Show HN: GA Insights – Never Log into Google Analytics Again - <AUTHOR> Hey HN!
We are Patrick & Chris, bootstrapped co-founders of GA Insights (https://www.ga-insights.com) - a simple way of getting reports and alerts for your tools inside Slack and Teams. We started as a technical tool to monitor client accounts in Slack, interfacing with Microsoft Azure insights, and then pivoted to supporting business intelligence tools like Google Analytics and Google Search Console.
The idea was born out of the angst that we had experienced using disparate tools to monitor our metrics, client & to share information. Google Analytics has an ever-evolving interface that most developers would rather not spend a day getting lost in. We decided to take the primary use cases we had for Google Analytics and provide an engine to process, visualize, and ship to Slack or Teams. This gets us daily or weekly reports on metrics such as page speed, bounce rates, page engagement, and when the cart checkout breaks.
Once we started to gain some traction with clients, we extended the capacity to include other data sources like Google Search Console and Google Ads, making it simple for indie businesses and large corporations to extract the value from these reporting surfaces and send them to a channel that we use every day, like Slack or Teams. We use ML to analyze 100s of metric streams to detect anomalies in your data, and are soon expanding into providing root-cause analysis when anomalies occur.
Currently, we send 2.6k alerts per week and 3.2K scheduled reports into Slack, Teams & Email. Slack has seen the biggest uptake followed by Teams. We run on Azure, combines NoSQL, Serverless, Redis, Warehousing, and scalable architecture to deal with bursty loads (common in report scheduling).
We're launching new data sources and integrations rapidly, with Facebook, Stripe, and Zapier next on our docket.
Happy to answer any questions you might have. <comment><USER2> I get why it is this way, but it'd be cool if I could hook it up to a >500k website for cheap or free and you limit the account some other way unless I upgrade it -- maybe only a couple of alerts or reports per month.

<comment><AUTHOR> Not sure what we could do here, but feel free to drop me a mail at patrick@ga- insights.com

</comment></comment><comment><USER3> Awesome. How are you solving for annotations and human-provided context to augment this data? This is a problem space I've thought a lot about, feel free to reach out if you want to chat.

<comment><AUTHOR> Sure - drop me a mail at email@example.com. Happy to chat.

</comment></comment><comment><USER4> Would you be creating on premise service - ie analytics data directly from the site? Seems many browsers now block GA and other trackers.

<comment><USER5> Indeed, if this product is dependent on Google Analytics it is probably a little late: It's a matter of time before browsers are all blocking GA by default.

<comment><USER6> I don't see Chrome going anywhere for a long time, and I don't see Google blocking its own analytics service within its own browser on its own volition.

<comment><USER5> Google may have a hard time continuing to explain away it's refusal to respect user privacy as the sole browser that doesn't block GA. And if the Chrome team continues to fight privacy initiatives, Chrome will be replaced by something like Edge, which is compatible but also actually cares about privacy and security (these two things are the same, if you aren't prioritizing privacy you are not a secure browser).

Regulators will also be paying attention to this over the next few years.

I think a startup should be very aware of these risks if building off of GA.

<comment><USER7> I have a hard time believing Edge is any more private then Chrome, it's just a question of who gets the data.

I'd love to be proved wrong on this though.

<comment><USER5> It's weird for you to believe this, because Chrome is made by an ad company whose sole goal in existence is collecting data for ad targeting...

Many of Chrome's features are implemented in Edge by replacing Google services with Microsoft ones. So for many things, Microsoft may be collecting similar data (though likely not monetizing it at all).

But the key thing is that tracking prevention: It means your browser is leaking your data around the internet _significantly less_. Not just less to Google, but less to _almost everyone else on the Internet_. Chrome, by refusing to implement tracking prevention, is pretty much a leaky ship with holes in it.

Here's Edge's implementation: [https://docs.microsoft.com/en-us/microsoft- edge/web-platform...](https://docs.microsoft.com/en-us/microsoft-edge/web- platform/tracking-prevention)

Here's Firefox's implementation: [https://support.mozilla.org/en- US/kb/enhanced-tracking-prote...](https://support.mozilla.org/en- US/kb/enhanced-tracking-protection-firefox-desktop)

Here's Safari's implementation: [https://webkit.org/blog/7675/intelligent- tracking-prevention...](https://webkit.org/blog/7675/intelligent-tracking- prevention/)

Chrome has nothing. Google paid some of their staff to write a FUD piece about how preventing tracking was a privacy risk somehow.

<comment><USER7> All valid points. Much appreciated.

I was coming from a position of "Why would MS remove anything instead of redirecting it to themselves", but failed to consider that they would be adding things themselves to prevent other tracking.

<comment><USER5> And don't get me wrong, I agree Microsoft is no saint on data collection. I use Firefox and encourage others to do so. But I'd recommend Edge over Chrome because I consider tracking prevention so necessary for safe browsing.

Microsoft's data collection and use seems primarily to be focused on telemetry for product improvement. They obviously do it in Edge too. I find it less malicious than ad targeting, but I'm strongly opposed to mandatory telemetry. And I think telemetry-driven development is a mistake that should be avoided. It dehumanizes software support and still provides incomplete information, while also violating the privacy of your users.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> i just got to say... i love reading the view source code of websites and finding SO references :) What would we do without SO?

//[https://stackoverflow.com/questions/1634748/how-can-i- delete...](https://stackoverflow.com/questions/1634748/how-can-i-delete-a- query-string-parameter-in-javascript)

<comment><USER9> You're absolutely right! But hey, I appreciate that at least they cite their sources!

</comment></comment><comment><USER10> This looks really useful, especially for small companies who need simplified metrics monitoring out of google analytics.

Have you considered adding a hobbyist plan or 1 month trial for startups or small projects to try before buying?

<comment><USER11> Not affiliated with the OP, but at the bottom of the homepage it says:

 _Free Tier Available. Free plan for under 2.5K visitors, or trial us with no credit card needed_

</comment></comment><comment><USER12> Have fun with this until google makes it impossible to use.

<comment><USER13> I don't follow. What do you expect would happen? Change to the GA API? Or they try to shut it down b/c "GA" in the name.

</comment></comment><comment><USER14> Does this work for anything other than Google Analytics?

<comment><AUTHOR> Right now we also support Google Search console and Google Ads. Our vNext will include much more, such as Facebook, Segment, Zapier and other data sources.

<comment><USER14> Anything on this list? [https://developers.reverseeagle.org/replace/google- analytics...](https://developers.reverseeagle.org/replace/google-analytics/)

</comment></comment></comment><comment><USER15> Are you running on StarThinker from Google?

This shiny piece of software engineering at their Github account is currently commoditizing the infrastructure F500 companies would outsource to SaaS and agencies because they didn't do tech.

Last year more than half of the big companies out of Europe started moving to a brand new in-house data driven marketing team. Vodafone and Adidas are already fully operational.

It's written in Python and it seems to operate like Airflow with DAG recipes but simpler without coding.

Plug & play realtime dash-boarding in Data Studio that can visualize a ridiculous amount customization of all the data Google services produces.

[https://datastudio.google.com/gallery?category=marketing](https://datastudio.google.com/gallery?category=marketing)

StarThinker sends out custom reporting via email of all Google ads services which even has a custom DAG rate limiter recipe named floodlight.

StarThinker supports currently more API's out of the box than you, even Smartsheets API has a custom recipe.

You can spin up a cluster with working UI in the cloud within 8 minutes.

[https://google.github.io/starthinker/](https://google.github.io/starthinker/)</comment>


Java vs C# vs Python vs Ruby: an "objective" analysis - <AUTHOR> http://jasonmbaker.wordpress.com/2009/04/21/java-vs-c-vs-python-vs-ruby-an-objective-analysis/

<comment><USER2> There are definitely some errors in the chart. Ruby doesn't use a reference counting GC, for instance. 0 doesn't evaluate as false in Ruby, either (that's a weird one). Ruby's 'apache option' is mod_rails, or 'passenger'.

Also... all things considered, this is sort of useful, but in actually making a call of what to use, there are a lot of other things that need to be determined, such as the organization's current skills and knowledge, what they're aiming to do, what it needs to integrate with, and so on.

<comment><AUTHOR> Thanks for pointing those things out. I'll update the chart.</comment></comment>


Show HN: Forking Cheeze Wizards smart contracts, all funds are secure - <AUTHOR> https://medium.com/dapperlabs/disclosure-forking-cheeze-wizards-smart-contracts-all-funds-and-wizards-are-secure-3c53af5bc531 <comment><USER2>
        It's worth noting that these smart contracts have
        undergone formal security reviews by Sigma Prime and we're
        confident there are no further issues to keep the
        tournament from running as expected.

Sure we had the barn security-inspected, and sure the horses just walked straight out, but we're DOUBLE EXTRA SURE now that there aren't any other security problems. FUNDS SAFU!</comment>


Ask HN: Are Monads Really That Hard? - <AUTHOR>

I've been experiencing something lately. I don't understand the difficulty of monads. So here I present my understanding of Monads in the hope that someone will be able to point me in the right direction, or at least point out something that I'm missing.
* Monads Hide Failure (kinda)
Monads allow you to call a function that may or may not (Maybe/Just/Nothing) return the value you need in the next function. If Nothing is returned, you can pass Nothing through your future function calls or composed functions with no ill effects.
* Nesting Monads
You can nest Monads, or use do notation, to create easily replaceable failure possible sections of code.

    foo :: Maybe Integer
    foo = do
        x <- someMonadicFunction
        y <- someOtherMonadicFunction
        Just (x + y)
 someMonadicFunction and someOtherMonadicFunction can be anything that returns Nothing or Integer and it doesn't matter if they fail because the do will return Nothing in that case.
# End
I keep reading about how Monads are a really hard topic, so I think it's possible that I'm not looking at the right pieces here.
So my question is, where do I go from here? Do I understand Monads, or am I missing something here? <comment><USER2> By theory, you have gained some knowledge about Monads. The hard part about Monads is, how you implement them to solve your problem. I would say, _practice hard_ ; then only you will truely master the concept.

Try to solve as many problems as you can, using monads. When you will be comfortable with aspect oriented programming (which the monads encourage), and easily speak functional language, then you can tell yourself that you have now mastered the concept. Even after that practice hard.

<comment><USER3> I think you're absolutely right. The theory behind many concepts I find is actually very simple, c pointers being another example. I mean how simple is this?

int x = 15; int *y = &x;

The hard part is using it to solve your problems.

</comment></comment><comment><USER4> Sigh. A type `m` is a "monad" if a few functions can be written for it with the following signatures (there are some laws too, but just ignore those until you understand the basics):

        return :: a -> m a
        bind :: (a -> m b) -> m a -> m b

That's all it is. What you've described is a particular type for which these functions can be written.

My advice: stop trying to think of particular ways monads can be used. Rather, you need to understand it as embodying a special flavor of embedding values and functions from one space (the space of simple types a, a -> m b) into another (the space of types m a, m a -> m b).

So, bind, apply and map are just ways of lifting different-shaped functions into (m a -> m b):

        map   :: (a -> b)   -> (m a -> m b) -- from Functor
        bind  :: (a -> m b) -> (m a -> m b) -- from Monad
        apply :: m (a -> b) -> (m a -> m b) -- from Applicative

The moment you start trying to understand these with some first-order metaphor, you know you've lost the way! :)

</comment><comment><USER5> You aren't describing Monads. You are describing _a particular_ Monad.

You can use the same 'monad pattern' for a variety of stuff such as state computations to mimic mutability, asynchronous pipelining, IO (which if i'm not mistaken is pretty similar to the async pipelining), etc.

A 'monad' is just a term for objects that have flatmap(scala)/selectmany(.NET)/bind(Haskell?) and for comprehension/Do notation is just a convenient pattern built into the languages for working with them.

</comment><comment><USER6> You understand a usage of monads well, ie. using them to handle failing error states. However, in practice they are also used to deal with other side- effecting functionality such as state, IO, etc. If I was you, I'd look up the Monad instances for State, List, and a few others to get a grip on how you can model your own problem solutions using monads.

<comment><AUTHOR> Thanks for the tips, I've looked into the List monad, but I'm sure there are some useful ones I haven't looked into. Stacking IO Monads seems to be a useful topic. I'm also looking into Warp and Yesod for the req/res Monads.

</comment></comment><comment><USER7> My teacher told us that a monad is somewhat like a recipe of an action. A set of instructions without a real purpose of return. So you have to create them under different terms than functions. A function is more of a specification with a constant result, ie put in 2 get 4, regardless of state. It is the combined power of monads and functions which grant access to the more interesting features of a functional programming language.

<comment><USER4> I'm afraid your teacher is either trolling you, or hasn't much understanding of the topic himself... :(</comment></comment>


The World of Competitive Lockpicking - <AUTHOR> https://www.cnet.com/news/inside-the-hidden-world-of-competitive-lockpicking/ <comment><USER2> My best friend has been a professional locksmith since he was 16. One interesting thing he told me is that he gets worse tips for picking locks too quickly. It creates a perception of lower value if he picks a lock in a few seconds instead of a few minutes.

<comment><USER3> And as an exception to that rule: I was forced to hire a locksmith because I couldn't pick the spool pins in my apartment door lock. I asked him if he would be able to do it quickly and he did it in like 30 seconds. I gave him a good tip.

<comment><USER4> I didn't know tipping was a thing with locksmiths. I hope I haven't been inadvertently rude by only paying what they were asking. Haven't heard of this before.

Some locksmiths really don't like locksport folks. I think there are multiple reasons but the most basic might be that they think it will result in fewer calls.

I have some very basic picking skills and for me, anyway, it's actually given me tremendous respect for the locksmith trade and made me more likely to call them when warranted, because I understand the wider range of things they can do and the skill it takes to do them successfully.

<comment><USER5> For someone with no clue about that world, may you give some examples?

<comment><USER4> Like all those old furniture or door locks that I just assumed were lost causes, many locksmiths can actually make keys for them. Not usually a serious need for it but if you were selling an old piece of furniture you might do it. In my case we have a bedroom closet we'd like to lock some stuff away in when we go away and have someone come in to feed the animals.

The ability to make a key for locks which have no key is another, even if those locks don't have removable cores (I'm thinking of mostly padlocks here). That's a really cool thing called impressioning, where the mechanics of the lock (pins pressed down into the keyway by springs) are actually used against it to progressively turn a key blank into a working key.

Master keying is another great example (when multiple, different keys work in a lock and you can have one key that works in multiple locks, such as a small apartment building).

Also a lot of ancillary things around the lock but not the lock itself, for example installing deep screws or replacement anti-kick hinges (door devil or door armor). In theory those are DIY things but in practice you can spend a lot of time trying to get alignment right (especially with a deadbolt going smoothing in/out), but it's something a locksmith does all the time.

<comment><USER5> Those are great examples, thank you! I had no idea they offered most of those services.

<comment><USER2> Yup, said friend cut me a key for an old motorcycle over a couple beers one night just from impressioning the fork lock.

<comment><USER4> Sometimes they can even make a key by sight reading, peering down the keyway; this is especially common (for good locksmiths) with wafer locks (often seen on cabinets, and autos but those are usually too complex to sight read).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I can recommend the lock picking lawyer on YouTube.

He has tons of videos where he dissect different locks and pick them normally but also finds novel ways of opening the locks.

<comment><AUTHOR> Quite possibly the most dispiriting youtube channel I've seen. His chipper and near instantaneous lock picking expertise has basically caused me to fear imminent loss every time I lock my bicycle or a door. I suspect that not at all of his 1.8M subscribers are viewing for their entertainment pleasure. Still, something to behold. [0].

[0] [https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ](https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ)

<comment><USER7> It's worth remembering that he's probably in the top 0.1 percentile of all lockpickers in the world. And he has a massive pile of tools, some custom- made, and experience with a huge variety of lock types. And usually picks or opens the lock the first time before shooting, so you're only seeing his well- practiced openings. And he doesn't produce video at all of any locks he hasn't been able to pick.

Though he is pretty up-front about which locks take elite skill and tools to pick, and which ones can be opened by a first-timer with a bent-up paperclip.

<comment><USER8> And yes, he really is up there in lock picking skills He literally won a lock picking competition last year [1] . Not to mention that you're seeing the end result of some amount of effort in each little video, he's talked a bit about it in the past [2], but like all of these sort of videos, you're only seeing the "good bits".

My big take away from his channel is two fold: Avoid locks that are well know to have big security flaws, like the paperclip attacks. Otherwise, the point of entry will probably be a broken window or busted door.

It's really a fun hobby, I've got a few locks I rotate from a larger collection on my desk that I try to pick anytime I'm waiting for a compile to finish.

[1] [https://www.youtube.com/watch?v=Avn7ABVHPYk](https://www.youtube.com/watch?v=Avn7ABVHPYk) [2] [https://www.youtube.com/watch?v=lkfBKQuLkRc](https://www.youtube.com/watch?v=lkfBKQuLkRc)

</comment></comment></comment></comment><comment><USER9> See: The Open Organisation of Lockpickers (Toool) for gatherings/events.

[https://toool.nl/Toool](https://toool.nl/Toool)

<comment><USER4> They also keep a pretty good page with U.S. state laws on lockpicking: [https://toool.us/laws.html](https://toool.us/laws.html)

</comment></comment><comment><USER10> Its funny but the article doesn't actually mention that the international competitions for lockpicking that occur every year.

TOOOL.NL run one at LockCon in the Netherlands TOOOL.US runs one at LockFest in the USA OzSecCon.com/TOOOL.COM.AU runs one at OzSecCon in Australia.

In addition to lockpicking competitions, there are actually a wide variety of ways, tools and techniques to open locks such as impressioning which is also a competitive sport in these communities.

I highly encourage people to give it a shot, it's good fun. And once things are back to normal, check out a local meetup or start one yourself, it's a good way to relax and have fun with some new friends!

</comment><comment><USER11> "The Moderators of /r/lockpicking" would be a more apt title.

<comment><USER12> Yeah, kinda disappointed to see an article on locksport but no mention of LPL or BosnianBill.

<comment><USER13> Or Deviant Ollam

</comment></comment></comment><comment><USER14> I'd love it if someone held a lockpicking competition (once it's safe to do things like this again) and if you book your hotel room through the event when you arrive the front desk tells you the room number but doesn't give you the key.

<comment><USER15> That would be against the rules of the organization as described in the article.

<comment><USER16> It wouldn't necessarily have to be arranged that way though.

I could see this being something at DefCon or similar for example.

<comment><USER15> It could be. But any member of the lockpicking organization would not be allowed by their rules to attend.

<comment><USER16> Interesting. Seems overly restrictive to me, but I can understand the reasoning behind it.

Out of curiosity, do you happen to know if members of the organization are allowed to do things like participate in pentesting?

<comment><USER15> From the article, the rule is, _Nobody can pick an active lock, or help anyone attempting to. The community is united on that front, with mods receiving reports of any violations almost immediately._

They then clarify, _We are extremely strict about not assisting anyone with picking a lock in use, regardless of whether they own the lock, or whether they have permission to do so._

That would rule out pentesting as well.

<comment><USER16> Indeed, thanks for patching my bad reading comprehension.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> The history of lock picking started to get interesting in the industrial revolution. See [https://gizmodo.com/in-1851-a-man-picked-two-unpickable- lock...](https://gizmodo.com/in-1851-a-man-picked-two-unpickable-locks-and- changed-1698557792)

<comment><USER4> You might want to check out some of Schyler Towne's talks on the history of locks [1] [2]. His enthusiasm is infectious; he's obviously an expert, and obviously loves what he's talking about.

[1] [https://www.youtube.com/watch?v=vGjkQ7qAyY4](https://www.youtube.com/watch?v=vGjkQ7qAyY4) [2] [https://www.youtube.com/watch?v=C5CrR8-42x4](https://www.youtube.com/watch?v=C5CrR8-42x4)

</comment></comment><comment><USER18> I always wanted to get a cheap set and practise on some locks - where's the best place to find old locks to practise on? I don't want to destroy my front door!

<comment><USER19> Go to your local home improvement store and load up on cheap locks.

Masterlock #3 is the defacto starting lock to learn how to pick - it's easy, and only has 3 pins, no security pins, etc. They're also very cheap and everywhere, you might even have one already you forgot about.

It's important to get an easy lock to learn on. It'll allow you to learn the principles without a ton of frustration.

For tools, it's difficult to beat Peterson on quality and price.

Picking locks is honestly a great brain exercise. I have a collection of locks, all locked together in a giant ball of locks, and no keys. They sit on my desk, and I pick them when trying to take a break once in a while. It requires a lot of focus, and a mental map of what is going on inside the lock. Pretty soothing actually.

</comment></comment><comment><USER20> Getting a cheap bumpkey and learning how to use it on your own door can save you lots of trouble the next time you lock yourself out of your place. I hide one in the bushes.

<comment><USER21> I have a key behind a combination lock. Not 100% secure, but I live in a safe enough area that I never worry.

I'm more worried about my smart garage door openers getting hacked then someone getting my key.

<comment><USER4> If it's a combination padlock, many of them are shimmable or easily bypassable [1]. If you care, it's worth searching for your lock brand and model # on YouTube.

[1] [https://www.youtube.com/watch?v=hpkf1Zldf0s](https://www.youtube.com/watch?v=hpkf1Zldf0s)

<comment><USER21> You can break into my house by breaking a window near (or on) the door and then unlocking it. It's not even worth trying to hack the keybox.

</comment></comment></comment></comment><comment><USER22> > The World of Competitive Lockpicking

I initially read this title as 'The World of Competitive Bootlicking'</comment>


Circumventing the No-Fly list in thirty seconds - <AUTHOR> http://blog.rodneyfolz.com/circumventing-the-no-fly-list-in-thirty-secon <comment><USER2> The first time someone pointed this out, the FBI raided his house[1] and sparked a Senate investigation. This was _four_ years ago. I did this to one of my Southwest tickets recently, though didn't use the forged copy. Honestly, it's like they think HTML is unreadable, or, more likely, that it's security theatre designed to make everyone feel safe. I would be okay with that if it wasn't taken so seriously.

[1] [http://arstechnica.com/security/news/2008/06/tsa-defiant- pas...](http://arstechnica.com/security/news/2008/06/tsa-defiant-passengers- wont-get-to-fly-without-id.ars)

Edit: The Soghoian blog post about the raid: <http://paranoia.dubfire.net/2006/10/fbi-visit-2.html>

<comment><USER3> I think there are two purposes to the TSA. One is to make people feel safe, as you mentioned. The other is to get people into the habit of having their rights routinely violated by "government agents". It is a form of conditioning, and its pretty effective.

10 year olds at this point have never known a world that was otherwise.

In another 15 years, almost all adults will be completely used to it, and the idea that we don't need the TSA will sound as absurd to them, as to most of us it seems "absurd" that in fact in the past you could fly in the USA while carrying a rifle or shotgun aboard, with ammo. The flight attendants would offer to stow it for you in a coat locker, but otherwise wouldn't bat an eye.

Even today you can fly with firearms (in checked baggage) but a lot of people think that this idea is completely absurd because they've never seen it... and they've been conditioned to being disarmed and the idea that you can't have a gun in an airport. (you walk in and check it at the counter, before going thru security.)

<comment><USER4> > "10 year olds at this point have never known a world that was otherwise."

It takes 2 generations to completely change the nature of a society. As long as those born before 2000 are still around all hope is not lost. Do not give up.

<comment><USER5> IMO, relevant

One of the best talks I've ever seen <http://youtu.be/5gnpCqsXE8g?t=8m40s>

</comment></comment></comment></comment><comment><USER6> I'm a very tall man (6'4") and always have trouble with a lack of legroom on flights (even JetBlue).

A few years ago I was adventurous, and frustrated -- there were no seats left on the flight that it would let me reserve online. Yet for this particular airline, it showed that the exit row seats were available, but clicking on them lead to an alert that you could not book them online: You had to do so at the airport.

I decided to look at the code making the seat selection calls, submitted my seat selection for that seat anyway -- and wallah! I was granted a ticket with that exit row seat. Had no problem going through security or boarding. Haven't tried it since - as most airlines now charge extra for those seats, and its not such an easy hack.

<comment><USER7> At first I thought "wallah!" was a phonetic misspelling of _voilà_ <http://www.thefreedictionary.com/voila> , but now I see it apparently is an arabic oath meaning "by Allah!" <http://www.google.com.au/search?q=wallah> (though the wikipedia article suspiciously cites no sources... <http://en.wikipedia.org/wiki/Wallah_(Arabic)> )

<comment><USER8> wallah does indeed mean 'By God!' in arabic but it's used as an assertion of veracity. In this context the poster obviously meant to say voila and like you I've also seen this wallah variation of it creeping in recently.

<comment><USER7> Retro-validation appeals to me, so it could be interpreted as:

 _and - truly, I swear by God I am not making this up - I was granted a ticket with that exit row seat_

In English, it's an old-fashioned idiom that a Robert Louis Stevenson character might have used. But English-speakers tend not to swear by God much these days - indeed, "swearing" usually means profanity.

<comment><USER9> It is still a common idiom in US English.

</comment></comment></comment></comment></comment><comment><USER10> This doesn't surprise me in the least. I've been in India for the last month, and I've been _shocked_ by two new things since my last visit (several years ago).

First, security here is _everywhere_.

Second, security here is _pointless_.

I have had to walk through security to get to supermarkets, discount stores (think Walmart), high-end shopping malls, temples, mosques, movie theaters, national monuments, airports, hotels, you name it. You can't walk into a large building and not walk through a metal detector. The ACLU would probably go ballistic if the US had even 1% of the number of pat-downs that I have had to go through daily here.

Unfortunately, it's entirely pointless. Generally, I don't take my belt/jewelry/phone off when going through the metal detector, and most of the time, it doesn't even detect that. Whether or not I set off the detector, the process is the same: they (occasionally) wave a wand over, and then send me to a second person who briefly pats me down (<5 seconds in all). Keep in mind, the _exact same process_ is applied to those who do and do not set off the metal detector. A few times, I've set it off and they just wave me through without even checking me further. It's mind-boggling.

I can't say I'm a fan of ubiquitous security, but the only thing that's worse than ubiquitous _ineffective_ security. Anybody who really wants to cause trouble can bypass it in their sleep - all you manage to do is disrupt the lives of everybody else, all the while accomplishing literally nothing.

<comment><USER11> Similar thing happened to me when visiting a museum in the Vatican. Long queues, metal detectors, etc. After passing through the whole thing with no problem, I realized I had my pocket knife in my pocket throughout the day. I noticed then that the metal detector was beeping all the time, but they were not paying attention, as they probably didn't want to get people to take off belts, etc.

<comment><USER12> I accidentally took a pocket knife through airport security in LAX.

After that, I realised that the TSA was not only annoying and a waste of time and money, it was completely pointless as well.

<comment><USER13> It is possible to deduce that from their track record as well. In 10 years TSA has caught exactly 0 terrorists. Not saying there weren't attempts, but those were caught by FBI, other agencies, and most importantly, regular citizens.

<comment><USER14> While I agree that the "security theatre" that the TSA provides is largely useless, I don't think this is really an accurate statement. It's entirely possible that TSA screening prevented someone getting on a plane with a weapon of some sort, but that the person in question was never identified as a terrorist, since they had to abandon whatever plans they had.

<comment><USER13> > It's entirely possible that TSA screening prevented someone getting on a > plane with a weapon of some sort

I disagree with that statement. "It could" is hard to measure. We spend 100s of billions of $ on something based on this unproven hypothesis.

Keep in mind, TSA was created to catch terrorists red-handed as they are just about to board a plane. As in "Hey look a bomb in the x-ray machine, arrest this guy!". That is their purpose. They have not yet done that, once, in 10 years!

Govt. intelligence work and regular citizens have prevented and stopped attempts. There is some track record there. TSA doesn't have one.

By your metric one could have just as well re-defined TSA's mission as "Protect the citizens of the United States of America against Evil Pink Elephants from Neptune". Chances are very high that TSA's track record with that task would have been exactly what it is with their current mission. AND you could have still made your argument "See no Pink Elephants from Neptune have attacked us, so they must be doing their job."

Or think about it another way: How many airliners were blown up in US airspace before 9/11? Was it a monthly occurrence? Yearly? Now if was a yearly thing, and then TSA came along and it suddenly stopped, you could have made a correlation based argument saying, that it is probably because of fear of TSA that we didn't have any more attacks.

Yet another way to look at it. As a terrorist you are trying to instill terror and kill as many people as possible. A large gathering of people would maximize your impact. I wonder what places and events consistently create large queues of people waiting in line? What about also a place that would cripple and disrupt the economy and travel? I'll leave that as a rhetorical question.

<comment><USER14> I agree with you completely that it's entirely unproven whether or not the TSA has been effective for catching terrorists. I also agree that it's a wasteful system that should be seriously reformed into something that is actually effective.

It's precisely because it's unproven that we cannot say that the TSA has never caught a terrorist. That's all I was saying. The TSA may or may not have caught a potential terrorist at some point, it's pretty much impossible to say. You can't have it both ways. Either the TSA's effectiveness is unknown (meaning they may or may not have caught terrorists), or it's known to be 100% useless (meaning 0 terrorists were caught).

In regards to occurrences of terrorists prior to 9/11, you're correct that there weren't many (any?) incidences of using a plane for a terrorist attack, but hijackings were certainly not uncommon prior to 9/11. In fact, come to think of it, incidences of hijackings are almost certainly down since 9/11. I don't think this can be entirely attributed to increased security, but I wouldn't be surprised to see it as a contributing factor.

<comment><USER13> > we cannot say that the TSA has never caught a terrorist.

But why? I am sure any such catch would have been paraded in front of media for months. Are you saying they caught a terrorist with a bomb red-handed but hid it and instead shipped the guy secretly to a prison in another country? If not, that then I think we can say most definitely that they have not caught a single terrorist. Would you agree?

> but hijackings were certainly not uncommon prior to 9/11

Obviously hijackings were not that bad. That is the reason the first two planes ended up being used as projectiles, because people thought it was a regular hijacking. Within hours everyone in the country including passengers of the plane that went down in PA learned to not think about hijackings anymore in the same way. So the problems basically "fixed" itself immediately.

You are right the # of hijackings is now lower. TSA presence might have a part to play, that's plausible. But because of the previous paragraph it also becomes irrelevant. So the reasons for having the TSA evaporate away again.

</comment></comment></comment></comment></comment></comment></comment></comment><comment> chao- Poorly implemented solutions are security theatre at its best. Well, almost. They're second best to "The wrong solution for the problem" approaches. Take the school in Texas this week where one kid shot another [1]. The school's solution is to make everyone use completely transparent backpacks, nevermind that:

1\. You could fit a gun inside a zippered/covered binder or expanding file folder and the backpack does nothing.

2\. The school already has metal detectors, so the backpacks aren't actually adding any detection.

3\. They don't even know if the edge case where their current security failed even involved backpacks.

[1] [http://www.chron.com/news/houston-texas/article/Teen-shot- at...](http://www.chron.com/news/houston-texas/article/Teen-shot-at-North- Forest-High-School-2457718.php)

<comment><USER13> The point of security theater is often to placate the public. Public demands (or is perceived to demand) action. Doesn't matter what. In this case "something" was done. The school gets to :

1) boast about how they were proactive and did something quick (so it looks good on their resumes).

2) protect themselves against the expected criticisms that they didn't do anything.

3) it was an easy policy to implement (they just wrote down a new rule). no need for new equipment, training or anything so it doesn't affect the budget.

Not saying that it isn't stupid. It is very stupid. But in their position they seem to act rationally. Now if another incident occurs they will get a backlash about how transparent backpacks didn't work, to which the response would be we need to outlaw binders. _But_ if they hadn't done anything and another incident occurred the backlash would have been a lot worse -- they would have been blamed and possibly sued because they took no action to prevent it after a history of past incidents.

</comment></comment><comment><USER15> I know a girl who changed her name when she got married and whose ID still has her maiden name. She buys her plane tickets under her married name, and carries her marriage license with her when she flies in case the TSA asks about the discrepancy. _But no one has ever noticed._

<comment><USER16> Out of curiosity, why doesn't she update her ID?

<comment><USER17> At least in the UK it costs a decent chunk of money to get the name on your passport changed after marriage. Not a huge amount, but enough that it's easier to just book tickets under your maiden name.

</comment></comment></comment><comment><USER18> This doesn't always work. You might end up arrested. You are better off with a fake ID.

When you board the plane they check the codes to see if you have been through special screening, they check the markings to the boarding pass codes.

I've made it to the flight a few times only to be turned around and accompanied back to security for the full security theater experience. At this point they will check the list and you will be arrested if they find a problem in the paperwork.

Your best bet is to change your name slightly William --> Bill etc. and play around with a middle/first initial. Computers are dumb. TSA agents are friendly when you are friendly to them and have tendency to not pay attention to their work. Social engineering is a lot more effective than computer hacking.

<comment><USER19> > "they check the codes"

And what codes are these? the pen-squiggle? the highlighter-check-mark?

Is it your hobby to try to sneak past TSA checkpoints? Are you successful often enough that you have been turned away at the gate for not having the proper 'codes'?

<comment><USER18> >And what codes are these? the pen-squiggle?

There are codes that indicate the level of screening you should get along with codes that have "Special screening" indicated on them. And then the TSA is supposed to squiggle in response. Buying a one way ticket usually means you get special screening, I hope the terrorists don't figure this one out.

>Is it your hobby to try to sneak past TSA checkpoints?

In a way yes. It is my hobby to get through these things as quickly as possible. Sometimes I go through the staff/express line, you get a long way by being friendly to TSA agents.

>Are you successful often enough that you have been turned away at the gate for not having the proper 'codes'?

Yes. TSA agents make mistakes and don't always check the passes properly. I swear with half the agents I could give them an ID for someone completely different, all they do is check that it "looks" real.

One time I almost missed a flight. One of the gate agents was nice enough to run back to security with me and hurry them along. Someone else watched my bag rather than wait and get it searched properly. Security theater at its finest.

<comment><USER20> The SSSS mark is also handed out when you purchase your ticket shortly before the flight or when you pay in cash, or at the discretion of the airline. I've endured it more times than I care to recall because I frequently change my travel plans.

[http://en.wikipedia.org/wiki/Secondary_Security_Screening_Se...](http://en.wikipedia.org/wiki/Secondary_Security_Screening_Selection)

<comment><USER21> Looking at those criteria, it wouldn't flag terrorists who were well-funded, forward-planning, and punctual. Which sounds like prerequisites for a successful attack.

Hey ho.

</comment></comment></comment></comment></comment><comment><USER22> I don't know about the US, but this definitely doesn't work in Canada.

The the gate agents definitely always check ID with the boarding pass.

<comment><USER23> That's not the point... John Doe buys a plane ticket and gets an electronic boarding pass — John uses Chrome Developer Tools or Firebug to change John Doe to Jane Terrorist. John Doe's name is checked against terrorism watch lists, but Jane Terrorist's name isn't. Jane Terrorist then presents a boarding pass with her actual name and she has an ID showing her name is Jane Terrorist. The TSA agents don't check terrorism watch lists at the checkpoint.

tl;dr: You can alter a boarding pass and circumvent the entire watch list process.

<comment><USER24> You can alter the ticket, but they check it to see that it matches your ID. So, using this method you would ALSO have to edit your ID

<comment><USER25> You're missing the point - the TSA watch list is checked with the name you bought the flight under. You can then change that name to the name that matches your ID. The TSA does not check your name against the watch list when you go up to their booth; they only verify that the two documents match (where one of the documents is essentially fabricated).

<comment><USER26> Yes, but the point is you have to buy a ticket with your real name. You can't board the plane unless the ticket is in your name. If it is in your name, you get stopped at check-in.

<comment><USER27> You can buy the ticket under whatever name you like. Identity is verified at security, and you can edit the boarding pass to match your real name.

<comment><USER28> I can't believe the point isn't getting through. I'll take my shot at it.

\</comment></comment></comment></comment></comment></comment></comment><comment>--

A is on the no-fly list. He is trying to fly.

B is not. The airline Computer expects B.

-

A brings the following things with him to the airport: ID A, Ticket A, Ticket B

Security: Ticket A vs ID A

Boarding (America): Ticket B vs Computer (B)

Boarding (Canada): Ticket B vs Computer (B)... vs ID A

</comment><comment><USER29> FWIW, I have been on two flights today and on neither of them did the gate agent check my ID. This tactic would've worked fine.

<comment><USER30> This is my experience, too. I fly multiple times a year (within the US) and I've never seen a gate agent check anyone's ID.

<comment><USER31> its rare, but it does happen, especially around the holidays. I was recently on a flight that was being gate-checked.

</comment></comment></comment><comment><USER32> This is easy to fix. Only terrorists use DOM editors, so we simply need to check all laptops when going through security.

<comment><USER33> or pass a Stop DOM Editing Act.

<comment><USER34> They could call it the SODOM Act!

<comment><USER35> That would never work. Imagine the sound bites during re-election.

"My opponent supported the _SODOM Act_! Need I say more?"

</comment></comment></comment></comment><comment><USER36> In my experience, the TSA agent you have to show ID and boarding pass to at the security checkpoint also scribbles something with a marker or highlighter on your boarding pass.

But even aside from the fact that this is obviously and trivially forgeable, I don't think the person who scans your boarding pass at the gate even looks for the scribble, as I've used a different boarding pass to get on the plane than I did at the security checkpoint before (because I had printed one out at home and also printed another copy at the self-service check-in machine, and just happened to use different copies each time I needed to show it).

<comment><USER25> They definitely don't look. Several itineraries have multiple legs, and the TSA only ever looks at - much less scribbles on - your first leg. Even that aside, you can easily get a boarding pass from an agent _inside_ the terminal, without it ever having been checked by the TSA.

I've actually gone through TSA with one boarding pass on one flight, and boarded a completely different _flight_ before (not just a separate piece of paper) - back when I could book flights for free on JetBlue and had already booked another flight that night. I merely decided once I was in the terminal that I'd hop on a different flight I had also checked in to.

I do a lot of flying and have long though about this. It's total theatre. They could fix it by implementing some cryptographic code that's scanned at TSA entry points, verifying the actual _document_ (boarding passes are a far cry from a verifyable document).

<comment><USER37> > _They could fix it by implementing some cryptographic code that's scanned at > TSA entry points, verifying the actual document (boarding passes are a far > cry from a verifyable document)._

Yeah, I tend to believe that they really aren't serious about it. It seems trivial to include a data matrix barcode that encodes the traveller's name and flight data.

<comment><USER38> Wait, what? Are you saying barcodes aren't used in the US? Here in Norway at least all major handling agents issue boarding passes with barcodes, so you can board a (domestic or intra-Scandinavian) flight without interacting with anybody human except the security agents just by scanning the barcode at the gate. No idea if it's also used for security purposes, though.

<comment><USER39> The ticket has a barcode, but it's usually scanned by the airline before you board the plane. The TSA checker just looks at your ticket and your id, no computers involved.

<comment><USER36> And presumably the passenger's name is encoded in the barcode, which I guess is why the OP suggests printing the original ticket with the name of the friend that bought it instead of just using the "forged" ticket at the gate. Though I'd also guess that the airline employees who scan the ticket at the gate almost never check that the name on the ticket matches the one displayed on their screen when they scan the barcode, so you'd probably be fine using the forged one.

<comment><USER39> This wouldn't work for international flights, since they often check your passport before boarding.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> If terrorists still want to "get us", why don't they detonate some truck bombs in major urban areas? If the bridges or subway tunnels in the SF Bay Area or NYC had big holes punched in them, the economic impact would be huge.

<comment><USER40> A suitcase bomb in a large TSA security screening lineup would have a similar effect and would be a tragic way of pointing out how ridiculous the so-called security is.

<comment><USER41> Then we'd have to go through security to get to security. :-P

</comment></comment></comment><comment><USER42> Not only is my ID almost never checked at the gate, the agent hardly even compares the name on the paper to their flight information. So really, you could just print out the forged copy with your name on it and use it the whole way through.

</comment><comment><USER43> Possible easy way to fix this:

Include a QR code on the printed boarding pass that holds the details of the passenger and flight along with a hash of the data, the hash being salted with a secret known only to TSA. The TSA agent then scans the QR code, computer verifies the hash and displays the data on screen for the agent to check against the printed boarding pass and ID. No database look up is needed, just a PC and webcam.

Danger is someone works out or leaks the hash secret.

<comment><USER19> The real danger is someone figures out how to spoof a legitimate request to the TSA-QR service and have them create authentic codes with bogus data.

Never mind that the solution itself is far from 'easy'. Somehow linking every ticket printer to a central TSA-QR service in a reliable and secure way sounds like, uh, fun...

<comment><USER9> Like how credit card processing works?

<comment><USER19> Yes, but only if:

1\. All existing hardware and software magically vanishes

2\. The government is put in charge of implementing its replacement.

3\. The whole system is a dead-weight loss which exists to serve the whims of government oversight rather than facilitate commerce.

</comment></comment></comment></comment><comment><USER44> Does this work?

> Give the ticket with your friend's name to the gate agent who lets you > board. It will match the flight information and you'll be allowed to board.

I fly 4 times a month and each time I have to present a piece of photo ID at the gate to the flight attendant that has to match the name on the ticket, ticketing computer and ofcourse me.

The above advice would seem to fail this test.

</comment><comment><USER45> The boarding pass should never be shown at the gate, instead you should show your ID. The agent would then check it to make sure its real and then scan it to see if your in the database to fly that day. It is a simple solution, Someone needs to build a device that can read 90% of IDs.

<comment><USER46> There are already federal standards for "enhanced" state drivers licenses.

</comment></comment><comment><USER47> Could you use the same trick to use your friend's ticket in general?

I've often had the situation of having an "extra" flight ticket for some reason. I've always thought that there is no way I can give the ticket away to a friend, but it seems like this could be a way to do it.

<comment><USER48> That's an interesting proposal. I wonder whether it is against the law, or just against terms of service to do so.

</comment></comment><comment><USER49> For every flight I've been on, the gate agent checks your ID against your ticket.

<comment><USER50> I've not run into that in any of my recent flights. I've seen it happen for international travellers but not for any of the domestic ones. It may also have to do with the fact that my flights were completely full and took nearly an hour to finish boarding.

<comment><USER49> Maybe it's a Canadian thing, and an international thing. To be fair, I suppose I haven't flown any purely domestic flights in the US.

</comment></comment></comment><comment><USER51> Security isn't there for the terrorists, just a scam to keep people flying.

</comment><comment><USER52> Glad we all give up our civil liberties for this awesome "security". I'm sure zero terrorists know of this method.

Those who sacrifice liberty for security deserve neither.

</comment><comment><USER53> It would suck to be someone whose name appears on a no-fly list. It would REALLY suck to be that same person who forges a ticket and gets caught. #oops

</comment><comment><USER54> They not check your ID at the gate? They always take my ticket and my passport, look at both, and say "Good morning Mr. B, have a nice flight".

</comment><comment><USER55> This only helps you in national flights. For international flights they very often do check the match between ID and ticket.

</comment><comment><USER43> I may be missing something but wouldn't your name be flagged as on the no fly list when you pass your ID to the TSA agent?

<comment><USER56> It would if they checked your name against a database. But all TSA does is verify your ID is valid and matches the name on the boarding pass, nothing more.

<comment><USER43> Ok, thanks. Not being an American I wasn't sure how the system worked. So when do they actually check the no fly list?

<comment><USER6> When your flight is booked, the airlines are required to check it against the copy of the no fly list they're given. So typically you do this online, well before you visit the airport.

(Former employee of ITA Software - does airline flight stuff - not sure how much more I can say, so I'll stop there)

</comment></comment></comment></comment><comment><USER57> DHS is a giant convoluted bureaucracy and it was designed to be such from the beginning. They don't actually have to, or really desire to make anybody safer at all. That's not the point of DHS at all. It's all just a series of checklists, and forms, and initiatives... and reports... all the way down. All anybody needs to do is go down the new checklist that somebody higher up gave them to fill out.

<comment><USER58> FYI, this is the structure of DHS and its Components:

<http://www.dhs.gov/xabout/structure/editorial_0644.shtm>

</comment></comment><comment><USER59> Thanks for the article. Now tsa will install another check point on each gate where you will have to show id, remove shoes, do the chicken dance ...for security</comment>


How effective communication can be achieved in a digital work environment - <AUTHOR> https://www.airsend.io/blog/index.php/2020/05/24/1-tip-on-how-effective-communication-can-be-achieved-in-a-digital-work-environment/ <comment><USER2> The simplicity is perfect. I absolutely love it & have long been looking for a solution like this for several organisations that I own or am involved in where the technical capability of users is VERY mixed.

Biggest weakness, easily fixed: but when I "search channel" my expectation is that I will wiki results (Dam) first and chat results (River) second. Currently wiki mentions in the channel are not shown at all in the search results, only chat mentions.

<comment><USER2> I understand that the search function will now be updated.

Can't express how happy I am.

Bye bye Slack, Teams & Telegram</comment></comment>


As Cloud Arrives on Main Street, We Need a New Set of Metrics for Cloud SLAs - <AUTHOR> http://techcrunch.com/2015/01/24/as-cloud-arrives-on-main-street-we-need-a-new-set-of-metrics-for-cloud-slas/

<comment><USER2> unless there is external regulation/certification, what incentive does one cloud service provider have to open a can of worms on themselves like this? It can only be assumed that all the others will follow suite and it would be comparable to price cuts ... great for the customer but from a game theory view point, best if Google, Amazon etc don't use this as means of differentiation</comment>


Ask HN: Do you get paid to contribute to a open source project? - <AUTHOR> I've been considering putting in the effort to get up to speed with a major project like Chromium or Firefox.
Ideally, if I am going to put in the massive amount of effort, I'd like to at least have the potential to get paid for the effort. Let me stress, getting paid is not the primary reason. I learn code bases and write code because I love the art.
Any advice from serious open source contributors? <comment><USER2> I'm not a contributor but I've worked with core contributors to major projects. This is usually how I see things go down:

1) You work on an open source project and an altruistic company hires you to keep working on it. This is ideal, and I've only ever seen it once (Sendmail hired a couple of core contributors to keep making Sendmail awesome back in the 90s).

2) You work on an open source project, people see the work because they use the project, and then offer you a job to keep working on the project, but slowly over time you are working less on things that are great for the community and more on things that are great for your company. I've seen this a lot.

3) You get hired by a company that uses a big project, and they ask you to start making modifications that are useful for the company. It turns out what you did was useful for everyone so you contribute it back. Sometimes it turns out to be a huge win and so you keep working on it. I saw this with Cassandra and some of the folks at Netflix.

4) You create a cool project and your company lets you open source it. It becomes well known and then other companies want to hire you for either 1, 2 or 3. I saw this a couple times were people left Netflix to go to Facebook or Google to continue work on an OSS project.

If you work on Chromium or Firefox, you'll pretty much be limited to Google or the Mozilla foundation (with some exceptions). So if you want to do it to learn some great code but don't have a particular project that you love, I'd suggest one of the more infrastructure projects that are widely deployed if you want to increase potential job prospects.

In summary: There are lots of ways to get paid to write OSS, but you may not like them all.

<comment><USER3> "This is ideal, and I've only ever seen it once" I think this is happening more and more.

At GitLab we hired more than 10 people that first contributed to the project voluntarily. Including our CI lead Kamil and VP of Engineering Stan Hu. Our last hire that joined this way was Clement Ho that was an MVP (most valuable volunteer) on August 22nd, 2016.

<comment><USER2> I guess it gets interesting when you're an open source company. It could be argued that the people you hire fall into category 2 (doing things the company wants), but since the company is driven by community desire, it's sort of a nice hybrid of 1 and 2. :)

(BTW I love GitLab and you guys are doing!)

<comment><USER3> Thanks for your kind words!

Number 2 is: "you are working less on things that are great for the community and more on things that are great for your company" => I hope that at GitLab everything we do is good for the community. There is a split between working on great things that end up in the community edition and great things that end up in the enterprise edition (proprietary). Part of the community is using the enterprise edition, so those things are good for the community but at a reduced level. But I hope they are always things everyone can get excited about.

</comment></comment></comment></comment><comment><USER4> By and large Open Source is how I make a living.

My major source of income is my "Varnish Moral License" (see: [http://phk.freebsd.dk/VML/index.html](http://phk.freebsd.dk/VML/index.html))

It is not particularly easy to shake money loose, but I'm making a living and I'm trying to explain to the world that free software is not the same as gratis software.

(See for instance: [http://queue.acm.org/detail.cfm?id=2636165](http://queue.acm.org/detail.cfm?id=2636165))

As others have pointed out, the browsers are all backed by actual organizations with employees, so that will probably be a tough row to hoe, unless the end goal is to get employed by one of them.

</comment><comment><USER5> Once my OSS project became popular, I started a business and switched to an open core model. Businesses buy additional features, I get recurring revenue so that I am paid to maintain the OSS and commercial parts.

[http://sidekiq.org/](http://sidekiq.org/)

And to answer the inevitable question: many of my paid features are also available as 3rd party OSS plugins. Many companies prefer to pay for the commercial version so they know the features will all work well together and be supported years from now.

<comment><USER6> This is awesome! Has this become your full time gig, or is it still not enough to replace a salary?

<comment><USER7> In the 'Pro' section it claims 500+ customers. Assuming that's true, at $950/year, that's $475,000. This doesn't include Enterprise ($1950/year).

I'd guess it's his full-time job now.

</comment></comment></comment><comment><USER8> One person who has spent a lot of time looking at and thinking about this problem is Nadia Eghbal. She has a repository called "Lemonade Stand"[1], which is a resource that lists a number of ways to fund open source development, and she wrote a paper on the topic of "digital infrastructure" being built on top of open source projects[2]. She also co-hosts a podcast called Request for Commits[3].

Another person worth looking at would be Eric Holscher, who's Twitter feed frequently has interesting insights into running an open source project as your full-time job[4].

The best bet if you want to do open source full-time would be to work at a company like GitLab[5] or Sentry[6], but that does restrict the exact kinds of open source work you can do (at least during working hours).

[1]: [https://github.com/nayafia/lemonade- stand](https://github.com/nayafia/lemonade-stand) [2]: [http://www.fordfoundation.org/library/reports-and- studies/ro...](http://www.fordfoundation.org/library/reports-and- studies/roads-and-bridges-the-unseen-labor-behind-our-digital-infrastructure) [3]: [https://changelog.com/rfc](https://changelog.com/rfc) [4]: [https://twitter.com/ericholscher/status/752572876138565632](https://twitter.com/ericholscher/status/752572876138565632) [5]: [https://about.gitlab.com/](https://about.gitlab.com/) [6]: [https://sentry.io/](https://sentry.io/)

</comment><comment><USER9> Some projects choose to use Gratipay. If you take a look at Gratipay's website their goal is to provide voluntary payments (and eventually a payroll system) to contributors for open work. Any team/project can apply to join Gratipay, but the main stipulation is that "public issue tracker with documentation for self-onboarding, and be willing to use our payroll feature."

[https://gratipay.com/about/](https://gratipay.com/about/)

Once payroll rolls out contributors set their own compensation.

Some more information on that can be found here: [https://gratipay.com/about/features/payroll](https://gratipay.com/about/features/payroll)

Previously Gratipay was Gittip, and worked much like Patreon - essentially a donation or ~tip~ system.

There's still some work to be done, but I've been following this project for awhile. I've been working full time now on other stuff, but I keep up with their updates, and Chad (founder) is a great dude.

</comment><comment><USER10> (Nearly) all our work (github.com/hammerlab) is OSS. We're hiring experts in ML if you're interested in working on big genomic data in the field of cancer immunotherapy. We're a lab (academic not-for-profit, part of Mount Sinai's medical school, run off foundation, grant, and gift money) of software engineers from industry and academia in NYC trying to make research better, and cure some cancer while we're at it (running some clinical trials).

<comment><USER11> sounds fascinating

<comment><USER10> Feel free to email me if you're interested (even if you don't feel as though you're an ML expert)!

</comment></comment></comment><comment><USER12> Yep, I get paid to work on QEMU. I would suggest that your chances of getting paid to work on something and what kind of work that turns out to be depend quite a bit on the project. You can have a look at the git commit history or the mailing lists: if the project really mostly worked on by a single company (as I suspect may be the case with Mozilla and Chromium) then the only paid employment prospects are likely to be with that company. A niche project might not have any opportunities for paid work on it at all. At the other extreme, if you look at the Linux kernel it has a huge range of corporate contributions of various kinds (as well as a lot of work that's purely downstream) and you have better chances of finding one that does the kind of work you might want to do.

Incidentally, previous experience with the specific codebase isn't necessarily a requirement to get a job working on a project: if you have general experience in the field and can work with an open source community then these both transfer over (this is how I got into working on QEMU). Learning a new codebase is something that you typically have to do when you start a new job in the closed source world, after all...

</comment><comment><USER13> You gave the example of Firefox. In fact, the Mozilla organization, which manages Firefox has plenty of paid employees. See [https://careers.mozilla.org/](https://careers.mozilla.org/). The same is true for some other major open-source projects such as the Linux Foundation or LetsEncrypt. Being an employee at one of these organizations means you are literally being paid to contribute to open source projects.

</comment><comment><USER14> This is not the answer you're looking for, but technically it is a valid answer to your question.

I'm a software engineer at Google, where I've contributed to Google Servlet Engine, Omaha ([https://github.com/google/omaha](https://github.com/google/omaha)), Firefox, Chromium, and Android, among other open-source projects.

Some of these are closed-source projects that were later open-sourced, some are developed in the open, and some are run as a hybrid between the two. I also develop random crap on the weekends, and Google gives us wide latitude to open-source that work if we want.

I recognize you're asking whether one can start with open-source contributions and eventually receive compensation for it. I'm answering that in my case I am compensated for a job that happens to involve lots of open-source contributions, which is the same end result but starting from a different place.

</comment><comment><USER15> I've gotten hired at my last 3 jobs primarily due to open source contributions I've done in my free time for fun. Instead of focusing on doing the code for money, focus on doing it for the challenge, the fun, and most importantly the networking.

<comment><USER16> Were the jobs continuing to work on the open source projects, or your open source experience was just a factor for why you got the jobs?

<comment><USER15> A bit of both :)

I was hired based on knowledge gained from dealing with the projects, implementing features in said projects, or literally just deploying the software in large challenging environments. And this was for stuff I contributed to in my free time for fun! OSS <3

<comment><USER16> This is awesome! I actually just started working on my first project with Mesos + Marathon this week.

<comment><USER15> Great stuff as well (but due to $reasons, I'm switching to kubernetes away from Mesos/Marathon)!

[https://github.com/mesosphere/marathon/issues/created_by/SEJ...](https://github.com/mesosphere/marathon/issues/created_by/SEJeff) :)

</comment></comment></comment></comment></comment><comment><USER17> Yes of course you can get paid to...For example, we build an open source Android app called Umbrella, which is used to help travellers, journalists and activists manage their digital and physical security on the move ([https://play.google.com/store/apps/details?id=org.secfirst.u...](https://play.google.com/store/apps/details?id=org.secfirst.umbrella)).

We pay our developers to help us build it and we are currently hiring an Android dev. [http://ie.indeed.com/job/android-developer-passion-human- rig...](http://ie.indeed.com/job/android-developer-passion-human- rights-995a46ed7366c651)

Code is here: [https://github.com/securityfirst](https://github.com/securityfirst)

</comment><comment><USER18> I've been hired by a friend to co-develop the EQCSS JS library ( [http://elementqueries.com](http://elementqueries.com) ), and everything turned out very well :)

So I'm here to tell that friends or family aren't always the worst possible clients. If you both know what you're talking about, and are well organized, and define precisely what's the price for each task, it can be a great experience.

today the project has 900 stars on Github and a lengthy Smashing Magazine page :)

More info here: [https://www.smashingmagazine.com/2016/07/how-i-ended-up- with...](https://www.smashingmagazine.com/2016/07/how-i-ended-up-with-element- queries-and-how-you-can-use-them-today/)

</comment><comment><USER19> If you're interested in academia or scientific research, there is scope to work on open source projects there. My full time job is working on a particle physics data analysis program, which is entirely open sourced. You won't necessarily have to do a scientific project either - other people who work at the same research facility work on configuration management systems, or databases.

Note that this doesn't have to involve doing a PhD or actually being an academic - it's more a providing the tools that enable academics to do successful research kind of thing.

</comment><comment><USER20> Not directly, but given we use open source stacks at work, it is in the best interest of the company when we push patches upstream so there is no cost to maintain a fork.

</comment><comment><USER21> I'm not getting paid for open-source, so most of my GitHub stuff is for fun/profit [https://github.com/wkoszek](https://github.com/wkoszek) <\- none of these generated any $$$. So if you contributed something, your learning goal could work, but there's no money to be made.

Learn/money idea to what you want is to get a job where open source is welcome, cherished and used. Internships are good to try it out. HIIT in Finland was such place and I interned there, and the result is here: [https://github.com/wkoszek/freebsd_netfpga](https://github.com/wkoszek/freebsd_netfpga) So I've got $$$ for stay + food + cinema for hacking project which I knew we'd publish and I learned a bunch.

If you're not for a rich country, Google Code In and Google Summer of Code be an option. You get a $5000 stipend for spending your summer at home hacking code, you get a decent mentor from a project you're interested in and you get experience.

Another model is to reach out to projects which are backed by a legal body. For example the FreeBSD Foundation helps and support the FreeBSD Project, and they have sponsored projects. If you're good in FreeBSD and have an idea, I feel there'd be some $$$ if you can deliver something useful. FreeBSD has feature idea pages and if you see a fit, you could just ping people and start collaborating.

Last, and I think the hardest, is to start hacking good code in a product you see is (1) open-source (2) backed by a company. I don't know how many hiring managers are techies merging pull requests etc., but even through individual engineers you can get a reference. After 10th pull request accepted by a guy who reviewed your stuff and with whom you've worked, I feel like it's easier to shoot "Are you hiring? I NEED THE MONEYZ!" email.

</comment><comment><USER22> I have a couple motivations that drive me to invest in open-source:

\- I grew up in a family without a lot of money, by using open-source software growing up I got to learn a lot of different aspects of digital production, sofware development, and try software I never would have had the opportunity to try if it hadn't been open source. This was incredibly formative in shaping my skill set today, so I have a lot of past open-source contributers to thank for where I find myself today

\- I believe businesses have a responsibility to the community in which they operate and where their employees live. This is corporate stewardship, for a big business maaybe they invest in a local school, or sponsor kids sports teams or summer camp. I'm a freelancer, so I wont be sponsoring any sports teams, but I feel its important for my 1-man business to give back in a 1-man- sized way!

So with those two things in mind, a desire to give back to open source, and a desire to help the community I come from - I have tried to find challenging new work that pushes the limits of current technology. I stretches me as a learner & worker, it provides a solution for a problem that meets the clients needs, and if I can find a way to give the solution I came up with back to the community, then others can save time and money by using my work as a springboard for their own solutions.

I write and release lots of use cases and examples demonstrating techniques and solutions, and pour a lot of time, and even some of my own money into getting them out there!

If your aim was to help a project like the Firefox project, and you wanted to be paid for your time - I would try to find a client who has an ee case not currently supported by Firefox, having them pay you to solve their problem, and also arrange that your solution can be sent back to Firefox and included in their codebase. Its a win/win/win for you, the client, and Firefox, plus a bonus win for all Firefox users at the same time!

</comment><comment> bjelkeman-again There are some organisations that build open source software and hire developers. We only have one open position right now, but we keep expanding our team. [http://akvo.org/about-us/working-at-akvo/](http://akvo.org/about- us/working-at-akvo/)

</comment><comment><USER23> Look at issues, engage with the developers and do smaller commits into Chromeium or Firefox and then apply for a job at Mozilla, Google, or Apple once you have a bit of a portfolio with the project. Firefox has the benefit of hiring remote so you don't need to be near a campus of one of the other big companies.

I work in Open Source and there are plenty of companies that build their business around a product and hire at market rates, normally they have a SaaS model of operation, but you'll have to set your sights a little lower than Chrome or Firefox. These companies include Ghost, Mongo, Elastic, Basho, Cockroach Labs, Automattic (Wordpress), Silverstripe, and countless more.

Another way to do it is to do postgraduate work at a university and get a grant, I know people who work on the Rust compiler in this capacity.

</comment><comment><USER24> I know one common technique for contributors is to put a bitcoin or donation type ID in their profile. This allows for people who see your contributions to go to your profile and give ya something back. Not sure how effective but this is one method I have seen.

<comment><USER16> It's a cool effort, but the pay is not substantial.

[https://gratipay.com](https://gratipay.com)

</comment></comment><comment><USER25> This, I believe, is the core idea behind BountySource [1], and similar sites [2]. People place bounties on problems in open source software that they'd really like to see solved, and "bounty-hunters" (i.e. potentially you) solve these problems and get paid the amount pledged.

And of course, if you're starting a new project, there's the Kickstarter model - followed by, for eg., Neovim, Chocolatey, etc.

[1] [https://www.bountysource.com/](https://www.bountysource.com/) [2] [http://alternativeto.net/software/bountysource/](http://alternativeto.net/software/bountysource/)

</comment><comment><USER26> I started and work on the minikube project as part of my full time job. It's developed completely on GitHub, and I manage two other engineers working on it full-time.

github.com/kubernetes/minikube

<comment><USER27> I'm one of those engineers working on minikube full time. It's been a great experience so far.

</comment></comment><comment><USER28> For the past 2 summers, I've been paid by Google through GSoC [1] to work do open-source work, all on Homebrew. It's been a great experience in terms of skills learned, and the pay is just a nice incentive for work that I'd be doing anyways.

I'd highly recommend it, although I believe enrollment in a university is required for eligibility.

[1]: [https://developers.google.com/open- source/gsoc/](https://developers.google.com/open-source/gsoc/)

</comment><comment><USER29> My company started as an open source project. Most of our hires are open source contributors. We're distributed all around the world (many open source companies are like this).

There are usually 3 kinds of paid contributors we see: 1\. Companies scratching their own itch while we maintain it

2\. People I hire to work on the project

3\. Phd students technically on a stipend doing their research with us (we do AI)

Another possibility is a 3rd party company paying someone to add a pull request to an open source project whether that be us or others.

</comment><comment><USER30> Yes but not by others. I pay myself to do it (well my company does).

If I need something fixed or added to a FOSS project for $WORK, that's work related and it's perfectly reasonable to do so.

Now getting someone else to pay you is a much bigger stretch. Outside of a couple people who work for really big companies that market commercial versions (or support packages) for FOSS projects, I don't know of anyone that gets paid to work on FOSS.

<comment><USER31> This may not work in all organisations - how do you get permission to work on FOSS? Did you have to explain that the code would be contributed back? How did that work with your employer's copyright assignment (if any)?

<comment><USER30> > This may not work in all organisations - how do you get permission to work > on FOSS? Did you have to explain that the code would be contributed back? > How did that work with your employer's copyright assignment (if any)?

I'm the one in charge so it's pretty easy to convince myself.

The long term value of contributing back to a FOSS project means not having to maintain your own fork.

That's what it really comes down to and companies either get it or they don't. The dumber ones think that their three-line fix to an obscure JS library will be a competitive advantage instead of the white elephant it truly is.

</comment></comment></comment><comment><USER32> I got paid/sponsored to work on a couple of projects.

I had met some people from the company a couple of times and wrote something they wanted adapted to work with their products but didn't want to invest in it.

A few thousand to get me to do something I was going to do anyway at some point was a good way for them to get something that they wouldn't monetise directly.

Not sure how to get a gig like that though :)

</comment><comment><USER16> You might consider talking to Tom Christie of Django Rest Framework. I know he's working on it full time now. IIRC the pay he gets is less than a normal salary, but there are plenty of upsides to the freedom and flexibility he has.

</comment><comment><USER33> The main benefit is giving back to the community, and possibly learning some new skills, and maybe building a github profile. I wouldn't depend on it for more than a little bonus every once in a while. Experiences may differ.

</comment><comment><USER34> If you're into working on a Opensource Social Virtual Reality platform, we're always looking for contributors! [http://highfidelity.io](http://highfidelity.io)

</comment><comment><USER35> I've made my living based on OSS projects for almost my entire professional career (about 17 years, specifically working on Squid, SciPy, Webmin, Virtualmin, etc.). Not a _great_ living, mind you, but it's kept me in food and houses and given me a lot of freedom. Also, most of the stuff that made money hasn't been the stuff you want to be doing; the code doesn't make money, in the vast majority of cases. It's the stuff you do other than code, but that requires deep understanding of the code, that makes money. Deployments, support, customization, packaging, documentation, bundling and "productizing", and occasionally getting jobs on the strength of your prior contributions. I've written a lot less code than I would have liked in all those years, and much of the code I wrote has been fleeting ephemeral things like shell scripts and packaging scripts.

I don't know a lot about the frontend OSS world, but I know that if you pick a project that has a lot of money being thrown around (in large deployments, for example) then you'll find that it's easier to get some of it to land in your pocket. Niche projects are difficult to get paid for, but can be good places to learn; smaller projects may be happy to have some help and will lend more guidance when you ask questions. But, then again, some big projects have people specifically tasked with bringing new developers up to speed and "community management", so that may even out that difference.

It will never hurt you to have OSS contributions on your resume. It's gotten me jobs, and has allowed me to round up good paying contract work when I've needed it (even in unrelated fields; I've recently done some Ruby work, even though I've never had a real project in Ruby). And, as someone who has hired people, I can say I've only ever hired people who had OSS work I could see. Sometimes unrelated to what I was hiring for, sometimes they were already working on what I was hiring for and I just wanted them to be able to spend more time on it and get them on board with the company road map.

All that said, it's not the easiest way to make a living in software. Getting a real job is probably the easiest way, and if you're lucky you'll get to work on OSS stuff to one degree or another. I've worked on tons of stuff that I never got paid for, and don't expect to ever get paid for. And, if you aren't really directing your efforts toward making something pay, you're unlikely to find that it'll pay.

OSS contribution does not, in the general case, lead to getting paid. But, it can lead there if you want it to.

</comment><comment><USER31> If you get a chance to go to a FOSS or Linux conference, there are normally lots of people there who are hiring or looking to be hired to work on FOSS.

</comment><comment><USER36> yeap, interning this semester at Cockroach Labs, Inc.[1] where their central project CockroachDB[2] is open sourced under Apache-2.0.

[1]: [https://www.cockroachlabs.com/](https://www.cockroachlabs.com/)

[2]: [https://github.com/cockroachdb/cockroach/](https://github.com/cockroachdb/cockroach/)

</comment><comment><USER37> Lots of actors supplement their income waiting tables. Artists paint portraits. Writers edit newspaper articles. Devs speak at conferences.

</comment><comment><USER38> Yes, I work for nVotes/Agora Voting, which is an open source secure electronic/online voting project.

</comment><comment><USER37> Open Source Devs speak at conferences to make ends meet.

</comment><comment><USER31> FWIW, I don't think I'd get into a FOSS project _just_ for the chance of getting paid. I think it's really hard to work on something you don't have an underlying interest in, first.

</comment><comment><USER39> Yes

</comment><comment><USER40> yes

</comment><comment><USER41> If you're a student, GSoC does include a small stipend iirc.

</comment><comment><USER2> If you want an interesting way to get paid for OSS software, check this out: [https://fair.io/](https://fair.io/)

Basically the idea is that the code is open and free, but if someone uses it a lot to make money they pay you a licensing fee.

<comment><USER42> I applaud your effort in trying to support developers that want to make FOSS, but sorry, this just won't work, as the devil is in the details, and your license is not FOSS.

      - What is a user?
      - Why is it not applicable for library code (and libraries are *the* important assets in dev)?
      - What is a plugin?

Now you might give me some convincing answers to these questions, and we might come to an agreement about the definition, but the takeaway for potential license users (e.g. dev companies) is: It is not FOSS (or "OSS").</comment></comment>


LocalWiki, a really easy to use geographically-based wiki, released - <AUTHOR> http://localwiki.org

<comment><USER2> This sprung out of DavisWiki (<http://daviswiki.org/>). Poking around that site you find that the citizens have a sense of humor. Does _your_ town have a Zombie Attack Response Guide?

<http://daviswiki.org/Zombie_Attack_Response_Guide>

</comment><comment><USER3> Anyone want to help bootstrap a localwiki for Chicago? I've got 13k Chicagoland Twitter followers on @windycitizen we can set loose on it after we get the first 100 entries or so up.

</comment><comment><USER4> Pretty cool, I'm setting up a VPS to test this out for a possible San Diego wiki. Definitely would need some help with administration and populating it with content though, if anyone's interested.

Edit: Temporary home here - <http://220.127.116.11/Front_Page>

<comment><USER4> Update: <http://sd.localwiki.org>

<comment><USER4> Update 2: <http://sdwiki.org> :D

</comment></comment></comment><comment><USER5> Looks good. Just a couple questions:

From a quick look over the documentation I could see this is built with postgres and python/django, but I didn't notice which versions (nor a roadmap to see if there would be a future transition to python3). Is there any chance you could clarify?

Also, considering its geographic focus, maps seem to be an important part, but I didn't notice any maps in the Davis install. Is there already, or planned, integration with Open Street Maps? From a quick search I found there is a django module for OSM[1], so I was just curious what the plans are in that regard.

[1]<https://bitbucket.org/ikks/django-cms-osm>

<comment><AUTHOR> It's built atop Django + GeoDjango, so we'll likely transition to Python3 when most of Django marches there. There's a development site here with some more information: <https://dev.localwiki.org>

The DavisWiki is running our old software, not LocalWiki. We'll transition it over soon. The Denton site is a good example of what LocalWiki looks like: <https://dentonwiki.org>

We're using OSM base data for the map tiles (rendered via cloudmade). We'll likely do our own map tile rendering soon, probably running an open tile server for any localwiki install to point at. Not sure about further OSM integration - got any ideas?

</comment></comment><comment><USER6> Anyone interested in helping with a Berkeley wiki? I'm glad to host an initial version.

<comment><USER7> I own the domain of berkwiki.org which is running their old software. I'd be interested in partnering with someone to get it off the ground again.

</comment></comment><comment><USER8> Congrats on shipping Philip! Gonna set up a test-bed. Oaktown needs a Wiki too.

<comment><AUTHOR> Sweet! Let me know - Oakland Local folks may be interested in helping out.

</comment></comment><comment><USER9> (shameless plug)

My site, www.lokusapp.com is a similar project, with more integration with social features among other differences. It's still in beta stages, but any input would be appreciated.

<comment><USER10> I skimmed the page and it seems to be so complicated (comparing with the localwiki). For example, page [http://www.lokusapp.com/entry/united_states/texas/mclennan/m...](http://www.lokusapp.com/entry/united_states/texas/mclennan/marrs_mcclean_science_building/) is almost empty (no information) but it is cluttered a lot by empty boxes. Maybe you should focus on the design for a while.

</comment></comment><comment><USER11> A desktop client when html5 exists? Really?

<comment><AUTHOR> It's not a desktop client. We're just using the phrase "Download" because it's a bit more digestible :)

<comment><USER4> I think maybe changing it to "install" might be good, because it does take someone with basic sysadmin skills to set up anyway.

I'd also consider putting the "find a community" stuff at the top too, since that's probably the first thing you'd want people to look at (and they can install the software if they don't find one).

<comment><AUTHOR> Thanks! Will change on our next deploy.</comment></comment></comment></comment>


Body-part replicator coming on market - <AUTHOR> http://www.economist.com/sciencetechnology/displayStory.cfm?story_id=15543683

<comment><USER2> I am really excited about this.

This technology would've changed my life as a child, and it still potentially can. Every few years I need to have surgery to replace the bone around my crushed skull (mostly in my eye socket area. Right now they remove bits from my ribs or hip when they need the material. This technology could change that completely.

Not only could they "print" bone that's the right shape instead of being ribs hacked together to be "close enough", but they could design and manufacture the blood flow necessary for the new tissue not to reabsorb.

It's a big deal for me and people like me.</comment>