Ask HN: Can you give me some advice on writing essays? - <AUTHOR> I am trying to learn to write some interesting essays/blog post, and I need some advice, because I'm completely stuck.
I have had trouble coming up with things to talk about my whole life. I read a lot, and I feel like I know a lot of things, but when I sit down to write my mind goes completely blank, I have nothing to say, or rather I feel like there's nothing worth writing about.
I don't have anything to say to people who know less than me, because explaining obvious things seems boring, and I don't know what to say to people on HN/LessWrong, because I feel like they are smarter than me and already know everything I am about to say.
For example when I read Eliezer Yudkowsky's essays, I think that I already know a lot of the things he is talking about, so before I've read them I had this information in my head, information that could be turned into some interesting writing. I was supposed to be able to write at least something similar, but clearly I didn't. I assume I have some interesting information in my mind, it can't be completely empty, but when I try to come up with topics for essays I hit this weird roadblock, and end up with nothing.
Recently I'm making some progress at writing fiction, but with essays I'm completely stuck, I've got nothing. It's like I'm missing some key element necessary to just start writing things.
Can you help me out? Do you have any advice that could help me to get started? <comment><USER2> The time to think of topics is not when you sit down to write--it's when you're busy interacting with the world.

There, you're going to have insights. You're going to encounter itches you need to scratch. You're going to find questions that pop up--why you're feeling out of sync with something, why you're annoyed by something.

With luck, you're going to create things that no one else has created. And even if someone else has created it, something led you to create it in the way you did.

All of these observations of self can be noted when they occur, and they can form the premise for an essay. Use a sticky, or carry a Field Notes notebook. Stop and capture them.

Maybe 95% of them will be garbage. File them away--maybe journal them. See if they come up again. If they do, then you're onto something.

The other 5% may write themselves.

For me, essays are about connecting ideas from disparate domains.

Short version: if you have nothing to say when you sit down at the keyboard, then get up from the keyboard and interact with the world around you, and observe. You'll be cured in no time.

<comment><USER3> I agree completely with firebones. Getting a pocket-sized Moleskine notebook last year and jotting down observations that arise when I interact with the world has been most helpful. One surprising point is that looking back on my notebook, many ideas I would've forgotten about completely if they hadn't been written down. I'm not saying these are $1M ideas, but it's nice to have a record of what you were thinking 6 months ago.

To borrow pg's analogy that we are the executable whose source code we've lost, by writing down our thoughts (even in point-form) we may at least hope to generate output logs of versions of ourselves compiled at different times.

</comment></comment><comment><USER4> Speaking as someone who has written many well-received essays on LessWrong, I feel like you're approaching the problem from the wrong angle. IMO writing a good essay shouldn't be a goal, it has to be a side effect of doing interesting intellectual work.

For example, there's someone on LW who wrote a chatbot that successfully hypnotizes people over IRC. Would you read an essay about that? You bet you would! There's also someone who sold drugs for bitcoin, and someone who doxxed drug lords, and someone who won AI-box experiments, and someone who independently invented cryptocurrency... My own most successful essays on LW came as as a side effect of my work on decision theory math, which had other nice effects as well (like being invited to speak at conferences). Even Eliezer's essays were a side effect of his attempts to figure out friendly AI, rather than "hmm I want to write something interesting today".

So, instead of mulling over which obvious thing you'd like to write about, try to do some novel work that interests you on its own terms! When you try to describe it afterward, I promise you the words will come much easier.

<comment><USER5> I'd put a slightly different twist on that. The key is _having something to say_. Maybe even having something that you _have_ to say. If you don't have that, don't bother trying to write (unless it's a job requirement, or it's just for practice).

<comment><USER4> Yeah, that's certainly how the rest of the world puts it. Unfortunately it's not very actionable. "The key is to have something to say!" "Hmm, but what if I don't have anything to say right now?" And they're stuck again. It's kinda like "be attractive, don't be unattractive". Whereas my answer is "do interesting intellectual work, get results, write them up". A little more actionable, no?

<comment><USER5> I'd say that my action is this: If you don't have something to say, don't say it. If you don't have something to say right now, don't view yourself as being stuck. You don't _have_ to have something to say right now (or ever, for that matter). Don't waste your time trying to have something to say. When you do, you'll know. In the meantime, go do something else, rather than trying to "find" something to say.

Your advice is on how to find something to say, and it's fine (though it's not the only way to get there). My advice is how to think/feel about your situation when you don't have something to say.

I said that your advice isn't the only way to find something to say, because the something to say doesn't have to be something intellectual. Go do some interesting intellectual work - that's fine. But also, go fall in love. Go start playing sports. Go on vacation. Go take up a hobby. In any of those, you can find something to say, not because you're desperately trying to find something to say, but because you're out living life instead of racking your brain looking for something to say.

</comment></comment></comment></comment><comment><USER6> This sounds less like a problem with writing essays and more with a fear of being judged - I know, because I have the same problem.

"I don't have anything to say to people who know less than me, because explaining obvious things seems boring [...] I feel like they are smarter than me and already know everything I am about to say"

I've suffered from this for years. 'That idea sounds stupid - it's far too simple', or 'if I write this / make this my peers will judge me'. When the reality, the people you look up to probably aren't looking at you, and there are far, far more people who, despite you thinking something is obvious, will find value in your work.

Reading HN (and similar) we're exposed to some incredible people - those at the top of their game. Because you or I am not that person doesn't mean that what we write doesn't have value to someone.

My friend has recently published his third novel. It's quite good. He started writing when we lived together at university 15 years. I used to read his short stories back then. It took him 13 years to publish his first book. But he wrote voraciously in the meantime. Most of us don't start great - it comes with practice.

Basically what I'm saying, is pick a topic - even one you consider too simple - and get started. Write 300 words. Then do the same tomorrow. Then the next day. Your writing will improve, you'll read more, research more, learn more - and new ideas will come to the point where you'll have more ideas than time. Like the writing itself, it comes with practice. And those 'obvious' topics you start with - they'll undoubtedly benefit someone in the long run.

</comment><comment><USER7> > It's like I'm missing some key element necessary to just start writing > things.

You're probably missing the value proposition of your writing in general (what is your set of essays giving to the people who read it), and the thesis of each post in particular.

For the VP I use: "My essays all about helping _________ learn/be/do/become ___________."

Once you've got that value prop, you can get specific ideas by thinking about the type of person you're serving (the first blank) and thinking about the sort of questions that person asks you over a beer when you're hanging out with them.

Or you can use trigger questions like:

* Mistakes you've made or seen in this industry * Most common bad advice in this industry

Etc etc. I made a little interactive version of this process at [http://whattowrite.org](http://whattowrite.org) (it's a free and unsupported old hobby project, but it works all right).

Good luck. In the early days, essays/blogging are more about refining what you think, so don't worry too much about whether or not people read it. Write for you first (but with a reader in mind so you don't wander all over the place).

</comment><comment><USER8> Some advice, in no particular order:

1\. Writing is a conversation. If you're ever stuck in front of the computer, try using a voice recorder instead (e.g. while going for a walk, or while sitting in the sun somewhere) and then transcribe what you said. I find it has magical effects of simplifying sentences and keeping writing interesting.

2\. Write with a goal and a reader in mind. Do you want to inform/describe something or convince/sell something? Who are you writing to? When in doubt, write to inform, try to summarize and distill the essence of the topic.

3\. Do not pervert the English language, e.g. if you say "utilize" instead of "use", I hate you. More on that front: [https://www.mtholyoke.edu/acad/intrel/orwell46.htm](https://www.mtholyoke.edu/acad/intrel/orwell46.htm)

4\. Keep it short: in each sentence you're either getting to a point or setting up some context that will allow you to make a point soon.

</comment><comment><USER9> When I am stuck on writing essays for a deadline I start by reading one or two new articles on the particular topic I want to write about. Then I take relativly detailed notes on the best article I read. I then spin those notes out into exposition of the topic considered.

At that point there will be bits of the topic that I don't think any of the articles captured completly or parts where I agree with one and not others. An original point of view comes out of the synthesis.

If I am struggling at the stage where I spin the notes out into exposition I follow a relativly simple framework that forces me to keep writing. I learned it for exams but I think it is pretty versatile and adds clarty where otherwise you would be waffeling: DICE

>>Define: Define the view / theory / idea / term under consideration. Sometimes this will be pretty involved and amount to the meat of your exposition. If it is getting too long though then you should break the concept up and DICE individual parts as well as the bigger picture.

>>Ilustrate: Give an example of the thing under consideration in non abstract terms.

>>Contrast: Define the contrasting ways of understanding or a competing theory or an example of something that isn't covered by the theory.

>>Explain: Explain what motivates the theory you are considering and why it is different from alternatives.

After doing that for all the parts involved in the topic I usually have some areas that the original articles I considered didn't touch on. Then I get into evaluating.

People imagine that originality is blue sky thinking. Occasionally it is. But usually it is adding clarity or going further than someone already has on a particular topic or presenting old ideas in a new light. Often times a good reading of existing views adds light where a radical new approach just adds heat.

</comment><comment><USER10> When I have a hard time writing, be it blog entries or fiction, I have found I have one of two problems.

#1 I don't know enough about the content. I love when I have this problem because it means I get to have unique (to me) experiences that will help me flesh out my idea. I also realize that I'm not in a position to write anything, which relieves some pressure.

Unfortunately, "not enough experience" is not one of my common hangups. Which leads me to....

#2 I have a mechanical problem. Uh, I hate these, because they come in all forms. It could be that I'm writing in a style that I'm not used to. Or that I'm trying to write about a topic in a blog post that is meant for a book. Or my first draft is a dumpster fire. Or I can't get through a first draft because I'm worried about said dumpster fire. Or my idea isn't organized. Or coherent. Or maybe I'm a terrible writer and should give up.

And on and on and on goes the spinning top if self loathing.

To combat it, I do a few things. First I make sure the idea and the medium align. You wouldn't want to write a blog post about the geo political tensions the Syrian refugee crisis has caused much like you wouldn't want to write a book about your mom's famous beef stroganoff recipe.

Once you feel they align, tell yourself you're not a genius. Really, do it. What you're about to write will be derivative and boring. It's going to be the steamy turd you wish you never wrote.

Then polish the turd. Revise your writing the best you can. And finally have someone (with some sort of credentials) critique it. Or if you're feeling daring, set it off in the wild. After you do all that, put that piece out of your head and start something else.

This advice, in and of itself, isn't novel. Hell, someone on this thread's handle is FailMore. But that's all it is. Reps, fucking up and learning from it.

And remember you're not the smartest guy in the room. So don't pretend to be. But you can be interesting to some people, so work on that.

</comment><comment><USER11> My favorite quote on writing comes from James Ervin's AMA[0]:

>And if you're going to write, write what you want to write. The odds against any creator are insane. If you're going to devote months of your time, don't let it be for an idea you think will sell. Odds are it won't. Write something you want to write, or need to write. Write for yourself before anyone else. I'd rather read someone who is excited and passionate about what they want to say than someone who's obviously trying to say what they think I want to hear.

— James Erwin

I had the same issues with my writing recently (why should I even write anything when there are far better people writing about these things). It boiled down the following for me [1]:

1\. Self Learning (Writing about it makes you understand it betteer)

2\. Sharing knowledge (I want the knowledge to spread)

3\. Network Effect (People I know are far more likely to read my post as they trust me)

4\. I love writing

Coming up with topics is harder. I tend to read a lot, and whenever I read something I already knew, I put it in my "to-write-list". Essentially, the idea is to write things that you'd like to read yourself, but can't find anywhere. Another good idea is to take "auxiliary" topics instead of a core topic. This means finding things that are interesting enough only when taken together. For instance, don't write about Machine Learning, write about doing Machine Learning with a specific toolkit or language.

Specific topics are always better than vague ones, in my experience.

[0]: [https://www.reddit.com/r/IAmA/comments/2w72o7/so_i_sold_a_re...](https://www.reddit.com/r/IAmA/comments/2w72o7/so_i_sold_a_reddit_reply_to_warner_brothers_a_few/coo5gys)

[1]: [https://captnemo.in/blog/2015/06/07/on- writing/](https://captnemo.in/blog/2015/06/07/on-writing/)

</comment><comment><USER12> Take a look at the Pyramid Principle [pdf] [http://www.consultingmethodology.com/wp- content/uploads/2014...](http://www.consultingmethodology.com/wp- content/uploads/2014/03/Pyramid-principle_consulting-methodology.pdf), developed by Barbara Minto from Mckinsey Consulting. It provides a framework for structuring your thoughts and helping you identify the most important points for your essay, blog post, presentation. The journalism pyramid does similar but to my mind has less of a methodology.

</comment><comment><USER13> Why do you want to write? Do you _really_ want to write? To me it seems strange to want to write about something, anything, but not knowing _what_ to write about. I have the opposite problem: too many things to write about and too little time to write about them. I don't want to write about them for the sake of writing something, but because I find the topic interesting. It's like the kid who is exploring a forest and found a cave, and is excited about the cave and wants to share that excitement.

So I think the first thing you need to evaluate is whether you really want to write and why. If the answer is you want to seem sophisticated and earn the intellectual respect of being a writer then I can't give you any advice except that maybe you should reconsider the decision to write. Write about topics that interest you. Where does your mind wander when you are in the shower? That's what you should write about. In most cases this is not a topic that you've already fully understood. Those topics aren't interesting any more because you already know the answers. Interesting topics are those for which you need to do additional thinking and additional research. Write about what you are learning _now_.

</comment><comment><USER14> Other people's heads contain different information that yours!

There are smarter people out there but they might not have your insights into the challenges and rewards of hydroponic banana farming.

Two days ago you might not have known how to perform a particular task, and searching the internet was fruitless. You might not be the first person to have to work out how to do that from first principles -- but you can make sure you might be the last!

Come up with an outline: maybe it's a rant like me talking about Excel ( [https://blog.scraperwiki.com/2015/07/eusprig/](https://blog.scraperwiki.com/2015/07/eusprig/) ) -- ugh, this sucks because A, and then people do B to get around C, and can't even start to do D, E or F because they're stuck in this way of doing things. Use that to structure what you're writing, flesh out those bare bones.

</comment><comment><USER15> The first idea, the first sentences are always the hardest. To get my fingers typing, I would talk to myself "What do I want to say?" I would type this sentence. Then I would answer myself out loud. "I want to talk about the dangers of unapproved GMO foods escaping outside controlled grow areas and into consumer farms." Then I type what I just said out loud. If I don't know what I want to say, I answer myself "I don't know. This GMO topic interests me because of the really interesting science behind the creation of these hybrid plant lines. But I don't trust the human bureaucratic framework around the scientists. I feel this way blah blah blah".

Verbal style obviously isn't written style. I edit things after I have a lot more words on the page. But that out-loud Q&A gets my juices typing.

</comment><comment><USER16> I have at times made my living writing and developing presentations for audiences ranging from executives of major tech vendors to CIOs and their teams at fortune 500 companies. My twenty-something daughter has just completed a BA in Scientific and Technical Communication and has simultaneously finished writing a suspense/horror novel. Both of us refer to early drafts of our writing with the same phrase, "word vomit."

It is a gross and yet liberating label to what we do. By just getting the ideas out there in a very loose, non-judgmental manner you get past your own inner censor.

You can always decide later whether it is worth the effort of the second and third draft to get it publication ready, but at least the ideas are out of your head and you've made a start.

I hope this little phrase helps you get past your inner judge.

</comment><comment><USER17> I don't know exactly what you want to do, but creativity plays and large role.Many years ago when I was younger I wanted to write screenplays for Hollywood, used this book as a way to explore my creativity. Also reading as much as you call and watching classic movies would help as well. The book is called the Artists Way.

[http://www.amazon.com/gp/product/1585421464/ref=as_li_tl?ie=...](http://www.amazon.com/gp/product/1585421464/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=1585421464&linkCode=as2&tag=stratoptio09-20&linkId=4BKOSWQXFLUCTEZ7)

</comment><comment><USER18> Hey Rayalez,

Some friends and I run a project which could be relevant. It is called Taaalk ([http://taaalk.co](http://taaalk.co)) and is an online platform for conversations. So if you don't know what to write but have a friend that would happily discuss a subject with you, or know someone you'd like to learn something from by asking them questions then it works well.

We've found that people discover they know a lot of valuable information which they didn't consider valuable until someone started asking them about it. Sounds like this could apply to you. Drop me a line at josh[at]taaalk.co if you want to get involved.

</comment><comment><USER19> I have a blog; a very unpopular blog that is probably read by two or three people. I write essays and "blog posts" on there.

I also majored in literature and philosophy and had to write essays a lot. I got a lot of As.

The first thing to learn is that every group of writers follows different rules.

Think about why you want to publish your writings. Learn that context matters -- that is, your target audience matters. People reading my blog posts don't want the same thing as the people reading my essays at university. My university essays have a different tone and style. To be sure, the essays on my blog are the least popular, because they are very academic. That's okay. I like to write that way sometimes.

Often the things that others find interesting in our writings are things the writer would have never guessed. Because of this, it's all right to swallow your pride and just hit "Publish." Some of it will be horrible, some of it will be great. And there is always the stuff in between.

From a strictly academic perspective, the easiest type of essay to write is a comparative essay. Compare books, ideas, or topics that are similar enough to warrant a comparison; e.g., sexual parallels in Fifty Shades of Grey and Marquis de Sade's literary oeuvre, if you're going for a wide appeal. I just made that up. It's all experimentation.

Another academic "lesson" is when you're stuck writing an essay, it's time to bring in another example.

These are standard techniques that possibly engender a style that is stale and stiff. The more you cater to your reader, the more entertaining it'll be, because you'll speak her or his vernacular.

Having said all that, I have only published my poetry in very small publications. Nobody is interested in my short stories or essays (outside of academia), and I am by no stretch of the imagination a blogger who others read assiduously.

I am read by a very small circle of writer friends.

We have a joke.

We're good at things that don't have much value in modern culture.

It's a big joke.

And we're the punch line.

</comment><comment><USER20> The best essays start with a story or metaphor. Finding these stories and connecting them to your topic can be hard. I wrote a book that shows you how to do this. You can get it for free at Leanpub - it's called Hooked On You ([http://www.leanpub.com/hookedonyou](http://www.leanpub.com/hookedonyou)). It comes with a few stories you can use to get you started. Hope it helps.

</comment><comment><USER21> This is pretty good from the ex-maintainer of Planner mode, Emacswiki mode and Remember mode:

[https://gumroad.com/l/no-excuses-blogging](https://gumroad.com/l/no-excuses- blogging)

</comment><comment><USER22> You can start by summarizing somebody's ideas (like Yudkowsky's), then compared them to other authors you know. You can focus on one aspect and add your own thoughts.

</comment><comment><USER23> i think if you have trouble coming up with things to write about, your problem is not on the writing portion. i don't know how other people do it but for me, im constantly thinking and questioning things everyday (obviously the best times is outside of work but even work springs ideas into my head). even as you read books and other interesting content, you should be consistently thinking and not sucking it in. hopefully that helps.

</comment><comment><USER24> Figure out what really makes you excited and reach out to people doing those things. You'd be amazed as to who will respond to an unsolicited e-mail.

</comment><comment><USER25> pg wrote an essay on what an essay is and how you can write one. [1]

The most important take away from it was to not to write an essay to defend a position, but to write one so you can express your idea that leads to something interesting which is unknown to your audience, so you can share it!

[1] [http://www.paulgraham.com/essay.html](http://www.paulgraham.com/essay.html)

</comment><comment><USER26> Tell a good story, if you and some people where sitting around a campfire what would you say?

</comment><comment><USER27> I'm afraid I don't really write enough to comment on how you should get started. Or rather how you should get finished. The idea of noting down ideas, snippets in a book (or digitally) _is_ good. I have a couple of rats nests of small items, and todos, ideas -- 2/3s in various ColorNote[c]s on my Android -- the rest in text files in a mercurial repo).

If the idea you note down is any good today, it'll be a good idea tomorrow too. And a year from now.

If you have enough good starting points, actually spending some time writing out an essay from them becomes easier. Remember you'll probably want to do at least three re-writes if you're hoping the result is going to be any good. Lots of people don't do that -- and it shows. _Most_ half-decent blog posts would've been a lot better if the authors took the time to rework them a bit more. Or, according to Hemmingway: ""The first draft of anything is shit."

So with the caveat that I don't actually write much (yet?), the best book I've read on writing is: William Zinsser's "On Writing Well": [http://www.amazon.com/Writing-Well-30th-Anniversary- Edition/...](http://www.amazon.com/Writing-Well-30th-Anniversary- Edition/dp/0060891548)

Highly recommended for anyone that have to communicate in writing (ie: everyone).

> I don't have anything to say to people who know less than me, because > explaining obvious things seems boring, and I don't know what to say to > people on HN/LessWrong, because I feel like they are smarter than me and > already know everything I am about to say.

For essays, it can be good to write for yourself. To yourself, or someone much like yourself, but someone who's perhaps not yet encountered one particular idea, one particular technique -- one particular subject.

That usually gives a good framework for avoid "talking down". Write to yourself of one, two or five years ago. There will be many that don't have that last year, years of experience and circumstance that led you down the path to were you are now. Perhaps such a perspective makes it easier for you to share something?

[c] [http://www.colornote.com/download.html](http://www.colornote.com/download.html)

I mostly use Colornote to keep track of _ideas_ , such as app/application/project ideas along with a couple of bulletpoints (eg: Reinvent email: look into alternative client/server sync such as jmap; store email in normalized sql db?; document db?; store attachments based on content hash? (free de-dup); Store email body as same? (Good for multi-user server support for mailinglists ... etc))

</comment><comment><USER28> Study Butterick's Practical Typography for tips on how to use typographic elements well, for example using hyphens and dashes properly[0]. Once you read a few of these tips you'll start seeing them _everywhere_ in professional writing.

[0] [http://practicaltypography.com/hyphens-and- dashes.html](http://practicaltypography.com/hyphens-and-dashes.html)</comment>


MacOS X is an Unsuitable Platform for Web Development - <AUTHOR> http://teddziuba.com/2011/03/osx-unsuitable-web-development.html

<comment><USER2> What a crock of shit. None of the "package managers" he mentions are OSX. They are add-ons by people like him who want OSX to be Linux. Plenty of web developers use Macs day in and day out, me included. What he is really complaining about is his employer's stack is ill-suited to running locally on OSX. It probably sucks on Windows, too. Anyway nothing stops him from using Ubuntu on his Macbook.

This is the same "Toyota Prius is unsuitable for plowing snow" crap that geeks with big egos post thinking they have something interesting to say.

Either use the same platform for development as you use for production deployment, or use tools that are compatible across deployment and dev platforms. And stop whining.

</comment><comment><USER3> Strange you would think a MacBook running OS X is closer to Linux than a Thinkpad running Linux.

<comment><USER4> I think he meant a Thinkpad running Windows.

</comment></comment><comment><USER5> I do find Mac OSX slightly inconsistent at times - to install desktop apps, drag to Applications; to install lower-level stuff, double-click the .mpkg file. Where is the uninstall for the .mpkgs?

The most annoying thing I find about other people's Macs is the case- insensitive filesystem.

include "lib/myfile.inc.php";

will work fine on the mac, but by the time it's deployed on the production Linux servers it breaks horribly because the file is _actually_ called MyFile.inc.php.

I just wish they were case-sensitive by default.

As a Linux sysadmin in charge of said production servers, I'd much rather have a yum repository with RPMs (or Apt repo with .DEBs) in it that I can deploy with none of the fuss, rather than language/platform/framework specific installers.

I can't say I entirely agree with the way he's phrased it, but I do understand where his frustrations come from.

I use a mac laptop (13" Air) - they make very nice hardware. I don't always find the desktop environment to be the easy-to-use, fulfilling experience that other people have reported.

</comment><comment><USER6> OSX's open source programs are either made and heavily tested in house, or the versions of the community open source projects that are heavily tested at the time of inclusion. So this would be the release that is already a few months old at the time of inclusion, which is probably a long time before release. So yes, you will get old versions. I'm pretty sure that only Apple-written source code will get updated between now and Lion's release.

Also, OSX is barely hardened for server use.

Tbh I wish there was a lighttpd/sqlite/php6/pear/gd/etc package, with binaries focused on each hardware revision of everything intel based. It wouldn't be too hard, and it'd save the bother of everyone less capable compiling the same thing.

</comment><comment><USER7> Setting up a local dev instance evolved into a pathological week long chore at any of the startups I've worked at in the past five years. Sadly, he's right and it is impossible to package up what you need in a sensible manner across multiple platforms. However, most of the toughest bugs I experienced involve the interaction between the load balancer/caching layer and the app layer, or how the system performed when the database was huge. These are impossible to solve with a local instance, anyway. Might as well start out with a process like Quora and have developer instances which you can spin up in the cloud. Having a local setup at all is a waste of time in a world with cheap cloud services.

</comment><comment><USER8> OSX package management is indeed annoying - which is why I do almost all development SSH'ed into a linux box. You'd think this is fragile, "What if you don't have internet access?" but in practice, especially with a MiFi, this never comes up.

</comment><comment><USER9> Coming from Windows to Linux, the package management was one of the coolest things! I kind of expected the same on OSX, but I've had the same confusion expressed in the rant. What do you use for package management?

</comment><comment><USER10> If your production environment is Linux but you're developing on another platform, what do you expect?

You'd have the same issues if you developed on Debian and deployed on RedHat Enterprise.

</comment><comment><USER11> This is the usual insipid nonsense one gets from closed-minded programmers who unfortunately populate all platforms.

</comment><comment><USER12> either he is full of shit or he doesn't know squat about package management. you can always install from source.

<comment><USER13> I don't think he wants to install from source. It sounds like he wants definitive, tested, binary packages.

<comment><USER14> What is he missing? I use Emacs on the Mac. AquaEmacs is nice. Sometimes getting binaries is a hassle. I use homebrew these days.

Linux is a great platform. However, it's still lacking the polish and commercial support. Where's Photoshop CS5? OmniGraffle? The big thing now is I'm doing iPhone/iPad development. I still have a Linux server but it looks like I'll be doing my main dev on a Mac for the foreseeable future.

</comment></comment></comment><comment><USER15> Nice rant.</comment>


Selene: Voter-Friendly, Receipt-Free Verification - <AUTHOR> https://medium.com/mit-security-seminar/selene-voter-friendly-receipt-free-verification-f05139155790 <comment><USER3> If it takes a 56 page PDF to explain, and an explanation on encryption... it's too complex.

Just do it with paper, have multiple observers, never count to more than 10 (10 slips = 1 bundle, then count 10 bundles and make 1 large bundle, etc).

Basically, I like the UK way. It's not even slow, the whole country gets the results before they wake up the next morning.

The whole thing can be verified, and it can be reverified easily later.

<comment><USER4> It suddenly occurs to me: Another aspect of pervasive biometrics. The State -- or, private entity with sufficient influence to access the ballots (think especially but not only at the local/regional level) -- scans the paper ballots for prints. Suddenly, they know how you voted.

(DNA as well, I guess, but we are further away from having instant/economic mass DNA scanning.)

<comment><USER5> That's not a huge concern, since in the UK there's a record of voter id -> ballot paper id kept. With access to that and the ballot papers you can tell how everyone voted.

</comment></comment></comment><comment><USER6> I don't think looking at this as a replacement for the existing ballot system is the right way to look at it. For the kinds of elections that are currently conducted, the current ballot systems may be sufficient, and even preferable, as other posters have argued.

In my opinion, research into new, more technical voting systems are not about our existing elections, but about new types of 'assessments of opinion' (AOO) differentiated from the current understanding of an 'election'.

For example, current systems assume that 'elections' occur relatively infrequently, are restricted to a certain number of choices, and that the person voting is sharing only their own opinion.

However, if we wanted to implement a system in which legislative decisions (proposing and passing laws, let's say) were made by the population as a whole, possibly several times per day, in a geographically distributed manner and supporting both direct and indirect delegation, any system that is intrinsically based on a paper ballot is not a feasible solution. Perhaps we'd also want to support conditional delegation as well; for example, this person receives my vote for topics localized to a 30 mile radius, while person B receives my vote for topics related to privacy protections, and so on (with additional rules for preemption/disambiguation, etc).

It wouldn't even necessarily have to be used for traditional governance - <USER2> could scale to be used for voting with a group of friends, a business, a shared-interest group, etc.

This is obviously a very tricky problem to solve, particularly if you add (optionally?) other requirements such as verifiability, secrecy, and so on. I haven't read the full PDF posted by the author, but I think it's likely that the proposed system solves only a portion of the problems described above, given the complexity of the requirements.

That being said, I certainly don't think saying "paper is always the way to go, because it's the simplest" or "these kinds of developments are solutions in search of a problem" are constructive. Addressing the weaknesses of a specific solution is one thing, but saying that the existing ballot system is optimal (particularly given the audience of HN) is a surprising sentiment to see here. Sufficiently long-standing problems (are capitols necessary?) may not be immediately visible to us, but that doesn't mean they aren't there, and we should strive to be open-minded - even towards imperfect solutions.

Just my 3 cents.

<comment><USER7> It doesn't even have to have anything to do with the state. Votes in school classes? On a corporate board? In games? A working secure anonymous voting system could be useful everywhere.

My own sketch kind of "cheats" a little - I'm using Secure Multiparty Computation to achieve a cryptographically protected opaque VM distributed against mutually distrusting entities. This makes practically everything else easy - vote input data can be anything, and you can have any imaginable type of vote trivially. Per-choice scoring? Choice rankning? Switching is easy too.

[https://roamingaroundatrandom.wordpress.com/2014/06/16/an- mp...](https://roamingaroundatrandom.wordpress.com/2014/06/16/an-mpc-based- privacy-preserving-flexible-cryptographic-voting-scheme/)

Still only a blueprint, but technically possible. I'm going to look into how this particular scheme works and see what they're doing different that could be reused, if anything is applicable.

Edit: reading it now. Turns out their approach is remarkably similar to mine on a high level! But their cryptographic constructions differ and is definitely more advanced.

</comment></comment><comment><USER8> The gist of the method of verification, from the linked slide deck:

       Typically, voters get a "protected receipt", i.e. an
       encrypted/encoded version of their vote.

       Cast receipts are posted to a secure web bulletin board.
       Voters can verify that their receipt is correctly posted.

       A (universally) verifiable, anonymising tabulation is
       performed on the posted receipts.

<comment><USER9> So there is a receipt but, in the interests of preventing tampering (?), the voter won't be able to understand it.

It still requires a complex software system that no lay person (and no expert in short order) can verify.

That problem remains and it isn't really a technical one. Any voting machine has to be able to be verified using simple visual, mechanical inspection for the people to trust it. More technology will only undermine trust further.

<comment><USER10> My understanding is that this system is trying to solve one particular problem: how can you be sure your vote was counted? A simple visual inspection probably isn't enough to convince me that my ballot box won't be dropped off the back of a truck later.

That said, I do have some question about how thoroughly it addresses that problem.

A lot of the presentation is about difficult edge cases, such as how a voter can falsely verify their vote to someone who's coercing them to vote a certain way. This part seems quite complicated, but it kind of has to be. Maybe an interest group could make step-by-step instructions available to groups of voters who they think are likely to be coerced.

What I don't know from the presentation is, is the simple case understandable? If I am a reasonably normal person who has never been to a key-signing party and does not code El Gamal for fun, will I be able to verify my vote? Do I need to personally do the math and computation that would verify my vote, or would there be a usable, trustworthy app of some sort that does it?

Here's another threat model that they don't discuss: what if I don't like this system and I want to undermine it, and I use a false verification code to say "look, you counted my vote for the wrong candidate, this system is corrupt"? Presumably nobody would be able to say I was wrong, and nobody would be able to distinguish a real election flaw from my fictitious one.

<comment><USER9> A ballot box falling off the back of a truck is a voting system problem that us utterly unrelated to the "verifiable voting mechanism" problem. Talking about them in the same sentence this way obscures both problems.

<comment><USER10> I mentioned it hyperbolically, as a way of saying a voting system being simple and inspectable is not sufficient to make your vote verifiable.

</comment></comment></comment></comment></comment><comment><USER11> buro9 hit the nail on the head. The most important, often neglected, issue is that voters will understand and trust it. I've been digging through voting schemes for a while trying to find this one requirement. Fortunately, I did find one in a discussion on Schneier's blog:

Scantegrity voting scheme [https://web.archive.org/web/20110324052432/http://www.scante...](https://web.archive.org/web/20110324052432/http://www.scantegrity.org/)

[https://web.archive.org/web/20110728002210/http://www.scante...](https://web.archive.org/web/20110728002210/http://www.scantegrity.org/learnmore.php)

I'd still like to see experts in cryptography and voting architecture do a thorough evaluation of its security. However, the process is simple enough that about any location should be able to implement it and about any person use it. I mean, there might be modifications for accessibility reasons. Second link has the papers.

Anyway, what do you all think about Scantegrity in general and as a default recommendation for secure voting?

<comment><USER12> I manually worked thru a hypothetical election using Punchscan for my jurisdiction. It didn't protect voter privacy.

With paper ballots, dropping your ballot into the ballot box is the secure one-way hash (assuming enough people are voting).

The trick crypto systems do is hide your ballot within a herd of ballots, using some kind of one way hash, assuming there will be hash collisions. Works great with simple ballots (few races) and large numbers of voters.

Alas, in my jurisdiction, the smallest political (bookkeeping) unit is a precinct (ranging from 0-1000 voters) and our ballots have 10-40 races. So combinatorially, it's likely each ballot is uniquely identifiable.

A crypto systems _might_ work if our complex ballots were separated into more simple ballots. Eg one each for national, statewide, county, and local races.

Rant: My primary grievance with proponents of crypto for voting is they do not specify under which conditions their systems will and will not protect voter privacy. That is very intellectually dishonest, with a dash of technophilia.

After studying this, extensively, crypto based voting systems for elections are complete non-starter for me. I'd rather forfeit voter privacy than embrace an inscrutable system that I can barely understand.

</comment></comment><comment><USER13> Did you know btw that in the UK your vote is not really private: there is a serial number on the ballot that is noted down against your name in the register?!

</comment><comment><USER13> As the author of the Selene scheme and the talk i should add some clarifications:

Selene is explicitly _not_ intended for high-stakes, binding votes to elections. It amy be suitable for some forms of election, e.g. of officials of professional bodies, student societies etc., in the way that say Helios has been used. I want to stress that I, like many, in the verifiable voting domain do not advocate internet voting for serious elections. we currently know of no scheme that provides sufficient levels of verifiability, coercion resistance and usability.

A primary goal of Selene is to make the verifiability step as simple and understandable as possible. In contrast to most existing E2E verifiable schemes voters do not have to handle encrypted ballots to perform the verification, they simply look up their vote in the clear on the WBB using their private tracker. Of course, making the verification so transparent, as opposed to the usual practice of checking the presence of an encrypted ballot, has its costs in terms of receipt-freeness and coercion resistance, but we have tried as far as possible to mitigate these.

The scheme does use some fairly sophisticated crypto but as far as possible this is all under the bonnet as far as the voter is concerned. Of course, to understand the arguments for the security claims would require at least some superficial understanding of the crypto, but my guess is that most voters will not be that interested, or will be happy to accept the evaluation of experts.

I don't believe that it takes 59 or whatever slides to explain the key features of the system:

there are constructions, transparent to the voter but verifiable by expert, interested parties to guarantee

that no two voters get the same tracker.

There is a mechanism to notify voters of their tracker after the trackers and votes have been posted in the clear.

The fact that voters learnt their tracker only after the posting of this information helps mitigate the obvious coercion strategy: ask the voter to reveal her tracker.

The notification is set up in such a way that a coercer voter can fake it to appear to reveal an alternative tracker, pouting to the coercer's vote.

verifying your vote is simple: look up your tracker and check that the vote alongside it is correct. and this is of course in any case optional, voters can just vote and go.

much of the content of the slides is just discussing the background, contrast with other E2E schemes etc.

A paper describing the scheme in detail will be available shortly. I welcome feedback.

</comment><comment><USER13> the scheme does not require 56 pages or whatever to explain. there is some crypto under the bonnet that is designed to guarantee essentially the following:

1 every vote will get a unique tracker number

2 the voter is notified of his or her tracker after the votes/trackers have been posted to the Web Bulletin Board. This is to give a coerced voter the chance to identify a tracker number that points to the coercer's required vote.

3 each voter is notified of her/his tracker in a way that allows them to deny it and claim another tracker that points to the vote demanded by the coercer (which they identified in 2).

</comment><comment><USER14> Can this system be understood and verified by a 5 year old?

<comment><USER15> Can a 5-year-old do a rigorous security analysis of a conventional paper ballot as conducted by modern nation-states?

If not, then the appropriate standard for comparison is "Could this system fool a 5-year-old?".

<comment><USER16> No, but a five year old could understand the fundamentals of why a paper ballot is secure, even if they do not evaluate the complete implementation. This system is a little tricky just to understand conceptually.

And here's the thing: voter fraud is very rare. IMHO, _fear_ of voter fraud causes many more problems than the fraud itself. It is therefore critical that people understand and trust the voting system even if a more complex system is otherwise safer.</comment></comment></comment>


Ask HN: Has anyone here successfully applied to Stripe Atlas? - <AUTHOR> I've just applied - but I was wondering if anyone here at HN has any experience with Stripe Atlas so far?
How long did it take for you to be accepted? Was the process as simple as it sounds? Are you based in the US, or international?
Any experience(s) you can share would be great. <comment><USER2> I got accepted but didn't pursue it. The bank they use traditionally works exclusively with local venture-capital funded startups and multinationals opening offices near venture-capital funded startups, so I'm a bit skeptical they'll be a good match for anyone a continent or two from the Bay Area.

From what I read SVB don't actually issue debit cards to anyone so I'm not sure how useful the account would be, I don't think you could use it to pay for anything except maybe indirectly through PayPal, that may make accessing the funds complicated too. It may leave you requiring local incorporation and a local bank account for all your business needs in which case you're paying 15+ percent tax in the US purely for Stripe.

The incorporation process is itself just a couple forms to fill out. A company I registered through [http://clerky.com/](http://clerky.com/) beforehand was effortless, getting an EIN and registered agent was also easy through [http://delawareinc.com](http://delawareinc.com) (except fitting very verbose Costa Rican addresses on the forms), and taxes by [http://de- taxes.com](http://de-taxes.com). Price is around $499+ either way you do it.

<comment><AUTHOR> Not been able to get a debit card from SVB sounds like a problem.

But once the business is registered - how hard is it to open a 2nd bank account, with another bank, so you can get a Visa Debit card through them?

<comment><USER2> I think you need to be standing in a bank branch to do that.

</comment></comment></comment><comment><USER3> Are you referring to getting accepted into the beta or completing all the various forms for your company? I've been accepted to the beta, and the landing page says:

"After you submit the application, we will send you the documents to review and sign within a day or two. Your company and bank account will generally be set up within a week of submitting the signed documents."

I have yet to submit my forms, but I was under the impression the process would be relatively quick.

<comment><AUTHOR> Sorry - I meant "getting accepted". How long was it between applying, and getting accepted?

<comment><USER3> I was accepted into the beta a little over a month after I applied.

</comment></comment></comment><comment> video-host Still waiting...</comment>


How The Kernel Manages Your Memory - <AUTHOR> http://duartes.org/gustavo/blog/post/how-the-kernel-manages-your-memory <comment><USER2> One of the most important bits to pull out of this article, is that when you ask the kernel for memory, it doesn't actually do anything other than update its accounting of available memory and VA space - when you _touch the page_ , you page fault and the kernel actually gives you a physical frame. The NT kernel (and I suspect any other production OS) works the same way.

<comment><USER3> AFAIK there is a difference between Linux and NT: Linux allows overcommitting, while NT requires that every page has a "backing store", for example a physical RAM page, a swap page or a memory mapped file.

Thus when you _touch the page_ , Linux may figure out that there is no memory that page can be mapped to it, but now it is too late because the application "believes" that the memory has been allocated. So the kernel kills the application (or, to be correct, _an_ application) too free memory with an OOM exception. This is one of the reasons why it is good to have loads of swap even if the physical RAM is big enough for all the running processes.

<comment><USER4> Or, if you know you won't be running applications that allocate more than they use, you can disable overcommission entirely.

</comment></comment></comment><comment><USER5> All great reads: <http://duartes.org/gustavo/blog/best-of>

I've never heard of this guy, but I like him already. Anybody that can produce documentation of this level of quality for a relatively advanced codebase is a good person to have committing, or even just hanging around.

<comment><USER6> I agree, the quality is really good. Thank you for pointing out the "Best of" link. Another hour removed from "productivity" and moved to "always wanted to read about" for my day. =)

</comment></comment><comment><USER7> Great article, nice graphics. His other articles are very good too. I'd love to see someone explaining the details of memory management for the ARM Linux kernel with the same clarity.

</comment><comment><USER8> Great article. If you want to know more about Windows memory layout here's a couple of great books:

<http://technet.microsoft.com/en-us/sysinternals/bb963901>

[http://www.amazon.com/Windows-File-System-Internals- Develope...](http://www.amazon.com/Windows-File-System-Internals- Developers/dp/1565922492) (Yes it's about file systems but it's an awesome book about Windows internals)

[http://www.amazon.com/Windows-Device-Development-Classic- Rep...](http://www.amazon.com/Windows-Device-Development-Classic- Reprints/dp/0976717522/ref=sr_1_6?s=books&ie=UTF8&qid=1300344720&sr=1-6)

</comment><comment><USER9> I love this dude's blog, but I wish he'd actually post more new articles.

</comment><comment> rw2- Nice post. But it's Hacker _News_. Not "Hacker _OMG I've found a nice old article_". ;-)

February 3, 2009 at 11:35 pm

<comment> rw2- Hmmm, nobody seems to understand what ";-)" means.

<comment><USER10> We do. Your post is still noise. This is a valuable article that most people here have not seen - I hadn't, even though I have seen others from this author. Which are all excellent, by the way. I upvoted this submission because I love seeing such detailed systems articles on the frontpage.

<comment><USER6> I agree. I enjoy finding detailed articles like this when I come to Hacker News. Also, even though this article is old to a lot of people I have found a new blog to follow with what appears to be well written articles.</comment></comment></comment></comment>


Google Acquires Cloud Migration Platform Alooma - <AUTHOR> https://techcrunch.com/2019/02/19/google-acquires-cloud-migration-platform-alooma/ <comment><USER2> Why would Google acquire a startup that barely raised 15M in 2 rounds? There seems to be more to this story. Perhaps the alooma team is extremely talented? Any ideas?</comment>


Why can't local government and open source be friends? - <AUTHOR> http://www.guardian.co.uk/technology/2009/aug/07/local-government-open-source-birmingham-website-costs

<comment><AUTHOR> If you don't get that far in the linked article, they mention a new group—UKGovOSS [1]—that have produced an interesting report [2] on the attitudes towards open source in local government.

[1] <http://ukgovoss.org/>

[2] <http://ukgovoss.org/2009/08/06/open-or-closed-report/>

</comment><comment><USER2> For the state I live in, I find there is little knowledge of linux/unix in state and local governments. This quickly narrows the playing field to Windows and to proprietary from there.</comment>


Kafka and KSQL, Azure Data Lake Storage Gen2, and Other Topics Week 37 - <AUTHOR> http://www.nielsberglund.com/2018/09/16/interesting-stuff---week-37/ <comment><AUTHOR> A roundup of things I found interesting the week just gone by.</comment>


Making Sense of Our First Look at Windows 8 - <AUTHOR> http://allthingsd.com/20110601/exclusive-making-sense-of-what-we-just-learned-about-windows-8/ <comment><USER2> Biggest part of announcement was the HTML+JS part. Let that sink in- HTML+JS is now the premier way to write Windows apps. Who would have thought this day would come?

<comment><USER3> Don't for a minute think this means that this means platform-neutral apps.

HTML+JS calling into Windows APIs, is more likely what this is, rendering rich widgets ala ASP.NET controls. I'm willing to bet money on it.

And at that point, who cares? Different development toolset. Same lock-in.

<comment><USER4> I'm sure they're not going to use ASP.NET controls. If WebOS is universally accepted as developer friendly I don't see why Windows which is planning for a similar toolkit will not be considered so.

And let me know when the day arrives when you can develop and run platform- neutral apps in Mac,iOS or in fact Linux. Don't be unreasonable. Thanks.

<comment><USER5> Apple actually tried to introduce HTML5 as the development platform for the iPhone, and developers didn't want it.

<comment><USER6> Not quite. Safari for iOS is crippled when compared to the desktop versions. You have to write a native app over a web app if you want to allow the user to upload images or video, for example.

</comment></comment></comment></comment></comment><comment><USER7> Ok, just to be sure I understand that correctly - Microsoft has invested quite a lot of money into developing Silverlight and WPF and then promoting those technologies among developers as the best thing since sliced bread (not to mention the only way to write applications for WP7) and now they are doing that? How is that for the coherent vision and a clear message to people who'd like to write for their platform?

<comment><USER8> Microsoft invest lots of money into lots of different technologies, then dump them later. OLE, COM, Win16/32 and many _many_ others have fallen by the wayside over the years.

<comment><USER9> Another good examples is connecting to a database on the MS stack, so many different ways of doing it.

<comment><USER8> The canonical example, in fact. They've gone through something like 10 different APIs/frameworks in the last decade, IIRC.

</comment></comment></comment></comment><comment><USER10> But how do you make things?

This is a fantastic way to present information. it's beautiful. I would love this on a tv, or a bunch of displays in my house. especially with an epaper non light generating kind of display.

But... but... how do you make stuff? how do you design a house? how do you write code? It seems so very very consumer.

<comment><USER11> You open a CAD program or code editor?

</comment></comment><comment><USER12> There is a video on youtube for user interface of windows 8 <http://www.youtube.com/watch?v=p92QfWOw88I>

<comment><USER13> I think it looks a lot nicer in motion. Though switching between desktop and tablet modes could be a bit jarring.

</comment></comment><comment><AUTHOR> Live rollout:

[http://allthingsd.com/20110601/up-next-at-d9-microsoft- windo...](http://allthingsd.com/20110601/up-next-at-d9-microsoft-windows- president-steven-sinofsky-live-at-d9/)

</comment><comment><USER14> Side question: we're going to see the debut of OS X Lion soon this summer, as well. How often does this happen, when we have a year when both MS and Apple reveal their upcoming operating system?

<comment><USER15> Technically, Apple showed off Lion last year and is going to release it this year.

Microsoft is showing off Windows 8 this year and is going to release it next year.

Nonetheless, this near-overlap happened around the time of Win 7 and Snow Leopard too (both released late summer 2009).

</comment></comment><comment><USER16> This looks like a tablet OS rather than a desktop OS.

The elephant in the room is Office. How is Office going to make the transition to a Windows 8, touch-based UI and still be usable to the dozens of millions of current users?

The age-old desktop vs. touchscreen conundrum arises. Apple has two versions of it's OS: OSX for desktops, which is (currently) not a touch-based UI, and iOS for it's small and large tablet devices which is touch-based.

<comment><AUTHOR> I wonder if they're keeping it quiet but plan on Office vNext being fully integrated into the new UI. I recall some leaked screenshots that seem to be leaning in that direction. Mmmm... here:

[http://www.redmondpie.com/microsoft-office-15-leaked- photos-...](http://www.redmondpie.com/microsoft-office-15-leaked-photos- suggests-metro-based-ui/)

</comment></comment><comment><USER17> Looks to me like MS just declared the desktop to be dead.

<comment><USER18> Apple's experiences with iOS are giving most everyone that general impression, including Apple...

</comment></comment><comment><USER19> If they don't have a ship date yet, why are they showing this off? It seems like they're just asking for any of their good ideas to be stolen before they launch. Apple's approach seems to be to develop in secret and show something off just before it hits the shelves.

Is Microsoft just seeing to see how people react to this, leaving room to backpedal if necessary?

<comment><USER20> So that people can get all their outrage out of the way and get used to it.

</comment></comment><comment><USER21> When Steve Jobs said that touch interfaces on the desktop/laptop sucked, I think that opinion was based on some thorough testing.

Looks like Microsoft are gonna go ahead and do it anyway.

</comment><comment><USER22> Looks like OS X and Linux have nothing to worry about here. It's the Microsoft Bob idea wheeled out again with a trendy minimalist feel instead of a dog.

<comment><USER23> It's Windows, there isn't going to be a change in userbase no matter what MS does.

Windows users will not switch to Linux (but it's the year of Linux on the desktop!) because of the usual issues, but serious (non-VS-using) developers will never use Windows either. As for OSX, Apple hipsters aren't going to spontaneously start using Windows, and Windows users aren't going to start spending 2x as much on their computers any time soon.

<comment><USER24> You managed to pack a great deal of trolling into this post. Kudos for this one.</comment></comment></comment>


Node.js is non blocking server side javascript, but might blocking be better? - <AUTHOR>

The downside of node.js is that due to its non blocking nature, coding must be callback oriented which requires a different programming approach and mindset.  Code can become complex and callback nesting can make things hard for programmers.<p>Using Google V8 might it be practical to create a blocking server side javascript engine that is perhaps slower, but easier to program? <comment><USER2> Meaning each request runs on its own thread or process? That would kind of eliminate the entire charm and feel of Node wouldn't it?

In other words, the event/non-blocking/callback aspect of Node seems so ingrained in it's implementation that it wouldn't even be the same thing if you changed it, it would just be server-side JS. Just my opinion, I'm pretty much a total Node "noob" (did the tutorials, haven't gotten much beyond yet).

</comment><comment><USER3> have a look at jscex which is a macro that turns async operations into synchronous-looking ones.</comment>


How to find out the number of Calendar users? - <AUTHOR>

How can I get the # of users for Web-based calendars for Gmail, Yahoo, MSN etc? Or How many calendar events / tasks are created each year? Google search does not turn up anything. Even a formula to get rough figures would help as well.<p>Thanks, <comment><USER2> I'm unaware of any previously published data on this subject. Note that this doesn't mean that there isn't any.

It seems like you're asking the wrong question here. Are you trying to do market research for a potential calendar application? If so, I suggest you do market research. Hire someone to check your surveying methods, and ask a random subset of your audience the questions you wish to know. Then, multiply by (audience population / sample size) to get an estimate of the number of users.

Also, it's customary to add "Ask HN:" to the title of posts like this.

<comment><AUTHOR> Thnx Reemrevnivek.</comment></comment>


New study shows how birds work to sing together - <AUTHOR> https://phys.org/news/2017-12-birds.html <comment><USER2> It is highly difficult to synchronize an orchestra without a conductor, that is, some centralization is needed (like CPU clock). Same problem with bands but they tend to use some kind of rhythm generator. It seems that birds have learned how to sing together asynchronously.

<comment><USER3> Like when stadium full of football (soccer) fans start chanting the team name and sometimes even songs without any centralized entity

<comment><USER4> It's one thing to have everyone chanting the same few words in unison. It's another to have an orchestra/band where every musician has a separate part but they all need to be played in sync.

<comment><USER5> Professional orchestras can play the standards without a conductor and effectively often do in those cases where the conductor is borderline incompetent. I've sung Beethoven 9 for example. The "conductor" (one of the several hundred assistants of Karajan...) bought a good orchestra from prague. He did the whole piece in ones. Nobody watched him. The orchestra members know this piece well and played without him.

Often you'll find conductors where you can't read anything: "Now where's the 1? Well, last bar he did it with his wrist, now he's doing it with the tip of the stick, o wait,now he's swimming (unclear speed) again. Ok, now he's changing his frame of conducting (the area in which a conductor does his movement). Wait, what? Now he's giving the one behind his back. How am I supposed to ... Screw him. I'll just listen to the music and start a little early (you hear the orchestra with delay, as you often only get the reflection from the audience's walls).

Edit: We use the rehearsals to get to know a new conductor and to decide when to actively not look at him and get our marks from someplace else. Often you'll get so confused that it's better to "just do it, it'll be ok."

Also I have seen musicians in the orchestra conducting their colleagues in difficult parts where the "masterchief" wasn't any good. We do the same on stage in those cases.</comment></comment></comment></comment>


British Airways faces record £183M fine for data breach - <AUTHOR> https://www.bbc.com/news/business-48905907 <comment><USER2> > At the time, BA said hackers had carried out a "sophisticated, malicious > criminal attack" on its website.

Compromising a single JS resource that was being carelessly loaded on a payment page doesn't qualify as sophisticated in my mind. It might not be uncommon in the industry, but tools like SRI and CSP stop these attacks dead in their tracks.

I believe we are about one huge attack[0] of this kind away from realising how dire the situation truly is.

As a victim of the earlier Ticketmaster attack I'm curious as to if the ICO is investigating that too.

0: [https://hugotunius.se/2018/11/29/how-to-hack-half-the- web.ht...](https://hugotunius.se/2018/11/29/how-to-hack-half-the-web.html)

<comment><USER3> > but tools like SRI and CSP stop these attacks dead in their tracks.

this isn't... usually true. in the case of this attack, the Javascript was appended directly to a 'known good' library resource[1]. Typically CSP whitelists based on origin, which would make CSP ineffectual in this case. Also, websites like BA have advertising, and it's nearly impossible to run CSP with ads unless you use the `strict-dynamic` directive, which whitelists any javascript loaded by your javascript recursively... including this javascript[2].

There are other, more uncommon modes for CSP which you might be referring to:

1\. Nonce, which provides protection by ensuring each script has a server- calculated one-time-use token. This would not have any effect, as the script is part of one naturally loaded by the server.

2\. Hash[2], which provides protection by checking the script's content against a predetermined hash. This _possibly_ could be effective, but in practice rarely is. If the attackers could edit this script, there's absolutely no reason to believe either (1) this just updates the generated hash or (2) the attackers cant just update the hash. (this is essentially the same as SRI). Hash is potentially effective where taking advantage of a third- party CDN with known content that should not change, but by the look of the url: [http://www.britishairways.com/cms/global/scripts/lib/moderni...](http://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.min.js) the resource was not on a CDN.

[1]: [https://medium.com/asecuritysite-when-bob-met-alice/the- brit...](https://medium.com/asecuritysite-when-bob-met-alice/the-british- airways-hack-javascript-weakness-pin-pointed-through-time-lining-dd0c2dbc7b50) [2]: [https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Co...](https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)

<comment><USER2> From the reporting I've read, primarily by RiskIQ, in both the Ticketmaster and BA case it was not the origin servers that were compromised in which case SRI would have been effective in so far that it would have required the attackers to compromise the origin servers too at which point it's all game over anyway.

So I would assert that SRI would have stopped both these attacks.

<comment><USER3> i cant find any hits for "origin" or "CDN" on the original RiskIQ article: [https://www.riskiq.com/blog/labs/magecart-british-airways- br...](https://www.riskiq.com/blog/labs/magecart-british-airways-breach/)

the RiskIQ article identifies the location of the script as "the main website"

additionally, I'm not sure how this would solve the problem. If BA went to all the effort of putting their frontend assets on a CDN, why wouldn't their HTML, with the hashes also be on the CDN? and if the hashes are not generated by the CDN, how does the server generate the hashes without being affected by changes on the CDN? regardless of outcome, if the process is automated, does a human being need to read a diff every time any file on any CDN changes? Can't an attacker then just wait until the hashes are automatically updated?

<comment><USER2> Sorry I should have been clearer here. RiskIQ doesn't distinguish between the CDN and origin in their write up. That's an assumption on my part, I believe it be the case that the CMS that serves the JS file is different from the origin server that would be serving the checkout pages and other parts of the BA website. From a quick Google it looks like the CMS path on BA is just a file storage server of some kind.

Most likely the origin server had a hardcoded reference to the CMS path([https://www.britishairways.com/cms/global/scripts/lib/modern...](https://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.min.js)) and if that had been done as

        <script type="text/javascript" src="https://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.min.js" integrity="sha384-5XrDTQbmmgpJKmfKW8outDDdYpRCnIf+nxX2nVR10NyWby6pPcujAELgWVmCu2P/"></script>

I speculate the attack would not have been successful. For an extremely static resource like this it wouldn't have been complex to adopt SRI.

</comment></comment></comment></comment></comment><comment><USER4> I'm glad to see a solid fine given for a data breach.

I've worked on projects in this sector before, and it's a common story to others - client cuts cost as much as possible, until the risk of an inferior product has grown too high to handle. It's a race to the bottom, and security rarely comes into consideration outside of a basic pen test being mentioned (if it happens).

Still, I'm quite annoyed at the lack of follow-up against what is blatant bullshit from BA. When your business is so heavily reliant on taking payments online, their security procedures should be airtight. I can understand that it's quite a clever hack, but it's security 101 to know what third-party code is doing on your server.

The fine is good, but it would be nice to enforce rules where a company caught in a data breach has to accept liability and not contest the severity.

<comment><USER5> This amount represents more than their profits for roughly two years. It isn't realistic and is likely a number released to make headlines.

The point of regulation is to change corporate behavior, not drive them out of business.

The stock market does not seem to think the fine will ultimately be anywhere near that high, with a drop in stock price of only 1.5%.

As always, beware of headlines.

<comment><USER4> I'm not too bothered by the number, but am worried that a company will be able to talk their way out of punishment through misinformation.

You only need to look at the latest Zoom vulnerability, and the Panera Bread data leak to see how companies will happily tell its users that everything is fine, while doing absolutely nothing to publicly resolve the issues being raised. To make things worse, a lot of people will blindly believe this, or take their side to be contrarian.

As you've rightly said, regulation needs to change corporate behaviour, and while a hefty fine will do that, it's also a minor risk to a firms ongoing reputation. It's a cost that can be offset elsewhere - more than likely onto the customer. I would rather the fine be halved or even quartered, if it meant that BA had to publicly accept full responsibility, and to push for independent auditing of all of their software.

</comment></comment></comment><comment><USER6> For those who are wondering what happened, British Airway's website had malicious JavaScript included in some files they were using. Compromised third party libraries (in this case, the Modernizr library) was the attack vector. The malware would take sensitive data off the webpage and send it back to the hackers surreptitiously.

Most sites still would have no idea if this were to happen to them today.

That's why I've developed Enchanted Security ([https://enchantedsecurity.com/](https://enchantedsecurity.com/)) - a virtual content security policy that tracks the network requests and even blocks malicious ones. It's like a firewall but running on your users' browsers. This would've prevented what happened to British Airways. Get in touch if you're interested in learning more.

<comment><USER7> Interesting approach, but doesn't using your product add another attack vector? Surely Enchanted's CDN will be a rich target for attackers.

Full disclosure: I'm in private beta with a product that periodically loads production sites and compares all executed JS to the last-known-good profile (usually from CI prior to deployment), and raises warnings if anything changes. We don't run in actual users' browsers, so we won't see malicious code as early as Enchanted, but you don't have to trust us.

<comment><USER6> For your first question, there's an optional hash you can add that locks the code to its known hash. Also, you can self-host everything if you like.

The type of product it sounds like you're running is a scanner and scanners have a couple problems. First, there's cloaking: if the malware can detect that it's a scanner (usually pretty easily) then the malware doesn't activate. Second, the malware comes from trusted code that you already think is trusted, and that's a problem if you overlook something because it's trusted. By contrast, Enchanted Security would see it since it runs on every users' browser all the time.

<comment><USER7> To be honest, if you can get clients to reliably use SRI, that's probably better protection than either of our products.

Yeah, our product could be classed a scanner, but there's no (little) risk of cloaking, as the network request or JS loaded to work out whether we're a real user is enough by itself to raise the alarm. To pull it off, the attacker would have to compromise the host of a trusted resource, determine that we were a scanner from our network request alone, and serve to us the original resource. There's a few ways to help ensure that our network requests aren't easily recognised, which is part of our "secret sauce".

Our approach does protect against the case where an attacker gets access to the client company's server and makes changes to the resources served, which can allow them to work around / selectively serve embedded snippets.

The second problem you mention isn't an issue, as we don't trust hosts, only the hash of resources (the same idea as SRI).

<comment><USER6> Depending on how the code is being served, cloaking is a big problem for scanners... if you think it's no risk you're probably overlooking the risk. Google put out a report on it and there's lots of papers on it and related topics like VM detection in browsers.

You can use SRI for something like a specific version of jQuery, but not for most of the products people are relying on that have more dynamic functionality.

SRI isn't practical for third party resources that are expected to change over time, which is actually a lot of third party resources. For example, a chat script like Intercom will change when someone from marketing makes a change that affects its frontend settings. This may be changing some text or coloring. So you can't pin it with SRI.

In your case, if your product tells you that some marketing script you're using changed hashes, how would you know whether that was a valid change or whether an attacker introduced malware?

<comment><USER7> > Depending on how the code is being served, cloaking is a big problem for > scanners... if you think it's no risk you're probably overlooking the risk. > Google put out a report on it and there's lots of papers on it and related > topics like VM detection in browsers.

Almost all bot/automated test/scanner detection relies on JS in the browser, which is too late to avoid triggering an alert with our approach. The attacker would have to identify us from our network request to load the compromised resource alone, for which we have (so far) effective mitigations.

> In your case, if your product tells you that some marketing script you're > using changed hashes, how would you know whether that was a valid change or > whether an attacker introduced malware?

We'll alert the client company for any resource that's changed - you can't trust that any third party resource change is okay, especially if the reputational and legal cost of a breach can exceed 10's or 100's of millions.

Most third party code from reputable companies, including tracking tagging, doesn't change that often, and client security/ops teams tend to be horrified by the ones that do. Each time some third party silently replaces code that they're serving, it introduces new opportunities for bugs, breakages, and attacks.

I really disagree with you about SRI. SRI isn't sufficient to prevent all client-side attacks, but it is very effective, and when enterprise customers demand it, third-party services almost always find a way to support it.

</comment></comment></comment></comment></comment></comment><comment><USER8> Seems very just. BA clearly had no controls to understand the code running in production was the code they had deployed. I hope this serves as a wake up call to other companies who have a blatant negligence for infosec.

<comment><USER9> > clearly had no controls to understand the code running in production

This applies to everyone who has advertising or third party anything on their page, no?

<comment><USER10> If they choose to import some code from elsewhere sure. They could run their own advert by hosting "advert.jpg" on their server and wrapping it in an anchor tag.

BA however are a company selling their own product, no need for them to have adverts. If they want to dilute their product with adverts then they take the risk of fines (as well as losing custom)

<comment><USER11> Why does an airline even need to show advertising on their page in the first place. You'd think they would be most concerned about selling their own product.

<comment><USER7> Many of them show ads for partners to generate ancillary revenue, which is a large source of profits for airlines.

In addition, if they themselves _advertise_, they'll need to add tags to track attribution, conversions, etc.

<comment><USER10> Funny how people advertised for decades on tv, in newspapers, and with leaflets through the door, without invasive tracking

<comment><USER7> Fair enough, but if you're advertising online with any of the major companies today, there's no way to do so effectively without instrumenting at least your landing pages and conversion pages with advertising tagging.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> "The information included names, email addresses, credit card information such as credit card numbers, expiration dates and the three-digit CVV code found on the back of credit cards, although BA has said it did not store CVV numbers."

Is it standard for airlines to handle storing payment card details themselves and hence having to be PCI certified instead of delegating to a PSP?

<comment><USER13> Someone injected Javascript into their pages which collected this information. But, yes, it's standard practise for airlines to store card information (excluding the 3/4 digit code) in the customers' PNR (Passenger Name Record) in the airline's GDS (Global Distribution System). The details are on this page: [https://servicehub.amadeus.com/c/portal/view- solution/965353...](https://servicehub.amadeus.com/c/portal/view- solution/965353/en_US/ticketing-and-fare-elements-form-of-payment-fp-)

<comment><USER14> Just a quick clarification, in the case of an airline website, the PNR will not be created through the GDS (too expensive), it will be created directly in the PSS (usually managed by the same company)

<comment><USER13> Think it depends on the airline and whether they allow agent bookings. Last I knew, BA.com created them on 1A but that may have changed with NDC.

<comment><USER14> For web they create them on 1A, but directly in 1A PSS, not going through 1A GDS (and therefore not paying the GDS fee, just a PSS fee). This is the case for all direct channels (websites or airline call centers) of all airlines

</comment></comment></comment></comment></comment><comment><USER15> Statement on the Information Commissioner's website: [https://ico.org.uk/about-the-ico/news-and-events/news-and- bl...](https://ico.org.uk/about-the-ico/news-and-events/news-and- blogs/2019/07/ico-announces-intention-to-fine-british-airways/)

<comment> Anthony-G The statement shows that the ICO investigated this data breach on behalf of other data protection regulators of other EU states. As an Irish citizen, I wish our Data Protection Commission was as serious about protecting the personal data of EU citizens.

</comment></comment><comment><USER16> UK's ICO and other data security enforcers are acting. That's good. They're changing companies' calculus about putting resources into infosec. That's even better.

The public and press perceive that "justice is served," so we're tempted to think the problem is solved. I don't think that's helpful. These fines don't address root causes of the problem. They don't make our systems more resilient.

They're drawing a significant amount of money from the system and transferring it to their governments' general accounts. Is that the best use of that money? Should some of that money be used to help address infosec problems? To fund training for citizens, legislators, and governments? To step up law enforcement efforts against cybercreeps? To publicly fund independent security researchers (white-hat hackers) to help detect this stuff and nip it in the bud? To help subsidize the significant expense of comprehensive infosec audits for municipal governments, ngos, and small firms?

Here in USA, the National Security Agency has, by hoarding zero-day exploits and inadequately protecting them, done major infosec damage to civil institutions worldwide (UK's NHS, the Baltimore city government, you name it). I suspect similar things have happened in other governments. To what extent is it their responsibility to help clean up the mess? Can other governments use their resources to backfill where the US government can't or won't act?

Do governments now join identity thieves as enemies of people doing infosec? That cannot be good. We have to get this right and we can't do it if we're fighting each other rather than the criminals causing the trouble.

<comment><USER17> >They're drawing a significant amount of money from the system and transferring it to their governments' general accounts. Is that the best use of that money? Should some of that money be used to help address infosec problems?

Well the point of these fines is to say to organisations "put your money into infosec, or when you have a breach it'll probably be your fault and we'll take that money as a punishment".

>Should some of that money be used to help address infosec problems? To fund training for citizens, legislators, and governments? To step up law enforcement efforts against cybercreeps? To publicly fund independent security researchers (white-hat hackers) to help detect this stuff and nip it in the bud? To help subsidize the significant expense of comprehensive infosec audits for municipal governments, ngos, and small firms?

The NCSC[0], GCHQ's defensive side, publishes advice for the public, companies, charities, schools, government departments etc.

[0] [https://www.ncsc.gov.uk/](https://www.ncsc.gov.uk/)

</comment></comment><comment><USER18> Just FTR, note that BA might appeal against this, so it may be subject to revision before it's all over...

"BA has 28 days to appeal. Willie Walsh, chief executive of IAG, said British Airways would be making representations to the ICO. "We intend to take all appropriate steps to defend the airline's position vigorously, including making any necessary appeals," he said."

</comment><comment><USER19> This may be the beginning of the end of hiring front end devs in house. Suddenly they are a serious liability... much nicer if you can pass on the fine to a third party!

<comment><USER20> I'd say it's likely to be a game changer when it comes to skimping on IT in general, whether in-house or outsourced. It's good news.

</comment></comment><comment><USER21> So this is ~$366 per person whose data was compromised. That seems fairly cheap all things considered.

It's a far sight better than the "credit protection" they normally provide (from our point of view, rather than the people who are used to not having any penalties for abusing their customers). Remembering of course that the typical cost to companies making when they settle with "credit protection" is much lower than the already low $30 individuals would have to pay.

I'm also tired of newspapers parroting press releases that say things like "sophisticated, malicious criminal attack". Just like a few years ago every publicly exposed+default password service was compromised by "Nation state attackers", and before then "Advanced Persistent Threats". If you make a claim like this, you should be required to provide the full details of the attack:

\- what level of employee account was compromised, and if none was needed, why not? Otherwise, did the targeted employee need the level of access that the attackers used? If not, why did they have it? Simply being a C-level executive does not imply requiring access.

\- Did it make use of any software exploits? If it did, were those exploits fixed in the release versions? If those exploits were fix in released software, why was that out of date software being used?

\- Is your company using established best practices: 2FA for all accounts, TLS for all networking, service isolation.

\- Did the compromise come about due to loading content from a third party? If so, how was that code authenticated (multiple browsers support SRI)? Was that code used to support the site functionality, or was it for tracking or advertising?

This seems like a perfectly reasonable bare minimum if you want to support a claim that the compromise was unavoidable.

</comment><comment><USER22> Do the regulators take into account whether the firm is actually at fault?

Without considering what happened in this specific scenario, surely there are cases where companies take the utmost care, follow standard security principles and still get hacked; or the issue was not with the company operating the website but rather with, say, a hardware manufacturer?

<comment><USER23> They do in some form. Largely though, "regulator" action tends to be outcome based. Relying on "standards" can be difficult. In some caes, standards exist and ignoring them can point to negligence. Conversely though, standards don't exist for a lot of things and when they do, they're not a full solution. IE, it's possible to follow "standard security practices," while still being insecure. If regulators make that a "get-out"... you may as well just have legislation instead of a regulator.

In recent times, regulators and legislators don't understand the problems (maybe no one does) sufficiently to be specific with rules. They demand general things, outcomes (you will not lose data) and general operating principles (you will secure your users' data , have good policies, and enforce them).

Both data protection (eg gdpr) and anti money laundering rules are examples of recent areas that work this way. If a bank's customer has been depositing stolen money, financing terrorism or something... the bank is at risk. Their policies will be examined and circumstances do get taken into account, but the "standards" they're judged against aren't absolute and standards compliance doesn't totally protect them. OTOH, if they don't adhere to their own policies or the policies are bad... it is enough to get them in trouble.

Lawyers, btw, hate this emerging system.

In short, modern "regulator enforcement" is a lot less legible & "letter of the law" oriented than legal environments that we are going used to.

<comment><USER17> This is far from being a new development in Europe. Regulators have never been a strict rule interpretor

</comment></comment></comment><comment><USER24> Excellent. Now I wish they pick another big corporation (just pick one) and hand them a similar fine for using a standard GDPR opt-in-by-default popup.

They need to make it clear through _action_ , not just vague wording, that having a default of allowing all tracking is not ok.

Pop ups should say "hi and welcome to site X. Click the yelliow button to enter with tracking/personalization and the blue button to enter without".

<comment><USER25> The company I work for explains it to our customers that we can't enable any tracking cookies, analytics, external chat scripts and other external scripts unless visitor opts in. I explain that it is against the law and they back down.

Sadly not many people in the industry realize it and they keep doing whatever they were doing for years.

</comment></comment><comment><USER26> Websites need to really up their game, specially given the amount of third- parties they are using.

I've tried highlighting similar issues in the past, where even if there is no active breach, but they are leaking sensitive data to multiple third-parties when it's not needed in the first place.

[https://dev.to/konarkmodi/watching-them-watching-us-how- webs...](https://dev.to/konarkmodi/watching-them-watching-us-how-websites-are- leaking-sensitive-data-to-third-parties-1nn3)

[https://news.ycombinator.com/item?id=16516687](https://news.ycombinator.com/item?id=16516687)

</comment><comment><USER27> Original source: [https://ico.org.uk/about-the-ico/news-and-events/news-and- bl...](https://ico.org.uk/about-the-ico/news-and-events/news-and- blogs/2019/07/ico-announces-intention-to-fine-british-airways/)

</comment><comment><USER28> Is there a good reason for them not to launch a bug bounty program?

The cost of doing so would be significantly cheaper than any future fines, and would reduce the chances of future breaches.

</comment><comment><USER29> "amounts to 1.5% of its worldwide turnover in 2017"

I imagine that's a significant sum but I'm struggling to get my head around it. If so then good for the ICO I suppose. I remember reading endless comments a few years back speculating GDPR would never have any bite.

<comment><USER30> The maximum fine of 4% of parent company IAG's turnover would have been almost €1bn.

</comment></comment><comment><USER31> Is good that we see on the font page of HN more GDPR fines for non US companies because I seen a lot of US users accusing that only US companies are targeted(there are other non US examples but those did not appeared or stayed on the first page here on HN ).

<comment><USER32> Yes, there was always that weird nationalist claim that GDPR was just a protectionist measure rather than a sincere attempt to achieve its stated aims.

</comment></comment><comment><USER33> So who gets the money? The people who had there data stolen?

Who gets the money are the people who create laws. The more crimes commited, the safer there jobs are. The people who had there data stolen, are now on a register sold to the insurance industry, and the insurance industry decides they are a greater risk to insure, so the costs to the consumer go up. Strange how crime really drives the economy.

<comment><USER30> The Treasury. Fines are sent to the Consolidated Fund (the government's general account at the Bank of England).

<comment><USER34> From the article:

        Where does the money go?

        The penalty is divided up between the other European
        data authorities, while the money that comes to the
        ICO goes directly to the Treasury.

So it seems most of it will go to other European data authorities.

<comment><USER30> Ah thanks, I missed that. It usually all goes to HM Treasury but this is a joint operation between multiple EU supervisory authorities.

"ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR 'one stop shop' provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO's findings."

[https://ico.org.uk/about-the-ico/news-and-events/news-and- bl...](https://ico.org.uk/about-the-ico/news-and-events/news-and- blogs/2019/07/ico-announces-intention-to-fine-british-airways/)

</comment></comment></comment></comment><comment><USER35> This is a death knell for BA, my friends father is a high level manager and if he's to be believed they are running on major thin margins.

Mostly due to compensating employees fairly in the 90's-early-2000's. Now they're desperately trying to remove those compensation packages.

Although it could just be cost aversion masquerading as a hard requirement.

<comment><USER10> BA has becoming a low cost carrier over the last 10-15 years and make a large profit from it. They're trading on their past glories and failing to innovate.

Last time I traveled BA in first it was shocking, rude crew, dirty seats. FinnAir in Business on the other had is a joy to behold.

I used to hit 2500 tier points a year on BA metal, I barely make 300 now, just occasional short flights in europe, but they've doubled-down on the 737 max, so I guess that will end soon too.

<comment><USER36> >Last time I traveled BA in first it was shocking, rude crew, dirty seats. FinnAir in Business on the other had is a joy to behold.

It seems like the American and European airlines are all going down the tubes, unless you shell out for business class on certain ones. The Asian airlines are the best ones these days; you don't have to pay extra for a first-class or business-class ticket to get superb service and cleanliness there.

</comment></comment></comment><comment><USER37> Too bad this will all go to the state and not to any of the people who were actually damaged in the breach. :/

<comment><USER38> The state is made up by the people it represents so by this, society benefits as whole.

<comment><USER37> Not only is this false in the national sense, as the machinery and personnel of the state are not coterminous with those they rule over, but it is also false in this specific sense, as many of the people who were harmed by this breach (such as myself) were not involved or are not permitted to be involved with the regulatory body that is assessing this fine.

Many people who are not British subjects are customers of BA.

The ICO does not represent me, yet somehow they are getting paid for the misuse of my data.

It's nice work if you can get it.

<comment><USER39> The fine is not there to repair the damage made to individual customers. The fine is there to punish the Corp for its bad practices, and to scare other Corps into having good data protection practices. It's a punishment and a deterrent.

If you want personal compensation, free to sue BA.

<comment><USER40> From the article:

> Where does the money go?

> The penalty is divided up between the other European data authorities, while > the money that comes to the ICO goes directly to the Treasury.

> It is up to individuals to claim money from BA, which provided no > information on whether any compensation had been paid.

So you are right.

It would be nice if a portion of the money goes back to ICO, so they can grow and have a chance to focus on smaller fish as well.</comment></comment></comment></comment></comment>