NY hospitals pitch tents, nix surgeries to prepare for influx - <AUTHOR> https://www.bloomberg.com/news/articles/2020-03-14/n-y-hospitals-pitch-tents-nix-surgeries-to-prepare-for-influx <comment><USER2> My neighbor is a doctor, when he gets called to the quarantine unit, his family doesn't know how long it'll be (weeks? months?) until they see him again.

Last night he was headed to work. I saw him saying goodbye to his family with a bag packed. It was horrible. Kids crying, chasing after him...

<comment><USER3> I've been hearing over the past week a lot of optimism about how things will return to normal in two weeks (ie. schools are "closed until April <so and so>")

Where did these people get the idea that this will be under control in such a short amount of time?

Edit: Just to clarify I am not saying this to sow seeds of negativity, just wondering myself how can anyone announce reopening without any basis in reality.

<comment><USER4> Probably there's a big concern about civil unrest.

<comment><USER3> Civil unrest should not occur. Society and order will not disintegrate, and people will keep working (one of the better ways of dealing with the anxiety of this situation for many people, I imagine).

There isn't a food shortage; there will be a slow down of cargo movement because of extra safety precautions and less people working, but there is no reason to expect people to go hungry and riot over this. Food shelters will not be closing down. Water, electricity will continue working.

Things will get quieter for a little while, shopping malls will be empty and then running in a reduced capacity as things return to normal.

<comment><USER5> > _people will keep working_

> _less people working_

Something here doesn't make sense to me.

<comment><USER6> He meant to say "fewer".

</comment></comment></comment></comment></comment></comment><comment><USER7> My girlfriend is a physician at NYP in NY. It feels like there's almost nothing I can do to help and the worst case projections sound like a true hell I never thought we'd experience.

It's even scarier to hear how unprepared the whole system appears to be. The hospitals are extremely concerned about mask supply and they all just received an email on Friday recalling any boxes of masks from anywhere in the hospital to central storage. Apparently patients and others have been walking out with boxes of masks and it's impossible to order more.

I know a 60 year old who hasn't practiced medicine in a number of years who expects to jump into service in a week or two when patients are overflowing makeshift shelters.

<comment><USER4> How many weeks have we had to spin up mask factories? They're not exactly high tech items.

<comment><USER8> There is only one medical mask factory still in business in the US.

Edit: you can read more about the mask supply issue here. There maybe more than one but very few remain and 95% of masks are imported.

[https://www.washingtonpost.com/business/2020/02/15/coronavir...](https://www.washingtonpost.com/business/2020/02/15/coronavirus- mask-shortage-texas-manufacturing/)

<comment><USER9> "He's hesitant, however, to ramp up production at the facility outside Fort Worth, scarred by the boom-bust mess that occurred after the swine flu pandemic in 2009."

" But after the pandemic, demand declined, and it took months for hospitals and distributors to go through the surplus of masks they had ordered but never used. Prestige Ameritech had to let most of its new workers go. 'Everybody said they'd stay with us. The day after the pandemic they forgot who we were. We nearly went out of business'"

"A lack of planning on their part is not an emergency on my part," Bowen said. "They had their chance. I told them over and over."

That article contains a great background on the lack of long-term preparation.

<comment><USER10> Wow. Seems like the easiest and simplest step imaginable for the CDC or some other federal department to step in and give a large minimum volume commitment immediately, and put this particular fear to rest...

<comment><USER11> It wasn't guaranteeing the initial manufactured volume that was the challenge, it was the continuous orders after the crisis. All the US MBA's and purchasing departments went back to China-supplied JIT supply chains. To compound the JIT mistake, they ignored the owner when he told them the next time this happens, he's not risking his business to bail out everyone.

This is a US Federal government-scale public utility problem space. Hand the US factory-based US PPE companies a 35-year contract rolled over once a year. They are to build out capacity in several separate facilities for up to 10% of US population per day, paid entirely by federal taxpayer funds. Train skeleton DOD and DHHS staff on how to maintain and run it, keep key personnel in primary facility on alternating shifts with federal equivalents. Run skeleton output for DoD and social welfare-related consumption. Improvements in primary facility are simultaneously performed in national strategic facilities. Company keeps manufacturing on a JIT basis as they are market-forced to today.

Develop standards and protocols to store the PPE for 30 year durations, and intermixing with normal supplies to keep rotating them. Ideally design some kind of factory-reusable retort pouch, and make the PPE reusable with sufficient treatment, and easy-to-use validation testing. Normally let the factory reman the used-once gear to identify and fix field problems. Set a stockpile goal that gives the strategic factories time to spin up in enough time to fluidly cover a pandemic response.

Then turn around and start contact tracing the JIT decisions, and tell them they have 10 years to clean up their act and lay in stockpiles and best practices. Hold natural persons responsible.

I'm guessing some kind of plan like this is languishing in the now-disbanded CDC pandemic response leadership. Extreme risk planning has been a marked oversight of American-style business leadership, and I see no incentive nor reason it will ever change.

</comment></comment></comment></comment></comment></comment><comment><USER12> Seattle hospitals are also postponing non-life-threatening surgeries, as much to avoid consuming PPE as for beds and staff: [https://www.swedish.org/patient-visitor-info/coronavirus- adv...](https://www.swedish.org/patient-visitor-info/coronavirus-advisory), [https://www.uwmedicine.org/coronavirus](https://www.uwmedicine.org/coronavirus)

The County is converting at least one motel and at least one parking lot to recovery/isolation/medical support: [https://www.kingcounty.gov/depts/health/news/2020/March/14-c...](https://www.kingcounty.gov/depts/health/news/2020/March/14-covid.aspx) (scroll to "Temporary housing, isolation and quarantine facilities")

<comment><USER13> The surgeon general has asked hospitals nationwide to postpone elective surgery.

</comment></comment><comment><USER14> Shit...

I have a thing scheduled for early next month. Not a full on surgery but it is pretty invasive and urgent and they require me to be in the hospital for a few days.

I'm not in New York but I am in hotbed for the current problem.

Interventional Radiology is somewhat specialized so hopefully there aren't any interruptions. But they do have about 20 beds in their unit of the hospital.

<comment><USER15> I live in China. I have read many horror stories out of Wuhan, China after the local hospital got overloaded with patient.

1\. People got infected couldn't be treated and had to stay home. See this video that the daughter of a sick mom trying to get attention by drumming in the balcony and crying for help. "My mom is dying and I am helpless" [https://www.youtube.com/watch?v=cuvA0XooI5c](https://www.youtube.com/watch?v=cuvA0XooI5c)

2\. people with long term illness or scheduled surgery couldn't be treated, such as leukemia patient need dialysis, because Major hospitals has directed all resources to treat coronavirus patients.

Work from home, cancel meetings, stay away from the crowd.

Wash hands, wear mask if you have to go out.

Get medical advice from your doctors ASAP if you fall into the second category.

Please get prepared for the worse and don't let this happen to you and your loved ones.

EDITED: add a youtube video

<comment><USER2> Thanks for sharing your experience. My Mom is undergoing Chemotherapy, with a surgery scheduled in April. She has pancreatic cancer, which is a very tough cancer. They caught it early, and we were hopeful - until Covid 19. Now we have no idea how many delays, etc to expect.

Best wishes to you from an American. We're in this together!

</comment></comment></comment><comment><USER16> Yeah, I hope it doesn't come to it but this is the right first step. Adapted a flu surge model with folks at my company to estimate bed capacity shortage and it's not pretty. [https://qventus.com/blog/predicting-the-effects-of-the- covid...](https://qventus.com/blog/predicting-the-effects-of-the-covid- pandemic-on-us-health-system-capacity/)

</comment><comment><USER17> I don't know what to do. I am in LA for school, but my family is in NYC. They want me to come back, but it seems like the last place I should be going right now. Being with family is important, but the idea of traveling and adding another person to the population of NYC seems counterproductive to fighting the virus.

<comment><USER18> I'm in the exact same boat. I want to fly home and this is the only time I'll probably ever see super cheap tickets, but I'm young and the possibility that I could expose and infect so many people along the way makes it look as though shelter in place is the most responsible thing to do.

<comment><USER19> Don't worry about it; if you want to go home now, you should go home. If you're not symptomatic, and if you take even minimal precautions, you're highly unlikely to spread anything.

To me, the far more important consideration is if there's benefit in you and your family/friends being together now. That's what would make my decision.

</comment></comment></comment><comment><USER20> I'm terrified of what's coming. I feel so helpless.

<comment><USER3> Did you see the Louis CK skit about flying in a tin can and complaining about not having wifi on your cell phone?

Existence is a very fragile thing. Nature is unforgiving. We as a species have made incredible strides to be where we are today. People all over the world wake up every morning, do their routine, and go about their daily lives.

Around them, they are surrounded by people, care free and oblivious to the absurd amount of work it has taken to come to a point where people can relax their minds and go for a walk, get fresh water to drink, go watch a movie with their friends, or get in a fancy car and go for a drive.

We will make it through this. We are surrounded by all kinds of deadly shit waiting to kill us, and we are still here, thriving. There are many competent teams working on this to the best of their abilities.

Modern medicine is a technological marvel. Two days ago, a team of researchers managed to reproduce the virus which will pave the path to figuring out how to create antibodies.

It will take some time, and it has already impacted a lot of people. The death count will not stop going up, but we won't give up either.

We have given a middle finger to just about anything that could have killed us. We've erected hamlets, villages, towns, cities, metropolises. We have a station floating in space. Built monuments to things we like and things we despise. We've composed beautiful music to inspire ourselves to wage wars against each other. We are relentless and unstoppable.

Hang in there, and don't let helplessness take over you.

<comment><USER21> Just to clarify, that was a Louis CK bit. I enjoy both of their comedic styles.

Louis does it in a stand-up special, but here is a good Conan clip, with a great title: [https://m.youtube.com/watch?v=nUBtKNzoKZ4](https://m.youtube.com/watch?v=nUBtKNzoKZ4)

<comment><USER3> Thank you - I blanked out who it was!

</comment></comment></comment></comment><comment><USER22> And at the very same time, a bunch of bars are probably packed full of people. Maddening.

<comment><USER23> They were here in NYC on Friday.

<comment><USER24> Restaurants had 50%+ drop in traffic in NY state on Friday (opentable data).

<comment><USER23> We were talking about bars. And some of the bars around the neighborhood were packed on Friday night.

</comment></comment></comment></comment><comment><USER25> Tents work as long as you have enough artificial respirators and it's not too cold outside. Also, you need to have enough medical personnel, if the Chinese stats are correct about 40% of the Wuhan doctors got sick after 2-3 weeks of the whole thing getting really serious and they had to airlift about 6000 medical personnel from other Chinese regions.

</comment><comment><USER26> Wish I could be doing something. I've just fled to Long Island and am staying in the house reading the news.

<comment><USER3> It would not surprise me if there is a rallying call (state-sponsored employment?) for younger and able people to help out in the coming weeks, especially if a longer-term lockdown is happening. Things like picking up/dropping off groceries and other tasks on behalf of the elderly and infirm.

<comment><USER27> Especially those who have been infected and are immune. (I'm not sure we know to what extend people become immune though?)

<comment><USER3> I'm really at a loss on this subject because I'm trying to find out answers to two questions that don't have much coverage so far (understandable):

1\. The people who "recovered" from this so far, do their CT scans or other tests show alterations to their organs? I've read that survivors of SARS have had permanent damage that later led to issues like cystic fibrosis, and others.

2\. Has anyone really become immune to this thing yet? The "UK experiment" is going to be an absolute shitshow if they are walking into this without knowing that it's possible to be immune from it.

<comment><USER28> Regarding the second question, a preprint of study on SARS-CoV-2 immunity in rhesus macaque indicates that they did develop an immunity. [0]

[0] [https://www.biorxiv.org/content/10.1101/2020.03.13.990226v1](https://www.biorxiv.org/content/10.1101/2020.03.13.990226v1)

<comment><USER3> Reassuring - thank you!

</comment></comment></comment></comment></comment></comment><comment><USER29> I came here two weeks ago to downvotes and nonmedical people telling me how I was inciting a panic. Welcome to the show, folks. A lot of my colleagues are going to die soon and I'm beyond sad because of it.</comment>


Academic expert says Google and Facebook's AI researchers aren't doing science - <AUTHOR> https://thenextweb.com/artificial-intelligence/2018/07/14/academic-expert-says-google-and-facebooks-ai-researchers-arent-doing-science/ <comment><USER2> If you take the average Google AI project and the average AI researcher in academia, the Google project is going to be more useful to humanity 99/100\. Maybe at the very high end application is "beneath" exploration, but even then the puritans in the theoretical world seem the have the most impact subsequently applying their work (academia or not). Google and Facebook have the money to fund interesting projects with long time horizons. Does academia? You could argue not as much, it's about writing incremental papers as opposed to real world impact unless you have grinded long enough (or are at the top) to earn long-term measurement.</comment>


Secret Origins of the Batman: The Haunting of Robert Kane - <AUTHOR> http://www.dialbforblog.com/archives/391/ <comment><USER2> When the comic industry was young, they borrowed from each other. How else can you explain Shazam! aka Captain Marvel has some of the same powers as Superman?

They still copy, Deadpool Wade Wilson was a rip-off of Deadshot Slade Wilson. Sometimes they just change names and appearances.

I created original characters for a comic book, but they were too boring to print. So being original does not always work.

"Good artists borrow, great artists steal." Picasso</comment>


Getting stressed isn't just a state of mind. It can also seriously harm the body. - <AUTHOR> http://www.sciam.com/article.cfm?id=stress-dangers&print=true

<comment><USER2> so why do we keep booking ourselves to the brink?

<comment><USER3> Because we're impatient, because it's often the only way to get a step or two ahead -- ahead of what, I'm not sure; ahead-of-average maybe -- and because our society demands it.

Five or so years ago (can't remember now) I was couch surfing at a friend's. Now I've got my own little consulting business. I'm pretty proud of that, but I'm also pretty exhausted now.</comment></comment>


Stop Perfecting, Start Shipping - <AUTHOR> https://medium.com/shipharder/makers-stop-perfecting-start-shipping-3c1448e6920b <comment><USER2> I am not so sure. This is a handwavy advise I always hear from contemporary business wizbangs, but I don't think it is objectively or universally true. Pedantic, careful and attention to detail, perfectionist products that _just work_ without things breaking all the time are a pleasure to use from the standpoint of the customer. Figure out the implementation details, funding, motivation, etc. as an entrepreneur - shipping broken products to paying customers is something that I only see in the software industry. You don't buy a vacuum cleaner and expect to send half of the missing screws to the customer 6 months later. Hell, just 20 years ago when you bought your SEGA game cassette, it shipped as a final product. Not to be patched ever. Once its out to the factory, if you found a bug, tough luck. Yes, this analogy has its limits, but silicon valley mentality of this startup hustle is questionable.

I recommend watching this incredible talk (it's about software) : [https://www.youtube.com/watch?v=pW- SOdj4Kkk](https://www.youtube.com/watch?v=pW-SOdj4Kkk)

<comment><AUTHOR> Physical stuff != code...

It isn't about having functionality served half-baked but about having minimalistic functionality (only serve what brings the most value for the users to their table) and go from there.

It is irrational to think that you know _exactly_ what people want/is going to provide them with enough value to keep coming back to your service/product...

So why not start small by building the basics, releasing them, getting feedback and use that to move your product in sync with what the users want/need.

I loved the sega games as much as the next person, and I truly admire how they got so much shipped with such limitations.

But this indicates one big problem of makers nowadays: building functionality has become easier and easier with all the frameworks/tools/no-coding/... stuff that it has become too easy to ship too much (or lose yourself in keeping working on adding just a little feature here and there), thus straying away from shipping and getting that _golden feedback_ from actual (paying) users.

I'll be checking out the video later, thanks for sharing and your feedback!

<comment><USER2> > Physical stuff != code...

Think more abstractly. A business is delivering piece of IP to the customer in exchange for monetary value. The _medium_ of this IP can be physical or intangible. It is the delivery latency that's different. If those screws that I talked about arrived in about 45ms latency from the warehouse to the customer, and fitted themselves in another 2mins, you could patch things instantly. Just because this latency is different, doesn't mean you ship MVPs, broken pieces of software that require constant patching. Take time, carefully think about the architecture of the software, think about extensibility and modularity. Avoid feature creep, instead work on _just works_ aspect of the product. This is why I love software from companies like Sublime HQ. They make fast, efficient, well architected software that's a pleasure to use. Similarly, there is something beautiful about unix utilities, little pieces of software that just work :) Continuous delivery is great for huge software, Arch Linux, for example.

<comment><AUTHOR> I totally agree that setting up a product that is extensible, stable, scalable, etc. is something that needs to be done.

As I see it, and how I'm currently executing, is that the focus on extensibility and modularity increases over time. I look at making that extensible software as something that starts in an MVP with a focus on 1K users max, and grows and becomes more important from that point on. So it is something you can do a while after the initial launch.

> Just because this latency is different, doesn't mean you ship MVPs, broken > pieces of software that require constant patching.

I agree that the MVP should be working properly. No doubt there. But it should also focus on testing if it provides value (and see if it actually is viable?). By capping it at 1K users to start with you can focus on the value part instead of spending your time on tech implementation at first.

Especially for bootstrapping solo founders, I strongly believe that the focus should be on the value of the product in the beginning, not in the setup of the technical solution.

I'm going to use my own case as an example:

As a single developer I'm working on a product idea (sharing your videos via enhanced QR codes that enable Augmented video watching without the viewer having to install an app).

I could set up the infra, cloud services, build extensible pretty code and do the works in getting this ready to shine and go for 10K users.

But I chose not to. Right now, I'm focussing on the proof of concept (which is for showing ME that the idea is feasible and usable in the ways that I want it to work).

The PoC will only have the concept of working roughly and the code will be a lot of hacked-together code that makes sense to me. This isn't an MVP as I won't have user accounts, authentication, security, payments, .. implemented. Just the core functionality.

I'm going to share the product with a bunch of people in my network to get initial feedback about it and I'm going to use it myself.

I probably will use footage of using it, along with an explanation of the idea for a landing page.

I'll know within a week or two if the idea is good enough to keep using it myself and I'll have my network feedback along with things I didn't consider that need to be in check.

When the lights are green, I'll start a new solution with clean code and the core functionality from the PoC implemented so its clean, expandable, maintainable, secure, tested, etc.

I'll have the minimum feature set around it (security, accounts, support channel, payments, ...) to make it a whole experience.

For the MVP my focus lies on reaching 10, 100, and then hopefully 1K users. And I will have a tonne of work laying ahead of fixing stuff, giving support and helping out.

I'll also have metrics about bandwidth usage, unforeseen scenarios, people who are working my product and stretching its limits in ways I didn't even consider.

And _that right there_, that moment after I hopefully have a bunch of users, is where I would make sure the amount of users is capped, and where I start to invest time on making this more scalable, improving the app experience, see If there need to be changes of the services used I'll use in the background (behind the API), etc.

There will be a lot I've learned by this point. And if the product has proven to be viable (I gain enough revenue from it to justify working on it), I'll be working hard to make it even more secure, stable, scalable, and future proof.

While writing this, I feel like we aren't that different in how we look at things. Perhaps its semantics, perhaps I just need an extra cup of coffee.

I think that the focus on CI/CD, scalability, modularity starts with the MVP and increases from there.

I know there are quite some products that ran a nice MVP and reworked their backend from scratch on after some time to make things more flexible and elastic to take on more users.

My mantra:

Code Hard, Ship Harder</comment></comment></comment></comment>


Ask HN: How to successfully launch an iPhone app? - <AUTHOR>

I have developed an awesome iPhone application. The UI is cool, the idea is right, what are some ways to improve my odds of getting a good launch?
The idea is fairly simple so I am leery of just submitting to the appstore and letting competitors with PR teams copycat me.
Cheers! <comment><USER2> Try prmac.com -- Ray Barber will help with PR for a completely reasonable price.

</comment><comment><USER3> Your worries are unfounded. Release.

If it's great, you'll sell a lot of apps.

<comment><AUTHOR> Thanks! Anyway to jumpstart PR about it?

EDIT: Just checked out trailbehind.com, looks interesting! I've been looking for something like this for a long time. Not to derail my post, but is there a way to filter by additional criteria other than genre of activity?

For instance suppose I would like to see all 5.11 sport routes near Philadelphia PA. Is there a way to do that?

Also is there a way to specify sort criteria?

<comment><USER3> Nope, for now what you see is what you get. You can only sort by type of activity and distance.</comment></comment></comment>


Alertbox Columns Moved From Useit.com to NNgroup.com - <AUTHOR> http://www.nngroup.com/news/item/useitcom-moves-to-nngroupcom/

<comment><USER2> No more old school formatting.

When you go to the wayback machine it indicates there are old records, but when you click on any of them they are missing.

<http://web.archive.org/web/20090615000000*/http://useit.com>

</comment><comment><USER3> This is why the Internet Archive (<http://archive.org>) is so extremely important. Because even the MOST popular and important URLs do not live forever.

<comment><AUTHOR> Ironically, <http://www.useit.com/alertbox/fighting-linkrot.html> does not redirect to <http://www.nngroup.com/articles/fighting-linkrot/>

NVM: The original URL was <http://www.useit.com/alertbox/980614.html>, which does redirect.

</comment></comment><comment><USER4> What I want to know is whether it gets as many hits in its new location on the corporate-looking site....</comment>


Debian 9 Stretch released - <AUTHOR> https://www.debian.org/News/2017/20170617 <comment><USER2> Chris Lamb here, Debian Project Leader for 2017. Would love to get your feedback on the parallel "Ask HN" thread here:

[https://news.ycombinator.com/item?id=14579080](https://news.ycombinator.com/item?id=14579080)

<comment><USER3> I don't use debian anymore, was my first linux distro, I align more with arch but I'm very happy to see you walking steadily.

Happy distrofathersday

<comment><USER2> > I align more with arch

Could you briefly outline why? :)

<comment><USER3> These are not perfectly sensical reasons:

\- old arch single config file, with '@' syntax for parallelism got me hooked; sure it's different in systemd days

\- early problem free systemd adoption

\- simplified, close to upstream distribution (don't want to dig for src, dev, docs etc)

\- their wiki is the one that speaks the most to my mind, I try to be gentle and objective, but every time, I find solutions in a short amount of time, and even more ideas. They hit a very very sweet spot to me. (gentoo was like that before the data loss)

\- no installer, might seem stupid but it's a bit easier to reason with it; I don't have to learn an install framework, it's very bare and unixy.

\- very thin tooling from arch, debian does a lot, but it's too heavy for my mind. Things might have changed since I last live in debian but I run a few debian live isos and derivatives and it always feels like "too much", administrative (as the debian documentation)

\- rolling by default, debian has testing but it feels riskier

\- AUR felt simpler (again) than custom apt repos

Also I might add that I distanced myself from the OS quest (or if I could I'd run a lisp or smalltalk fork or something similar). I'd be happy to hear your suggestions about my points if you have time for that.

<comment><USER4> > _their wiki is the one that speaks the most to my mind_

I'm a debian user, and I love the arch wiki. The debian wiki is often stale and/or incomplete, and usually you're told to go to the mailing lists (which are an awkward way to get info). The arch wiki is great at being clear and concise and I find arch's mediawiki to be more easily legible than debian's bare html.

<comment><USER3> Not only debian, but all distros so far.

</comment></comment></comment></comment></comment></comment><comment><USER5> Don't forget to verify the install medium, which is a little more involved with Debian.

If you're already running a trusted Debian system, then install the debian- keyring package. Packages are signed and verified, so those keys don't need further verification.

Otherwise, fetch the keys in [0] with gpg:

      $ gpg --keyserver keyring.debian.org --recv-keys <...> # e.g. 0x6294BE9B

Then, verify the key's fingerprint with [0]:

      $ gpg --fingerprint

Unless you don't trust your CA, this is good enough.

Finally download the checksum and their signature files, and verify their signatures:

      $ gpg --verify <...> # e.g. SHA512SUMS.sign
      $ gpg --no-default-keyring --keyring /usr/share/keyrings/debian-role-keys.gpg --verify <...> # if using debian-keyring package

[0] [https://www.debian.org/CD/verify](https://www.debian.org/CD/verify)

<comment><USER6> With files SHA512SUMS and SHA512SUMS.sign in the current directory the verifying can be as simple as

        gpg --auto-key-retrieve SHA512SUMS.sign

The key is retrieved from user's default keyring or keyservers. The usual keyserver pool (pool.sks-keyservers.net) has the Debian CD signing key. How we can trust that the key is the right one is another matter. It is signed by many Debian developers.

<comment><USER5> Right, if you're already in the WOT then there are better ways, but then you're probably familiar enough with GPG that you don't need any help. :-)

Most distributions have signed checksum files, but _also_ post those checksums in a HTTPS location. I, and I suspect most people, just check against that and call it good. AFAIK Debian don't have that, and between using GPG or thinking "F* it, I'll take my chances", I suspect many would choose the latter. I was trying to give people who's security conscious but not paranoid^W^Wlazy an option.

</comment></comment></comment><comment><USER7> As a former Debian Project Leader from many years ago: congratulations on another fine release!

<comment><USER2> Hey Wichert, nice to see you pop up here!

</comment></comment><comment><USER8> I have been running a little "Single Server LAMP Lifestyle Business" for 15 years now and it has been happily crunching away on rock solid Debian all the time :) All in all I spend a few hours per week on it and it pays all my bills. Thank you, Debian team!

From what I read [1] Debian 8 will be supported until April 2020 and Debian 9 until June 2022.

So in 2020 I will have to decide to either switch to Debian 9 or to Debian 10 which probably will be out by then. Is that correct? My feeling is that it might make things easier for me to skip Debian 9 and go directly with Debian 10.

I did the same with 7. My server used Debian 6 until I switched to Debian 8.

[1]: [https://wiki.debian.org/LTS](https://wiki.debian.org/LTS)

<comment><USER9> I have to wonder - if it runs your business, have you ever donated to Debian? This isn't having a crack at you, most people haven't donated.

<comment><USER10> Code contributions are appreciated as well :)

</comment></comment></comment><comment><USER11> One of my favorite changes:

> If you use debhelper/9.20151219 or newer in Debian, it will generate debug > symbol packages (as <package>-dbgsym) for you with no additional changes to > your source package. These packages are not available from the main archive. > Please fetch these from debian-debug or snapshot.debian.org.

No more shipping -dbg packages with full binaries. And less storage space is always a win.

<comment><USER12> -dbg packages never shipped full binaries (with a few exceptions for unusual libraries); they always shipped detached debug symbols. This change just makes them automatic and puts them in a separate archive.

<comment><USER11> Did not know that, thank you. Do you know happen to know how it is done? When I pull the debian tarball for nginx (which has a -dbg package with symbol files) I see:

> dh_strip --dbg-package=nginx-$(*)-dbg

Which is the exact same command I use in my rules file. But instead of giving me a -dbg package with symbol files debuild gives me a -dbg package with the unstripped binary. Not sure what I am missing. I am following the DebugPackage guide on the Debian Wiki[1].

1\. [https://wiki.debian.org/DebugPackage](https://wiki.debian.org/DebugPackage)

<comment><USER12> With current Debian, you don't need to do anything at all, and in particular you should not pass --dbg-package. Instead, dh_strip will automatically create a -dbgsym package containing detached debug symbols, if your package contains a library or binary.

Also, make sure that you build with debug symbols enabled in the first place; the default CFLAGS should do that.

<comment><USER11> Sorry, I'm not asking about current Debian. In your previous comment you mention that the symbol packages are not new. I'm wondering how people have been creating them on Debian 8.

</comment></comment></comment></comment></comment><comment><USER6> My favourite change is the transition to GnuPG 2.1 as the default /usr/bin/gpg. Particularly the "trust on first use" (TOFU) trust model is a really good improvement.

</comment><comment><USER13> Finally! Been eagerly waiting for this. Congrats Debian team.

This is surprising though:

> _Python 2.7.13 and 3.5.3_

I thought 3.6 was in Stretch out of the box. Why 3.5 only (especially on a LTS)? :\

<comment><USER14> Including Python 3.6, even as a non-default Python, would have required to rebuild all Python packages and handle the non-working ones (either fix the problem or explicitely exclude Python 3.6 support for this package). There was not enough time to do all that.

<comment><USER9> Any bugs I should look at in particular? Does this mean we're stuck with Python 3.5 for the lifetime of Debian 9?

<comment><USER15> Would love to know this myself.

I'm in process of moving my company's main web app to python 3, and standardized on 3.5 to match Debian 9.

But python 3.6 has so many cpu & memory improvements (not to mention things like f'' strings), seriously considering installing custom copy of 3.6... though not sure if I want the burden of maintaining my own copy of everything that will affect.

Then again... "Debian stable" being rock solid stable is why I stick with it for production; if their caution in this is the price I pay, it's worth it.

<comment><USER9> I'm not sure how tricky it'd be to maintain your own repo just for Python 3.6. It may be worth it.

</comment></comment></comment></comment></comment><comment><USER16> It seems you have committed to supporting Python 2.7 for two years longer than official support. Could you comment on that situation?

<comment><USER17> This also applies for the perl version they shipped, perl releases are supported for 3 years, Debian for 5.

It's inevitable that you're going to get mismatches between OS support and "official" support for the specific packages that go into that release. Not all projects provide supported releases over a period of years, so distros just do their best to patch any issues that upstream has stopped caring about past that point.

In practice the only thing that's going to be a big worry are new security issues, which upstream is usually willing to go out of their way to fix for versions still used in the wild, even for technically "unsupported" releases, at least the Perl project is, I don't know about Python.

</comment></comment><comment><USER18> I'd like to know if the Linux server landscape is changing in favor of Debian due to Docker. It seems most popular packages are based on Debian.

Although Alpine Linux is my personal choice.

<comment><USER10> Alpine is the default iirc

<comment><USER19> Strange, this is the first time I hear about Alpine, most of the server stuff I work/worked with were either Redhat or Debian.

<comment><USER20> A lot of people porting older applications that depend upon base OS assumptions into containers will probably be using more full-featured containers. With greenfield applications I would expect more use of Alpine or even the scratch base image for people trying to deploy truly minimal containers.

</comment></comment></comment></comment><comment><USER21> As I mentioned yesterday on the "Upcoming" comment thread ([https://news.ycombinator.com/item?id=14574287](https://news.ycombinator.com/item?id=14574287)), if you're looking to start using Stretch in your Vagrant dev environment, we're uploading AMD64 & i386 boxes for both VirtualBox and Parallels providers to Atlas as I type this. (If you're reading this soon, make sure it's v1.2.0, v1.1.0 is based on RC5 from a few days ago)

Edit: the uploads are complete, v1.2.0 of debian9-amd64 and debian9-i386 are released.

[https://atlas.hashicorp.com/koalephant](https://atlas.hashicorp.com/koalephant)

If there is user demand for it, we can look into vmware boxes, and possibly hyper-v too.

Apologies if anyone feels this is off-topic/opportunistic - AFAIK all other Debian 9 boxes on Atlas target Virtualbox only, and while projects like Boxcutter (which we forked from) _do_ support Parallels/etc, they aren't always the quickest to produce new boxes.

</comment><comment><USER22> fyi Debian names their releases after Toy Story characters.

Sid (Debian unstable) is named after the guy that breaks the toys.

<comment><USER12> And experimental is called "rc-buggy". (Debian has the notion of "Release Critical" or "RC" bugs, which affect migration from unstable to testing, so I find the nickname "rc-buggy" for experimental hilarious.)

<comment><USER23> IMHO, rc-buggy would have been a better pun for unstable (which is where packages with RC bugs are blocked until they can transition to testing).

<comment><USER12> It would have been, yes, but sid was already named.

</comment></comment></comment></comment><comment><USER24> Nice! I see it's already available on Linode.

<comment><USER25> Oh that's nice. I'm about to deploy things to Linode. Will check now.

</comment></comment><comment><USER26> Well, my Tangerine iMac will be sad to see debian support go.

<comment><USER9> 233mhz PowerPC? How long did you keep it going for? How long did you use it for?

<comment><USER26> Actually a 400 MHz one. Through the help of eBay I upgraded it to 1GB RAM and 160GB HDD. It's currently built into a desktop arcade machine running MAME.

I have an awful habit of re-using old tech instead of throwing it out. Hopefully I can eventually get rid of the stuff that still works at the MIT FLEA or something.

</comment></comment></comment><comment><USER27> I use debian mainly for servers. Tried Debian 9 this morning for desktop, do not like the hidden-by-default-activities UI, also D9 does not recognize my dual LCDs(Ubuntu has no issues with that), so it will be the same for me: All servers will be upgraded to Debian 9, Ubuntu LTS for the desktop, and ArchWiki for documentations. Good for now and Thanks for the new release.

</comment><comment><USER28> How long does it usually take for things to settle down in Testing after a stable release? I heard it might take up to several months.

<comment><USER2> I would actually recommend running unstable these days.

<comment><USER29> Unstable over testing? Really? Why? :-)

I've been running stretch on a lenovo carbon x1 for the last 2 years and it's been one of the first problem-free experiences running linux on the desktop (linux user for.. 18 years). Really awesome. Thanks!

<comment><USER30> Some years back I was using testing. It was the year they changed over from Gnome 2 to Gnome 3. I couldn't use the stable release because my mainboard and cpu wasn't supported.

Boy, was this a hard process. It took some months until my system worked without GDM crashes. After that I changed over to Arch and been a happy Arch- er since than. I wouldn't recommend running testing.

I've heard that unstable is more like Arch linux and the rolling release model of Arch Linux works very well for me.

</comment></comment></comment></comment><comment><USER31> Thanks a ton to the whole debian team. You do amazing job that keeps the modern computing running day and night.

</comment><comment><USER32> _Chromium 59.0.3071.86_

How well is Chromium supported on Debian?

I like it as a secondary browser for its excellent support of multiple profiles but I run Ubuntu and had to switch to Chrome because Chromium doesn't seem to be updated promptly.

<comment><USER33> You should check out the new contextual containers feature in Firefox if you haven't. Both more convenient and more powerful than profiles.

As someone commented elsewhere in this thread, you can get FF version 52 in the security repo of Stretch, even if the default browser is Firefox ESR.

[https://testpilot.firefox.com/experiments/containers/](https://testpilot.firefox.com/experiments/containers/)

<comment><USER32> Interesting. Does it also allow different settings/addons per each profile?

<comment><USER33> I don't think so, but some addons support per container settings. For example Cookie AutoDelete where each defined container can have its own whitelist:

[https://addons.mozilla.org/en-US/firefox/addon/cookie- autode...](https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/)

</comment></comment></comment></comment><comment><USER34> Downloading it, does anyone know how does Debian work on a MacBook Air 7,2?

<comment><USER35> Why not run it on a new box?

<comment><USER34> I don't understand what you're trying to say. I want to use Debian as my daily OS because I don't like how macOS does things, and I got a MacBook because they are good quality and have a good warranty and I can run all 3 platforms (Win+Lin+Mac) on it if I so desire.

<comment><USER35> You like Apple's hardware but not its OS. I think there are better compromises out there, but of course, feel free to do your thing.

<comment><USER34> I don't wanna argue, but keep in mind that I'm in Serbia and that I bought the MacBook with a "special financing plan" which the Apple reseller offered but not any of the generic stores that carry such ultrabooks as the XPS 13 or the Spectre...

<comment><USER10> I am not sure I understand

<comment><USER36> Basically their material circumstances have lead to a particular outcome.

</comment></comment></comment></comment></comment></comment></comment><comment><USER37> I've been running Stretch for 6 months and can't remember a single crash or issue. Amazingly stable release, kudos and thanks to everyone involved.

</comment><comment><USER38> Nice to see this release; I'd already started upgrading some of my lightly- loaded servers over the past few weeks but the "real" ones will wait a little longer.

One thing that is new in this release is the availability of mod_http2, for Apache. I'm looking forward to seeing if that will increase the response-time of my various websites.

</comment><comment><USER39> At last the freeze is over. It started to be a bit annoying to build Mesa from source when stuff like newer llvm and libdrm are hard to squeeze into frozen Debian testing.

I suppose the idea of reducing freeze time with "always releasable testing" didn't really work out (lack of resources?).

<comment><USER40> Testing is usually a bad distribution to use for anything in production. If something breaks, it will stay broken for quite a long time until the fix makes it out of Unstable.

Unstable is almost always a better choice. Things may occasionally break, but fixes will arrive very quickly.

<comment><USER41> Serious question...

Can't you make the same argument against using stable for the same reason?

> If something breaks, it will stay broken for quite a long time until the fix > makes it out of unstable [and testing].

<comment><USER39> Stable usually doesn't get such issues. They are related to transitions. Sometimes it happens, that some packages are stuck in unstable for example, because they don't build on some arch, while their related packages go through. In result, testing gets an inconsistent combination, while unstable is OK. It happens when someone didn't take care to specify that these packages should only move to testing together.

This won't happen with stable, since it will get the consistent result in the end.

</comment></comment></comment></comment><comment><USER42> Firefox is back.

Me: Yay!

In version 45 (released on March 8, 2016)

Me: WTF.

<comment><USER43> It's Firefox-esr in the repo, which is the extended support release, [https://www.mozilla.org/en- US/firefox/organizations/](https://www.mozilla.org/en- US/firefox/organizations/)

I think 52 is in the security repo now, though

<comment><USER42> Oh okay. Thank you!

</comment></comment></comment><comment><USER44> Really looking forward to this release. We run Kubernetes with Debian 8. One of the big pain points has been needing to enable Docker memory accounting. I read that memory accounting will be enabled by default in Debian 9. Is that still the case?

</comment><comment><USER45> Happy to report I updated last week already and even my cubox-i (arm) booted just fine on first attempt. Thanks and congratulations!

</comment><comment><USER31> Anyone else tried to get debian running on Macbook pro late 2016?

</comment><comment><USER46> Golang 1.7... 1.9 is due out soon. Sigh, this is why I end up installing things myself without a package manager.

<comment><USER47> Debian stable releases have a 2+ year lifespan so even 1.9 would be out of date for most of the distro's life.

Luckily Go is quite easy to install and use from an isolated directory, and the majority of Debian usage here would be as a target OS where the Go compiler version doesn't matter.

Also jessie shipped Go 1.3 but it was updated to Go 1.7 in jessie-backports, so you can probably expect further Go updates in stretch-backports when it's released.

<comment><USER39> You don't need to use stable. Debian testing is rolling and only stalls during release freeze period.

<comment><USER48> I use unstable in my day to day and have had minimal problems.

<comment><USER49> Same here, my laptop as been on unstable for over five years and it's been fine.

<comment><USER50> Unless you need Debian for some reason, why not use one of the arch based distributions or fedora/some other redhat based one? Those always have the latest packages.

<comment><USER49> I don't get the question. I already have the latest packages on Unstable, why would I switch?

</comment></comment></comment></comment></comment></comment></comment><comment><USER51> Does it support USB yet? ;-)

</comment><comment><USER52> Congratulations. The return of Firefox branding makes me feel nostalgic. I remember using Firefox 1.04 on Debian in the early 00's. This was in the golden age of Firefox, when every new release was an improvement and it was a lean non-bloated alternative to other browsers.

In the past Debian was considered to be one of the most stable Linux distributions available. Stability and quality was a priority above anything else. However, around 2014 something changed when systemd was forced into Debian in a way that would never have happened before the new generation of developers took over the project.

Maybe this is just something we have to get used to, young developers seems to value ease above quality and stability, this also explains the current flood of Electron apps.

<comment><USER14> Half of the technical committee chose systemd. None of them are new comers. The casting vote in favor of systemd was done by Bdale who is a Debian developer since the very beginning.

<comment><USER52> systemd was just a symptom. Multiple developers that had been working on Debian for many years, left the project in that period for various of reasons.</comment></comment></comment>


Zapcc – A caching C++ compiler based on clang - <AUTHOR> https://github.com/yrnkrn/zapcc <comment><USER2> Could someone give us more of the story around ZAPCC ? I see that it is a C++ compiler that is based on clang, and that it only works well on Linux. Could someone (perhaps turrini) share some comparison tables of the relative speed, size, disk usage, of this compiler compared to clang and gcc ?

<comment><USER3> Explanation why fork of clang was required (as opposed to just improving clang) would also be interesting.

<comment><USER4> I evaluated zapcc at one point. Its a fork of clang because the changes are very intrusive to clang, and probably would have had a hard time getting accepted in to trunk without a ton of debate. I believe it actually daemonizes in to a long running server process (zapccs) that then holds the instantiated templates in memory, communicating with the zapcc compiler process over IPC. I think that most clang maintainers would have found that radical of a rearchitecting kind of controversial especially from an outsider to the project.

<comment> loup-vaillant > _especially from an outsider to the project._

That should really not be a criterion.

<comment><USER5> How else will the project know that the major changes will be maintained? Having code in a project without an owner will just lead to bugs and bit rot.

<comment> loup-vaillant So now not only projects have to be maintained, we also have to maintain _changes_? I'm seriously getting sick at the notion that nothing can ever be finished.

Bugs? That will be those introduced by the change, nothing more. If there is any bug left, that's only because nobody discovered them yet. Having a maintainer won't change that, only _usage_ reveals bugs. (Unless of course the "maintainer" is instead tasked with finding bugs in the first place).

Bit rot? That's only an issue when the environment _around_ the code changes. Clang is a _compiler_ , there's not much it cares about its environment. And if you're talking about changes _within_ Clang that could have an effect, and those are well within the maintainer's control. We shouldn't need a maintainer for every patch.

This change in particular doesn't seem to introduce any new feature. I'm guessing it only allows Clang to run faster. The new code path _replaces_ the old, so it shouldn't require much more maintenance.

\---

More generally, we should do away with the notion that everything should be maintained, forever. We should be able to code correct programs. We should have environments stable enough to preserve that correctness. And we should stop believing we need so much code in the first place. Let's not kid ourselves, programs "require maintenance" (euphemism for "aren't finished"), mainly because they're so damn big. We can do better, really.

[http://vpri.org/work/ifnct.htm](http://vpri.org/work/ifnct.htm)

[http://www.projectoberon.com/](http://www.projectoberon.com/)

[https://www.youtube.com/watch?v=kZRE7HIO3vk](https://www.youtube.com/watch?v=kZRE7HIO3vk)

</comment></comment></comment></comment></comment></comment><comment><USER6> Does ZapCC provide libclang.so which utilizes this caching?

I noticed that parsing heavy-templated files with clang-based tools is also very slow which probably means that some kind of template instantiation (or other processing step) is being made. These tools could greatly benefit from any speedup.

While reported 2x average speed-up may be not big enough for me to consider ZapCC for offline compilation, 2x less time to get list of completions in Clang-based IDE is something I would be very happy to get!

</comment><comment><USER7> > in-memory compilation cache

I'd like to see a persistent cache. In-memory doesn't work well for the "occasionally recompile Firefox, LLVM/clang, WebKitGTK, etc." desktop use case...

<comment><USER8> Isn't that what ccache provides? Admittedly it's not perfect but it sounds like it might help your use case. [https://ccache.samba.org](https://ccache.samba.org)

<comment><USER7> This new zapcc thing seems to be more granular than ccache, it caches individual template instantiations

</comment></comment></comment><comment><USER9> How is zapcc better than ccache?

<comment><USER10> ccache does not speed up full build. zapcc does.

<comment><USER9> What do you mean by "full build"?

<comment><USER11> zapcc speeds up the build even if you changed a #define across the whole project or added a line to a header that you use everywhere leading to recompiling of all your .cpp files.

</comment></comment></comment></comment><comment><USER12> Thanks for the open source release! I tested it with their commercial version before and it was great for C++ projects.

</comment><comment><USER13> How does this differ from PCH?

<comment><USER14> Disk I/O. This stays in memory between compilations.</comment></comment>


Non-Euclidean Worlds Engine - <AUTHOR> https://www.youtube.com/watch?v=kEB11PQ9Eo8 <comment><USER2> The potential uses for this to solve the problem when the space in RL is limited but the space in VR is infinite.

<comment><USER3> But you never walk in perfect circles(nor rectangles) and so you end up hitting the meatspace wall sooner or later. Perhaps VR itself could steer you away from walls as needed. Not sure if it's doable without the odd and moving angles creeping the user out.</comment></comment>


A Few Notes on Raising Venture Capital Part 1 - <AUTHOR> http://ownlocal.com/newspaper-support-group/a-few-notes-on-raising-venture-capital-part-1/

<comment><USER2> FTA: _Beware the VC that has invested in a competitor. ... Even if they're not going to share the details of your powerpoint_

Protip: They're going to share the details of your powerpoint.</comment>


Twilight, the Anti-Fan and the Culture Wars - <AUTHOR> http://reviewsindepth.com/2010/03/twilight-the-anti-fan-and-the-culture-wars/

<comment><USER2> I suppose there are reasons pushing for the study of recent popular culture (easier access to interviewees, for one), but often I get the feeling that things get lost in the recency and media attention: studying Twilight has this weird trendy/journalistic feeling to it, no matter what angle you take on it, and we don't currently have much perspective on how it'll play out. I'd much rather see the "anti-fan" concept (which is interesting) studied with a less recent example where we have a lot more distance on the height of the fandom/antifandom, e.g. by studying the disco-haters of the late 1970s or some other example > 5 years old.

<comment><AUTHOR> I had a brief look and can't really find any detailed empirical work on the matter. The paper by Gray cited in the article does not really have much empirical work behind it - but is more about identifying the concept of the anti-fan as such and acting as a call to action for the research that is needed.

Given that the concept is relatively new, it may be extremely difficult to identify historical records of genuine anti-fans back in the day, since many may not have known that this is the sort of practice they were engaged in.</comment></comment>


PandoDaily Acquires NSFWCORP - <AUTHOR> http://pandodaily.com/2013/11/25/pandodaily-acquires-nsfwcorp-to-double-down-on-investigative-reporting/

<comment><USER2> From the Guardian article:

      Carr said he expects Pando to start making more waves,
      but for different reasons. Pando's investigative team
      would target all the most powerful people in the Valley
      and challenge them "when they need challenging," he
      said. Some of Pando's investors "were going to shit
      himself" when they heard NSFW's team was joining
      Pando, he added.

Somehow, I really doubt this part. I think non-investors have a much higher probability of getting "challenged" than investors.

</comment><comment><USER3> They're such investigative journalists that they won't even provide any details of their own transaction. Oh, wait.

</comment><comment><USER4> Don't wish to be a grump but the original announcement post is from Pando Daily/ Sarah Lacy @ [http://pandodaily.com/2013/11/25/pandodaily-acquires- nsfwcor...](http://pandodaily.com/2013/11/25/pandodaily-acquires-nsfwcorp-to- double-down-on-investigative-reporting/) and this post doesn't really say much </end grumpiness>

<comment><USER5> Anything that gives Pando Daily less traffic is all good by me.

</comment></comment><comment><USER6> D __n! There goes the chance to sell my site to NSFWCORP.

</comment><comment><USER7> I expect a very public resignation within three months.</comment>


Throw the big ones back, fishing study suggests - <AUTHOR> http://www.reuters.com/article/scienceNews/idUSN1640365620080416?sp=true

<comment><USER2> FAT chance of that!</comment>


Tell HN: Executing a 51% attack on a real live CryptoCurrency, livestream - <AUTHOR> Hey all, On  Oct 13, 3:00 CDT, 4:00 EDT 1:00 PST I'm going to do a 51% attack against the cryptocurrency Einsteinium (i'll do the biggest, most established coin I can afford to attack, I'm putting in $50 of my money and if you want to donate you can 18YvVAxEMYxowSYEmWVtY75ZUdKXXk2vQc (If that's against the rules feel free to remove it Admins)) :
1. Demonstrate how easy these attacks are for anyone to do.
2. Generally teach people about the nuts and bolts of these attacks and potential mitigations.
If you want to watch it, https://www.twitch.tv/geocold
Event link: https://www.twitch.tv/events/NyJSsF3hQkGHdnsKA2f4JQ <comment><USER2> A 51% attack against small blockchains is like taking a lollipop from a toddler.

<comment><USER3> A smaller blockchain might seem like a toddler compared to the big old bitcoin, however you shouldn't dismiss that the biggest shitcoins in market capitalization have a decent amount of people invested in them.

Take in account a 51% attack causes a double-spend. A double-spend targetting a transaction of a big amount costs the same as if you target a transaction of a small amount. This means that whoever performs this attack could just wait until the perfect victim comes in (think: a big transaction from/to a hotwallet of a big exchange).

This, in the end, could cause a big loss to some user of the exchange (especially if the exchange doesn't take responsibility for the issue); which could mean a lot more value than a lollipop.

Key takeaway from this IMO: don't invest in shitcoins, err.. altcoins sorry.

<comment><USER4> You should demonstrate an effective use of double-spend in your 51% attack, since there's a lot of FUD around what can happen with a 51% attack. As in, people may assume you can drain accounts with 51% control, as opposed to double-spend transactions that did not yet hit high confirmation counts.

<comment><AUTHOR> " As in, people may assume you can drain accounts with 51% control" This is categorically incorrect. I'll make sure to mention that.

<comment><USER5> Of course you can drain accounts with 50% hash power or greater. And the number isn't 51%, it is actually 50%. If you have 50% of the hash power, you will be ahead exactly half the time. However, you will selfish mine and this creates an asymmetry. When you are ahead, other miners will mine off your chain, making your chain the longest. You will never mine off other published blocks, no matter how far behind you are. And no matter how far behind you are, you will eventually be greater than even at some point.

Because you can start mining at any point in the past, you can erase all transactions except the genesis/first transaction.

The bitcoin developers realize this so they essentially stuck the blockchain in the source code by putting 'checkpoints' in the code. This protects their coins. The developers are the actual central blockchain authority. If they changed the checkpoints, they would fork the whole chain. The chain is essentially in the source code.

</comment></comment></comment></comment></comment><comment><USER6> Do you have an estimate for how expensive the attack will be?

Are you renting hardware from the cloud?

Any chance they will hardfork before you can attack?

<comment><USER7> [https://www.crypto51.app/](https://www.crypto51.app/)

[https://www.crypto51.app/coins/EMC2.html](https://www.crypto51.app/coins/EMC2.html)

<comment><AUTHOR> A great site. I made a version of it in python a while back and wanted to turn it into a website but never got around to it. Glad they did it for me but a lil sad I never got the media attention it got :(

<comment><USER8> Try CherryPy if you want to turn python code into a website.

<comment><AUTHOR> Thanks for the recommendation. For me, making it wasn't the hard part, the procrastination was.

<comment><USER8> No problem, I recommend it cause CherryPy will take any object oriented application and turn it into a website, you could make it all RESTful if it makes it easier and just have a jquery ajax client or something to make it stupid simple. Been using CherryPy for years and happy with it.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Feel free to ask me any questions, I'll try to answer them all.

<comment><USER9> What these attacks are about is stealing money, right? Is that your plan? Why do you want donations to steal something or if you don't steal anything how will you change the chain?

<comment><AUTHOR> Generally, an attacker would deposit money in an exchange, exchange that money, withdraw it, then overwrite the transaction. I don't plan to do this. I'll either just do the overwriting part or just deposit like a dollar and not exchange or withdraw it. This is meant to just be educational.

<comment><USER10> I understand you're doing it to be educational - though what stops someone else taking advantage of your 51% attack and performing a double spend?

<comment><USER11> Nothing really. Except since this 51% attack is pre-announced people can choose to not accept any transaction as confirmed until the attack is over.

</comment></comment></comment></comment></comment><comment><USER12> I hope you realise Einsteinium has introduced dPoW algo to harden their blockchain security several weeks ago? They checkpoint to the Bitcoin blockchain every 10 minutes on average. You have not prepared accordingly, have you?

</comment><comment><USER13> We apologize. This content is no longer available.

</comment><comment><USER14> Can't we take profit too with this attack? It would affect the whole blockchain, so we can also send an amount of that coin to an exchange when you start the fork. Then we will have the amount restored when the fork becomes the real of the coin.

</comment><comment><USER15> What are you going to stream? Setting up the miners physically or a screencast of the configuration? Or something else?

</comment><comment><USER16> I think you've already done it. A central bank cannot run a blockchain level of trust that is smaller than they are. And nor can shipping companies, and basically anyone.

If you're not sure another party isn't in control of the 51% of the chain, nothing is safe.

<comment><USER17> Which then requires a centralized authority, of members who trust the systems/processes and people in place, if going to use blockchain technology..

</comment></comment><comment><USER18> What time UTC ?

<comment><USER19> 8:00 PM UTC

<comment><USER20> Why PM?

<comment><USER21> Because that's when it is?

<comment><USER20> Yeah, but how was that conclusion reached?

3:00 CDT = 8:00 UTC, but the original post didn't mention AM or PM.

Is PM the default in US?

<comment><USER21> The event link from the original post says:

DATE & TIME Saturday, Oct 13 4:00 PM EDT

But yes, generally 4 AM isn't the most common stream start time :).

</comment></comment></comment></comment></comment></comment><comment><USER22> Is there a recording of this? I've missed the thing!

</comment><comment><USER23> Isn't that kinda mean towards whoever set up the coin?

Not saying don't do it...bit think it might ruin someone's day even if it is intended as educational

<comment><USER11> I think how to judge this attack depends on how the coin presents itself. If they're clear about being in a phase of the project where such attacks are feasible then it's just vandalism, but if they're presenting a more flattering image of their project then demonstrating a 51% attack is a service to the public.

<comment><USER24> If they are in that phase, then they shouldn't be on exchanges.

</comment></comment></comment><comment><USER25> I probably do not understand enough of the blockchain technology but you announcing this ... why can't they ramp up their security?

<comment><USER26> Because in order to "ramp up their security", they'd need more users which makes this attack harder. Security isn't like a knob that you turn.

<comment><USER24> They can just rent more hash power than OP during the live stream.

</comment></comment></comment><comment><USER27> Did anyone watch it live ?

<comment><USER28> Was banned by Twitch before the demonstration so switched to stream.me who also banned him, says he'll record it and post a video later instead last I saw

</comment></comment><comment><USER13> What account?

</comment><comment><USER29> Finally someone can prove those claims of how much it costs, if this is legit.

</comment><comment><USER30> will it be pumpped during attacking?

</comment><comment><USER20> CDT, EDT, PST? I have no idea what this means.

Please don't use time zone abbreviations. They are neither human- nor machine- readable.

<comment><USER31> Over half the HN readership lives in areas where these abbreviations are human-readable. And 100% can google the abbreviations. Would it be better if we started using UTC+5, etc.? Sure. But good luck getting Americans to change. If the OP's European counterpart posted a time in "CET" I'd have to go look it up, and I'd be fine doing that if it was important to me, rather than pointing the finger and crying Eurocentrism.

What I did find objectionable about the times, though, was the lack of "AM" or "PM". In the US, 3:00 might be in the morning or the afternoon, and the context does not make it clear which is intended.

<comment><USER32> Never heard about CET before you mentionned it and I'm european

</comment></comment></comment><comment><USER33> or you are trying to hack us? with creating an account?

<comment><AUTHOR> What account?

</comment></comment><comment><USER34> Isn't this massively illegal? You're basically DoSing a network. Possibly theft as well!

<comment><USER35> Why would it be? You're just mining like any other person, except you're doing it faster than anyone else. I think the poster has mentioned that this is purely for educational purposes; they're not trying to steal everyone else's money.

</comment></comment><comment><USER33> lol, I taught you were gonna show us how it works on some testnet. If you are for real, this will be very educational! tell us every detail please! The costs, hashpower, what exactly are you going to do? double spend?...</comment>


Miscreant: a multi-language misuse resistant encryption library - <AUTHOR> https://tonyarcieri.com/introducing-miscreant-a-multi-language-misuse-resistant-encryption-library <comment><USER2> This library implements a crypto primitive that sacrifices a marginal but measurable amount of performance to avoid a very common user error with crypto primitives --- repeating a nonce (a cryptographic counter). For perspective, this week's KRACK 802.11 bug is an instance of nonce reuse.

The primitive being provided here is an instance of SIV, which is widely considered the most conservative mainstream cipher mode that addresses nonce reuse. SIV is a moral cousin to Deterministic DSA and EdDSA, in that the "nonce" is based on a hash of the message. You can add additional nonce material, and that will improve the security of the system, but even with a constant all-ε stream of additional nonces, for most applications you're fine.

The downsides to AES-SIV are that the mode is "offline" and two-pass. You have to have the whole message available to encrypt with AES-SIV (the state needed for CTR mode comes from processing the whole message). This makes some kinds of streaming interfaces hard to implement. On the other hand, you can almost always delegate that kind of interface up one layer in your application stack and pass AES-SIV chunks of messages.

This library or something like it will eventually hit some kind of "1.0", and, at that point, if you can get away with the performance hit --- and you _virtually always can_ , because bulk encryption isn't a bottleneck in most systems, and on the systems where SIV's performance hit matters you tend not to get much benefits from the "faster" stuff --- you should use this for bulk encryption. (Unfortunately, KRACK is a very good example of a setting that probably couldn't get away with using AES-SIV). As a crypto interface, it's better than NaCL.

<comment><USER3> Hello, very ignorant of crypto user question if you don't mind:

In this system, do distributed encryptions of the same data cause any vector for attack? Eg, if this library helps prevent nonce misuse, does distributing the writes of data across multiple computers cause possible problems?

This may seem completely off the mark, so feel free to respond with a simple "No.", i'm very ignorant of this stuff. All i know, is to be very wary heh.

My use case, for those curious, is that i've got a distributed , content addressed filesystem built ontop of a sort of ledger. This filesystem allows for offline writing, which of course means that when nodes reconnect, reconciliation of any data conflicts must take place. This is done on the ledger in a very bitcoiny way. Simply, stupid.

In a nonce system (as described in the blog at least), i could simply use the length of the chain as the nonce and i'd be 100% safe from nonce reuse _on the ledger_. However, some writes of distributed nodes might duplicate nonces before reconciliation takes place. The ledger never has duplicates, but old- hash addresses would _(temporarily)_ contain a duplicated nonce.

Does this scenario sound bad for Miscreant?

As an aside, thank you to all involved for this project! Friendly crypto will be such a boon to developers!

<comment> loup-vaillant An easy way to prevent nonce reuse is to use a nonce big enough to be selected at random. 192 bits is big enough. XChacha20 provides that. I believe there are more general nonce extension constructions out there, but I don't know enough to recommend any.

If for some reason you cannot (or don't want to) rely on your system's random number generator, consider using a _hash_ of the chain as the nonce. Just make sure duplicated chains never happen, _or_ revealing the existence and location of duplicates is not a problem.

If you need to mitigate replay attacks… Err… I don't know.

</comment></comment></comment><comment><USER4> Have you thought about Chacha20/Poly1305-based analogues to the algorithms you implemented, per [https://github.com/briansmith/ring/issues/413](https://github.com/briansmith/ring/issues/413)? Is AES-SIV mainly better because it is specified, and thus has seen more analysis, or are there other reasons that Chacha20/Poly1305 aren't taking off in this space?

<comment><USER5> As you guessed, my main reason is there aren't standard constructions around SIV modes for ChaCha20Poly1305, although as Brian Smith notes in that thread SIV is a general construction which should be easy to adapt.

See my comments in that same thread for some early hints at Miscreant.

AES is also more ubiquitously available in hardware, which is nice when targeting slower devices like embedded/IoT.

</comment></comment><comment><USER6> Would it be reasonable for the library to almost make a "good attempt at making a nonce, perhaps by using a global counter, date time, uptime and reading /dev/random?

Then nonce collision would require a library submitting identical nonces, identical messages, and basically every way of getting a unique number from the OS to all collide.

<comment><USER7> Sorta: if your CSPRNG is weird/broken then you have way worse problems, so just use your CSPRNG. If your CSPRNG is fine, adding global counters, timestamps, uptime... makes no sense.

(Also, you should use /dev/urandom, not /dev/random. Or getentropy/getrandom/CryptGenRandom, depending on your OS.)

<comment><USER6> CSPRNG can be badly behaved at startup time on virtual machines, and there have been problems with bad random numbers at start up time. Adding wall clock time to the mix wouldn't hurt.

<comment><USER7> Which operating system do you run where time isn't already in the CSPRNG pool?

<comment><USER6> I believe Linux only uses physical devices (which are very limited in some VMs), but this might just be folk-legend (I haven't read the source).

<comment><USER7> No, Linux' random.c has add_device_randomness (sp? it's definitely something_device_randomness), which includes a bunch of machine-specific things to the RNG, including MAC addresses, serial numbers, and, crucially, the RTC.

<comment><USER6> I'm obviously misinformed. Thanks for that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm not sure that im entirely convinced by the arguments against libsodium. Wouldnt it be possible to extend/fork libsodium where one could create a simpler api to automatically force (or atleast default to) correct nonce handling?

<comment><USER7> Yes, I believe that's possible, though not necessarily with the same performance. I built magicnonce [1] explicitly with two properties in mind:

* the simplest possible synthetic nonce design that's "obviously" correct for some useful value of correct.

* uses only explicitly exported libsodium APIs.

It's an off-line scheme like SIV, because the users I'm targeting don't care about on-line schemes. If you really care about on-line schemes, I think the simplest, most practicable solution right now is to just use an large nonce scheme (like secretbox) filled with random bits.

To give you an idea about performance and to continue with the author's gracious use of unflattering benchmarks, my Clojure+FFI code is about 20% slower than his AES-SIV-PMAC code. It should probably just publish it on IACR instead of just in a random module of my libsodium binding.

[1]: [https://github.com/lvh/caesium/blob/master/src/caesium/magic...](https://github.com/lvh/caesium/blob/master/src/caesium/magicnonce/secretbox.clj)

One could argue that it is still desirable to have fast, AES-based algorithms, and I think that both this article and related work (e.g. the AES-GCM-SIV paper) do a reasonable job of making that point. For example, my cost function assumes libsodium is free but implementing any nontrivial crypto is very expensive. If that's not true, say, in resource-constrained embedded environments (libsodium not free, developing crypto par for the course), I can totally see why you'd end up with SIV or SIV-PMAC: you just need one really fast implementation of an established primitive (AES). Really anywhere where the platform hasn't tilted the table in favor of GCM by having CLMUL instructions, AES-SIV-PMAC should dominate both from a performance and safety perspective.</comment></comment>


I'm sad; I didn't know LILO was on its death bed - <AUTHOR> http://lilo.alioth.debian.org/

<comment><USER2> How is "being finished" a "deathbed"? It's a simple bootloader that does what it's supposed to do. Why develop it further?

<comment><USER3> Technology evolves. It may work for now, but if it's not being actively developed, it may not work with future hardware and software. Moreover, especially with these kinds of projects, an announcement like this can be a nail, if not the final nail in the coffin of it.

<comment><USER2> Meh.For the past decade or so GNU ed has only made minor style changes to meet toolchain guidelines. It's ok for software to be done.

</comment></comment></comment><comment><USER4> I remember perfectly the pain to change lilo for the first grub (that I didn't liked so much) in the past, and the frozen L-I...(cric, cric, cric) screen. Seems like ages.

<comment><USER5> And where it stopped was the error code.

<comment><USER4> Yes, complicated things where much simpler then. The reiserfs creator was still cool and free, gnome was not a parkinsonian desktop with hyperactivity disorder, Xfre86 was da bomb, star-office, the stupid fire-ants in falcon's eye... and lilo of course.

The good old Woody times... :-)</comment></comment></comment>


Judge: illegal for undercover investigators to pose as Internet repairmen - <AUTHOR> http://lasvegas.cbslocal.com/2015/02/02/ruling-caesars-internet-gambling-case/

<comment><USER2> The linked article seems to disagree with this one from NBC News: [http://www.nbcnews.com/news/us-news/judge-fbis-ruse-snare- po...](http://www.nbcnews.com/news/us-news/judge-fbis-ruse-snare-poker-champ- was-okay-n298726)

"A federal judge has ruled that FBI agents in Las Vegas did not violate the rights of one of the world's top gamblers when they shut off the Internet service to his hotel room last summer, then posed as repairmen to get inside."</comment>


Clojure: if-let and when-let - <AUTHOR> http://blog.jayfields.com/2011/03/clojure-if-let-and-when-let.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+jayfields%2FmjKQ+%28Jay+Fields+Thoughts%29 <comment><USER2> PG has written about if-let, when-let, while-let and the likes in _On Lisp_ , but calls them anaphoric macros instead. They are basically the same macros, but without the use of bindings (more brevity). You should take a look at it if you're interested.

<http://lib.store.yahoo.net/lib/paulgraham/onlisp.pdf> \- Chapter 14 - Anaphoric Macros is on page 189.

<comment> cgrand-net It's a design choice to value explicit naming (and easier nesting) over brevity.

Anaphoric macros are not idiomatic in Clojure (there is only one: proxy), implicit introduction of locals is frowned upon (and you have to fight the hygienic macro system to create them).

<comment><USER2> Oh, I am by no means against explicit naming. I'm just recommending people to read chapter 14 of On Lisp if they find if-let and when-let good macros they use often.

</comment></comment></comment><comment><USER3> AND-LET* is a nice generalization: <http://srfi.schemers.org/srfi-2/srfi-2.html></comment>


Just 27% of employees believe in their company's values - <AUTHOR> http://cactussofthr.info/blog/2016/09/28/only-27-of-employees-believe-in-their-companys-values/ <comment><USER2> Yeah. File this under another thoughtcrime I've committed.

There was one set of values that my company's CEO wrote up on the fly b/c we were doing reviews for the first time. Those values are _awesome_. They're explicit about the goal of making money, they're explicit about priority, just awesome.

The new COO felt like he needed to make an impact so he wrote some new ones. The company I work for also has a very playful marketing tone, and he applied our marketing tone to our company values. The values also aren't explicit-- they are each a complete sentence, but it's fairly vague how they should be applied. Idk. I know it's all bullshit, but I felt like we really had something for a moment. I think that the new generation (I'm 29) is just so tired of being marketed or manipulated that honest "we're here to make money" is a better value than "We should all do what we can to hit our numbers."

Maybe this is just a problem that engineers and lawyers have, since we neurotically try to find the inconsistencies and misapplications of statements.

[edit] money, not monkeys. Thanks kd :)

<comment><USER3> I too, share in the goal and passion of making monkeys.

In all seriousness though, I'm surprised the number is even as high as 27%. Unless you're working for the Peace Corps or some charity that's trying to do some real good in the world, you're probably working for a business that is there to make money. And the reason you're working there is most likely that you need to make money to live on.

It's nice when companies just cut through all the bs and pretense and are honest about it.

<comment><USER4> > I'm surprised the number is even as high as 27%.

Every statement of company values I have ever read has been very bland, essentially a bunch of motherhoods that virtually no one would ever disagree with. Who ever had a problem with "innovation" or "communication"? A statement that actually made some choices, that drew some actual lines in the sand, would be very welcome. Imagine a company that said something like this:

"We are high performers. We recruit only the highly accomplished, and reward those who do great work far above common standards for our industry. We cull the laggards ruthlessly."

or

"We acknowledge a duty to act in the interests of our employees, customers, and stockholders, even beyond strict legal requirements. If we absolutely have to choose among these groups, the stockholders come first. Note that the list does not include suppliers, the government, or the general public."

or

"We believe in hierarchy. It's the only way to effectively organize the efforts of thousands of people. Your boss has done something to earn our trust in ways you have not. Accordingly, in a dispute between you and them, we will almost certainly side with them. If you have serious conflicts with them, we recommend you leave."

</comment></comment></comment><comment><USER5> Meanwhile the number of owners of the company who believe in the company's values remains steady at zero.

<comment><USER6> I suspect that believing in the company's values is the sole province of the Organisation Men:

[http://www.ribbonfarm.com/2009/10/07/the-gervais- principle-o...](http://www.ribbonfarm.com/2009/10/07/the-gervais-principle-or- the-office-according-to-the-office/)

<comment><USER5> Wow, that whole article is a _very_ interesting read. Certainly a world run by sociopaths does generally fit with how history has unfolded... I think though that the author makes one mistake where he conflates the perception that social mores are ultimately constructed fables with the ability and willingness to construct your own in order to control other people.

</comment></comment></comment><comment><USER7> Companies don't have "values", they have internal PR. People, sentient, living breathing people have values. Companies are not that.

<comment><USER8> That's a little too broad brush. Groups of people can share common values, and those groups can be quite large. In the millions.

Companies _can_ have values, but it's probably rare because what brings most people in a company together is a desire to pay the bills.

<comment><USER7> I wholly disagree.

It can have a _culture_ , that I will agree with. And that culture can be objectively better/worse when compared against a traditional moral system (and I'm only being so pedantic here with the "moral system" phrasing because culture that's good in one country/society may be considered toxic in another, so there's no objective measure of moral righteousness when examining a culture.

Values, on the other hand, are almost purely fiction. They are what certain executives (the ones charged with coming up with and signing off on the values statements) want employees, customers and the public to believe is the culture the company has created (or is trying to create), but that's not the same thing as the culture itself or what a value actually is. Using the term "values" here just anthropomorphizes a non-sentient entity (a company) in an attempt to create an emotional response in people.

</comment></comment></comment><comment><USER9> Considering I've worked at a place in the past where providing an "excellent work-life for it's employees" was written into the quality policy, but they consistently treated all their employees like crap; I'd be willing to argue that only 27% of businesses believe in their own values.

<comment><USER10> They would argue that they provided you with a great work-life, so great in fact you barely had time for your life-life.

</comment></comment><comment><USER11> Firstly: This should be changed to link to the original Gallup article [0] since the submitted link is just a shameless reformatting of their original work (and is harder to read).

Secondly: Something I think people are missing is that breaches of company values are part of the ammunition that can be used to fire people. I'd wager that's as much of the purpose of (big-company) "values" as anything else.

[0] [http://www.gallup.com/businessjournal/195506/few-workers- app...](http://www.gallup.com/businessjournal/195506/few-workers-apply- company-values-jobs.aspx?g_source=WWWV7HP&g_medium=topic&g_campaign=tiles)

<comment><USER12> I don't see this as a negative thing having witnessed someone terminated before in part due to misalignment with values. It can be a very useful tool for getting rid of someone who is quite obviously causing damage but might be hard to get rid of for other causes.

Values dictate how a company should operate and how employees should treat each other. It is a way of codifying the culture and can serve as part of the company's immune system to expel threats to that culture.

Making sure I understand and align with the values of companies I work for is something I've found to be tremendously helpful in ensuring I enjoy working there.

<comment><USER13> > I don't see this as a negative thing having witnessed someone terminated > before in part due to misalignment with values. It can be a very useful tool > for getting rid of someone who is quite obviously causing damage but might > be hard to get rid of for other causes.

That's just the Al Capone argument. Should we have insane tax laws that everyone has broken at some point just so that the state can send the "right person" to jail? Should we allow planting of contraband on the "right suspect" because if they didn't have anything on them today you're making up for when they'll have something on them tomorrow? Holding a 5 tonne weight over everyone's head is no way to foster a good culture. You're just forcing people to live in fear of unjust reprimands.

<comment><USER12> That's a bit of an extreme comparison, no?

FWIW, the values were pretty clear on this point, and it was pretty apparent to all (not just management) that the change needed to happen. And again, it was just in part due to this. There were other reasons.

There was no real sense from anyone I knew that the values were being unreasonably held over people's heads or that they were asking too much.

<comment><USER13> I can accept that it probably worked out in your case. It also worked out in the Al Capone case. The problem is that it's the wrong way of solving the issue, and could cause unjust carrying out of the rules. Because if everyone has broken the rules, then you have lost your effective ability to do anything in fear of reprimand.

It's very reminiscent of thoughtcrime. Which is why I have a problem with it.

</comment></comment></comment></comment></comment><comment><USER14> Most jobs are and always will be a chore.

But it isn't "cool" to admit it, in job postings as well as in job applications.

In my experience "professionality" is also doing your job (and doing it well) also and especially when it's a chore.

<comment><USER15> We can wear jeans and t-shirts, but the new professional standard requires pretending to have passion for the CEO's vision because plain old performance with a good attitude isn't enough anymore. Thought codes instead of dress codes.

<comment><USER16> I always think corporations are run like communist states: central planning, ideology, thought control.

<comment><USER17> I'm fine with that as long as the proceeds are also distributed in a manner consistent with communism (the utopian version, not the failed socialist state experiments)

<comment><USER18> The problem with the utopian version is that centralization of power pretty much guarantees it won't happen, hence the failed states. It's like how benevolent dictatorships are one of the best forms of government, but you never want to try and implement that for obvious reasons.

</comment></comment></comment></comment></comment><comment><USER19> Well, I would say that there are the set of company values that get printed on posters and placed in breakrooms. 27% of employees believe in those.

But, most importantly, there is an unwritten set of values that rules over those companies. Those who understand those values tend to do well. However, many don't realize this, and the dissonance often leads to a crappy work experience.

</comment><comment><USER20> The idea that a company can have values is absurd. A company isn't a person. It cannot have values any more than it can have a religion.

What the term really means is more like "the CEO's values" or "values as defined by consensus of the people in a subcommittee."

</comment><comment><USER21> A company's stated values and mission are often at odds with it's revealed preferences. Employees respond to the latter, which show themselves via what kind of behavior gets rewarded/ignored/punished.

</comment><comment><USER22> If you think that's bad, try working in a place where almost all of them do.

</comment><comment><USER23> I believe in paychecks.

Everything else ... yeah, that's probably the marketing department with too much free time.

<comment><USER24> I don't believe in paychecks, I need to see the evidence.

</comment></comment><comment><USER25> Everytime I have worked at a company and HR ships out their new Values deck I just roll my eyes, it could be the single biggest waste of time HR just spinning their wheels.

</comment><comment><USER26> I would have to first believe that my company actually has values before I could believe that I share any of them.

The only corporate value that I ever took at face value was "Make money." I'm not sure who must have had a stroke that temporarily disabled their executive dishonesty gland long enough to slip that into the corporate culture, but I hope they survived it.

Literally everything else has been blatantly obvious employee propaganda.

</comment><comment><USER27> Does this include the self-employed?

<comment><USER2> Ohhhhhh! Next time I'm at the bar I'm going to ask my freelance friends what their company's values are. This'll be good.

</comment></comment><comment><USER28> I thought the "values" of every public company is to make as much money as possible for shareholders.

</comment><comment><USER29> Actually, employees don't give a shit about the companies they work at and they should be treated as such. If it's not their own company all they care about at the end of the day are the money they get (the more, the better), the conditions they get and to complain about every single fucking thing. All this while trying to trick you as much as possible by not being efficient or trying to become better at what they are doing, on their own.

So I'd urge owners of companies to hire and fire people quick. There are rarely good people who stay within a company for more than 2 years and who care about what they do. Those people usually become part of it (partners).

The rest are just there temporary, so treat them as such: shitty replacement parts.

</comment><comment><USER30> I guess I've yet to see company values be something more than a generic "be a decent human being" list. Then, you watch all the politics and backstabbing from middle management and the complete cluelessness of upper management and that number seems pretty high to me. I haven't worked at a lot of startups can't speak to those.

</comment><comment><USER31> In related news: my culture was just shaped by Senn Delaney, a Heidrick & Struggles company. to help me live by my new values, I refer to my provided commitment card daily.

[http://www.senndelaney.com/](http://www.senndelaney.com/)

<comment><USER32> You poor, poor bastard. I can't imagine what hideous cultural concoction those suits must have cooked up and forced upon your company.

</comment></comment><comment><USER33> It will be interesting to also find out what percentage of employees think culture decks are bs as well.

</comment><comment><USER34> Probably because "company values" are just a checkbox on the company marketing checklist.

</comment><comment><USER35> I've been through several startups as well as acquisitions. There's a huge difference between learning/acclimating to a set of values that aren't yours versus starting something with a group of people who all share preexisting values. Many great teams and products exist because of the latter. Even so, great teams from the latter camp can have values diluted every time new people come on board.

The first startup, I was employee #12. The second startup, I was employee #30. The third startup I joined mid-way through an acquisition. Each of these companies had great aspirations for good values but all failed to trickle them down to individuals. Too much bullshit and too many bodies. As a co-founder of the current startup ([https://www.reamaze.com](https://www.reamaze.com)), we've purposely kept our team small, tight, and well curated. Instead of constantly hiring more bodies, we think outside the box and adapt to how our business is growing. All this to keep our values and chemistry intact. Just keeping the chemistry alive allows us to build products we and customers love.

You simply can't build successful teams, products, or businesses when so few of your employees buy into the real reasons you're doing what you're doing. Sure, you can buy them off with great salaries, benefits, and office amenities, and you may be able to carry that momentum to an exit but there will be miserable people. And if you can't carry the momentum, good luck with the mass exodus. This is why many will say "the day job will always be a chore". A lot of our customers actually come to us for advice on team building, customer service, and culture and we always encourage them to not hire. We don't even encourage them to hire if it's urgently desperate. Instead, hire only when you've met the right match at the right time. Happy to chat to anyone who wants to discuss team building and growing an extremely viable business by intentionally staying small and nimble.

<comment><USER36> I think team chemistry and emoloyee buyin is severely underrated. Large salaries being thrown around silicon valley when the hires themselves dint believe in the product but just the money, resulting in a team that just 'dayjobs' whatever they are working on instead of being passionate sbout the company's products and values.

</comment></comment><comment> hash-set Mr. Robot did a great job of exposing all this corporatist bs garbage.

<comment><USER37> I planned on watching that series but after hearing this it makes me not want to. I have enough cynicism in my life.

<comment><USER38> [https://www.youtube.com/watch?v=njIc062qmg4](https://www.youtube.com/watch?v=njIc062qmg4)

This is really the peak. Ultimately I would argue the show is pretty cynical but does show a world where change is possible.

</comment></comment></comment><comment><USER39> Sad that so many people spend working lives in institutions whose values are unintelligible or not theirs. I worked at a company whose values were clearly articulated and formed a shared vocabulary amongst employees. It can be done. The values were stated at a high level of generality, as they have to be. So applying them in novel cases required interpretation, discussion. In that sense, the principles were not easy to apply. But that's not necessarily a bad thing. The discussions themselves encourage engagement, reflection.

</comment><comment><USER40> Didn't bother reading. The bold font and lack of proper line height did me in.

</comment><comment><USER38> As far as I can tell every companies values are make money.

<comment><USER41> I think that over-simplifies a bit- a company's value is to make as much as possible for the corporate leadership. That's what the people who create the culture are most interested in.</comment></comment>


Akka - The most important middleware you've never heard of. - <AUTHOR> https://medium.com/21st-century-web-application-development/dc19e386026d

<comment><USER2> Erlang/OTP seems the most important middleware the author of this post probably hasn't heard of ... there isn't even a single mention of it while mentioned all the things copied from it (supervisors for ex)

> Akka is designed to be bulletproof. ... It's actually very hard to write a > system using Akka that isn't fault tolerant.

That is why you use something battle tested, build from ground up concurrent platform -- Erlang/OTP, not some new fangled experimental library.

The only way Akka is interesting if you _need_ to access Java libraries and there is just no other way.</comment>