How to Use Responsive Images - <AUTHOR> https://blog.ycombinator.com/how-to-use-responsive-images/ <comment><USER2> If you are using Webpack to build your application, you can take advantage of a fantastic loader called "responsive-loader" [0] which can automatically build smaller and smaller versions of an image which can be dumped into a srcSet automatically to give you a good amount of the benefits of responsive images without a ton of work customizing each  tag in your application.

Combine that with my plugin "imagemin-webpack-plugin" [1] which will ensure they are all compressed as well as you want, and you can get a fairly drop-in solution to massively reduce the size of images downloaded while keeping extremely high resolutions for user agents that want it, and without a ton of manual work on your part!

I've always wanted to look into taking this a step further and somehow determine the actual size of the image on the screen in various resolutions and then generate more accurate image sizes and fill in the `sizes` attribute. I've thought that you might be able to pull it off with some automated headless browsing of the built app with some work, but I never got around to trying it.

[0] [https://github.com/herrstucki/responsive- loader](https://github.com/herrstucki/responsive-loader)

[1] [https://github.com/Klathmon/imagemin-webpack- plugin](https://github.com/Klathmon/imagemin-webpack-plugin)

<comment><USER3> Fantastic! The webpack ecosystem maybe fiddly and overwhelming, but as soon as you have a nice, solid selection of tools wired up and working it becomes very powerful. I'm really excited about the two packages you mention. :D Thank you for sharing this!

</comment></comment><comment><USER4> I get why this is done, and it is important. But look at the amount of effort and time that goes into displaying a single image properly on the web nowadays. It's just nuts.

It feels like we are slaves to the tech and not the other way around.

<comment><USER5> You should read up on Client Hints. Allows the browser to automatically send desired size and pixel density down the image request, where the CDN can then serve up the appropriate file. Basically means for most cases you could go back to using a single  tag.

It's Chrome only for now but it's a nice future.

</comment></comment><comment><USER6> What is the compatibility with older browsers? Useful to know when designing for countries with expensive bandwidth or outdated smart phones

<comment><USER7> [https://caniuse.com/#feat=srcset](https://caniuse.com/#feat=srcset)

</comment></comment><comment><AUTHOR> Author here if anyone has follow up about the post, ama.

<comment><USER8> Nifty post. Always think the world could stand to learn more about srcset/sizes.

About a year ago, I went all the way down the rabbit hole of programmatically generating `srcset` attributes and wrote about it:

[http://kellysutton.com/2016/06/23/boiling-the-ocean-with- mar...](http://kellysutton.com/2016/06/23/boiling-the-ocean-with-markup.html)

</comment></comment><comment><USER9> Not a web expert here, but don't CSS media queries and "background-image: url(blah/blah/blah.jpg)" already achieve pretty much all of this?

With the advantage that you have attributes (background-size, etc) to handle image resizing and alignment without having to faff around with imgs, divs to contain said imgs and a bunch of CSS rules for each for hours?

AND the advantage that you can have one single file for "media" definitions that allows you to swap images around when needed (just change the url()) without having touch 347 HTML files just to set the image src?

Or maybe I am missing the point.

<comment><AUTHOR> You could do that, but there's a performance benefit to doing it with srcset/sizes in the html.

The cascading part of CSS means the a later rule could override an earlier one, so to determine which image variant to download when looking at the css the browser needs to parse the html, parse the css, link the two. A css rule may end up not even applying to any elements on the page if a particular selector has no matches. Only after all this can it begin downloading the actual images.

Using srcset/sizes the browser parses the html and can begin downloading the correct image variants immediately, before it parses css.

With prefetching enabled this means your browser could parse the html and cache all the image variants on the page that you'll need when hovering over a link to another page. So when you actually click on it everything is loaded from cache and super fast.

It's up the browser to manage situations of lower network speed, pixel density, etc. and to determine when and how much preloading to do. Using srcset/sizes just gives the browser the option to optimize as much as needed.

<comment><USER9> I think I understand what you are saying.

I did not consider the overhead of the browser parsing the CSS file and then figuring out which rules are applied where and depending on what rules are being applied, figuring out what else needs to be downloaded, etc.

But is that overhead really that significant? Or will the responsive images approach merely shave off a few % off the page load time?

<comment><USER2> While I think that the overhead on it's own might not be that much, even little gains of tens of MS can add up to improve the experience.

And something like srcSet will possibly allow the useragent to become "smarter" in the future. Perhaps halving image size when low on battery, or when on a limited mobile plan.

This isn't you choosing which image to serve who as a developer, it's serving up a bunch of options and letting the useragent choose which it knows is best for the user at that time.

</comment></comment></comment></comment><comment><USER10> There's no accent in the article that images should be optimized for the target screen dpi. It's wasteful to serve a 2x image for 1x screens and 1x when 2x is already present on the page.

Almost all CDNs/services compress images lightly if at all, offline tools are better at this, e.g. images from the reference page can be ~20% smaller. Ideally, hidpi images should be compressed harder, e.g. lower JPEG quality.

<comment><AUTHOR> Great points. The first article only lightly touches on those topics, in part 2 I'll talk more about the challenges and constraints that lead us to the srcset widths we use at Webflow and our image processing / compression stack.

Hopefully talking about the 'why' will help others make the right choices for their project.

The reference page will see improvements in the future as we enhance our process, but certainly resizing and optimizing variants by hand can yield even better results if you have the time.

What is worth noting from part 1 is that using pixel width variants in `srcset` will let the browser factor in dpi of your monitor as part of the calculation. So it wouldn't serve a 2x image where it only needed 1x.

It's not recommended to use high dpi images, 72dpi is the way to go for web content, with a larger (dimensions) version serving as the 2x variant.

</comment></comment><comment><USER11> Recently learnt in more depth around this, and did a really fun project to automate this in an ASP.net control.

Input is:

        <Controls:ResponsiveImageFixedSize runat="server"
            Alt="Logo"
            ImagePath="/global/construct-3-logo.png"
            Width="43"
            DisableLazyLoading="True"
        />

Renders as:

        <img width="43" height="44" srcset="https://s2.construct.net/images/v173/r/global/construct-3-logo_v43.png 1x, https://s2.construct.net/images/v173/r/global/construct-3-logo_v64.png 1.5x, https://s2.construct.net/images/v173/r/global/construct-3-logo_v90.png 2x, https://s3.construct.net/images/v173/r/global/construct-3-logo_v110.png 2.5x, https://s3.construct.net/images/v173/r/global/construct-3-logo_v130.png 3x" src="https://s2.construct.net/images/v173/r/global/construct-3-logo_v43.png" alt="Logo"/>

Works and looks great on high dpi displays. Lazy loading enabled renders something like:

At this point I was thinking that's actually a fair old chunk of text to display an image, but still worth doing.

It can be quite fiddly doing this, but it's nice when it's done and works as expected!

</comment><comment><USER12> If SVGs were embraced more broadly (and the standards team supported) many of the raster images would fall to the wayside. These recommendations are still totally valid for content-based images (photos, etc.).

Some sort of hybrid between the two, and the recs in the article, seem to be the future of visual imagery online.

<comment><AUTHOR> I'd love to also see something like FLIF get browser support. [http://flif.info/](http://flif.info/) where the user agent could set a preferred quality for images/variants based on network/device constraints. Or download the first say 20% of images on a page, only downloading more after staying on the page for a length of time.

</comment></comment><comment><USER13> Umm... How do I get to the post? It just takes me to the HN homepage.

<comment><USER13> Maybe it's my ad blocker on iOS.</comment></comment>


Ask HN What are the best designed website? - <AUTHOR>

I love the minimalistic design. I got inspiration from tons of website. I like few of the below design facebook.com quora.com (inspired by facebook) 280north.com github.com airbnb.com dropbox.com<p>Can you guys please give me your list of favorite minimalistic design. We thought a lot about the design, and we come up with one simpler style for our project http://www.codesnipr.com but thinking to redesign it again. Any thoughts on this? <comment><USER2> It's hard to tell if you're joking, but let's assume that you are not.

Before thinking about design, you MUST fix every typo and grammatical error on your page. I counted nine errors, several of which are repeated over and over again.

<comment><AUTHOR> Thanks for your comment. I am really sorry for making this much typo and grammatical error. I will try my best to be more careful best of my ability to rectify the same. As english is not my first language so must of basic grammatical error I am not able to spot if by myself. But it should not be excused, I will try my best to improve. Thanks again for your reply.</comment></comment>


How big is the Internet? - <AUTHOR> http://www.news.com.au/technology/story/0,28348,25857420-5018992,00.html

<comment><USER2> I totally thought this was going to be an article about the Morris Worm. Damn!

</comment><comment><USER3> That's cool. The 150 web address per person got me - one wonders what proportion of that is spam and/or subdirectories, however.

Sucks for Africa though :-(

</comment><comment><USER4> Wow, I was pretty surprised that the US does so well in terms of the percent of the population using the Internet.

<comment><USER5> It's all the white collar workers surfing from work :)</comment></comment>


Show HN: Sql2json – Python package to run SQL query and get JSON result - <AUTHOR> https://github.com/fsistemas/sql2json <comment><AUTHOR> I created a python package to run sql query and get json result.

I have created multiples python scripts to to run specific query return json, again and again.

But since now i only need to create my sql query and run it using sql2json.

I think that this tool can be useful for automations.

Right now i'm using it in personal project to run queries with dynamic date parameters and post result to a rest API with a linux cron job.

Also i'm testing it to send data to geckoboard using curl with sql2json response and geckoboard dataset api.

I want to receive some feedback from this community, how can improve it, is it useful for you.

Thanks

<comment><USER2> So are you using this mostly with something like Django on the backend? Aside from creating a REST API endpoint with python, I can't see many reasons to need this.

<comment><AUTHOR> No. It's focused to use as a command line and for automation not inside a webapp. You can see usage examples in github</comment></comment></comment>


7 reasons software developers should learn marketing - <AUTHOR> http://successfulsoftware.net/2015/06/10/7-reasons-software-developers-should-learn-marketing/

<comment><USER2> > 1\. Improved career prospects

Engineers' career prospects are already excellent. No need to bother based solely on this point.

> 2\. It's not rocket science

Standing on hands while picking one's nose is not one, too. It's not a reason to learn it, though.

> 3\. Less reliance on marketing people

This one might be sensible argument, but it's actually a duplicate of 7.

> 4\. Number crunching [...] Being good at crunching numbers is a big bonus > for some aspects of marketing.

So? It's a reason for one to learn marketing? Because his/her current skills might be useful there? It could be a reason if those were useless everywhere else.

> 5\. It's interesting

No, it's not, it's boring. Like archeology. Some people find it interesting, some do not.

> 6\. Diminishing returns on development skills [...] you won't improve as > much between your 9th and 10th year of programming as you did between your > 1st and 2nd year.

Oh, you would be surprised. There's so much in software engineering to discover, one just needs to look a little higher than building just another web shopping application.

> 7\. You'll need it if you ever start your own software business

Yes. Or maybe not, if I happen to have a co-founder who already knows it. And not everyone starts their own business, plenty of people just works for somebody else.

<comment><USER3> >Engineers' career prospects are already excellent

But will your prospects be so excellent in 10 or 20 years time? Having marketing and development skills gives you more options.

<comment><USER2> Similarly learning carpentry or welding, but those two are more constructive.</comment></comment></comment>


NHSbuntu – an OS for the NHS [video] - <AUTHOR> https://nhsbuntu.org/ <comment><USER2> I do think running hospitals on Linux is a good idea. However just sticking a skin over $YOUR_FAVORITE_DISTRO may not quite work. Hospitals have to work with proprietary devices -- for example, retinal scanners etc, many of which only have Windows drivers.

Also, while updating individual Linux systems is easy, patching Linux at scale across the thousands of desktops in the NHS needs a proper, thought-out patching strategy to eliminate breakage. You also need to consider -- in what cadence do I actually evergreen old systems?

The NHS could easily have this problem with any OS -- the actual culprit being a total lack of security-mindedness among the various NHS trusts' budget- holders. They viewed IT Security as not worth spending upon and are paying the price.

<comment><USER3> The NSH simply states that Linux drivers will be provided and supported by the Vendor or no sale. This is not hard.

<comment><USER4> But what about the billions of pounds worth of existing equipment?

<comment><USER5> If it works with XP, chances are it will work with Wine or VirtualBox. Where there is a will, there is a way.

 _But_ it would mean giving a huge F* YOU to established networks of parasi- er, _vendors_ specialised in public sector tenders - Microsoft being the king of them all.

</comment></comment></comment></comment><comment><USER6> It's nice to see something like this being proposed, but, the NHS probably have a tonne of bespoke software running on top of Windows, all of which would need to be ported. And given the fact that they don't have the funding to even keep their existing systems patched and up-to-date, a full-on migration is out of the question, unless the cash is raised...

<comment><USER7> True, but it's a long- vs. short-term cash problem. The new system would cost a lot in the first few years, but less on the long term as MS licenses won't have to be paid.

<comment> UK-AL NHS would need to pay someone for Linux desktop support. It's normally as expensive as windows.

<comment><USER8> I do not know how people can entertain this myth that linux support is as expensive as windows. The stability of linux applications is incredible compared with the brutal changes of windows (xp -> vista/7 -> 8 -> 10). Remote administration is far more easier and deployment on many machines is trivial. Machines rot is a lot slower, reducing the cost of machine replacement.

IMHO, the main cost is replacing the old window support guys by linux support guys because people a rarely competent in both and erasing the windows way of thinking is very difficult. The new team has to learn the specific needs and manner of NHS. Once they have the same experience as the previous team, the cost should melt.

<comment> UK-AL It's nothing to do with the support guys. It's do with the support by the vender.

When you deploy an os over something as large as the NHS, your going to hit a few snags, perhaps at the code level. You will need somebody who you can phone up, who will then go bug fix those issues.

Vendors like redhat have support licences that support this. And those licences are still fairly expensive.

If NHS was going to deploy a Linux Distribution, they will have to bring a Linux distribution vender onboard which would take the role Microsoft does now.

</comment></comment></comment></comment></comment><comment><USER9> Hi, I'm one of the founders of NHSbuntu. Thanks for making a thread on Hacker News about us, we really feel like we've made it!

Just to reassure people who maybe think because of the timing of our launch that we had something to do with the recent NHS Cyber Attacks, it was just an unfortunate coincidence.

I'm an NHS doctor and the rest of the team are NHS tech specialists, including a Technical Architect and a CIO. We've no interest in ransoming the NHS, but we did want to disruptively highlight the non-Microsoft OS options available.

We know the name NHSbuntu is a bit stupid, for several reasons, but (for the target audience) in 8 characters it does explain what we're trying to do fairly concisely. Neither Canonical or the NHS Brand Police seem particularly upset by it, so that's a good sign. Maybe in the future we'll have to change to something more suitable.

Anyone wanting to get involved please join in at www.nhsbuntu.org (we have a Slack team and a forum) - we are trying to build a team of contributors.

</comment><comment><USER10> Does this solve any of the problems that hospitals would have previously had, according to other posters on HN, wherein updating software can render a piece of equipment no longer having been tested properly/breaking the system because of some reliance on some weird software implementation?

</comment><comment><USER11> I struggle to see how swapping to an open-source alternative to Windows will effectively protect the NHS. Sure, this time it was a Windows exploit but it'd be as easy to find and use a Linux exploit. Sure there's the fact that Windows is vastly more popular, but telling everyone to switch to Linux? You've just made that more popular and a more likely target.

I'm an advocate of open-source software, but lets not pretend it'll solve everything.

Also, what about all the software they can't afford to replace? A lot of it is bespoke, and it's written for Windows. Don't pretend they have the money to port it. Their budget never will be the 350 million per week the public seems so obsessed with.

Finally, this is just Ubuntu, right? What's all the NHS branding for? If they're going to seriously consider it, surely they are going to look a bit further than the shiny surface NHSbuntu provides them.

Conclusion: Yes, use open-source operating systems, but no, it doesn't fix all, or sometimes even any, problems unless the code is thoroughly audited (shout out OpenBSD).

</comment><comment><USER12> Nice idea, but any links whatsoever to the NHS or permission to use their logo? There's no sign of such yet on the site.

If you really want to do this, one thing you'll need is to make sure existing vertical market software works perfectly in Wine - e.g. Informatica, which is stupendously popular in England and Scotland and is officially supplied by NHS Wales.

</comment><comment><USER13> How long was this in the making and also it must have been very beneficial that last weeks cyber attacks occurred?!

<comment><USER14> Well, around Jan 31st according to [1], more interesting details are listed in a presentation made for SXSW [2]

[1] [https://nhsbuntu.org/nhsbuntu/2017/01/31/initial- post/](https://nhsbuntu.org/nhsbuntu/2017/01/31/initial-post/) [2] [https://nhsbuntu.org/nhsbuntu/2017/04/26/sxsw-show-and- tell/](https://nhsbuntu.org/nhsbuntu/2017/04/26/sxsw-show-and-tell/)

</comment></comment><comment><USER15> Look at what Scientific Linux did - as I recall, they didn't like the changes that RHEL did (backend for OpenSSL) so they did their own respin.

THAT is what they need for the NHS, and any other industry that needs a really long support period.

RHEL gives ~10 years support, the MRI scanners etc need at least 15. On top of that, the customers also need guarantees that the vendors of the MRI scanners or whatever will keep up with this.

So - no more of using whatever library you like, or php extension - it's a case of - this is the base OS, build it on that.

This is a fuckup on so many levels - the vendors, the NHS for not giving a shit, the government for not mandating an open solution. The one I can't blame, for once, is Microsoft - they're supported XP for 13 years, thats enough.

</comment><comment><USER16> Good on them for making it feel familiar, but stealing all those icons straight up seems pretty risky.

</comment><comment><USER17> The video is slick-ish, but we've seen it before. How many healthcare professionals (doctor, nurses etc.) were asked? Simply throwing a new OS at the problem doesn't solve things without the end users input or without an _real_ understanding of the issues that they and the sys admins face. Also, the cost of hiring staff to maintain and manage is higher and retraining would be a massive cost too. _" Just use linux[0]"_ is almost the same in this instance as saying _" you're holding it wrong"_.

[0] It's really all the site and video say...

</comment><comment><USER11> On the Github page: © openhealthhub.org 2017

If you follow that address, you find this forum post: [https://www.openhealthhub.org/t/welcome-to- nhsbuntu/908](https://www.openhealthhub.org/t/welcome-to-nhsbuntu/908)

NHSbuntu was launched 20 days ago, before the recent attack.

</comment><comment><USER18> If you're going to try and create a project that attempts to persuade a public sector procurer to make a major platform change, having a wacky Team page is probably not the best way to go.

</comment><comment> UK-AL Does it have something that is at least as powerful as active directory?

If not, it's a no go for an organisation such as the NHS.

<comment><USER19> Active Directory works with Linux, I'm not sure how easy it is though.

<comment> UK-AL It doesn't work very well with group policy.

<comment><USER8> Trying to solve windows specific issues using windows solutions has a tendency to not work very well. Once you get accustomed, administration of a linux park is far easier. Try to avoid dependencies from these piles of crap.

<comment> UK-AL But there isn't good alternative for client operating system. The best you can do use devops tools, but you can tell they're really built for server deployments.

<comment><AUTHOR> Why do you think they don't work?

</comment></comment></comment></comment></comment></comment><comment><USER20> its a very good idea – not a good name choice. Healthbuntu maybe at a push.

<comment><USER21> I would have argued that Deathbuntu sounds way better, but the name might be inappropriate there...

On a more serious note, I agree that the name choice isn't particularly good, but is *buntu really relevant? I get that it might appeal to the technical minded people (and the creators probably belong to that category), or may sound a bit familiar to the masses, but I don't see any reason for them to keep this part of the name.

I would have named it after a drug or a scientist, I think.

The bottom line is that the name itself isn't very relevant. A good name would be something easy to spell, and with a neutral conotation, not too hard to remember, but without attracting too much attention, as this is supposed to be just a tool.

</comment></comment><comment> m-j-fox > Encrypted By Default

Just like NHS's Windows boxen.

</comment><comment><USER22> A quick whois lookup suggests the domain name was registered on April 26. This is after we knew about EternalBlue and DoublePulsar, but suspiciously before the May 12th onslaught of WannaCry at the NHS. Also, the domain status is "serverTransferProhibited" ([https://icann.org/epp#serverTransferProhibited](https://icann.org/epp#serverTransferProhibited)). Very interesting.

<comment><USER23> That is very interesting. I don't see anyone having a significant motive here.

Only thing I can think of is really, _really_ far-fetched. Someone who know what was about to happen to the NHS inserted a backdoor into this distro, and is now advertising it to them.

Yeah, I know. Probably not.

</comment></comment><comment><USER24> What is the NHS?

Seriously, what is the NHS? Nothing defines the NHS, including the about page.

<comment><USER25> National Health Service (how most people receive healthcare in the UK). I guess they're context blind because of the recent WanaCrypt infection they're on the minds of the target audience of this joke? buisiness?

<comment><USER26> They're right to expect the target audience to know what NHS is. NHS isn't any less known than e.g. Obamacare, after all.</comment></comment></comment>


Next steps for Yahoo - <AUTHOR> http://peteriserins.tumblr.com/post/37649559575/next-steps-for-yahoo

<comment><USER2> Didn't Google _have_ a dashboard product called Google Home? That did everything your suggesting? And that had an API and a way to write custom gadgets? But that was ultimately sacrificed in the first Great Purge?

There was obviously something about a dashboard product that didn't click with users - maybe Yahoo is going to do it sufficiently differently to set it apart but I don't see what or how.

<comment><AUTHOR> I must have missed it. Well, did everybody have a smartphone back then? Having a dashboard for a screensaver I think is something that would click immediately. I would use one on the desktop too, provided it's nice on the eyes and is easy to fill up with relevant things (like HN articles).

<comment><USER2> Sorry I was referring to iGoogle - and it is still alive, but to be retired after November 1, 2013. Personally I like the idea of a dashboard - I just dont see it as a killer product.

What Yahoo really needs is a GMail, a Facebook, or even a Pininterest - something that will engage with a large proportion or majority of web users every single day. Unfortunately Yahoo has lost on Search, Email, Social, and even managed to screw up Photo Sharing (even after buying _the_ leading site Flickr).

<comment><AUTHOR> Ah, yes, iGoogle and myYahoo are cases of home page dashboards. Nobody would really use those for financial analysis and the widgets are generally skeumorphic and distinct looking. I would say it's not a strong enough execution of the idea.

I agree it would not necessarily be a killer product for Yahoo. It would, however, allow Yahoo to streamline and combine some existing efforts.

</comment></comment></comment></comment><comment><USER3> Nice call, I'd use that and tell people about it.

<comment><AUTHOR> Cheers, I really want a dashboard as well :). And perhaps Bloomberg needs a cheaper alternative too.

</comment></comment><comment><USER4> good stuff</comment>


Handwritten.js – Convert typed text to realistic handwriting - alias-rahil Do the typing, leave writing to handwritten.js!
https://www.npmjs.com/package/handwritten.js
https://github.com/alias-rahil/handwritten.js
Example: https://raw.githubusercontent.com/alias-rahil/handwritten.js... <comment><AUTHOR> You'd be better off posting this as a Show HN. See [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html) and the tips at [https://news.ycombinator.com/item?id=22336638](https://news.ycombinator.com/item?id=22336638).

Post your main link ([https://github.com/alias- rahil/handwritten.js](https://github.com/alias-rahil/handwritten.js)), then add a first comment to the thread giving the backstory of how you came to work on this, and explaining what's different about it. That tends to seed discussion in a good direction. Good luck!

<comment> rahil-kabani Thanks for pointing me in the right direction! I am new to HN and I didn't knew about the tag.

</comment></comment><comment><USER2> This is cool. Did you introduce randomness somehow? It looks like the 'it' in the first two sentences are different. But it could just be my phone.

<comment><USER3> There appear to be different variations on the letters (src/dataset), one of which is randomly selected.

</comment></comment><comment> alias-rahil [https://news.ycombinator.com/item?id=24205416](https://news.ycombinator.com/item?id=24205416)

</comment><comment><USER4> 4 posts this week.... we get it.

</comment><comment><USER5> can it be expanded to include multiple languages and fonts ?

</comment><comment><USER6> This tool takes a file that can be consumed both by machines and humans and converts it to something that is impossible to consume by machines and hard to consume by humans, also inflating the document size. What are you trying to achieve with this?

<comment><USER2> Such an engineer thing to say. ;)

<comment><USER7> Are you meaning it in a negative way?

<comment><USER2> Not at all! It's just funny how different brains work. He has a very valid point from an engineering perspective.</comment></comment></comment></comment>


Ask: How do you design the sales funnel for products - <AUTHOR> Say you are building a SAAS application. How do you design your front end sales (beta accounts, free month, ebook, etc.) which leads to backend sales (consulting, yearly contract, etc.)
In terms of gamification - building viral loops like finishing profile (80% complete, e.g. linkedin) how do you keep track of those viral loops and integrate/design for them in product.
Hopefully it make sense, just looking for some tools/sites/ideas other than a pen and paper <comment><USER2> Note, I'm not an expert, I just run a free SaaS application (<http://www.ikeepm.com>). When I first started I tried 2-3 designs. There were certain words I was using that didn't yield good results. Ultimately, I tried copying what seemed to work for other SaaS companies. I tried to be original but I'm not a CSS/HTML expert.

Two things I learned, people like photos. So I added large photos showcasing some of the features. I also added larger buttons but the most important factor was not requiring the user to confirm their email addresses. Sure I get fake accounts, but I'll take that over losing customers who get frustrated over "lost" emails or not being able to get started within minutes.

I changed my signup process by requiring just their email address and a password. Once they signup/login, they can immediately use the service. I plan on rewriting the app soon and putting out a new design. It can definitely be better, but I just havent found the time to do it. So far it has worked well for me.

</comment><comment><USER3> I'm also very interested in this question.</comment>


How Failure Made 'Halt and Catch Fire' Great - <AUTHOR> https://www.nytimes.com/2017/10/14/arts/television/halt-and-catch-fire-finale.html <comment><USER2> It's weird to see your own history sexed up. I lived a lot of this as im sure some of you have-- Ijust never got rich, never got laid because of it, nor much respect.

Most of all, despite owning a few pinball machines, I've never, ever (been able) to use them in any sexual escapades :)

<comment><USER3> Yeah, I'm too short - the glass sits around mid-stomach, much too high for any shenanigans!

<comment><USER2> You could shorten the legs I suppose :)

</comment></comment></comment><comment><USER4> Nonsense, it was great from the beginning.

</comment><comment><USER5> I lost track of this show. Loved season 1 and 2. I'm glad they kept it going. I need to catch up on it now.

</comment><comment><USER6> Great show.

</comment><comment><USER7> a truly amazing show. it became one of my all time favorites</comment>


Protecting Software with Obfuscation and Software Licensing - <AUTHOR> https://cryptolens.io/2018/10/protecting-software-with-obfuscation-and-software-licensing/ <comment><USER2> Everything should be open source.</comment>


The wretched state of GPU transcoding - <AUTHOR> http://www.extremetech.com/computing/128681-the-wretched-state-of-gpu-transcoding

<comment><USER2> This is an example of what we get when a potential new technology is turned into a patent minefield. It's very hard to get anything done in the field of video encoding without having someone with a law degree on the team. Mr. Steve Jobs said it roughly this way: "all video codecs are patented".

Makes me sad :(

</comment><comment><USER3> Single page version: [http://www.extremetech.com/computing/128681-the- wretched-sta...](http://www.extremetech.com/computing/128681-the-wretched- state-of-gpu-transcoding?print)</comment>


Stream of links from places I visit most - <AUTHOR> http://stream.nerdspace.co/

<comment><AUTHOR> I may add more sources, feel free to suggest. The sole magic i have done, is to get direct links. HN is cool, they always offer direct links to articles in RSS, but others dont. Moreover, Twitter account also links to direct articles than my site. It would be kind of hypocritic if it didn't ;)</comment>


First Scrum – HELP - <AUTHOR>

Hey everyone, I'm attending my first morning Scrum soon and I'm a little worried. I've studied Scrum and understand basically how it works, but never actually participated in the morning scrums. Any advice? Please??? :) <comment><USER2> The key is to ensure every item on your board (hope you have a board) is actionable and deliverable by the end of your sprint. If a task is missing requirements or artifacts - move it back. If a task can not result it a fully tested and deployable piece of software - break it down.

And lastly, human beings suck at estimating time - base your first sprint on hours or timeframes and then move to a point based system.

Good luck

<comment><USER3> I was assuming the OP was talking about the daily standup meeting?

</comment></comment><comment><USER3> You talk about what you did yesterday, and what you're going to do today. The meeting shouldn't take more than 15 minutes. Assuming you're going 'by the book'.

I came from a scrum team that consistently pushed the limits of a scrum meeting by talking about way too much and taking way too long. Thats a people and process issue though.

</comment><comment><AUTHOR> Hey thanks everyone for the advice. I was indeed referring to the Daily. It went good. I spoke for about 60 seconds, although the scrum lasted almost 30. It wasn't as intimidating as I thought!</comment>


Larry Clark's new film straight to streaming, no DVD or theater release - <AUTHOR> http://swapcase.net/post/37173779754/larry-clark-goes-diy

<comment><AUTHOR> This post came out more journalist-y than I was planning, but I think that's all right. Let me know if you have any feedback!</comment>


Unlock, lock and enter your password on your Mac with Touch ID - <AUTHOR>

This app allows you to Unlock, lock and enter your password on your Mac via Touch ID. Check our website out: www.rydee.nl/en/keytouch/ <comment><AUTHOR> Unlike FingerKey for example, KeyTouch is able to lock and enter your password on your Mac.

Enter your password is simple: the mac app automatically detects if there is a password prompt open, if there is, and you scan your fingerprint on your iPhone or iPad, the password prompt will unlock.

Locking is simple too: when your Mac is unlocked and you scan your fingerprint on your iPhone or iPad, your Mac will lock.</comment>


TLDRead – Sparknotes for Research Papers - <AUTHOR> https://www.tldread.org <comment><AUTHOR> Hey All, I built a program that takes research articles and uses Machine Learning to automatically summarize papers and mount them as a dashboard to get a quick overview. If you enjoy it please show some love on product hunt: www.producthunt.com/posts/tldread</comment>


Abbreviated Parody of Paul Graham's "Boss" - <AUTHOR> http://www.jsequeira.com/blog/2008/03/24.html <comment><USER2> I for one believe this conversation has reached an absurd level.

<comment><USER3> Obviously intended as a parody, but I think he's inadvertently on to something.

<comment><USER4> Yes he's revealed that we are past the point of flogging a dead horse, indeed people are now interfereing with horse's corpse in unfortunate ways.

</comment></comment></comment><comment><USER5> The "elite" (politicians, rock / sports / business stars...) are indeed known for either fucking their secretaries / fans / interns / homosexual toilet mates, or divorcing every couple of years, depending on their professional constraints. OTOH, people who don't want to dedicate all of their resources to their libido tend to settle for a safer and simpler monogamy.

This is more of an additional argument to PG's thesis than a parody, actually.

<comment><USER6> They are 'known' for it in the sense that if they do it, we will all 'know' about it. I'm sure that within a block of my home there are more people who've cheated that way than you could find in a week's worth of TMZ and The Drudge Report.

</comment></comment><comment><AUTHOR> Although I fall in the camp of agreeing mostly with the original, this was just too funny to resist posting.

</comment><comment><USER7> The analogy that this parody depends on is a very weak one, because PG's point is that the modern job in the modern company did not exist when we were hunter-gatherers, i.e. any time prior to the invention of modern agriculture.

Marriage, on the other hand, is the result of an intrinsic human tendency to form long-term relationships and raise children within those relationships. This tendency has probably existed for longer than the "modern" human species (the major evidence for this, as I remember, is the similarity between male and female size, and the fact that human monogamy is determined by the combination of helplessness and large size of the new-born infant, so that the mother requires major help from the father in order to raise her child successfully).

Modern civilisation has not done anything to prevent men and women getting together the way they always have, and it has had limited success in providing "artificial" alternatives.

<comment><USER8> I would argue the opposite: that lifelong monogamous marriage is unnatural. Witness divorce rates in Western society. (Many other cultures that are overtly polygynous.) Humans, by nature, are slightly biased toward polygyny.

Let's assume PG's argument is that employees are unhappy because they are going against the grain of human group-dynamic nature. By analogy, nearly a majority of married couples are unhappy because they are going against the grain of human polygynous nature.

<comment><USER9> I did a lot of reading about hunter-gatherers last year while researching another topic, and I was surprised how universal monogamous marriage is. It's so prevalent I suspect it's in our DNA. It seems to be bad when it's indeterminate who is the father of a child.

<comment><USER8> "How the Mind Works" by Steven Pinker has some very well-reasoned arguments to support your intuition that it's in our DNA. [It's basically a popsci introduction to evolutionary psychology and cognitive science.]

<comment><USER10> I just finished that incredible book, which I consider the best read of my last two years.

It would be a worthy addition to any entry-evel AI, psychology or cognitive science class.

</comment></comment></comment></comment></comment><comment><USER11> I fall into the camp "To each his own". Some people get their kicks at startups, some don't. If anything I would say there are corporate prides and solitary tiger entrepreneurs.

And those that can do both without whining are ligers...bred for their skills in magic.

</comment><comment><USER12> I can't find the original source now, but the best summary/parody of the original article I read was roughly: "I'm wonderful because I founded a company and made a lot of money. Oh, you haven't founded a company? You suck."</comment>


Show HN: A text adventure game in Haskell - <AUTHOR> https://github.com/WaldoHatesYou/adventura <comment><USER2> That's interesting. Instinctively due to lots of statefulness an adventure game would feel like a problem most naturally solved using an object-oriented or structural approach so how would you compare the experience writing the game in Haskell as opposed to doing that in a non-functional language?

I took a peek at the code but with my (at best) level 101 Haskell knowledge found it a bit difficult to follow so I don't think I'm competent enough to comment much on the style - but the functional maze generation and limiting usage of monadic constructs to places requiring IO looks cool.

<comment><AUTHOR> Personally, I'm not a fan of using functional programming in video games. I found it to be quite a pain to deal with Haskell's functional aspects when handling state. Although, I did not try using the state monad which might have prevented the issues I encountered. So, perhaps I will try making a game in Haskell in the future just so I can try and see if the state monad would fix the issues I encountered.

</comment></comment><comment><USER3> Very nice. :)</comment>


Ask HN:  Coming Soon/Landing page design for a new group contact system - <AUTHOR>

I am a developer and not really a designer.  So this is the coming soon/landing page for a new group contact service that I am building.  I am looking for any feedback that you might have.
The core feature of the application is to abstract the communication process away from the person trying to broadcast news to multiple people at one time.  Kinda like an automated phone tree concept.
Any feedback or thoughts on the subject are much appreciated.
Site Url:  http://friendflare.com <comment><USER2> The page looks very good. I would just suggest that you slow down the phone rotation slightly, it's a bit overwhelming when trying to read the text.

<comment><AUTHOR> Thanks for the response!! I will take a look at slowing down the rotation of the slideshow and see what that looks like.</comment></comment>


Facebook has lost $100B in 10 days and now advertisers are pulling out - <AUTHOR> http://business.financialpost.com/technology/u-s-ftc-investigating-facebooks-privacy-practices <comment><USER2> This is the beginning of the Big Churn. Less top talent will want to be associated with facebook. Already even a few more privacy clueless friends family members are deleting their accounts. Adverts were always so low yeild, and fb pages 'because we need one'. Now that is all changing due to perception. The FTC, stocks falling, are further indicatuons of falling trust. And all business is built on trust.

<comment><USER3> Oh please - the overreaction from this is ridiculous.

I'm buying FB call options.

Facebook's network effect is extremely strong - this is also not even including their other assets (Instagram, Whatsapp, Oculus).

The API access was in violation of terms of service and the ability to access data through friends via the FB graph has already been closed.

<comment><USER4> Yes, Facebook's current network is fairly strong, but you shouldn't look to where the masses currently are, you should look to where the trendsetters, the young, and the people in the know—where they are. These people are ahead of the curve, and the signs they are emitting is that Facebook is not serving their interests and needs. Young people don't want to use facebook because it forces you to interact with everyone, including parents and people out of your circle. Privacy conscious people and many at the forefront of technology all either personally avoid and limit facebook usage or keep their children away from it (if they aren't already disinterested in the first place). Yes Facebook allows you to "fix" these issues with enough configurations, but then why would a new user go through the hassle of all that when they could just install snapchat or instagram (yes I know facebook owns this, but it's not facebook).

So unless there's a fundamental shift in its business model and allure, its trajectory will be doomed. It doesn't mean Facebook the company will fail, but it does mean that the Facebook product—what it is in its current form—has a finite shelf life.

<comment><USER5> I've been putting off posting this for months because when I write it, it seems grandiose but it's been my life and it's too ridiculous not to share.

I was born in 80 so that dates me. I've worked in music for the last 20 years and I've worked with over 60 bands most of whom are very successful now. However that number is misleading because I've toured with hundreds of bands if you count the openers and headliners over the years. It's stupid really when I look back on it. Once when I was 25 I used my network to start a music festival with no money that's been going on for the last 10 years and has never had less than 50k people attend. Anyways long story short most people don't understand marketing. But when you're touring you're living it. I remember when the words taste maker started getting thrown around. I remember when gorilla marketing became a thing... Because the marketing people would all be coming to our shows and our parties and sponsoring us. All of this to say that

We were early adopters of Friendster, when they killed the bulletin board my friends and I moved to MySpace, when MySpace got over crowded we moved to Facebook, when our families friends got on Facebook we left for Twitter and reddit, the less public of us left Twitter almost immediately but our pr teams stayed, when Obama won in 08 we left reddit. Many of us went to snapchat and we all use Instagram even though we hate it. There was a minor period when we thought google + was going to serve us but that lasted exactly one day.

What we desperately want is a decentralized encrypted locally hosted application that has exactly one killer simple feature. A bulletin board to post events. That's it. A simple way to keep in touch with each other and local ownership of our photos and videos. Sure to reduce bandwidth we'd be fine with our friends or fans hosting encrypted files on their devices but that's as far as they go. Do that, slap an easy to use interface on it, don't have advertising call it something literal like friends torrent or something and we'll never have another Facebook. If you want to monotize it... Give it a market place. But if you take anything from this rant it should be this, your tastemakers aren't faceless nameless statistics they're real people and they're friends with each other. We know who we are and we are and have been paying attention.

Also fuck Facebook freedom isn't free

<comment><USER6> _Do that, slap an easy to use interface on it_

What you're asking for is much more difficult than you realize.

<comment><USER5> I know (with lots love)! That's why I haven't built it. It's also why I don't think it has been built yet and why in my frustration this evening I sort of let loose.

</comment></comment></comment></comment></comment></comment><comment><USER7> What's interesting for me is that I finally deleted my account. I never used it anyway but now I feel empowered to say "I don't have an FB account" and that's ok.

I think this is a sea change - there will never again be this dominant of a social network imho. From now on the space will be fractured into niches (AngelList, LinkedIn, NextDoor, etc...).

<comment><USER8> I did the same. While I used to use my account regularly 5+ years ago, my feed was just full of stupid updates. People posting food pics, family commenting on news, and old viral videos, and lots and lots of ads. So, hey, I deleted my account. While Facebook isn't loosing any revenue from me, it certainly didn't ever attract me back into the active user status. Good riddance.

<comment><USER9> A few months back I had tried doing the "Hide this Page" game hoping to reclaim my feed. This turned into a Sisyphean task that makes Inbox Zero look fun. As it turns out, there are also a number of pages[0] that you simply cannot hide or otherwise unfollow.

I happened to "delete" my profile a week before this shit storm blew up and thankfully someone pointed out the Deactivate vs. Delete dark pattern and I quickly fixed that situation.

It's a weird world when the Smut Peddlers have some sound advice on living.

[0] - I didn't keep a list, but I recall one called "Wittitudes" or something along those lines simply lacked the "Hide" option, and all attempts at blocking it failed.

</comment></comment></comment><comment><USER10> It's too easy for some of you to get excited about one giant corporation taking a rather public beating. The anti-facebook tribe is strong in the Hacker News community.

Plus, what SV company wasn't a free-for-all of user data in 2012-2013? I don't know if any of you remember the Path app's lawsuit that triggered Apple's lockdown of API permissions. Apple, who suddenly got religion about privacy, but they too learned from their mistakes.

Anyway, I'm not here to argue in favor of FB, but the stock going down is pretty self perpetuated right now. It's algorithmically triggered in response to bad news in the press, that then generates more bad press like this and so on. I'm not sure where the bottom will be here, but I'm pretty sure it'll reverse course soon enough.

<comment><USER11> _Anyway, I 'm not here to argue in favor of FB_

You're just doing a really great impression of someone who is? My initial reaction was an unrealistic belief that you and others singing a similar tune work for FB, but I doubt that. I think it's a very rational fear that FB is the first domino to fall, possibly along with Uber. Fear and self-interest, and the simple desire not to see your industry facing a prolonged public backlash ending in regulation makes more sense as a motive.

Is that about right?

<comment><USER10> As it's impossible for me to convince anyone in this thread of anything on this topic, I'm just freely making some points. People have already picked a side to stand on and the line has been drawn. Case in point, you've already gotten your pitchfork out.

<comment><USER11> You didn't really respond to anything I said, just complained that people aren't agreeing with you and some ad hom that those people are mob-like.

</comment></comment></comment></comment><comment><USER12> In other words, FB has done somewhat worse than the NASDAQ, and about the same as GOOG over the same time period.

Best not to take broad market movements and try to ascribe specific market expectations to individual companies.

<comment><USER13> What are you talking about? The NASDAQ was down 4% since last Friday. Facebook was down almost 20% from Friday this morning...

<comment><USER12> Sorry, but what are you talking about? Facebook closed on Thursday at $165. It closed on Friday at $160. FB was up by half a percent today, on Monday.

[https://finance.yahoo.com/quote/FB?p=FB](https://finance.yahoo.com/quote/FB?p=FB)

<comment><USER14> > _Facebook closed on Thursday at $165. It closed on Friday at $160_

16 March open to 26 March close, Facebook lost 13% of its value [1]. The same statistic for the S&P 500 is 3.4%. This time horizon makes more sense than yours because it matches the first revelations of Cambridge Analytica's use of Facebook's data [3].

[1] [https://finance.yahoo.com/quote/FB/history?p=FB](https://finance.yahoo.com/quote/FB/history?p=FB)

[2] [https://finance.yahoo.com/quote/%5EGSPC/history?p=%5EGSPC](https://finance.yahoo.com/quote/%5EGSPC/history?p=%5EGSPC)

[3] [https://www.nytimes.com/2018/03/17/us/politics/cambridge- ana...](https://www.nytimes.com/2018/03/17/us/politics/cambridge-analytica- russia.html)

</comment></comment></comment></comment><comment><USER15> I fail to see how this will seriously damage them. They already own the two biggest alternatives to facebook - Instagram for pictures and WhatsApp for communication. More people are using their services than ever before and more people are getting access to the internet in developing countries.

<comment><USER4> People in US don't really use Whatsapp.

iOS users do use iMessage and Android use Hangouts.

<comment><USER16> Do android users actually uses Hangouts? I have a couple of friends on it but my understanding is that Android users (like myself) just stick with standard SMS/MMS in the US. Patiently waiting for Universal RCS to take off...

<comment><USER17> I know this is just anecdotal, but my friends and I do heavily use Hangouts.

It doesn't have enough functionality on its own, but I've augmented our experience with a chatbot powered by [https://github.com/hangoutsbot/hangoutsbot](https://github.com/hangoutsbot/hangoutsbot).

Obviously I don't think that this experience is typical, not everyone is a programmer or has a server on which to run it.

</comment></comment></comment></comment><comment><USER18> I have no idea where the FB stock is going. I don't think the company is in trouble, but likely to continue shifting focus. The good thing for them is that their products complement each other pretty well.

FB the product has been changing quite a bit. Many people don't use it anymore to see what their "friends" are doing. They use it to follow certain groups of interest. For me it's becoming something between Reddit, Meetup, and Craigslist. (I don't check my FB often)

Instagram (which I don't use) is still strong in what FB used to be, but the friendship model is more lax like in Twitter. The demographics also complement FB well.

WhatsApp (which I use daily for everything) is huge all over the world. It's also catching up in the US. Besides the 1on1 communication, it's also big on groups. But the WahtsApp groups are quite different from the FB groups. They tend to be smaller and more personal. It's not really by design, it's mainly because it's connected to people's phones. They just need to figure out how to monetize it. The potential is huge. (but first please improve the calling quality, it's so bad)

WhatsApp is a great product but among the three the most easily replaceable. But that's not going to happen any time soon. FB were smart keeping it independent and separate (many users don't even know they own it). One thing I really dislike about Google is that they merge everything under one umbrella.

</comment><comment><USER7> The bigger problem is recruiting. How many offers will be declined in favor of Google, startups, etc...

<comment><USER15> It's not like Google is a privacy haven for people who care about that sort of thing.

<comment><USER9> > It's not like Google is a privacy haven for people who care about that sort > of thing.

Google, Facebook, and Amazon are all on my shit-list. Any company that harnesses hapless users as a product can rot in hell.

<comment><USER19> I'm a bit worried they will soon enough go the route of AT&T, Comcast, the Telco mafia, Airlines, etc. and embrace their suck, then just lobby for survival.

[https://www.fastcompany.com/40520529/big-tech-lobbying- spree...](https://www.fastcompany.com/40520529/big-tech-lobbying-spree-heres- how-much-apple-amazon-and-others-gave-d-c-in-2017)

</comment></comment></comment></comment><comment><USER20> I genuinely believe that advertisers are only pulling out because it's the PR thing to do. There are many other companies that would love to take advantage of a less competitive bid for Facebook ad space and I have no doubt they will be taking advantage of it and will continue to spend boats of money on Facebook.

<comment><USER21> Two of the largest advertisers don't think Facebook ads are effective. The latest, P&G, specifically call out how narrow targeting is ineffective.

> After cutting back on certain digital ads, "we didn't see a reduction in the > growth rate," said Mr. Moeller during the call. "What that tells me is that > the spending we cut was largely ineffective."

[https://www.wsj.com/articles/SB10001424052702304192704577406...](https://www.wsj.com/articles/SB10001424052702304192704577406394017764460)

[https://www.wsj.com/articles/p-g-to-scale-back-targeted- face...](https://www.wsj.com/articles/p-g-to-scale-back-targeted-facebook- ads-1470760949)

<comment><USER22> I wonder why Facebook doesn't make deals with supermarkets to collect data on every single purchase. There's no doubt that Facebook advertising would be far more effective if it knew when John Smith last purchased toothpaste.

</comment></comment></comment><comment><USER23> Facebook didnt loose $100B in 10 days: it's market value dropped in response to bad news. Stocks go up and down all the time on companies that remain around a long time. It's still making piles of money. Its users have a huge, switching cost to block a transition, too.

</comment><comment><USER24> Perhaps some good will come out of all this.

Maybe in the future, when some PHB asks development to add a questionable data gathering function to a platform they can say, "Remember Facebook?"

<comment><USER12> Facebook runs a messaging service with ~1.2 billion monthly active users. One of the core features of the product is to integrate with other contacts on your phone, and you have to explicitly enable this feature, agreeing to "ongoing upload" of your "text and call history".

Apple runs a messaging service called iMessage. It logs all of your call metadata, SMS history, etc. There is no opt-in, it's just default behavior. Apple also runs iCloud. All of your data is sent there, too, including complete conversations.

Can someone for the life of me explain to me what makes Facebook the villain here? Apple does exactly the same thing.

Facebook has never sold this data. There is no evidence they've even used the data for anything except its explicitly-stated purpose.

<comment><USER25> > you have to explicitly enable this feature, agreeing to "ongoing upload" of > your "text and call history"

I don't remember this being explicitly asked of me in any obvious way. And even if it was, I would have assumed they only needed that permission to get a list of contacts on my phone, and that the rest of it would be unused.

> Apple runs a messaging service called iMessage

Yes, and it's all encrypted and none of it is sent to third-party advertisers or creepy voter manipulation firms.

> Facebook has never sold this data. There is no evidence they've even used > the data for anything except its explicitly-stated purpose.

[https://www.nytimes.com/2018/03/19/technology/facebook- cambr...](https://www.nytimes.com/2018/03/19/technology/facebook-cambridge- analytica-explained.html)

<comment><USER12> > I don't remember this being explicitly asked of me in any obvious way.

Maybe you didn't. The Facebook app does not collect this data. It's only Facebook Messenger or Facebook Lite. Here is a screenshot of the permission request: [https://fbnewsroomus.files.wordpress.com/2018/03/opt- in_scre...](https://fbnewsroomus.files.wordpress.com/2018/03/opt- in_screen.png?w=1152&h=2048)

> Yes, and it's all encrypted and none of it is sent to third-party > advertisers or creepy voter manipulation firms.

Yes, and this is all encrypted and none of it has ever been sold, or shared with any other third parties. So what is the difference again?

> [https://www.nytimes.com/2018/03/19/technology/facebook- > cambr...](https://www.nytimes.com/2018/03/19/technology/facebook-cambr..).

This is a completely different issue, and unrelated to the thread.

</comment></comment></comment></comment><comment><USER26> I hope they continue to lose money. That's a pretty negative feeling to have towards a business for me too. However, they started harvesting text and call info back in 2006; that is about the time I first started looking into anything technology related. I thought fb was terrific as it grew and helped enable more connectivity. Now that it has been shown to be true tho, the invasion of privacy is absolutely ludicrous.

</comment><comment><USER27> Good, I hope we see a sleeping giants-style shaming of advertisers who financially support Facebook

<comment><USER28> Ironically many of the sleeping giants that could tip the scales were already pulling out. Case in point: Proctor and Gamble (2016) [https://www.wsj.com/articles/p-g-to-scale-back-targeted- face...](https://www.wsj.com/articles/p-g-to-scale-back-targeted-facebook- ads-1470760949)

<comment><USER29> Extra-ironically, look at the opening line there:

> Procter & Gamble Co. PG 0.66% , the biggest advertising spender in the > world, will move away from ads on Facebook that target specific consumers, > concluding that the practice has limited effectiveness.

More-and-more-specialized online display advertising rarely delivers as (heh) advertised on any platform.

But on the other hand, the bit you leave out includes both that they weren't cutting their FB budget, and that they'd found some areas where it works better:

> Mr. Pritchard said P&G won't cut back on Facebook spending and will employ > targeted ads where it makes sense, such as pitching diapers to expectant > mothers.

So the real question is: were these political campaigns the useless sort of micro-targeting, or the effective kind?

<comment><USER28> P&G actually cut their digital ad spend : [http://www.adweek.com/digital/procter-gamble- cut-140-million...](http://www.adweek.com/digital/procter-gamble- cut-140-million-in-digital-ad-spending-because-of-brand-safety-concerns/)

> "Digital ad spending was lower versus a high base period and due to current > period choices to temporarily restrict spending in digital forums where our > ads were not being placed according to our standards and specifications," > the company said in its earnings

I suspect that FB targeted ads are not as useful for larger companies (who are generally advertising for awareness) compared to smaller or niche companies (where the target audience may be well defined).

</comment></comment></comment></comment><comment><USER30> Could this spark a small tech bubble burst?

Will non-tech people be fed up with their data being abused by tech/ad companies? If this trend goes viral (ironic, eh?) it could mean less ad money. Advertising has had it really good compared to older days of TV and radio with targeted online communities and data about them.

Maybe this just sparks less VC investment towards freemium products?

</comment><comment><USER31> This looks like big news but I think it is merely a small correction of its market value. For better or worse, they are going to stay for a very long time. At least from the current generation a significant amount of people will cling onto it for the rest of their lives like others do with cigarettes.

</comment><comment><USER32> I wouldn't particularly mind if it lost another 100-200b in market cap. It's gotta be enough to have a long term affect, and to teach the other social media giants a lesson so they don't replicate the same behavior. Unfortunately the might just get better at hiding it.

</comment><comment><USER33> Facebook isn't going anywhere for a long time. They'll retain the privacy- clueless fossils with FB. They'll keep the aspirational set with IG. Anything even remotely competitive or alternative they'll just throw cash at and snap up.

<comment><USER34> Unless it becomes so uncool that you are lame if you still actively use it...

eg. like having a myspace, or a .hotmail, or a @aol email account

Social networks have to be both useful and trendy in order to fully succeed....

messenger and whatsup are both very useful, FB itself is less, and it needs to be somewhat trendy in order to survive

Personally I find fb very useful to keep up with family and friends, but that might be not be the same for other people, especially very young folks

<comment><USER35> Myspace actually did keep a niche going with musicians for quite some time after its general popularity had waned. No idea why that was or if there's even any of that left.

</comment></comment></comment><comment><USER36> I'm impressed at how misleading this headline is. If you didn't know better, you might think Facebook's bank accounts contain $100 billion less than they did a week ago. What they actually mean is that the stock price is down ~20%.

</comment><comment><USER37> I like how when you click on the headline, the article actually says "$70B". But then again, what's $30B nowadays.

</comment><comment><USER38> Facebook deserves to die. That's really all there is to say.

<comment><USER39> Facebook deserves to prosper.

</comment></comment><comment><USER40> So while it seems like $100B dollars is a large sum, it's really about 12% ish of the market valuation. Yes it hurts, but no, it's not the end of the company.

Think of it this way. How much money will FB have to spend to rebrand itself and fix the privacy issues. $1 Billion, maybe $2 Billion?

You can do a lot with $2B dollars.

<comment><USER41> It will be back up within a few weeks. That is the way it works.

</comment></comment><comment><USER42> Shares in Facebook did not fall on Monday - they were up 0.45% at market close.

<comment><USER43> FB +0.45%

S&P +2.72%

That means FB is still falling relative to the overall market trend.

<comment><USER44> Falling upwards?

Words having meanings! Let's just use words that mean what they mean. Facebook did not "LOSE" $100B, and the stock is not "falling".

</comment></comment></comment><comment><USER45> Change isn't coming. Sorry.

Trump's victory signaled a social media gold-rush for political campaigns. 2018 is a major election year in American politics. You can bet that campaigns are evaluating and signing onto social media related efforts. To meet this demand, as Cambridge Analytica buckles, others will take it place. The people who benefit by these services are those who make the laws. While legislators benefit by social media targeted services, there won't be a political will sufficient to pass a law that will slay the goose laying golden eggs.

</comment><comment><USER46> This is what Mark gets for contemplating a run for President...

</comment><comment><USER47> @dang: "Facebook stock has dropped $100B in in 10 days..."

</comment><comment><USER48> The advertisers leaving is what really hurts Facebook. Remember, you aren't Facebook's customer if you're just a regular user; you're the product.

Think of it this way; imagine a farmer having a bad harvest. that's a lot of pressure, but he or she will try to cope with the loss and monetize what's left cleverly. Now, imagine the same farmer but the demand for the crop is falling. Now that's a capital "P" problem right there.

</comment><comment><USER49> With luck this could be the beginning of the end for Facebook. Probably not, but one can hope.

</comment><comment><USER50> Is it crazy to consider investing in their stocks soon-ish. I totally hate the company but if this is global-minimum i can make some cash pretty easy. I'm relying on the premise that most users will continue to user the site and that this is a short term media frenzy similar to youtube advertiser fiasco.

<comment><USER51> If you hate the company, don't invest. If you're non-fussed but think it will return to it's glory days invest. If you love the company, invest.

You aren't the only one who doesn't like the company, it "can" be taken as a negative signal and suggest the company will continue to lose.

How many people LOVE facebook? I don't think they really exist anymore. Apple has it's haters, but it also has it's fans. Google has more haters than fans.

Of course, we're talking about more mature companies here, so the upside is not as great, the downside could have a real impact.

Of course, you have to consider FB as more than FB. If you loved Occulus, I'd say maybe invest. Big fan of Whatsapp, maybe invest.

There should be other opportunities to invest in things you do like that you would be proud to own.

</comment></comment><comment><USER52> Let it burn</comment>


Off duty, black cops in New York feel threat from fellow police - <AUTHOR> http://www.reuters.com/article/2014/12/23/us-usa-police-nypd-race-insight-idUSKBN0K11EV20141223 <comment><USER2> I think this really cuts right to the problem which is two fold, first is racial profiling and the second is the _presumption of guilt_ that is going on. It is the latter which I find really disturbing.

In a better world an officer might stop someone and ask what they are doing and some id, but they must presume that the person is innocent. My favorite quote from my sister (who is a public defender) is "Being a minority is not probable cause." Once the officer has read the id, they should be on their way.

</comment><comment><USER3> Completely off topic, but the comma in the title feels very out of place.

<comment><USER4> It's short for "When they are off duty" and is a common construct in old- school headline writing.

</comment></comment><comment><USER5> You would think logical people are here. If 80% of crimes is done by Blacks in a neighborhood isn't it more efficient to look for criminals in this group even if it is just 15% minority?

Why males don't complain about being targeted by the Police compared to women?

<comment><USER6> If you're focusing on policing a subset of people, that subset will be charged with a disproportionately high number of crimes.

<comment><USER5> Charged isn't convicted. Somehow Blacks are 70% of prison population. So it looks like the cops are right. Unless we will buy now into a conspiracy theory that Blacks are convicted based solely on the skin color.

<comment><USER7> > Charged isn't convicted.

> Somehow Blacks are 70% of prison population.

Enter the plea bargain.

Those are not necessarily inconsistent. They will throw down the book at you and say you face 199 years in prison unless you plead guilty. Have you already forgotten Aaron Swartz?

[https://en.wikipedia.org/wiki/Aaron_Swartz](https://en.wikipedia.org/wiki/Aaron_Swartz)

</comment></comment></comment></comment><comment><USER8> 1st sentence - "have experienced the same racial profiling that cost Eric Garner his life".

How narrative gets created before your eyes.

His death being an unfortunate accident, how does racial profiling explain it?

<comment><USER9> When does it stop being an unfortunate accident and start being a crime? How many incidents does it take before we can agree on the existence of a pattern of abuse against visible minorities?

Each incident is itself an unfortunate accident. Together though, I argue they already are indicative of racial profiling, racism, and an a pattern of problematic behaviour among law enforcement professionals.</comment></comment>


Linux kernel lockdown, integrity, and confidentiality - <AUTHOR> https://mjg59.dreamwidth.org/55105.html <comment><USER3> Linux security has been criticised[1] for not having security enabled by default, and for allowing users to disable the security measures. This leads to users avoiding setting minimal-rights policies, and leaving the doors open. When security is optional, policy issues in distributions also aren't fixed quickly.

To limit applications rights to a minimum, SELinux, firewalls, and (systemd) sandboxes are all tools that could be used, but aren't in most installs. However, I think we are still lacking user-friendly interfaces (opensnitch is ported from MacOS).

One idea could be to let the desktop environment restrict one more capability a application on every run, inform the user before running it and ask the user after if the software worked correctly. That would gradually lead to a minimum set of software rights.

[1] [https://www.youtube.com/watch?v=OXS8ljif9b8](https://www.youtube.com/watch?v=OXS8ljif9b8)

<comment><USER4> > One idea could be to let the desktop environment restrict one more > capability a application on every run, inform the user before running it and > ask the user after if the software worked correctly.

That would only work reliably if one used every single feature of a program, every time one opened it.

I have tried to enable sandboxing for my services, but it is not easy to know what permissions can safely be restricted, without negative effects.

<comment><USER5> An interactive sandbox UX I like a lot is an app giving me a dialog "Allow", "Deny" with an additional "Remember" button when it does something new (perhaps modulo some time window, as long as it's clear). In certain situations I'd like to be more granular than that, but it would be much better than what we have today. A good way to be more granular is an "Advanced" button that lets you drill down more specifically depending on the resource that is being attempted to access.

Today if I want to send someone a photo I took on <insert newfangled application that can send messages here> I need to grant it permissions to read all of my storage. That's dumb. The OS should delegate access in such a way that I can give the app access to a single file's contents AND be performant/not get in the way for accessing all files if that's what I prefer.

What should NOT be possible is an app asking "hey can I read '/*'?". It should attempt to access specific resources in the namespace, and the OS should be responsible for saying "should this app bug you again about reading your <namespace>?" This gives an only-slightly-more complex UX to users that don't know/care, and gives a lot of flexibility to those that do.

I'd even be fine if it was one-time opt-in like Android "developer mode" which is basically impossible to enable if you're not looking for it.

<comment><USER6> But how does this interact with Unix command line tools? Any "sandboxing" system that A) either makes comamnd line usage inconvenient or B) completely ignore command line usage is going to create a rift.

Most of these "interactive sandbox UX" approaches basically create a "developer sandbox" where the command line tools can all play together but cannot access external data. And this is where things go downhill. Developers (or even users) DO want from time to time to write a script that accesses their contacts, gets the current GPS position and then does some munching with Perl for whatever obscure reason. Developers DO want from time to time to read whatever stuff Netflix program is storing on their private storage (oh noes!), or what the PDF reading program wants to send to the net.

And then you hit either A or B from above. If A, developer is annoyed and disables your sandboxing, and you are back to stage 1. If B, you are already at stage 1 and developer is annoyed seeing that random Perl scripts can apparently read your contacts list.

I find that any sandboxing approach that fails to actually think of command line usage is just falling in the trap of the "Android/iOS-centric world view". "Apps" may be glorified websites which are trivial to sandbox, but the more generic concept of "programs" is not. This is not only about command line scripts. Command line scripts interact with pipes. Programs, however, interact between themselves in ways we cannot even think of right now.

Which is why year after year you still see completely unsandboxed PCs being used for "productivity" despite tablets and anything else with the Android/iOS model.

<comment><USER7> The problem with sandboxing is it only works for server processes with very narrow behaviors - it's completely unable to express broad ideas.

My file browser should be able to see my whole system - that's what I want it to do. But I really don't want it to scoop up a list of files on my system, and send it wholesale to a network address I didn't type in specifically, after some specific actions.

AFAIK no security mechanism anyone currently proposes properly captures this sort of intent: there isn't a firewall which defines what can be done with the actual bytes of data an application has picked up in those terms - <USER2> they're in memory.

Of course this is a huge challenge: proving that my file browser doesn't have a way to, without gating through a user system, transform my file list into any code paths which can send it via network traffic.

But it's what we desperately need.

</comment></comment></comment></comment></comment><comment><USER8> This lockdown made it a huge PITA to run Wireguard in Fedora[1]. It broke existing installs when the kernel upgraded and then became very difficult to insmod or modprobe the wireguard kernel modules unless you blacklisted all new kernels (not safe). I hope this matures in a way that doesn't destroy some of the reasons I love Linux (that I can hack on my system and do cool stuff).

[1] [https://unix.stackexchange.com/q/543576/34855](https://unix.stackexchange.com/q/543576/34855)

<comment><USER9> Wireguard is merged into the mainline and would possibly appear in Fedora 32 on 5.6. Fedora 32 will be released several weeks later.

The underlying problem is that many distro just use a throwaway pubkey which makes users impossible to sign their modules. Maybe a better security model is needed.

<comment><USER8> yeah for this reason I've been super excited for kernel 5.6 (I don't usually get excited for new kernel releases cause it means work for me, but this one is different :party: )

</comment></comment></comment><comment><USER10> Why is this considered a good thing?

The only "security" this improves, is of devices where the manufacturer has decided to lock you out!

<comment><USER11> Your second line is the answer to the first.

Look at who works on the Linux kernel, and their affiliation, and you will see why things are the way they are.

<comment><USER12> We are drowning in cynicism these days. Let's make an effort not to add more.

</comment></comment></comment><comment><USER13> I think Fedora Silverblue takes a very different approach here - [https://docs.fedoraproject.org/en-US/fedora- silverblue/](https://docs.fedoraproject.org/en-US/fedora-silverblue/)

It basically doesn't try to fix the building blocks with all their legacy...instead it simply makes the entire operating system immutable.

I wonder what are the pros and cons of each approach. Or are they complementary.

<comment><USER14> Complementary. Silverblue's immutability may be aimed purely at stability and therefore may not have strong guarantees, but if it _did_ then the next attack vector would be from root to kernel (in memory), and that's where lockdown comes in; it's designed to prevent attacking a running kernel as root.

</comment></comment><comment><USER6> I find all the attempts at "curtailing down the powers of root" to be the modern equivalent of [https://xkcd.com/1200/](https://xkcd.com/1200/) .

At least with the "user vs admin" distinction, I could argue that it is useful becase my backups could be stored into a separate account with restricted access, so ransomware running in at the "user level" account, would not be able to touch them.

While if my "admin" account gets compromised then all bets are off as the backups could be wiped out (even if they are offline, they could be wiped out the next time I connect the storage device).

However I find a much harder time finding user justification for having a separate "root" vs "manufacturer root", unless you happen to be a manufacturer with questionable motives. If root is compromised, the attack surface becomes absolutely huge, and it doesn't seem to be very useful as a user the fact that I can rely that at least the kernel and bootloader will not be compromised if everything else is dubious.

Sure, now I can trust that the builtin "restore to factory" functionality on the device works (and even that may not be true). But unless I use it frequently (and who does?), the malware with root access would still be able to destroy all of my files anyway, compromise my backups, etc.

<comment><USER15> This is pretty much it. Let's frame the proposition differently to get people to consider it from a new perspective.

I can verify the OS install media with trusted publishes using signing keys and PKI. I can't do a god damn thing about the cheap, back-doored PCI controller from China.

What protection does secure boot really offer the end user at that point? The PCI controller is in place to just pass the right signatures to secure boot or just wait until after the secure boot checks so it's not helping with bad hardware. I already verified the OS media at install, so its not super useful there either. Did my boot code change? How would I know? Did the bad PCI controller fake it? Do I have _any_ additional trust in my system? I can't go probing the system to try to find out.

A black box with zero control told you you were safe and there is no way to look at or modify the system now so you can trust it. Your hardware was never on a TAO workbench. Who doesn't feel safer?

<comment><USER16> > I can't do a god damn thing about the cheap, back-doored PCI controller from > China.

Of course you can - that's what IOMMUs are for.

</comment></comment></comment><comment><USER17> Surprised no one has yet commented on eBPF, and the impact this has. ebpf already gives users the right to run code as the kernel, and this is _a security win_ in many cases - you can audit your system better.

On a server, I think I'd rather assume the attacker has root (or even kernel!) but have good auditing, and do specific service sandboxing, than assume that I can separate root from kernel.

My understanding is that confidentiality breaks ebpf. I'm unsure about integrity - if integrity works with it, great. Then I'd wonder where you'd want confidentiality - maybe a box that's handling CC info/ payment processing?

I have mixed feelings overall.

<comment><USER16> Integrity doesn't restrict ebpf. Confidentiality is for cases where you're doing stuff like using EVM to prevent offline attacks, which involves the kernel holding a key and using it to sign all files. This can be circumvented if you're able to just scrape the secret out of the kernel.

<comment><USER17> Cool, that sounds reasonable then. Good stuff.

</comment></comment></comment><comment><USER18> >Various interfaces make it straightforward for root to modify kernel code (such as loading modules or using /dev/mem), while others make it less straightforward (being able to load new ACPI tables that can cause the ACPI interpreter to overwrite the kernel, for instance).

What exactly is the "ACPI interpreter" referenced here? I am familiar with ACPI but this is the first tine I have heard this term.

<comment><USER19> ACPI tables contain byte code (AML), which needs to be interpreted by the kernel.

</comment></comment><comment><USER20> Since this is controlled via a kernel parameter, can root just unset the kernel parameter and reboot? Or are there systems where kernel parameters are also 'locked down' by some other mechanism?

(these are genuine questions - I don't know much about linux security and am seeking to understand).

<comment><USER16> Most distributions carry a patch to automatically enable this if you have a verified boot process. Otherwise, it's up to the admin to ensure that their verified boot process applies the appropriate policy (eg, by ensuring that your bootloader appends the argument regardless of configuration)

<comment><USER20> Thanks!

</comment></comment></comment><comment><USER21> This is laughably useless.

It's extremely unlikely they have patched all existing ways for root to change the kernel, and anyway since the kernel is written in C it almost surely has plenty of memory safety exploits.

Also requiring an hypervisor is much simpler than doing this work and actually has a reasonable chance of achieving the objective of not allowing arbitrary ring 0 code.

At any rate, all this work is mostly pointless because if you let people run arbitrary user space code, then they can do almost anything with the hardware anyway (like erasing all disks, etc.), and if you lock that down then you need to force them to use a particular user space and in that case there is no need to also lock down the kernel since without being able to run arbitrary user space code you can't interact with the kernel anyway.

<comment><USER16> How is requiring a hypervisor much simpler than this? I've seen no implementations that make strong integrity guarantees.

</comment></comment><comment><USER22> Possibly a dumb question -- how can one perform kernel/firmware updates if root is "locked out"?

<comment><USER23> The integrity mode applies to the running kernel in RAM. You generally don't actually upgrade that, instead you replace the kernel image on disk (vmlinuz), which is still possible. On next boot, the new image will be loaded. But if you have trusted boot enabled, the new image will only be booted if it is appropriately signed.

Live patching still works if the updates are signed. The kernel can still do whatever - with integrity enabled it just refuses to do certain things, such as loading kernel modules or updates that aren't signed.

<comment><USER22> Great explanation, thanks!

</comment></comment></comment><comment><USER24> Another option might be to allow a "rootless" mode in which direct access to the root account itself is impossible (but where there are still ways for non- root users to gain a subset of root capabilities).

</comment><comment><USER25> This is a serious improvement.

</comment><comment><USER26> Do people realize what they are doing here? I'm happy not touching my Windows kernel, stuff generally just works. Stuff _never_ just works on Linux. And now the last time I tried to load a kernel module I had built for my Ubuntu system, it refused because, duh, it wasn't signed by some UEFI key I had never even seen. So now of course, _the Ubuntu is fucking gone_. Because it makes it impossible to do things that on Linux are still a monthly requirement.

Not to mention the impact this stuff has on kernel and driver development. Even Windows you can just boot into a development mode and it might scream at you on the desktop, but it will allow you _to modify your system as you wish_. I wasted a few hours when that Ubuntu thing happened to figure out where that switch was and didn't find it.

Right now, this should be strictly the domain of Google and Amazon that can actually have a trusted chain from bootloader to userland. Not enabled on any vanilla Ubuntu because hey, we detected UEFI!

<comment><USER27> If you're using a modern machine, then you probably are using Secure Boot. For better or worse, Secure Boot requires Microsoft[+] to sign your binaries and they have certain requirements which you cannot break or they will revoke the signature. One of these requirements is that you cannot have a signed binary load unsigned code into ring-0.

So (ignoring whether these features are useful or good) in order to be able to run Linux on modern hardware these types of features are necessary. And I'm sure you'd be just as annoyed if you couldn't run Ubuntu on a machine that was less than 6-8 years old.

> I wasted a few hours when that Ubuntu thing happened to figure out where > that switch was and didn't find it.

It's a shame you didn't manage to find it, because it's pretty trivial to create your own signing keys and enroll them in the MOK. You can then use those to sign your kernels. You just need the sbsign package.

If you want to just turn it all off, it's even more trivial -- go into your BIOS and disable Secure Boot.

I would hope someone who wishes to do some kernel development would be able to overcome this fairly minor hurdle.

[+] Technically it's whoever owns the keys that the manufacturer has approved to run software on the machine. On basically all modern machines that list is just "Microsoft" but you can enroll your own keys or remove Microsoft's keys if you want.

<comment><USER28> I see arguments (like one of replies to your comment here), that you can turn off Secureboot - so simple, much wow.

Not all firmware allow you to turn off secureboot or enroll your own keys. You'll see plenty of this on bios-mods.com if you want to know what that looks like. It also really throws into sharp relief questions around things like device ownership.

Let me tell you about my experience with an Amazon DeepLens device (x86-64) that I've been trying to get stock Ubuntu installed on. The only keys on this device are Amazon ones. This means I cannot install any OS other than the one they supply (a modified Ubuntu 16.04 install). If I own the device, shouldn't I be free to install my own OS? If I own the device, and have physical control of it, I should be able to bypass secureboot, period - but not always the case today.

<comment><USER27> > Not all firmware allow you to turn off secureboot or enroll your own keys.

Being able to disable Secure Boot and install your own keys is a requirement of the Windows 8 and 10 advertising requirements, so manufacturers almost always allow it so they can get some money from Microsoft for advertising.

That doesn't mean it's always possible, but I would humbly suggest that we shouldn't purchase such devices so that companies who make those devices learn to stop doing that. The fact that Microsoft managed to pull this shit with Windows RT is disgraceful.

> It also really throws into sharp relief questions around things like device > ownership.

I don't disagree at all, and I do think that it's something we need to be very mindful of. But Secure Boot does solve real security problems.

> If I own the device, shouldn't I be free to install my own OS? If I own the > device, and have physical control of it, I should be able to bypass > secureboot, period - but not always the case today.

I completely agree. Amazon shouldn't be allowed to sell such devices. But that doesn't invalidate Secure Boot as a concept, nor is it the fault of Ubuntu or anyone other than Amazon.

<comment><USER28> I can see how Secure boot solves real security problems. And I am definitely not blaming Ubuntu here.

However, it's unfortunate that the Secure Boot technology (or maybe this is a licensing thing) by default does not make prescriptions, and that we're reliant on the device manufacturer's good will to see it implemented correctly.

<comment><USER29> How could a technology itself make prescriptions about the ways that the manufacturer lets you configure it?

<comment><USER23> Through licensing and/or certification requirements. Large companies take compliance serious.</comment></comment></comment></comment></comment></comment></comment>


Ask HN: What are the challenges to switch version control systems in your org? - <AUTHOR> I've noticed a lot of interest in monorepo-type version control and CI systems lately. Git doesn't seem to be a good solution to this problem, but it does have a lot of momentum as the standard. If a better version control system existed, what would be necessary features to switch? What would be the technical and social challenges to switch in your organization? <comment><USER2> I never worked in an organization where all the history was transferred to the new system (because of cost or technical hurdles).

So basically, even if the 2 systems are available for some times, the old server end up being decommissioned. So it means you have effectively lost the older history. This is not always that bad, but some times you'd like to know why something was added/designed that way because it does not makes sense, and you cannot use source control to help you. So each change of system incurs a loss of knowledge.

I don't say it is a good idea to have the same system for 30 years but at least you know where you are coming from.

The second point is that during the transition phase you have to maintain the 2 systems in parallel. Even you don't need to touch the old system often, every patch added to the old one need to be ported to the new one, and since systems are often not compatible (and don't play with the same kind of data structures), you resort to patch/manual merge that are kinda error prone, so this is a bit dangerous. It would be technically possible to import the legacy systems in the new tools, but it is often not done either.

So a perfect version control system would need :

\- to effortlessly import all the legacy history

\- to be 100% compatible with the old system to be able to do merge/compare across systems.

Frankly that sounds like impossible requirements. So most of the time it is more an organizational issue (when to do the cut off, training, etc) than really a technical issue due to the tooling.

</comment><comment><USER3> Somewhat related: A few years ago, Kiln (FogBugz) decided was supporting an online version of Mercurial and decided to support Git too. They made it in a way that you can use any repository with both system at the same time. Probably there are better tools now. I guess that in the future someone will just make a script for the transition from git to whatever.

[https://www.joelonsoftware.com/2013/03/11/town-car- version-c...](https://www.joelonsoftware.com/2013/03/11/town-car-version- control/)</comment>