What happens when you update your DNS - <AUTHOR> https://jvns.ca/blog/how-updating-dns-works/ <comment><USER2> One of my favorite revelations about the network tracing tools (things like `traceroute` and `dig +trace`) that might not be obvious for people like me who work higher up in the stack, is that the data they provide isn't usually made available during "normal" usage. Packets don't just phone home and tell you where they've been. Something else is going on.

When you send a DNS query to a recursive server like your ISP's or something like 22.214.171.124, you make a single DNS query and get back a single response, because the recursive DNS server handles all the different queries that Julia outlines in the post. As the client, we have no idea what steps just happened in the background.

But when you run `dig +trace`, dig is actually _pretending to be a recursive name server_ , and making all those queries _itself_ instead of letting the real recursive name servers do their work. It's a fun hack but that means it's not always 100% accurate to what's going on in the real world [0]

[0] [https://serverfault.com/questions/482913/is-dig-trace- always...](https://serverfault.com/questions/482913/is-dig-trace-always- accurate)

<comment><USER3> Traceroute's trick is amusing. It abuses the TTL field, sending out packets with too-low TTLs and waiting to see who complains about them. When layers reveal themselves they are doing it voluntarily, and those wise to the game can choose not to participate, or to troll it.

[https://www.theregister.com/2013/02/15/star_wars_traceroute/](https://www.theregister.com/2013/02/15/star_wars_traceroute/)

<comment><USER4> It's not abusing the TTL, it's working as designed

<comment><USER3> AFAIK the design purpose of TTL is to prevent an infinite loop in case the route contains a cycle.

</comment></comment></comment></comment><comment><USER5> Glad to see this. One of my (stupid) pet peeves is people that say "You have to wait for the DNS to propogate". DNS _does not_ propogate. What you're actually waiting for is the cache TTL to expire so those name-servers that have cached it have to query the real answer again, thus getting the newly pushed information. Of course it appears exactly like it "takes time to propagate" which is why it's actually a pretty sound description of what's happening, and thus why it's a stupid pet peeve. Pointless rant ends.

<comment><USER6> Yes, I'm annoyed about this too.

The most egregious case I've seen was an Amiga site. The site went down and for several _days_ reported that users would need to wait for the updated records to propagate and lots of loyal fans were insisting anybody who couldn't read the site was just being too impatient.

What was actually wrong? They wrote their new IP address as a DNS name in their DNS configuration rather than as an IP address. Once they fixed that it began working and they acted as though that was just because now it had successfully propagated.

On the other hand propagation _is_ a thing when it comes to distributing modified DNS records to multiple notionally authoritative DNS servers.

This can be a problem for using Let's Encrypt dns-01 challenges for example, especially with a third party DNS provider.

Suppose you write a TXT record to pass dns-01 and get a wildcard certificates for your domain example.com. You submit it to your provider's weird custom API and it says OK. Unfortunately when you do this all it really did was write the updated TXT record to a text file on an SFTP server. Each of the provider's say three authoritative DNS servers (mango, lime, kiwi) check this site every five minutes, download any updated files and begin serving the new answers.

Still they said OK, so you call Let's Encrypt and say you're ready to pass the challenge. Let's Encrypt calls authoritative server kiwi, which has never seen this TXT record and you fail the challenge.

So you check DNS - your cache infrastructure calls lime, which has updated and gives the correct answer, it seems like everything is fine, so you report a bug with Let's Encrypt. But nothing was wrong on their side.

Now, unlike typical "DNS propagation" myths the times for authoritative servers are usually minutes and can be only seconds for a sensible design (SFTP servers is not a sensible design) so you can just add a nice generous allowance of time and it'll usually work. But clearly the Right Thing™ is to have an API that actually confirms the authoritative servers are updated before returning OK.

<comment><USER7> > So you check DNS - your cache infrastructure calls lime, which has updated > and gives the correct answer, it seems like everything is fine

Been there, done that, got burned. If you're mucking around with DNS records that are going to be verified by someone else, never trust your local lookups, always try to verify through a fresh third party that everything resolves correctly _before_ you submit.

Because oops, something went wrong, the verification hit a wildcard entry with a cache time of days, and now you have to wait that long before trying again, because that entry isn't budging from other resolver's caches...

<comment><USER8> Yeah, flushing the cache in your own recursive resolver doesn't flush them all over the internet.

</comment></comment></comment></comment><comment><USER9> [https://howdns.works](https://howdns.works) is one of my favorite educational booklets on the subject. Not as in depth as many other resources, but highly amusing and fairly sticky.

<comment><USER10> This is brilliant thanks.

</comment></comment><comment><USER4> There is a very elegant way to update your DNS if you are running djbdns: You can optionally specify date ranges for every record![1] The server will automatically adjust the TTL. By having two records with different time ranges you can switch IP addresses at an exact moment.

The timestamps are provided in DJBs TAI64 format, use something like [https://github.com/hinnerk/py-tai64](https://github.com/hinnerk/py-tai64) to convert them.

[1] config file spec at [https://cr.yp.to/djbdns/tinydns- data.html](https://cr.yp.to/djbdns/tinydns-data.html)

</comment><comment><USER11> DNS infrastructure is really interesting. I did a bit of a deep dive on it a few months ago, culminating in running my own authoritative name servers [0] for a while.

[0]: [https://www.joshmcguigan.com/blog/run-your-own-dns- servers/](https://www.joshmcguigan.com/blog/run-your-own-dns-servers/)

<comment><USER12> One neat way of retaining that control is running your own SOA(s), but getting robust secondaries and listing _those_ in WHOIS so that they take all of the wild queries. Then you just work with your little SOA and everything just propagates as necessary and you don't get hammered.

</comment></comment><comment><USER13> This reminds me that I wish DNS had some way to define a load balancing algorithm for clients to use, so browsers could make load balancing decisions. This would eliminate the need for virtual IP addresses, having to pass originating subnet information up recursive queries, having to remove faulty VIPs (or hosts) from DNS, etc.

It is baffling to me that inside the datacenter, I can control the balancing strategy for every service-to-service transaction, but for the end user's browser, all I can do is some L3 hacks to make two routers appear as one (for failover purposes). L3 balancing would be completely unnecessary if I could just program the user agent to go to the right host, after all. The end result is unnecessary cost and complexity multiplied over a billion websites.

<comment><USER14> That is a use of SRV records [1], however it was not accepted into the HTTP protocol specification. I bring it up every time there is a new protocol version but I am too lazy to write an RFC addendum for it and hope that someone else will. Existing protocols may not be modified in this manor once ratified. Maybe HTTP/4.0? /s

Some applications use SRV records for load balancing. Many VoIP and video conferencing apps do this. There is a better list on Wikipedia.

        _service._proto.name. TTL class SRV priority weight port target.

[1] - [https://en.wikipedia.org/wiki/SRV_record](https://en.wikipedia.org/wiki/SRV_record)

<comment><USER13> Yeah, I always liked SRV records. It seems that they proved inadequate for gRPC balancing, so there are new experiments in progress (mostly xDS).

</comment></comment></comment><comment><USER15> Another cool thing about DNS - you only need the IP of a single root server to be able to get the nameservers, IPs and everything else to resolve any name in any TLD. The hierarchical nature of DNS is very neat to see in action. I built a toy DNS checker tool[0] while I was learning about it to get a more visual overview, and it ended up being one of my tools I still use every few days to verify a domain is properly delegated if I suspect it has issues.

[0] [https://r-1.ch/r1dns/](https://r-1.ch/r1dns/) (and yes it has a lot of bugs, don't break it :)).

<comment><USER16> Off topic,

you wouldn't be the R1ch of old something awful forums fame, would you? I used to run a waffleimages mirror :)

<comment><USER15> Yup, that's me! The SA forums inspired a lot of my random side projects, the TF2 server integration stuff was especially fun (got me into reverse engineering Valve's game .so to fix bugs). I miss those days when I had all the free time in the world :).

</comment></comment></comment><comment><USER17> " _What I'd expect to happen in practice when updating a DNS record with a 5 minute TTL is that a large percentage of clients will move over to the new IPs quickly (like within 15 minutes),_ "

That's not true. The vast majority of clients will move to the new IP within the TTL, within 5min (not 15min). Then there will be some stragglers that slowly update over the next hours/days (typically poorly written bots)

Source : my own experience updating a site with 500k hits per month and sniffing and watching network traffic at the 3 endpoints: DNS, old IP, new IP.

<comment><USER18> Or any proxy using default nginx configuration which caches DNS resolution for upstream blocks at first use and never invalidate until the config is reloaded or Nginx restarted.

</comment></comment><comment><USER19> How distributed is DNS these days in practice, compared to 10 or 20 years ago?

If the major internet powers agreed to stop serving responses to DNS servers they detected weren't respecting reasonable TTL's, do you think they could "bully" the industry into tightening things up? (Kind of how Google and others compelled the web toward widespread HTTPS)

<comment><USER20> I'm not sure why people don't run their own caching server instead of stubs. Or at least for the LAN? You don't _have_ to use your ISPs DNS servers, unless they are evil and capture port 53.

</comment></comment><comment><USER21> Recursive DNS servers can also throw you off the scent a bit by giving you an answer that is not the same as the authoritative server.

I've seen 220.127.116.11 return something other than NXDOMAIN for some domains that do not exist

Cloudflare will not honour dns ANY requests

Knowing how to query the authoritative nameservers is a handy tool for debugging.

<comment><USER22> Agreed. There's a lot of 'magic' that goes into running a quality recursive resolver, least of which is eDNS0 and EDNS Client Subnet - which intentionally returns different answers based on the requester's source IP -- in most cases for the most-optimal CDN location to be returned.

Test with:

dig @ns1.google.com www.google.es +subnet=220.127.116.11/24

dig @ns1.google.com www.google.es +subnet=220.127.116.11/16

Note how you get different IPs returned.

<comment><USER23> Here's a pretty clear demo of different results around the world: [https://wheresitup.com/demo/results/5ef1403cb8e31e3fb3298503](https://wheresitup.com/demo/results/5ef1403cb8e31e3fb3298503)

</comment></comment></comment><comment><USER24> As someone newly trying to learn DNS, I don't _use_ 18.104.22.168 personally. So I was confused at first why they kept offering it up on the page. It might help in the first reference to it, so say 'Google DNS' along with the 220.127.116.11

<comment><USER25> 220.127.116.11 is Cloudflare. 184.108.40.206 is Google 22.214.171.124 is PCH/IBM as Quad 9. They all also offer IPv6.

</comment></comment><comment><USER26> I have an idea: Because DNS requests are made from a server close to the user, the TLD should use a GEO table in order to give the the two closest DNS servers. Kinda like Anycast without having to configure routing/BGP sessions.

<comment><USER8> A lot of DNS infrastructure is anycast.

<comment><USER26> Yes. But most domains eg. websites dont have Anycast. And Anycast is expensive if you just have a private web site or blog. And Anycast services have poor coverage, its only clodflare that has decent coverage. But they only offer proper DNS service to enterprise customers.

<comment><USER8> > But most domains eg. websites dont have Anycast.

Are you talking about the (mathematical) "domain" in the DNS specs, or the popular domain i.e. the web server?

The latter is arguably true, in which case the geoip proposition is moot: there is only one web server. Maybe you mean the web server has multiple addresses instead of being anycast. Ok, yes that happens; and some DNS servers do use geoip to tailor replies to try and hand the closest address. Here is from tbe BIND ARM:

"By default, if a DNS query includes an EDNS Client Subnet (ECS) option which encodes a non-zero address prefix, then GeoIP ACLs will be matched against that address prefix. Otherwise,they are matched against the source address of the query"

Regarding the former, does anyone have info on how many DNS providers use anycast? I think a lot; or maybe I should say that a lot of domains are hosted on anycast, the DNS isn't as distributed as it used to be. If you're using DNS as a distributed key/value store, I hope you're doing a better job thinking about externalities (leakage) than e.g. the antivirus companies in terms of locating authoritatives and how you update them opaquely.

Personally I think stub resolvers are stuck in the 1980s. They could do a lot more by monitoring traffic health and editing DNS replies. Due to peering arrangements you could be in the same IX as someone else but that might not be the best route. Traceroute, SYN exchanges, (IP) TTLs might be better signals for determining the health of a particular path. I'd never thought about it until this thread started, maybe the stub resolver could use netflow analysis to inform editing the responses it returns to the applications.

<comment><USER26> DNS getting less distributed is a problem, as public DNS services generally do not hold a cache for long. They also give up if it's unlucky and tries a DNS server that is down!

So my case for top level (TLD) GeoIP: I have many DNS servers for my web- address/domains: Three in EU and two in US. The problem is that when the TLD servers sends the list of DNS servers it's randomized. Instead I want it to return the list in GEO order (and also network health order), so that the recursive resolver ask the best/closest DNS server. So in worst case scenario for a recursive resolver in EU tries a DNS server in USA, and it happens to be down, and then gives up. The best case scenario is that it tries the closest server in EU.

Trying to solve my problem I've tried the top 10 DNS providers (ranked by uptime and query speed), which uses anycast. Only two could be used as secondary/slaves, and both of them took over two days to propagate an update (they did not use TTL). The reason why I need fast updates is because of Letsencrypt which requires DNS challenges for wild-star domain SSL/TSL.

About anycast use, the root server's have been using anycast for a while now. Some TLD's use anycast I think (haven't actually checked). For web-hotels, and ISP's most do not use Anycast. ISP however have the DNS server's very close to the end users and they are good at caching. Which is the second reason why I'm against DNS centralization. Querying from example 18.104.22.168 is often 10x _slower_ then using ISP DNS (assuming the ISP have the query cached).

Anycast, although proven to work nice for the root servers, which makes it harder to DDOS-attack, doesn't actually work that great. I argue they could just list the servers in GEO order instead of configuring BGP routes. When I evaluated the "top 10" Anycast DNS providers, sometimes my amateur setup got lucky (eg test server from US got the US IP first and vice versa) and thus beat the Anycast network in query performance/latency.

<comment><USER8> > So in worst case scenario for a recursive resolver in EU tries a DNS server > in USA, and it happens to be down, and then gives up.

Recursive resolving algorithm for caching servers is actually addressed in the RFCs, it /should/ be trying all of them and using its own findings to prefer the best-performing one(s). But it doesn't know about anycast, if a recursive was switching between anycast nodes (with the same address) then that would imply that routes were flapping. :-(

Interesting data points.

I think the elephant in the room is the Universal Terrestrial Radio Access Network (UTRAN) a.k.a. "mobile" and I don't work with provisioning much so all I can say is that I suspect that if mobile is your concern you just prostrate yourself to the UTRAN masters and co-locate wherever they tell you to.

SSL/TLS cert management is a fiasco in my opinion, it's a shame that DNSSEC hasn't achieved market dominance so that if you own a domain you can automatically sign certs for it yourself. (Then we wouldn't need CA lists in browsers and OSes either.)

</comment></comment></comment></comment></comment></comment><comment><USER27> The title "update your DNS" looks ambiguous</comment>


Linus: C++ is a horrible language - <AUTHOR> http://article.gmane.org/gmane.comp.version-control.git/57918

<comment><USER2> I tire of having this rant being posted every three months on HN.

Linus is just having a strong reaction, the rant is more than four years old, Linus says nothing interesting about C++ and the same could be said about so many languages that its sad.

Additionally, any post about "this language is teh suxxance" - even when written by someone worth of attention - is generally full of nothing and adds little value to a community.

<comment> loup-vaillant Like this one? :-) <http://www.loup-vaillant.fr/articles/classes-suck>

<comment><USER2> Especially when both const and mutable exist in C++. ;)

<comment> loup-vaillant Just to be clear "mutable" in C++ do not mean what I want it to mean. Actually, it makes things even worse.

Thanks for pointing out the ambiguity, though. I'll try and fix that (that won't be easy, "mutable" definitely is the best keyword for what I want to express).

(Yes, I wrote that article, and I am _dead_ serious. This is also not a random rant. I wrote other articles to back that up: <http://www.loup- vaillant.fr/articles/> Note that I don't attack any particular language here, but an entire class of them.)

</comment></comment></comment></comment><comment><USER3> Nothing in there that isn't true of other languages, C in fact. Can write crap in anything.

Usual rant from a newbie C++ developer.

The guy did marvelous things; his opinions about languages are not his expertise, and not worth wide discussion.

<comment><USER4> I have 20 years of experience in C++. C++ makes me more productive.

If I understand correctly, Linus is saying something I agree with: a bad programmer using C++ will write code that is harder to maintain than code written by a bad programmer using C.

Bjarne Stroustrup once said, "C makes it easy to shoot yourself in the foot; C++ makes it harder, but when you do it blows your whole leg off."

In his FAQ, he expands on this point: "What people tend to miss, is that what I said there about C++ is to a varying extent true for all powerful languages. As you protect people from simple dangers, they get themselves into new and less obvious problems. Someone who avoids the simple problems may simply be heading for a not-so-simple one. One problem with very supporting and protective environments is that the hard problems may be discovered too late or be too hard to remedy once discovered. Also, a rare problem is harder to find than a frequent one because you don't suspect it."

In my view, Linus is agreeing with BS.

</comment></comment><comment><USER5> The essence of the rant (which I agree with) is that it's not about the language, it's about the culture associated with it.

You can write horribly structured code in C, probably more easily than in C++. And some people do. But most C programmers read K&R at some point, or maybe even some Linux kernel code, and so they end up valuing a style that emphasizes clarity and simplicity.

If anything, the sheer easiness of shooting yourself with C puts on a Darwinian pressure that causes long-term C developers to either adopt this culture or switch to something else.

</comment><comment><USER6> > _On Wed, 5 Sep 2007, Dmitry Kakurin wrote:_

At the very least Dmitry can now add to his resume that he is full of BS as per Linus Torvalds. I would've _loved_ to have that on my resume if I were applying for the C jobs :)

<comment><USER7> Why? This wasn't meant as a compliment...

<comment><USER6> It makes the resume stand out in the crowd. I know I would've invited the guy in, especially if he'd presented Linus' assessment ironically. That's why he needs to apply for a _C_ position for this to work the best :)

</comment></comment></comment><comment><USER8> Every programming language is horrible, that's why programmers exist

</comment><comment><USER9> God, I want a HN page that worked like Digg, where when you flag items they disappear, and you don't have to keep looking at them all day.

<comment><USER10> You might be interested in hn-zero, a chrome extension I wrote that makes articles on the HN homepage disappear after reading both the article and comments, or hitting a small X by the article.

<https://github.com/ddgromit/hn-zero>

</comment></comment><comment><USER11> _the only way to do good, efficient, and system-level_

That's the key restriction from Linus right there. He was talking about system-level code.

For everything else (application-level, frameworks, etc.), you need the abstractions that C++ provides.

<comment><USER12> For applications and frameworks, other languages provide the abstractions in a less difficult to wrangle fashion. Ada is perhaps my favorite example but you actually don't even have to leave the C family -- Objective-C is very pleasant to use in such a role. (No, it's not just an Apple thing, I use it all the time for Linux and cross-platform code.)

</comment></comment><comment><USER13> No one is going to accuse Linus of not having an opinion. Reminds me of his rant on SVN. This is pretty baseless though.

<comment><USER14> Link to the SVN rant?

</comment></comment><comment><USER14> By his logic you should just write everything in machine code and be done with it...

</comment><comment><USER15> Wow. I don't think I've ever seen such a verbal smackdown from Torvalds himself.

<comment><USER16> He's famous for them, and delivers them with regularity. This is the guy that has said "your code is shit" on several occasions.

Linus is widely considered to be a nice guy, and he probably is. But make sure you've toughened your skin before posting to linux-kernel.</comment></comment>


A Promising Step Toward Round-the-Clock Solar Power - <AUTHOR> http://www.technologyreview.com/news/531141/a-promising-step-toward-round-the-clock-solar-power/

<comment><USER2> Very unclear; it says "The device" \-- speaking of the catalyst/electrode system that does the electrolysis -- "uses novel, relatively high-voltage solar cells to generate the needed electricity." Why? If you need a higher voltage, you connect more cells in series. Or, for experimental purposes, you connect to a transformer plugged into the wall.

I do not see why the special and apparently short-lived perovskite solar cells are a necessary part of a new type of electrolysis system.

</comment><comment><USER3> Not mentioned is the lifetime of the electrodes and whether that is accounted for in the efficiency calculations.

<comment><USER4> Actually it is mentioned. "For one thing, it only lasts a few hours before the solar cell performance quickly drops off."

Interestingly there is a class of water splitting enzymes that also use nickel and iron... Oxidative inactivation by oxygen is a big part of their loss of activity. NiFe hydrogenases are odd beasts too, their nickels are attached to sufurs and their irons are attached to carbon monoxides, although CO prefers nickels and S prefers iron.

<comment><USER5> Previous commenter is right - the quote you pasted is about the lifetime of the solar cell itself, not the electrodes.

Both are interesting and important. The article addressed only the lifetime of the solar cells.

</comment></comment></comment><comment><USER6> Sounds similar to work by Dan Nocera at MIT: [http://www.nytimes.com/2014/03/30/technology/the- artificial-...](http://www.nytimes.com/2014/03/30/technology/the-artificial- leaf-is-here-again.html)</comment>


Ask HN: where we can take ordinary users(not geeks)? - <AUTHOR>

For Epihu.com, Where to write announcements, gathering places, your thoughts and advice on this subject) p.s. we like geeks :) <comment><USER2> Your question is not clear.

<comment><AUTHOR> And now? :)

<comment><USER2> No, I still don't understand. Are you looking for advice on where to advertise for new users of your site? Are you looking for advice on sites complementary to yours that you can direct your users to? Or something else?

You say your users aren't geeks. OK. But what are they?

</comment></comment></comment><comment><USER3> heeeeyyy thaaats nooot a quuueessstiiooon</comment>


Google Will Pay You $20 an Hour to Babysit Its Self-Driving Cars - <AUTHOR> https://www.yahoo.com/news/google-pay-20-hour-babysit-170000563.html <comment><USER2> Interesting. Looks like Google is moving towards the right direction.

 _Babysitting_. Well Yahoo, instead of trolling, can try to focus on writing better articles :)

[http://www.theverge.com/2016/5/12/11668548/google-self- drivi...](http://www.theverge.com/2016/5/12/11668548/google-self-driving- arizona-hiring-operator)</comment>


Magic: the Gathering is Turing Complete - <AUTHOR> http://www.toothycat.net/~hologram/Turing/HowItWorks.html <comment><USER2> As a long-time MTG player, this is TOTALLY WILD. I love it.</comment>


Edward Snowden's lesson to both businesses and NSA - <AUTHOR> http://qz.com/92509/edward-snowdens-lesson-to-both-businesses-and-the-nsa-your-it-people-are-your-biggest-risk/

<comment><USER2> Is anybody else reading this guy's twitter account? He comes off like a _massive_ asshole, and he throws around his PhD like Officer Farva. Is this indicative of the people who run the country's intelligence community?

It feels like they have no sense of perspective for the rest of society; it's like they're saying, "trust us you nerds, the ends-justify-the-means." Do they not realize that this nation is democracy, and the country decides as a whole our course, not just a select few? Wonder what his opinion on Aaron Schwartz is.

<comment><USER3> After reading through some of his tweets, I find myself more confused than not. Bizarre name-calling aside, his views are pretty inconsistent.

For instance, in the tweets cited in the linked article, he repeatedly mentions that IT [dorks / weenies / etc.] have low status and wide access. This is in line with the general premise, and makes sense.

However, some of his other tweets paint a starkly different picture, namely one in which Snowden is a "poseur", and agrees with other commenters' disparaging comments such as "he probably only had access to a printer and copier" or "was given powerpoint 100 training and has delusions of grandeur".

<comment><USER2> I agree. It all comes off as super-defensive, 'you guys just wouldn't understand' rhetoric. Not to mention all the insider backslapping. And the consistent claims that Snowden defected to China is clearly taking the situation out of context. Terrible PR for their side of the argument, at least, but fascinating (if not terrifying) insight into a bit of the minds behind the curtains at the NSA.

<comment><USER4> Maybe it's damage control? "No you guys, there are definitely absolutely no true Americans who are against the NSA. This guy? Oh, this guy is a Chinese spy!"

<comment><USER2> Character assassination. They are going to try and rip Snowden apart. I don't think they'll succeed though.

</comment></comment></comment></comment></comment><comment><USER5> This is news? Your IT people have to have privileged access to your computers; they maintain security policies, they issue smartcards, they reimage hard drives. They have physical access to the machines. _Of course_ they are your biggest risk.

<comment><AUTHOR> 1) NSA had official policies in the 1980s/1990s which would have prevented individual sysadmins from having broad authority.

A few changes have happened: explosion in number of systems, decline in quality of NSA staff (due to better opportunities elsewhere) on the tech/IT side, increase in contractors (who also tend to suck), politicization (since in the 1990s there was no clear mission, and in the 2000s there was not as morally justifiable a mission).

The NSA IT people I've met in the 2000s would not be people I'd hire to do IT/security. The older "former NSA" people I know are people I would gladly work with.

2) It appears Snowden has somewhat overrepresented the level of access he had.

<comment><USER6> Re point 2: The PowerPoint that was leaked has TOP SECRET on it. That is one of the highest levels of access imaginable.

<comment><USER7> eeeehhhhh... not really. A surprisingly large number of people have TS clearances, otherwise he'd have been making even more money.

<comment><AUTHOR> I think the published numbers are 4.5mm clearance holders (mostly S or the DOE L; I've personally never met a C-holder); 900k TS+ (including TS/SSBI, etc.)

Essentially every military officer is S or better, I think, and virtually everyone in certain military units is S (IT, etc.) or in some cases TS (CI). That is a _lot_ of people. A lot of 18 year olds :(

</comment></comment></comment></comment></comment><comment><USER8> To be honest, when these things happen 6 out of 7 times I empathize with the 'disgruntled' IT guy more than the object of his revenge. IT is thankless and when smart people end up being forced to work for sickening immoral egos you can't expect it to end well. We're probably lucky that most of them use computers for their revenge and don't go for violence.

<comment><USER8> Oh, and the way these "blue badgers" talk is sickening. It's like they think they're the nobility or something. They should go join a monarchy if they want to act like they're the only ones who can make judgments or comprehend things.

<comment><USER2> They've already got it. It's called the NSA.

</comment></comment></comment><comment><USER9> This has been true for a long time, however I am wondering if there is an opportunity here.

Why do IT admins get full rights to read data? Their job is to get the systems running, but somehow right now this means carte blanche from a systems perspective. It is easier to build a tool like that of course.

The problem arises with configuration of access rights, whoever has edit rights on that config, controls the system. Nuclear launch procedures have the famous 2 keys sequence where at least two people need to be involved - even if this is only Hollywood, the idea itself is quite interesting.

In IT systems this would mean some sort of approval process where any risky operation would need to get requested and confirmed by another party. You want a full data dump? Wait a sec, care to explain why?

Of course this wouldn't be foolproof, but better than the systems today, no?</comment>


New metal is so hydrophobic it makes water bounce like magic - <AUTHOR> http://sploid.gizmodo.com/new-amazing-metal-is-so-hydrophobic-it-makes-water-boun-1680799039?amp

<comment><USER2> This is blogspam. Original source was discussed here yesterday: [https://news.ycombinator.com/item?id=8921655](https://news.ycombinator.com/item?id=8921655)

<comment><USER3> Thanks, we missed that one. Had the story not been discussed yesterday we would swap the url, but in this case we'll bury the post as a duplicate.

</comment></comment><comment><USER4> Better, non-gizmodo link:

[http://www.rochester.edu/newscenter/superhydrophobic- metals-...](http://www.rochester.edu/newscenter/superhydrophobic- metals-85592/)

<comment><USER5> Here is what the actual pattern on the platinum looks like:

[http://scitation.aip.org/docserver/fulltext/aip/journal/jap/...](http://scitation.aip.org/docserver/fulltext/aip/journal/jap/117/3/1.4905616.figures.online.f1.gif)

</comment></comment><comment><USER6> How vulnerable would this nanoscale etching be to damage? Would a scratch or abrasion ruin its hydrophobic properties?

<comment><USER7> Almost certainly. I would also expect contamination (finger oils, for example) to be a big issue.

(Source: I worked on and designed equipment for commercial scale-up of a nanoscale superhydrophobic coating process)

<comment><USER8> Would not water (or any other solvent's) movement cause a scouring action that would remove contaminates and keep the surface clean?

<comment><USER9> I was wondering what would happen if you turned on a firehose and just slammed it for a good length of time...how durable it would be? If they're planning to use it on the surface of an airplane wing -- curious how durable the surface is.

<comment><USER8> I was actually thinking about using this on the surface of titanium on a catamaran.

</comment></comment></comment></comment></comment><comment><USER10> From the paper [http://scitation.aip.org/content/aip/journal/jap/117/3/10.10...](http://scitation.aip.org/content/aip/journal/jap/117/3/10.1063/1.4905616) it appears they have modeled the pattern after the lotus leaf [http://en.wikipedia.org/wiki/Lotus_effect](http://en.wikipedia.org/wiki/Lotus_effect)

</comment><comment><USER11> This will work really well. Some leaves use this same mechanism to 'self- clean', which means that now we will have the ability to add the 'lotus effect' to man-made objects.

[https://www.youtube.com/watch?v=VHcd_4ftsNY](https://www.youtube.com/watch?v=VHcd_4ftsNY)

</comment><comment><USER12> Since reading Dune, I have been waiting for mankind to get around to making this. It was just a matter of time.

</comment><comment><USER13> Worst title ever, this is not a new metal any more than printed paper is new paper.

</comment><comment><USER14> About the plane wing applications... Wouldn't these micropatterns also have some kind of impact on aerodynamics? Not saying it's even a negative thing, but more research seems to be needed.

</comment><comment><USER15> Durability? reaction to other biological substances? I'm thinking of artificial heart valves and the necessity of preventing anything sticking for upwards of 50 years of continuous use.

<comment><USER16> Regarding durability, the article says

> Instead of using chemical coatings they used lasers to etch a nanostructure > on the metal itself. It will not wear off, like current less effective > methods.

<comment><USER8> Goodbye Teflon!

</comment></comment></comment><comment><USER17> Making a hydrophobic urinal seems like an interesting prank.

<comment><USER18> On the 2nd floor of Wean Hall at CMU somebody has sprayed a small patch of hydrophobic coating on one of the urinals (I think it's the 2nd floor, but definitely it's floor 2, 4, or 5). The stream normally turns into a "sheet" falling down the back of the porcelain, except around the patch -- where it hops off and turns into a thousand little droplets that bounce merrily down to the drain. Unless the person who put it there keeps re-applying it, the coating has had an impressive lifespan (at least 1 year in a semi-public toilet). Anyway, if you happen to be in the area (and male) you can try it yourself.

<comment><USER19> _the coating has had an impressive lifespan_

Probably isn't handled too much though.</comment></comment></comment>


The PlugBot: A covert penetration testing device - <AUTHOR> http://theplugbot.com/

<comment><USER2> FYI the device pictured is a SheevaPlug and is most of what is cool about this IMHO

<http://en.wikipedia.org/wiki/SheevaPlug>

This would be a fun project but it strikes me as a little lame that they want donations for what I imagine would be writing a few bash scripts.

<comment><USER3> We already use Sheevas for this and tons more. Taking the default debian, plugging in a usb stick and running snort is indeed a 10 minute operation.

For more elegance, use a guru plug with its dual gigE ports, turn it into a transparent bridge, and just put it inline with the ethernet cable of your target.

[http://www.globalscaletechnologies.com/t-guruplugdetails.asp...](http://www.globalscaletechnologies.com/t-guruplugdetails.aspx)

Once you realize you've got a fully capable linux server/router right there in the wall socket, all kinds of wild applications start springing to mind.

</comment></comment><comment><USER4> Pretty cool... and terrifying.

You could do something similar already by leaving behind an iPhone (with custom software) plugged in somewhere in the office. It could probably be less conspicuous than this thing.

<comment><USER5> Many moons ago I did something like this at a place I worked. Instead of a phone, I took the guts of a dreamcast running Linux and duct taped under the CTO's desk because he refused to stop claiming that our network was significantly more secure than it actually was (which is to say, he claimed it it was very secure, when in reality it wasn't secured at all).

Unfortunately, it didn't have the desired effect; and the network admin was pissed that he had to count all of the connection lights on the switches in the network closet once a week.

Rogue devices on your network are hard to detect and defeat.

<comment><USER6> Not if you know what you're doing. A good practice is to shutdown any switch interfaces that aren't in use. Once you've done that, you can implement a rudimentary access policy using MAC based ACLs. While a MAC based ACL won't prevent an attacker from gaining access to your network like a real authentication system (802.1X), it will help you notice the disruption. If you shut all ports that aren't in use, and you implement MAC ACLs, someone will notice the disruption. You'd have to unplug a network device in order to get an active port, and if you plugged in a hub, you'd have to spoof a MAC address, which would disrupt traffic to/from the device belonging to the MAC you just stole.

Even rudimentary measures can help secure a network to some degree.

<comment><USER7> If the PlugBot would have two Ethernet ports, working as a completely transparent bridge, shutting down ports and enabling 802.1X won't help much. Bot will just patiently wait for target to authenticate, then proceed with IP and MAC spoofing for its operations (filtering on the bridge).

802.1X-2010 and MACsec would address this issue, but they require more expensive hardware and not yet widely supported.

<comment><USER8> Reminds me of the Network Monkey <http://www.hak5.org/store/network-monkey>

</comment></comment></comment></comment></comment><comment><USER9> I know that this is just Sheeva hardware, but I think this application begs for a second Ethernet port. Then you could use it as a "tap," wouldn't need to find a an empty network port, could spoof the MAC of the device behind it, etc. Even better, put power over Ethernet in it and use it to replace the power injector already attached to that Polycom in the conference room...

<comment><USER3> This version has 2 gigE ports and only costs $20 more.

[http://www.globalscaletechnologies.com/t-guruplugdetails.asp...](http://www.globalscaletechnologies.com/t-guruplugdetails.aspx)

</comment></comment><comment><USER10> You could run tor hidden services on these things, to keep wikileaks afloat covertly. Install them above dropped ceilings, if possible.

</comment><comment><USER11> Is there a way I can actually get my hands on one ? I'd love to.

<comment><USER12> You can get the SheevaPlug DevKit for $99 ([http://www.globalscaletechnologies.com/p-22-sheevaplug- dev-k...](http://www.globalscaletechnologies.com/p-22-sheevaplug-dev-kit- us.aspx)). As far as the software they're using, it's not available yet but will be GPL (source: <http://theplugbot.com/about>).

</comment></comment><comment><USER13> This should be a Kickstarter project.

</comment><comment><USER14> It took me a minute. Apparently, I have a dirty mind...</comment>


Ask HN: Opportunity to earn a cut on every transaction. How big should my cut be? - <AUTHOR>

I have been asked to put a quote together for developing and maintaining a public web based application for a promising new startup.
Yesterday, I presented a "no strings attached" time and cost estimation for developing the initial version of the app. I took into account that the estimated cost might not fall into their budget and presented two alternatives. Their business model is primarily a transaction based one and is very sound. They have sole rights to distributing the virtual product/service and key retail vendors have come on board with letters of intent.
As I suspected, the quote did fall out of their budget range and at that moment I decided to bring forward the alternative somewhat "informal" proposals.
Option B.
My business owns the IP on the software. They use it and pay just for maintenance costs.
Option C. They pay less for the system and I get a piece of every transaction.
Today I found out that they really liked the Option C. Now that the two alternative proposals where informal, they want to see something on paper and then we can come back to the table thereafter.
As per Option C, what do you fellow hackers think would be a good deal? What would be a realistic percentage, per transaction, to ask for? (Taking into account that their business very strongly depends on the system I will build and maintain. Also I was very highly recommend for the job by one of their current business partners. :)) Also, how much less should I charge for building the system in relation to taking a cut in the transaction costs? (Is there maybe a ratio as a rule of thumb?)
Any suggestions greatly appreciated. <comment><USER2> A couple of thoughts:

(1) as a business owner I would be very wary of a perpetual cut, so I would cap it.

(2) since you're capping it you can demand a larger cut to ensure that you're repaid faster.

I would propose something that would enable you to earn ~2-3x your initial proposal cost over a period of approximately 1-2 years. Ultimately you're giving them a loan. This is "owner financed software development". Think about it in terms of interest rates and the cost of money, not in terms of becoming their partner.

Furthermore, you might find that you can secure collateral for your loan. For example, they agree to pay you over time and secure that opportunity with you by making you a secured creditor on their books.

<comment><USER3> Good advice. Make sure you recoupe your costs - unless you are prepared to carry some of the cost as a strategic decision for your company.

I am wary of the fact you say 'promising new startup'. I would err on the side of caution and assume it isn't the giant success they(/you) hope it will be.

As a result, I would spread the risk: \- Ask for a 'normal' payment, within their budget, trying to cover at least 50% of your cost estimate. \- Then be as daring as you may negotiating your transaction cut on the gross.

So, I would reduce my risk as much as possible - who knows if it will take off?

</comment></comment><comment><USER4> Whatever you do, try and get a (small, depending on volume) percentage of the gross, not net, on each transaction. Maintaining their margins is their job, not yours.

<comment><USER5> Most industries are not this bad, but reportedly, Hollywood is set up so that no motion picture ever produced is ever profitable. This was originally a corporate practice invented to screw over people contractually due a percentage of the net, but everyone went back to negotiating based on gross.

<comment><USER6> A less weasely example might be the company simply deciding to take a loss or very low margin at low volumes to enable faster growth.

That might make sense for them because they have an open ended upside. It doesn't for whoever makes a cut.

<comment><USER4> Any time you take a percentage of the net, you've set up a perverse incentive for the company to spend more money up to the exact point where they're not paying you anything. After all, for them, it's "free" money!

</comment></comment></comment></comment><comment><USER7> Factors to consider: (or, why nobody here can give you an answer)

1\. How much do you _need_?

2\. How much of a cut do you want?

3\. What is their established sales volume? (You can lower the percentage if sales volumes are high.)

4\. If none, what's their expected sales volume?

5\. What's their expected sales growth rate?

6\. What is your estimate of their numbers being accurate? (i.e. Cut their expectations by 30% and see if it still works for you.)

7\. How much time (in actual $ per your hourly rate) are you expecting to put in on this project?

8\. How much time x 30% are you expected to put in?

9\. How much is that IP worth to you?

10\. How much is it worth to them?

11\. How much is it worth to others?

Answer those questions, and then it's just a matter of relative comfort. There's no set formula here, your cut is as big as you want, and as big as they want it to be. IMO, set properly, Option C is the best for you, because eventually, you'll have income for no work. That's the reward for the risk you're taking in not being compensated up front. Make sure that reward exists.

</comment><comment><USER8> If you give them ownership of the IP with Option C, then you should ask for a bigger piece of each transaction in your contract, ... keeping in mind they may choose not to renew with the same terms at the end of the contract term (1 year?).

If the software is so integral to the success of the project, you might negotiate shared ownership of the IP, so you get something if they sell it.

</comment><comment><USER9> There's two ways to do it:

1) Go simple - affiliate fees in ecommerce range from 4-8%. Pick a number you're comfortable with and use that.

2) Do the math - estimate their revenue per year/month/week, do a Net Present Value calculation, using a discount rate based on the fact you're getting paid over time, and the fact that you may never get paid. Divide your quote for option A by the NPV, and that's your % to ask for.

</comment><comment><USER10> i would charge something that "should" recoup your "no strings attached" cost estimate within the 1 to 3 years range. and if that doesn't include maintenance, tack that in there too.

might require you to get them to provide you some data and growth estimations.

<comment><USER11> I haven't done this myself, so I may be wrong; but wouldn't it make sense to also figure in some cost inflation due to the fact that he is now assuming their risk as well?

If this was an existing company with solid financials, what you are saying makes 100% sense... But this is a startup; there is a reasonably high chance that they won't be around after a year. Like I said; this is way outside of the realm of things I have experience with, so I could be totally off base.

<comment><USER10> definitely true. which is why i said 1 to 3 years, and i never said anything about stopping charging that rate after you recoup the costs.

there's quite a difference in the rate if you're aiming to recoup the cost in 1 year as opposed to 3.

on the one hand, you want to get paid. on the other, if you're going to be getting paid by a % cut, you don't want your % to be so high that it drives a new, possibly fragile startup into the ground. if you ask too much too fast and they die, you'll never get the full total, instead of getting the full total and possibly more if you were comfortable with a slower rate.

<comment><USER11> That makes a ton of sense; thanks for following up. (It seems like pretty good advice, as well.)

</comment></comment></comment></comment><comment><AUTHOR> Another question that now comes to mind is dollar vs percentage? Would it be more beneficial to put flat dollar figure or go with a percentage? Percentage seems a bit riskier if evaluated against net profit. They could potentially right off large portion of the income as a cost to company. Especially that the company is a startup and needs t grow. Just to through another spanner in the works. :)

</comment><comment><USER8> With Option C, do they own the IP? If so, what prevents them from cutting you out of transactions once they are convinced it is working, and they don't need you anymore?

If you own the IP, then you should think of yourself as a partner. Take a big enough piece of the action to keep you motivated to work hard on the project, ... but you also want to make sure _their_ piece of the action keeps them happy and motivated to grow the business (and you get a piece of a growing pie of transactions).

I don't think you've told us enough to know which rule of thumb to apply.

<comment><USER12> _With Option C, do they own the IP? If so, what prevents them from cutting you out of transactions once they are convinced it is working, and they don't need you anymore?_

Presumably a contract!

<comment><AUTHOR> To confirm. Yes, they are leaning more towards a contract option (outsource) rather than IP. However they haven't written off the IP option fully yet. (If strong enough case, I could perhaps still turn this.)

</comment></comment></comment><comment><USER13> Ask your self how much you want a year.

Lets say 50k a year for your self = Z. So then ask your self how many sales are expected on the site within a given year = X.

And Y is your amount you should charge per item.

z/x = y. Shoot just a little low unless they are very happy with the idea. Tell them that over a certain period of time, if X exceeds your personal number, you will reduce your costs...

Seems fair and if they sell more, you get more... Each party wins.

</comment><comment><USER14> It really depends on what their profit margin and volume on the product is. If they make $0 in sales, then you get screwed even if they give 100%

<comment><USER9> It should be a % of their gross, not their net. Don't make the mistake of letting their profit margin determine how much you get paid.

</comment></comment><comment><USER15> Be careful. You should either be part of this company or get paid a set fee as a developer. Any other solution isn't stable. A company can't really survive with someone else owning its core IP (Option B), nor would they want to keep paying a perpetual cut for a product that you'll presumably complete/deliver at some point. If you want to go down Option C, take an equity stake.

</comment><comment><USER16> Maybe a tiered payment approach would also be good. Keep it cheap for them to market the system initially then once they get more transactions you can increase the cut.</comment>


Major Discovery: New Planet Could Harbor Water and Life - <AUTHOR> http://www.space.com/scienceastronomy/070424_hab_exoplanet.html

<comment><USER2> "posted: 24 April 2007 04:23 pm ET" ???</comment>


NASA does not deny the "over $2B" cost of a single SLS launch - <AUTHOR> https://arstechnica.com/science/2019/11/nasa-does-not-deny-the-over-2-billion-cost-of-a-single-sls-launch/ <comment><USER2> > If these costs are amortized over 10 launches of the SLS vehicle during the > 2020, the per-flight cost would be approximately $4 billion per flight.

and they go on to say

>Moreover, this is just for the SLS rocket's core stage, side-mounted boosters, and a basic upper stage. Developing and adding the Exploration Upper Stage will add hundreds of millions of more dollars.

5 billion might be the final dollar figure per launch. I figure Boeing will still be trying to get it off the ground while Elon is sending and landing ships on the Moon or Mars.

Nuts....</comment>


Riak Search 0.14 Release Notes - <AUTHOR> https://github.com/basho/riak_search/raw/riak_search-0.14.0/releasenotes/riak_search-0.14.0.txt

<comment><AUTHOR> This is the second release of the Riak Search product which is based on the main Riak system. You can think of this as a superset of standard Riak. Comes with all the standard Riak features plus search. Lots of bug fixes re. analyzer/tokenizer.</comment>


Estimating Value of Facebook by Paying Users to Stop Using It - <AUTHOR> https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0207101 <comment><USER2> 1) The $1000 is misleading because although it's an average, the median is considerably lower, around $100 in that case.

2) This shouldn't be surprising as it tells us most people don't care that much, and a few people 'really do' \- which is normal for most goods.

3) Since we're dealing with network externalizations, wherein the value goes up when more people use it (the value of FB is the network, less so the features) - then a lower price makes more sense. If all those people who bid $100 or less (say 2/3 of the population) quit FB tommorow, than those in the $1K range who 'really like FB' would probably leave as well, because their friends would not be there.

This gives us a hint that in product wherein the consumer surplus is not very evenly distributed - and there are strong network effects ... that the optimal price should be low.

4) Getting paid to leave is simply a different metric than having to get out your wallet to pay for something. Surely the authors know this but I didn't see it mentioned. 'WTP != WTL' i.e. willingness to pay is not the same as willingness to leave.

<comment><USER3> At 100$ median valuation, wouldn't that mean that facebook's value is inflated (the article states ~250$ per user)?

<comment><USER4> Facebook is valued by the stock market mainly by the profit it's expected to generate in the long run. (Other concerns move the stock price around in the short term, but for most large companies most of the time the stock price will be a good reflection on the consensus view on long term profits.) The value users get from Facebook is almost totally unrelated to profits generated, and therefore to the stock price.

<comment><USER2> "The value users get from Facebook is almost totally unrelated to profits generated, and therefore to the stock price."

They are _definitely_ related.

FB creates some kind of value - some goes to them in terms of profit, some goes to the user in consumer surplus.

As FB shows more ads, the consumer surplus goes down.

Obviously corps are the one paying, but value to consumers does matter.

</comment></comment></comment></comment><comment><USER5> Pretty interesting. I bet if you took that same group and said Facebook now costs 1000 a year to use they would all quit.

It's easier to spend money that wasn't in your wallet in the first place. It's when you start taking it out of the wallet that people react.

<comment><USER6> I suspect it'd depend entirely on whether facebook costs _everybody_ $1000/year, or _just them_.

If facebook costed _everybody_ $1000/year, I would definitely stop using it, because the network would be immediately broken since everybody would know everybody with any sense would stop using it.

If facebook only costed _only me_ $1000/year, I would know the network was still intact, and I would consider it.

<comment><USER7> The latter is a true hypothetical as US law prevents charging different rates to different users for the exact same product/service.

<comment><USER8> It does? There's quite a few counterexamples to that, such as airline fares, cars, etc.

<comment><USER7> The example above is Facebook charging a single person $1k/year while not charging other people. That's called price discrimination: [https://econsultancy.com/what-is-price-discrimination-and- is...](https://econsultancy.com/what-is-price-discrimination-and-is-it- ethical/)

It would be a slam dunk lawsuit.

You can still offer discounts (airline tickets, Adobe, etc.) or negotiate pricing (cars, etc.) legally.

But, it is illegal to isolate someone and charge them more without justification as in OC's example.

So yes, Facebook charging a single person $1k/year is a true hypothetical. It couldn't happen legally in the US.

</comment></comment></comment></comment></comment><comment><USER9> I don't know the economics terminology, but perhaps average people are just decent at exploiting opportunity? In this study a third party paid out the second-lowest amount to the bidders who bid the lowest amounts in return for deactivation. While no one competitor platform does everything of what Facebook's apps do, there are plenty of competitors they could make use of instead to replace particular single features or utilities of Facebook. The auction then becomes a game to bid an amount that's high as possible, yet still the lowest among the bidders, to actually win the bet. And instead, if Facebook raised prices from $0 to $1000 overnight, people would quit in droves, for the same reason: because dozens of comparable offerings exists at low or no cost that can take over subsets of the functionality in people's lives.

Given that airline overbookings use the same scheme to decide who flies and who gets paid and bumped to a certain, yet hazy-on-details future flight, perhaps this study simply tests humans' secret bidding strategies much more so than it tests the value people place on Facebook's utility.

One way to continue along this line of research would be to make people bid on giving up a much larger selection of social media services, with the exception of one, which would be their choice. They'd have to name their choice to keep. A second auction would then encourage them to name their price to give up that last one as well.

<comment><USER10> The optimal strategy in a second-price auction is to bid the true amount you're willing to pay (or be paid, in this case).

You can show that bidding higher or lower than this amount is dominated by bidding the true amount. If you bid higher than your true amount, this can only hurt you: You won't get any more money to stop using Facebook, because if you win, you get the second-lowest bidder's bid amount. It only makes a difference if you increase your bid _too far_ , and lose the auction.

If you bid lower than your true amount, you might win when you otherwise would not have won... but you underbid! You're not getting enough money to compensate you for the loss of Facebook.

See: [https://en.wikipedia.org/wiki/Vickrey_auction](https://en.wikipedia.org/wiki/Vickrey_auction)

Now, I could imagine that there might be a systemic bias towards overbidding, because people aren't good at valuing their cost of foregoing Facebook.

<comment><USER11> But given the lack of information, a person might reasonably try to make educated guessed about other people's bids. And often enough there's not _one_ price a person has, it's more of a range. The combination complicates the thought process: A person might think anything over $100 would put them out of the running, but is willing to accept as little as $60. Their goal is to maximize their price within that range. Then it's not as simple as choosing your "true" price, the thought process is about choosing the highest price within your range that you believe is less than someone else's. I guess you might say any price within the range is a "true" price, but it does complicate the optimal strategy to include a bit more thought than just a single value.

<comment><USER10> If I'm willing to accept as little as $60, then I should bid $60. If someone else bids $1000, then I get $1000. I don't do any better by anticipating their bid and inflating my own bid to $999. If they bid $61, I get $61, and because I value not-having-Facebook at $60, that means I get $1 of surplus value.

Anyone bidding higher than their minimum price doesn't fully understand the second-price auction. Probably lots of people don't understand it, which could lead to inflated bids. (but that doesn't mean you, knowing better, should inflate your own bid!)

<comment><USER11> ah, never mind then, I get it. I was thinking about backwards, or maybe sideways, but either way not right side up. Thanks for the explanation.

</comment></comment></comment></comment></comment><comment><USER12> > we consistently find the average Facebook user would require more than $1000 > to deactivate their account for one year

The Hackerati like to bemoan that most people don't value their privacy and will happily give it up to Facebook and Google, even suggesting that such people don't understand what they are giving up.

But maybe people _do_ value their privacy and _do_ understand what they are giving up - it's just that Facebook and Google offer something that is even more valuable than their privacy.

<comment><USER13> That's the same as the Liberty vs Security distinction for laws in society. Time and again average people with prefer to sacrifice the former for the latter.

<comment><USER14> You make it sound irrational or somehow wrong. When driving on public roads I give up a lot of liberty -- hundreds of rules, fees, mandatory insurance but it's well worth it. Not just because driving itself provides a lot of value but because driving is better for everyone, and in particular me being part of that everyone, with less freedom.

Even in the extreme case like HOAs that enforce lawn height requirements. Yes it's a little insane but it's what keeps the neighborhood valuable and your property value appreciating.

The average person is pretty darn rational. Who wouldn't trade away liberty if they're better off having done so?

<comment><USER15> "but because driving is better for everyone"

maybe "driving with rules", but driving literally kills via exhaust fumes. if you own a tesla, you've already dumped so much pollution into the air...

"it's what keeps the neighborhood valuable and your property value appreciating"

some people don't care about this stuff. they realise their time on this earth is too short to spend it on "lawn height requirements".

"The average person is pretty darn rational."

Humans aren't rational. At all. Reason is a rare tool. Case in point: the current advertising complex.

</comment></comment></comment></comment><comment><USER16> Paying somebody to don't use something free doesn't equal the value of the product.

If you would pay me each month to not listen to music on youtube, while being at work, it would be far more than I would pay to keep using it. It would be a damn shame if I couldn't do that anymore, but I would never pay the same amount to keep using it.

Edit: structure

<comment><USER17> Consider 2 scenarios:

A) I pay you $x per year not to listen to music on youtube.

B) I give you $x per year. Simoultaneously, Youtube starts charging $x per year to listen to music.

Is there much of a difference between them?

<comment><USER18> Yes, lots of differences: \- you can invest $10 for a month, get small profit and than start listening music \- you can sign-up for Spotify for $7 a month and get $3 back.

<comment><USER19> How are these differences? You can do this in either case.

</comment></comment></comment></comment><comment><USER20> There is a network effect to consider, too. The initial group may require $1k, but the asking price would likely drop as the remaining number of users does.

<comment><USER21> Obviously each little act of "stop using it" lowers the value of Facebook. If nobody uses Facebook, it has no value.

This is supposed to be a tool to estimate the value, not to get everyone to stop using Facebook: _how much do we need to pay a given user to stop using Facebook, provided that nobody else stops using Facebook?_

If we put a thermometer on every cubic millimeter of an object, we will probably significantly affect its temperature; but we don't do that; we use one small thermometer against a much larger object, so the transfer of heat between the two has a negligible effect on the temperature.

<comment><USER22> >> If nobody uses Facebook, it has no value.

I wish that were true, but if everyone stopped using Facebook they could still build shadow profiles for everyone, as they do for people that do not have accounts, and they could just sell this data out.

<comment><USER23> why would those shadow accounts be any useful (or accurate) if there's no active users to corroborate or contribute any information on them?

Facebook's value is derived entirely from the information generated from its user base.

</comment></comment></comment></comment><comment><USER24> > Though the populations sampled and the auction design differ across the > experiments, we consistently find the average Facebook user would require > more than $1000 to deactivate their account for one year. While the > measurable impact Facebook and other free online services have on the > economy may be small, our results show that the benefits these services > provide for their users are large.

That's pretty funny.

So I wonder what the average opioid addict would want in exchange for a year of daily withdrawal? Or even tobacco addicts. I've read that, in Germany after WWII, some people just about starved to death, because they'd traded too much food for tobacco.

</comment><comment><USER25> I don't really care about eating ice cream, but I'd need to be paid a lot to accept to not eat ice cream for a year.

Not because of the ice cream's value in my life, more because it's an unsolicited offer to sell my rights away. I have little reasons to sell, and I might want ice cream within a year, so you better pony up the cash to make it worth my time and inconvenience. However, it really doesn't mean anything about the value of ice cream.

<comment><USER2> "more because it's an unsolicited offer to sell my rights away."

Most people don't think in those terms.

Also, you're not giving up 'rights' you're willingly not doing something. You don't have a 'right' to Facebook anyhow.

I think what you might be getting with ice cram is the 'optionality' value.

Sure, you ate ice cream 20 times last year, but this year, maybe you're at your kids b-day party and want to eat with them! Or take a toor of some Irish Cream place with great ice cream. There's a big variability and unknown distribution of value, with a long tail in there that has to be accounted for. Often by instinct :)

</comment></comment><comment><USER26> From what I can tell the participants for the auctions came from:

>One hundred twenty-two Facebook users on the campus of a Midwestern liberal arts college took part in Study 1

>A third sample was recruited online through Amazon's Mechanical Turk (MTurk), an "open online marketplace for getting work done by others," where workers complete Human Intelligence Tasks (HITs) [40].

Thus the study sample populations were college students and people on Amazon Mechanical Turk who do Human Intelligence Tasks. I would guess that the Amazon Mechanical Turk also had a high number of college students. Based on the samples, I think that you can conclude that college students really like Facebook. How that actually translates into the general population is a different story.

</comment><comment><USER27> > our results show that the benefits these services provide for their users > are large.

Good god, you scientists can't tell the difference between value created ("provided") and value captured??

Put it a different way: how much would you have to pay people for them to miss announcements of important local events, miss photos and personal notes from their closest friends and family… of course, it's going to be a high amount. But those things all existed pre-Facebook. Facebook has just CAPTURED the value.

<comment><USER28> Those things were not free before Facebook. If you wanted to advertise the birthday of your two-year-old in the local newspaper with a picture and a cute greeting, you paid money. (Yes, people regularly paid for that kind of notices in newspapers.)

<comment><USER27> Bad analogy. Advertising your family update in the newspaper is more like having a blog. It's a totally public-focused thing. While Facebook has a lot public, it's really focused on direct stuff of interest to your connections.

People used to mail photos to one another or send letters. With digital technology, that's emails. Facebook doesn't get credit for the switch to the internet and digital formats.

By design, Facebook pushes people to share photos _only_ on Facebook and forget to email others.

Want a test? What's your hypothesis for the following:

"How much would I have to pay you to cancel your Facebook account _if_ I made sure that your closer family and friends and other communities you care about all sent updates to you by email instead?"

<comment><USER28> Personally I'd hate it if my cousin sent me her vacation pictures by email, but I'm perfectly happy to take a quick glance at them while scrolling by in the FB feed.

But that's beside the point. There's something you're missing about the local newspaper analogy: it's that Facebook works great for communicating and sharing within groups of similar size to "people in my small town community who give a shit about my daughter's birthday".

<comment><USER27> Except that FB is actually tragically awful at these things because the way the algorithm is a black box that always changes, you don't have anything reliable about who sees what… and to really promote something so people see it, you PAY for it to be boosted, so it's no better in that sense than the old newspaper analogy!

Let me tell you a personal story: My sister is one of those people who just throws stuff up on FB like anyone else. People not on FB miss it. A couple years ago, someone inspired her to send a personal email to close family just sharing updates about what's happening with her and inviting others to reply the same way. It _immediately_ felt more personal and meaningful and brought out different context and closer relationships compared to anything that happens on Facebook. It died away after a little bit because we failed to keep up a routine… but I predict that if your cousin sent you vacation pictures _not_ in a just "email everyone" sense but in actually thinking of YOU, it would actually feel good and bring you together in a more meaningful way… but I don't know you or your cousin, of course.

</comment></comment></comment></comment></comment><comment><USER29> Loss aversion is probably a major factor [0]

It's well known that people demand disproportionately larger compensation for giving something up than they would pay to gain said thing.

[0]: [https://en.wikipedia.org/wiki/Loss_aversion](https://en.wikipedia.org/wiki/Loss_aversion)

<comment><USER30> I think that the endowment effect may be the more relevant behavioral economics concept here.

[https://en.wikipedia.org/wiki/Endowment_effect](https://en.wikipedia.org/wiki/Endowment_effect)

</comment></comment><comment><USER31> If people estimate the value of the benefit provided by Facebook to be $1000, under US tax law are they required to declare that as a "gift" and pay taxes on the net $1000 of service they received for $0?

<comment><USER32> Ask a simple question, get a simple answer: no.

The FMV of FaceBook access is zero, as evidenced by Facebook being routinely available for free.

US tax law does not anticipate routinely taxing inchoate transfers of value caused by operating things which distribute value broadly. For example, while assigning the copyright to Harry Potter would likely be a taxable event, holding a concert in public is not, even if the concert is of sufficient quality level to charge for it. The general phrase for this is "de minimis non curat lex"; specific instantiations of this of particular note are intrafamilial payments for cleaning one's room, which is de jure absolutely a taxable event and which de facto would result in the IRS Commissioner being asked to explain himself to Congress if it were ever enforced.

Additionally, if the IRS used people's subjective self-assessments to value things on one side of the ledger, they'd have to do it on another side of the ledger, leading to people having the attack "be a utility monster [0]" available against tax administration.

[0] Utility monsters have implausivly large but perhaps "legitimate" weightings for things. The existence of them is problematic for systems which do cost/benefits analyses and allow agents unconstrained choice of their utility function.

<comment><USER31> Thank you for the time you put into this reply.

</comment></comment></comment><comment><USER33> The raw averages are less interesting than the distributions here. Facebook is the prototypical example of the importance of network effects. The mean bids here are in the thousands, but the medians are $100-$200.

That means you could pay its users $100-200 to leave for a year, and it would lose about half its users immediately. But after the first half of users leave, it's probably worth a lot less to the remaining users than before the first bunch left.

Even if 90% of their users are willing to pay some price to use it, charging that price might lose them most or all of their users. I think that's super interesting.

</comment><comment><USER34> " our results show that the benefits these services provide for their users are large." What someone is willing to pay and "benefits" they receive are not the same thing. Someone already touched on it—people are willing to pay a lot for heroin, but few would claim heroin is beneficial.

<comment><USER35> Heroin is valuable, however.

</comment></comment><comment><USER36> This is the same as saying that the value of cigarettes is the same as what it would cost to pay a smoker to stop smoking.

With Facebook users, it can't be ignored that, in not all but many cases, we are talking about behavior that ranges from slightly compulsive to downright addicted.

<comment><USER37> Do you believe it is not possible to alter the usage behavior of a person addicted to a substance with money?

The cost might be unreasonably high to get them to stop, but it might be possible.

<comment><USER38> That's beside the point: You cannot conclude that cigarettes are _beneficial_ by this method.

Right in the abstract they say:

> ... our results show that the benefits these services provide for their > users are large.

...which is absurd.

<comment><USER39> I would, at the very least, say "perceived benefit."

<comment><USER27> even that is not fair, given the tobacco metaphor

</comment></comment></comment></comment></comment><comment><USER40> I didn't see the words "Endowment Effect" in the abstract or in these HN comments, so here's a Wikipedia link: [https://en.wikipedia.org/wiki/Endowment_effect](https://en.wikipedia.org/wiki/Endowment_effect)

Just a little something to keep in mind, relevant to the discussion.

</comment><comment><USER41> Losing access to Facebook can be pretty brutal. Specifically messenger. I actually had my Facebook temporarily suspended for 72h and I felt it.

It made it harder to contact with family ( we use group chat on messenger). I was still able to see things on Facebook so it wasn't even as bad as a full out ban. So many social events and communications are made through the platform. It's tough, even if you don't like the way the company acts, if all your friends and family use it to communicate you pay quite a price to protest it.

</comment><comment> move-on-by This is a completely anecdotal story of how I found the price of my privacy recently. I self identify as a privacy nut. I don't Facebook, I don't use google. I'll pay for privacy conscious services vs. using so called 'free' services, but I recently had an experience that gave me a bit of a different viewpoint.

My wife also doesn't have Facebook, for her it's more of a time suck then privacy reasons. For the most part she hears me talking about privacy, knows it's something I care a lot about, and is happy to go along with me. However, she recently learned about a couple apps that give you money back. Walmart pay and iboutta. Without a doubt these apps are tracking all sorts of things and building profiles and selling our information. I'm totally against it... but she loves getting the money back. "Oh you know that yogurt we got from Walmart? Turns out Kroger had it on sell for 50 cents off and we got reimbursed $5!" It really makes her happy. I'm thinking to myself that I would have rather spent that $5 and had kept my privacy, but I end up keeping that to myself. It's something she really enjoys.

On the other side, it does get into a more devious side of privacy issues. You don't need everyone to give up their privacy rights- you just need a few to give up the privacy of everyone they know.

</comment><comment><USER42> I think the experiment is fun but the principle is flawed imho. At best the method will find the average _utility_ value of fb for the study population.

Another commenter remarks that it would be ok to pay 1k to access fb if there is a promise of value (ie the "network" is still there) but projects that if fb became a paid service, that most users would leave it so the risk of losing utility value from fb would not be anywhere near 1k.

</comment><comment><USER43> Facebook for me is the means to keep contact with a larger group of my friends. From this perspective, one would have to pay me a very significant amount of money to drop the contact to my friends.

On the other side, this is mostly a thing of convenience and habit. The moment there is another, may be even more convenient platform to keep my contacts, I would drop Facebook for free and without heasitation. The value of Facebook for me is purely in my current friend list.

</comment><comment><USER44> There is one thing that really stands out in the choice of words in this article that makes me feel strange about it: Estimating the _value_ of Facebook.

> [Facebook's] _benefits_ are hard to measure

The Introduction reads like Facebook was the first of its kind and invented the social web. It's kind of like how mainstream media talk about Apple as the inventor of the smartphone and the tabled. It's as if there was no Facebook or Apple, there would never have been any other actor to take that space in the market.

It's like these companies are deities in people's minds. Apple sure has its prophets, but Facebook is probably felt as a more paternalistic and malevolent superego god.

I mean, I would not be surprised to see this kind of narrative in some click- driven blog. But in a peer-reviewed research article?

If this is really how most people think even in academic circles - that it is Facebook or nothing - then there's a huge disconnect and I have grossly underestimated the amount of awareness-spreading needed if we don't want to fully lose the open web.

<comment><USER45> it's just that the study is surveying people who already have a Facebook account. So the value they are talking about is not some abstract theoretical concept of value - they are talking about value in the context of quite literally - how much dollar value do people place on having a facebook account.

<comment><USER44> I get it, but to me that's like estimating the value of Honda by asking people who drive a Honda how much they would have to be paid to not be able to drive a car anymore.

The difference being that there are alternatives to cars while Facebook has a monopoly on the social graph of many users. I think one could argue that Facebook is a monopoly on online communication for large parts of the social graph right now, especially as they also own WhatsApp and Instagram.

</comment></comment></comment><comment><USER46> Even assuming only DAUs would pay $1000/year (Facebook has 1.5 billion of them) and a P/S ratio of 1 (which is conservative), the company would be worth $1.5T.

Edit: But we should consider something like Metcalfe's law, as pointed out by<USER20>
[https://news.ycombinator.com/item?id=18720468](https://news.ycombinator.com/item?id=18720468)

<comment><USER47> Companies cannot usually capture all the value they create.

<comment><USER27> And yet companies like Facebook capture many orders of magnitude MORE value than they create.

</comment></comment></comment><comment><USER48> If FB decided to start charging tomorrow, even $1, enough people would leave that it would become useless for everyone that stayed.

</comment><comment><USER49> Isn't this sort of like estimating the value of Ford by paying users not to use roads?

<comment><USER50> No, the roads are still free - the participants are still free to use other services after deactivating their accounts.

<comment><USER49> But other services don't connect to your friends. So I guess it's more like, paying them not to use any intersecting public roads.

</comment></comment></comment><comment><USER51> What if it's just a measure of the strength of addiction?

I imagine if you ran the same study and asked Heroin users or smokers how much you'd have to pay them to stop it would have similar results.

</comment><comment><USER52> I think you'd need to account for some behavioral economics in assigning positive or negative dollar values to free services

</comment><comment><USER53> BTW, there are some pay-to-chat applications. i.e. WowApp ([https://www.wowapp.com/w/byteofmydream](https://www.wowapp.com/w/byteofmydream)) and also you can spend earned money to charity. Sorry for spam, I just think it's a bit related to the topic

</comment><comment><USER11> very important to keep in mind there's a world of difference between what you'd have to pay a person to quit, and what they'd be willing to pay if Facebook started charging.

I think the later would quickly approach $0 for most people, especially as competitors rapidly entered the space to take advantage.

</comment><comment><USER54> Does the study include WhatsApp, Messenger, and Instagram?

I'm curious to know how to figure changes when you include Facebook owned services in addition to the primary Facebook platform.

</comment><comment><USER11> I wonder if a freemium model would have worked for Facebook. Thoughts on what that could looked like? Which featured might have been held back for paying customers only?

</comment><comment><USER55> Did they address how many have just quit FB? I did, $0.

<comment><USER56> I would need to be paid to join FB again, and endure the continuous stream of snarky memes and gregarious selfies.

<comment><USER57> There is this very interesting stand-up comedian from India (Amit Tandon) on YouTube. According to him ever since Fb become mainstream, people are under a lot of pressure to enjoy their lives. He logs in every night even if it was just to find out which of his friends were happier than him that day :D

</comment></comment></comment><comment><USER58> I wonder how these results compare to Estimating Value of Fentanyl, Norco, and Oxy by Paying Users to Stop Using Them.

</comment><comment><USER59> Actually I find it more interesting to just use this site than reading fb feed this day

</comment><comment><USER60> I'd deactivate for 5 bucks. I don't see or hold any value in it. I really don't care about an old school friends meal, who I would only have a fake "hi, how are you", then an awkward silence with if I met them anyway. Linkedin on the other hand has a foundation of worth, as does HN.

<comment><USER5> Please enlighten me on the worth of LinkedIn because I have yet to find it. It's basically become Facebook For Old People where said old people gripe about Facebook and post absolutely stupid comments on Facebook-like videos.

<comment><USER61> If you keep your LI profile up to date and have in demand skills, people will be knocking down your door to give you money. I've found all my best jobs from LI contacts tbh.

It was a wasteland for a while but in my opinion has rebounded.

<comment><USER62> As an anecdote/data point: I largely forgot about LinkedIn, and never really heard much from them. One day I installed the app and decided to see what all my old contacts were up to, just browsing around. Immediately after, my page views went up and I was sent a few messages from recruiters. I'm wondering if they don't 'reward' more active users in recruitment searches...

</comment></comment></comment></comment><comment><USER63> Did Facebook fund this study for positive PR? Or are the authors just trying really hard to get hired there? $1k to shut down Facebook for a year is the kind of result that should make one question one's methods, not publish it.

</comment><comment><USER64> Where can I donate?

</comment><comment><USER65> I will do it for free... Wait, I already did...

</comment><comment><USER66> Estimating value of heroin by paying user to stop using it.

<comment><USER67> Dopamine would be chemical in this case (probably? I'm not a neurologist..)

<comment><USER68> Here's my layman understanding:

\- Dopamine for that excited feeling that many people are liking what you had said or posted, i.e. confirmation bias.

\- Serotonin for that lovey feeling of seeing something inspiring/cute/your crush.

\- Adrenaline for internet arguments, insults, or conflict.

<comment><USER60> They also have the "punishment" factor, where the news feed completely refreshes if your phone's screen goes off; like a brutal pimp.

</comment></comment></comment></comment><comment><USER69> I prefer something like Yahoo blog 360 with some messaging features, not current facebook. The main problem is that, the stupid feed is very annoying.</comment>


Nuclear reactor on Kickstarter - <AUTHOR> http://www.kickstarter.com/projects/1992078142/building-the-open-source-bussard-fusion-reactor <comment><USER2> This is a presentation Bussard gave at Google in late 2006 shortly before death. Quite a character.

<http://video.google.com/videoplay?docid=1996321846673788606#>

(and it's the first google talk video I watched, some quadrillion ticks ago)

<comment><USER3> interesting. Here is the report he refers to: RW. Bussard, The Advent of Clean Nuclear Fusion: Superperformance Space Power and Propulsion: [http://www.askmar.com/ConferenceNotes/2006-9%20IAC%20Paper.p...](http://www.askmar.com/ConferenceNotes/2006-9%20IAC%20Paper.pdf)

also <http://news.ycombinator.com/item?id=283735>

</comment></comment><comment><USER4> I'm not sure I get this. Is this a joke? What's the goal here? What's the business model? Have I missed some fundamental development in nuclear physics that makes it possible to build a fusion reactor for $3,000. Is the $10bn being spent on ITER redundant?

<comment><USER5> Given that similar research is funded by the US Navy I'd have guessed that there is a pretty good chance that there is some chance this is a legitimate approach:

<http://en.wikipedia.org/wiki/Polywell>

Even if there is a very small chance of this working it is a pretty small amount of money compared to ITER - and I'd love to see a small project like this actually come up with the goods.

[Edit: corrected my mistake where I assumed that this was the same lot of researchers as the ones being funded by the US Navy]

<comment><USER4> Well poywell research maybe, but not _this_ particular project. Actually as someone pointed out, this is dated 2010, and the guy has had to bin it due to lack of funds. Although quite how far he imagined he'd get on $500 / month I'm not sure.

</comment></comment></comment><comment><USER6> sadly, looks like that out of funds, he had to go back to a "normal" job:

<http://prometheusfusionperfection.com/2011/03/20/new-job/>

<comment><AUTHOR> Oops, didn't notice this dated 2010.

</comment></comment><comment><USER7> By reading the Wiki on this, it seems like they're either on to something interesting, or they're great con artists... Why does this concept seem so simple?

<http://en.m.wikipedia.org/wiki/Polywell>

<comment><USER8> Sometimes simple ideas aren't necessarily obvious. Think about the web, for example, in many ways it was simpler rather than more sophisticated than existing ideas about networked information. A perfect example is the "concertainer" or Hesco bastion, which is basically a scaled up sand bag and properly should have been invented and re-invented many times for the last several millenia, yet it's a recent invention.

</comment></comment><comment><USER9> I feel they offer an awful lot of weird gadgets for giving a certain amount of money.</comment>