Building an automatic chicken coop door opener - <AUTHOR> https://www.iotforall.com/building-cheap-automatic-chicken-coop-door-opener/ <comment><USER3> Reminds me of the story of a farmer asking if an engineer can help him identify sick ostriches on his farm. So to identify a sick ostrich, it doesn't eat anymore, so the engineer develops a tilt sensor that you strap to the ostriche's neck, and if it doesn't tilt enough times a day the ostrich didn't eat and a LED would light up red indicating the ostrich is sick and requires the farmers attention.

Now the problem is to separate the sick ostriches from the healthy ones. So the thinking is you connect the ostrich camp with a narrow passage to another camp, and put out food in the other camp and as the ostriches move to the new camp you capture and divert the sick ones.

Turns out that when you put out food in the new camp, only the healthy ostriches will move to the new camp and the sick ones will stay behind because they are in any case not interested in food.... which negates the need for engineer and his sensor in the first place :D

<comment><USER4> That reminds me of this story about removing empty boxes from a production line.

[https://userweb.cs.txstate.edu/~br02/cs1428/ShortStoryForEng...](https://userweb.cs.txstate.edu/~br02/cs1428/ShortStoryForEngineers.htm)

<comment><USER5> Funny, but obviously not real. If the guys were tired of "tired of walking over every time the bell rang", the number of defects detected wouldn't be 0.

<comment><USER6> 1.Bell is ringing too much and people are tired of walking over: defects > 0

2.Put fan there to blow empty boxes: now defects == 0

I don't see the problem.

<comment><USER7> Yea you would put the fan before the check point so the line doesn't stop.

</comment></comment></comment></comment></comment><comment><USER8> I've had my own design of one of these up and running for about 5 years now. I should probably write it up.

I used a normal (non-stepper) motor with some gearbox I found in an old cassette player. The door limits are detected using reed switches.

It is solar powered, with a 12V lead-acid battery. I've had to replace that twice over the 5 years because winter tends to kill it. Since then I've added a winter trickle charge wire from the nearest outbuilding.

The solar panel voltage into an ADC provides the daylight reading. An Arduino Nano provides the main control functions. It spends a lot of time in sleep mode, waking every 5 minutes to check light levels, and at night sleeps until a preset time when it makes sense to start checking for daylight again.

It also has an XBee radio link to a Raspberry Pi which sends me email updates, keeps the Arduino's clock accurate (obviating the need for an RTC), and alerts me of any mechanical problems with the door mechanism. A common one is straw and other mess getting jammed in the door runners, and once a broken door mechanism.

Over the years I've tweaked the opening/closing times to account for the hens' habits, and for predators. I've learned that the dawn/dusk opening technique is not enough on its own, it needs to know the time of day also.

It opens at 6:30am or first light, whichever is latest. Too early in the summer and you're asking for fox trouble, and also the neighbours used to complain the cockerel would crow when it opened too early (sunrise can be before 4am in midsummer).

My hens go to bed very early, so it closes before dark, and again at least by 7:30pm in the summer because foxes can be active by then.

We live in the country and almost everyone near me has hens, but they rely on manual opening. They have all lost their entire flocks to foxes at least once in the time my automated door has been operational, but thankfully we have not. I have seen scratch marks on the sliding door indicating interested predators, but I think my timing is right to keep the coop closed when foxes are about.

<comment><USER9> "We live in the country and almost everyone near me has hens, but they rely on manual opening. They have all lost their entire flocks to foxes at least once in the time my automated door has been operational, but thankfully we have not. I have seen scratch marks on the sliding door indicating interested predators ..."

We live on a very small island of private property inside a _huge_ expanse of open space / wilderness and thus have very heavy predation on any animals we raise.

In the case of our chickens, I just kept adding hot wires to the fence until nothing could get into the run. There are four hot wires now, two of which form a negative (back bending) slope. It is impossible for a thing to climb the fence now without touching (and holding) at least two hot wires. We've had our current flock for over a year with no losses, vs. losing every previous flock to raccoons and weasels every 2-3 months.

I wonder if you would comment on this (seemingly successful) strategy - <USER2> seem to know what you're doing...

<comment><USER8> The problem with fences is the underground part. I have relatives in France whose chickens were all killed by a fox digging under the fence.

They say you need as much fence under the ground as you have above it.

Your problem with being really isolated is that the predators will not be afraid to come out in daylight. If I were going for a tech solution I might start thinking about detection systems...

Or maybe just dogs?

</comment></comment></comment><comment><USER10> Anyone interested doing something like this, I've also done this with a esp8266 and a linear actuator. Detailed how to:

[https://blog.garble.org/arduino-chicken-coop- hardware/](https://blog.garble.org/arduino-chicken-coop-hardware/)

[https://blog.garble.org/arduino-chicken-coop- hardware/](https://blog.garble.org/arduino-chicken-coop-hardware/)

I've installed a few of these now and love em

</comment><comment><USER11> > _If price weren't a constraint, I immediately would have chosen a cellular > IoT board like the Particle Electron or Boron ($50). Connectivity to the > cloud provides several advantages:_

I think we should question whether tech as a whole is moving in the right direction when the first question for building a time-controlled, battery- operated chicken door opener is "how do I connect it to the internet?"

(Sorry for the sarcasm, otherwise, it's a really cool project though)

<comment><USER12> i mean, yes? but also his concerns around clock drift and email notifications are legit.

<comment><USER13> He could probably synchronize his RTC to the GPS system. GPS works by sending a clock signal plus satellite ID from each satellite. Devices using GPS then use an ephemeris to determine the location of each satellite and then calculate the relative position of the receiver.

<comment><USER14> There are also time signal radio stations like WWVB, which are used by millions of devices to sync their clocks.

</comment></comment></comment></comment><comment><USER15> My coop is outfitted with one of these automatic door kits: [https://chickendoors.com/product/right-standard-pullet- shut-...](https://chickendoors.com/product/right-standard-pullet-shut- door/?gclid=CjwKCAiA0O7fBRASEiwAYI9QAhx1WldAnxw36kfxXPT6tfBQAQ5zuvg8KaQ- QMzjUr93ty9jtWktrhoCaWMQAvD_BwE)

It opens at daylight, closes at dusk. Adjustable tolerances in either direction which I need to adjust occasionally but not often, like after DST changes to allow the door to stay open longer while the chickens get used to the shorter days, ensuring they can get inside before the door shuts, with darkness falling earlier. Small solar charger and battery keep it operational.

I understand the impulse of the author to design something complicated, but practically speaking there is no need to remotely control the opening of the coop door over the internet, especially if you have a photoresistor already to detect daylight.

<comment><USER16> Not sure I understand; if the coop is opening at dawn and closing at dusk, why does it need to adjust for DST? From the chickens' perspective, the sunset time doesn't change substantially at the moment of DST change.

</comment></comment><comment><USER17> Nice project!

 _Needs to be battery operated and last for at least two weeks (14 days)_ : UNOs are notoriously power-hungry. It's highly unlikely that 4 AA batteries can power an Arduino UNO full-time AND open/close the coop door. Maybe with some advanced deep-sleep-cycle, but I'd love to know more about this.

I also fail to see why he didn't use a cheap ESP-board. They're usually cheaper than Arduinos (as in: below 5 bucks), have an onboard WiFi chip and they run Arduino code just fine. You get a couple of pinouts less, but since he's only using a sensor and a stepper motor this won't be a problem.

If I were to make this, I'd go with a nodeMCU and a cheap solar charging setup. Probably would fit in the budget, too.

<comment><USER18> > UNOs are notoriously power-hungry... Maybe with some advanced deep-sleep- > cycle, but I'd love to know more about this.

The naive Arduino code has two basic functions setup() and loop(). Putting your main code in loop results in a busy wait that spins up 100% of the CPU all the time. It's also running all the peripherals all the time.

You want to use "avr/sleep.h" and "avr/power.h" to put the processor to sleep with peripherals off (except the one which will wake up the processor). See [http://www.gammon.com.au/power](http://www.gammon.com.au/power) for a nice tutorial. Opening these headers and their source in the avr-gcc libraries and comparing to the documentation on the processor is a good exercise in getting right down to the metal of how the processor manages power.

You also want to get rid of the ancient 7805 regulator; many clones use a better LDO voltage regulator to alleviate the problems with high standby current.

</comment></comment><comment><USER19> Really fascinated by this kind of stuff, but getting into it seems really overwhelming. I think it would be something really fun for me and the kids to do together, does anyone have any personal beginner resources to recommend?

Of course I'll do the googles too.

<comment> jon-wood Like software development the best approach is to learn a concept at a time and then put them together into something bigger. Start off just with an Arduino and some basic LEDs and switches - that'll teach you the basics of connecting things together (if you're really at the beginning don't even involve an Arduino, just get do it all on a breadboard). Once you're comfortable with that maybe add some more exotic inputs and outputs, like light sensors and motors. After that maybe replace your Arduino with an ESP32 which will give you wifi and bluetooth to interact with your system.

Once you've spent a while doing that you should be in a good place to start on more complex projects - there are a few robot kits designed to have a Raspberry Pi mounted on them to make them programmable, or maybe look at ESPHomelib[1] to do some home automation.

[1] [https://esphomelib.com/](https://esphomelib.com/)

</comment></comment><comment><USER20> Very creative and useful project. The Internet of Poultry (IoP) has finally arrived:)

<comment><USER21> Honestly, farming is probably the place where IoT makes the most sense. Especially for very environmentally sensitive processes like winemaking, large sensor networks and data analytics offer a lot of value to the farmer.

<comment><USER13> You can do a lot of the same stuff with Bluetooth Low Energy and avoid putting your entire winery on the internet. I really like BLE because it's a very straightforward set of protocols for building sensor networks and sending/receiving data.

<comment><USER21> LoRa is probably the way to go for farmers, given the range requirements. No need to connect to the Internet regardless.

</comment></comment></comment></comment><comment><USER22> Great project and all, and definitely something fun to work on, but this is a pretty questionable application for IOT (don't wish to discourage).

What's the key metric here? The chicken coop opens and closes at the appropriate time of the day? How does IOT help solve that objective? There's some great parallels here to an MVP in the software world.

As for my two cents, an alternative and more robust solution, could be put together with something like an aliexpress ambient light switch, limit switches, a recycled car battery, a trickle charge solar panel, and some relay logic.

<comment><USER23> I'm unclear on why this is a questionable usage. My wife keeps chickens, and going out morning and night to open the doors is...certainly not hard, but inconvenient (particularly the night one, as you often remember AFTER you've settled in for the night and must head out, regardless of weather.

Skipping the occasional visit doesn't work either - they need to get out both for general happiness and foraging, and if you don't close the door, creatures kill your chickens. (This has happened to us twice, and we're in the middle of suburbia, albeit the Seattle variety with more wildlife than the average cul- de-sac)

> The chicken coop opens and closes at the appropriate time of the day?

It's closed sometime after chickens have entered for the night, which tends to go off of sunlight, and opens early enough that the chickens aren't literally cooped up when they want out. That's rough, but the machine doesn't have to be perfect, it just has to do as well or better than we humans do.

As for what value does IOT add? Well, it can help confirm when it is/isn't working, but mostly it's that the cost is almost the same, at least for those of us without extensive electronics experience. Your alternative (I'm not sure how it's more robust) solution LOOKS cheaper, but I wouldn't know how to connect the parts and would likely screw up the amps/watts enough to break stuff and require replacement parts. For me, spending an extra $50 on parts is worth the saved time and effort - even as the $250 version that has no options for customization of behavior/interactions is NOT worth the saved time and effort.

Probably - it should be noted I've been researching this topic (along with any way to ensure the chickens ARE all inside - if they get broody they may nest elsewhere, which ends poorly) for the past year but so far we're still doing it manually. I expect this to change over the holidays.

> There's some great parallels here to an MVP in the software world.

Only in the vague "is this adding enough value to be worth it?" sort of way, but as the answer is "it depends" I'm not seeing the great learning opportunity you're implying.

<comment><USER22> I have no qualms with the merit of an automatic chicken coop door. Obviously the benefits can be considerable, and the project certainly fits the bill.

The point is, almost all maker projects jump straight to let's throw an Arduino at it, with no consideration to the tradeoffs at all. This can be quite a disservice.

There are tradeoffs, eg. power management? (those batteries aren't going to last at all), fault tolerance? (arduino crashes due to condensation shorting out the timing crystal), maintenance? can you instruct an untrained individual to perform any meaningful repair work (eg. bend the arm on a damaged limit switch).

One benefit IOT can bring, is the detection of fault conditions etc (door took too long to open fully something stuck in the tracks), but implementing that kind of handling in a meaningful way is a complex problem.

These things rarely matter for a diy project, but you see this stuff everywhere. Consider whether a problem can be solved in an analog or mechanical manner, it's likely to lead to a simpler and more robust solution.

As for ensuring chickens are inside of a coop, that's a tough problem and I'm interested to hear your thoughts on that?

Eg. for the above chicken in coup problem, something as simple as a weight triggered switch on the ramp (or a push bar near the coop opening) is likely to out perform anything more complex.

<comment><USER23> > I'm interested to hear your thoughts on that?

My thoughts are definitely too complex. Currently I'm thinking of a camera that will turn on a light and take a picture (at a specified time || when door closes) and send that to our family Slack - someone will habitually look at any notification, and we don't have a large number of chickens so it's fastest to rely on human perception to see if someone is missing. Or just a camera that we can turn on remotely to check the feed ourselves.

That's the "simple" version - a more complex one would take a picture and compare to an empty sample to decide how many blobs there are, but that is hampered by (1) If chickens huddle, that becomes complex and (2) it's not a problem space I have any interest in, so the problems won't be fun to solve.

<comment><USER22> Vision sounds like a really tough way to solve it, challenging lighting conditions just to make things trickier.

I know that in some contexts, RFID tags are used for livestock tracking. Don't know if they would comfortably work on birds though.

</comment></comment></comment></comment></comment><comment><USER24> How does the track mechanism work? Is that just a string being wound around the motor shaft?

I've been playing around with Arduino and find the electronics easy but it's really hard to get good information about linear motion in terms of what parts to get and what wheels / accessories are compatible / needed with what tracks. Very few resources out there and I've ordered so many incompatible tracks, wheels, carriages, etc because I couldn't find any information on what mates with what.

</comment><comment><USER25> I used a raspberry pi, a controller board and a linear actuator to create a similar solution. I also coded up the door lock, but turns out the linear actuator has enough resistance to stay closed on it's own.

[https://github.com/HenriPro/ChickenCoopDoor](https://github.com/HenriPro/ChickenCoopDoor)

</comment><comment><USER26> Cool project, but is it a failure for one of the requirements being that it costed under $50 and title says it costed $100?

<comment><USER27> I believe it was $50 for the door and the remaining $50 was for the parts.

</comment></comment><comment><USER28> Depends what you value your time at, but I've had two ChickenGuard automatic door openers for years now, and they've worked perfectly: [https://www.chickenguard.com/](https://www.chickenguard.com/)

<comment><USER29> Heck, why not just go to the store and buy some eggs?

<comment><USER30> The taste (not to mention the color) of store-bought eggs aren't up to par. Eggs from own free-range chickens are simply... better.

Also, chickens are really fun animals, and they taste nice too.

<comment><USER29> I agree! But my comment was sarcasm/extension about his suggestion to reduce effort by buying a commercial door opener. Like damn, if you're not going to make your own door opener with an Arduino, are you truly even committed to raising chickens?

<comment><USER31> I got the sarcasm and found it highly amusing, more so with the amount of comments about egg quality!

</comment></comment></comment></comment></comment><comment><USER32> The biggest problem is to convince chicken to go sleep at the coop instead in its favourite tree.

</comment><comment><USER33> I'd be very surprised if the motor and electronics last a season without fault.

</comment><comment><USER34> Annoyingly, doesn't mention how it counts the chickens. :)

<comment><USER35> It has a light sensor, so it assumes that once its dark enough, the chickens will have come inside of their own accord. Based on chickens I've met, this is probably accurate.

<comment><USER36> When I did it, I just closed the door at ~nautical~ civil twilight. The chickens come home to roost before that, and the predators (raccoons) generally were later than that.

My design was Raspberry PI -> sensor/power board -> battery powered drill. And an extra long usb cable to get the wifi dongle to the other side of the roost, because when the chickens were in the coop, they absorbed enough wifi signal to make it drop off the network.

Edit -- changed which twilight. Also, code here: [https://github.com/wiredfool/coop-door](https://github.com/wiredfool/coop- door)

Unfortunately, schematics and physical door design are lost to several moves.

<comment><USER35> TIL chickens are wi-fi jammers

<comment><USER14> All sacks of meat, humans included, are to some degree. We're made of a lot of water.

</comment></comment></comment></comment></comment><comment><USER37> our neighbor had an automatic door and the coyotes learned what time the doors opened.

They were first in line for breakfast.

</comment><comment><USER38> Where is the video? (I'm on mobile Safari)

<comment><USER39> [https://vimeo.com/301639731](https://vimeo.com/301639731)</comment></comment>


I'm giving up on HPKP - <AUTHOR> https://scotthelme.co.uk/im-giving-up-on-hpkp/ <comment><USER2> The decision to use HPKP is about balancing risks. You're reducing the risk that a compromised CA can issue a fake certificate for your site (the use of which also requires either DNS compromise or some targeted MITM hijacking) in exchange for increasing the risk that operational failure or the need to rotate certificates more quickly than anticipated will block all users from your site for a potentially long period of time.

The questions to ask are: how bad is the failure case, how likely is it, and how hard is it to recover from? All three answers, IMO, weigh strongly in favor of _not_ using HPKP.

An invalidly issued certificate is hard to make use of, except in targeted situations (malicious wifi for DNS spoofing, or a compromise of trusted root certs on the target machine), or for limited amounts of time (actual DNS takeover). So the number of users affected would be small in either case. And if there's a root CA out there granting invalid certificates, there's enough interest in keeping the trusted roots clean that it would get patched up pretty quickly anyway. So, the impact is low, the probability is low, and the recovery is relatively quick.

But HPKP is rife with opportunities to screw yourself over unless you're extremely careful. And a mistake can potentially affect all your users for whatever period you configured the pinning to be for (which might be months or longer if you don't think it through or just make a mistake). Recovering from that is difficult or impossible.

So given those tradeoffs, the choice seems obvious to me. It's far easier for attackers to just use a different domain name and count on people not realizing or not even knowing which site they are visiting. That requires no CA compromise, no trusted-root hacking, no DNS MITM, no wifi trolling. HPKP is a problematic solution to a problem no one actually has.

<comment><USER3> > So the number of users affected would be small in either case. And if > there's a root CA out there granting invalid certificates, there's enough > interest in keeping the trusted roots clean that it would get patched up > pretty quickly anyway.

However, HPKP is one of the mechanisms today that can best _detect_ this activity happening. (In the future, CT with mandatory log inclusion proofs should be better.) People don't just learn about misissuance events by magic, but by having technologies that provide other channels for checking what certificates exist in the wild or what certificates UAs should expect.

Also, some misissuance can be unintentional on the CA's part, so pinning can conceivably also help clean up the CA's practices.

You might be right that these factors weight against HPKP most of the time, but for the core misissuance-detection one, the situation is a bit more complicated because of the way that HPKP itself helps with catching these situations.

<comment><USER4> There is a header one can set, as an alternative to HPKP, that will merely notify you in the event of a misissuance, rather than block off your domain. Perhaps that would be preferable?

<comment><USER3> Yes, the notification mode would probably often be sufficient in many cases (and I think might be what caught the DigiNotar compromise?). I forgot what happens if an attacker tries to block the notification from going through, though.

</comment></comment></comment></comment><comment><USER5> Lots of good HPKP discussion on infosec twitter as a result of this article.

I agree that HPKP in enforce mode is too dangerous to be valuable, but running HPKP in report-only mode can be an effective canary against (poorly executed) MITM attacks or other accidental server/router/ISP/etc misconfigurations.

</comment><comment><USER6> This article (and others I have read disliking HPKP) generally take an all or nothing approach. That is to say, they see HPKP as either "pin the key of my certificate" or "don't use HPKP at all"

In reality, you can have a valid HPKP setup as long as any keys in your certificate chain match the key in the HPKP header. This means that you can pin the intermediate certificate (or even the root CA if you want) key. By doing so, you are no longer vulnerable to losing your SSL keys, but now other CAs cannot issue certificates for your site

<comment><USER7> Or you get N certificates from different sources, pin them all, use 1, stick the rest in (a) safe vault(s). Even if something really bad happens, you can use one of the other ones until you cycle. Cost of N certificates will be << money you'd lose otherwise, and likely a rounding error in any company's monthly spending. (if it's already live / trading)

<comment><USER8> HPKP is based on the public key, so you don't necessarily need to obtain signed certificates in advance - generating a key pair and keeping the private key safe would suffice.

There is some value in ensuring that a CA is willing to sign a certificate using those keys in case something went wrong during the key generation (i.e. a key size or curve that's not supported by the Web PKI), so it might be considered a best practice to do that regardless.

<comment><USER7> It's possible. But if you're in a disaster recovery situation, do you want to add the step of granting the certificate as well? Do people on call have access to the company credit card to get one?

It's easier to just get a full cert ahead of time.

</comment></comment></comment></comment><comment><USER9> Let's Encrypt set HPKP on suicide watch.

Let's Encrypt devs decided to put those short-lived certs (instead of the long-term certs everyone was using) making it almost irrelevant to use that "security header", almost every webdev knows the issues present on the current cache-invalidation problems on every major browser.

<comment><USER10> What do you mean? How HPKP and Let's Encrypt collide with each other? Let's Encrypt is just another CA. You can use the same key for reissuing your certificates, so HPKP header will stay valid.

<comment><USER9> [https://community.letsencrypt.org/t/hpkp-best-practices- if-y...](https://community.letsencrypt.org/t/hpkp-best-practices-if-you- choose-to-implement/4625)

[https://community.letsencrypt.org/t/official-hpkp-support- fr...](https://community.letsencrypt.org/t/official-hpkp-support-from-lets- encrypt/23753)

[https://github.com/certbot/certbot/issues/1611](https://github.com/certbot/certbot/issues/1611)

</comment></comment></comment><comment><USER11> Scott, so take HPKP out of your securityheaders.io site. Encouraging people to deploy this extremely sharp tool can bring only bad results.

<comment><USER12> He did, on test.securityheaders.io. The change probably will move to actual site (non-test version of it) soonish.

<comment><USER11> Excellent!

That also shows damage that can be done by people blindly perusing A+/100% on security tests. The same goes to ssllabs that needs 4096 bit RSA keys (or equivalent) to get 100%. Just... a bad idea.

</comment></comment></comment><comment><USER13> Okay, but I still think mobile app apis served over SSL that don't pin to a specific signer are making their lives way harder.

<comment><USER2> This is true. This is an actual case where pinning is a good idea, but this sort of pinning can and should happen in the application code or config, by restricting which CAs are trusted for a particular transaction. There's no need for a generic HTTP header for this situation. Set your TLS negotiation requirements in your app.

</comment></comment><comment><USER14> I'm very curious to hear what the community thinks of the dangers outlined here.

I've been hesitant about setting up HPKP before for small unimportant personal sites before since I have poor operational hygiene for them (I keep my machines patched so I don't get pwned but I have lost SSL keys before due to laziness or forgetfulness).

<comment><USER10> It's hard for me to justify a technology which could do very serious damage to a domain. I did the same, I set up HPKP for my domain and then I've lost my keys (I forget to pay for hosting and server was deactivated). It's not a big deal for me, I'm not really using this domain, but even with this throwaway site I've had problems, when I uploaded some file and sent link to my friend, but he wasn't able to download it, because he was there before.

Blackmailing domain owners with HPKP is a real threat as well. It'll happen, sooner or later, servers are getting owned all the time. Defacing front page is visible. Setting additional header is not.

<comment><USER15> > I've lost my keys (I forget to pay for hosting and server was deactivated)

Both of them? You mean you were storing your backup key on the same server the main key was on? Doesn't that kinda defeat the purpose of having a backup key in the first place?

<comment><USER2> Mistakes happen. New certs and keys can be easily acquired if you lose the key. But HPKP prevents you from fixing this simple mistake in order to guard against a problem that's extremely unlikely.

</comment></comment></comment></comment><comment><USER16> Re: HPKP suicide, why not pin a handful of 'recovery' keys that you can use when things go sour? Stored off-server or offline so in the hack scenario you don't lose them.

<comment><USER17> In a "hack scenario" theoretically everything can be compromised.

<comment><USER15> Sure, in theory. Realistically though, I think any scenario that involves compromising both the production server _and_ a USB drive locked in a safe is pretty unlikely.

<comment><USER8> The interesting bit about RansomPKP is that it works independent of whether your HPKP pinning strategy is sound. In fact, it works even if you don't use HPKP at all. All the attacker needs is the ability to modify your HTTP headers and to either have access to your existing private key, or the ability to change the private key to one under their control. From that point on, it's all about how long it'll take you to notice the modified header. If it's live long enough for a sufficiently large percentage of your visitors to hit the site, the damage is done.

One thing to take away from this is that RansomPKP is not so much an argument you can use when deciding whether you should deploy HPKP for a particular site, but rather something that's relevant for deciding whether browsers should continue to support HPKP in its current form at all. I could see how a couple of large RansomPKP cases could very well cause a change on that front.

<comment><USER18> Actually, more than just being independent of your pinning strategy, one of the partial mitigations that Bryant (@eganist) and I recommended when introducing RansomPKP was to _enable_ HPKP, since it would both block existing users of the target site from pinning the new malicious headers and cause alarm bells to be set off early.

Like you said, RansomPKP is more impactful to the ecosystem-wide decision of whether HPKP should exist than to whether an individual should use it (given the precondition that it exists). That said, malicious pinning was explicitly discussed and noted as a concern during the standardization process, so RansomPKP doesn't add much to that ecosystem-wide decision; it's just a fun application of HPKP Suicide that takes the core malicious pinning idea to a logical conclusion, and isn't even necessarily the worst way to abuse a compromised web server. There are also much more positive applications of HPKP Suicide, e.g. my startup Cyph's in-browser code signing layer.

Anyway, I wouldn't use any of this to argue against the very existence of HPKP, but I agree with Scott removing it from a tool that at least partially targets non-experts.

<comment><USER15> > one of the partial mitigations that Bryant (@eganist) and I recommended when > introducing RansomPKP was to enable HPKP, since it would both block existing > users of the target site from pinning the new malicious headers[...]

Huh? How? If the header changes, don't browsers automatically update their pins next time the user visits that page?

> [...]and cause alarm bells to be set off early

I don't get this either. If an attacker enabling HPKP wouldn't set off any alarm bells, why would changing an existing HPKP header do that?

<comment><USER18> At the time, if I recall correctly, we'd tested both Chrome and Firefox and confirmed that any HPKP header that didn't match the key currently in use would be ignored. Because of this, the only way we could see to replace an existing pinned key would have been to remove or replace the existing header and keep that change intact for the duration of the header's max age while remaining undetected the whole time (which would be unlikely when faced with a competent InfoSec team, as you implied).

As far as early alarm bells, sorry, that was a bit vague. I was referring to not just ambiguous warning signs that would be caught by careful monitoring, but the inevitable stream of reports from end users about the big scary TLS pinning error screen in the browser, should the attacker decide to immediately push out the malicious keys/headers without waiting out the old ones' expiry.

<comment><USER15> Ah okay, I see what you're saying. If the HPKP header is set, the attacker can't transition the server over to using a new key the attacker controls until _after_ the max-age expires, otherwise they'd risk tipping their hand when users who still have the old set of keys pinned start getting key pinning errors and complaining to the site owner. (And they can't remove the original key from the set of pinned keys until after they make that transition, since key pinning headers that don't include the key you're currently using are ignored.)

<comment><USER18> Yep, that's exactly it. There are a bunch of possible permutations/optimizations, like initially keeping the original header with the max age changed to 1 for a shorter period of time (until you're confident that the number of user reports will be small enough not to get on anyone important's radar before it's too late, and/or maybe you have some more complicated logic to track which clients do and don't have the altered header); but in any case the general point we made in the talk was just that enabling HPKP (among a few other things) was a net positive if you were worried about getting hit by RansomPKP today, not that it would entirely prevent the attack.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Does anyone here know how (or if) each of the major browsers caps max age? It appears the specification provides a hint that it's up to UA whether to cap max age.

If the browsers aren't capping max age, could this affect future owners of a domain had the HPKP max age been set to several years after their ownership of the domain expired?

<comment><USER11> They do cap: 10 weeks in Chrome, 60 days in Firefox [0] but you can still poison future owner's domain.

[0]: [https://mobile.twitter.com/spazef0rze/status/900698403629391...](https://mobile.twitter.com/spazef0rze/status/900698403629391877)

</comment></comment><comment><USER20> How is HPKP supposed to work when you change certificates? The new certificates don't have HPKP and the site still relies on old HPKP.

Letsencrypt certificates only lasts 90 days. It's a real pain-in-the-ass to figure out a process that allows HPKP with certificates that expire every 90 days.

<comment><USER21> If you continue to use the same public key, your existing pin will work with your new certificate. So there's nothing to do. IIRC, many (all?) LE clients generate new keys by default, so this is something you need to plan for in advance.

If you want to change your public key, you have to obtain your certificate in advance, then introduce its pin into your HPKP configuration at least N days before the certificate switch. In this case, N is your maximum HPKP policy duration. With this process you ensure that, when you do switch the certificates, all your users will have the correct pin for it. Whatever HPKP policy you had N+1 days prior, it will have expired by then. You probably want some additional safety margin there too.

</comment></comment><comment><USER22> Am I mistaken to think that the HKPKP attacks could be mitigated to a certain degree by implementing delayed pinning - meaning a pin must be announced for a certain amount of time before it goes into effect, allowing the owner to notice and counteract a malicious pinning.

<comment><USER23> HKPKP is a header in http request, there is no where to announce it early.

<comment><USER24> The idea is that browsers would see that header, but only enforce the pin if the header was kept for a certain period.</comment></comment></comment>


Nook Tablet vs. Kindle Fire: how the specs compare - <AUTHOR> http://www.geek.com/articles/gadgets/nook-tablet-vs-kindle-fire-how-the-specs-compare-2011117/ <comment><USER2> For me, hackability will be the major issue. I'd rather run the Kindle app and the Nook store app on top of Cyanogenmod than on either of the supplied Android versions.

They should both run ICS pretty well, too -- but I place low odds on Amazon or B&N putting themselves to the trouble of porting it any time soon.

</comment><comment><USER3> Funny how the things that don't matter were given seven whole sections.

But the one thing that will determine whether either of them succeeds or fails, the intangibles, was given only lip service at the end.

<comment><USER4> Yeah, I actually chuckled when I read "this may be the [spec comparison] that will come in the handiest this shopping season."

Consumers don't care about specs in this market. Sure, a few do, but not enough to make or break a product. This market is all about services, convenience, branding and mindshare. In those categories, Amazon, specifically the Kindle, wins hands down. Even with better specs, the B&N Nook will feel like the cheaper "also-ran" to the more mainstream Kindle Fire and iPad. It's a shame for B&N, but that's the facts.

<comment><USER3> IMO it's going to come down to selection, price, and experience.

Unless either side comes out with a killer feature that the other can't replicate.

What's the selection of titles, movies, and music? What's the pricing look like? What's the buying and consumption experience? Amazon has all 3 down to an art. Does B&N?

</comment></comment></comment><comment><USER5> through the consumer lens:

can i buy and read books? both.

can i watch movies with it? both.

play sudoku? both.

listen to music and audio books? both.

my kids can play angry birds? both.

cost the same? nope, the kindle fire costs $50 less.

<comment><USER6> I'd add consumer brand confidence B&N vs Amazon. In this case B&N needs to overcome at least $50 worth of Amazon's influence to even the odds.

Another thing I'd add is brick and mortar retail availability - in this case I believe the Nook is also available at Target as well as B&N's stores, and that might influence some shoppers who want to try before they buy.

<comment><USER7> I believe that Kindle is also available at most brick & mortar stores that Nook is (not B&N obviously).

</comment></comment></comment><comment><USER8> I think the big difference is going to be software. I expect that Amazon's engineers are going to be able to pull that off better than Barnes and Noble's.

Nothing against the devs at B&N, it's just that B&N is a book store that writes a bit of software while Amazon is a software company that happens to run an online store.

</comment><comment><USER9> It's a shame they both still have terrible displays. It's hard on the eyes to read a long text on a screen with < 200ppi. Guess I'll have to wait for the next generation.

Probably fine for casual web browsing and children's books with large type, though.

<comment><USER10> I had an opportunity to try out the Fire and didn't think that the display was terrible at all, for what its worth. Seemed crisp enough to me.

</comment></comment><comment><USER11> 1080p output but a 600p screen without any video output capabilities. Why? Are they just saying they can re sample 1080p files to a lower resolution?

</comment><comment><USER12> Summary : they are the same hardware wise. The reviewer barely mentions software. And it's clear he never either device in real life. Not even from far away.

Why is this even here?</comment>


Red Gate's Springboard incubator startups unveiled - <AUTHOR> http://eu.techcrunch.com/2009/11/04/springboard/

<comment><USER2> Pager Duty is out and can be used today: <http://pagerduty.com>

<comment><USER3> I can't believe this is not already a solved problem! What are your USPs?

<comment><USER2> it isn't my startup, was just noticing they were live. their USP is (AFAIK) that they offer really great scheduling, escalation and delegation.

</comment></comment></comment><comment><USER4> We've been using PagerDuty since they launched beta on HN a month or two ago and overall we like it although we think the pricing seems a bit high.

</comment><comment><USER5> Nice to see something like this on my side of the pond. Just a shame it's on the other side of the country.</comment>


Ask HN: Why are we more productive, have more workers, but still working more? - <AUTHOR> A trio of articles have appeared in my feed over the last week, all pointing to how we really don't need to work so much (see the New Yorker's "You Really Don't Need To Work So Much" and "No Time", or the NY Times' "Overwhelmed").
Most of the articles centre on Keynses's "Economic Possibilities for Our Grandchildren" essay, which predicted that we'd only be working 3 hours a day or 15 hours a week due to technology, automation and the rise of GDP.
This might go against startup and high-tech culture, where working long hours seems to be the norm, but is anyone working on tackling this problem?
How can we achieve a sustainable living on just 3 hours work a day? Is Tim Ferriss' 4 hour work week achievable for everyone, or even close to that?
Tackling this problem would change the world and technology must be one of the factors in addressing this problem. Why hasn't this been solved yet? <comment><USER2> Over the years, I have thought a lot about work and money. IIRC, about 2/3s of lottery winners are bankrupt within five years. I suspect part of the reason for that is because in modern culture, most people spend their waking hours in one of two modes: 1) Working (aka earning money) or 2) Consuming (aka spending money). When people win the lottery, a lot of them quit their jobs. They now have an extra 40+ hours per week that they need to somehow occupy themselves. They think of themselves as "rich," so they spend those hours consuming (spending money) instead of engaging in low cost/creative hobbies, like cooking, gardening, sewing, etc.

As our income has gone up, one of the side effects is that we want bigger homes, more clothes, etc etc etc. If you tried to recreate the lifestyle of, say, 1950s America, with a modest home and home cooked meals (etc), you could probably drastically reduce the number of hours needed to support yourself -- assuming you could find ways to fill your time that didn't involve pissing away the money you do have.

Most people do not have that kind of self discipline. That isn't something policy will create. That isn't something an app will create. There are ways to shape policy to make more small scale, affordable housing available. But, for the most part, making this happen on a large scale and not just for the occasional quirky individual (as it currently happens) would involve somehow radically altering the world's culture.

As much as I think it would be awesome if people in the world generally had more free time hand-in-hand with more financial security, I have significant reservations about the wisdom of attempting to convince people to do what it would take to make this happen. That tends to be in the morality/religion/ethics/culture area and that is very dangerous ground to tread. Historically, it has tended to be the domain of religious figures, many of whom ended up dead at a young age via methods like crucifixion or being burnt at the stake.

</comment><comment><USER3> As long as there is a significant portion of society willing to work 6+ hours a day, the remainder of society will have to live up to comparable conditions. The reason is because in a capitalist economic system, the gatekeepers of wealth will push up the prices of rent, loans, and other heavy-to-enter spheres, making the 6+ hours of work a requirement for basic sustainable living. When I say _sustainable_ here, I am including the ever-increasing educational, technological, and other requirements for obtaining worthwhile employment. Sure, you could live in a hut without electricity or running water, but nobody is going to hire you; and this required level of "decency" grows with time.

Put another way, there is an ever-increasing "tax" being placed on society from those who exploit the masses. Increased production efficiency allows the bourgeoisie to increase this societal tax ever more.

<comment><USER4> Someone who lives in a hut would have to be smart about it.

</comment></comment><comment><USER5> This is actually not Keynes, it was originally Lenin who predicted that in the future people will live like we do on retirement, because machines would do everything for us.

You have to always measure the productiveness agains the goods you want to get. Today we are incredible efficient in getting the goods that would consume 90% of your time 100 years ago. But once we satisfied those needs, new appetites arose, so we now not only want shoes and bread, but also iPhones and intercontinental flights.

I'd look at some of the religious communities, like ultra-Orthodox in Israel, who are able to live for the whole month on very modest welfare, supporting large families of about 10 children. But no car, no phone, no Internet, no plasma, no fancy vacations, games, gym memberships, Starbucks or online shopping etc.

We are incredibly good at inventing new needs.

[http://www.mrmoneymustache.com/](http://www.mrmoneymustache.com/)

</comment><comment><USER6> I would say that it is because we don't reap the benefits of our own work. Our employers do. If you owned a business and had the option of letting me work 3 hours or take a 10 times increase in profits what would you do?

And say you are a good guy, and let me work 3 hours, how would you deal with a competitor who is making 10 times the profit your company is with the same numbers of people and payroll?

</comment><comment><USER7> We're working _a lot_ less. [http://ourworldindata.org/data/economic- development-work-sta...](http://ourworldindata.org/data/economic-development- work-standard-of-living/working-hours/)

</comment><comment><USER8> It probably has a lot to do with centrally planned economies (eg the Fed) and kleptocratic govts misallocating vast swathes of the labor and investment pools into nonproductive sectors of society, like banking, accounting, law, govt agencies, and other forms of regulatory capture. The number of people engaged in productive work has shrunk dramatically and they are supporting an ever expanding parasite class. Atlas's burden is increasing.

</comment><comment><USER9> Rent, as in, the economic concept.</comment>


Ask HN: Is it worth learning SmallTalk? - <AUTHOR> I've looked at this article titled [Design Principles Behind Smalltalk](http://www.cs.virginia.edu/~evans/cs655/readings/smalltalk.html), and I can't see anything in Smalltalk that's not available in Java or Kotlin as well. I understand that Smalltalk is where the OOP ideas originated, but is it worth learning Smalltalk in 2019, even if just as a side project, for an amateur programmer reasonably familiar with OOP principles and techniques?<p>The idea that Smalltalk is a fully featured system which provides you with everything you might want to do with a computer reminds me of Emacs and Temple OS. Also, the blog I mentioned above seems to present Smalltalk as the perfect programming language. <comment><USER2> Smalltalk is three things in one. It is a _language_ ; it embodies a language _design idea_ ; and it is an _operating system_.

Learning Smalltalk gives you three things:

1\. An understanding of Smalltalk, the language. This is least essential. It's also the kind of thing you can pick up in a single 30-minute session. The language is tiny and simple.

2\. An understanding of the design idea, _uniformly object-oriented programming_. This is crucial and will connect with other styles of programming including Actor-based and pure-functional. This is something you will never get from Java, which is not a uniformly object-oriented language.

3\. An understanding of a completely different and (these days) unusual way of designing an operating system. An object-oriented operating system, to boot. The IDE, the debugger, and the other tooling all integrates to give a level of manageability in many ways far superior to e.g. Unix or Windows.

After a while, you may find yourself discovering subtle things about the interplay between the three aspects of Smalltalk that you can then apply in your own designs. For example, Smalltalk is a "dynamic" language, but the way classes and methods are arranged is very rigid, giving a lot of static structure to the system organisation. This static structure is what unlocks the powerful tooling, and is what simplifies the programmer's mental model to make the system understandable. Comparable OO and almost-OO languages, such as Python, have a more "dynamic" system organisation, making it harder to write tools for automatically manipulating Python systems and making it harder for programmers to understand how Python code, data, state, and processes come together to form a running program image.

<comment><USER3> You have just explained to me why I keep returning to Pharo over the years. I play with it, and always seem to walk away with a more connected, deeper understanding or sense of deep organization that I have not experienced with other languages/environments. The only thing is I have not been able to go beyond toy programs in Smalltalk, or utilities for work (I use Storyboard to keep track of my projects at work, since the company's system Vision by Deltek is too complicated, and we don't have full access to its utilities).

<comment><USER4> I think the new graphics layer (Bloc) will help with this. It's already a huge mental leap to understand what's going on when someone first boots up a Smalltalk environment. The current look of the system doesn't help things.

<comment><USER3> I thought Bloc was low level like Morphic. If not, I'll have to look into Bloc. I have been using Moose for my data viz needs, and playing with Pharo. I love GT (the Glamorous Toolkit)[1]. Will that be affected by Bloc? Smalltalk, Pharo in my case, is always refreshing and surprising. I have just not learned it enough to build anything complex yet, but that's on me. It's a great environment.

[1] [https://github.com/feenkcom/gtoolkit](https://github.com/feenkcom/gtoolkit)

<comment><USER4> Yes it's a replacement for Morphic, but it also allows for more modern 2D graphics. The new GToolkit alpha is actually built in Bloc.

</comment></comment></comment></comment></comment><comment><USER5> > _I 've looked at this article titled [Design Principles Behind > Smalltalk]([http://www.cs.virginia.edu/~evans/cs655/readings/smalltalk.h...](http://www.cs.virginia.edu/~evans/cs655/readings/smalltalk.html)), > and I can't see anything in Smalltalk that's not available in Java or Kotlin > as well._

There are several things in Smalltalk not available in Java or Kotlin, and more importantly, a lot more not available in an equally convenient and elegant way. Because the main thing behind a language is how features are laid out and play together, not whether a feature is merely available or can be achieved with some workaround.

(And of course, Smalltalk was created 20+ years before Java, so there's that).

In Smalltalk for example everything is an object. In Java you have int and co, and the resulting non-uniform behavior that requires boxing.

In Smalltalk you write code in a live image, and this means you can save state and resume your programming and program from where you left, give it to someone else to run from where you suspended it, and so on.

In Smalltalk the programming environment and the compiler are one, so the language is part of the IDE. You have total visibility of all objects, can edit them, query them based on their types, and so on -- and not just through some "ctags" type indexing.

In Smalltalk you can edit any part of the program, or IDE, and continue working with your changes.

What in Java would be a built-in operator like "if", in Smalltalk is accessible to the program to create, add variations, etc.

</comment><comment><USER6> This depends on what you want to achieve.

If you want to broaden your understanding of programming [0] then learning Smalltalk is worthwhile. A lot of ideas from Smalltalk have bled into the mainstream but it's interesting to see how a live image, integrated system functions.

If you think Smalltalk will be the next mainstream language, and you want to be ahead of the curve, then I wouldn't bother. That's highly unlikely. It's most suited for limited, self-contained and presentation heavy use cases. These still exist but they're not where the industry is or is likely to go. And it's hard to see pure OO coming back into fashion any time soon.

And as to perfection, well, as with all these things, it depends on what your building. It takes an inordinate amount of discipline to write a system that works well at scale. Even worse if you want to run distributed. It's really not suited for that. But if you keep in its sweet spot, it can be very pleasant to develop in.

[0] I'm assuming from your question you've had mostly mainstream language experience. If you're an expert Common Lisp programmer then this probably doesn't apply so much.

</comment><comment><USER7> I downloaded Squeak last year, played with it for a while. It's extremely cool. I felt like I grokked OOP for the first time. (And it's much more OOPy than what is usually called OOP) It was the easiest thing I've ever tried to install and use, everything just worked. Most interesting were the design decisions just _different_ (and better, cooler) to what is universal these days. (And a lot of the things that _are_ familiar and universal these days, originated with Smalltalk!) A lot of stuff you can't do between windows or programs nowadays (the stuff Ted Nelson, Alan Kay etc complain about), is natural and easy in Squeak/Smalltalk. Or how it saves the whole state of the system and everything you had open, where you had it, and you can have many of those.. Too many things to mention, but it's a delight.

[https://en.wikipedia.org/wiki/Squeak](https://en.wikipedia.org/wiki/Squeak)

</comment><comment><USER8> Learning for fun, yes.</comment>


Fixing the IoT isn't going to be easy - <AUTHOR> http://mjg59.dreamwidth.org/45098.html <comment><USER2> This is not a suprise to anyone that has been following the IoT trend for a couple years.</comment>


SOPA vote rescheduled for this week, attempts silent passage - <AUTHOR> http://www.slashgear.com/sopa-vote-rescheduled-for-this-week-attempts-silent-passage-19203217/

<comment><USER2> this has nothign to do with sopa, do not read it

[https://plus.google.com/107304794162956058165/posts/bRpzedGR...](https://plus.google.com/107304794162956058165/posts/bRpzedGRihy)</comment>


Google.com rendered on 14 different Android browsers - <AUTHOR> http://www.flickr.com/photos/brad_frost/7030374923/sizes/o/in/photostream/

<comment><USER2> I'm sure you're wanting to make a point... But all I see is different browser chrome, and some browsers not requesting the mobile page?

Or - likely alternative - am I completely missing the point?

<comment><USER3> Yes all of these request the mobile page. The big problem with html5 development I find is that mobile phone developer have no reason to make browser good enough so that web apps can compete with mobile app. I mean why would they intentionally undercut their own business.

<comment><USER4> The problem with apps is having to download them. HTML5 is way better for applications that have single time use or where you want an interaction as quickly as possible.</comment></comment></comment>


Vienna named world's top city for quality of life - <AUTHOR> http://www.theguardian.com/business/2016/feb/23/vienna-named-worlds-top-city-for-quality-of-life <comment> amar-singh Its a great news. Congratulations.</comment>


The formula that makes a video go viral - <AUTHOR> http://virool.com/blog/index.php/2012/02/viral-video-formula-cracking-down-on-what-makes-the-video-go-viral/

<comment><USER2> Wow, an actual scientific approach. Very cool.</comment>


SMS Marketing Automation - <AUTHOR> https://www.outseed.io/ <comment><AUTHOR> Hey all! Long time lurker of HN here and I thought I'd show off my project. I literally could never have completed this without HN because I've learned so much here. Big shout out to Tailwind CSS and TailwindUI. I don't know how I could have ever made my app not look like a three year old put it together without these two tools! Haha.

Anyways, I've been programming for about 5 or 6 years now. I randomly started with Salesforce.com administration, moved into development and then went crazy learning all kind of other technologies. (It's super painful for me to want to go back to Salesforce.com development.)

Current stack of my app is Rails + Webpacker + Vue on Heroku. Literally the easiest stack I have ever used to develop something new. I wouldn't hesitate to recommend it to anyone for ease of use for a newbie.

Anyways, hope you all like it.

Try it out! Text HACKERNEWS to (208) 856-4213</comment>


Stop Working at that Coffee Shop! Alternative Places to do Work - <AUTHOR> http://martinizer.com/alternative-places-to-get-work-done/ <comment><USER3> > Art galleries are beautiful quiet places to work

Art galleries are beautiful quiet places to enjoy art.

Until people with laptops start occupying it.

<comment><USER4> Maybe you're right, but I've personally always found galleries sterile, and perhaps would be humanized by some normal human activity. Better than the usual gawking parade. That dead artificial vibe tends to overwhelm my appreciation for the art it purports to showcase.

<comment><USER3> As someone who often frequents galleries and enjoys the common experience - <USER2> are just fine with the current normal human activity in there, no need to fix it, thank you.

<comment><USER5> Why does the fact that you like the current situation and he doesn't make you more right than he is?

<comment><USER3> it sounded like he doesn't like them. if I don't like the place and people in it, I just don't go there. I don't try to change it against everybody else who is fine how things work.

on a side note, I really don't think that every piece of public space needs to be occupied by people on computers. I wouldn't like if galleries were the victim of what happened to cafes, where I need to look if there is actually an atmosphere of a cafe, not an office/chatroom with coffee tables instead of desks (sometimes it reaches a ridiculous degree). it's not like I'm offended, it just spoils the mood.

my kind of 'get off my lawn'.

</comment></comment></comment></comment></comment><comment><USER6> I'm currently traveling around SE Asia working on stuff. Just had a very productive week on Don Det, one of the "4000 islands" in Laos. Quiet, beautiful, not much else to do there. Not stressed about money as perfectly acceptable bungalow on the river was less than $5 a day. Annoying place to get to however. General comments on doing this: I like to stay in the one spot for a while as travelling is tiring and distracting, and when you are somewhere new it takes a day or so to suss it out to get into a routine.

<http://backrecord.com/4000islands.jpg>

<comment><USER7> Is Phnom Penh on your itinerary? Then holler.

<comment><USER8> I'm living in Vietnam but will probably visit Cambodia again before too long. Contact info is in my profile if you want to meet for a drink or something.

<comment><USER6> If you're coming to phnom penh, feel free to contact me also (email in my profile). Based here. Great to meet for a drink or something.

</comment></comment></comment></comment><comment><USER9> I stopped doing this many years ago. And this is product of having an office badly designed or, your own home. When I did my home properly I just can't go outside to work. I cannot work better than the confort of my flat. I just go outside to enjoy, not to work.

My recomendations for a proper place to live, work and rest:

1\. Decorate minimally your home. Use the furniture that you will use. Free all the space you can. 2\. Choose a proper selection of colors and combine them well so you can achieve some sense of 'balance'. 3\. It is important lighting: light it up all and well. Have choices like table lamps too for those moments you want dark mood. 4\. User proper bedclothes, some people just use white beddings and the same ones at least for 3 months. Don't do this isn't confortable and nicer. Change it every week and it will help to improve the quality of the space. 5\. Be clean. The more cleaner, the better you enjoy your place.

Following this you will never need to go outside for working. You will go outside just to enjoy a rest and fresh air not to bothering you with work again. Real disconnection.

<comment><USER10> You're telling me that some people don't change their bed sheets for three months!!!!!!

<comment><USER11> Apparently in the UK 1 in 3 people change their bed sheets every 3 months. I can't find the source but I read this somewhere a couple of years back or so...

<comment><USER10> I'm in the UK. I change my sheets every week. I did this even when I didn't live with my girlfriend.

</comment></comment></comment></comment><comment><USER12> The problem is actually about "working alone". When you work alone, the loneliness creeps upon you and takes away the focus from work, and then you're left with the unenviable choice of trying to regain focus (hard) or staring at walls or spiders building cobwebs.

So, ANY place with some people and a decent, undisturbed atmosphere would do. Although, if you already have a coding buddy or someone in the house, then there is no problem working from a house, be it a $2700 mansion in the heart of the prairies or a cramped house in Mumbai.

Just make sure to take regular breaks and go outside to remind yourself that you are alive.

</comment><comment><USER13> As working environments go coffee shops (and indeed most public spaces) are generally pretty dire. They can be noisy with interruptions and the physical set up isn't well suited to work (bad chairs, tables not at a great height, limited space) - in short most of the things programmers will (rightly) complain about in a bad open plan office environment.

It's nice to get out and go somewhere different once in a while but to me unless you're going to spend money on getting a private room somewhere (be in a hotel, a rented house or whatever), they're not places to get anything serious done, they're more about having a break and a change of scenery.

</comment><comment><USER14> Stop annoying people in art galleries or squatting coffee shops, and just get a co-working space. Or just rent a incredibly overpriced office space in airbnb, that will do as well

<comment><USER15> For some people it's the specific vibe from a coffee shop that makes them productive. For a while after Uni I'd be more productive in pubs than anywhere else from spending time working in them during Uni, it took a long while to get out of it.

</comment></comment><comment><USER16> When I was in Thailand I was coding in a wicked high speed internet coffee shop in Samui, on terraces looking out to the beach, on a bed next to a pool by the beach and in bars with live music at the nights.

If you're into what you're working on you can work anywhere, the more dynamic the better.

<comment><USER17> Every time I go to Thailand or Bali, I want to do this, but my wife has instituted a no laptop rule for our vacations :( Honest, I found Tokyo and Osaka to also be quite nice for coding, but I would usually wind up in one cafe or another.

<comment><USER16> Ah man! Buy her a book or something, take her to a day spa! Tell her you're reading an ebook on the laptop.

<comment><USER17> I'm allowed to bring a tablet, but you can't code on that :)

</comment></comment></comment></comment><comment><USER18> The best place to work is an office.

</comment><comment><USER19> Id argue that a consistent place to work (Office and home) is alot less overhead and alot cheaper to get most of your work done. The ergonomics of working on laptops fulltime are also horrible.

When i am out and about i enjoy the places for the reason they should be enjoyed, not because i can get more work done there.

</comment><comment><USER20> The library

<comment><USER21> The libraries around here tend to be packed full of students.

<comment><USER22> Go to public libraries before 3pm. Students will be in school, and college-age students have their university libraries.

</comment></comment></comment><comment><USER23> I find that having a 4G wireless hotspot is the hot setup. If the weather is nice you can be outside while not being tied down to a specific location. Only restriction is coverage & power.

</comment><comment><USER24> I've chased that dream, in libraries and all over Asia. It always falls apart because an external 24" screen is such a big boost in productivity and ergonomics.

</comment><comment><USER25> If you feel like you can no longer work in the comfort of your own home, then you need a vacation. Or a workplace (go Marissa!). :D

</comment><comment><USER26> This is perfect. Always looking for new inspiring places to work!

</comment><comment><USER27> I always assumed those who work at coffee shops are homeless people (living with mom at their 30ties) or idiots.

What is behind working in coffee shops anyway? What's the point, what's the advantage of working in quite room all by yourself?

<comment><USER22> People work in coffee shops to be noticed.

<comment><USER27> What for? Networking in coffee shop?

</comment></comment></comment><comment><USER28> Dude pays a $2700 mansion to work [<https://www.airbnb.com/rooms/668090>], but the others days, can only afford the coffee shop. Something's wrong.

<comment><USER29> I'm not sure how the monthly rate is relevant. It costs over $6,000 to buy a month's worth of days at high-quality hotel chains but no one seems to object when they stay in one in Las Vegas. How does taking a "working vacation" for $109/night (the nightly cost of what you derided) count as being overly extravagant?

</comment></comment><comment><USER30> > The real challenge here is finding somewhere shaded so I'm not blinded by > the glare of my MacBook.

You could have said "Laptop", but said "MacBook" instead. Why?

<comment><USER31> MacBooks are known for their screen glare, because of the glass cover.

<comment><USER30> Ah, that must have been the reason why he mentioned it.</comment></comment></comment>


How Online Networking Happens - <AUTHOR> https://blog.joinentre.com/effective-online-networking-strategies/ <comment><AUTHOR> I've been thinking a lot about how networking works now that things are virtual and probably will be for a while. We put together a blog post and diagram on Entre laying out the flow of How Online Networking Happens.</comment>


Hudson's Secret: Kohsuke - <AUTHOR> http://pelegri.wordpress.com/2010/12/05/hudsons-secret-kohsuke/

<comment><USER2> I worked with Eduardo (the author of the post) at Sun and I can tell you that when he says that Kohsuke is among the top 3-5 engineers that he has worked with, that REALLY says something.

Eduardo was a Distinguished Engineer at Sun and as such, he worked with Sun's top engineers. He was also a senior technical member of the team that created JavaEE.

<comment><USER3> Having met Kohsuke at various Hudson meetups, and worked with the Hudson code somewhat, I can definitely attest to him being the smartest coder I've interacted with.

He's not just a productivity dynamo, but he's just a great coder. This was exemplified when I idly mentioned in the IRC channel "it would be pretty great if there was a way to unit test my plugin." About 10 minutes later, Kohsuke responds with "well, there is. There's a test harness I wrote." The test harness is a thing of beauty, spawning a headless, up-to-date version of Hudson that allows all sorts of querying about its operation. I'd never worked with something quite as amazing.

Kohsuke == Hudson. Hudson without Kohsuke is essentially just an historial artifact. Oracle stands to lose much more from a potential fork than they realize.

EDIT: The man also has the patience of a saint, which cannot be overstated when it comes to support.

</comment></comment><comment> contol-m InfraDNA <http://infradna.com/about> is the company Kohsuke founded to offer professional support for Hudson.

</comment><comment><USER4> On a related note, here's an interesting article about Hudson's development infrastructure and Oracle's attempts to keep the project on java.net:

<http://www.hudson-labs.org/content/whos-driving-thing>

<comment><USER5> HN discussion from earlier this week: <http://news.ycombinator.com/item?id=1954180>

<comment><USER4> Whoops! Must have missed that.

</comment></comment></comment><comment><USER6> Also, Kohsuke's blog is full of little gems and code snippets:

<http://kohsuke.org/> <http://www.java.net/blogs/kohsuke/>

A good example would be Akuma: his embeddable UNIX daemonization library that he wrote for hudson to use:

[http://weblogs.java.net/blog/kohsuke/archive/2009/01/writing...](http://weblogs.java.net/blog/kohsuke/archive/2009/01/writing_a_unix.html)

</comment><comment><USER7> Hudson is great. It's one of the few open source CI servers (that I know of) which can be configured without mucking about with reams of config files.

<comment><USER8> I recently setup Hudson for the first time and was amazed that it just worked!

</comment></comment><comment> brown9-2 Hudson is an amazing tool and Kohsuke deserves all the praise he gets.</comment>


Ask HN: How do large SV companies handle the potential risk of the Intel ME - <AUTHOR> As the Intel Management Engine has the potential to actually compromise any given system, how do large SV companies handle the risk? I think Google and co. wouldn't want to be backdoored by Intel. <comment><USER2> Maybe they don't connect it to the Internet for one thing.</comment>


Report: Microsoft the top-selling tablet maker based on online sales in October - <AUTHOR> http://www.techtimes.com/articles/114316/20151209/microsoft-surface-overtakes-apple-s-ipad-as-top-selling-tablet-online.htm <comment><USER5> I've seen others knock down this report already, but I'm having trouble finding a link. What those other articles noted is that this is US-only, online-only sales (and I believe from people who opted in to provide this data). Apple sells a lot of iPads at their own stores, and certainly outside of the US.

Ahh, here's one of the sites that did a take down of this report:

[https://www.thurrott.com/mobile/ios/62854/so-did-surface- rea...](https://www.thurrott.com/mobile/ios/62854/so-did-surface-really- outsell-ipad-in-october)

<comment><USER6> The knock against this this is that it's a very clickbaity title. If it's true, it's a big deal, but the title made it to be a BIGGER deal by implying it's all sales. Which would be huge, but also absurd.

The idea that Surface is selling well should be taken away even if the article is clickbaity. By all accounts, MS is hitting supply walls with Skylake before they meet demand or cross some sort of arbitrary sales goal they want to maintain [0]. They're sold out everywhere and backordered on the SP4 and SB. I'm glad I pre-ordered!

And the MS devkit? It's.. um.. I mean I know that people will be shocked to hear it but it's not only really damn good these days, but it's open source. Look at how you do Async programming on Windows Phone with C# or JavaScript, and what kinda performance gains you get. Check out the MS GitHub and see how much of themselves they've put out there and opened to the community.

It's a big deal. I'm actually enthusiastic to join their dev community.

[0]: [http://wccftech.com/intel-skylake-core-i5-i7-processors- glob...](http://wccftech.com/intel-skylake-core-i5-i7-processors-global- shortage/) [http://www.pcr-online.biz/news/read/there-will-be-a-major- sh...](http://www.pcr-online.biz/news/read/there-will-be-a-major-shortage-of- skylake-cpus-until-end-of-november/036847) [http://www.winbeta.org/news/rumor- surface-book-surface-pro-4...](http://www.winbeta.org/news/rumor-surface-book- surface-pro-4-shipments-delayed-due-intel-skylake-shortages)

<comment><USER7> We used to just call clickbaity headlines "headlines," and the entire point of them is to be concise and get you to read the whole article.

<comment><USER8> I think we called them 'titles' or 'misleading titles'. Magazines with the article titles on the front would do this and I think it was distinctly different from say, a newspaper where the article started right below the headline. The magazine is actually hoping you don't see any of the article before you've bought the magazine (and possibly seen ads.)

</comment></comment></comment></comment><comment><USER9> I'm happy about this and hope there is some truth to this. It would signal to developers that maybe there is a viable third platform for apps.

As a user I've long been a tablet fan, I own several iPads and Surface tablets that are still actively used in our family. Until recently I used a Surface Pro 1 for work, I'm now getting a shiny new and fully loaded Surface Pro 4.

Using a Surface tablet as a PC (with monitor and keyboard and mouse attached) works very well, as many people have found. But Surface never really competed with iPad as a tablet, purely using touch. I know nobody who uses and likes Metro IE, Windows Mail, reads the newspaper using an app or plays games on it.

Except me: I've always felt that the only thing lacking on the Surface to compete as a tablet is good Apps and users willing to invest time learning to use it. People would find it actually is quite nice. Even the doomed Surface RT2 is superior to an iPad for many tasks, once you "get" Metro IE, the keyboard and multitasking gestures. I regularly write comments here on HN using Surface in tablet mode, which is much less fun when I try it on an iPad.

When Surface really succeeds in the market, my hope is that the App platform will finally start working. As a developer, the technology and tools feel vastly superior and more productive that those of Android and iOS so I'd be happy to start developing Windows-first again.

<comment><USER10> You're going to love your Surface 4. My Surface Pro 2 is overtaking my iPad for exactly the tasks you list: email, browsing, reading news (Flipboard) and playing games.

I love that the same machine I use for dev can become my casual tablet in a moment.

<comment><USER11> I really want to use my Surface for development, but I can't get it to work. Most of the work I do is command-line driven (Ruby, Elixir, Node) and I am so used to Vim that the experience is just awful on Windows. I've installed Cmder which helps a ton, but things are still wonky.

And that makes me quite sad.

<comment><USER10> What's wonky about it? I installed vim through Chocolatey, but I rarely do more than a few quick edits then :wq my way out of there. Most of my work is done in Atom these days.

</comment></comment></comment></comment><comment><USER12> Aligns with my experience, Surface 3 Pro replaced my MacBook Pro and iPad air last year and this year I've added a Sony Z3 compact 8" android tablet - <USER2> is not an "inexpensive android" device, but it is waterproof, ridiculously light and waterproof. Love it, no interest in going back. Not sure what I am going to do with iPhone 5S... Easy to leave Apple at this point, especially with the mess they made of iTunes.

<comment><USER13> What is the Surface 3 Pro lacking that you still have a z3 ? (waterproof ?)

<comment><USER12> I've been using many different tablets since they came out (iOS, Android, BB, Windows). I found that a large tablet is critical for productivity and I agree that 10" is the minimum, but it is also too small for me. I also found that thin 8" tablet is perfect for ereading, whether magazines, novels, Web browsing, videos. However with the very high resolution display, it is also handy for light productivity, I can use it to ssh or tunnel xwindow into my debian boxes, review Office documents, and learn Spanish with duo lingo. Ever fall asleep and drop a Surface on your face?

Microsoft has all but abandoned the smaller than 10 inch tablet (no longer in the Microsoft stores) and I could find any high end windows tablets in that category. Of the metro/universal apps, the ones I need are not available and over the last few years many aren't being updated, lack features and are now disappearing from the Windows app and store. And with windows/Android, I can easily copy files between the devices and they both support Miracast (eg. Microsoft wireless display adapter).

Long answer, hopefully useful.

</comment></comment></comment><comment><USER14> Though I wouldn't have guessed it earlier this year, this seems like a bygone conclusion. Last night I tried out the iPad Pro for the first time while killing time at an Apple Store...I liked it, though I've had an iPad since it first came out so there's much less of that revelatory experience with each iteration. The store had the iPad Pros set up with the keyboard cases and I've never used my iPads with a keyboard so I was delightfully surprised that my favorite OS X shortcut -- Cmd-Tab -- worked for application switching. Unfortunately, none of the other shortcuts I'm used to worked, such as Cmd-T to open a new tab in the browser, and so forth.

In a way, the iPad Pro felt like tablet's version of the uncanny valley...close to "real" computing but not annoyingly not quite enough...unless major overhauls are made to iOS, and every application built on it thus far, I couldn't imagine using the iPad for anything more than media consumption. And when I think about it, I hardly ever use the iPad for any app that is iPad-only -- I use it mostly for web browsing, reading, and Netflix- watching -- things I can switch effortlessly to on my Macbook.

I had thought the Surface was doomed to fail, in trying to serve both as a tablet and as a regular computer and screwing up both...but in retrospect, it seems like the intuitive strategy. Most tablet functionality is purely a subset of what a regular laptop can do...and attempts to port OSX apps to iOS have rarely resulted in something that was better as a native tablet app. Adding to this, the majority of the computing world is already entrenched in Windows applications...even as someone who has been almost exclusively OS X for the last 10 years, my next tablet purchase will probably be a Surface...doing productive work on Excel and Windows-versions of Sublime Text is better than attempting it on iOS by far.

edit: And maybe familiarity breeds contempt -- and/or I'm entering in my tech- curmudgeon phase...but besides the initial iterations on multi-touch -- two fingers to scroll, pinching, stretching, rotation -- I've been less than inspired by iOS's innovations in touch gestures. In fact, I find myself frequently fighting against accidental actions, such as how dragging my fingers a little lazily to the left while reading a webpage triggers the browser's Back action. And how I'm frequently accidentally activating my Slack app (because it's the only one I have that has multitasking?) when my fingers do something on the right side of the browser. I feel we've reached the limits of what we can intuitively express via finger-motion gestures and if Surface's tablet functionality had far fewer of them...that would actually be a net positive for me.

<comment><USER15> I had the Surface 2 & 3 as primary mobile computer devices. The 2 I used a year, the 3 less than a month due to a problem which may or may not have been a defect. There should be some historical posts on hn where I was wrote that I was shocked how great the 2 was. Now I'm 100% iPhone - iPad Pro - <USER3> Macbook. Anything that requires heavy processor power is done through remote servers.

From a security and privacy standpoint I feel a little bit better with Apple than Google/Android. Microsoft I don't know enough about at this current point in time to make a judgement call on.

With an iOS or Android device you can remote in to a Windows, Linux, or OSX desktop. Every year things have become visibly better and easier to use. Much of the biggest stuff is cross platform. If you use Adobe Creative Cloud you can jump from Windows to OS X with no license switching issues. Many other companies have followed.

Years back I attempted to go ultra mobile with a Fujitsu U810 (convertible where the whole computer was about the size of your hand.) Watching the transitions since then, today things feel very mature. Back then if I tried using that thing I could work at about 1/20th speed. Now I'm desktop speed (my last desktop had 3x 27" screens.) The high DPI mobile screens help a _massive_ amount.

You have to tweak your workflows and find the right apps. Sometimes small things can be a big problem, such as a keyboard shortcut not working right when you are remoted in through a tablet.

Te device matters less and less. It is now much more about weight, battery life, heat output, and stability (not crashing when you pick it up weird, which the Surface did to me often.)

</comment></comment><comment><USER16> This is bonkers.

* A lot of people already have an iPad. No need for something new.

* The new iPad pro was just announced and not available yet. Less people willing to buy old stuff.

* The Surface had just been updated and is still building on the success of previous models.

This comparison is Steve Jobs-level of data creativity.

<comment><USER17> All of that is irrelevant. As far as I can tell (and it seems the same for others) there is nothing saying that this data includes Apple's 1st party sales to consumers.

That's like saying Walgreens products are bombing in the market because no one is selling them (and your data doesn't include Walgreens stores).

<comment><USER16> Yeah, even worse.

</comment></comment></comment><comment><USER18> I bought my wife a Surface Pro 3 last year. We debated very hard over the SP vs. a macbook. She does a lot of work with MS Office - so it seemed like a good choice.

The bluetooth and wifi are now non functional (looks like a hardware issue), and Microsoft wants $400 to replace the unit (it went out of warranty in June).

Perhaps I have no reason to complain (it is out of warranty) - but I expect high end hardware to last longer.

This will be the last Microsoft product I purchase.

<comment><USER12> I've had my own share of interesting S3 Pro issues expecially with Windows 10, but almost all of them have been software / firmware related. You tried restoring to Windows 8.1 and same problems?

<comment><USER18> Yep - the suggestion from Microsoft was to downgrade to 8.1 - but that did not help.

</comment></comment></comment><comment><USER19> Since people complained about the article title, we changed it to more neutral language from the body of the article.

</comment><comment><USER20> This is sad for me, not exactly by the Microsoft "win", but by the Apple "loss". Yes, you can call me a devotee if you like.

What I feel is that the only company which cares (cared?) for design (bear in mind: _true_ design, not decoration) and end-user experience has lost their edge. It's sad for me, on one hand because I'd rather see more - not less - companies being design oriented. On the other hand, pragmatically, it's also worrying because I don't know which laptop/smartphone I should buy when my current ones "expire".

I like/liked Apple because they had a fundamental vision; their devices didn't seem to be full of gimmickry or spec/feature-oriented. Now they are releasing phablets, hybrids, battery extending cases and operating systems full of new features.

So, the mobile computing dark ages begin? Jobs said the same regarding desktop computing in 1996. I think the web was obviously overlooked in his remark, but he was quite accurate regarding the desktop per se.

</comment><comment><USER21> Microsoft just got called out by Steve Ballmer, of all people, for using "run rate" instead of real sales numbers.

I'd personally be taking any claims like this with a grain of salt.

</comment><comment><USER22> I don't understand the whole "I want to use my tablet as a laptop" craze and vice versa.

I use my Macbook Pro for laptop stuff, and my iPad Pro for reading books and PDFs and drawing diagrams etc. Why would I want to merge both devices into one?

<comment><USER20> I wouldn't want such thing. I like focused products. But the geek opinion- makers in the web like buzzwords such as "convergence" and "hybrids". It seems relevant, because opinion-makers talk about it, but - at least to me - <USER4> relevance to real-world users still has to be proven.

</comment></comment><comment><USER13> Interesting first comment:

>

1010data is a cloud services data insight company. Yahoo Finance, The International Business Times, and Forbes are all reporting their numbers. It's based on looking at online sales from the top 100 online retailers and extrapolating sales from that data.

1010data is not fly by night. They've been around since 2000 and most of their stuff is designed to provide insight to retailers when it comes to what they need to sell. This is an internal industry report, not something generally released to the public. WinBeta got their hands on it, but it's not a shocker. The iPad has not been doing well. While the entire tablet segment has been stagnant, the iPad has been hardest hit. The growth segment in the market has been in higher cost productivity designs that can do more.

This kind of market data has been around for over a year. It tells you why we're seeing all these "me too" Surface products. It's not just Surface, it's 2-in-1s that are attracting people. Why did Apple make an iPad Pro? Because this is where tablets are going. Few need a consumption only tablet when they can have a device that works for that AND also can get work done.

Either IDC or Gartner is showing that Microsoft is closing in on 20% of tablet share and is expected to pass the iPad in the next few years. This is not just Surface but the Windows tablets. They are the largest growth segment in tablets. Microsoft has gone from 0% to over 10% in only about 2 years.

So for those that wonder about UWP and apps for phones - they are coming because of these 2-in-1s. This is why Satya Nadella has asked for some patience. This 1010data info is for retail industry and it is how many (like Best Buy) will determine what to stock, what to push, etc.

In other words, the Microsoft Surface is the IT tablet for right now. Microsoft has managed to create a major brand that is looked at as a quality one while also using it as a halo brand that can filter down to other OEMs.

Do not be surprised if we find out by this time next year that Windows tablets overall have surpassed the iPad. And as the Surface surges and UWP becomes more viable, the opportunity of have a Surface convergence device that can be a phone emerges as an interesting concept to reboot the idea of what Windows is on mobile.

Everyone is so focused on right now where Android seems insurmountable and Apple is strong. Both will continue to be viable for a long time, but Microsoft is putting together an alternative narrative that allows consumption and production on single devices and on a single OS. We're only at the beginning of the UWP salvo.

The report is solid, but limited. Brick and mortar retailers aren't counted here - and that includes Apple Stores. Of course, physical Microsoft Stores are not counted either, but they are a much smaller group.

Did overall Surface sales trump the iPad? Likely not. But there's a reason why Apple was compelled to make the iPad Pro. The Surface is a REAL danger to them. For them to mock it and then backtrack when it has succeeded tells you all you need to know.

And the Surface is becoming the key to UWP. If it remains a hot item, it remains an attractive target for developers.</comment>


Recession Tales - The Workplace Is Changing Forever - <AUTHOR> http://www.walletpop.com/blog/2009/11/04/recession-tales-the-workplace-is-changing-forever/

<comment><USER2> Gloom and doomers keep glooming and dooming because they can't see outside of their valuing system.

Change is the only constant in the Universe. Anytime something no longer changes into the same thing, people freak out because the majority of human understanding has been erected around the idea that the Universe is a _static_ container in which material agents interact (which is false). Therefore, people are afraid of change, otherwise known as: the un-known.

 _"When the 15 million unemployed Americans do find jobs again, they'll return to a workplace that is likely to have grown accustomed to less pay for more work, or at least working less hours in a week. The raises that were once part of an annual employee review, if not entirely gone, will take years to get back to where they were before the recession."_

This statement is silly and comes from a person that stands in a static place, not a dynamic place; a place of lack rather than abundance. They haven't allowed themselves to grow outside of their own valuing system and are therefore stuck inside the old one continuing to observe and judge events from within that system.

The alternate point of view, could be, that the workplace has changed for the better and more Americans now value their personal time more than they had before. As more jobs are created in the coming years, the employed will have a greater sense of self-respect (something the author was not giving the American workforce) that companies will be obliged to heed. Or, more Americans now see the glass ceiling of working _for_ someone other than themselves and realize they could very well start their own business, or provide their services as a contractor/consultant...

Static thought is perishable because the system it is apart of evolves too quickly for any-thing to not keep up. Dynamic thought allows growth and evolution on the micro-personal level and the macro-social level; this evolution is what creates recessions and booms.

The expansion of something is often seen as contraction because as "things" fill up the bubble it appears to be a "boom", and once the bubble is popped because it has reached capacity, it _expands_ and all the contents of that bubble spill into the next larger bubble with more dispersion appearing to be a "recession".

</comment><comment><AUTHOR> Interesting article, but "forever" is silly as we all know that the economy and issues related are cyclical and never go in one direction forever.

Look at this piece: "When the 15 million unemployed Americans do find jobs again, they'll return to a workplace that is likely to have grown accustomed to less pay for more work, or at least working less hours in a week. The raises that were once part of an annual employee review, if not entirely gone, will take years to get back to where they were before the recession."

Does the author really think so? When the economy rebounds and is bustling again and employers are back to competing to hire talent, is this really going to be a problem? Nope. In fact, in our current "crappy" economy, that is still happening. Microsoft is trying to recruit people from Apple Stores, for their own stores, and luring them with higher wages.

Just a thought. I will admit though that through these cycles, some things do change in a direction that seems to go on much longer than cycle itself.

</comment><comment><USER3> I have a better title for this; one that doesn't require you read the article at all: "The Workplace is Always Changing Forever"</comment>