RSA finally comes clean: SecurID is compromised - <AUTHOR> http://arstechnica.com/security/news/2011/06/rsa-finally-comes-clean-securid-is-compromised.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss <comment><USER2> Steve Gibson and Leo have been talking about this for weeks on the Security Now podcast. Interesting story if you'd like to listen. Amazing how a well known security company kept its crown jewels within reach general employees with Windows boxes. When are they gonna learn?

<comment><USER3> Not only that, they have employed a security-by-obscurity strategy:

 _RSA Security Chairman Art Coviello said that the reason RSA had not disclosed the full extent of the vulnerability because doing so would have revealed to the hackers how to perform further attacks._

<comment><USER4> In their "defense", keeping it secret might have had more to do with saving their public image than with any belief that it was actually better security.

</comment></comment></comment><comment><USER5> I've programmed some for OTP devices. Vasco primarily, but some RSA too. Normally, the OTP algorithm takes two args... a "shared secret" (each customer has a different secret) and the exact date/time. All the fobs and the back-end server know/share the secret.

On the fob thingy, one calculation occurs. The fob can be physical or virtual. So you may have a physical key fob or a virtual software fob for your blackberry, iPhone, Droid, etc. They even work with dumb phones over SMS. Either way, the same calculation occurs. Again, it looks something like this:

const unsigned int OTP ( const string& shared_secret, const time& time_of_day ) { return OTP; }

So when you push the button on the fob (or just look at it if it's the always on type), it returns an OTP. On the server, the exact same calculation occurs except that it calculates a range of OTPs (in case the time on the fob has drifted... and this does indeed occur). A minute or so worth of calculations. The fob's OTP must fall into the server's calculated range, if not, the OTP will fail and the fob will need to be recalibrated (resync its clock).

So, if this story is true, then the list of customer shared secrets was stolen and whoever has them now knows that company X uses secret Y on their fobs. It's hard to believe that RSA actually had a list matching company names to shared secrets unencrypted. I'm not sure I believe that.

<comment><USER6> > It's hard to believe that RSA actually had a list matching company names to > shared secrets unencrypted. I'm not sure I believe that.

If you don't believe it, what other attack/compromise do you suppose took place?

</comment></comment><comment><USER7> Our securid's from RSA were replaced weeks ago in mass. I work for a well known large company, is it just the news is late?

<comment><USER8> Yes the Lockheed Martin thing happened last month, it's just taken this long for RSA to publicly admit that it has a serious problem.

<comment><USER9> > It's taken this long for the RSA Lawyers to allow a public statement

Fixed that for you. Customers were notified and I believe many a secureid token was replaced, at least for all mission critical businesses.

That letter to the public would have been second to the priority of customer notifications, even sony was late in their press release -- carefully wording their response to forgo accepting blame. Since the attack was "thwarted" we can assume that RSA did in fact communicate with these businesses and shared the knowledge of the potential attack.

It's not a "serious problem" like if the fundamental cryptology is flawed or implemented with a level of security through obscurity. The only "serious problem" was storing seeds for some unknown reason. If your seed wasn't stored then you have nothing to worry about, and I can only assume if you were contacted by someone from RSA(personally) than you should probably assume your seed was stored.

One would hope that a business like Lockheed Martin then setup a honey pot to try and gather information on the attackers logging in with these compromised SecureIDs.

<comment><USER10> > The only "serious problem" was storing seeds for some unknown reason.

I read somewhere else that the seeds are stored by RSA as an additional backup for the customers. In the event that the customer accidentally loses their seed database, it would be a very costly operation to replace all the SecurID hardware tokens.

But... well... they are forced to replace all the SecurID hardware tokens anyway.

<comment><USER11> > In the event that the customer accidentally loses their seed database, it > would be a very costly operation to replace all the SecurID hardware tokens.

It'd be a very _profitable_ operation for RSA, so I doubt this explanation.

</comment></comment></comment></comment></comment><comment><USER12> There is fundamental issue about those kind of tokens. The customer is not able to renew or set the private key (seed in RSA terms) of their tokens. It's a kind of insecure business model where the customer has no control over the tokens and is bound to the security of the supplier (if the supplier is compromised...). There are solutions like Yubikey or other compliant HOTP/TOTP tokens where the customer has the control of the private keys inside the token.

<comment><USER13> True, but the positive fundamental property of these tokens is that it is very very unlikely that someone ever messes with your device without you knowing it. Which prevents a MITM attack.

<comment><USER14> But as we've seen that security is only as good as the security on RSA's servers. Imagine if someone more sophisticated had (has?) attacked RSA's servers and avoided RSA becoming aware, how secure would your token be then?

</comment></comment></comment><comment><USER15> Can anyone compare this to Google's two-factor authentication using the Authenticator App? The app is open source (<http://code.google.com/p/google- authenticator/>) and the private key(correct?) is provided via a QR scan.

<comment><USER16> It's the same concept, yes. And if the servers running the Authenticator at Google were hacked this system would likely be broken (but you'd also have much bigger problems)

<comment><USER17> there's no online component... your phone takes the current time (divided by some value), the secret key, and performs a cryptographic function on it, then the system you're logging into does the same thing and compares the results.

with secureid the secret key is fixed in the hardware (and RSA keep a copy of the key), whereas with Google authenticator you can generate and input the key yourself, so that Google never sees it.

<comment><USER18> > you can generate and input the key yourself, so that Google never sees it.

Google still needs to know the secret. All authenticators are based on a _shared_ secret model, so the same possible attack vector that bit RSA.

<comment><USER19> Right, but a compromise of your token for Google's services would not mean your token for your job was compromised as well. You could even generate a new key for each machine you connect to, if you were paranoid enough.

</comment></comment></comment></comment></comment><comment><USER20> This is one of those cases where I really hate NDAs.

</comment><comment><USER21> If I'm understanding this correctly, then an attacker still has to know which seed is linked to my token in order to use it?

Or can they reverse engineer that if they catch sight of one number?

Edit: Spelling

<comment><USER13> Quote from the article:

 _Sources close to RSA tell Ars that the March breach did indeed result in seeds being compromised. The algorithm is already public knowledge.

As a result, SecurID offered no defense against the hackers that broke into RSA in March. For those hackers, SecurID was rendered equivalent to basic password authentication, with all the vulnerability to keyloggers and password reuse that entails._

So they got a lot of the seeds and then were basically down to trial and error, similar to know passwords.

<comment><USER22> So the seeds are in fact equivalent to a signature made with symmetric keys... If the SecureID card used asymmetric keys with a truly private key, such incident could not have happened.

Using private keys stored in a hardware carried with the owner with a challenge Q&A seems more secure.

<comment><USER23> The SecureID device S computes S(s,t) without any input from the server the user is authenticating to. t is synchronized time and available to everyone. s is a secret specific to that device. I don't know if it's a shared secret, but the compromise suggests that either it is, or RSA kept the 'private key' part on their servers for convenience.

You're right that a different device S' that received a challenge c from the server and computed S'(c,s,t) could offer more security via public key crypto. But it would take more power (if communicating to the client machine to avoid user transcription of the challenge) or have a more cumbersome UI. I'll bet such devices are already sold.

</comment></comment></comment></comment><comment><USER24> Although RSA were absolutely at fault it seems like a design failure that the seeds cannot be revoked. Give the keys 4 possible seeds and put 3 of them in a safe. Security is about having defence in depth.

<comment><USER25> How do you update the tokens though? They need to be simple, no hooking into the internet.

<comment><AUTHOR> They could maybe have a single button that allows you to switch to a backup seed with some elaborate sequence of presses.

</comment></comment></comment><comment><USER26> This is nitpicky, but shouldn't the title (on Ars I guess, since it was used verbatim) be "was compromised" since this was a one-time data theft that rendered all currently-live SecurID tokens useless?

<comment><USER13> True, on the other hand there are still 40 million of those tokens out there, which are all compromised and have to be replaced. So that is still very much present tense.

<comment><USER9> It's hard to tell from the information given if ALL seeds have been compromised or just SOME which RSA may have been holding.

<comment><USER11> Given RSA's reluctance to come clean on this, I don't think anyone's going to trust "oh, but _your_ SecureID wasn't compromised" from them.

</comment></comment></comment></comment><comment><USER27> Funny thing that, I'm holding a SecureID token in my hand right now, having just remoted into the corp network via VPN.

Thanks RSA.

</comment><comment><USER28> It is sad how the comments here are much better than at Ars.

[I wish Ars would implement threading and a silent karma system]

</comment><comment><USER29> Didn't we know this when the breach originally occured? Or after there was a major break in?

Oh, it's "official" now. Good thing they were responsible about it.

<comment><USER30> Happened last month. [http://www.engadget.com/2011/03/18/rsa-hacked-data- exposed-t...](http://www.engadget.com/2011/03/18/rsa-hacked-data-exposed-that- could-reduce-the-effectiveness-o/) Lockheed Martin Breach [http://www.infoworld.com/t/hacking/lockheed-hack-should- put-...](http://www.infoworld.com/t/hacking/lockheed-hack-should-put-the-us- high-alert-329) (This happened a few weeks ago) I remember hearing it earlier.

<comment><USER29> Yeah, that was my point.

</comment></comment></comment><comment><USER31> Hm, defense contractors were attacked, and it's taken so long for RSA to acknowledge the compromise to the rest of the world? It's was most definitely perpetrated by a government, and it's taken so long for them to respond because _our_ government has been assessing the damage.</comment>


Saying "All Lives Matter" to Siri Now Redirects You to Blacklivesmatter.com - <AUTHOR> https://www.imore.com/saying-all-lives-matter-siri-now-redirects-you-blacklivesmattercom <comment><USER2> One of the greatest things in a democratic society is the right to protest about issues like this, which is very good for a healthy debate.

However when Tim Cook defended the decision to side with China and to censor and suppress the pro-democracy protestors in Hong Kong [1] and then support this one, it is quite extraordinary for this double standards from Apple to pick and choose their causes when both are exercising their right to protest against an injustice.

A very hypocritical one-sided stance from Apple.

[0] [https://www.macrumors.com/2019/10/03/apple-bans-app-used- by-...](https://www.macrumors.com/2019/10/03/apple-bans-app-used-by-hong-kong- protestors/)

[1] [https://www.macrumors.com/2019/10/11/tim-cook-defends- remova...](https://www.macrumors.com/2019/10/11/tim-cook-defends-removal- hkmaplive-from-app-store/)

<comment><USER3> It's not hypocritical at all, they don't need anything from Alabama rednecks, they do need the support of the Chinese government. The consistent principle behind both decisions is "Look out for Number One"

<comment><USER4> Hey you never know, one of those Alabama rednecks could grow up to be the CEO of Apple one day!

[https://en.wikipedia.org/wiki/Tim_Cook#Early_life_and_educat...](https://en.wikipedia.org/wiki/Tim_Cook#Early_life_and_education)

<comment><USER5> The irony of the comment you're responding to could not be more perfect.

<comment><USER4> My greatest fear in responding was that I'd somehow manage not to fully capture it.

<comment><USER6> #nailedit

</comment></comment></comment></comment></comment></comment><comment><USER7> I feel like your technology should be simply a set of tools that assist you.

If you're a "bad" person, logically your technology should help you be bad.

And if you're good, the same.

But never would I want my technology to inform me what is good or bad, or permit me one path over the other. That is my decision as the human in the relationship.

<comment><USER8> Technology is never neutral. It always reflects the biases of its creators, and of the social environment in which it's developed. Those biases may directly contradict the goals you expressed. For example, if self-driving car technology has racist biases, a "good" person may still end up on the inside of a car that chooses an escape route with a pedestrian of color in its path over an escape route which has no pedestrians.

Neutrality is a myth. Actively promoting values and challenging biases is preferable. You don't have to agree with the values promoted, and you're welcome to choose not to use the technology.

<comment><USER7> Your Siri unit should not be altering your commands.

It is that simple.

<comment><USER8> It does all the time. It has since before it was acquired by Apple.

<comment><USER7> This is a deliberate blacklisting of a command based on a political agenda.

Technology is built in service to mankind.

<comment><USER8> "Black lives matter" is not a political agenda, it is explicitly a service to mankind.

<comment><USER9> This is a fantastic demonstration of what Zizek means when he talks about modern ideology.

> _For subjects to believe in an ideology, it must have been presented to > them, and been accepted, as non-ideological indeed, as True and Right, and > what anyone sensible would believe. As we shall see in 2e, Žižek is alert to > the realist insight that there is no more effective political gesture than > to declare some contestable matter above political contestation. Just as the > third way is said to be post-ideological or national security is claimed to > be extra-political, so Žižek argues that ideologies are always presented by > their proponents as being discourses about Things too sacred to profane by > politics. Hence, Žižek's bold opening in The Sublime Object of Ideology is > to claim that today ideology has not so much disappeared from the political > landscape as come into its own. It is exactly because of this success, Žižek > argues, that ideology has also been able to be dismissed in accepted > political and theoretical opinion._

[https://www.iep.utm.edu/zizek/#Ha](https://www.iep.utm.edu/zizek/#Ha)

I think it's actually fairly concerning that the fault lines between ideologies seems to be deepening - people seemed more and more convinced that their positions are absolutely not even contestable. I'm not sure where there is room for civil political discourse and positive change in this kind of scenario.

<comment><USER7> Yep - exactly right, I shouldn't have responded to it - I knew it was coming from the top level post.

That thought process is absolutely poisonous for technology - it's like a viral brain-lock.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> "All Lives Matter" is Racism 1.0 thinking.

But Racism 2.0 has been pushed out and – in some ways – it's a forced upgrade.

Racism 1.0 was widely understood: racists were bad people who made monkey chants on football terraces. It was "the nice people" vs "the mean people". If we "raised awareness", maybe one day it would be "stamped out".

Racism 2.0 is more complex.

It's structural and systemic, so for the first time a lot of of white progressives are discovering that we're part of the problem. Saying "I don't see colour" is suddenly the wrong thing to say. For a long time it was the correct thing to say and think.

People are having to re-learn stuff they thought they already knew and not everybody is thrilled.

Worse, Racism 2.0 is closed source. The code isn't really published anywhere, at least not in simple language. You have to kind of piece it together yourself from lists of "resources" thrown together by activists, some of whom have opaque agendas.

It's not as simple as it used to be, and it's not surprising that some people are confused.

<comment><USER11> We were recently asked by management to stop using the words _whitelist_ and _blacklist_ , as they are seen as being "hurtful". No real idea how to react to that, given that they are terms of art (and of course, were never any sort of reference to race).

I suppose it's pretty much like most management edicts that come down over time. Just nod your head, keep your mouth shut, and with any luck it will all blow over in a month or two.

<comment><USER3> I think a lot of this goes too far, but I do agree with whitelist and blacklist. In all aspects of our lives we use "white" to describe things that are good and "black" to describe things that are bad. That movie is "dark." It has a "black-hearted" villain.

While that phenomenon does not have its origin in racism, I do think it reinforces it. I've moved to allow-list and block-list on my company's recommendation. I only remember to do it about 50% of the time, so I'm glad that it's not being policed, but rather a constructive suggestion.

<comment><USER12> Ok what about your balance sheet being in the black? Should that be neutralized too?

I think it's going too far. If you want to do something for people go out and help them. Devote time to kids, provide mentorship, etc. This other superficial stuff only satisfies misguided activists and does nothing for affected kids.

Here's the thing. It's easy to find someone or something to pillory. It's time consuming and hard to get on the ground and help. People love "showing" how good they are, but rarely act on it in real life with hard effort —that's too much work.

As Zizek says, what happens the day after (the revolution)? Everyone is enamored with the effervescence or revolution being the good guys... but no one wants to do the hard work. Everyone's life has to go on when you get back to reality.

<comment><USER13> I generally don't like the way these discussions play out because there is plenty of vocabulary we've changed over time when it becomes less palatable to the contemporary taste. It's easy to pull out all of the more innocent examples of the word while ignoring the perspective of those who don't appreciate it.

There are definitely instances of taking it too far, and they tend to be the ones that get disproportionate attention because they generate easy outrage. But in all honesty, if what we're seeing happen right now is progress towards a fairer society, I'd rather not stand in the way of it just because I'm used to having 'master' as my main branch on git, and I'd prefer to have the people most directly affected make their voice heard on this kind of thing.

<comment><USER12> So no "maître d'" no "maistro", "meister" either... or is there a line somewhere?

Am I not my dogs master? I mean, of course it should not be used to show relationships between people, but relationships between things or people and animals, I don't see an issue.

<comment><USER13> I don't think reductio ad absurdum is an appropriate reaction. Nobody is banning those words wholesale.

<comment><USER12> Of course no one can ban a word. Words exist independently of any authority... that said, it's not an absurd proposition to think people will want to control those words for their own reasons. I don't think my examples are a stretch given that it's a stretch to tie conceptual data relationships to human relationships and see something untowards in it.

Do we change the name for "Slavic" people too because it harkens back to their history where Slavs were the default slave people in Western Europe and the origin of the word's English meaning?

If anything, Slavs would have a point as it unfairly defaults them as being slaves etymologically.

<comment><USER13> I might well be wrong but this kind of authority over the use of language seems to be much more US-specific than I've seen elsewhere, which you could attribute to the overall dominance of US people in the places where these discussions tend to crop up (github, HN, Reddit, Twitter, Tumblr, etc.).

I don't really know what to make of it except that these discussions about not using 'master', 'cop', etc. seem _heavily_ biased to the US perspective and current affairs in the US. I can understand it taking place due to the sheer cultural upheaval that has (quite frankly) been a long time coming, but my mild frustration about `US === the whole wide world` can take a step aside while we focus on the injustices fellow humans face.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> I'm really tired of this American centric hysteria. The world doesn't care. Please resolve this domestically.

Yes I'm aware of the Atlantic slave trade - it was despicable and shameful.

<comment><USER15> America isn't the only place that the Atlantic slave trade occurred. It's not the only place where blacks (and others, like Muslims) have been/are persecuted in greater numbers than the "indigenous" populations.

<comment><USER14> > It's not the only place where blacks (and others, like Muslims)

Ever heard of Arab slave trade?

<comment><USER15> Hence my attempt (perhaps insufficient) to not say that "only" Black lives matter in this case. I'm also not infering that the BLM movement has been saying anything like that in the first place.

<comment><USER16> Arab slave trade does not refer to arabs being slaves but rather to people from north africa, south europe, and eastern europe being traded - so, caucasians.

<comment><USER14> Yes - Arabs (predominantly Muslims) are responsible for slave trade comparable in magnitude to Atlantic slave trade.

</comment></comment></comment></comment></comment></comment><comment><USER17> Oh Tim... I beseech thee, please stop with your divine virtue signaling from upon high.

</comment><comment><USER18> Wikipedia says there has been a poll in august 2015 regarding ALM. And "78% of likely American voters said that the statement All Lives Matter was "close[r] to [their] own" point of view than was Black Lives Matter.

Yet, everyone seems to agree that ALM is now a racist move? I am racist if I believe that all people should be treated equally? Those that utter the phrase are accused of subtly trying to transport a message which is anti-black? The longer I read about it, the more I hate identity politics. If I honestly believe that BLM is to restricted a phrase, I am now being accused of being racist because I dont explicitly support BLM? This is madness. Why do activists persue radical and extremist paths which eventually reduces the support they get from the political middle?

<comment><USER19> I'll assume you're not intentionally misunderstanding ALM vs. BLM. ALM is the base assumption that we all agree with. But imagine if we were in our happy ALM world, but "B" kept getting shat on. BLM is a response to that, to say, "Hey, BLM too!" If it helps, think of it as an asterisk. "*BLM too." BLM is not exclusive, it's an interjection.

Also, these thoughts aren't mine (though they were obvious to me from the start), they're fully Googleable.

<comment><USER18> No, I am not intentionally misunderstanding something. How do you even do that?

But I still done get the word wrestling. From my POV, ALM is not exclusive. But if someone accuses me of being racist just because I am using a phrase that has somehow been declared unwanted by a select few, all they are achieving is that they reduce my willingness to support their rallies.

Language police is horrible. I know it from first hand. I am blind. And since about 10 years or so, I notice that more and more people feel like they are not allowed to use the word blind while I am around. It is pretty clear why they do that. They are afraid of stepping on someones toes and being shunted for that. Now, all that has been achieved by this is that people feel more awkward around me, because they no longer know how to talk about my condition. They find all sorts of phrases to make sure they never mention the supposedly bad word. However, fuck it, I AM BLIND. Policing the language does not improve my situation at all. In fact, it worsens it.

</comment></comment></comment><comment><USER20> This is extremely concerning. People's hardware should not be remotely edited to broadcast political slogans, even if this particular slogan is a good one.

<comment><USER21> People are free to not use Apple hardware.

<comment><USER20> I don't think that really mitigates the concern. If my microwave started saying "support our troops!", I wouldn't be comforted by the fact that I can throw it out and get a different one.

<comment><USER22> But your microwave doesn't connect to an online service that you don't pay for. Nobody is forcing you to use Siri, or any of Apple's online services. It's more similar to a website you use saying "support our troops." If you don't like using an always-online constantly updated service, then you have the option to not use it. You pay for the convenience of Siri's knowledge and functionality by giving up any control over how the system responds and acts. You can always turn your internet connection off when you use Siri, and thus only use it for things like playing and pausing music.

<comment><USER20> Well, it doesn't yet. I suppose my smart refrigerator would have been a better example. As more and more components of our lives get a screen and Wifi connection, we're going to need better norms than "online services can do whatever they want".</comment></comment></comment></comment></comment>


What "Hollywood Accounting" teaches us about management risk - <AUTHOR> http://revenuetrades.tumblr.com/post/10119543092/hollywood-royalty

<comment><USER2> What is there to predict when the whole game is fixed? The article seems to acknowledge that the game is fixed but then continues on like it is not.

<comment><AUTHOR> You can fix the game of declaring profit, but you can't fix the game of revenue. And therein lies the problem: management risk represents the ability of a business to draw a profit from revenue. Tax-flight and profit-sharing shenanigans represent the management risk of dishonesty, though more often management risk is the aptitude of a manager to run the business well.

The businesses we are working with (I'm with RT, wrote the post) aren't films. They're startups and operating businesses. And we believe royalty financing has more scaling potential in a massive crowdfunding marketplace than equity financing. Removing management risk makes crowdfunding more viable.

</comment></comment><comment><USER3> I think this is a misleading article in the sense that all movies lose money, due to the way they are structured.

I'm no expert on the financing of the entertainment business but I do remember a podcast on npr talking about this:

[http://www.npr.org/blogs/money/2010/05/the_friday_podcast_an...](http://www.npr.org/blogs/money/2010/05/the_friday_podcast_angelina_sh.html)

<comment><AUTHOR> I'm not making a point that film investing is good or bad. I submitted this to HN because the audience is tuned to startup and business perspectives.

From an outsider's PoV, it is counter intuitive that these major films are technically not profitable. We aren't as surprised by their revenue, and that is the point: in the example of those films, revenue would have been easier to predict than profit.</comment></comment>


Uber's Employee Ratings Put Women at a Disadvantage, Suit Says - <AUTHOR> https://www.bloomberg.com/news/articles/2017-11-08/uber-s-employee-ratings-put-women-at-a-disadvantage-suit-says <comment><USER2> I think this is a more issue of "Stack Ranking", which by itself should be illegal, but somewhat it is still legal.

While pretty much all employment in the US is "at will" employment, "good faith" is assumed in the system....

Stack Ranking by default is a "bad faith" system, where the employer, will fire people, even though the employees were good performers (if you are in a team of all good performers, it is common place that stack ranking punishes good performers/employees as well).

It is very similar to the "decimation" system that the Roman Army practiced, when a particular unit or legion performed bad or cowardly in battle, one in ten was chosen (via short sticks), and culled to death by their companions. Very brutal, and can't see how it improves morale even if the unit itself is actually performing well. (which stack ranking is, constant decimation). This causes rampant politicking and favoritism to the point that systematic discrimination arises from it.

<comment><USER3> Stack Ranking seems like it should be a perfectly legal method of performance management. You might choose to not work at a company that practices it, but why should it be illegal?

It is perhaps a natural fear that a Stack Ranking system would lead to a "Rank and Yank", but the mere ordering of employees during a performance management process doesn't give me any particular concern, nor do I consider it a bad faith system.

In fact, it forces people to make a sometimes hard choice, which I believe has more benefits than drawbacks to an organization, else you run the risk of having a massive "undifferentiated middle" and no clear development plans because you have no feedback from rich discussion about why Jane is better than Joe; instead Jane and Joe are simply declared to be equal without any discussion about what Joe could do to improve or what Jane should continue doing, etc.

<comment><USER4> Microsoft used stack ranking for some time and from what I've read it caused a lot of problems and was considered to be negative overall. It led to a cutthroat environment where employees were competing with each other (and not focusing on doing their best work) so that they would get a good ranking [1]. According to reviews on Glassdoor, it's still used unofficially for their 6-month reviews [2]. Amazon also used it for a time [3] and has since abandoned it.

1: [https://www.vanityfair.com/news/business/2012/08/microsoft-l...](https://www.vanityfair.com/news/business/2012/08/microsoft- lost-mojo-steve-ballmer) 2: [https://www.glassdoor.com/Reviews/Microsoft- stack-ranking-Re...](https://www.glassdoor.com/Reviews/Microsoft-stack- ranking-Reviews-EI_IE1651.0,9_KH10,23.htm) 3: [http://www.nytimes.com/2015/08/16/technology/inside- amazon-w...](http://www.nytimes.com/2015/08/16/technology/inside-amazon- wrestling-big-ideas-in-a-bruising-workplace.html)

<comment><USER3> We also used it in the past (pure ranking, no rank-and-yank) and have since abandoned it.

I thought it was effective in forcing deeper conversations as part of the comparison process, but became unwieldy and unworkable when we passed about 50 engineers which was a long time ago, so I'm not sad to see it go.

</comment></comment></comment></comment><comment><USER5> Tldr: the claim is that when male managers are faced with stack ranking employees, they will often choose male reports over female reports due to sexist bias.

<comment><USER6> I think a simpler and better claim would be that:

When managers are faced with stack ranking employees, they will often decide based on factors not purely related to the productivity or value of the employee.

\----

That, and as an employee in a stack-ranked organization, you know you need to be competitive. Not in terms of productivity but in terms of "in the eyes of your manager"\-- Perception is more important than performance.

Studies have shown that men compete more aggressively than women, on average. So it's certainly plausible that men enjoy a gender-driven advantage that isn't purely due to gender-discrimination. Rather, it is the system that is biased.

This reminds me of that "racist algorithm" debacle.

<comment><USER7> >Studies have shown that men compete more aggressively than women, on average.

Studies have also shown that when women exhibit identical "aggressive" behavior as men, they are labeled more negatively than their male counterparts.

<comment><USER8> Studies have also shown that social psychology is a morass of irreproducible results, so without links to detailed descriptions of their methodologies and hostile verifications, it's reasonable to be skeptical of these claims.

</comment></comment></comment></comment><comment><USER9> Many of my friends have stopped using Uber in favor of Lyft. Is this a real trend, or just something I see in Silicon Valley tech circles?

<comment><USER10> Lyft aren't even available in most places that Uber are, so I can't see it being much of a wider trend.

<comment><USER11> Is this referencing outside the US? I travel very frequently to both rural and urban areas in the US and have yet to find a place where I could not Lyft, but could Uber.

In fact... I have only been to one place where I could not Lyft, and it turned out I also couldn't Uber (very rural).

<comment><USER10> Yes I don't think Lyft is available outside the US at all is it? I couldn't even use it when I was in the US as I don't have a US phone number.

</comment></comment></comment></comment><comment><USER12> Is it possible to create a performance review system that somebody won't complain is sexist?

<comment><USER13> Obviously, yes.

Problems like this are endemic to zero-sum schemes like stack ranking.

<comment><USER12> How?

Edit: The parent post was edited.

Are other employee evaluation schemes free of appearance of sexism (or actual sexism), or is it harder to see?

<comment><USER13> The edit wasn't necessary to support the first sentence. There are thousands of tech companies, large and small, and most of them monitor employee performance. Meanwhile: allegations of sexist bias in review processes are infrequent enough to be newsworthy. QED.

<comment><USER12> A quick google immediately shows pages like this one [] which frets about sexism without including the words "stack" or "ranking." It has the usual citing of questionable concepts like implicit bias, or the Bloomberg article's "unconscious bias."

What I would like to know is, suppose you need to make a system in a large organization in an attempt to lay off your 10% worst employees. It's pretty reasonable to expect sexist rankings, even made by non-sexists, and to also expect beliefs by individuals, wrongly held, that their personal low rank was the result of sexism. How do you determine whether an organization's ranking system is sexist, in which direction, and by how much?

[] [https://blog.impraise.com/360-feedback/how-performance- revie...](https://blog.impraise.com/360-feedback/how-performance-reviews-are- reinforcing-gender-bias-5-steps-to-fight-against-it-performance-review)

Edit: By non-sexists, I mean, like, non-garbage people.

<comment><USER13> You asked a simple, straightforward question with an easily obtainable answer, which I provided. I'm not interested in the new tangent you're trying to start here, sorry.

<comment><USER12> Yeah but your answer was so weak, talking about lawsuits that have made the news. I have also seen, personally for example, allegations of sexism regarding employee ratings that didn't turn into a news article about a lawsuit. That means you can't use notoriety of lawsuits to precede the use of "QED."

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> At this point, any company that thinks stack ranking is a decent idea just needs to die.

<comment><USER15> I wouldn't go that far, but I agree stack ranking is a really bad idea.

Uber seems to be full of bad ideas, so maybe it's a good fit.

<comment><USER6> Maybe Uber is like an organizational Gaspode[1], in which so many bad ideas are all running amok at once that it all keeps working, somehow.

[1]: [https://wiki.lspace.org/mediawiki/Gaspode](https://wiki.lspace.org/mediawiki/Gaspode)

>is only still alive because the various diseases are too busy fighting each other to kill him

</comment></comment></comment><comment><USER16> Why not normalize the rankings? It seems that at volume, that sexism should be the only remaining factor when looking at overall averages. Unless you really believe that "women are worse drivers". Normalize them to the average for each sex.

<comment><USER17> This is talking about employees, not drivers, and you cannot "normalize" stack ranking. The whole point of stack ranking is you're putting the employees in order from best to worst. They're not given numeric ratings.

<comment><USER16> Guess I should RTFA :)</comment></comment></comment>


Apple now has more cash than the U.S. government - <AUTHOR> http://thenextweb.com/apple/2011/07/29/apple-now-has-more-cash-than-the-u-s-government/

<comment><USER2> Saying that Apple has more _cash_ than the treasury is misleading. The apple numbers are based on total assets (including property for instance) whereas the treasury numbers are based on liquid operating budget.

Im sure that the treasury would have a good leg up on apple if it was allowed to add the value of the governments property to the mix.

</comment><comment><USER3> which is maybe not saying much :oP</comment>


Ask HN: Why is the design of hackernews that terrible? - <AUTHOR> Seriously, why is the design of the hn page that shitty?
I mean, if you open up a page with lots of comments and replies, you can't see the forest for the trees.
And on the other hand, it wouldn't be too difficult to design a page with better UX. <comment><USER2> I love the hacker news design. It loads fast even when the internet connection is awful, and since it's pretty much plain text, I am free to resize my text window to the extent of my needs.

<comment><AUTHOR> Fair point, but there are very lightweight css frameworks out there that are well suited for mobile.

</comment></comment><comment><USER3> I have a similar complaint -- I think narrower columns would do a lot to help the reading experience. It is better on mobile, though!

<comment><USER2> Why artificially restrict my reading area? If you want a smaller reading area, use a narrower browser window. The width is particularly valuable/important because of the tiered comment structure.

<comment><AUTHOR> That the problem, if you have no nested replies, you need small browser window. But if the next comment has lots of replied, you need to resize the windows, again. Moreover, I may not want to make my browser window smaller because other tabs run fine with my current width.

</comment></comment></comment><comment><USER4> Within the first 30 days, dang will give you a full refund on request.

</comment><comment><USER5> for one thing, because pg doesn't consider UX to be relevant.[0] This site is meant to appeal to the sort of programmer who is comfortable working in a terminal, after all, so it shouldn't matter to a "good hacker."

[0][https://news.ycombinator.com/item?id=5025176](https://news.ycombinator.com/item?id=5025176)

that said, apparently collapsible comments at least are on the way... eventually[1].

[1][https://news.ycombinator.com/item?id=8297695](https://news.ycombinator.com/item?id=8297695)</comment>


Beijing to Shut All Major Coal Power Plants to Cut Pollution - <AUTHOR> http://www.bloomberg.com/news/articles/2015-03-24/beijing-to-close-all-major-coal-power-plants-to-curb-pollution <comment><USER3> I really wish that articles like this would give more context for all the numbers that inevitably get thrown around.

> China Huaneng Group Corp.'s 845-megawatt power plant

What percent of the city's electricity is that?

> Beijing plans to cut annual coal consumption by 13 million metric tons

How much less soot will actually be in the air? Will the city feel noticeably cleaner?

> China planned to close more than 2,000 smaller coal mines from 2013 to the > end of this year

How many coal mines does China have?

> The level of PM2.5, the small particles that pose the greatest risk to human > health, averaged 85.9 micrograms per cubic meter last year in the capital, > compared with the national standard of 35.

What is considered a safe level? What is considered acceptable in Europe/the US?

I know that researching all that would take longer than just throwing up the facts from the press release. But without that context, it's hard to know whether this is really a big deal or just a normal retirement of older power plants for newer, cleaner alternatives.

<comment><USER4> "I really wish that articles like this would give more context for all the numbers that inevitably get thrown around. > China Huaneng Group Corp.'s 845-megawatt power plant What percent of the city's electricity is that?"

Humanity uses about 17 terawatts of generated power (electricity plus transportation plus …), about 15 from fossil fuels, of which coal generates more GHG that all but the dirtiest oil and the leakiest NG facilities. That plant is probably used about 80% of the time, so it represents about 675/17,000,000 of humanity's power use and something like twice that much of our GHG generation.

We think we can generate about 500GT CO2e of GHG net before reaching 3°C warming (but that involves a lot of guesses), which is a level that seems civilization-destablizing to many observers (wild, but necessary guesses). Coal creates about 1kg per kWh, so convert from 675MW … 60sec _60min_ 24h _365d_ 675,000kW = 21,286,800,000,000 kg/yr, or ~21GT/yr, or 4% of that budget.

<comment><USER5> is the budget yearly?

<comment><USER4> The 500GT budget is total. That plant is using roughly 4% of our let's-not- wildly-destabilize-civilization GHG budget every year. We've got about 30 years to radically restructure our energy use. More here (among many places): [http://www.ipcc.ch/report/ar5/syr/](http://www.ipcc.ch/report/ar5/syr/)

<comment><USER6> Are you sure this is right? There must exist more than 25 coal plants in the world? Do we expect to hit this budget w/in a year? Is this coal plant much bigger than most others?

<comment><USER4> [Edit: an up-to-date piece focusing directly on the carbon budget: [http://www.theguardian.com/environment/keep-it-in-the- ground...](http://www.theguardian.com/environment/keep-it-in-the-ground- blog/2015/mar/25/what-numbers-tell-about-how-much-fossil-fuel-reserves-cant- burn) ]

There are a lot more than 25 coal plants in the world, and we must stop using them very very soon. Here's an EPA-citing source claiming 1 Gt coal -> 1.8 Gt CO2e, and 3.5 Gt used by China in 2011, the latter amounting to ~6.5 Gt CO2e, and ~20% of world emissions that year. [1] If Chinese coal use is now about the same, and if we have 650 Gt left before some particular nasty tipping point is reached, then China's coal is currently using that budget at a rate of 1% a year. There's a lot of uncertainty in the rate measurements, and significant uncertainty in the tipping points, but there is no uncertainty that world will be like nothing humanity has ever seen at 500ppm CO2, and we have no reason to think that, say, Pakistan, India and Bangladesh can adjust smoothly to regular high temperatures of 54° with sporadic heat waves at 57°, or that America and the US can smoothly adjust to most of the farmland that currently feeds them becoming unusable and most of the fisheries collapsing.

Finally, note that we're not going to get to near carbon-neutrality in 30 years by dropping radically next year, continuing at a flat 1/30th of our budget for 30 years, and then dropping to 0. Any plausible route will accelerate GHG reductions something like linearly.

[1] [http://www.sourcewatch.org/index.php/Existing_U.S._Coal_Plan...](http://www.sourcewatch.org/index.php/Existing_U.S._Coal_Plants)

<comment><USER4> Oh, note that @voodoomagicman was right; 4% for one coal plant was off by a factor of about 100, mostly b/c I overestimated how much coal it used.

<comment><USER5> Ok, thanks for the info, now I have a better sense of proportion. So that means that 25 years brings it to 1% globally. I see how breaking the cap might not be totally inevitable but it doesn't seem very evitable either. I think we could see a major food price increase in our lifetimes.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> If any country has a chance at implementing nuclear power on a widespread scale, I think it's China. In America, the primary reason we don't use nuclear power is driven primarily by the negative perception and fear of the word "nuclear" (with a bit of help from the fossil fuel lobbies). One of the advantages of the one-party state is if the party wants something done, that thing will get done, no ifs, ands, or buts. China's rail network is an excellent example of this (and that's another thing we've failed to implement stateside due to political gridlock). Should China decide that nuclear is the way to go, then it will be done.

<comment><USER8> Yes, we all saw how well this worked at Chernobyl. Single party rule - no ifs, ands, buts or coconuts.

There's no subsitute for democracy and people holding their governments accountable.

<comment> steve-howard We've learned a lot from and since Chernobyl. Chernobyl came about because the people running the plant made a string of willfully stupid decisions to try out a safety feature for the plant. This isn't to say that democracy isn't superior to single-party rule, but that no one would invest in building a modern nuclear reactor and play fast and loose with safety procedures.

<comment><USER9> Arguably the people who _built_ Chernobyl also made a willfully stupid decision to leave out passive safety features:

[http://en.wikipedia.org/wiki/Passive_nuclear_safety](http://en.wikipedia.org/wiki/Passive_nuclear_safety)

</comment></comment></comment></comment><comment><USER10> Oh, just the _city_ of Beijing. For a moment there, I thought it's the whole country. That would have been... very consequential.

<comment><USER11> Imagine the effect that would have on Australia.

<comment><USER12> That comparison seems slightly disingenuous, only for the fact that Australia's size vs population is very disparate. The majority of the area isn't even populated at all -- as in, not even rural sustenance farmers live there. [0] Localized air particulate pollution is very much a matter of local energy generation density, which is going to be closely related to local population density.

[0] [http://www.abs.gov.au/AUSSTATS/abs@.nsf/Latestproducts/1270....](http://www.abs.gov.au/AUSSTATS/abs@.nsf/Latestproducts/1270.0.55.007Main%20Features12011?opendocument&tabname=Summary&prodno=1270.0.55.007&issue=2011)

<comment><USER13> I think borgia is referring to our coal exports to China being lucrative, and their removal would hurt.

We have a lot of coal. Here in Victoria, we have a ridiculous amount of low- grade coal that's not good for exporting. One power company CEO once said in a radio interview that if you want to convince him of a new technique to use less coal for whatever reason, don't frame your argument around fuel price - the coal is effectively free.

</comment></comment></comment></comment><comment><USER14> The biggest challenge China is facing is its management structure. It's a "一刀切" (decisions and executions are basically boolean-value-like things). The lack of effective and elastic delegate mechanism makes the organization look like an elephant that can not dance. It's easy to find examples from the time zone management (all regions in China are using the same time zone) to recent campaign of youth soccer. I know what I said here is off topic, but it might add some context for this topic.

<comment><USER12> For others curious like me, Google translates "一刀切" as "one size fits all".

</comment></comment><comment><USER15> The article mixes a few things. CO2 emissions are climate change relevant, but for pollution in Beijing there are other emissions from these coal power plants responsible. Modern coal power plant have much lower emissions in general, but not for CO2. Probably the coal power plants are so old, that it is not effective to modernize them with modern filtering systems, higher efficiency, etc.

<comment><USER16> Many of those plants are decades old, and poorly managed. But they're also ran by state owned companies which means there's no market incentive towards efficiency and a huge amount of politics regarding what you do. I worked almost 10 years ago for a European company doing district heating in China. In a smaller city in the north of China, they were able to replace the 19 existing coal plants with a single one.

</comment></comment><comment><USER17> China probably has more shale-gas than the USA, but has been slow to develop it. Cheap shale gas in the US has cut US coal pollution in half. Shale gas development is extremely expensive. This one area where China's hybrid state- private enterprise system is not as nimble as the United States.

</comment><comment><USER18> Excellent news, though I wonder if the hydroelectric/wind/solar replacements they mentioned will be sufficient to meet the demand.

<comment><USER19> from the article "The facilities will be replaced by four gas-fired stations with capacity to supply 2.6 times more electricity than the coal plants."

</comment></comment><comment><USER20> Catching up to London in the 1930s...or was it 1950s?

Burning lots of coal in dated power stations next to a city is a bad idea for the residents health.

<comment><USER21> Until 1983: [http://en.wikipedia.org/wiki/Battersea_Power_Station](http://en.wikipedia.org/wiki/Battersea_Power_Station)

Edit: I don't understand the downvotes; my point is that the last coal-fired powerstation in London was closed a lot more recently than people might think.

<comment><USER22> That was a pretty interesting link - I had no idea of the explanation as to why Battersea power station was that shape!

There was a quite large coal fired power station operating close to Edinburgh until very recently (2013):

[http://en.wikipedia.org/wiki/Cockenzie_power_station](http://en.wikipedia.org/wiki/Cockenzie_power_station)

<comment><USER21> Yup, although that's not nearly as "in" the city as Battersea.

Every time someone mentions wind turbines "spoiling the view", I show them a photo taken looking along Portobello beach. In the far distance a few white single-pixel turbines are visible. In the medium distance is Cockenzie, which is _on the seaside_ and visible from miles around.

</comment></comment></comment></comment><comment><USER23> Is it in response to that viral video [1] on air pollution that got banned a couple of weeks ago? Nice move.

[1][https://www.youtube.com/watch?v=T6X2uwlQGQM](https://www.youtube.com/watch?v=T6X2uwlQGQM)

</comment><comment><USER24> There was an interesting data synthesis piece of music this week:

[https://vimeo.com/122603843](https://vimeo.com/122603843) "Air Play - <USER2> Music Created With Beijing Air Quality Data"

</comment><comment><USER25> While China's pollution is among the worst you can get, the country does have the advantage of being run like a corporation, and when they decide to clean it up, they will do it very quickly. I guess, I hope, that within 30 years, many parts of China that are currently "horribly polluted" will be as clean, or cleaner, than cities in "the already developed places" such as Europe or N. America which themselves had horrible pollution at one time.

<comment><USER26> The government isn't really that efficient or centralized. The top bosses in Beijing say X, and that gets filtered down and translated through 10-20 Confucian layers of beaurcracy, at the bottom, the emperor is far away, as they say. And corruption...if everyone breaks the law, you are at a disadvantage if you don't also, and will simply go out business. China will have to improve their governance significantly if eg have any chance of cleanup the air. Xi jinping is treating corruption and pollution as two sides of the same coin at least.

LA in the 70s is nowhere near as bad as hebei/Beijing is today. Maybe London in the early 50s....it's hard to say.

<comment><USER27> The fact that the top bosses do breathe the Beijing air is the biggest reason to be confident it will be cleaned up.

<comment><USER26> They send their families to Europe and the US, becoming "naked officials." I doubt many of them spend much time in Beijing these days; they all have retreats where the air is clean, as well as very good air filters when they are Beijing (official use was used as an advertising point until the CCP shut that down).

</comment></comment></comment></comment><comment><USER28> Someone has been learning something from playing Cites: Skylines.

</comment><comment><USER29> +1 for cutting coal burning, -1 for DDoS attack on GitHub. China is at par today.

<comment><USER30> Right. Those are totally equivalent.

<comment><USER31> At least they didn't fly in heavily armed police to shut it down like the USA did to Mega.

<comment><USER32> The raid on Kim Dotcom was performed by NZ police, not American police.

[http://en.wikipedia.org/wiki/Megaupload#Arrests_in_New_Zeala...](http://en.wikipedia.org/wiki/Megaupload#Arrests_in_New_Zealand)

<comment><USER33> It's hyperbole to say the U.S. flew in people for the arrest, but it's also splitting hairs to say it was just the NZ who arrested Mega.

</comment></comment></comment></comment></comment><comment><USER34> This seems very uncharacteristic of China. The residents of Beijing have been told by the government for years that if you don't absolutely need to be outside, then don't go outside. This is the first I've heard of China putting anything before growth.

Unrelated, but this gives me hope that they might crack down on counterfeiting soon.

<comment><USER32> Growth requires citizens not dying of air pollution. I don't really see this as putting something before growth.

<comment> teach-me Weak citizens dying of air pollution quickly and being replaced by healthy strong new recruits from the hundreds of millions living in the China villages.

Very similar the recipe for big cities in Europe before the industrial revolution. There was no canalization, food had to be brought on horse cars without refrigerators from vast areas, making it decay. A dozen people per room, resulting in fast spreading of viruses and bacteria.</comment></comment></comment>


Differential Diagnosis - <AUTHOR> https://en.wikipedia.org/wiki/Differential_diagnosis <comment><USER2> I wonder if there is a formalism out there that relates medicine's differential diagnosis to engineering's fault tree analysis [1]

[1]: [https://en.wikipedia.org/wiki/Fault_tree_analysis](https://en.wikipedia.org/wiki/Fault_tree_analysis)</comment>


In China, Techies are Dogs - <AUTHOR> http://inchinatechiesaredogs.pen.io/

<comment><USER2> 2 reasons why:

1\. In China, copying is better than innovating. If you copy, you have no risk, because you _will_ make money by undercutting your competition. If you actually innovate, there's a lot of risk, and the potential upside just won't justify the risks. So techies are useless (except for reverse engineering foreign tech - and cutting costs). Now that the US and Japan are possibly cheaper after accounting for better productivity (guess those techies aren't worthless) and stabler conditions, this will change.

2\. China is capital constrained. You can't start a business because getting money is too bloody hard. Sure, you can get a bank loan, but the banks only loan to SOEs. So bosses get a lot more money than plebs. Once again, this is changing, but not as fast.

</comment><comment><AUTHOR> resubmitted with a fixed URL</comment>


Jamendo launches new Creative Commons music API with a $2500 contest - <AUTHOR> http://developer.jamendo.com/contest?hn

<comment><USER2> Took forever to find out what Jamendo actually is.

From their Facebook: "Jamendo is the world's #1 platform for free and legal music downloads under Creative Commons licenses. Available in eight languages, the site offers a catalog of over 350,000 tracks/ 60,000 albums/ 50,000 artists!"

And from G+: "The entire catalog is licensed under Creative Commons, allowing artists to publish their music and preserve their rights while providing users the freedom to download it for free."

</comment><comment><USER3> More details on the prizes:

Jamendo Innovation Award Winner: $1,000 Runner-up: $500 Winners will be chosen by the Jamendo team.

Community Award sponsored by GitHub and 3scale Winner: $500 + a GitHub 2-year Medium plan (for a single winner) or a 1 year Silver account (for a team) Runner-up: $500 + a Sonos Play:3 HiFi Player offered by 3scale The winning app will be the most voted by the Jamendo users.

</comment><comment><USER4> Good luck to all the participants :)</comment>


Using Multiple Author Identities with Git - <AUTHOR> http://www.thecodedself.com/Using-Multiple-Author-Identities-With-Git/ <comment><USER2> I always wondered why git doesn't support hierarchic config locations… My homedir looks like this:

      ~/code-repositories/
         +---$company/ (my work related repositories)
         +---private/  (my personal non-public repos)
         +---public/   (my clones of public FLOSS repos)

So I'd simply like to drop a `.gitconfig` with the default user for all repos below this location into each of those 3 directories, but instead I have to make sure for every freshly clone/initiated repo to configure the author etc.

</comment><comment><USER3> I use Karn for this: [https://github.com/prydonius/karn](https://github.com/prydonius/karn)

</comment><comment><USER4> I only recently discovered the local "current repository" configuration option, but I still need to verify which identity I'm using before a commit.

It makes sense not to set the global config at all if you're paranoid. This ensures you have to setup the user.name and user.email locally.

<comment><USER5> There is also extremely useful option user.useConfigOnly, it was added recently though. Before 2.8 (iirc) you had to use weird hack "git config --global user.email '(none)'"

</comment></comment><comment><USER6> I'm forever using the wrong hat when making commits, because I don't keep all my repositories local but clone when needed.

I keep intending to make a wrapper around "git init" and "git clone" warning me of what my identity is, so I have the opportunity to change it.

Karn looks interesting (thanks pseud!) but unfortunately won't work for me because I often use /tmp and not any consistent path naming that would identify which hat I should be using.

</comment><comment><USER7> Thanks for this. I had assumed there is a way to do this but had never gotten around to setting it up since I use different machines altogether for personal and work projects.</comment>


To the non-entrepreneur: Everyone is running a business, including you - <AUTHOR> http://blog.sidu.in/2012/06/everyone-is-running-business-including.html

<comment><USER2> I've found this line of argument can really help open people's eyes to the opportunities around them.

Even if you're an employee (or job seeker), you are running a business. Your product is your skills. Your market is all your potential employers.

What are you doing to market your product? What are you doing to improve it? Are you selling to the right market? What would it take to develop a different product or adapt it to a market you'd rather be in?

Everybody who works for a living is in business. Some people just don't realize it, and therefore do it really badly.

<comment><USER3> > Everybody who works for a living is in business.

That is, to me, a very depressing thought. I'd much rather write code or come up with ways to solve problems (related to code or that can be coded) than have to think about business.

<comment><USER2> In my head, I translate that as "I don't want to think about whether my code actually helps anyone."

Because if you do care, you necessary need to (1) learn what someone's problem really is, (2) figure out how to solve it, (3) explain your solution to them so they use it. And at that point, you're "doing business".

Business is not accounting. It's problem solving. It's designing algorithms that run on people _and_ processors. And you measure the performance of your algorithm in money, because money is the best measurable proxy we have for "what people value".

<comment><USER4> It's completely possible to _care_ about whether your code actually helps anyone without ever thinking or worrying about it yourself. All you have to do is trust someone else to make sure you're not wasting your time, whether it's your boss, CEO, or co-founder, and perhaps they can make this determination better than you. It sounds like you feel you have to be in charge of the business to know you're not wasting your time, but not everyone feels this way.

I support a world with strong organizations and separation of responsibility, where designers can design, programmers can program, and chefs can cook lunch, and if the company fails, well, at least lunch was delicious. It's not the back-end programmer's fault for not spending his shower time thinking about the business model. Most people aren't looking for a financially risky job; it's on the entrepreneur to take the risk.

Alternatively, let's just get rid of salaries and everyone can work for equity. Then they'll _really_ be thinking about how much their work is helping the customer.

</comment></comment></comment></comment><comment><USER5> I think the most useful concept is to think of you as a business and whoever pays you as your customer. Then think in terms of providing value to your customer. As long as you provide value, your customer (or another like them) will keep paying for it.

If you work for BigCo pushing paper around, figure out why BigCo thinks that's worth money, and then figure out how to provide them better value. Whether it's pushing paper faster, reducing the amount of paper that needs pushed, training others to push paper more efficiently, or whatever, the point is that if you're providing clear value to BigCo that's worth more than what they're spending on you, you can keep them as a customer as long as you want. Even if BigCo goes under, as long as HugeCo and all of their competitors need the same thing, you can get them as customers.

That's where real "job security" comes from -- having skills that customers are willing to pay for.

<comment><USER6> Sales people instinctively understand that you can't just rationally provide value to your customer; you also have to persuade the customer's decision- makers that you're providing value.

At BigCo, this means you can't just do what's good for the company, you also have to make sure your boss is happy about what you're doing.

This pitfall is especially tempting to hyper-rational programmer types, who think that providing value is sufficient, and that no company (including their personal "company of 1") should ever need sales or marketing departments.

<comment><USER7> There is a strategy to the rational approach, but it's rarely stated: if your organization can't recognize value without undue effort, then it's going to lose to one who can.

To put it differently, if your job is the ship's lookout, you don't try and convince the captain that he needs a lookout. You try to find a new captain who won't sink the ship.

</comment></comment></comment><comment><USER8> Yes, but in my case it's the kind of business done out of interest rather than to turn a profit. Like running a second-hand bookstore in a building you own in Paris, opening at lunchtime and spending the day swapping chit-chat and literary references over coffee and chess with a handful of regulars and the occasional wage-slave who sneaked out of work.

</comment><comment><USER9> My favorite Jay-Z lyircs: "I'm not a businessman. I'm a Business, man!"

Or like that one book by Reid Hoffman and Ben Casnocha - The Start Up of You....its interesting mindset to view your career as a start up.</comment>


The privacy paradox: why do people keep using tech firms that abuse their data? - <AUTHOR> https://www.theguardian.com/commentisfree/2019/may/05/privacy-paradox-why-do-people-keep-using-tech-firms-data-facebook-scandal <comment><USER2> Tech firms engage in capitalist logic to achieve it: wherein the true costs of production are externalized and obscured from public view (or worse, portrayed as being virtuous and of benefit to the user). Willing or not, we are in their employ when we engage in their services, much in the same way we contribute to climate change merely by participating in industrialized Western society. We are both the victims and perpetrators, because even individual moral responsibility has been externalized, seemingly to the point of irrelevance. And as the complex systems (e.g., near-omnipotent global surveillance, totalitarian fiat currency, Bernays' propaganda) we've designed and implemented to run our world are beyond the comprehension, let alone control, of any single mind, how could it be any other way?

<comment><AUTHOR> Interesting points. You write about externalities, which touch on an economist view. And you also note Ed Bernay and his work on human psychology/propaganda.

Is there empirical literature that further explains this paradox? I wonder if there's anything in anthropology that describes this.

<comment><USER3> The paradox here is pretty difficult to break down because it its function and causes are so intertwined with everything in "industrialized Western society" as the above comment makes note of.

The book "24/7: Late Capitalism and the Ends of Sleep" captures many social phenomenon and mechanisms of the neoliberal/"late capitalism" moment.

Here is an excerpt from a book review: "the emergence, rationalization, and normalization of the "observing subject" across the 19th century, revealing new techniques of discipline, such as the regulation of attention in industrial labour and later the pathologization of deviant forms of perception and attentiveness" from [https://muse.jhu.edu/article/580561](https://muse.jhu.edu/article/580561)

<comment><AUTHOR> This is neat, I'll check out Jonathan Crary's writing, thank you!

</comment></comment></comment></comment><comment><USER4> The article is so confusing. I'm hooked when it started at "The point of the experiment, one imagines, was to prompt the question: "How do they know this?" in the target's mind." and then it just ends without answering anything.</comment>


Microsoft narrows CEO shortlist to Ford, Nokia, Skype and Azure leaders - <AUTHOR> http://www.theverge.com/2013/11/5/5070910/microsoft-reportedly-narrows-ceo-shortlist-to-ford-nokia-skype-and

<comment><USER2> I can understand why Ford's CEO would be considered for the lead job in the automotive industry (as he helped build Ford's reputation back) but being the head of Microsoft? I'm wondering what value there is in hiring a CEO that does not have a technology background/vision.</comment>


Why Bitcoin is a Prime Target for Hackers - <AUTHOR> http://www.scanmysite.net/blog/why-bitcoin-is-a-prime-target-for-hackers

<comment><USER2> Whenever I see reference to bitcoin mining botnets, I wonder if this couldn't be implemented on a legitimate level. Call it "mineware", and the way it works is that you get a piece of software for free, but while it runs, it mines bitcoins for the developer.

This would be particularly well suited for professional graphics software. There you have customers with high end hardware, but that hardware is sitting idle for a large chunk of the time. The mining could be tuned to conservatively curb its CPU/GPU usage when other processes needed it. The end result is that you fully utilize a resource you have in order to get software for free.

The biggest problem, of course, is that this kind of breaks down if more than one developer does it.

<comment><USER3> This is similar to what CoinLab is doing. Gamers run the the CoinLab mining client in exchange for in-game currency.

<comment><USER2> That's cool to see that the idea is being explored, although I think gaming is absolutely the wrong market for it. My understanding is that GPU processing is really where the money is for mining, and while a gamer's system likely has idle CPU cores to exploit, GPU is a rather precious resource for a game.

<comment><USER3> The idea is to mine when not playing the game. I know that some people seem to play games 24x7, but most people don't.

</comment></comment></comment></comment><comment><USER4> It does repeat the no-fee meme, which is an odd one. As I understand it there is a default fee and the mining/validating crowd are under no obligation to process your transaction if they don't want to.

And it's such a good target for a few reasons, the irreversible nature of transactions is one thing, another is that the authorities don't really care to get involved.

<comment><USER5> The default fee is currently very small (0.01 BTC) per transaction. Compare that with credit card fees of $0.35 + 2.5% per transaction, and you will see the draw of Bitcoin for large businesses with lots of credit card transactions.

The transaction fee mechanism is a helpful free market tool that gives more freedom to Bitcoin spenders: for low-importance transactions, the spender may choose to save on fees at the expense of a long, uncertain confirmation time.

Of course the miners have no obligation to anyone, and at this point in the game, block rewards are high enough that transaction fees do not really factor into the decision on the transactions to include in the block. As block rewards shrink, transaction fees will become the miners' main source of income, so fee-less transactions will take much longer to be confirmed.

<comment><USER4> Sure, there are low and/or optional fees. However these will likely increase in practical terms in the long run. Whether they ever increase to the level of credit card fees, for a fast transaction, is unknown.

This is still not 'no transaction fees and taxes in the least'. I would anticipate that if it ever gets wider traction we'll start seeing attempts to tax commerce in Bitcoin , just like real money. Bitcoin income should probably already be declared in many countries.

<comment><USER6> Bitcoin transactions are taxable in both the U.S. and Europe, regardless of whether Bitcoin is a currency or asset.

Not reporting Bitcoin transactions is income tax fraud. In the U.S., at least, that potentially means that the statute of limitations for when the IRS can go after you for back taxes and penalties never expires.

</comment></comment></comment></comment><comment><USER7> The answer: Money.

<comment><USER8> The more answer: Anonymous, digital money.

The strengths of Bitcoin are its weaknesses. If you stash thousands under your mattress and your house burns down, you're out of luck (sort of. The Secret Service will replace bills if you can send them mostly burned versions.) If you completely delete your Bitcoin wallet, you're out of luck. If a robber breaks into your house and steals your cash stash or a hacker gets into your computer and steals your Bitcoin stash, you're out of luck.

<comment><USER9> It's not that easy though.. Bitcoin transactions are public, and the community is relatively tightknit. Eventually a thief has to use a payment processor to get real dollars from their heist, and from that point onwards look over their shoulder in public.

<comment><USER4> Really?

I thought the general consensus was just to let it all go, spend maybe a little effort tracking the coins as they get moved, but eventually lose them in the system, and then forget about the whole thing.

Correct me if I'm wrong, but AFAICT nobody's watching the coins that got stolen from (say) bitcoinica so that they can either refuse to transact with them or go beat them up. In fact quite the opposite, the community as a whole seems entirely resistant to the idea of any sort of coin blacklist. AFAICT.

</comment></comment></comment></comment><comment><USER10> Answer:

1) Money 2) Vulnerable

Doh!

<comment><USER11> QFT.

I mean why even waste the time writing an article about it? The answer is obvious.

</comment></comment><comment><USER12> If you do double-spending in a short period of time (while it hasnt' propagated yet), won't both people claim you paid them? I think people's reputations for this sort of thing should be in the system and somehow managed as well.</comment>