Keys.pub – Manage cryptographic keys and user identities - <AUTHOR> https://keys.pub/ <comment><USER2> This loses something important about Keybase sigchains: on Keybase, a sigchain represents an identity and _not_ a single key, which makes it possible to add separate keys for different devices and to seamlessly replace and revoke keys over time. (Non-key-specific sigchains let the Keybase client do interesting things like automatically re-encrypting shared data when someone revokes an old key.)

Tying sigchains to keys seems limiting, and I'm curious if there's a reason for it. Otherwise, I like this a bunch.

<comment><USER3> Indeed, in a perfect UX you'd never manipulate keys, always identities; that gives keys less importance and allow them to be rotated in a period that's closer to 10 weeks than 10 years. Also, exchanges are done with identities, not keys.

</comment></comment><comment><USER4> I, for one, am happy Keybase user, excited about their new features and can see it already becoming a much better (but not ideal) alternative to Signal for private IM (proper encryption, every device is first-class, usable CLI, no phone-number bullshit, good team chats, etc).

But I do see that the same reason I am optimistic is the same reason many users are disappointed and they're right - Keybase seems to have pivoted and they are headed in a completely different direction than they were when we joined.

Keys.pub looks to fulfill precisely the promise of "what Keybase was supposed to be". And crucially, I think; looks to be fully open source (server-side included, no sketchy opaque metadata spider-web by a US corporate).

I do see these two projects as fully complementary.

It would be interesting if this could, optionally, import pubkeys from Keybase as well. I think these could be complementary.

<comment><USER5> Keybase jumped the shark with their crypto coin offering.

<comment><USER6> I keep hearing people say this, but I don't understand it. It was a fun little giveaway experiment funded by someone else, in the spirit of the company's focus on cryptography.

I don't visit the cryptocurrency tab anymore, and it's not like it gets in the way or anything.

<comment><USER7> It was a trainwreck that damaged the project's reputation and harmed its users.

If you know crypto, it had several problems. There are worse coins to airdrop on your users but not many. The user experience resembled that used by scammers on Telegram and the project's overall behaviour looked like a de- anonymization attack (I mean that seems to be Keybase's business model but this looked _exactly_ like one). All of this led to crypto chats on Keybase being targeted by social engineering attacks, and Keybase's famously bad moderation tools made that much harder to deal with than it could have been.

If you don't know crypto it made Keybase look like a crazy crypto project, which isn't an easy sell.

In either case you could be forgiven for wondering when Keybase got their money transmitter license.

So this did get in the way, and the sooner Keybase remove the tab the sooner it will be clear that they are past the denial stage.

This was a bad enough fuck-up that I removed my social proofs and now recommend that people not use Keybase. But if they fixed a few things (remove the Crypto tab, fix moderation, fix name changes) I'd pay them a subscription in a heartbeat.

<comment><USER8> In all honesty I believe the crypto offerings were a smart idea that didn't undermine Keybases reputation , it attempted to highlight a user friendly exchange of Stellar and any further crypto to come along . What did undermine the reputation was allowing a system that could be scammed which called for the closing of the offering . Clearly not thought out enough .

</comment></comment></comment></comment></comment><comment><USER9> One of the things I liked about keybase is that it pooled identity proofs from different providers. If somebody manages to replace a proof in my gihub account, other people can (independently) verify that there is something wrong.

I'm not sure if I misread the documentation, but it seems that with keys.pub each "service" offers a disconnected world. If somebody manages to publish a proof in my github account, it can trick people using keys.pub to think that's still me.

OTOH, with keys.pub I don't need to trust any server.

Am I misunderstanding something?

</comment><comment><USER10> Lots of keybase early users here. I started really using it relatively recently, and mostly like it, regardless of "losing its way".

What I use are is the chat, git and filesystem. Verifying other people's identities - not so much.

The only problems are related to the GUI having hiccups, opening images posted to the chat, say. Git and filesystem are relatively slow, but can live with that.

<comment><USER11> I feel like if they did some decoupling and got rid of the persistent running connection / filesystem stuff for features that did not need it as a mandatory thing that early users wouldn't mind as much. For all I know it actually does work that way too.

</comment></comment><comment><USER12> I was a very early user of Keybase and I've been super disappointed in the direction they've gone. They've had some neat ideas along the way but packing them onto the key service and the cryptocurrency missteps have caused me to shy away from them.

This looks like a good start for a real competitor. Obviously it's early but I'm seeing the right things.

<comment><USER13> I see this from a lot of people and I'm puzzled, can you not just avoid using the features you don't like? I don't see anyone going "I used to use VS Code but they added a database viewer so I stopped".

<comment><USER12> The keybase client went from a small CLI to a persistently connected app that ties into a filesystem, cryptocurrency platform, chat ecosystem and more.

Nothing is free. Adding features takes up resources, adds complexity and errors and increases attack surface. Sometimes that's an OK tradeoff - I like being able to see images in my email client. Sometimes the tradeoff is not worth it - my text centric IDE has no business touching database files.

<comment><USER13> That's fair, my question was more about the cryptocurrency feature specifically. "General bloat" I can understand, if you only care about the keys.

It seems to me, though, that the key part is just the first step in an entire featureset: Once you have a reliable way to get trusted encryption keys for any person, you can build a whole lot of useful functionality on top of that, which is what they've been doing.

Personally, I wouldn't have much use for just the key exchange, and I really like the encrypted chat/repos/files/etc on top, but I can understand different preferences there.

<comment><USER12> It would be possible to build an ignorable cryptocurrency feature, and if that had been the case, I probably wouldn't have noticed or cared. Instead Keybase tied into the launch of a questionable currency which involved giving the currency to people as a marketing tool and then resulted in a spree of attackers, disclosure attacks and other problems.

There's a difference between "Hey, we've built in a small wallet feature" and "Congratulations user, we've now given you 200 Lumens of tax liability and sent you marketing emails disguised as information, please prepare for a horde of hackers. Also we've fussed with your keys to make this new feature work. Thanks!"

<comment><USER14> I haven't found a use for it yet, but I'm not upset that they gave me money. It's the only crypto I've ever owned, but it's mine I guess?

Also, my understanding is (at least in the US) that you don't need to declare gifted cryptocurrency until/unless you realize it's value by either selling it or sending it to someone else as payment for a service.

</comment></comment></comment></comment></comment></comment><comment><USER15> > This project is in development and has not been audited.

I love seeing notes like this. Everyone needs to start somewhere, and for security projects there is a danger of overselling initially, which undermines credibility. This sounds like someone who understands that theres a lot of complex challenges to get this to production level security.

</comment><comment><USER16> This seems like a cool project. Keybase has kinda lost it's way and has no idea what it is anymore. Where this seems pretty focused on doing one thing and one thing well.

</comment><comment><USER17> Hi all,

I'm the author of keys.pub.

Can the mods change the title of this post at all? This project is meant to be supportive of ideas from Keybase and to promote Saltpack and this title is weirdly disparaging. (Edit: Title was changed, thanks!)

Thanks everyone for the feedback. This project is in its early stages but the goal is to make it easier to manage and securely store keys and secrets.

I'm currently working on hardware key support and FIDO2 integration, so be on the lookout for that.

<comment><USER18> Sure, no problem. I've used the HTML doc title but I had to shorten it to fit 80 chars. If there's a better—more accurate and neutral title—let us know.

(Submitted title was "Keys.pub – Keybase Without the Cruft".)

Edit: I changed the title to something the author suggested in an email. Before that it was "Keys.pub – Manage keys, sigchains, identities, signing, encryption, passwords".

<comment><USER17> That's great, thank you.

</comment></comment></comment><comment><USER19> In light of Zoom buying keybase ([https://news.ycombinator.com/item?id=23102430](https://news.ycombinator.com/item?id=23102430)), this project might be more interesting to users of keybase now.

</comment><comment><USER20> I get that this is new and in development, but I'd really like to see a more in-depth comparison to keybase than:

> This project borrows many ideas from Keybase, including sigchains and user > (proofs), and uses Saltpack and keybase/go-keychain and other packages. > However, this project only links a single key to a user.

I say this while noting I've seen that "Better documentation" is an item in the todo list. However, it just isn't clear - to me - where they plan to move or draw a finish line for features.

If you have a better comparison please post it, and I guess a PR for the project too ;)

</comment><comment><USER21> Keys seems to have taken the `back to the basics` approach and follow KISS to solve the original problem(s) Keybase was trying to solve (key & user ID management for human beings).

Obviously Keybase has strayed away from its original heart, added all those unrelated elements like social chat, Dropbox like (fuse) filesystem (this is actually OK), team collaboration, SCM, and even crypto currency wallet, so bloated [1], hmm... Do we really need all those? No for me, but I don't have a choice if I want to use the core bits and pieces (good part) of Keybase.

Glad to see Keys, gave it a try on Linux (thumbs up for packaging it using `AppImage` instead of snap or flatpak). However, it had gnome-keyring dependencies (wrong assumption that people use GNOME Shell or variants as default Desktop Environment), issue reported [2] and being worked on. I did run it in a Windows VM and it seems to be exactly what I need for key & user id management, looking forward to its development and adoption.

[1]: Keybase GUI for Linux [https://pbs.twimg.com/media/EW0wKs4VcAAL3Qi?format=jpg](https://pbs.twimg.com/media/EW0wKs4VcAAL3Qi?format=jpg)

[2]: [https://github.com/keys-pub/app/issues/6](https://github.com/keys- pub/app/issues/6)

</comment><comment><USER22> This is very cool but I screwed up 2 of my "sigchains" to Reddit and to GitHub by deleting the underlying messages (I didn't realize I wasn't supposed to) so now two of my identities are messed up and I can't even use the app. I get this message: "panic: Unknown user status content-invalid (13)". Great project, but needs a better way to clean up invalid keys and re-issue them.

</comment><comment><USER23> One of the killer features for Keybase is the combination of teams + KeybaseFS. Unfortunately this doesn't look like it has either of those features.

<comment><USER24> That's the cruft. If they separated those out into separate apps, I'd be happy. It's an E2E-encrypted Slack-clone, public key management system, encrypted file storage, and a crypto wallet.

<comment><USER25> I guess one man's cruft is another man's crucial feature.

<comment><USER24> Precisely the reasoning for writing tools that do one thing very well.

<comment><USER26> The problem with that is that it completely disregards one market, i.e., the one that wants an integrated system. You could probably install six programs that do these individual things, but then you'd have to install six programs. That's a non-starter for those looking for the integrated solution.

<comment><USER27> What if you made a unified installer that installs those six tools configured in a certain default way?

<comment><USER26> Certainly there are plenty programs that are designed modularly, componentized, plugin-based, compositional, whatever... They just never feel as good as purpose-built apps with good workflows. If you know of one that does, please do forward it on because I'd love the inspiration.

I think Keybase does what it intends to do, which is to make PKI accessible to non-experts and to cultivate a community of users achieve the usefulness that network effect affords.

If you're really just looking for encryption and signing, encrypted filesystems, encrypted chat, distributed filesystems, and you're an expert, you have the tools you need.

<comment><USER28> > They just never feel as good as purpose-built apps with good workflows. If > you know of one that does, please do forward it on because I'd love the > inspiration.

I think the flaw here is that you're _(likely)_ comparing purpose-built with unrelated unix-like apps.

What could have been done here with Keybase, is a purpose built app composed of unix-like tools, all controlled and implemented towards the purpose-built app. Aka the IM would be unique if you wanted it, or bundled with the FS, but both would be first-class Keybase citizens.

Unfortunately most companies don't put the time or effort into letting people consume parts of their offerings. It's all or nothing. Which is the complaint here, imo.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> So there is no network that connects all the keys.pub clients together? Are you just supposed to do point-to-point connections through Wormhole? Still trying to understand it.

I keep hoping for a decentralized/federated network implementation for Keybase (or forked version) that will basically take the place of the centrally managed Keybase servers.

</comment><comment><USER30> I might have to give this a try. Keybase has turned into something that I don't enjoy for a variety of reasons.

</comment><comment><USER31> I think it might be a good idea to use something like IPFS to distribute keys. Now that cloudflare seems to want to support it officially, the only exception to why they might not are the same kind of lawsuits that brought down the pirate bay but cloudflare has opted to offer content blacklisting/cache refuse in their terms of service so I'm not sure how that's going to work out, but so far since 2018 nothing seems to have changed. I'm not really sure what their takeaway is though, it must provide them some benefit otherwise it's just a waste of their money to provide a gateway service. I'm not sure how well it's going to scale once people start building on it and actually use it more.

<comment><USER31> I want to add to that the ethereum name service, [https://www.increaseo.com/eth-domains-ipfs/](https://www.increaseo.com/eth- domains-ipfs/) could also potentially play a role in a means to efficiently and reliably distribute public keys in conjunction with IPFS? Seems worth considering at least.

<comment><USER31> and it's not the fastest thing but in theory it's simple enough that you can just do something like this:

ipfs add test.asc added QmX1yKeerXb9vSYoQXcZuuw1QFTu5UxDCec4hY9htjRYE7 test.asc

and retrieve it [https://cloudflare- ipfs.com/ipfs/QmX1yKeerXb9vSYoQXcZuuw1QFT...](https://cloudflare- ipfs.com/ipfs/QmX1yKeerXb9vSYoQXcZuuw1QFTu5UxDCec4hY9htjRYE7)

if you have an ENS name you can access it this way: [https://cloudflare- ipfs.com/ipns/atmarketplace.eth/](https://cloudflare- ipfs.com/ipns/atmarketplace.eth/)

</comment></comment></comment><comment><USER32> Can anyone suggest a serialization format that can be implemented across languages without being a language lawyer?

JSON seems like it fits the bill but I have seen soooo many complaints about UNICODE encodings, whitespace or some other things, and people saying secure scuttlebutt suxx because it relies on perfectly copying Node's JSON implementation. But dudes, what format is better out there?

<comment><USER33> The SSB issue with json is that it plays with the json after signing it. Just don't do that.

<comment><USER32> Please elaborate

What specifically do you mean? I have so far resorted to using http_build_query type algorithms to make it for sure canonical.

</comment></comment></comment><comment><USER34> What does this wormhole exactly do? The docs just say it's a secure connection, but how exactly do you interact with it?

<comment><USER35> it's [https://github.com/warner/magic- wormhole](https://github.com/warner/magic-wormhole)

but see in particular [https://github.com/warner/magic- wormhole/issues/107](https://github.com/warner/magic-wormhole/issues/107) . It uses a static wordlist and by default uses a shared pool of rendezvous servers.

The (an?) author addresses this here [https://magic- wormhole.readthedocs.io/en/latest/attacks.html](https://magic- wormhole.readthedocs.io/en/latest/attacks.html) but I think characterizes the attack poorly: it's not important that it's low-probability that an attacker can pull off a MitM transparently, all an attacker needs to do is be able to guess the channel + code words before the receiver receives the message. The default is to only use two code words, so 65536 possibilities. I don't think it would be hard to open 64k connections very quickly, so this seems like an easy-to-win race. Maybe I misunderstand the math.

I don't think wormhole should be used for anything important without a private rendesvous server, and if you have secure access to a private rendezvous server, why bother with wormhole?

<comment><USER36> That's not how the protocol works. A single failed guess terminates the connection and alerts the sender that an incorrect code was used and someone might be attacking them.

If you are concerned about guessability you can use more than 2 words. You can also use strings that are not in the default word list (the only thing the default word list gives you is tab completions).

edit: Also the "wormhole" spec that keys.pub has is not related to magic- wormhole.

<comment><USER35> I happily stand corrected on both counts, thanks

</comment></comment></comment></comment><comment><USER37> Question is, will this become a useful tool or a bloated multi-purpose behemoth (with no clearly defined purpose) like Keybase did?

We badly need good simple tools for encryption. For all the criticism of GPG coming from the savvy crypto-crowd, there is still no other tool that performs common encryption-related tasks quickly and easily.

<comment><USER38> age is the standard answer to this [https://age-encryption.org/](https://age- encryption.org/)

<comment><USER37> I like where age is going. It only does a fraction of what I need (for example, I need to sign and keep detached signatures), but I have high hopes for it.

Still, it is nowhere near a replacement for GnuPG.

</comment></comment></comment><comment><USER39> GnuPG - Keys.pub without the cruft

Jokes aside, gpg does exactly key management, signing, encryption and so on.

Plus, it's nice to acknowledge and support the work of the author.

A tiny wrapper that provides a friendly CLI/TUI would be welcome.</comment>


Building a More Diverse Facebook - <AUTHOR> http://newsroom.fb.com/news/2014/06/building-a-more-diverse-facebook/

<comment><USER2> It almost looks like they tried to present the data in the most-negative-to-fb possible way, just in terms of ordering if nothing else. I'd also be interested in citizen vs. immigrant (of various status); someone from Russia moving to Menlo Park to work for Facebook really is not directly interchangeable on a diversity metric vs. a 5th generation American of any race, IMO. Native-Bay-Area vs. moved-to-Bay-Area before vs. moved for FB might be an interesting metric, too.

It really only matters that they keep measuring it the same way and then watch for trends as they try to change things, though. Good job for caring and being quantitative IMO.

What amazes me is how low the "two or more races" category is. I would have expected a much larger percentage there.

</comment><comment><USER3> I think it's the government's job to make sure that the candidate flow is balanced across those facets. As a private corporation, when there are N candidate for a position, the best one should get the job. Doing something else makes charts look better, but hurts corporations, the economy as general, and is totally unnatural. Enforcing diversification also assumes wrongdoing without a proof.</comment>


5 Ways To Break Your Design Habits - Just for Fun - <AUTHOR> http://spyremag.com/5-ways-to-break-your-design-habits-just-for-fun/ <comment><USER2> There are some good suggestions here. When I designed my new blog at tom.preston-werner.com I wanted to do it without any images as design elements. When you do this, you really have to pay attention to your text colors and typeface choices. I guess it's a little like losing your sense of sight and your hearing becomes more acute. Designing outside your comfort zone can be a great learning experience.</comment>


Lavabit's founder responds to cryptographer's criticism - <AUTHOR> http://arstechnica.com/security/2013/11/op-ed-lavabits-founder-responds-to-cryptographers-criticism/

<comment><USER2> Ladar Levison could not have missed Moxie Marlinspike's point more completely if he had heard that Moxie's post was coming and bought a ticket to a tropical island where there was no Internet for the expressed purpose of avoiding it.

Start by understanding this: end-to-end (e2e) security is not a crazy pipe dream. It can be accomplished today, using tools with graphical interfaces that are available on all mainstream platforms. Though we could surely use better, more convenient tools for providing it, there's no valid argument that is premised on e2e being intractable.

Marlinspike's argument was simple. Levison's site made expansive claims about its security properties. Marlinspike highlighted them. Then he explained how the system could only provide those properties under an "avert-your-eyes" attack model, because it was fundamentally a plaintext-in plaintext-out system. It could provide no security without Levison's own say-so, but could subvert its users the moment Levison's will or capabilities broke.

Levison replies with a series of technical details that are irrelevant to the avert-your-eyes problem. Levison thinks that marking memory secure was a meaningful countermeasure against a state-sponsored adversary (compelled disclosure was his stated threat model), because attackers would not have had the source code. This is a baffling statement in an era where people reverse engineer smartphone basebands for fun, because it's an obstacle that the FBI would have had no trouble surmounting in 1999.

Similarly, Levison's surprise that the DOJ could compel him to hand over TLS keys (in a configuration that Marlinspike points out wasn't even forward- secure --- that is, a configuration that provided sub-Google levels of resilience versus DOJ) doesn't have anything to do with Marlinspike's argument. If Levison's own keys determine the security of the system, it is an avert-your-eyes system. However meaningful you believe avert-your-eyes promises to be, the are undeserving of promotional security copy that discusses the details of asymmetric encryption.

Levison argues that it's unfair to judge his system by the standard of PGP. His system was designed solely to protect emails at rest. But that's a meaningless distinction, obviously so, because Levison had to shut his system down after being compelled to reveal keys that could decrypt prior sessions. Plaintext-in plaintext-out mail encryption is like a bulletproof vest you store in your attic --- perhaps useful for protecting you against bullets flying in your attic, but little else.

I believe we need two kinds of privacy enhancements: laws that constrain the actions of governments and limit the scope of investigations, _and_ better privacy-enabling technology. But I have no illusions about which of those two enhancements users should rely on: they should ignore the limitations supposed for governments, and choose technologies that offer end-to-end security, where the endpoints make the judgement calls about the degree of safety they have, _not_ the operator of the service.

And while that concludes my direct response to Levison's post, I'd like to make a tangential argument:

"I wasn't trying to fix security, only improve it" has for the last 20 years been the siren song of bad security systems. It lured customers into the rocks in the 1990s when it was used to rationalize stack canaries as a cure for memory corruption vulnerabilities, shipwrecked web developers with promises of "smart quoting", got Hushmail customers backdoored, inspired 100 different secret-salt password hashes, installed tens of thousands of packet sniffing "intrusion detection" systems on networks around the globe, and got us elliptic curve-based chat systems... incorrectly implemented in browser Javascript.

Alarm bells should go off in your head when you hear that sentiment spoken aloud. Loud ones. If you start to feel persuaded by it, tie your self to the mast: reinstall GPG, generate new keys, and refuse to send plaintext messages.

<comment><USER3> _Levison 's surprise that the DOJ could compel him to hand over TLS keys_

This is the part that baffles me. The lavabit about page clearly identified the FBI and NSL as a threat. Lavabit was supposedly designed to be secure against the FBI, even if the FBI didn't play by the rules. But then he still expected them to play by the rules?

<comment><USER4> You cannot refuse to hand over data when given a warrant, but if the data is encrypted (and you do not possess the key to decrypt it) the information is essentially worthless and they won't throw you in jail for refusing to comply.

Fun fact: Lavabit turned over an archive of encrypted emails from Snowdens account when he was first contacted by the feds. Those emails are still perfectly secure, because Snowden is the only person who knows the password required to decrypt the mail files. The reason the feds demanded the SSL keys (a few weeks after he first turned over the emails) is because they could not decrypt the mail files and wanted to try and capture Snowdens password the next time he accessed his account.

<comment><USER3> Well, they could be secure, unless the FBI also has a previously recorded session which they can now decrypt with the SSL key to recover the password.

<comment><USER2> Since 'tedunangst is being coy, let's be clear that what he's saying is that _they aren 't at all secure_.</comment></comment></comment></comment></comment>


Crosswalk - <AUTHOR> https://crosswalk-project.org/

<comment><USER2> After digging into the FAQ I see this is intended for Android. I guess CEF is probably better suited for desktop apps.

<comment><USER3> Thanks for pointing this out. It's difficult to discover by just browsing the homepage. I was really hoping that this would be a desktop system. Are there any tools like this that are targeted at Mac OS or Windows?

<comment><USER4> You might want to take a look at node-webkit then

[https://github.com/rogerwang/node-webkit](https://github.com/rogerwang/node- webkit)

</comment></comment></comment><comment><USER5> This is pretty cool. Sounds like an alternative to PhoneGap/Cordova for high performance apps on Android. It appears it's meant to address the problem of building something like a mobile game with WebGL.

<comment><USER6> It does support WebGL indeed. It's not an alternative of PhoneGap/Cordova in fact it's a PhoneGap/Cordova++ as Crosswalk is compatible with the Cordova APIs. Instead of using the Java Android WebView it uses the Crosswalk View to render the contents.

<comment><USER5> How is it compatible, specifically? Do you replicate the same API in the skeleton app you distribute? Or is it possible to drop the Crosswalk View into a Cordova app directly?

<comment><USER6> [https://github.com/crosswalk-project/crosswalk-cordova- andro...](https://github.com/crosswalk-project/crosswalk-cordova-android) we use upstream cordova and replace the Java WebView by our own. You would need to repackage your app.

</comment></comment></comment></comment><comment><USER7> I would love to see something like this for embedded Linux applications (Platforms like BeagleBone or Raspberry Pi), without the overhead of X11, rather than just Android/Tizen/et al.

</comment><comment> Dorian-Marie I think that some screenshots would help to understand how the final product is rendered.

<comment><USER8> How about some downloadable sample apps I can build?

<comment><USER6> [https://crosswalk-project.org/#documentation/samples](https://crosswalk- project.org/#documentation/samples)

would that be ok?

<comment><USER8> That is great!</comment></comment></comment></comment>


YouTuber "Technology Connections" demonetized, dashboard says "reused content" - <AUTHOR> https://twitter.com/TechConnectify/status/1227932868028043264 <comment><USER2> This sucks because I loved his channel so many people have had to put up with this BS, CodysLab, NerdRage- I dont understand how they can pay millions to unboxing crap videos but screw over good content creators. Also, he linked this in the twitter thread if you want to support him [https://www.patreon.com/technologyconnections](https://www.patreon.com/technologyconnections)

</comment><comment><USER3> For anyone not familiar with Technology Connections, if you ever enjoyed the simple, straightforward TV of golden-era PBS or Discovery channel, please check out Technology Connections' videos. He produces eloquent, high-quality media with a distinct lack of gimmicks and unnecessary background music; just conversations about interesting consumer electronics and other items and how they work.

</comment><comment><AUTHOR> It appears to be fixed:

[https://twitter.com/TechConnectify/status/122804841209815449...](https://twitter.com/TechConnectify/status/1228048412098154497)

As usual on YT, no explanation was given by the Google.</comment>


Open betas and short software release schedules lead to "a race to the bottom" - <AUTHOR> http://thestandard.com/news/2008/04/30/thou-shall-ship-no-software-its-time

<comment><USER2> Up until Google, software products in Beta usually had many bugs. Typically, this would be desktop software that had not been tested in more operating environments than the developer's own computer. I believe Google was the first major web application to use the term beta, and at the time, it was a very strange thing to do. It was probably because they were in "beta" that they didn't try to place ads all over the place; they didn't want to worry about that because they were too busy trying to figure out the best search algorithm.

Beta could mean that more features are coming soon, like with Google. But Beta can be the original meaning--that the software or web app is available for feedback but may not even work correctly. That's not something new, however.

</comment><comment><USER3> Or to use an old cliche, "you only get one chance at a first impression."

</comment><comment><USER4> Amen</comment>


License plate tracking for police set to go nationwide in the USA - <AUTHOR> https://www.cnet.com/news/license-plate-tracking-for-police-set-to-go-nationwide/ <comment><USER2> I guess I don't have a lot to say other than: this is pretty disheartening. We are going further and further down the rabbit hole that is the surveillance state.</comment>


Crowdsourcing, the Gulf Oil Spill and the Arrogance of BP - <AUTHOR> http://blog.crowdspring.com/2010/06/crowdsourcing-bp-oil-spill-innocentive/ <comment><USER3> A "solution" isn't an idea. Ideas are 10 a penny. How many of those solutions were actual plans that could be put into effect, bills of materials, Gantt charts, cost breakdowns?

Personally I would rather BP be getting on with the job than reading unsolicited email from the peanut gallery.

Oh, and to put that $2.35Bn into perspective, Union Carbide paid out $450M for, umm, _killing 20,000 people_ at Bhopal. BP has made a huge mess sure, but after the initial explosion, no-one has died. I think Americans need to take a good long hard look at themselves in a mirror before getting on their high horses.

<comment><USER4> _Oh, and to put that $2.35Bn into perspective, Union Carbide paid out $450M for, umm, killing 20,000 people at Bhopal_

First of all, let's not pretend like all American's are happy with Union Carbide's "punishment" for that incident.

Second, BP isn't paying for deaths. They must pay for the monumental cleanup and economic damages resulting from the environmental disaster they caused. It's expensive.

According to the article, _Innocentive has a global network of more than 200,000 engineers, scientists, inventors, and business people who are experts in physics, chemistry, math, life sciences, computer science, and many other fields._. I wouldn't be so fast to discount the worth of their ideas. It's that kind of arrogance that got them in trouble in the first place.

<comment><USER3> According to Innocentive, perhaps. But my point stands: how many of these solutions were actually actionable? And even if all thousand of them are - <USER2> engineers qualified to evaluate them are all busy working on the problem themselves!

This just looks like some free publicity for Innocentive. Maybe they're the arrogant ones?

</comment></comment></comment><comment><USER5> Official word from Innocentive: [http://blog.innocentive.com/2010/06/23/innocentive-oil- spill...](http://blog.innocentive.com/2010/06/23/innocentive-oil-spill- challenge-bps-response/)

</comment><comment><USER6> We need ideas to replace oil or at least find safer ways to extract it -- this X-Prize model does not work in a crisis, especially when there are already credible strategies. There is not time to start from scratch, and BP sure as hell isn't the entity to evaluate the feasibility. They have enough to do. BP's call for ideas is pure PR.

</comment><comment><USER7> I had an idea today, where you'd take a large heavy Prism and lower it where the pipe would go- the pipe would have to be removed. The pressure of the oil coming out would push the sand around the prism, and allow the prism to sink. The prism would obviously continue to sink, and it could follow with concrete rubble.

</comment><comment><USER8> Unbelievable. Especially after reading the official word from Innocentive posted by shaddi in this thread. Do we know at least what BP's rationale. They seem to be focused on spending minimally on additional efforts to close the open well or cleanup the spill and really rely on the August relief well as the only worth investment right now.

Their rationale: Can't just be cost containment? That would be so idiotic and short sighted! They are going to be dealing with this as a corporation for decades...

They should be owning up to it now. But maybe it's just short sightedness of the people in charge currently. They will likely all be retired long before this is over...

<comment><USER9> The rationale is simple: it freaking complex for a large corporation to navigate legal wranglings with "normal" trading partners during the best of times; given that they are currently embroiled in what already may bankrupt them, it does not make sense to embark upon a partnership with an unknown entity type.

Put simply -- they know what they know and they know what they don't know, and they're worried that if they step outside the comfort zone of redlines, LOLs, and escape clauses that they could worsen rather than improve the current situation.

<edit> That said, it is really myopic of them and it does demonstrate a possibly disastrous lack of foresight.</comment></comment>


Enki: Level-up your dev skills in 5 minutes every day - <AUTHOR> https://www.enki.com <comment><USER2> FYI, the link you posted returns a 502. When I manually changed the URL to request http instead of https (the link is https) things worked just fine.

Enki seems fantastic. I really like the idea of learning and building skills in small chunks. I feel like so much of my free time is divided up into small pieces (i.e. < 30 mins) but so much existing learning material out there is geared towards focusing on something for at least an hour.</comment>


Ask HN: Are user names personal information? - <AUTHOR>

Setting facebook's real name policy aside, is there case law in which user names are defined as personal information. As an example, consider the following. Reddit has a policy in which users should not post personal information, especially about other users. A gaming subreddit deletes links to videos/screen-shots that contain gamer tags claiming gamer tags are personal information. Clearly this is policy rather than law, but often law influences policy. Is it reasonable to consider user names to be personal information? <comment><USER2> It varies by state to make it more complicated.

You can do searches for "personally identifiable information " or PII in statename to learn more

<comment><AUTHOR> Quick reading: "gathering" is integral. In the example I provided, the web site is not "gathering" information.</comment></comment>


Ask HN: How to go from job at [platform] to indie consultant for [platform]? - <AUTHOR> I would love to hear from folks who have successfully left a technical role at [platform name] to become an independent consultant specializing in [platform name] with the goal of having more freedom and increasing income...<p>Were there any steps you took/wish you took prior to leaving to ensure success? <comment><USER2> I became an SME (in k8s &| devops), did some impressive work at IBM with it, left to start a company, do consultation / custom work on side to keep cash coming in. One gig is mainly DevOps spanning AWS, GCP, onprem; the other is a migration from AWS to GCP/GKE.

The biggest contributions to success seems to be track record and networking. The second gig is with a former coworker who knew my work.</comment>


Ask HN: What was the last hard/time consuming thing you did? - <AUTHOR> Hey there! :)
I'm currently looking for a side project and was wondering what was the last hard thing you had to solve or did consume a lot more time than you expected?
Doesn't really matter too much what it was. I'm open for almost anything tech related. Setting up monitoring, analytics? Getting data from one point to another? Making sense of that data? Integrating or using service XYZ? Communicating with other teams? Communicating with customers?
I hope you get the idea :)
Thanks for your input in advance! <comment><USER2> I have been trying to read a book [jQuery] but its been very difficult for me.

By the time I finish client work it is already mid-night & I'm left with very less motivation, but still reading a page here n there I have managed to cover upto 25% of the 444 pages so far.

I'll read a page now, thanks for the reminder :)

<comment><USER3> Why are you reading a 444 page book on jQuery in 2017?

<comment><USER2> Because I use jQuery for my work & I want to get better at it.</comment></comment></comment>


Microsoft formally bans emulators on Xbox, Windows 10 download shops - <AUTHOR> https://arstechnica.com/gaming/2017/04/microsoft-formally-bans-emulators-on-xbox-windows-10-download-shops/ <comment><USER2> I guess in 10-20 years we will be telling our grandchildren about the old days, where you can do whatever you want on your computer, limited only the abilities of the hardware* . And they won't believe us.

*Simplification, of course.

<comment><USER3> No one has to put up with this though. Use free software and gain control over your computer again.

<comment><USER4> Its easy to say that, but look at the actual hardware requirements[1] for running an open and free system. You can count your options on your fingers..

[1] [https://libreboot.org/docs/hardware/#supported_laptops_x86in...](https://libreboot.org/docs/hardware/#supported_laptops_x86intel)

</comment></comment></comment><comment><USER5> Hah, jokes on them. I never use the Windows 10 store.

<comment><USER6> There's a Windows 10 store?

/s

</comment></comment><comment><USER7> I made a 3D NES emulator for the HoloLens about 8 months ago [http://n3s.io](http://n3s.io) and I pleasantly surprised that a few MS employees reached out. Some were doing internal hackathons and wanted assistance, others even contributed to the code base, but I was particularly shocked when a HoloLens dev that helped run their tutorial + social media reached out to encourage (and offer resources) to get the app on the store.

My response was "no way that'd get through", but they insisted on me trying anyway and said they could try to push it through. I didn't bother for a couple other reasons (the open source libretro core I was using would need to be reworked for their managed app environment, and HoloLens performance was actually pretty crap no matter what I did), but a few days later the other emulator controversy started.

I was expecting this outcome and really don't blame MS. Glad I didn't try to port my own app over (which would also work on Xbox and desktop).

</comment><comment><USER8> It's not surprising, but still disappointing. Emulators preserve games of eras past.

<comment><USER9> So do "Virtual Consoles" which are releasing more and more past games on different platforms and charging for it. I'm guessing if emulators weren't so rampant on the PC then companies like Nintendo would have or would think about creating a Virtual Console on PC for NES/SNES/N64, etc.

<comment><USER10> Having to rebuy the license to pay the same game over and over and over again so you can play it on a slightly updated and still working hardware is downright Kafkaesque.

Nintendo and other copyright holders want to act like you're licensing software (so they don't have to be beholden to first-sale doctrine, laws concerning the ability to make local backups and other consumer protections), but they also want to prevent you from using that licensed software on newer hardware and want you to pay for 35 year old game over and over and over and over again. It's downright absurd, how many times do you want us to pay for the same piece of Super Mario code?!

<comment><USER11> Well, I've misplaced my receipt for The Legend of Zelda that I bought 30 years ago. Ideally they'd have had an infrastructure in 1986 to manage my ownership of the product in perpetuity across media and distribution channels. But they didn't, so I can either hold on to my feeling of entitlement that Nintendo owes me the virtual console version for free or I can pay $5 to play it on there.

<comment><USER12> Or you can download an emulator and a rar with all 721 SNES games for free.

<comment><USER11> I could also sneak into movie theaters to see all my movies for free. It's not stealing, right? I haven't deprived them of a physical product? There's no marginal cost to them to show the movie to one extra person, right? They lose no revenue because I wasn't going to pay to see the movie anyway, right? And movies are terrible right now, aren't they? Everything's a sequel or reboot, there are no more original ideas, right? And the way they show ads before movies now, they have no right to do that after I've already paid for a ticket, do they? And people are always talking in theaters and they never do anything about it, right? And they turn up the air conditioning too high...

I'd really have to be a sucker to pay for movie tickets given all those reasons not to, right? I think I'll still do it, though.

<comment><USER13> idk dude. It's the same argument as pirating Game of Thrones. Most people when offered a convenient and safer channel would probably just pay for Game of Thrones, but many have no simple recourse other than paying out the ass for cable.

e.g. I live in Canada. Pretty sure HBO Go doesn't support Canada, and I'm sure as hell not wasting my money on cable TV just to see Game of Thrones. I'd rather pirate it. But if I can watch something on Netflix, obviously I'd rather just do that and pay for the service.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Time to write WebAssembly emulators that will run inside browsers?

<comment><USER15> Until they white-list websites, you know, for your safety. Good citizens only use government-approved and microsoft-approved sites anyways.

</comment></comment><comment><USER16> I don't know about XBox, but does anybody actually use anything from the Windows Store? The only app that I have gotten is the SlingTV app, except I ditched it for the older native app, because the UWP Store one was so hideously broken and slow.

<comment><USER17> Yes, I have been slowly migrating to store apps, specially since they are sandboxed.

I also own a couple of WP, so I now get to use those apps on the desktop as well.

<comment><USER18> What are "WP"?

<comment><USER17> Windows Phone

</comment></comment></comment></comment><comment><USER19> Isn't the rule prohibiting "UWP games and apps that "pose a safety risk or result in discomfort, injury or any other harm" to users." kinda broad (meaning especially the "discomfort" part)?

Seeing as "discomfort" was not specified in any way, it COULD mean the horror game you potentially want to release on the Windows Store could be denied a listing, because it could cause some players/people psychological "discomfort".

To be clear, I would be mostly fine with this rule if "discomfort" was specified as "physical discomfort".

<comment><USER20> Welcome to the wonderful world of "App Stores" where some random company which managed to put itself between you and a substantial part of potential customers decides what you can distribute under what conditions covered by their own vague rules which are suspect to arbitrary change at any time anyways.

</comment></comment><comment><USER21> Yeah, emulators should switch to Linux, and MS should get lost ;)

</comment><comment><USER22> I've had an Xbox kicking up dust for months now, this is the first I'm hearing there were even emulators to start with, pretty disappointing.

But then again I guess it shows how often people actually use the App Store, I never looked at it, and I don't think anyone I know has either

</comment><comment><USER23> Every UWP app I saw poses a risk, results in discomfort, injures its users with ridiculous uselessness. Windows Store should be banned altogether, once and for all, for a brighter future of the humankind.

</comment><comment><USER24> I have always seen piracy of media after 17~ years as purely productive. No jobs are lost and modern generations are enjoying media which would otherwise have been lost to time.

</comment><comment><USER25> So what? There are many Javascript-based emulators out there. You just need a browser.

<comment><USER26> Or you could just download one from the internet and run the executable "manually." You aren't restricted to the app store.

</comment></comment><comment><USER27> And just like that, a new generation of hackers was born.

</comment><comment><USER28> bad publicity for the upcoming scorpio system

<comment><USER26> How is this bad publicity? Why would someone spend >$400 just to play emulators on a TV?

<comment><USER28> why would anyone ins 2016 not have an internet connection, and dont take advantage of online play

when there was a rumor or intention to make the xbox one require a net connection (a not so unreasonable requirement) most people took it negatively

anything that give the perception of limiting your freedom and choices, will be viewed negatively, even if those limits wont really hurt you

and i think you are correct, most people wont use emulators, most people dont even know what emulators are, so why ban them .. it is just bad publicity

</comment></comment></comment><comment><USER29> Holy poop, and I thought Apple is being quirky with its App Store!

Compared to the Xbox side and its costs, the App Store app review is a walk in the park.

I might understand this for AAA titles, but for indies this must be a nightmare.

<comment><USER30> They probably have bad memories of their last indie store on Xbox 360 which, if you visited it, was full of tutorial games and dating apps...

<comment><USER31> And Microsoft couldn't employ a few people to curate and administer this service?

<comment><USER30> It was community peer reviewed. As long as the 'game' didn't break in any obvious ways it was allowed on.</comment></comment></comment></comment>


World's First Open Source Insurance Policy - <AUTHOR> https://www.lemonade.com/policy-two <comment><AUTHOR> Frankly I wish more legal documents included the human (non-lawyer) readable version.

Clarence Thomas: The law ought to be accessible to the average person, he argued during an appearance at Harvard.

[https://www.theatlantic.com/national/archive/2013/02/why- cla...](https://www.theatlantic.com/national/archive/2013/02/why-clarence- thomas-uses-simple-words-in-his-opinions/273326/)</comment>


Cory Doctorow: Publish books free online - <AUTHOR> http://www.guardian.co.uk/technology/2010/may/23/cory-doctorow-my-bright-idea

<comment><USER2> "If you are building a business model that says that people can only copy things with your permission, your business is going to fail because whether or not you like it, people will be able to copy your product without your permission."

I think he is making a great point. This applies to "trade secrets", "patents", and "physics." Sharing your idea does not limit you, on the contrary, it enlarges the market. Corporations and scientific researchers do not get this fact.</comment>


Where Don Draper ends, D.B. Cooper begins - <AUTHOR> https://medium.com/sterling-cooper-draper-pryce/e96804523838

<comment><AUTHOR> It's also unknown whether or not he survived the jump -- and I think the "falling introduction" ties in well with this idea.

</comment><comment><USER2> Thought-provoking article.

I hope the theory is true. Although I guess we have to wait another season to find out.

Interesting, relevant counterpoint from Matt Weiner himself: [http://www.businessinsider.com/matthew-weiner-how-mad-men- wi...](http://www.businessinsider.com/matthew-weiner-how-mad-men-will-end- next-year-2013-6)

</comment><comment><USER3> Having got repeatedly annoyed by this: if you're using chrome on an android device (nexus 7 in my case) and medium.com flatly refuses to scroll, pulling down the page settings and selecting 'request desktop site' will make it look exactly the same ... except actually work.

Sadly (sort of), that means it no longer annoys me sufficiently to have bothered to work out why I have to do that, as yet :)

</comment><comment><USER4> Really interesting piece. I've been thinking for a while that the series would end with a live action version of the opening credits, with Don taking a swan dive off the top of the building. But I guess that's too obvious.</comment>


IOS 4.2 Software Update Features for iPad - <AUTHOR> http://www.apple.com/ipad/software-update/

<comment><AUTHOR> The reason I put this up here on Hacker News is that I did not know that they were going to be coming out with the ability to print from the iPad.

<comment><USER2> Info on how to set up your Mac to let iOS devices "print" to a PDF through it: [http://i.tuaw.com/2010/11/16/how-to-create-pdfs-with-your- io...](http://i.tuaw.com/2010/11/16/how-to-create-pdfs-with-your-ios-device/)

Requires hacking with currently released version of Mac OS X because there's some controversy about when/if AirPrint-through-a-Mac-or-PC will be coming. Some say it's cancelled, but that sounds kinda crazy to me: why even ship the feature on iOS if it's only going to be able to print to a small portion of HP's line of printers?

<comment><USER3> Wait, so air print won't even be able to print to a normal jetdirect or IPP printer?

<comment><USER2> I believe that's correct: it supports HP "ePrint" branded printers directly and, maybe, any other printer attached to a Mac or PC with iTunes installed by going "through" the Mac or PC.

It's because they don't want to start having user-installable device drivers on iOS (a laudable goal); I assume HP ePrint printers work because they speak something very PDF-like natively, though that's purely conjecture on my part.</comment></comment></comment></comment>


Who am I? - <AUTHOR> https://news.ycombinator.com/whoami

<comment><USER2> This concerns me more

[https://news.ycombinator.com/whoareyou](https://news.ycombinator.com/whoareyou)

<comment><USER3> Eh, it just returns that for any invalid URL.

<comment><USER2> [http://i.imgur.com/It7xugI.gif](http://i.imgur.com/It7xugI.gif)

</comment></comment></comment><comment><USER4> Interestingly, trying most *nix commands in place of "whoami" returns a page that says "Unknown.", like with seemingly any invalid URL.

However, trying [https://news.ycombinator.com/ps](https://news.ycombinator.com/ps) returns a completely blank page. Implying it may be a valid URL for some reason.

</comment><comment><USER5> I was a bit confused until I realized what account I was logged in as...

"Certified at 184.108.40.206"

</comment><comment><USER6> Heh. Is this actually being used somewhere? I wrote something to piggyback on Google App Engine's IP geolocation a while ago [http://blip.runway7.net/](http://blip.runway7.net/)

<comment><USER7> Awesome! Would the source code for this be available somewhere?

<comment><USER8> Google App Engine adds the following HTTP request headers:

      X-AppEngine-Country
      X-AppEngine-Region
      X-AppEngine-City
      X-AppEngine-CityLatLong

[http://rominirani.com/2012/04/25/appengine-location- detectio...](http://rominirani.com/2012/04/25/appengine-location-detection- update-x-appengine-country-and-more/)

<comment><USER7> Thanks for the info, I might try this out someday.

</comment></comment></comment></comment><comment><USER9> I wonder if this is looking at the local machine for a cookie, or the news.ycombinator.com machine for login information, or if it is a coordination between a private cookie storing an index that makes sense when combined with the database on the server.

Does anyone know the cookie format for ycombinator?

<comment><USER10> It looks the cookie format is just user={hash}, and looking at an older version of the code it matches that up to data loaded from a file called arc/cooks

[https://github.com/wting/hackernews/search?utf8=%E2%9C%93&q=...](https://github.com/wting/hackernews/search?utf8=%E2%9C%93&q=cookie&type=Code)

</comment></comment><comment><USER11> Did anyone else get a brief surge of adrenaline thinking your username was for some reason on the front page of HN?

<comment><USER12> I expected to receive an algorithmic psych profile of myself based on my HN comments.

Instead, I needed to work out if it was an IP address, or a count of how many hours I've spent on here...

<comment><USER13> Wow, how old are you? Like 8 million years?

</comment></comment></comment><comment><USER14> See also [https://www.google.co.uk/webhp#q=google%20what%20is%20my%20i...](https://www.google.co.uk/webhp#q=google%20what%20is%20my%20ip)

</comment><comment><USER15> Where am I? [https://news.ycombinator.com/pwd](https://news.ycombinator.com/pwd)

</comment><comment><USER16> First thing I thought of was `24601!`

</comment><comment><USER17> Now try WhoIsThat?user=</comment>


Some Schools Actually Want Students To Play With Their Smartphones In Class - <AUTHOR> http://www.npr.org/blogs/alltechconsidered/2012/10/03/162148883/some-schools-actually-want-students-to-play-with-their-smartphones-in-class <comment><USER2> I think it would be even better for schools if we could get an OLPC (or some device that runs sugar linux) with touchscreen.</comment>


Police drop bomb on radicals' home in Philadelphia (1985) - <AUTHOR> http://www.nytimes.com/1985/05/14/us/police-drop-bomb-on-radicals-home-in-philadelphia.html?pagewanted=all <comment><USER2> The Wikipedia section on the bombing of the MOVE house is at [https://en.wikipedia.org/wiki/MOVE#1985_bombing](https://en.wikipedia.org/wiki/MOVE#1985_bombing) .

Philadelphia, "The City that Bombed Itself."</comment>


Ask HN: What is your failure story? - <AUTHOR> We hear success story all the time. That is good but I think failure stories can give more learning.<p>What is your business or startup or carrer failure story? <comment><USER2> I was responsible for a software bug that forced the entire United States Coast Guard to revert to using paper records to track all of their Aviation Logistics for an entire month. The bug was in an aircraft maintenance dashboard that had over a dozen filters on it. It passed a thorough round of QAing, but once in production it was found that a specific selection of filters would create an infinite loop in the report that would crash the system. With hundreds of mechanics using the dashboard, someone was triggering that selection of filters every two to three days.

It was a very rough month for me. When an emergency patch failed to solve the issue, management decided to take the whole system down (it was too big a release and had been in production too long to revert). User satisfaction surveys bottomed-out. There was discussion in upper-management about firing me, but my immediate supervisor defended me and pointed out that this required failure at many levels. When we got the system back online, they had to hire dozens of contractors to manually enter all the paper records into the system.

I continued to code for the Coast Guard for five more years, got a big promotion to Senior Developer at one point, and left the organization with much respect. Every once in a awhile someone would present a graph of user satisfaction surveys over the years and there would be that awful month where the graph bottomed out, but I could eventually smile about what that junior developer did.

<comment><USER3> Huge kudos to your manager for standing up like that. Companies often look for a single point of failure (it's only human), instead of admitting that the organization as a whole systematically failed to prevent the error, let alone discover it "in time."

I hate to use platitudes but companies are only really as strong as their weakest link (not to impugn your skills or anything like that). Letting a single failure sink the whole ship means there are larger issues at play.

<comment><USER4> You also need to be a person worth fighting for. It goes both ways.

<comment><USER3> Presumably that's what the hiring process is for.

<comment><USER4> Right. Everyone knows that the hiring process is perfect and accurate and that if you're hired there's no need to prove yourself because you already did that in the interview are you kidding me?

<comment><USER3> I think you have a very maligned view of what managers should be if you agree with the thought that people need to prove themselves to managers to be "fought for." Especially over a mistake that multiple layers of the organization didn't catch and weren't equipped to handle.

No I'm not kidding you. That view point seems either very naive or nonconstructive. And considering you had to resort to a disingenuous straw man in order to respond to something I didn't say or imply, I'd say the latter is more likely.

<comment><USER4> You need to constantly prove yourself everyday. Lets put it this way. If I don't show up for work and I did well on the interview. I'm not proving myself aren't I? If I do horrible work, if my code is buggy and full of errors then what am I?

No manager will fight for that despite a strong interview. This is simple logic and common sense.

Obviously the person in the original posting proved himself.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Failure 1: I'd planned to do a PhD eventually, but I ended up more or less self-sabotaging my degree grade by being depressed and not doing anything about it (2:2 in the UK system vs. the nominal 2:1 ostensibly required for MSc/PhD applications to most places)

Failure 2: For the longest time, I never managed to make a good routine for myself. To learn, build things, exercise, meditate, etc. Good habits seem to be a pre-requisite for success in virtually any endeavor.

Failure 3: I had an interview scheduled with Google once, right after I had finished my military service in Finland (it's more or less mandatory for men).

I had scheduled it a tiny bit too close for comfort, just after I was supposed to have been out of the garrison. Turns out they called an hour too early (I specified UTC timezone but they marked it down as BST..) so I could only awkwardly tell them I could not talk at the time, and ask if they could call again an hour or a day later.

I never could get another call and settled for a crap job (by some standards). Maybe I could have earned a lot more and learned a lot more (and had a better network of contacts) if things had turned out differently :p

On a more positive note, I started doing freelancing/consulting last year after "no one" seemed to want to hire me at a decent salary and proceed to make OK amounts of money through random gigs.

Still figuring out how to network effectively. I figure the best bet is through gaining visibility online by publishing something useful.

<comment><USER6> I am in a similar predicament currently, and just want to let you know that there are others whom share your pain(s). I am 23 in 10 days, and haven't been in education since my community college days about 4 years ago. I have felt like a worthless pile of rubbish since then, however it is all related to depression, anxiety, ADHD, and an unsupportive family.

Personally, I find that small, but actionable changes to your routines and habits make the biggest difference. Please hang in there man!

</comment></comment><comment><USER7> * First month on the job I wrote some software that took our biggest customer offline every night (would've been during the day too if I'd picked a smaller constant in my code).

* Accepted a job for vastly less than market rates, luckily realized before too late.

And honestly I make more mistakes every week... Full versions of above stories at [https://codewithoutrules.com/softwareclown/](https://codewithoutrules.com/softwareclown/)

<comment><USER8> Can confirm, I'm subscribed to Software Clown for almost a year now and still have fun reading it every week (and I like to think I've learnt something from it as well). I love how you keep the articles short and dense so is no problem to read them even standing in crowded bus :)

</comment></comment><comment><USER9> Not a complete failure story, but I joined a FANG company as an entry level engineer. In about three and a half years, I've gone through two promotions. My most recent team where I got promoted to senior engineer is demoralizing to me and gives me anxiety even thinking about work.

I'm feeling a mixture of burnout and just a general disinterest in my teams domain area. My current team has also grown in ways I didn't expect when I joined.

My coworkers don't seem the most motivated. I spend less time coding or building anything and more time sending status reports and pointless meetings. I worked on very impactful things early in my roles at this company. I question the value of things my team is doing now.

My direct manager is very passive. There's literally no feedback or much engagement from him. His job is to make sure sally doesn't stab sue kind of thing.

Ironically, the culture is very cut throat. Longer term, I'm realizing I will have to quit and find a job elsewhere. It's a bit demoralizing after earning two promotions and putting in as much as I have. My husband and I were planning on getting pregnant by next year and purchasing our first home. If I leave my job, we have a sizeable nest egg but both plans will be up in the air. I haven't said anything to my husband yet.

I still have a job, but I'm questioning what was all this for.

<comment><USER10> Thanks for your post.

I am currently at a startup and have been here a few years. I came to really hate the environment, mostly because the people this company can hire are not what I would personally consider talented (due to a mix of non-exponential company growth and lower compensations than FAANG companies). The result of hiring low quality professionals is that the engineering standards are so low that it really depresses me.

For this reason, I've interviewed and got offers with 3 FAANGs, and I am contemplating about moving to one of them. After reading your post, I recognize I am perhaps romanticizing FAANGs a little bit more than what's fair, but the thing that intrigues me the most is the ability to work with and learn from other very talented engineers (so I can grow), that I have a hard time finding in startups that don't have big pockets as them.

And of course, also the financial aspects, since financial freedom is relatively high in my priority list.

<comment><USER11> FAANG companies are not where you go to find high engineering standards. You need to look for a job featuring one of these:

DO-178C DAL A (if you mess up, aircraft crash)

EAL5, EAL6, EAL7 (if you mess up, national secrets leak)

MISRA C (if you mess up, cars crash and a giant recall is required)

IEC 62304 Class C (if you mess up, medical devices kill people)

NUREG/CR-6463 (if you mess up, you get a nuclear disaster)

ISO 9000 and ISO 9001 (if you mess up, it will at least be documented)

If you didn't really mean high engineering standards, and you just want to work with capable people, you can find that all over the place. Perhaps being within commute distance of a FAANG has an impact, and you are seeing that due to your location. There are many people who refuse to live anywhere near a FAANG and/or wouldn't tolerate the culture.

<comment><USER10> Yeah, I definitely didn't mean high engineering standards then. The places you are listing wouldn't work for me because of the little financial incentives they provide. As far as I know FAANG are the only places where a reasonably decent software engineer can make ~$400-500k/y (at least those were my offers), and by living frugally the way I do that means massive savings even in a high cost of living location, which puts me closer and closer to my financial freedom goals they day I decide to be done and move to a low cost area.

So, I guess working with "very capable people" and a very good paycheck is enough for me :-)

<comment><USER11> Do you have a well-defined goal in terms of dollars and years? If not, you might always want a bit more money, and thus never quit. You'd miss out on the chance to raise a family. It's safest to get that done before age 30. No matter how much money you get, you can't buy back your younger years after they are gone.

<comment><USER10> Yes, if I can continue with my current savings rate, I should be done by my mid-late 30s (very early 30s now), with my passive investments fully covering my cost of living at least in Mediterranean Europe (where I'm originally from) or South East Asia (where my partner is from), both amazing places to live :-)

Both my partner and I are not looking to have kids (we've thought about it for many years before reaching the conclusion) and we already have extended families with tons of kids, so from that point of view we feel there's nothing we're missing, it's a non-priority.

For everything else, I'm not exactly wasting my life right now, I'm enjoying it even in a very high cost of living area: if you can deal with housing (and not having kids admittedly helps a lot since you can live in way smaller and cheaper places close to work), things are not that much more expensive than anywhere else, so I get a lot of experiences with good arbitrage :-)

</comment></comment></comment></comment></comment></comment><comment><USER12> Burned out six months into my first post college job. Not as dramatic as some of the other failures here. Just stopped showing up, and refused to leave my room for a week. Eventually got up the nerve to call them and explain what happened. They were willing to take me back but I realized it'd likely happen again if I continued.

So I changed fields inside tech, from IT support/sysadmin to web development. On the job hunt right now so still not sure if it was the right choice. I have been enjoying learning it significantly more than the sysadmin stuff.

</comment><comment><USER13> Once I scale up Azure analysis services(main data source for company Marketing and decision making) cause we were running low memory in peak hours, only to find out that I couldn't scale down, increasing cost by 300%. I had to recreate all the models again in the old tier increasing even more the cost cause we have to maintain both data sources till I finish with the creation of the models. My boss was mad.~azure lvl 100 destruction~

<comment><USER14> Here's my most memorable Microsoft snafu: My desktop was just upgraded to Windows 10. The "Favorites" links in File Explorer were converted into "Quick Access" links by the Microsoft migration process, but the aliases (titles) of the links had changed, or so I thought. I renamed the aliases back to what they were under Windows 8.

The phone started ringing with complaints, and to my horror I learned that I inadvertently _renamed_ widely-used WAN and intranet folders. Quick-Access had no aliases: I had inadvertently changed the _actual_ folder names. A colleague walked by and asked, "Why are you sweating and white like a ghost?" Fortunately I renamed them back before too much damage was done.

</comment></comment><comment><USER14> In my first job out of college, I had no training or experience in customer service. I was horrible at it without knowing what I was doing wrong.

For example, our system allowed for different ship-to's per order, but one vendor's receiving system wasn't able to handle multiple ship-to's. I should have referred them to my supervisor to negotiate something, but instead said, "you'll just have to change your system." They got irate. That and a few other "people skills" issues that needed tuning got me FIRED. I was devastated.

I had taken a "communications" course in college, but it was horrible in hindsight. The author and instructor should have been fired...uh, mentored, I mean. They should have made us read, "How to Win Friends and Influence People". Colleges have something against that book because it's not based on empirical data and doesn't try to sell the idea of using good logic. Instead it deals more with the "squishy" side of human nature. Humans are social creatures above all else.

</comment><comment><USER15> Once worked for a company that had a subscription based service. They wanted a monthly report of expired accounts so that they could warm-call for renewals. The bug was that some accounts had paid for 2 years. After a couple years, someone noticed that the reports hadn't been including the 2-years subscriptions and it was effectively a loss of a couple million in revenue.

While I did code it to the specifications I was given, and was really clear on understanding it was still a pretty big failure.

\-----

Second biggest failure was checking in the db connection against a production database into source control. It was internal source control, and the transforms (ASP.Net Web.config transforms) had it anyway, so wasn't an increased risk in that regard. I was troubleshooting a production issue.

What happened is another developer had used that connection configuration to drop/recreate a table. It took a few hours to recover from (DB restore, then replay against API activity logs). And a day of lost time for a few hundred workers.

</comment><comment><USER16> In the pre-HTML5 days of the Internet, I wanted to be a Flash Designer. Forever. I loved the platform and process so much, that I only had stars in my eyes for Flash! The idea of being able to blur the lines of animation, programming and design was wonderful. Then it died (April, 2010 [https://www.apple.com/hotnews/thoughts-on- flash/](https://www.apple.com/hotnews/thoughts-on-flash/)) and so did my career.

Fortunately, in most failure stories we can find some ways to recover. Knowing Actionscript developed some programming skills, which were applicable to HTML5.

My key lesson is learning how to pivot from one technology platform to another. It's not always easy, requires some humility, but it's possible.

</comment><comment><USER17> I developed an app many years ago , helping students find cheap eats around campus. The traction for people to use it was their but I didn't plan for the food stall owners to be extremely stubborn with prices and deals.

<comment><USER18> What happened?

</comment></comment><comment><USER19> 0\. Graduated from a top CS uni. Starting salaries were lower than KFC assistant manager. Started looking outside tech to for enough income to sustain being a programmer.

1\. Put down $6000 on a coffee kiosk. Made real good money every day. But partners were all dishonest and manipulative.

2\. Built an app for a guy. He paid well. Built another app for him. Contract sucked, one clause meant we couldn't get paid even though the project was 75% done.

3\. Wedding planner business. Too much work, too little profit.

4\. Brownies dropship, successfully distributed in petrol stations. Slow cash flow, dishonest suppliers.

5\. Sold snacks and tarts. Did very well in festive season, but demand flatlined after.

6\. Manufactured crab crackers. Unit economics didn't work out. Dishonest suppliers. Too capital intensive.

7\. Did prototype for a big company. Contact person later paid me half of what he verbally proposed. Project had potential, but felt cheated.

8\. Large tech project. Contact people were aggressive negotiators, trying to get insultingly unfair deals. One partner ragequit over it so we didn't pursue it.

9\. Tried to do price comparison startup for groceries. Grocery suppliers didn't like it because it puts pressure on their low margins. Gov warned us that crowdsourcing is illegal if we didn't get grocers' consent.

10\. Pivoted to recipes + e-commerce. Went remarkably well, but had to do some unethical things.

11\. Tried to pivot to Blue Apron style service. Too capital intensive, not enough VCs here. Logistics and market were underdeveloped. (A YC startup ended up doing this reasonably well, Dahmakan, but with substantial changes)

* Success point! Gave up on the startup. Sold whatever I had of my startup at this point, at enough money to cover up for all the above losses. Bought an Alienware and 4K monitor, wasted 1-2 years of my life playing games.

12\. Built app for a guy. Was paranoid of payment so there was a standoff where I refused to add features and fix bugs until client paid. Project was 90% done but client didn't close deal because of bugs.

13\. Took on a hell project just to try to be a hero. Unreasonable budget, unreasonable specs, nobody wanted the job. Couldn't do it.

14\. Worked on a startup for a guy. Too ambitious, architecture was too complex for team. Employees were overworked and unfocused, often "forgetting" to do things they were supposed to. They brought in consultants, managers, interns. We had 2 day sprints where half the time was spent in meetings discussing timeline.

15\. Inherited company from late father as a non-executive director, hoping for passive income. A Fortune 50 company didn't pay, putting said company about $500k in debt/bankruptcy. Saw the red flags early, but hard to put foot down on family business.

16\. Major project for multinational companies (plural). Top notch team. But VP insisted on unreasonable deadlines. 6 month project shortened to 6 weeks, at half the quoted price. Hacks were made, failed quality control. Teams blamed each other, started wasting each other's time to buy more time for their own work.

It seems like a lot but there's been some moments of success as well :)

<comment><USER20> Duuudeeeeee this was like watching a movie! You should totally turn this into a blog, perhaps even a book I bet you learnt lots along the way, you're literally the poster boy/girl for try, fall down, stand up, try Thanks for this :)

<comment><USER19> Yeah I can see how some people would get discouraged. But I grew up playing roguelikes. It was normal to try something, fail, then try again, understanding why one approach didnt work. It's actually fun to start something after a previous failure, because you'll be excited to try the path not taken.

If anything the mistakes I do regret is trying to settle for a comfy corporate job after selling my company. The failures were out of my control, and there was little learned from it.

</comment></comment></comment><comment><USER21> Failure 1: Worked for a friend's company. As employee #1. I was to have all kinds of freedoms and responsibilities. Sounded really awesome.

Failure 2: Was too conflict-shy to draw firm boundaries, and likewise was he.

This friendship of 20 years is no more.

(While working for said friend) Failure 3: Offered a hair-raisingly badly thought-out fixed-price bid. Both my friends's mistake and mine. We probably sunk about 5x what we stood to make from it, and then abandoned the project, embarrassing a relative in the process.

There's plenty more of course, but these bother me.

</comment><comment><USER22> Me - a graduate student in a university. Looking around on all servers on the network and found a program called "crack". it was designed to reverse- engineer passwords given a unix passwd file. I thought, what the heck, let me see if I can get some gems. SO I used yppasswd to download all password hashes, and ran crack on it. Needless to say, sysadmin found out in a couple of days, and suspended my account for 2 weeks :(

</comment><comment><USER23> Working remotely and contracting so I could travel the world. Went well until I burned out and ended up a broke alcoholic.

</comment><comment><USER24> Me and my friend developed the a call center on the cloud software (contactcentral.io) .We feel product is on par with other competitors in the same space but we failed in marketing. We both came from engineering background bootstrapped ourselves, couldn't find better marketing strategy to position it properly by generating actual leads.Either we should have cash to spend on marketing or good minds working on marketing.

</comment><comment><USER25> Back in uni, I wanted to be a motorcycle designer. I managed to get into Honda Japan's internship program, which was essentially a 3 day long interview process. They give you some design specs on the first day and then lock you in a room with 10 other kids to draw motorcycles non stop for three days. 4 years of effort all came down to these three days, and I couldn't draw anything on the first day. My mind went blank. I stayed up all night to catch up on the drawing. That was my first failure.

The lack of sleep meant I couldn't focus much during the second day. I pushed through and kept drawing. My next failure that night was to again forgo any sleep just to keep pushing out designs. On the third day, I was so exhausted by the lack of sleep, all the stress I piled on myself after all those years of expectations, My mind went numb during the morning's final prep. I was so tired, I didn't even know what the hell I was talking about during the final presentation, I interrupted the judges, I talked back, I argued. Naturally, I failed to progress to the next stage.

That failure was the beginning of a series of failures over the next several years.

I broke up with my fiancee to 'focus on my studies/career'.

I couldn't get a product/industrial design job because I was so focused on motorcycles during my studies that I was fairly terrible at most other products. Desperate for any job, I become a web designer for a company on the other side of the country. The job lasted six months.

I wasted money moving again to another city to search for better opportunities but found little. After another six months, I was out of savings and my family wouldn't lend me anymore money. I gave up, I contemplated suicide for a while, but finally moved back home to work for a relative.

About a year in, I got together with a couple of friends to set up our own design agency. One of them, talked the big talk but spent all his time playing games. Tried to rush work out the day before the deadline. The other worked really hard but wasn't particularly talented and decided to go back to his old job. I went back to work for my relative again.

After several years, found a small dev shop willing to take me in for not very much money. Spent two years there.

I'm in a better place now but those six years were terrible and whenever I look back at it, I've always felt that first failure at Honda just set a lot of things in motion. I was burnt out and depressed but I wouldn't admit it, so it just kept getting worst.

I have much gratitude for that relative who put up with me the whole time and gave me the opportunity, namely time to heal and a place to rest, to turn things around.

</comment><comment><USER26> Failure #1: Joined a mobile app startup as employee #3 for a lot less money than I should have, run by a guy who really didn't know how to run a startup, he had just convinced the parent company to give him some money to make mobile apps. He couldn't raise money, only get handouts from the board. I falsely assumed because those people were rich as hell and the other companies they owned were successful that we'd be okay also. But they didn't want to spend hardly any money, especially on marketing, and when our apps failed to make money, it just convinced the board to pull the plug on us.

Which lead to Failure #2: The startup guy decided to make a couple apps as 'warmups' before his main app idea. When those apps were released and didn't make money, the board became more wary about letting us do the 'main' app. If we had just started with the main app to begin with, they wouldn't have seen those app failures and we could have probably convinced them to keep funding it until release and that app might have actually seen success. Having low- investment but visible failures made the company look like a failure, and insured its death.

But not a failure: I had a lot of autonomy, I had my first experience managing other employees, and the apps we worked on helped me learn a ton in a short amount of time, and I'm still proud of them years later, even if they didn't reach much of an audience. That experience also helped me land my next job.

I could probably do that about every job in my career, honestly. Pretty much every job I've had was a mistake and a valuable learning experience at the same time, at least up to a certain point. Before this job I had joined another startup as employee #3 that failed for different reasons, and after this job I joined a small company that ended up having its worse year ever and lost all of their clients, and then I took a contract job I despised just to keep afloat for awhile where the entire department fell apart when the lead dev left and they terminated my contract, but that gave me the skills that helped me get my current job I've been at for 3 and a half years which started so successful it was bought by a larger company, and has been very slowly eviscerated by that larger company as it has been forcibly integrated into the rest of its corporation (our company, now division, has about 15% of the workforce it had when it was purchased, and it had over 500 employees a the time), and yet I've learned a lot while I've been here and worked on projects for the most highest profile clients in my life (you can't get higher profile than them, really) and for the first time I've actually had to really, really care about optimization since our traffic is massive and constant, although the stress has gotten beyond ridiculous now and I need to leave soon.

</comment><comment><USER27> Published an app on the App Store that tried to connect to localhost instead of the production API server...</comment>


Show HN: Bookwork.in, a place for old fashioned book lovers - <AUTHOR> http://bookwork.in

<comment><USER2> Received a 500 error when searching for a book.

Is this targeted at people in India? Wondering because of the .in domain. It is a really good idea for a place like India where the public library system is not that great. I grew up there and the way I was able to read books mostly was by borrowing from friends whose parents or grandparents had built up a collection.</comment>


Graphic Objects - <AUTHOR> http://www.ddj.com/dept/lightlang/199204122 <comment><AUTHOR> _'... A graphic interface bypasses the verbal and appeals directly to the visual ..'_ ~ pg, AI Expert, October 1988

Nice article about graphic interfaces, graphic objects, dynamic graphical representations using lisp.

</comment><comment><USER2> dupe of <http://news.ycombinator.com/comments?id=20515>

<comment><AUTHOR> Didn't see that. It seems theres no way you can check the urls when the one I submitted ( <http://www.ddj.com/dept/lightlang/199204122?pgno=1> ) and the one you refer to is at ( <http://www.ddj.com/199204122> ).

Thanks. Might not have submitted if I had been able to search. Better to have search check for similar titles (with urls) so I can check for multiple urls pointing to the same article before submission.

<comment><USER2> A user interface issue indeed. I suppose the best we have for now is Googling within the domain, and adding comments with links to previous discussions if we remember any.

<comment><AUTHOR> Guess I'll try that. I just missed reading that article. Would be nice if pg added a simple google search box hack with something like site:news.ycombinator to do this automatically. Certainly kill this problem. Wonder how regular google indexes the site? Because even then, as new stuff is added the lag in crawling & indexing the problem persists.

We need dynamic search. Could baysian classification be used ~ <http://news.ycombinator.com/comments?id=24189> to suggest dupes?</comment></comment></comment></comment>