Ask HN: Security Vulnerability Rewards - <AUTHOR> Hi,
You are working on a product and the product is still in the beta stage, and someone out of the blue sends an email to you that your site has these security vulnerabilities(valid ones) and asks for rewards in return.
Has anyone faced this kind of situations? We are willing to give him the reward, but being in beta stage, we are still not sure as to what and how much we should reward him. <comment><USER2> Speaking as a security consultant - don't give a reward. What they did is technically illegal and not in the spirit of security testing.

If someone finds a vulnerability accidentally (I've done this before), they won't ask for a reward if they are professional and the company has no bug bounty. It's reasonable to tell a company out of respect - it's unreasonable to ask for payment, that implies almost a ransom and will encourage more of it.

There is a problem with bug bounties these days in that they attract a lot of people desperate to get into the InfoSec industry who don't necessarily know what they're doing and have no professionalism (see @CluelessSec for example.) Don't encourage it by giving a reward.

Cold calling (or emailing) companies to solicit penetration testing is okay, casing the company for vulnerabilities and asking for payment is not. I do suggest you find someone to do a solid penetration test of your company however just out of principle.

<comment><AUTHOR> @dsacco, thanks for a very clear direction where i should go. Did the same thing, Fixed the problems and thanked the guy :)

Thanks a lot for the answer.

</comment></comment><comment><USER3> A startup I worked for encountered this "unsolicited penetration testing."

If you offer them a reward or recognition, you are going to see many more vulnerabilities being reported to you. You are going to start seeing port scans on your machines and all sort of scraping looking for vulnerabilities. Some security vigilante is going to take down your service in the middle of the day with an overly aggressive script.

The best course of action is to fix the vulnerabilities, thank them for their contribution (in that order), and say nothing more. You don't have the time to manage a bug bounty program right now, and by giving them recognition or reward you are in effect starting an ad hoc bug bounty program.

<comment><AUTHOR> Thanks a lot for the answer. We are doing the same thing as you have mentioned.

This is an unnecessary distraction though at this point of time :)

</comment></comment><comment><USER4> You should probably take the time to think about how you're writing your software soon, and maybe consider the possibility of hiring a consultant to audit your code before you ship.

Also, what debacle said.</comment>


Facebook news feed ads generate 49 times more clicks at 45% less cost - <AUTHOR> http://venturebeat.com/2013/06/27/facebook-news-feed-ads-generate-49x-more-clicks-at-45-less-cost-study/

<comment><USER2> Because a stupid user clicks on that crap by mistake.

It is probably should already be obvious, that most of internet audience developed a habit of ignoring ads, same as TV audience did long ago, so the times of making money, like it was possible in times of debut of Google's ad- words are gone.

Almost no one clicks on an ad unless it is decorated as ordinary link, looking like a part of the site, which is plain cheating.

"Investors" who are waiting that FB will make profit on ads, well, let's say that they are naive.

<comment><USER3> I guess people also are making purchases and signing up by mistake after clicking on ads. Just because you ignore ads, doesn't mean others do same. FB is already making profit on ads.

<comment><USER2> Clicks and sign-ups, leave alone purchases, are very different things. FB sells clicks, but a user just hits "back" button. Eventually, there will be no demand for clicks, because even being very cheap and abundant, they will not create enough money.

Profit = revenue - cost. So, FB pays all its costs from selling ads? Since when?)

</comment></comment></comment><comment><USER4> Ads masquerading as news get more attention? What an enormous surprise!

<comment><USER5> I always have to look twice, because sometimes they really look like friend's updates.

What I have started to do is to mark them as spam.

</comment></comment><comment><USER6> This should be obvious, but click volume is a bad thing if conversion rates are low. Your KPI is cost-per-conversion, not cost-per-click.

</comment><comment><USER7> What about the quality of the clicks?

</comment><comment> jmcdonald-ut I read through the article pretty quickly, so forgive me if I missed something, but what qualifies as a click? Do "Likes" count as a click (for example)?

<comment><USER8> My somewhat limited knowledge of the world of Facebook advertising (got free $100 credit, ran campaign) would tell me yes, Likes do count as a click.

<comment><USER9> No, clicks are either click on the ad, directing the user to your site or click on the name of the ad Publisher (i.e. your Fan page). Likes and shares are different metrics

</comment></comment></comment><comment><USER10> If you guys want to remove those ads from your newsfeeds, check out this javascript I wrote: [http://programmerhrishi.blogspot.in/2013/05/get-rid-of- those...](http://programmerhrishi.blogspot.in/2013/05/get-rid-of-those- suggested-posts-and.html)

</comment><comment><USER11> I think the reason they cost less is because they are the only type of Facebook ads that are shown on mobile. I have a web app which doesn't work very well on phones and the only way to prevent my ads from being shown there is to disable News Feed ads completely.

</comment><comment><USER12> Hard to believe. The reason why search related ads work well is because the search engine knows about the intent... You just entered it.

An ad on a news feed on the other hand is almost always something you don't want. The same goes for most ads on websites, they're likely something you do not want or something that does not align with your intend.

<comment><USER13> The new ads are "retargeted". You won't see one unless you've been to the advertisers website recently. That is where the "intent" comes from.

Seems reasonable to drive user to your site through SEM/SEO, then hammer home the message with one of these new FB add.

<comment><USER14> I wish those retargeted ads were smarter. They should reset the given "intent" after an action is taken.

Early this year, I bought a watch for my girlfriend as a surprise gift for our anniversary. I made the mistake of doing some prior research to find the best price... on her laptop! I bought the watch online, using the same computer, but the advertising software was incapable of recognizing this action and kept showing her exactly the same watch ads all over the Internet. Long story short, my gift was not a surprise anymore.

That happens to me all the time, I always look the best deal before buying something online, buy it, but then have to deal with ads that are not of my interest anymore for about an extra week. I guess is more cost effective for advertisers to show completely irrelevant ads even if the purchase already materialized, but it gets so annoying to the point of starting to dislike the brand a little bit more every time. At least in my case.

<comment><USER3> >I made the mistake of doing some prior research to find the best price...

Doing research to find the best price is never mistake. It sucks that your surprise is ruined. I dont know if advertisers can know if action is taken on other website. I guess you should delete cookies to "reset intent" or do research in private tab.

</comment></comment></comment></comment><comment><USER15> The problem with fb has never been CTR %, but volume. This is why they will never end up eating into search budgets, specifically with midsize e-commerce businesses (largest group of retargeting advertisers).

</comment><comment><USER16> I will admit, I've had good success recently with some promoted posts from our FB page. It's anywhere from $5-50.

Much better than traditional FB ads, but that's not saying much.

</comment><comment><USER17> It's too bad a "Facebook Premium, no ads included Edition" will never happen due to the fact that it wouldn't make as much money as the current model with invasive ads.

<comment><USER3> That is not necessarily true. They can easily calculate average worth of FB user (money that user brings them by clicking on ads) on yearly basis and set yearly membership fee above that number. Example: If average yearly worth of user is $5, they can charge $10 fee. Most of people that would sign up for premium would be users that dont click on ads anyway (their average worth is lower) so FB could earn more.

</comment></comment><comment><USER18> Is the only indication that it's sponsored the little "sponsored" tag in gray at the bottom? Or does it still say "suggested post" in gray at the top?

</comment><comment><USER19> How is this not spam?

<comment><USER20> Not sure what you mean but I'm a fairly typical HN type and I read the article of my own free will and found it useful.

</comment></comment><comment><USER21> Compared to what? Jesus.

<comment><USER22> Other ads on facebook, presumably.

<comment><USER23> Did you even read the article?</comment></comment></comment>


Rise of the Facebook-Killers - <AUTHOR> http://www.villagevoice.com/2012-02-15/news/the-facebook-killers/full/ <comment><USER2> This is pretty much the stupidest thing I've ever read.

I think it's absolutely hilarious that people keep predicting the end of Facebook. In reality no one cares and everyone will keep using it.

</comment><comment><USER3> Mark Zuckerburg has done more harm to the human race than anyone else his age?

I get the point he is trying to make and Mark is no saint but that is a ridiculous statement.

<comment><USER4> I think he meant that thanks to FB, a lot of people over the world have wasted a lot of time.

<comment><USER2> What about TV? What about Movies? What about listening to Music?

These are all wastes of time and everyone should stop doing them.

<comment><USER4> Absolutely, but it's not Zuckerberg's generation that created them.

</comment></comment></comment></comment><comment><USER5> Old article. Are any of these Facebook killers still doing well? That's not a rhetorical question, I'm actually curious about the answer.

</comment><comment><USER6> FYI this is from Feb 2012

</comment><comment><USER7> Over the top? Sure, but the take-home message is that there's an alternative to Facebook and that is Diaspora. We should use it and invite others to as well.

You won't ever look like a moron recommending Diaspora (like you most certainly do recommending Path or Facebook).

<comment><USER8> What is it about Diaspora that makes it a facebook-killer? I am not convinced that giving people the option of controlling their own data would convince them to switch? I think suggesting something like that is pretty ignorant of facebook's appeal and growth. If the argument is "people will switch because they will realize facebook is bad for them" then facebook becomes an industry behind a long line of other industries taking advantage of people, and on the grand scale of things, is probably one of the most harmless.

Next, it seems to me for this approach critical mass, you may end up with a centralized diaspora pod, in which that user is hypothetically free to sell your data, which doesn't really fix the problem.

At the end of the day if I need a tight, controlled, social network of only people I trust without the fear of my data being sold, I will use the social networks I've already been using, namely, email, phone, and in-person communication.

IMO, Diaspora is pretty low on the list of what will bankrupt Zuckerberg. If Google can spend 100s of millions of dollars on a social network and not steal significant traction, diaspora needs a better killer feature than "you own your data." Lets face it, a large part of the facebook community (if not all of it) doesn't give a shit about their data.</comment></comment>


How Development Agencies can Play a Bigger Role in Startup Communities - <AUTHOR> http://blog.twinenginelabs.com/2013/07/the-role-of-development-agencies-in.html

<comment><USER2> I'm surprised more startups don't hire agencies. It is just so much easier to get a prototype spun up. The agencies have already built products, so they have the experience needed to help you get started much faster.</comment>


Python Code Review - <AUTHOR>

Looking for code review for my first (short) python application at https://github.com/yousifS/spm. <comment><USER2> Might want to add some code comments so that it's easy to tell the intention of each method. Personal experience: when you write a little bit of a pydoc for your code it can highlight code smells. e.g.: If the docstring is too long then maybe you are doing too much in one method.

</comment><comment><USER3> Looking at the run function, you might benefit to use a switch-case in place of that plethora of if-elif's. It would look a bit neater IMHO.</comment>


Reasonable System for CSS Stylesheet Structure - <AUTHOR> https://github.com/rstacruz/rscss <comment><USER2> These are all great ideas. The only thing I don't like about these types of projects/guidelines is the almost religious, strict adherence to them that some people who pick them up like to rant about.

The examples are great and realistic but they will inevitably break down in any project with just a moderate amount of complexity. When this happens I see people decide that they've done something wrong and think they either need to restructure the UI to fit the guidelines or find a different set of guidelines to fit their project. Both are wrong.

After years of studying these guidelines and trying to perfect the perfect, most efficient, small, and understandable set of CSS styles I've come to the realization that we need to simply accept that there are going to be exceptions and that's okay. Yes, think in components, give classes sane names, don't use ID attributes, etc. but also know that at some point you're probably going to have to break a rule and it's not the end of the world. Think about the problem for a few minutes but don't waste your time trying to shoehorn your front end code to fit a set of guidelines so you can feel superior because of your strict adherence to RCSS or SUITCSS or whatever. There are more pressing issues than a few unused or single use classes. If you can follow the rules more than 80% of the time then I say you're as close to perfect as you'll ever be. Anything else is reaching for an impossible standard.

It's funny that the stricter you adhere to some of these guidelines the less productive you become as you spend more time thinking about how to create components so they fit the rules rather than getting the damn styles to look however you want.

My point being this: I love all the different philosophies and think they're all worth studying but let's be realistic when it comes time to implement stuff.

</comment><comment> at-fates-hands Naming conventions seems to be old school now that virtually everything is being done with JS.

Using webpack's css-loader changes the game completely as pointed out by Mark Dalgleish here:

[https://medium.com/seek-ui-engineering/the-end-of-global- css...](https://medium.com/seek-ui-engineering/the-end-of-global- css-90d2a4a06284)

 _Writing maintainable CSS is now encouraged, not by careful adherence to a naming convention, but by style encapsulation during development._

I'm sure there will continue to be more JS solutions to getting rid of CSS naming conventions, since it seems everything is being done with JS these days.

<comment><USER3> At which point you no longer have graceful degradation when JS is disabled. Web "designers" need to stop breaking the web with their code spew everywhere ruining the basic functionality of HTML and CSS.

<comment><USER4> Sure you can... there is no reason why those JavaScript styles can't be outputted to a css file in your preprocessing step.

</comment></comment></comment><comment><USER5> I always feel like these naming conventions are just one big workaround for the pain of a global namespace. We should tackle it with tools like CSS Modules[0], not with something as flimsy and error-prone as a naming convention.

[0] [https://github.com/css-modules/css-modules](https://github.com/css- modules/css-modules)

<comment><USER2> CSS is not a programming language. You can't think about it the same way you'd think about your backend code or even client side JS. The global namespace is by design. It's a feature, not a bug. The whole point is to think about the Cascade. You go from vague to specific and that way you have entire classes of elements with base styles and specific components have additional styles attached.

CSS modules is a cool idea but I don't think there's anything wrong with CSS as it stands today. When you work in any language you need to understand and work with the language you have and I think that a lot of criticism of CSS boils down to "CSS doesn't work like this other language/paradigm I know and like".

<comment><USER5> I humbly disagree.

No, CSS isn't a programming language, but that doesn't mean it can't use functionalities that are typical of programming languages - just look at variables, functions, arrays, maps and other features that preprocessors like SASS have brought us.

While some approaches are a matter of taste/habit, I think there's an extremely wide consensus that having everything available in global scope is bad.

If the global namespace really is by design, then why are we adopting conventions (such as the one in this very topic) that mostly aim to defeat it? Prefixing class names to apply them only to a specific component is nothing but a primitive way of limiting scope.

</comment></comment></comment><comment><USER6> Hasn't this already been solved with SUITCSS?

[https://github.com/suitcss/suit/blob/master/doc/naming- conve...](https://github.com/suitcss/suit/blob/master/doc/naming- conventions.md)

<comment><USER7> Yea SUITCSS is a great solution and it's completely cleared up so many CSS issues my team has had in the past. Looking at rscss I kind of cringe because it doesn't make it easy to reason about where classes are in the markup. Like .search-form is affecting .submit, but looking at the template I have no idea, and I also don't even know which file to look in.

</comment></comment><comment><USER8> I was under the impression that child selectors are specific in nature, and they should be used later in the sheet, when declarations become increasingly specific.

<comment><USER9> In a general sense, the child combinator is "more specific", i.e. there are fewer elements that can match it. Combinators do not affect specificity though.

See [https://developer.mozilla.org/en- US/docs/Web/CSS/Specificity...](https://developer.mozilla.org/en- US/docs/Web/CSS/Specificity#Selector_Types)

</comment></comment><comment><USER10> Another alternative to BEM [http://getkickstart.com/amadeus/](http://getkickstart.com/amadeus/)

<comment><USER10> Or more precisely: [http://getkickstart.com/amadeus/#selectors](http://getkickstart.com/amadeus/#selectors)

</comment></comment><comment><USER11> I like how readable it is, but nesting selectors:

      .parent .child .element {

is bad for performance — thus BEM's:

      .parent--child__element {

<comment><USER5> It's not as bad because of decreased performance (which is negligible) as it is because of increased specificity, which has bigger day-to-day implications in large apps.

</comment></comment><comment><USER12> Very interesting project, although I believe the name suffers from RAS syndrome: Reasonable System for [Cascading Style Sheets] Stylesheet Structure.</comment>


How to Think Real Good (2013) - <AUTHOR> https://meaningness.com/metablog/how-to-think <comment><USER2> Interesting read that loops full circle to classic AI debates.

I was frustrated a bit by the dismissal of probability theory, though, as if Bayes theory solved it, and by extension, and probability as a whole could be dismissed.

A lot of the issues the author raises are limitations with Bayesian (at least classical Bayesian) theory. The author's critisms dovetail with some areas of probability theory (cf Jaynesian or algorithmic probability literature); I suspect their concerns are one in the same at some level as some of the concerns discussed there.

The problem is uncertainty to various degrees is fundamental to reasoning, so probability must be involved at some level. An integrated approach is needed. I agree that Bayesian theory per se isnt the end of the story, but something involving probability will be part of it (and because Bayesianism is a big part of that, probably that too).

<comment><USER3> > but something involving probability will be part of it

quantum mechanics without the physics?

<comment><USER4> > "Even though it was discovered by physicists, it's not a physical theory in > the same sense as electromagnetism or general relativity. <...> Quantum > mechanics is what you would inevitably come up with if you started from > probability theory, and then said, let's try to generalize it so that the > numbers we used to call "probabilities" can be negative numbers."

[https://www.scottaaronson.com/democritus/lec9.html](https://www.scottaaronson.com/democritus/lec9.html)

</comment></comment></comment><comment><USER5> > Work through several specific examples before trying to solve the general > case. Looking at specific real-world details often gives an intuitive sense > for what the relevant distinctions are.

This describes well why I like the more functional approach to programming (whether within an OO framework or otherwise). I often find myself solving a problem a number of times before I abstract it. And usually creating said abstraction before the problem appears leads to over-engineering.

When writing 'functional' code, I come up with solutions that are isolated enough that I can later replace them with various more abstract solutions, whereas the more OO or procedural approach can leave me with a mess that is too much work to disentangle.

<comment><USER6> I'm the same. One of my work projects is a fairly large code base and we add new features to it regularly. When I'm adding a new feature I generally prototype it all in one file (or at least as few as possible).

Once I have something working, I try to simplify it, then I look at the relationships within the code and as it interfaces with other code. The abstraction usually becomes quite obvious at that point. This approach of starting "dirty" usually results in very clean code at the end of refactoring. If I try to start clean, it is usually far dirtier and I end up changing much of the architecture anyway. So, it seems more efficient to start without any architecture and then tailor fit at the end.

I guess it's like writing text, it's best start with a rough draft to get the ideas down, then you can organize it once you've got a working version.

</comment></comment><comment><USER7> In terms of academic philosophy, I would say he is doing a version of pragmatism.</comment>


The year Mexico legalised drugs - <AUTHOR> https://www.historyextra.com/period/modern/1940-the-year-mexico-legalised-drugs/ <comment><USER2> _…there was no intrinsic link between drug addiction and criminality. In fact, it was only the high price of drugs, generated by prohibition, that led users to commit crimes, he said._

This statement is a real eye opener for me.

<comment><USER3> The US government learned this with the prohibition of alchohol in the early 20th century, then promptly forgot it.

<comment><USER4> Look at the influence alcohol has in the US today though.

"An estimated 88,000 people (approximately 62,000 men and 26,000 women) die from alcohol-related causes annually, making alcohol the third leading preventable cause of death in the United States"

I could google statistics for violent crimes committed while under the influence of alcohol, drunk driving statistics, etc. Whether we like to admit it or not alcohol has left a giant, negative, impact on our society.

[https://www.niaaa.nih.gov/alcohol-health/overview-alcohol- co...](https://www.niaaa.nih.gov/alcohol-health/overview-alcohol- consumption/alcohol-facts-and-statistics)

<comment><USER5> > Whether we like to admit it or not alcohol has left a giant, negative, > impact on our society.

I don't think anyone disputes that. The question at hand however is if the legal status of alcohol has any influence on the impact, and if so, what it is.

The assumptions of drug or alcohol prohibition are that a) Making a substance illegal reduces consumption of that substance. b) Reduced consumption results in reduced harm.

The thing about b) is that not every drinker is a violent drunk and not every drug user is using drugs in harmful way. Prohibitionists are assuming that it not only reduces the number of users, but also that it reduces the number of problematic users.

Now the casual pot smoker or the "one beer after work" drinker is not causing trouble for society. At the same time, they are the ones most likely stopping consumption should the substance become illegal. However, the alcohol or heroin addict may not cease consumption the day his substance of choice (or at this point, habit) becomes illegal but instead acquire it through the black market, potentially causing more damage than the substance itself would.

<comment><USER6> The influence of alcohol, or any drug, should be a kicker during sentencing for all violent and negligent crimes.

</comment></comment></comment></comment></comment><comment><USER7> Given the choice between not being able to get adequate pain relief due to DEA intervention, and legalizing drugs, I would choose legalizing them, provided legalizing them would not limit dosage to insufficient levels for pain relief.

It is incomprehensible to me that it is somehow acceptable to solve the "opioid crisis" by making people with serious pain suffer and by persecuting their doctors for trying to help them.

However, it would be totally appropriate to allow limits on employment, insurance, and government benefits due to drug use. While I support their right to choose, I shouldn't be required to subsidize someone else's destructive choices.

<comment><USER8> If you limit an addict's ability to get medical insurance, you'll end up subsidizing them anyway. Hospitals are prohibited from turning patients away in the US (and I wouldn't want to live in a world where they could do so). So addicts show up, get treated, and default on any bills they incur. The expense from this treatment gets passed on to everyone else. Try visiting an emergency room at 1am on a Saturday night and you'll see what I mean.

Incidentally, do you have the same views on employment, insurance, and government benefits as they pertain to alcohol consumption?

<comment><USER9> Although "Hospitals are prohibited from turning patients away in the US (and I wouldn't want to live in a world where they could do so)." is technically true. For instance if you have aquired Hepatitis C and went to a hospital in the US with no insurance, they will not consider treatment to cure the disease. They will help make you comfortable with your chronic disease until it kills you.

<comment><USER10> Medicaid is one of the largest buyers of the Hep C cure.

<comment><USER11> You don't just magically get medicaid though. You have to apply for it and follow up with things if they send you stuff in the mail. If you don't do that you go back to being uninsured which leads back to what JudasGoat said where you will get the minimum amount of care in order to get you out of the hospital.

</comment></comment></comment></comment></comment><comment><USER12> I think the right approach to drugs is to regulate use by neighborhood. And with monetary fines only.

Outright bans cause too many problems. Illegal production makes drugs more dangerous. And allowing everything has some social costs too. Each approach eventually leads to many people wanting the opposite policy, so it will just go back and forth.

Regulating it by neighborhood will allow people to keep drug abuse away from their kids, while still allowing those who want to use drugs to access it without too much trouble. They can just travel to a neighborhood where it's allowed. Avoiding fines will give them an incentive.

Neighborhoods that do allow drug use will pick which drugs to allow and be able to tax the activity and have rules to handle the activity. There are red light districts for prostitution. Why not handle drug use the same way?

<comment><USER13> > I think the right approach to drugs is to regulate use by neighborhood. And > with monetary fines only.

So, if you have the money to pay the fine without breaking a sweat, you just ignore the rule.

> Regulating it by neighborhood will allow people to keep drug abuse away from > their kids

No, it won't. For much the same reason local fireworks bans don't, except drug use is a lot easier to conceal.

> Neighborhoods that do allow drug use will pick which drugs to allow and be > able to tax the activity

No, they won't, for the same reason neighborhood bans don't work. It's impossible to police effectively.

Maybe areas that allow drug _sales_ will be able to tax (some of) it (but any tax in the "legal" area directly reduces the impact of fines in the "illegal" area, and even people who go wholly legal will shift activity to the lowest tax areas available; you might also look into what a big business cigarette smuggling to avoid taxes is.)

<comment><USER14> > So, if you have the money to pay the fine without breaking a sweat, you just > ignore the rule.

Not just that, but if you can't or won't pay the fine, what happens? You end up imprisoned just as if the penalty had been to throw you in jail all along.

<comment><USER15> If you can't pay the fine in most states you aren't supposed to go to jail.

</comment></comment></comment></comment><comment><USER16> And they had to stop because of the US... no surprise there.

<comment><USER17> Indeed... Here is hoping that our next president (AMLO) who is kind of leftist and admires Cárdenas, will finally legalize drugs.

</comment></comment><comment><USER18> The British East India Company, the largest drug trading organization of the 19th century, is to be blamed for most of modern drug trade.

It is very likely that the opium poppies in modern Mexico are direct descendants of the ones planted by the British.

After the British lost their colonies in the Americas, they tried to fix their economy by selling opium to China. A few decades later, many Chinese workers moved to the Americas, among them, opium poppy planters. Few decades later, the US passed the Chinese Exclusion Act and many of them moved to Mexico.

Total death toll? millions of people.

\- [https://en.wikipedia.org/wiki/Opium_Wars](https://en.wikipedia.org/wiki/Opium_Wars)

\- [https://www.youtube.com/watch?v=fgQahGsYokU](https://www.youtube.com/watch?v=fgQahGsYokU) (animated explanation)

<comment><USER19> I get that the trade imbalance meant that BEIC/Britain looked for something other than silver to trade. But wasn't Qing (?) China closed?

AIUI they traded with Chinese merchants at designated ports, trading opium to get tea. The Chinese then traded the drugs on.

Three things that don't make sense to me in the "traditional" telling of "Britain purposefully created opium _addiction_ across China".

* One, that opium addiction was a new idea, opium was widely used in Britain.

* Two, how did merchants at the ports create demand in the interior, surely they met demand outcompeting local sources on cost and so widening the market.

* Three, after Britain was shut out of the trade China seemingly already had a massive local supply.

These things tend to make me think that in some measure the Chinese closed the ports in order to prevent cheaper product from supplying an already established and widespread market. And yet, I've read, once that BEIC supply was stopped the Chinese maintained the market with local supply.

Are their letters/papers where controllers of BEIC talk about addiction? Did they 'just' look for a large market that they could undercut?

It seems more like a tale of amoral merchants (of many nationalities), rather than evil Britain. But I'm from the UK (which does and has done plenty of evil things, selling weapons to the Saudis when we know they're using then to kill civilians, for example).

[banter] Of course the British are still addicted to tea, but we diversified our supply somewhat. Having comestibles disposed of in the sea seems like a repeating theme - perhaps the Dutch will sink our potato shipments after Brexit.[/banter]

<comment><USER20> When the emperor banned opium, the British sold it to smugglers. When the Chinese seized 20,000 chests of trafficked opium to stop it from being sold, the British attacked China and made them sign an agreement to buy tons of stuff from the British, including opium.

[http://www.bbc.com/news/world-asia- india-36781368](http://www.bbc.com/news/world-asia-india-36781368)

<comment><USER19> So Britain stopped trading, and traded legally with Chinese people who themselves smuggled the opium ... see to me that sounds like the smugglers are doing the worst thing there?

The Chinese seized and destroyed opium from merchants from several countries, Britain sent forces to release merchants, ships, goods and was demanding compensation for the destroyed opium, which compensation they then fought to acquire.

If the Emperor/Lin Xehu(sp?) at any time ordered that selling tea to foreigners was illegal(?), then it looks much worse for the outside forces; if not then it looks like balance of trade was a prime motivation on both sides, rather than (im)moral considerations.

([https://www.nam.ac.uk/explore/opium- war-1839-1842](https://www.nam.ac.uk/explore/opium-war-1839-1842) [https://www.reddit.com/r/AskHistorians/comments/6304d1/what_...](https://www.reddit.com/r/AskHistorians/comments/6304d1/what_caused_the_first_opium_war_ive_read_several/) based on other tertiary sources I've read seem like good synopses.)

<comment><USER18> Stop complicating things. This is very simple:

1\. The British planted opium then transported it to China and traded it.

2\. The Chinese told them it was illegal.

3\. They continued trading it.

4\. The Chinese seized all of it.

5\. They declared war so they could continue trading it.

I don't see the confusion or debate here. What the British were doing was very simple: illegal drug trade for profit.

What others were doing is a separate debate and does not absolve the British from anything. Don't mix things.</comment></comment></comment></comment></comment>


Why Capitalism Creates Pointless Jobs - <AUTHOR> http://evonomics.com/why-capitalism-creates-pointless-jobs-david-graeber/ <comment><USER2> 'Capitalism' doesn't create jobs. Companies create jobs. Many companies are badly managed, and employ staff they don't need. This is true. (And only has one solution - people not taking jobs they think are pointless, and companies not hiring for those positions).

However, the OP is calling jobs "pointless" based on reference to his ideal planned economy where everyone works on a factory or farm for 15 hours a week. In this imaginary utopia, jobs which grease the wheels of capitalism - sales, marketing, finance - are superfluous.

Thing is, planned economies fail disastorously badly in practice. I assume HN knows why. The deeper issue is that many capitalistic service businesses do serve a vital purpose - finance is a hyper-efficient resource allocation engine, for example, marketing ensures customers find the best products for their needs, and so on. The managers and administrators the OP reviles are highly paid precisely because making large organisations efficient (e.g., not hiring for unneccessary jobs) is hard.

Instead of asking why someone chooses to pay for jobs in these areas, the OP simply assumes that they need to be abolished, by fiat, and like every intellectual since Plato starts planning how everyone should live their lives in his ideal republic.

</comment><comment><USER3> What nonsense.

Yes, compared to 1910 there are more people in administrative positions, and this has _nothing to do with capitalism_. It's government. It's because there are more rules, more laws, more restrictions. Rules, laws, and restrictions, by the way, that are very popular with voters.

You can do away with all these "bullshit jobs" if you're prepared to do without environmental restrictions, a nontrivial tax code, employment regulations, etc. Do we really want to live in the non-rose-tinted world of 1910, where you can legally pipe your toxic wasted into the nearest river, where you can fire your secretary if she won't sleep with you, where you can chop down the tree with the last spotted owl?

There's a cost to economic organization. One that you can't just wave away. The idea a job is a "bullshit job" if the person holding that job isn't swinging a hammer is just childish.

<comment><USER4> I could do without nontrivial tax code.

<comment><USER3> People _say_ that, but most of the complexity in the tax code (that average people deal with, anyway) is there in an effort to make it more "fair" or to encourage socially beneficial behavior.

<comment><USER4> Which fails horribly and instead benefits many antisocial economical behavioirs. Encouraging "right" activities through convoluted taxation has all the same qualities as planned economy. Although it's not as harmful because it affects smaller percentage of economy.

<comment><USER3> Nonetheless, this is what voters want.

<comment><USER4> Not really. It's what the representatives think voters won't strongly oppose to.

</comment></comment></comment></comment></comment></comment><comment><USER5> Enterprise organizations are like machines: They need to be serviced and maintained. That is what these "pointless jobs" are for, but they're not pointless. They're vital for the function of the organization and therefore essential to the economy. They just aren't fun or well paid, like factory jobs.

</comment><comment><USER6> (2013). And blogspam. Original: [http://strikemag.org/bullshit- jobs/](http://strikemag.org/bullshit-jobs/)

</comment><comment><USER7> A lot of programming jobs turn out to be pointless. Is that what this article is about? I didn't read it.

</comment><comment><USER8> I liked the article better when it had the chimp in a suit for its lead illustration.</comment>


YC Results Today - <AUTHOR> Just starting this for the traditional discussion of results. Anyone have an idea when invites will be be sent today? <comment><USER2> There's another (similar) thread on this topic

<comment><USER3> Where? Do you mind adding the link?

<comment><USER2> [https://news.ycombinator.com/item?id=14137867](https://news.ycombinator.com/item?id=14137867)</comment></comment></comment>


How 30 seconds dropped my bounce rate by 78% - <AUTHOR> http://encosia.com/2010/04/23/how-30-seconds-dropped-my-bounce-rate-by-78/ <comment><USER2> This article is about how he redefined "bounce" to not include people that viewed the site for 30 seconds or more.

While I appreciate the sentiment, I consider "bounces" to be a lack of up- sell. My stats give me a "bounce" rate as well as the average time spent on that page for new visitors, so I can already see both of the stats he's referring to. They are just useful for different things.

<comment><AUTHOR> Since I'm not selling anything, a single pageview can easily be a success case for me. If Google refers someone to my site and a single page (and/or its comments) answers their question, I see that as a win. That's where most stats packages fail me, since they assume single pageview visits are immediate bounces.

I think it's applicable to other situations as well. Even if you're selling something and hope to guide visitors down a funnel, an accurate time-on-last- page metric should be valuable. There's a world of difference between someone that bounced immediately and someone that read your landing page for a few minutes but wasn't convinced to take the next step.

<comment><USER2> If you just want single page view stats, my stats give me "time spent on site" broken down by "new visitors".

I don't understand why you have to redefine the term "bounce" in order to achieve that. You could simply say that "bounce" wasn't the metric that you were looking for, or that people put too much emphasis in it. You don't need to "fix" it because it isn't broken.

"Bounce" is a measurement of people that do not continue to interact with a site after the first page they visit.

<comment><AUTHOR> What stats package do you use that gives you a "time spent on site" that's accurate for a single or final pageview (honest question)?

Most of them take a very pessimistic view. I believe Google Analytics counts a single pageview visitor as 0s, for example. That turns out to be terribly inaccurate for my site.

<comment><USER2> I'm using Yahoo! Web Analytics which is not publicly available.

</comment></comment></comment></comment></comment><comment><USER3> Obviously, the key question here is what the desired action on your landing page is.

If you're Hanselman, and your goal is to get people to read your blog posts, then your bounce-rate can be close to 100% and it doesn't really matter-- the content you are attempting to serve up is all on the front page, and additional clicks are secondary.

If, on the other hand, you have an e-commerce site like Amazon's, where the landing page is just the first step in a process that you'd like to end in a conversion, then a 78% bounce rate is definitely something to work on.

</comment><comment><USER4> interesting article, unfortunately, the title is misleading, but maybe it's just me.

<comment><AUTHOR> Sorry you found the title misleading. That wasn't my intention.

<comment><USER5> This strikes me as disingenuous. The title STRONGLY implies "how 30 seconds of work dropped my bounce rate".

It's really hard to come up with any other interpretations of the subject line a priori.

It's stunningly good link bait, and the article is deeply disappointing compared to the promise.

<comment><USER6> Interesting, I hadn't understand that possible meaning in the sentence at all until reading the comments. I had assumed it was a 30 second reduction in page load time or some such (Though I suppose it should've been obvious this wasn't the case... A website with a 30+ second load time would likely not be able to gain a large audience). Either way, a confusing headline...

<comment><AUTHOR> I suppose this chain of comments just goes to show how differently we all think. That was the first title I thought of to describe the topic of the post in limited space, nothing more.

If you look at the other posts on my site, it should be obvious that I'm not good at (purposely) writing link bait type titles. Sorry if you feel like I tricked you. Wasn't my intention.

I only submitted it here at all because I found Clicky's new bounce measure profoundly helpful. That data would have been invaluable to me years ago. I thought anyone working on a web startup would surely also be interested.

</comment></comment></comment></comment></comment><comment><USER7> I really wonder how useful the time-on-page metric is. Thanks to tabbed browsing, I might have your site open for 30 minutes, yet only look at it for 30 seconds.

<comment><USER8> The solution is to track mouse-movement/page-scrolling to check whether the user is interacting with the site.

Also, is it possible for javascript to check whether the site's tab and browser window is viewable and in the foreground?

<comment><USER9> You can listen for the window blurring

</comment></comment></comment><comment><USER10> Your bounce rate didn't change. The title is very misleading.

</comment><comment><USER11> In Google Analytics, under Visitors > Visitor Loyalty > Length of Visit, you can find the number of 0-10 second page views, which could be a useful metric to try to reduce - now if I could make a line graph out if it instead of a bar graph for the period. Anyone know if this is possible?

</comment><comment><USER12> While the original 78% bounce rate missed people who happily read the full page and then were done, the new 15% "<30 seconds on page bounce rate" overcounts people who leave the page up without reading.

When discovering new material (as from HN or long lists of search results), I'm sure I'm not alone in that I open a bunch of tabs, then slowly work through them. Sometimes, when I reach one, even if it's been open for minutes (or hours!), it's dismissed immediately as uninteresting or obsolete.

I've noticed some video sites manage to defer auto-start of the video until I bring the tab to the fore. Other sites seem to only load (or fade-in) inline images as I scroll to them. Has any analytics tool added similar monitoring of foreground-time or scroll-to-end-of-item sensing?

<comment><AUTHOR> I believe Clicky only continues pinging for 10 or 20 minutes after a page loads (not sure which; they've changed it up a bit since introducing the pinging).

That's a great idea about detecting whether or not the tab is actually active. I don't know how difficult that is to implement without a visible element on the page, but I'm going to ask Clicky about adding that feature.

<comment><USER13> At least "scroll to end" or "scroll more than x pixels" is easy to add, and would work just as well as long as your pages don't fit on screen.

</comment></comment></comment><comment><USER14> Hiii, Hope you all will help in sharing information..

I want to know what should be accurate bounce rate of a blog ?? marck_don

<http://www.adnpost.com>

</comment><comment><USER15> I stayed for about 15 seconds.</comment>


Show HN: WantKeeper, An online wishlist. - <AUTHOR> http://wantkeeper.com My buddy and I got tired of the hodge podge of online wishlists currently available, so we tried our hand at it.
Pinterest was the closest thing we'd seen to functionality that was simple and also promoted sharing, so you'll notice quite a few cues taken from Pinterest.
We've tried to figure out how to simplify the wishlist and gift buying process, and we'd love your opinions and thoughts!
http://wantkeeper.com to sign up. It's free, you only need a Facebook account. <comment><AUTHOR> My buddy Jon and I got tired of the hodge podge of online wishlists currently available, so we tried our hand at it.

Pinterest was the closest thing we'd seen to functionality that was simple and also promoted sharing, so you'll notice quite a few cues taken from Pinterest.

We've tried to figure out how to simplify the wishlist and gift buying process, and we'd love your opinions and thoughts!

<http://wantkeeper.com> to sign up. It's free, you only need a Facebook account.

<comment><USER2> have you checked out refer.ly?

<comment><AUTHOR> I assume you're talking about earning money with referral program? I hadn't seen refer.ly, but we are using Skimlinks to perform a similar function.</comment></comment></comment>


Crowdfunding Campaign to Change Crowdfunding Law - <AUTHOR> http://www.indiegogo.com/Change-Crowdfunding-Law

<comment><USER2> If the Dodd bill kills most angel investing (due to the regulatory barriers as much or more than the new wealth thresholds) we may be left with "new things" like crowdfunding.

That's how Rich Hickey can afford to hack on Clojure this calendar year: <http://clojure.org/funders></comment>


Wood pulp extract stronger than carbon fiber or Kevlar (2012) - <AUTHOR> http://newatlas.com/cellulose-nanocrystals-stronger-carbon-fiber-kevlar/23959/ <comment><USER2> Im not too surprised. The strength of plywood is well known in aero and racing circles. For parts like stringers plywood is used instead of fiberglass when higher stiffness is required.

Plywood is similar strength/weight as fiberglass which isn't too far off from carbon fiber.

The issue with all popular composite materials like fiberglass, carbon fiber, and plywood is that their strength is highly directional. It takes a lot of skill and testing to make sure your part is strong enough in all directions force will be applied.

There's some omnidirectional "mat" type materials you can get easily for fiberglass but you exchange the directional strength of weave for a non- directional but overall inferior strength of randomly oriented strands.

</comment><comment><USER3> Strip planking is popular amongst canoe builders. A 1/4inch thick core of cedar has fiberglass on either side. The glass provides tensile strength and the wood provides both compression strength and a useful offset between the fiber layers.

I can lift the bare hull of an 18 foot long sailing canoe with one hand.

The downside is in maintenance/repairs, and the critical requirement to keep through holes absolutely watertight. If water gets into the core it's a total PITA

Also, strips of cedar that are 3/4" by 1/4" by 18' are really weird to handle.

<comment><USER4> The Mosquito, a plane from WWII, was largely made of wood and is considered one of the best planes from that era.

<comment><USER5> YES!

</comment></comment></comment><comment><USER6> Stronger at 10% of the price of carbon fiber. So why haven't we seen more people using this material in the last five years?

<comment><USER7> I was watching America's Cup sailing last week and these boats were all carbon fiber, completely. If there was a material stronger and lighter, even by a few percent, at any price, they'd be using that. They would do just anything to gain an advantage.

<comment><USER8> I didn't read the rules for the most recent Cup but previous editions have limited the allowable materials and processing techniques in the rules, setting a limit on fibre modulus to prevent the better funded teams from going all out on eye-wateringly expensive M55J carbon for example. Cure pressures were limited to 1 bar vacuum (atmospheric) to keep the rich guys out of big and expensive autoclaves for their hulls and primary structure. There was a maximum density requirement for the keel bulb material forcing you to use lead rather than platinum, gold or depleted uranium! These (nano? micro? mini?) fibres would likely be used as an additive to the resin, then laminated with everyday carbon - usually the first failure method to occur is resin microcracking which these little guys could helpfully and cheaply delay.

</comment></comment></comment><comment><USER9> Also take a look how strong and abuse-resistant cross laminated timber is: [https://alexschreyer.net/engineering/much-abuse-can-cross- la...](https://alexschreyer.net/engineering/much-abuse-can-cross-laminated- timber-clt-take/)

</comment><comment><USER10> Carbon fiber works so well in composites because it is possible to create long, continuous fibers which can be woven into cloth for directional reinforcement.

Maybe it is possible to use the strengths of each by adding CNCs to carbon composites.

<comment> chroem- Nitpick: fabric lay-ups are rarely used in industry because the weave exerts shear stresses on the fibers, making them weaker under load. Aerospace composites are all unidirectional.

But fiber blends are very common. It's typical to mix CF, glass, and aramids to get the price and properties you want, though I don't think it would make much sense to mix chopped and continuous fibers.

<comment><USER10> Thanks for the correction, my bad. The technical term for the kind of thing I was thinking of is 'multiscale composites', and there already seems to be a lot written about carbon fiber/carbon nanotube mixed composites which would presumably be similar to carbon fiber/nano-cellulose composites. I obviously can't claim to be an expert, but there at least seems to be some precedent.

</comment></comment></comment><comment><USER11> Hmmmm. I wonder how its material properties change in the -40 to +300F range and if the chemicals involved can tolerate immersion in oils.

With the weigh/strength characteristics and requirement that it not see water I can see this material being used in indoor (or sealed inside a gearbox somewhere) applications to reduce rotating mass.

</comment><comment><USER12> I'm delighted by how in-depth and detailed this is!

I'd be interested in seeing the numbers for how much the final product _weighs_ in comparison to Kevlar/Carbon Fibre...

I'd also love to know if this research went anywhere since 2012

<comment><USER13> > CNCs... bulk density is low at 1.6 g/cc, but they exhibit incredible > strength. An elastic modulus of nearly 150 GPa, and a tensile strength of > nearly 10 GPa.

This is the same as carbon fiber (1.57-1.7g/cc), and slightly higher than kevlar (1.44g/cc).

</comment></comment><comment><USER14> I think it since got surpassed by UHMWPE, which has a tensile strength of ~20GPa. They make cheap body armor out of it.

[https://en.wikipedia.org/wiki/Ultra-high-molecular- weight_po...](https://en.wikipedia.org/wiki/Ultra-high-molecular- weight_polyethylene)

<comment><USER15> UHMWPE is a beautiful thing. As easy to cut as wood, you can bend and mold it at temperatures over 300F, and it's strong enough that a 0.9" thick plate can stop bullets. Specifically, by "bullets", I mean a NIJ-0101.06 level III threat. That could be up to 24 shots from an AK-47, FN FAL, or AR-15.

</comment></comment><comment><USER16> No wonder it's so popular as a binding agent for fake cheese.</comment>


Unacceptable Risk: The Troubling Medical Helicopter Safety Record - <AUTHOR> http://www.popularmechanics.com/technology/aviation/safety/medical-helicopter-safety-crashes?click=pp

<comment><USER2> This is so true. My wife works at the level 1 trauma center here in Seattle and she often has to make the decision to call Airlift. After a couple of crashes a couple of years ago she is much more careful about weighing the risk to the crew against the real need of the patients.</comment>


Covid-19 Vaccines with 'Minor Side Effects' Could Still Be Pretty Bad - <AUTHOR> https://www.wired.com/story/covid-19-vaccines-with-minor-side-effects-could-still-be-pretty-bad/ <comment><USER2> I am not an anti-vaxxer at all but I would have my doubts too. I think we won't get a vaccine before the end of 2021 for that matter. I would see how much of a threat Covid-19 is at that time and would take a vaccine depending on that.

<comment><AUTHOR> Same here. Let those at higher risk pool take it. Might cause problems 5 years from now but then Covid will probably kill them if they catch it so it makes sense for them.

A rushed vaccine is not for all though, might even ruin the human race if billions take it and 12 years later we learn of x and y problems.</comment></comment>


'Man Tax' – The shop where men pay 7% more - <AUTHOR> http://www.bbc.co.uk/news/blogs-trending-37611512 <comment><USER2> Regardless of what one might think of the initiative, how is this legal?

Even with the weird justification "So the 'man tax' is essentially a promotion that favours female customers.", is it legal to give a discount based on sex only?

</comment><comment><AUTHOR> My favourite part of this is the earnest reporting of online quotes, leading to the very odd looking "LooseGoose89 said they felt the tax was unfair"

Just weird

<comment><USER3> In the future internet commenters will be infamous celebrities. They already are legendary.

Wouldn't you buy a trashy celeb magazine if it had /u/fuckswithducks and /u/_vargas_ in it?

It would be some kind of wonderful.</comment></comment>


Ask HN: How much time per week do you spend on side projects? - <AUTHOR> <comment><USER2> To everybody posting about not working on a side project because of children, I would ask you to reconsider that if you're truly passionate about something and want to develop it. I've been working on a side project for a few years now. I also have kids and spend a lot of time with them. I've discovered that it's actually very beneficial to spend an extended time working on a project, and by extended time, I don't mean hours every day. I mean stretching the project out over years. For one thing, it gives you the freedom to reconsider solutions and approaches. Work is usually focused on delivering as quickly as possible. It's very refreshing to have the time to consider a problem thoroughly and let it play in your subconscious freely. Also, your kids need time to themselves too so there's no need to feel guilty. But to answer the question, I spend probably 0-15 hours per week, usually working at night after the kids have gone to bed.

<comment><USER3> Seconded. It took me two years to build my current side project, and that's ok. I am no longer 20, I don't have to rush to do everything in an instant.

I also noticed that because of the slower pace I often avoid solving problems that can be bypassed altogether. When working at a frantic pace I'd often notice that I solved a problem that didn't really need solving.

<comment><USER4> Someone once said 90% of problems go away if ignored. In the 19th century British foreign policy coined a phrase for this approach: "masterly inactivity".

</comment></comment></comment><comment><USER5> I replaced programming with woodworking. I find it a lot more enjoyable after 8 hours of building software and 1 - 2 hours of administrative work to transition to building "hardware". My side projects are all furniture my wife or other family members ask for.

<comment><USER6> This is happening to me at the moment, currently upcycling an old timber door into a bench

I find woodworking a lot more satisfying than coding. You can point to something solid and say, "I made that", and your family don't have to be technophiles to enjoy and appreciate it

<comment><USER7> My code has a much bigger immediate impact. But I always assume that 10 years from now it will all have been rewritten or projects replaced/cancelled. However, my wood projects that I've given to family will be passed down to the next generations (hopefully).

</comment></comment></comment><comment><USER8> None. After my first cup of coffee in the morning when I have artificial enthusiasm I always tell myself I will start when I get home, but after 9 hours of making somebody else rich, I am just out of energy, and not interested enough in software to push through.

<comment><USER9> Sounds like me...only I procrastinate and spend all the time I would working on a side project --thinking up ideas, or 'researching' what others are doing so I can copy/make better/build it and make$$.. Seems I never get past that 'market research' phase .... spend too much time on hackernews/reddit/indiehackers.

<comment><USER10> Have I posted this while i was sleeping? It sounds exactly like me. I guess I am bitten by analysis paralysis bug. With hundreds of new frameworks coming out each day, one day you think to solve a problem with shiny new tool, next day there is a new one. I spend @ couple of hours each day "thinking" about items to build, unfortunately not been able to draw a line in sand and start it.

</comment></comment></comment><comment><USER11> I have a wife and 3 young kids, so I have no side projects. I wouldn't miss these years for anything

<comment><USER12> +1 before I had kids I spent maybe 5-10 hours a week on random side projects and freelancing, since I had twins they are my full-time job and my full-time job became kind of side project

</comment></comment><comment><USER13> 2 - 6 hours a week but that's going to go up as I turn it into a real business. Eventually I will quit my full time job but for some amount of time it will be like having two jobs.

I pretty much make my wife mad at me every Saturday by locking myself in the office while she watches our daughter.

But I hope that if I can make something of it then it will help my daughter and our family long term more than my current job can.

I also try to dedicate at least as much time (usually double) bonding with my daughter (she is a year and a half). They are only this young once.

</comment><comment><USER14> About 5 hours a week on [https://getelapse.com](https://getelapse.com), chunked into 20 minute slots like lunch breaks or downtime at home between family stuff. The only way I'm able to make forward progress is by being super strict about CI+CD.

It's actually doing a good job of forcing me to code really well, because if you've only got 20 minutes to get a _thing_ done, you can't have much cognitive overhead or switching costs.

<comment><USER15> Sound like you are dog-fooding your product:

       https://getelapse.com: "An elegantly simple tool to help you focus on the tasks you need to get done."

<comment><USER14> Sure am! :)

</comment></comment></comment><comment><USER16> 2-3 hours a week on Chavah Messianic Radio[0], a non-commercial Pandora-like radio station for my religious community.

It's been going for several years now, and enjoys a nice user base. It started out in Silverlight, then KnockoutJS, and now AngularJS [1].

[0]: [https://messianicradio.com](https://messianicradio.com)

[1]: [http://github.com/judahgabriel/chavah](http://github.com/judahgabriel/chavah)

</comment><comment><USER17> Depends highly on family scheduling.

On weeks where I have a free Saturday (no kids or girlfriend) I can get in a solid 8-12 hours depending on motivation and other chores.

On weeks where I don't get that Saturday it can range from 2-6 hours if I'm lucky.

My current side project is something that if I had a company I could task out 2-4 devs, full-time, for probably 3-6 months just to get to beta state.

It actually really sucks, and is more depressing than I generally admit.

</comment><comment><USER18> Between 7 and 14 hours a week. It depends if I can dedicate one full day on the weekend to it. That happens rarely. Otherwise I stick to one hour every morning before work to do the most important thing. My side project is my website where I attempt to teach about web developement (JavaScript, React) [https://www.robinwieruch.de](https://www.robinwieruch.de)

</comment><comment><USER19> Before my side project became my main gig, I worked on it a couple of hours each evening. I told my girlfriend I was committing to the project and moved my computer desk and PC down to the tv room so we still spent time together while she was watching TV in the evenings.

We didn't have kids at the time, but I imagine the same thing still working now as kids are in bed by 7pm (on a good night!).

</comment><comment><USER20> None right now. Work demands are exciting team capacity so I'm often needed for overtime work. Any spare time is spent with family.

</comment><comment><USER21> I average about 14 hours per week on my animation platform. It took a few years to have a release: [http://www.superanimo.com](http://www.superanimo.com)

The difference for me was when I got a nights and weekends membership to a coworking space. Since I'm paying for it I force myself to go at least 3 times a week.

</comment><comment><USER22> I spend just 4 hours a week on my side projects.

Right now

1) building a newsletter about stories & life lessons by real mystics. www.realmystics.com (2 hours a week)

2) Building a platform for finding meditation workshops & art therapy classes in the city (2 hours a week) www.lightup.life

</comment><comment><USER23> I would say around 5/6hours a week. Most of it on the weekend. I am building [https://iheartreading.co/](https://iheartreading.co/). I have been working on it for a little bit than a year, with a big break last year (5/6 months without doing anything).

I try to spend maybe 15 min every day checking where I am at, and several hours per weekend, when possible, working on features etc.

Trying to work on it in the evening after my work day is challenging, as I have not a lot of energy/motivation.

</comment><comment><USER24> I usually spend one day every week. For the last few months, I have been doing a lot of side projects related to the use of machine learning in sports analytics and cyber security. I usually have an idea and spend the next few days trying to write code for the idea. I have had a lot of success with my side projects on Fsecurify.com and Crickytics.com. I initially got a lot of good response from people and that gave me motivation to keep doing these side projects.

</comment><comment><USER25> Some weeks a few hours, but usually none, honestly. I have lots of things I'd like to do and most of them I don't already spend 40 hours a week doing.

</comment><comment><USER26> Side projects hours are directly proportional to how happy, satisfied, and content I am with my say job.

At my previous job it tended to be 15+ per week easily. But now it tends to be 0-2 hours per week. It's not a bad problem to have; to enjoy and feel satisfied with everything at the day job.

I still wouldn't mind being more side project engaged sometimes though. It's always a struggle.

<comment><USER27> I'm the same way. My current work project is in fact more interesting and ambitious than any of my side projects (distributed rules engine fed with realtime sensor data to take autonomous action to optimize workplace convenience for office workers), so I haven't spent meaningful amounts of time on a side project in months.

I do still work on dev talks to give to user groups, it engages a different side of my brain than the programming side projects do.

</comment></comment><comment><USER28> For my side project, [https://www.rabbitmqhosting.com](https://www.rabbitmqhosting.com), I usually spend about 1 hour per day(average 5hrs per week).

As a developer I usually find the marketing side of things to be a bit tricky to do. So as a workaround I usually carry out marketing during my 40minute commute to my day job.

</comment><comment><USER29> I have a bunch of side projects. I spend about 5-10 hours per week on them, but usually just one project at a time. For example, one week I might spend 5 hours working on a Hamilton costume. The next week I might spend 8 hours working on my MUD, and the following week a few hours on my arcade cabinet.

None of my projects are really monetizable...

</comment><comment><USER30> Usually about 12 hours. I try to get 2 to 3 hours in on weekdays as soon as I get home from the office. I take weekends off unless I'm feeling particularly motivated/inspired, but with the MLB, NASCAR, F1, and Indycar seasons in full swing right now, my weekend schedule is pretty packed...

</comment><comment><USER31> 40+ haha.

Im a Freelance Javascript developer currently having a very easy/boring job.. No kids, no wife, just a dog :)

So including weekends I easy hit more then 40 hours!

TradeJS

[https://github.com/DutchKevv/TradeJS](https://github.com/DutchKevv/TradeJS)

<comment><USER4> Very slick GUI: nice work!

<comment><USER32> Thanks! :D

Still working on it hard. My plan is to have a stable v0.0.1 by end of next week

</comment></comment></comment><comment><USER33> 2 - 3 hours in the morning, 3 - 4 at night. Most nights.

I take Saturdays off for the most part, Sundays I work for 4 - 5 hours.

So like anywhere between a few and another full-time job. Admittedly it isn't a side project, more of a side-venture I am trying to make my full-time job.

</comment><comment><USER34> 12.5 - 30 hours depending on how motivated I am. I have a 3 hour commute (round trip) with 2.5 hours of that on a train so it is perfect time to work. At night it all depends on my motivation

</comment><comment><USER35> 50% of my time is dedicated to my side project (20-40 hours).

Over the last 2 years I cut consulting hours down to 20, and increased my hourly rate so I could work 50% of the time for 75% of the money.

</comment><comment><USER36> None. 40-50 hours a week coding at my day job is more than I need.

</comment><comment><USER37> Lately an hour or two per week. The only free time I get during the week is on weekends and I usually prefer other things over my side projects.

</comment><comment><USER38> Between 6-9 hours per week. I'm able to work about 3 hours at night, after an 8 hour work day. Usually 2-3 nights per week.

</comment><comment><USER39> I try to get in 20-30 hours a week just now.

(Have dropped most other activities because I am pushing to try launch in couple of months).

<comment><USER40> I think at that stage it becomes your main project!

<comment><USER39> Still have a main job 40 hours a week. (But yes working on making it main!)

</comment></comment></comment><comment><USER41> about 20 hours per week, says RescueTime. I also work 10+ hours a day, 5 days a week at a full-time job.

<comment><USER42> How do you find time for family?

<comment><USER17> Not everybody has a family.

<comment><USER42> True, but it seems to be a pattern in all the articles.

</comment></comment></comment></comment><comment><USER43> Probably around 10 hours a week. Usually this is all on Sunday. I'm dead to the world on Sundays.

</comment><comment><USER44> It severely depends on the mood (even in long term). From 3-5 during bad weeks to 20+ for good ones.

</comment><comment><USER45> 10 hours a week based on how busy I am.

You really need to pre-plan what you will do to get the most out of the time.

</comment><comment><USER46> around 10 hours per week working on a social word game for polish market: [https://goo.gl/MQkme0](https://goo.gl/MQkme0)

</comment><comment><USER47> Some hours... 3-6, max 10 if it's really interesting...

</comment><comment><AUTHOR> now that I have kids it very hard to find time anymore.

</comment><comment><USER48> About 10 hours on a good week. Zero on a bad week.

</comment><comment><USER49> Not enough for my own satisfaction.

</comment><comment><USER50> 20+ hours a week.

</comment><comment><USER51> 3-6</comment>


The Fight to Mine Your Data and Sell It to Your Boss - <AUTHOR> https://www.bloomberg.com/news/features/2017-11-15/the-brutal-fight-to-mine-your-data-and-sell-it-to-your-boss <comment><USER2> The poignant part of the headline here is "sell it to your boss". I think we have already lost the battle over data mining. It is happening, and will continue to happen and it seems to me there is really nothing we can do short of drastically restructuring the entire Internet.

The biggest problem is when you combine intrusive massive surveillance with a ultra-powerful entity that can be capricious, malicious, and often abuses and punishes its underlings. This is why I am far more concerned (as a selfish American, thinking for now only about the concerns of Americans) about the FBI having unlimited surveillance powers than the NSA: the FBI has a history of committing crime, horrifying suppression of speech, dissents, political movements, of destroying the lives of innocents, etc. The FBI can knock on your door with guns and throw in you a cage for decades. It has massive power over us so it is important we do not give it massive information about us at the same time.

The same is true with bosses. One technique to deal with this is to try and firewall the information off away from the powerful. This is what we did to the FBI before parallel construction (bills that say data will be collected "only for terrorism" \-- a lie, obviously, as it always is, but one that made the collection palatable). The article focuses on this approach, which is in my view a lost cause, but a lost cause worth fighting for nonetheless.

The other approach is to take away power from bosses. Right now a boss has complete and total power over his employees without labor unions or worker protections (i.e. the current state of affairs in the US). It is this combination with the information that is so disgusting and dystopian. So we could, instead, talk about taking away the _power_ , rather than taking away the _information_ \-- which would have the added benefit of solving many other social problems along the way.

<comment><USER3> An approach we can take on an individual level is to be mindful of the data we are giving up. If you are employed and in the process of job hunting, then stop "liking" the article headlined "10 Reasons why you deserve better from your company".

<comment><USER4> I call BS on the comments that say doing what you suggest is giving up... To me, "Liking" something implies expressing your opinion publicly, probably via Facebook. When I receive a job application, the first thing I do is check to see what the person has publicly posted. That's not surveillance. Before the general population starts to worry about surveillance, they need to think about the public image they are portraying online. I can't hire someone who posts stupid shit publicly. It could damage my business if my clients look them up.

<comment><USER5> _That 's not surveillance_

Yes it is. No less than if you got their postal address from their CV, parked outside their house and watched who came and went. After all they volunteered their details and the street outside their house is public... right?

<comment><USER6> I mean, it is clearly "less" isn't it?

This continuum fallacy stuff really just makes privacy advocates look like kooks.

You have to use the language other people use if you want to convince them, and normal people do not draw an equivalence between someone googling their name, and someone staking out their house, because there is an ocean between them.

<comment><USER5> _This continuum fallacy stuff really just makes privacy advocates look like kooks_

You've clearly not read the article, in which a judge says that planting a tracking device on a car is materially different than tailing it.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm going to posit that most of us are spoiled by how much attention we get from recruiters, which is why the attention on this article seems to be on the legality of scraping someones site are not.

The focus should be on how disturbing it is that a company is using metrics like "independence from employer brand" to take the power out of the hands of the worker and put it into the hands of the corporation who already wields so much power and influence over our society.

Programmers are lucky, a last bastion of decent treatment by corporations. Companies like HiQ are looking to tip the scale back in favor of the corporation, run by people like Mark Weidick who want to be a useful and well kept pet and identify as a "Silicon Valley entrepreneur. Hollywood wanna-be." (twitter)

I fear secretive preemptive firing and hiring. "Talks" from your manager, based on encroachments into your private internet browser. This will force developers to combine their personal identity with their corporate identity (which far too many developers do already wearing their respective companies t-shirt like a big walking free advertisement) and curate their online life to reflect how grateful they are to the lords of their fiefdom.

<comment><USER8> Give it time, and _Snow Crash_ is going to look like a utopian vision.

<comment><USER9> The day I wipe my ass with dollar bills will be one of the saddest days in my life. (Note: Employer, NSA, FBI, DHS, this one's for you!)

</comment></comment></comment><comment><USER10> I think the two main questions raised in this case:

1\. Is it always ok for someone to build a bot to do something which can be legally done by hand? Example: Building a LinkedIn scraper that tracks all public data. Or using a GPS tracker to track a car, instead of manually following it

2\. Is it anti-competitive practice, and a violation of anti-trust laws, for LinkedIn to allow the general public, and other companies like Google, access to its public data, but ban others such as HiQ?

On question 1, I tend to lean towards LinkedIn's position. Just because something can be legally done by hand, shouldn't automatically mean that we should allow it to be done at massive scale by automated scripts. I wouldn't want companies having the right to surveil the movements of every citizen 24/7, just because they have the right to follow someone on foot, and I think a similar argument can be made against HiQ.

On question 2 though, I agree with HiQ. LinkedIn's attempt to ban HiQ doesn't seem like an attempt to protect their users, but rather, an anti-competitive attempt to kill off a potential competitor, and secure the market for themselves.

<comment><USER11> Haven't the courts already decided that if things can be done by hand then they can be automated? For example license plate scanners were ruled legal because officers can view that information in public, but the automation allows the police to follow everyones movements with only a few machines set up. This ship has sailed

<comment><USER12> Automated license plate scanning is probably legal for local municipalities (Neil v Fairfax County, SC appeal pending).

That doesn't mean it's legal for private entities to do so, nor is necessarily legal for such data to be, for example, aggregated nation-wide.

See [https://www.theatlantic.com/politics/archive/2014/02/mass- su...](https://www.theatlantic.com/politics/archive/2014/02/mass-surveillance- of-all-car-trips-is-nearly-upon-us/283922/) for Conor Friedersdorf's article which is attributed with bringing down the last attempt for a "Homeland Security" database of where you were last summer.

<comment><USER13> The correct solution for this concern is to make it legal to obscure the IDENTIFYING part of the license plates (but require that state and 'tabs' are still exposed) while it is parked.

Moving the obscurity would constitute modification of private property and should require either a valid documented probable cause or a warrant for the search.

</comment></comment></comment></comment><comment><USER14> This approach strikes me as confusing _precision_ for _accuracy_. It is possible to use this sort of information to formulate an extremely precise model. That apparent precision becomes believable because ... it's precise and complex and uses a lot of data. That then becomes a salable product.

However, whether this all is actionable and accurate is another and unfortunately _later_ question. The promoters and customers of that approach might want to read this chapter in the CIA's _Psychology of Intelligence Analysis_ :

Chapter 5: Do You Really Need More Information?

[https://www.cia.gov/library/center-for-the-study-of- intellig...](https://www.cia.gov/library/center-for-the-study-of- intelligence/csi-publications/books-and-monographs/psychology-of-intelligence- analysis/art8.html)

But then they might not have a product to sell or buy.

<comment><USER15> I dunno, I was accutely aware that as I prepared to find a new job by updating my resume, updating my LinkedIn profile and contact list for the first time in years, etc., that it would be very obvious to anyone watching what I was doing. I correctly assumed my employer wasn't watching (which would have made things potentially uncomfortable for me), but with tools like this it becomes so low effort to watch for this stuff that they can afford to do it.

No, not everyone is like me and ignores LinkedIn while actively and happily employed, but I imagine enough people are and that it's not so hard to build models of other user types that work as advertised (as long as they have access to the public data).

HiQ is a threat to LinkedIn on two fronts: as a direct competitor and as a reason for some people to opt out of using the service (though it appears LinkedIn offers similar services, so perhaps the threat is more the Streisand effect at work). That doesn't mean HiQ should be locked out of the data of course, but it makes for an interesting and complicated situation.

<comment><USER14> I'm not saying that social media doesn't exist and that anything you say can't and won't be used against you in a court of law. It will be. What I am saying is that relying on a complex model based on this is just rank silliness. Still, I guarantee that that rank silliness will be a product, it will be sold and and it will be bought.

For a big market with small bets (ads) this makes sense. For a small market with big bets (employment) it doesn't make sense, to me at least.

<comment><USER16> I think you make the mistake of not thinking in statistics.

It doesn't matter if it's not always right, it only matters if it's better than what they have at the moment (ie: almost nothing).

Like the quoted bank said in the article, improving retention by 1% can lower costs by 100 mil per year. Offering a raise to people polishing their Linked in page sounds like low hanging fruit to me.

And of course, employees will try to game the system, which will become smarter and so on.

<comment><USER14> A statistician went duck hunting. His first shot was a foot high. His second shot was a foot low. When asked about it he said, _On average, that 's a dead duck._

As I said, there are markets, large markets like ad auctions, where this approach makes sense. But for HR, I'd have to see this being a demonstrable success story before I'd touch it. I think there are better and easier approaches to retention like treating your employees well rather than looking at a statistics dashboard and following its sage if soul-less advice.

</comment></comment></comment></comment></comment><comment><USER17> What HiQ are doing will be illegal in Britain when the new data protection regulations are introduced in May 2019.

You will no longer be allowed to collect and store personal data without content.

</comment><comment><USER18> Well now it is time to delete my LinkedIn account. There terms and services say that would not allow people to steal my information and that my information is my own. I have never agreed for my info to be resold by HiQ. Now that it is illegal for LinkedIn to protect me from HiQ's theft the only option I have is to drop LinkedIn.

<comment><USER19> I believe it's done only on publicly visible accounts, modify your privacy settings _if_ you don't want to go all the way to deactivation.

</comment></comment><comment><USER20> Now I'm just glad I never signed up for LinkedIn or any of these. Can't trust any data repository that's not my own.

</comment><comment> default-kramer You know, I think LinkedIn actually has a point that blocking certain scrapers is in the interest of their users' privacy. Of course, they are really just trying to stifle a competitor (glad the judge called them out on it) but I still think they should have a right to block scrapers at will.

<comment><USER17> The judges argument is fine, if HiQ had to contact every profile owner and ask for their consent to store and use their data. Otherwise, how does a individual know where their information is going?

</comment></comment><comment><USER21> It's interesting to see EPIC and EFF on different sides of the same issue. I don't feel like i've ever seen that happen.

<comment><USER22> I wonder if it might've been best for the EFF to just stay out of this one entirely, because it seems like sticking up for either side is defending and normalizing a shitty proposition. I see their point that LinkedIn is abusing the CFAA to stop competitive scrapers, but on the other hand, evil as LinkedIn may be, at least the users on it agreed to its terms. If I sign up for LinkedIn and give them my data, I agreed to that. If HiQ slurps it up, I'm not consenting to whatever sinister things they decide to do with it. That feels wrong and not something the EFF should be sticking up for.

(Disclosure: I used to work for Microsoft, which now owns LinkedIn, although I like to think I'd have this opinion either way)

<comment><USER16> Yes, I don't quite get EFF's point.

So they are saying that anybody should be allowed to scrape anything found online, and use that data for any purpose?

In this case it can be argued they use the data against the physical's person about who the data is.

So they wouldn't object if banks or credit companies would use the data to reject non-desirable people.

<comment><USER13> My armchair impression is that the EFF doesn't like the prescient this might set. I think you are correct in them wanting individuals to be able to scrape or otherwise mechanically process anything which they can normally view.

The real chilling effect is from the lack of actual privacy on the data it's self; and the existing asymmetry of power in the employee / employee model as we know it today.

</comment></comment></comment></comment><comment><USER23> I am so thankful I don't have a LinkedIn, Facebook, etc. account to mine for data.

<comment><USER24> I assure you that Facebook knows all about you whether you have an account or not.

<comment><USER25> Highly doubtful has any idea of even gender and age. They have a broad idea of localization and perhaps a pretty laughable attempt at "interests". Absolutely guaranteed to be nothing of value though.

<comment><USER26> Oh they have much more than this.

Messenger asks nicely to upload your whole address book, and since half your college buddies clicked yes they know when and where you studied, and who you knew, and your parents landline thus some idea of their location (and how wealthy it is). Ditto your colleagues at each place you worked, who all still have your old corporate email, and some have newer info...

And that's before anyone posts anything on facebook.

<comment><USER25> And yet they can't show even a semi-related ad if their entire existence counted on it.

They have the data, yes. But they will ruin society before having any idea on how to use it.

Most importantly. They can not correlate that with my IP or my browsing history. So that information is beyond useless when trying to track me and only slightly useful for researching the society in which I grew up (which facebook isn't interested in anyway).

<comment><USER26> This is also true. I don't see how they're making money off their extensive knowledge about me.

When I make the mistake of buying something online in a browser logged into facebook, then I get adds for a week trying to sell me what I just bought... this does not lead to me buying another one! And all this strategy seems to need is basic cookies, not a shadow profile.

</comment></comment></comment></comment></comment></comment><comment><USER27> There's a positive framing of the idea of mining (or collecting) information about yourself and selling it to your boss: it can help get you raises and promotions.

After all, when you ask for a raise you're in a wonderful negotiating position when your value is clearly quantified. When you mine/collect the information yourself, you get to choose how and when you present it. Thus you are selling the information to your boss and reaping the rewards yourself.

<comment><USER28> At first, it will help you get raises. Then over time as everyone does it, you won't get a raise unless you participate. Over time, you won't get hired at all unless you participate.

</comment></comment><comment><USER29> The official opinions of EFF and EPIC on the case:

* EFF: [https://www.eff.org/deeplinks/2017/08/judge-cracks-down-link...](https://www.eff.org/deeplinks/2017/08/judge-cracks-down-linkedins-shameful-abuse-computer-break-law)

* EPIC: [https://epic.org/amicus/cfaa/linkedin/](https://epic.org/amicus/cfaa/linkedin/)

</comment><comment><USER30> Why does HiQ have any right to my data in the first place?

<comment><USER31> Because people self-submitted their own information to LinkedIn with the desire for it to be publicly accessible.

<comment><USER32> And what is the reason people want their own information to be publicly accessible you think?

My public information on LinkedIn is public - to market myself. I didn't make it public so that another company could store it in their own databases, analyse it and sell it to "my boss".

This is a discussion touched upon in the article "What were the public squares and private rooms of the web? Who got to determine access? Should data be protected as speech?"

Anyway, as mentioned in another comment, the highly unethical work HiQ is doing will be hard to capitalize on with the GDPR coming up.

</comment></comment></comment><comment><USER33> I think LinkedIn's mistake was letting the lawyers fight over it. They could have just blocked the bots with a captcha and called it a day.

<comment><USER28> Captcha's are easy to beat these days, even fancy reCaptchas. They make the process harder and a bit more expensive, but they don't solve the problem.

</comment></comment><comment><USER34> Good.

My Boss is going to find out I volunteer at soup kitchens and help old ladies across the street. Oh, and I also love his favorite band and agree with him politically and didn't even have to gratuitously mention this around the office like a big suck up. A promotion is just around the corner!

Wasn't it just last week we saw articles on the front page almost every day about how we can't trust information from the Internet because Facebook and Google are big lying spying monopolies and sell clicks to anyone and don't responsibly curate like they are supposed to and we should all go back to reading the newspaper to get the real facts on life? Ya, pretty sure that was the gist of them. Anyway, hopefully my boss didn't read any of those. We'll just leave him believing that data mining and scraping and twitter sentiment analysis have super secret powers to reveal the hidden truth about the world.

</comment><comment><USER35> This is stupid. While my boss has vested interest in my data, I am the only one that can benefit or change because of it.

<comment><USER36> If your employer knows you are looking for other opportunities, they could stop giving you projects and start transitioning you before you are ready, or just fire you.

That's a benefit to the employer, that probably is not a benefit to you, since you would likely want to quit on your own terms.

Another quick example is knowing that your employees are researching how to unionize, and thus knowing to bring in anti-union resources.

I'm sure there are more.

<comment><USER37> Or even create a self-fulfilling prophecy. What if someone is listed as "may leave" when they have no intent to do so. If the employer then starts freezing the employee out, that could lead the the employee eventually leaving, even if they didn't originally want to.</comment></comment></comment>


A CLI application for controlling Spotify - <AUTHOR> https://github.com/bjarneo/Pytify <comment><USER2> Pretty interesting, giving it a shot now. Is there a way to upvote songs/add to saved music from here? What if I want to play the 'discover weekly' playlist for example and save the songs I like?</comment>