Sortfolio for sale - <AUTHOR> http://37signals.com/svn/posts/2899-sortfolio-deserves-a-better-home-make-us-an-offer

<comment><USER2> I wonder how much of a decline in revenue it will have when its no longer owned/linked/shown on 37signals. I bet alot of the revenue comes from internal links and just being owned by 37s in the first place.

<comment><USER3> I'd guess that they're not just going to jettison it to the highest bidder. I imagine there will be some kind of arrangement between them and the eventual buyer that 37signals will help promote it in some way. (Obviously this is purely speculation on my part, but it would make sense.)

<comment><USER4> I'd have to think there would be some aid provided by 37s in the changeover process. If nothing else, the service will still reflect 37s in some way in the periods following the change in ownership.

I also think the value that 37s is giving SF is being somewhat overestimated. The revenues are going to be tied in with the amount of people looking for designers. As long as the stream of good customers does not dry out, the site will continue to do very well. At this point, how many customers are being brought in because of 37s? I don't know, but that would be something I'd have to get a better idea of before considering a purchase. I think SF has already gotten all the value from the 37s name that it can, or at least is close to that point. Early on, being a 37s product had tremendous SEO, linking, social news, etc. value. That stuff is already built into the product, so the 37s value is mostly limited to drawing in new customers. I couldn't imagine that value being so high that it's going to significantly effect revenues on it's own.

</comment></comment></comment><comment><USER5> So let me get this straight -- Sortfolio pulls in $17-20k per month of (relatively) easy revenue, and they want to sell it? That tells me they must be making an absolute _killing_ from their other products.

EDIT: And I'd be remiss if I didn't point out that I got my current job (I'm a web designer/developer) when my boss found me on Sortfolio, so I'm a little sad about this announcement.

</comment><comment><USER6> 37Signals is not selling Sortfolio to make money - clearly they have enough - but because they believe the product deserves a better home.

I believe they won't accept the highest bid as much as the most interesting offer. I don't mean to say they'll give it away to a small, poor startup group; but I do think their preference would be that the next owner take it to the next level both in terms of direction and financial success.

I'm actually more interested in Sortfolio now than I was before. 37Signals is in a position to be as choosy as they'd like with the future buyer. I wonder who they will choose....

<comment><USER7> _37Signals is not selling Sortfolio to make money - clearly they have enough_

That's a strange statement. It's also countered by the fact that they're selling the company, for money.. and that they're not interested in equity as part of the sale.

<comment><USER8> I think the OP is saying the 37s will measure the "success" of this deal on what Sortfolio becomes, not on how much they can make on the transaction. Ergo, if they believe a buyer has the chops to purchase Sortfolio and build it out different markets, they may select that buyer over one that (for example) wants to purchase it for more money and simply shut it down.

I'm not taking an opinion personally, but that's my take on the comment.

</comment></comment></comment><comment><USER9> "Futher, the Sortfolio model could expand into a variety of other verticals including photographers, wedding planning, catering, illustrators, artists, etc. I'd love to see a Sortfolio for calligraphy or hand lettering."

Hrm, maybe it's obvious now that <http://weddinginvitelove.com> (directory of wedding invitation designers) was very influenced by Sortfolio. It was the best example of a directory website that put the emphasis on the work as well as shuttling customers to the designer's websites rather than being a middleman. Great to know that Sortfolio was doing so well, gives me hope for WeddingInviteLove!

</comment><comment><USER10> Jason & DHH, how about a inject of $10 million series A funding to propel sortfolio to be the twitter of directories?!

<comment><USER11> Done!

</comment></comment><comment><USER12> What I'd give to have my _side project_ generate 20k a month. Working in that direction, but still...

<comment><USER13> I think the question is _exactly_ that: what would you give?

<comment><USER14> But the keyword is _my_.

<comment><USER13> Exactly.

</comment></comment></comment></comment><comment><USER15> I'm unsure how well sortfolio will/can do outside the 37signals brand because I'm sure this is part fo the draw for people to use it.

<comment><USER16> And it will be interesting to see if there is any change in the monthly revenue because of this post. As you're saying, the 37signals brand adds credibility to being seen on Sortfolio.

<comment><USER15> Exactly. I think this could still be a good opportunity for a buyer, but I don't think I would base my offer to purchase based on current revenues.

</comment></comment></comment><comment><USER17> If they paid a single developer/designer/salesperson around $80k/yr to maintain it, even after all the perks and insurance and taxes and whatnot, they'd still end up on top if that developer did nothing other than maintain the current number of paid customers.

What could hosting an app like this cost? Very little, I imagine. I'd personally find a service like Happy Cog Hosting (<http://happycoghosting.com/>) to manage it for me.

Makes it feel like a steal for anything under $1mm (that's approximately 5x revenue), even without the promotion through association w/ 37signals.

I haven't read anything convincing me that this isn't a great deal for an eager entrepreneur.

EDIT: "They" in the first paragraph refers to any owner of Sortfolio. If you take it to mean 37signals, that's fine, but I doubt that Sortfolio has the sort of growth potential that 37signals' other apps still have, and so is not worth the effort to maintain.

</comment><comment><USER18> _"Futher, the Sortfolio model could expand into a variety of other verticals including photographers, wedding planning, catering, illustrators, artists, etc. I'd love to see a Sortfolio for calligraphy or hand lettering."_

My thinking exactly ... In fact, I'm pretty confident I could fork SF for weddings and commercial photographers and 3x-5x the revenue within a year (I say that because it's the areas I work in and have connections in).

I also love that SF appears to have some good SEO juice. I googled a couple companies in their directory and their SF profile came up on page 1. I know SEO is a divisive topic on HN, but I think this is a benefit any serious buyer should consider.

From my POV, it comes down to a "build vs buy" question.

</comment><comment><USER13> So what would be a good offer? If they just run it for another two, three years without spending time on it and then close it down they'd probably make about 600,000$. So the offer should be minimum 500,000$, including perhaps some ongoing traffic/links from them?

<comment><USER19> That's not bad. If that was the case ($200k/yr profit for three years), the worth would be about $550,000 depending on what you think inflation is. Here's a primer article for you on calculating things like this: <http://wiki.fool.com/Net_present_value>

However, the market value of the domain plus links plus announcement/traffic from 37signals for the relaunch make it worth much more than that. The price in cash ought to be equivalent to selling a modestly successful startup right now. I don't know what would be appropriate and would welcome additional thoughts from the community.

P.S. The other reply to your post is really lame. Thanks for starting this discussion.

</comment></comment><comment><USER13> I find <http://dribbble.com/> works much better to find freelance designers, although it's not even aimed directly at that.

It does go to show. With only 200 paying customers, they're making 20,000$/month!

<comment><USER20> they have just under 2% conversion rate from free to paid.

<comment><USER21> If you think you can get a better conversion rate and get more profit from that, round up some money and take over :)

<comment><USER20> Bryce, you need to get WAY higher to make this a worthwhile deal. assume you lose half your traffic once they stop promoting it. you still have a decent sized mailing list, so you can sell to those guys, but they might not upgrade once the traffic dies off.

</comment></comment></comment></comment><comment><USER22> This would be a dream come true for me. I can finally work from home 100% of the time without a boss or anyone to answer to. I can dedicate all my love and passion for web development to Sortfolio.

The only problem is, what is considered a "serious" offer for Jason??? Hmmmm... What if I offer something a lot higher than what he had in mind? (I doubt it)...

Would you take a home equity loan to buy Sortfolio? I am considering it :)

<comment><USER23> It's generating $240,000 a year in revenue. Unless your house is worth a ton, I don't think a home equity loan is gonna cut it :)

</comment></comment><comment><USER24> Jason is coming to Mixergy to talk about it. Any suggestions on what I should ask?

<comment><USER25> What's their CAC, LTV and any other interesting metrics he is willing to share

</comment></comment><comment><USER26> This sounds like a job posting in disguise.

</comment><comment><USER27> I think they're selling because they're not trying to do everything that makes money, but to concentrate on the things that are the most profitable. For example, you could make money washing dishes, but for most people, there's more profitable work that they could do, so they don't work as a dish washer.

To prospective buyers- would you rather be a dishwasher or try for something that's even more profitable?

</comment><comment><USER28> I think $1M would be a reasonable offer. I just don't have any ideas how to grow the business. Traffic has been on a steady decline:

<http://siteanalytics.compete.com/sortfolio.com/>

And without a steady stream of traffic from 37signals properties, it could go bust.

Maybe it would be smart to evolve it into a portfolio site.

If I were interested, I'd offer 15k + 50% of the rest each month, and sell them on my vision. Too bad I don't have one.

<comment><USER29> $1M is nowhere near a reasonable offer. You're talking 4-5 years to break even just on that sale providing you don't have any competitors. I wouldn't give them more than 1-2x revenue. Of course, I'd have to have 1-2x revenue to begin with ;-)</comment></comment>


NGen Express: Paring quality designers with simple/low budget projects - <AUTHOR> http://www.ngenworks.com/blog/ngen-express/

<comment><AUTHOR> I for one am very exited by the potential of this service!

I'm a developer who can't design, but I do have an attention to detail and an appreciation for well-designed sites. This service is right up my alley. It looks like nGen Works will take care of finding the designers, which is the really hard part for me. The "name brand" designers that I know are way out of my price range, and I'm not sure where to find less expensive quality designers. Hopefully this service will solve that problem.

I very much look forward to seeing pricing and the work of their designers!</comment>


How the shape of your ears affects what you hear - <AUTHOR> https://www.nytimes.com/2018/03/06/science/ears-shape-hearing.html <comment><AUTHOR> >The Encoding of Sound Source Elevation in the Human Auditory Cortex

[https://www.jneurosci.org/content/38/13/3252](https://www.jneurosci.org/content/38/13/3252)</comment>


Ask HN: Why can I not delete News.app from Mac OS X Mojave? - <AUTHOR> This is very Microsoft Windows or Google Android behavior from Apple, making it impossible to delete or uninstall the News.app from a fresh Mac OS X Mojave installation. Extremely user hostile. <comment><USER2> I want to delete iTunes as well. The Mojave will open iTunes when I hit the play button on my keyboard after Spotify is idle 10+ minutes. Drives me crazy!!

</comment><comment><USER3> This is how it's been on iOS for years but I was pleased to find out yesterday that I can now remove those "built-in" apps from my home screen. Not sure whether or not they're actually deleted or just hidden though.

Perhaps you'll be able to remove them eventually...

<comment><USER4> When Apple first allowed users to "delete" Apple apps in iOS 10, they weren't deleted but hidden. My understanding is that in iOS 11 they are really deleted.

</comment></comment><comment><USER5> It's a guess but it's probably integrated into multiple apps (e.g. Stocks probably also uses it) so they may have decided it is easier to avoid problems by keeping all installed.

</comment><comment><USER6> Yoh also can't delete finder or chess.

It's been that way for a at least a decade.

</comment><comment><USER7> Tried `sudo rm -rf News.app`?</comment>


Microsoft recommends switching to iPhone, Android as it kills off Windows phones - <AUTHOR> https://www.cnbc.com/2019/01/18/microsoft-ending-windows-10-mobile-says-switch-to-iphone-or-android.html <comment><USER2> Unfortunate news; though most won't miss it, I will. It was the last smartphone option that avoided both the Scylla of Google's data vacuuming and the Charybdis of Apple's pricey walled garden and their "my way or the highway" design philosophy. Plus, the live tiles are actually useful in a smartphone context.

Microsoft (and by that I mean both Arbogast and Myerson) was just plain stupid to break app compatibility multiple times between Windows Mobile 6.x and Windows Phone 10. What exactly did they think was going to happen to their app count after pissing off their developer base?

<comment><USER3> It's _good_ to not keep app compatibility forever. When you don't you get the hodgepodge mess of Windows.

Apple has broken compatibility plenty of times and has been able to move its customer base to the new platform.

<comment><USER4> _Apple has broken compatibility plenty of times_

When Apple breaks compatibility, I have to tweak the Objective-C code I've been toting around for ten years. When Microsoft broke WinMo compatibility, you burned it to the ground and started over.

<comment><USER3> Were you around for either the 68K to PPC transition, the PPC to x86 transition or have you had to move from Carbon to Cocoa?

<comment><USER4> I was not writing Objective-C code for any of those on mobile platforms, which is the topic at hand.

EDIT: though in rereading your original comment, it's a fair question. Yes, I was around. No, I still don't think it applies. Even considering desktop, IMO Apple made great efforts to make such transitions at least somewhat seamless. In more than one instance, Microsoft's mobile message was: "that app won't run on the new OS without a _lot_ of work."

</comment></comment></comment></comment></comment><comment><USER5> This didn't age well: [https://www.zdnet.com/article/microsoft-celebrates- windows-p...](https://www.zdnet.com/article/microsoft-celebrates-windows- phone-7-with-mock-iphone-funeral/)

</comment><comment><USER6> Curious: Would there be any benefit to open sourcing parts of the OS, at least enough so that it could run on mobile hardware of some kind?

I believe HP/Palm open-sourced WebOS after they abandoned the device market, but nobody tried to build a Hackintosh type phone out of it.

Back then, that made sense as WebOS suffered from a lack of apps, but in 2019, mobile web apps aren't the afterthought they used to be. I can call an Uber and track the entire journey using their web app manifest ("Add to home screen"). I'm using Uber as an example of a complex app that you wouldn't think would work well as a 'website'.

With everything we know about Google's data collection/tracking policies, I'd think there'd be some itnerest in having the option of hardware that ran a non-intrusive mobile OS.

<comment><USER7> I would be far more interested if they open sourced the hardware of their phones, or at least publish enough information that allowed developers port other operating systems on hardware otherwise doomed to end in some third world landfill.

<comment><USER8> Yes, it's generally a Qualcomm SoC underneath. Already several Lumias were reverse engineered to run Android. [0]

A month ago, MS announced Project Mu - opening up their UEFI implementation on github. [1] Extending that project to their legacy ARM phones would be the way forward, perhaps.

[0] [https://www.xda-developers.com/microsoft-lumia-525-hacked- to...](https://www.xda-developers.com/microsoft-lumia-525-hacked-to-run- android-6-0-1-with-cyanogenmod-13/) [1] [https://blogs.windows.com/buildingapps/2018/12/19/%e2%80%afi...](https://blogs.windows.com/buildingapps/2018/12/19/%e2%80%afintroducing- project-mu/)

</comment></comment></comment><comment><USER9> Windows Phone has been dead for awhile, really. I will miss it, WP8.1/8.2 was truly the least bad mobile experience.

<comment><USER10> I haard more people saying that: I like the hardware but thought the OS was awful.

<comment><USER9> I loved the OS compared to Android. It was very performant which made cheap hardware seem fast. The OS was incredibly consistent, and it never badgered me with useless notifications.

</comment></comment></comment><comment><USER11> R.I.P. I loved my Lumia.</comment>


Ask HN: Comprehensive List of Startups - <AUTHOR> what's the best way to find a comprehensive list of startups and as many attributes as possible? U.S. companies only <comment><USER2> [https://bba.bloomberg.net/?utm_source=bloomberg- menu&utm_med...](https://bba.bloomberg.net/?utm_source=bloomberg- menu&utm_medium=bcom)

What is maximum age and do you have a minimum revenue requirement?

<comment><AUTHOR> no revenue filter. but age wise, preferably post 2001-2002 as the date of incorporation/registration.

</comment></comment><comment><USER3> AngelList and/or Crunchbase

<comment><AUTHOR> their APIs are not as open. and manual is not going to be efficient. I was looking for a massive list

<comment><USER3> Totally just saw your username… small world haha. I wish both had more free API access too.

Another thing to consider is most investors and accelerators keep lists on their own sites but very fragmented.

Is there specific info you want?

<comment><AUTHOR> was waiting to see if you'd figure it out at some point. but no specific info. at least the basics (year founded, team size, funding, sector) etc...

and yeah, going to each investor site would be a nightmare. pretty much impossible.

thinking about just asking people to input their info on some form but highly doubt that'd work either.

<comment><USER3> Yeah, agreed. If you do find something let me know. I had been searching for similar a few months ago and realized everything I wanted was available from the AngelList + Crunchbase + LinkedIn via APIs (and none had all of what I wanted by themselves), but the cost was prohibitive for my project too. The conclusion I came to was that I'd have to collect the data myself via a network of tiny scrapers.

<comment><AUTHOR> I'm gonna figure something out. stay tuned. I feel like a lot of people are looking for this list.</comment></comment></comment></comment></comment></comment>


The Joy of Popup Windows - <AUTHOR> http://code.flickr.com/blog/2011/02/01/the-joy-of-popup-windows/

<comment><USER2> Browsers need a "never open a new window" user option. Open a new tab instead. \- When you open a new window, there's a good chance that I'm going to accidentally click again on the parent window. The popup loses focus, slips behind the parent window in the z-order, and I have to pick it out of the taskbar or Expose. It would be a much better experience to pop the new window in as a new tab. When you hit 'submit' or whatever the tab closes and your original tab is back on top. This could be entirely a user-defined option too, in Chrome all tabs/windows are interchangeable by dragging.

<comment><USER2> Found a [Chrome extension]([https://chrome.google.com/extensions/detail/papnlnnbddhckngc...](https://chrome.google.com/extensions/detail/papnlnnbddhckngcblfljaelgceffobn)) to do exactly this. You still get an annoying little popup window flash, but then it sucks it into a new tab. Awesome.</comment></comment>


Ask HN: Why did you start working in a startup? - <AUTHOR> <comment><USER2> To try and fail than never having tried.

</comment><comment><USER3> To get more creative freedom.</comment>


Amazing apple recruiting video.  - <AUTHOR> http://www.youtube.com/watch?v=A7HVt3xgTn4 <comment><AUTHOR> The level of thought that even marketing teams dont use in their pitch is truly inspiring. My kid brother said he wished he had seen this video before the start of his summer internship.

</comment><comment><USER2> The video is wonderful.

Then I think about the horrible software disaster train wreck that is iTunes.

Cognitive dissonance, anyone?

<comment><AUTHOR> I second your opinion on itunes ! I sometimes wonder if apple sees something in iTunes that most ppl miss !</comment></comment>


Top 20 Programming Lessons I've Learned in 20 Years - <AUTHOR> http://www.dcs-media.com/Archive/20-20-top-20-programming-lessons-ive-learned-in-20-years-FI

<comment><USER3> These lessons are pretty basic, but they have served me well over the years. When I find myself getting lost in a project, it helps to go back to the basics and get some perspective.

1\. _Break it down._ A whole project - even an ostensibly simple one - <USER2> overwhelming to contemplate and leads to defensive procrastination. Always take the time at the beginning to break the project into manageable components. Then work through the steps until complete. Be sure to review and revise the list of steps as your requirements change.

2\. _Your requirements will change._ Accept it. Embrace it. Understand that the final product will be better if you're willing to change your mind when the facts change.

3\. _Obey Gall's Law._ When coding a project, take the shortest path to a simple application that works, even if it's only a fractional subset of the total project requirements. Then incrementally add functionality, testing as you go, until the project is completed.

4\. _Document as you go._ This includes both code comments and external documentation for application and/or API users. Every time you add or change a feature, update the documentation to reflect the change. Just make it a core part of your workflow. If you wait until you've finished coding to start documenting, it will end up looking forced, rushed, and incomplete. Ideally, include your documentation right in your version control.

5\. _Use version control._ Disk space is cheap and abundant, so commit early and commit often. Make sure your commit comments reflect what you're capturing in each snapshot.

6\. _Backup and restore._ This should be a no-brainer. You need a proper, reliable, redundancy-tested offsite backup, and you need to test regularly that you can restore from your backups. No, a RAID array is not a backup solution.

7\. _Leave your code in a working state at the end of every day._ Don't walk out on code that won't run. It's surprisingly demoralizing to come to work the next day knowing that a broken build is waiting for you. If you have to roll back or comment out a half-finished code block, do it.

8\. _If you can't figure out a problem, walk away._ For small to medium-sized problems, I find a good brisk walk is enough to break the logjam in my mind and see through to a solution. For big problems, I may have to pull out the big guns: a good night's sleep.

9\. _Fix bugs first._ Don't introduce any new features while any identified bugs are still outstanding.

<comment><USER4> 7a. _Write out your mental cache_ at the end of the day. I always type up a quick todo list (or update the one on the current mental stack). It reduces my boot time in the morning.

 _there will be bad days._ Some days just aren't meant for programming. Do something else those days or you'll cause more harm than good.

<comment><USER5> +1 I do this every single working day without fail. #7 is excellent too. Ernest Hemingway said:

 _The best way is always to stop when you are going good and when you know what will happen next. If you do that every day … you will never be stuck. Always stop while you are going good and don't think about it or worry about it until you start to write the next day. That way your subconscious will work on it all the time. But if you think about it consciously or worry about it you will kill it and your brain will be tired before you start._

(more detail: [http://www.secondactive.com/2009/08/boost-your- productivity-...](http://www.secondactive.com/2009/08/boost-your-productivity- with-hemingways.html))

I would also add 9a. Understand what was causing the bug once it's fixed. I'd say a key hallmark of a bad engineer is if they are happy with a fix even though they don't understand what the underlying problem was.

<comment><USER3> Thanks for your helpful reply! I turned my comment into a blog post and incorporated your suggestion:

[http://quandyfactory.com/blog/41/top_10_programming_lessons_...](http://quandyfactory.com/blog/41/top_10_programming_lessons_in_10_years)

</comment></comment></comment></comment><comment><USER6> _Learn to learn more...there is a lot of technology out there and keeping up with it is a fulltime job, but if you have a smart way of receiving your news, you'll learn about new technology every single day._

Thanks Hacker News! You're my smart way of receiving my technology news :-) My own knowledge is fairly narrow (at least relatively speaking), C#/.NET and Python/Django for the most part, but reading about all of the stuff going on elsewhere in the tech world at least helps me to know what I don't know.

</comment><comment><USER7> I think this is all fantastic advice, except this one:

 _A language is a language is a language_

Perhaps I am simply not yet experienced enough, but I find which language I am working with makes a great deal of difference.

I know that some of it is personal preference and knowledge of the languages, but at the same time some of it seems to be that some languages are better suited for some tasks than others, and yes it at least looks like some languages are all around better than others.

Personally, I generally choose Python as my general purpose programming language and prefer it for most projects, and I get a lot more done in than I do in Java. I use C# for many types of projects on Windows, but I use VB.Net only if forced. If I ever decided to write an OS as an exercise I would probably start with C and if I needed to do something heavily statistical I would seriously look at learning R.

<comment><USER8> I don't think he's saying that any language is the best tool for the job.

More (and I've found this to be true) that once you learn most basic programming concepts in one language, moving to another becomes easier. The more you learn the easier it is to switch to another language.

<comment><USER9> After a while you start thinking of languages as API's. You don't think about the problem in Java, or Lisp you figure out how to solve the problem abstractly and then find out how to use the language to make it as easy as possible. This is why learning new idioms / languages can be helpful even if you always implement in the same language. You also start to implement an add hock solution that mimics other languages in your language of choice. (Which can confuse people not used to the concept.)

</comment></comment></comment><comment><USER10> _You are not the best at programming. Live with it_ \- Strictly speaking this is only true for N-1 of the population...

<comment><USER11> How would you measure 'best' at coding? As I understand it, there are at least several different aspects that you could measure. One persons be the most effective algorithm designer, but another another the quickest at internalizeng large problems. It seems that one ould be the best in one way but not another and there could be no 'best' coder overall.

<comment><USER12> I certainly agree. And domain expertise comes into it too. Too much insulation from the domain can lead to a kind of inverse leaky abstraction problem - where not enough of what's real about the problem is affecting the design, which is too ivory-tower.

<comment><USER13> I've experienced this before -- a project designed by database coders to process data not naturally represented by a database metaphor.

</comment></comment></comment></comment><comment><USER14> Nice list. Here's mine (off the top of my head in no particular order):

      1. Start with the answer, then work back.
      2. Name your variables so that anyone will know what they are.
      3. Name your functions so that anyone will know what they do.
      4. Never write the same line of code twice.  Use functions.
      5. Assume the user doesn't know what they want.
      6. Even if the user knows what they want, assume they can't verbalize it.
      7. The user always knows what they don't like.  Prototype often.
      8. Be prepared to dig down as many levels of detail as needed to understand.
      9. When you're stuck, turn off your computer.
      10. Don't turn your computer on until you have a specific task.
      11. Beauty is important, but delivery is more important.
      12. No variable should be fully contained within another variable.
      13. All variables should be at least 3 characters long.
      14. Use the right tool for the right job.
      15. Almost any tool can do the job.  Some are better than others.
      16. Benchmark often in order to learn what happens under the hood.
      17. Try something that's never been done.  It may be easier than you thought.
      18. Remember the patterns you've used before. You'll use them again.
      19. Keep it extremely simple at first.  Complexify as you go.
      20. Code every day.

<comment><USER4> Could you explain 12?

<comment><USER14> Sure.

If you have the variables TodayYYYY, TodayMM, and TodayDD in your program, then you cannot also have a variable named Today, because it's fully self- contained in another variable. Why? Because it screws up global find and/or replace in a simple text editor.

Lots of people have told me that this is unnecessary with a good IDE, and lots have given me lots of common examples of violations of this rule, but I still like the rule (guideline). I like my source code to be portable, easily reviewed by even the simplest tools, and I like the common tasks (reviewing every instance of a variable in a program) to be easy.

One of the hardest things I ever have to do when reviewing someone else's code is to identify every use of a variable to find a bug or understand something. Violation of this guideline is the biggest culprit. (And violent, painful death to anyone who writes a 1200 line function wrapped with "for(a=b;a<c;a++){...")

This is also why all variables must be 3 characters or more, or it would be very difficult to adhere to #12.

(FWIW, my list comes more from many iterations than from any theory or philosophy. We can debate these forever. I just like to do what works for me. Use what you like, ignore the rest.)

<comment><USER15> I can think of a lot of exceptions to this though: x,y,z,i,j,t,dt,dx,in,out... all standard, least-surprise variables. In any software that processes images you just know what x and y mean, more clearly than if they were called column and row. Same for t and dt in anything that involves physics simulation. And a function like _Vector add(Vector x, Vector y)_ really doesn't benefit from being called _Vector add(Vector firstvector, Vector secondvector)_ or such.

I think the divergence in opinions may simply come from working in different domains. In business software, I imagine the types of data may be a lot more varied than in DSP software and such, so a longer variable name may help keep track of things.

</comment></comment></comment></comment><comment><USER16> A program may never be truly finished, but often in practice you reach a stage where the bug count is low and there isn't much extra to be added - at least for certain types of application. This probably doesn't apply to things like operating system kernels, but does for more specific stuff like a datamatrix reader.

Also it is a good idea to avoid too much software architecting from the top down. I made this mistake early on, because "divide and conquer" was how the books said it should be done. Often a more bottom up approach works better, and is more adaptable to mid-project changes in requirements.

</comment><comment><USER17> Sound advice and well written, even if its old its a nice collection of thinks to think about. I wonder if "people" will start understanding #17 (No project is ever simple) some day.

<comment><USER6> It would sure make freelance work a little more pleasant. How many times have you heard _"This was supposed to be a 3 week project...that was a year ago"_? You'll probably never hear something like _"Well, we thought it was going to take 2 years and require a mainframe, but we banged it out in 6 months running on Postgresql."_

<comment><USER18> I have heard this though, from the designers of a system (about 4.4 years through a five-year research grant): "You're going to implement _how much_ of this in 6 months?" and after I told them, "Can't be done! Flat out impossible."

It took me 6 months and a couple days, working 40 hour weeks.

</comment></comment></comment><comment><USER19> Kinda surprised this doesn't include the Programming 101 - "Fix the first error your compiler is reporting".

I've seen lots of people, even experienced coders get overwhelmed when they make a change, screw up the syntax and see screens and screens full of errors show up.</comment>


Mormon Church has misled members on $100B tax-exempt investment fund - <AUTHOR> https://www.washingtonpost.com/investigations/mormon-church-has-misled-members-on-100-billion-tax-exempt-investment-fund-whistleblower-alleges/2019/12/16/e3619bd2-2004-11ea-86f3-3b5019d451db_story.html <comment><USER2> One thing that is a bit misleading in this article is the part that says members are asked to pay tithing even if they can't pay things like utilities and food.

Many members take great pride in paying their tithing first, no matter what. What this article left out was that no tithe paying member would ever be allowed to have their power shut off or not have food or other important necessities.

The church has and will provide food and even pay important bills for members if they need it. I have worked in bookkeeping at our local Ward and personally seen large checks for mortgage parents, electric bills, and even medical bills for needy members or members that were otherwise just going through a financial rough spot.

I should also add that this aid is not predicated on paying tithing or not. But local leadership does have to make decisions about whether the request for help is sincere and I would imagine being a faithful tithe paying member makes you more likely to receive help.

As for the rest of the article, I think there are definitely some transparency issues and maybe even some misleading statements from some leaders about how tithe money is used. But I don't think anyone was led to believe that the church is spending most of what is taken in.

The church has always had grand expansion plans. I would expect any organization with such plans to stockpile a war chest.

<comment><USER3> Based on the fact that they have a $100B tax-exempt warchest, the payout ratio of that social safety net is pretty low.

<comment><USER2> It's not even the same funds.

I was merely pointing out that it isn't true that poor members are lacking basic necessities while being pressured to pay tithing.

<comment><USER4> You're right, you aren't "forced" to pay, you're merely deprived of the right to participate in temple rituals that are central to the community and teachings if you don't.

And also have to tell your bishop, the most important and powerful member of your local community that you aren't going to pay in a private 1:1 meeting.

<comment><USER5> Even if you tell your Bishop, he's not gonna care. It's not his job. Yes, there are bad Bishops, but you can always move up the "chain of command" to your Stake President if the Bishop does something you don't like.

</comment></comment></comment></comment></comment><comment><USER6> One of the things I learned about LDS today from reading reddit threads on this was how much land the church owns not just in the US ( I believe they're the largest land owners in the US) but also abroad.

It's basically a real estate company operating tax free.

One article on their land ownership I found that details some of it. [https://www.theguardian.com/cities/2017/jan/30/from-book- to-...](https://www.theguardian.com/cities/2017/jan/30/from-book-to-boom-how- the-mormons-plan-a-city-for-500000-in-florida)

</comment><comment><USER7> Religious organizations should be held to general disclosure requirements for other organizations with charitable status.

</comment><comment><USER8> Perhaps it's a good idea to limit religious organizations to (monitored) operating costs and disallow them to become businesses?

I don't see this as a strike against religion but rather a return of religion to it's proper function: religion rather than business.

There are a lot of scams in religious organization and have been for some time. Removing some of the perverse incentives (i.e televangelists worth millions with private jets) may help with that and I don't think infringes on right to worship according to conscience in the least. As it sits now a lot of bad behavior gets a pass because "can't interfere with religion".

</comment><comment><USER9> Seems like if you make a hefty profit, you should be stripped of the 'non profit' status. Scientology is abhorrant in this reguard, as are most temples.

</comment><comment><USER10> Religion is just the business of selling people peace of mind. And the Mormon church shows how big of a business it is.</comment>


Gitlab considers not hiring SREs and Support Engineers in China and Russia - <AUTHOR> https://gitlab.com/gitlab-com/www-gitlab-com/issues/5555 <comment><USER3> I'm shocked (in a positive way) about the amount of transparency Gitlab provides.

Even as a reader, it almost feels as if someone misconfigured the ACLs or I'm reading leaked internal documents, not an intentional decision to make this open. Some of the discussions seem highly sensitive, and yet it seems to work for them.

Thank you, Gitlab, for being so open! I've learned a lot about compliance from just reading this thread. For anyone curious, here's some background on the mentioned boycott laws: [https://www.bis.doc.gov/index.php/enforcement/oac](https://www.bis.doc.gov/index.php/enforcement/oac)

<comment><USER4> Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.

<comment><USER5> Congratulations on taking a step in the right direction, even if it is a very small step. Nobody else seems to take the threat seriously, somewhat excepting defense contractors of course.

I can understand being reluctant to deal with the full extent of the problem. Somebody from China, with a family in China and subject to Chinese law, does not cease to be a security threat by moving to the USA and getting a green card. This gets awkward.

It really is no surprise that valuable secrets of all types (private key, customer data, trade secret, insider info for trading, etc.) end up in other countries.

<comment><USER6> I on the other hand think that splitting countries into allies and enemies is stupid. China is a huge country, and excluding a billion people from your company just because their government does questionable things sounds like a pretty bad idea.

If you are really concerned about the confidentiality of your data, don't store it unencrypted in some SaaS where every customer service rep has full access to all your data. At that point you're already so vulnerable that exluding potenential employees from a whole country is just pointless security theater that some suit with an MBA thought up to justify his position.

<comment><USER7> > China is a huge country, and excluding a billion people from your company > just because their government does questionable things sounds like a pretty > bad idea.

People have to do what the state they live in and belong to orders them to do. That's part of the point of having a state. So if you can't trust a state you can't trust its people either.

> you are really concerned about the confidentiality of your data, don't store > it unencrypted in some SaaS

I don't think dissolving the company is on the table.

<comment><USER8> > People have to do what the state they live in and belong to orders them to > do. That's part of the point of having a state. So if you can't trust a > state you can't trust its people either.

So, I could say that American is sucks if I think Trump is sucks?

That is ridiculous. The first is that 'state is unauthentic' is a subjective speculation. And the most funny is that the conclusion 'people is unauthentic' is came from your first thought.

I can not say American is terrorist if Hillary wanna burn other country. Am I right?

<comment><USER7> If your world view is based on separating entities into good and bad, nuanced statements will appear ridiculous.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> It's immoral to discriminate on the basis of fear, prejudice, and rumor.

One client can demand that Gitlab get rid of Chinese and Russian nationals today. Tomorrow, a different client can make similar demands - aimed at the nationals of different countries. This makes no sense whatsoever, and will blow out of control quickly.

Sanction programs are the established legal frameworks for such things: [https://www.treasury.gov/resource- center/sanctions/programs/...](https://www.treasury.gov/resource- center/sanctions/programs/pages/programs.aspx)

It's disappointing to see the promise of some money making the company go full 180 on its hiring and employment procedures - going as-far as potentially rescinding one employee's offer, and flagging another employee's personal choice to live in a different country as a risk.

The due process here is concerning. Some techbro starts by creating a "we need to block all Russian/Chinese" issue - followed by a bunch of echo-chamber "yessir" comments. When a legal advisor steps in - everyone tries to silence her and convince her it's just an "iterative process".

Finally - it actually looks like Gitlab's security practices are truly lacking. That an employee is Chinese/Russian shouldn't be a consideration - the systems should be tight enough to make sure absolutely no-one has access to customer data without consent - and that any actions taken are logged for auditing. Whenever necessary - pass your employees through a background-check. In sensitive (government) scenarios - restrict to employees with government clearance.

Honest question: Is Gitlab now a company not in a position to say "no"? Investors and potential customers need to know.

<comment><USER10> Companies don't make decisions based on morality.

This is a question of liability. Gitlab's liability, based on whatever internal metrics being measured, would be significantly higher than the potential economic rewards of having employees in sensitive positions in these two countries--at the moment.

Also, on a side note, morality != legality. They're two different things. What is moral isn't necessarily illegal, and vice versa.

There's no need to beat up the strawman "techbro." It seems to me that this was a difficult decision to make and somebody had to make it.

Damned if you do; damned if you don't.

<comment><USER9> > "Companies don't make decisions based on morality."

So let's just label every employee with a Foreign/Chinese/Russian background as a spy, because a client says so?

<comment><USER11> Why not? And Australians, they're _explicitly_ (by law) required to be spies.

And your comment suggests as much - why would opsec about consumer / sensitive data be important _unless_ you expect your employees to act in less-than-fair manner (be that for personal gain, a competitor's gain, a national gain, ...)?

<comment><USER9> > "Why not? And Australians, they're explicitly (by law) required to be > spies."

How come we don't see Gitlab re-considering hiring Australians then?

> "And your comment suggests as much - why would opsec about consumer / > sensitive data be important unless you expect your employees to act in less- > than-fair manner (be that for personal gain, a competitor's gain, a national > gain, ...)?"

The defense industry will put you through background checks, demand a security clearance, and won't hire you unless you're a citizen - whilst simultaneously employing some of the strictest security measures available today. Security will stay there long after you've stopped hiring Chinese and Russian individuals.

<comment><USER12> > How come we don't see Gitlab re-considering hiring Australians then?

I can't speak to GitLab specifically, but them restricting Australian hires too has been brought up numerous times in this HN thread. Given the amount of activity on here from their team members and specifically sytse, it would seem likely that they have at least been made aware.

</comment></comment></comment></comment></comment></comment><comment><USER13> I am Chinese living in China. Nationalism is on the rise lately in China, not just for domestic reasons, but also as an reaction to nationalistic moves from "the West" like this one. It's a recurring theme, not just in governmental propaganda, but also in daily conversations, that "the West" would talk about fairness and justice then commit blatant discrimination and double standards.

As a founder of a tech company based in China, I benefit from US companies blocking Chinese (and Russian) engineers; still I am saddened by this. I hope they could come up with more intelligent policies to protect their OPSEC.

<comment><USER14> Curious as the way I see it it's very often China who is the 'initiator', eg internment of Muslims, stealing of territory in South China sea, debt-trap diplomacy, and so forth. Presuming that you are aware of these occurrences, do you agree with your government's positions and actions, and - if not - <USER2> actions, if any, do you take to make it clear your opposition?

The Chinese government is, IMO, massively over sensitive to any outside commentary or criticism, eg: [https://www.abc.net.au/news/2019-10-31/china- warns-australia...](https://www.abc.net.au/news/2019-10-31/china-warns- australia-not-to-strain-relations-over-human-rights/11656922)

<comment><USER15> As a chinese, this kind of comment makes me hate the west even more. I have no control over my government. Zero. 0. Do you understand the concept of 0? Thats the amount of influence I have over any government matter. And you people being racist pos because there is nothing I can do about my gov. Wtf do you want?

<comment><USER16> I am sorry that you think like that, but the government is nothing without its people. The moment you start saying there is nothing you can do is the moment you lose. Russian dissidents etc. Chinese middle-class is complacently trading freedom for comfort. American and European middle-class too, for that matter.

<comment><USER17> I feel it is really unfair to blame chinese individuals like this, can we blame American's for all of their terrible influences they have had around the world too then?

<comment><USER18> There is a difference between blaming someone for the actions of a government over which they have little control, and suggesting that it's possible to work toward a better system. Nobody blamed the Civil Rights Movement for segregation; though they lived in a time when Jim Crow was law, they did all they could to defeat it.

I'd also suggest there's a difference between acceptance of bad government action, even if you don't or can't actively oppose it, and active defense of such action.

</comment></comment></comment></comment></comment></comment><comment><USER19> Ok, that discussion made it clearer for me, and I am kind of behind @cciresi at that point:

[https://gitlab.com/gitlab-com/www-gitlab- com/issues/5555#not...](https://gitlab.com/gitlab-com/www-gitlab- com/issues/5555#note_237336244)

They have a customer that required the personal data they'll give to Gitlab not be handled by people living in Russia and China. Could be a group doing humanitarian or journalistic work.

That's actually an interesting conundrum: you want to hire a company, need to trust it for handling sensitive material, and can't afford it to fall between specific states' hands.

I don't think there is an objective process to do that. I know that USA and France and probably many other countries have laws to authorize seizure of data they consider linked to a variety of vaguely labeled activities (from "trouble to public order" to "terrorism"). You may end up excluding 80% of the world if you use objective criterion there.

<comment><USER20> >Could be a group doing humanitarian or journalistic work

They speak about revenue, so I'm sure that's not the case. I bet it's a commercial company with sensitive data, probably gov/mil contractor with strict obligations to their customer.

And someone at their management doesn't understand Intelligence 101: they don't reach for your data from the country of origin.

<comment><USER21> If I understood it correctly, this should be a nationality block, not country- of-residence.

<comment><USER20> This would be even more ridiculous.

<comment><USER21> Why is it ridiculous? The espionage laws in question apply to individuals / nationality, and are explicitly aimed at persons living abroad.

</comment></comment></comment></comment></comment><comment><USER22> The title seems misleading, the article specifically states this does not effect any current employees, presumably as they have none in China and Russia.

> As such we feel a country block is the most humane solution at this time-- > especially because it affects zero current employees

<comment><USER4> Correct, this block would be for two functions (Site Reliability Engineer and Support) and we currently have no people in that role in China and Russia.

Please note that we're still discussing this change. We work out in the open so you can see us working on it. I hope that people appreciate the difference between that and what you would see in a non-transparent company (probably nothing, they would just not open up a vacancy in the offices in that country).

<comment><USER23> Would you consider extending this to other roles? If you remember the Juniper VPN backdoor was so well done it would have likely (or did) passed code review, putting most software engineering in to scope.

Additionally would this extend to individuals who are of Chinese or Russian origin? China in particular leans on nationals who are on visas or have family still in country to conduct espionage operations.

<comment><USER4> It would be strange to not accept code from certain countries since we are an open core company that gets contributions from around the world. There are other ways to prevent supply chain attacks. A difference with data is that there are always multiple people involved before code is merged while data can be extracted by a single individual who has access.

Discriminating on origin is likely illegal.

<comment><USER23> > A difference with data is that there are always multiple people involved > before code is merged while data can be extracted by a single individual who > has access.

It sounds like you just need to harden your production perimeter. Jump boxes with two-man-rule access and terminal logging. Apply the same practices to data as you do code.

> Discriminating on origin is likely illegal.

You should ask your legal folks about the national security exceptions of Title VII. It sounds like your customer requirements are pushing you in that direction anyway.

</comment></comment></comment></comment></comment><comment><USER24> Probably an idea to throw Australia on that list -

[https://www.zdnet.com/article/whats-actually-in- australias-e...](https://www.zdnet.com/article/whats-actually-in-australias- encryption-laws-everything-you-need-to-know/)

<comment><USER25> I'm surprised we (Australia) aren't already on more of these lists.

After having this discussion with my manager and colleagues (the conversation with my manager was in my interview process where I bluntly stated if I was asked to comply with anything from this law, I'd immediately resign, my manager also agreed). Everyone I've spoken to agreed we'd immediately resign since it was the only potential option to protect our selves as employees and our employers.

Edit: I'll need to spend a little more time looking into the Assistance and Access Laws. The following article attempts to downplay some of these concerns:

[https://www.homeaffairs.gov.au/about-us/our- portfolios/natio...](https://www.homeaffairs.gov.au/about-us/our- portfolios/national-security/lawful-access-telecommunications/myths- assistance-access-act)

<comment><USER26> Since National Security Letters exist, blocking all employees from the US would also be logical. Same for running anything on third-party hardware.

There needs to be a more effective response than Hari Kiri.

<comment><USER27> That's Hara kiri. If you're going to appropriate an antiquated foreign word out of context I wish you'd at least spell it properly.

<comment><USER28> (1) it's a non-antiquated English word, etymologically linked to the antiquated foreign word (it entered English a long time ago.)

(2) In English, both hari kari and hara kiri are accepted spellings (the word came into English before modern, maybe even standardized, transliteration, and the source language doesn't natively use the Latin alphabet.)

(3) But, in any case, you are right that it is misspelled.

</comment></comment></comment></comment></comment><comment><USER29> Personally for me, coming into a company that was so transparent was very difficult at first, especially as an attorney. However, over time I realized how much I developed and grew from it. I became much more open and accepting of criticism and feedback. Instead of becoming defensive, I listened to it and learned from it. I also welcomed all of the extra eyes on my work, it helped me create much better work product, just as the open source community does with open source code. When you are transparent, people know what you are doing and that you are genuinely putting the efforts in to do your best. You never know what is going on with others behind closed doors.

</comment><comment><USER30> If I was a Chinese or a Russian engineer working for Gitlab, I'd consider quitting right now regardless of how this discussion ends. I am surprised that this initiative is not just considered by them, but basically approved by some of the senior staff:

> In e-group on Monday October 15, 2019 we took the decision to enable a "job > family country-of-residence block" for team members who have access to > customer data.

I don't think there's a need to explain what's wrong with this idea, there are a lot of sane comments on this thread explaining this just okay.

On a side note, I really like how company transparency saves them from making wrong decisions final. I think that this initiative will be dropped just like the recent third-party tracking issue, and I wish more companies were as transparent as this one.

<comment><USER31> >> If I was a Chinese or a Russian engineer working for Gitlab, I'd consider quitting right now regardless of how this discussion ends.

This is partially the goal of such moves and will accelerate the rise of discrimination. Thus, one should not quit despite the situation.

<comment><USER30> So you'd suggest staying and fighting against this inside the company? If they truly love the company and it deserves this, you might be right.

edit: what bothers me is that at least by some senior staff members these employees are already considered second-class citizens as otherwise this initiative wouldn't even be discussed, and I wonder how comfortable it will be to continue working with these people now.

<comment><USER31> by staying you fight it already, better be passive - not being insane is already a lot

<comment><USER30> I have to disagree. Passively staying does not change anything; the fact that they work for this company has not prevented this initiative.

<comment><USER31> When a wast majority thinks in a way against you, fighting them you will inevitably make mistakes and be triggered to do dumb stuff. Crowd think can make people believe that Chinese and Russians are some sort of zombies. If you stay around and show that you are not a zombie to be eliminated, this is already a lot. I know how it sounds, but don't underestimate crowd dynamics.

</comment></comment></comment></comment></comment></comment><comment><USER32> I wrote another comment arguing that this proposal was both racist and discriminatory, which got flagged and deleted without explanation, presumably because I worded it in such a way as to give an example that might resonate more with Americans by using examples of specific groups of people that have experienced oppression in the US. In the interests of quality discussion on HN, I'm going to make another attempt but in a way which is hopefully less likely to be misinterpreted.

There are employment laws which prevent companies from discriminating against people based on factors such as race, sexual orientation, religion, physical appearance, age, marital status, and other things over which they either have no control or which are not relevant to their job. These laws are in place for good reason and most people (myself included) support them.

It is my belief that a company policy prohibiting the hiring of people based on any of the above attributes would be wrong, and probably illegal (depending on the jurisdiction).

The question then comes down to whether refusing to hire someone based on either their nationality or the country in which they live (in the case of a remote company) is wrong in the same sense as the above factors. My argument is yes. The fact that someone lives in China or Russia does not, by itself, make them an untrustworthy person, any more than someone living in the United States, Germany, Japan, or the UK.

At the request of several customers, GitLab is proposing a policy which discriminates against people based on their naionality/country of residence, which I would argue is almost (if not equally) as bad as discrimination based on the other factors I've mentioned, and should be opposed for the same reasons as a policy which prohibited hires who were of a particular race or sexual orientation.

If anyone wants to flag this comment, you are of course free to do so. But I would much prefer, and I think we could all benefit from, a coherent discussion of the flaws in my argument.

<comment><USER33> The fact that you're in one of these countries makes you easy to access by enemies on the global scale. Assuming the individuals are good, that doesn't mean they're not a security risk. The reality is, countries like Russia and China do not respect intellectual property, and are know to perform cyber espionage and attacks. This seems very reasonable to me.

Furthermore, the whole point of anti-discrimination laws are to prevent judgement based off traits that cannot be changed. Where you live is not the same thing as your skin color. Imagine if someone refused to change their password and only used 6 characters for it. It's a security protocol to force a change there. I'm viewing thing more similar to that than similar to racial discrimination, given that gitlab is not saying they won't hire Russians widely.

<comment><USER34> It's much more easy to just buy some data than torture somebody. Or you think engineers from US, UK or any other country can't be bought? :)

<comment><USER33> I agree with that, but I was thinking more along the lines of bugging your home, tracing your internet traffic through ISPs, etc.

</comment></comment></comment></comment><comment><USER35> The title here really should say "considers" \- the discussion seems to be ongoing - and it looks like legal is advising strongly against it.

</comment><comment><USER36> It's hard when you have people in your circle of trust who are subject to coercive law enforcement. My heart goes out to victims of such apparatus.

It isn't even as simple as worrying that foreign national employees can be coerced by their home nation police or state security services — anyone subject to policies like Gitlab's who is local to your business but who has family or assets abroad that can be used to effect duress, or who can be blackmailed in some way elsewhere, would need to be vetted.

</comment><comment><USER37> Do they already block Australia, because of the backdoor laws passed a while back?

<comment><USER38> I suspect this is driven more by surveillance or sabotage risks posed by employee access rather than jurisdictional risks.

Australian law is likely to have little impact on what an SRE or support engineer might be able to do. Australia having an established practice of recruiting and placing enterprise surveillance moles would.

China and Russia have some history with this latter. Though one might say similarly of the US and Israel, as two examples.

<comment><USER39> Alright, I also thought about Israel and AU at first but this thing is so political that no way can they include US allies in there because gov wouldn't approve this sort of thing.

To my eye, american companies are becoming more and more like chinese companies in the amount of control governments can extort on them and that is highly troublesome.

<comment><USER40> I know of a couple major us companies that do include Israel along with other usual suspects but they don't spray about it on the internet. There's also growing concern regarding what corporate equipment you can take across us border so there's that.

</comment></comment></comment></comment><comment><USER41> While I acknowledge the pragmatic approach taken by the company to protect their user's data, I am curious as to how this will play out over time. Factors such as longer term travel or working vacations to these countries by their employees?

Or, What about if one of their employees is married (or wants to get married) to a legal resident of one of these countries? How far removed does the employee have to be from this risk? And how much of an impact on their (and their family's) civil liberties could this have?

<comment><USER42> I've been told (at a different company based in a different country) "don't bring your work laptop to China, don't bring materials to China without authorization, we'll provide what is effectively a burner device for whatever you are bringing to China (I believe they re-used them as different employees went to China)".

I imagine Gitlab would have a similar but less restrictive policy, "don't bring a work laptop <with credentials that gives you access to one of these roles> to China, ...".

I don't see why a policy against residing/working in China would care about who you are married to or where they live.

<comment><USER41> Consider this scenario: Loyal and long time high performing Gitlab employee Bob, is happily married to Su, who originally hails from China. They live and work in the US. All good.

Until Su's ageing parents back home succumb to ill health and she decides that the family need to move back to China to care for them for maybe one or two years - perhaps longer.

Bob then has to make the choice between (a) resigning his job or (b) being forced into a long distance relationship with lots of travel between China and the US, or (c) divorcing his wife.

When company policy gets in the way of important life decisions, I think it is a dangerous line to walk.

<comment><USER42> Consider the exact same scenario at any non-remote company.

If Bob wants to move to China, where the company doesn't have an office, he's going to have to resign or take a leave of absence.

This decision on Gitlab's part would be moving their incredibly generous "you can work from anywhere you want except places where we legally can't let you like Crimea and Iran" to a nearly as generous "you can work from anywhere you want except places where we legally can't let you like Crimea and Iran, and places that are known to coerce people into spying for them like China and Russia".

Most companies operate on a whitelist of places where you can work (where they have offices), not a blacklist. Even many remote companies operate on a whitelist (e.g. "Remote, US only"). Really, I'm amazed they feel that they can operate on a black list approach at all and not accidentally violate tons of local laws.

<comment><USER43> I may be reading into things here but it sounds a lot like the reason for this is to gain business from the US Government. Limiting reach from governments such as China and Russia is already standard practice for most security/defense related functions of the government.

<comment><USER44> Yes, and didn't they also just have a fairly abrupt about-face in terms of doing business with ethically-questionable customers?

MSFT just recently won a 10B cloud deal from the DoD, perhaps the purse is still open there?

</comment></comment></comment></comment></comment></comment><comment><USER45> > "It seems odd that we proclaim that we will accept any customer not > prohibited by law (b5a35716) but we are implementing controls that impact > employees based on a perceived political climate. This is contradictory."

Second this

<comment><USER46> Accepting any customer serves the customers interest.

According to customer requests that their sensitive information not be placed in a situation where it could be relatively easily accessed by state actors ... serves the customers interest.

That's not contradictory, except in the most superficial sense of "but we have open arms for everyone".

<comment><USER47> Nothing stops state actor to access sensitive information through backdooring cleared engineer's system.

</comment></comment></comment><comment><USER31> I love to see how propaganda works. The top comment even congratulates gitlab.

</comment><comment><USER19> I don't understand what I am reading, I feel I am missing some context... Is it about being afraid the Chinese and Russian state will spy on user data if some employees are located in those countries? Or were there updates to their laws that made it mandatory to open databases to the state if an employee is located in these countries?

<comment><USER48> It's actually in the discussion:

> There is an unacceptably high risk that these nations may apply pressure to > individuals living within their borders with sensitive data access (based > their role at GitLab). It is our concern. And it is the stated concerns of > several customers.

The discussion is actually pretty significant, as they sort out how they might manage the _customer demand_ that is creating these hiring blocks, and in turn, how that is reported and tracked.

I don't see this as a purely "done deal", it's a company having very important discussions in the open that most would just default to "restricted". All this transparency is a great source for others to learn from.

<comment><USER19> After activating JS I could see the discussion, sorry.

Going a bit deeper, it seems to be a specific demand by a potential client. Can make sense for activists, journalists, humanitarians. Makes sense for gitlab to push back too though.

<comment><USER49> Why does it make sense for Gitlab to push back on a reasonable request from customers?

</comment></comment></comment></comment><comment><USER50> So. As a freelancer living in one of the scary red states and seeing a lot of US people and companies in the potential client crowd, should I now start looking for opportunities more in Asia, South America and Africa? Is the Gitlab client's sentiment spreading among Western companies?

</comment><comment><USER51> Reading the discussion, it appears this policy was due to a customer request, and not some legal requirement.

I wonder how the HN crowd feels about that? There was a lot of talk recently about how companies should not sacrifice their values and kowtow to the demands of large clients.

As a company that values freedom of movement and is remote first, this prevents their employees from moving to where they want. Does this also mean they can't vacation there either?

<comment><USER52> > Does this also mean they can't vacation there either?

No, the post is fairly explicit about what the proposed block is.

While I agree with the position that companies should avoid trading ethics for short-term profit, this is a move I hesitate to condemn - the cost is fairly minimal (their remote-first position is still quite generous), and there is much to be said for the increase in privacy and security this provides their customers.

</comment></comment><comment><USER53> I'm surprised Australia does not appear on this list.

</comment><comment><USER54> This is just ridiculous. It is truly unfair to discriminate people based on the country of their birth. It's not like they had a choice.

Am I the only one who thinks that both China and Russia have spies who are not native Chinese or Russians? And are people really naive to believe that a stupid decision like this would prevent China or Russia from trying to obtain the information they need (if they really want it)

<comment><USER55> You might have misread the issue at hand, this is not discriminating on country of birth, but country of residence. You can choose not to continue living in the above mentioned countries, and this would no longer be a problem it seems.

<comment><USER54> Ultimately it affects the developers who are born in China and Russia as well. Not everyone can afford migrating to a "white listed" country due to various reasons like family, friends and other commitments.

<comment><USER56> How is that different from any other job? Unless they support remote work, which most don't, is it not discrimination for a job to only consider people who are willing to move to city X or country Y?

</comment></comment></comment></comment><comment><USER57> > Eric Johnson @edjdev · 5 days ago > Owner

> @cciresi I appreciate your position. Please be aware there is an active, > time-sensitive contract negotiation linked to this matter. And you need to > advocate to the DRI that the company walk away from that contract in order > to enact your proposal.

[https://gitlab.com/gitlab-com/www-gitlab- com/issues/5555#not...](https://gitlab.com/gitlab-com/www-gitlab- com/issues/5555#note_237506130)

Well now, _that 's_ interesting.

</comment><comment><AUTHOR> See [https://gitlab.com/gitlab-com/www-gitlab- com/merge_requests/...](https://gitlab.com/gitlab-com/www-gitlab- com/merge_requests/32606) for more discussions. Here's one from sytses (CEO/co-founder)

> @cciresi this is a request from a customer considering using GitLab.com. > @mmcb has more context on the why. We should probably add that to the MR.

Probably the US government or something like that?

<comment><USER58> >Probably the US government or something like that?

The requirement to block some class of people off from some customers is nothing new, and back at Sun there was separate Sun Federal which was dedicated for such clean business.

GitLab's approach (and i think it is just a start of the trend in the industry, time to get rid of the accent :) while theatrically good isn't practically efficient. A Chinese or Russian residing here with some family back at the Motherland is susceptible to the same pressure in the loving, yet firm hands of the Motherland as if s/he were residing there her-/himself. So the next absolutely logical and necessary step for GitLab on this path is to block all Russians and Chinese who has at least some family back there. Giving that there may be other ties too and the hassle to verify (to which degree of relationship?), simply blocking all those nationals would the natural and practically efficient way.

<comment><USER59> It seems obvious to me that the kind of pressure to which you are referring is not limited to family. It would be easy enough to threaten a high school boyfriend. Or the family of your child's former best friend. Or a former co- worker. Or any friend. Or even a complete stranger.

Extortion can be effective well outside family lines.

And, of course, extortion is equally effective on USians, Brits, Indians, Nigerians, or anybody else.

</comment></comment></comment><comment><USER60> I've never heard of Russian government using their state powers to take advantage of some developer and break into foreign network. That seems like strange and unethical move. I, personally, won't ever use Gitlab after that move.

<comment><USER61> [https://www.dw.com/en/russian-intelligence-used-blackmail- to...](https://www.dw.com/en/russian-intelligence-used-blackmail-to-try- hacking-uk-visa-system/a-46335303)

<comment><USER60> Thanks, that's scary. May be I'm wrong.

</comment></comment></comment><comment><USER62> Interestingly, Ukraine was also on the list initially, but then was removed. Is it a coincidence, that Gitlab co-founder, Dmitry Zaporozhets, is from Ukraine?

</comment><comment><USER63> The real "threat" is more and more people, companies, and institutions caving in to pressure to take more explicit national-boundary stances.

</comment><comment><USER64> Doesn't this directly imply non-US entities should have severe reservations about American SREs and Support Engineers?

<comment><USER23> That is just whataboutism. China has a long demonstrated history of using its intelligence services for the benefit of domestic corporations, as well as exploiting its citizens working overseas to aid in the same.

</comment></comment><comment><USER65> >I'm shocked (in a positive way) about the amount of transparency Gitlab provides.

Same here. I was pretty surprised they sent an apologise email few days ago

Saying sorry after actions you made, show how they care about their users

</comment><comment><USER66> Well, that's a "goodbye gitlab" for me.

<comment><USER67> Alternatives to gitlab:

[https://gogs.io/](https://gogs.io/)

[https://gitea.io/en-us/](https://gitea.io/en-us/)

[https://www.atlassian.com/software/bitbucket/download](https://www.atlassian.com/software/bitbucket/download)

[https://gitbucket.github.io/](https://gitbucket.github.io/)

[https://kallithea-scm.org/](https://kallithea-scm.org/)

<comment><USER68> [https://sourcehut.org/](https://sourcehut.org/)

[https://nest.pijul.com/](https://nest.pijul.com/)

</comment></comment></comment><comment><USER47> What if large chinese customer to demand that none of US SRE engineers have access to their data? What if China to ban GitLab?

You gotta lower your ideals of freedom if you wanna suck on the warm teat of China. (c)

</comment><comment><USER69> Could someone "in the know" elaborate on what specifically prompted them to contemplate this? e.g. They mention concerns from enterprise customers.

I commend the transparency of debating it in the open, but I suspect it'll get hard to maintain reasonable discourse once the issue hits mainstream headlines and becomes sensationalized.

The suggestion does feel like a giant cudgel. I get there are genuine concerns, and I don't have better ideas to offer. I can't help feeling bad for legitimate future job applicants who will feel discriminated against. I'm sure if a bad actor wants to do something adversarial, they'll find ways around it (like agents in a non-banned country).

It used to feel like attitudes of major world powers were slowly converging (Russia got some democrazy, China started to open up its economy, tolerance seemed to be growing). Now it scares me how fast they're diverging. Politics is seeping deeper into tech, and it's going to get more fervent. Curtailing trade is loosening the ties between disparate cultures ([https://www.cato.org/publications/commentary/peace-earth- fre...](https://www.cato.org/publications/commentary/peace-earth-free-trade- men)).

The internet was supposed to connect us all and help bring us closer together. What happened?

</comment><comment><USER70> I don't mind this, as long as they would offer a relocation from the country in question. I would even volunteer! It's not my fault I was born in this shithole.

</comment><comment><USER71> It sounds like there is nobody that this affects, and nobody it is likely to affect. They just want an official policy in place to reassure their customers.

<comment><USER49> It apparently impacts one new hire.

</comment></comment><comment><USER39> The discussion on Gitlab is completely out of control now. Gitlab should never have opened that can of worms. Geopolitics and all, first started talking about limiting nationals of China and Russia to do certain jobs and now so many have conflated this to ethnicity, political views, hacking and anything in between.

</comment><comment><USER72> One would this the best solution for this would be a Federated structure that would ensure a Chinese Systems administrator could only deal with whatever resources assigned (China maybe) and a US administrator can only work with whatever resources are assigned (U.S customers??). Therefore you can have the separation of data but please everyone.

I am not saying it would be simple to iron out, but it would allow for distrusting customers to all play together without worrying about data compromise.

Just a thought, i read all the comments and they are about politics and such and very few are about a technical solution to work for all.

One can argue only letting a Chinese Administrator work on a subset is again a geopolitical thing, but that point should be moot if other administrators are restricted as well.

</comment><comment><USER73> Gitlab can restrict SRE selection for concerned clients and change their process to make sure every SRE doesn't have access to every client. I'm sure some Chinese companies wouldn't be happy to have American SREs access their data either and I can think about dozens other countries with political issues against each other.

But off topic, I'm wondering how many companies have similar policies that nobody knows just because they don't have "open-source" policy.

Sadly recruitment process is polluted with many hidden policies and while we appreciate and expect honesty and transparency from applicants, the recruiters themselves aren't anything close to honest and transparent.

</comment><comment><USER74> IMO this is not really about hiring, the hiring aspect is just a temporary workaround for a broader policy/technical challenge.

Namely, how to maintain your overall organization and software-stack while internally isolating data-flows and rules which are unique to different jurisdictions.

Even if today it's some potential client expressing general concern, tomorrow it might be something you can't simply ignore, like an EU privacy law that must be complied with to avoid dropping a bunch of customers. (Or a demand by Elbonian officials for an account that lets their secret police snoop on Elbonian business, but hopefully that one would be resisted.)

</comment><comment><USER75> This is where it is important to get back to first principles, and making distinctions based on nationality is less helpful than making distinctions based on rules-oriented-organisations vs. people-oriented organisations. The primary distinguishing characteristic which we need to pay attention to is rule-of-law and the power-predominance of rules-oriented-organizations across the political and economic system. This is something which should in principle be apolitical and possible to evaluate empirically.

</comment><comment><USER76> Gitlab is investing hard on looking good in the press, but forgetting to fix their critical bugs. Their CI/CD feature is useless due to the bugs that are never fixed as they are not prioritized. One example is this 1-year old critical bug in CI/CD:

[https://gitlab.com/gitlab-org/gitlab- runner/issues/4119](https://gitlab.com/gitlab-org/gitlab-runner/issues/4119) (Gitlab CI/CD jobs finishing _midway_ with Success)

</comment><comment><USER77> Deleting everything I have on gitlab and leaving this racist platform

<comment><USER78> So, give any quote from the link or elsewhere that in any way shows the reasoning for this consideration is based on how much they don't like Chinese people or how inferior they are as a race. People keep throwing around the racist label even when it's absolutely clear that it's not about race. It's about the Chinese and Russian governments and how they operate. These are legitimate informational/operational security concerns that can't be waved away with "well, it's racist to protect ourselves, so we just won't".

<comment><USER77> >It's about the Chinese and Russian governments and how they operate

Have you ever thought that Russian government consists of Russian people? Same with Chinese

<comment><USER78> Yes, so? Nobody is concerned about the Chinese because they're Chinese. Unless the CCP adopts principles like freedom of speech or other values that are foundational to Western countries, the CCP is forever going to be at odds with us. As long as they oppress their population and minorities and expand their influence on neighboring countries in undemocratic ways, and seek to extend that influence to the West, there's a conflict. And the conflict isn't race. It's values. This tolerating undemocratic behavior because it might be intolerant only allows authoritarian regimes like the CCP to continue their spread.

It's hilarious and depressing to see people using their freedom of speech to defend China, a place that suppresses any and all criticism in absurdly draconian ways.

</comment></comment></comment></comment><comment><USER79> I'm a little surprised this isn't illegal, and it really should be. It's irrelevant whether or not this actually would work, it's in principle immoral.

</comment><comment><USER80> (Poor English warning...)

As a Chinese I'm actually very disappointed at Gitlab. I think anyone wouldn't be happy if one's country is banned from the company. And I also think some people just worry too much about people in China. Actually, ordinary people in China are not so oppressed by the government. And ordinary developers from China is just as ones in America. Few of them will steal data from the company.

</comment><comment><USER81> This is reported in Gittalk (a high impact platform for Chinese IT workers). I admire the transparency. The issue can't be solved by a company alone. Practically there might be workaround but it's up to the employer..

Which clause of which act, or which executive order specifically prevent Gitlab from recruiting non-enemy state person?

<comment><USER81> This leads to discussion of using Chinese alternative other than Gitlab/GIthub, and the expansion would lead to more employment by Chinese code repository providers...

Everyone get what they want, in long term?

</comment></comment><comment><USER82> Today they have requested GitLab to enforce employment policy and GitLab started to implement it.

Tomorrow they will ask GitLab to inject backdoors and GitLab will implement that as well?

It is probably happening in other US tech companies at this time affecting those who want to get lucrative DoD and government contracts.

</comment><comment><USER83> /s

"Gitlab considers" is the new "British scientist" news headline.

</comment><comment><USER84> How big of a customer one needs to be to request some other country citizens to be banned from working as SRE? How much do we need to pay to ban Israelis for example?

</comment><comment><USER85> Am I missing something? Why does said customer just self host the open source software and purchase support. 90% of the sensitive issues will be solved

</comment><comment><USER86> If you want to be serious about it, you probably have to temporarily revoke access privileges for anyone in that job role who is traveling there too.

<comment><USER87> You can never be sure, that the guy didn't sell his soul to intelligence agency and some government official during his visit. Better completely terminate the account and fire the employee if (s)he happened to travel there.

/sarcasm (just in case)

</comment></comment><comment><USER88> First they came for the Russians, and I did not speak out — Because I was not a Russian.

Then they came for the Chinese, and I did not speak out— Because I was not a Chinese.

...

</comment><comment><USER89> Well, the answer to that is simple. #boycottgitlab

I am working at a European company where the amount of Russian engineers is constantly increasing (similar thing happens in many of the bigger companies nearby). And they prove to be quite ok.

So since today I will speak strongly against use of Gitlab in my workplace should such a talk begin.

<comment><USER90> I think you are confusing them having something against Russia(gov) with Russians(people). They also clearly state that current employees will not be affected. Reading the motivation behind it and the possible dangers it would pose to their clients. I think it's very reasonable not to continue having sensitive data be available in Rus & Chi.

What would you do in this case?

<comment><USER67> Gitlabs actions affect Russians(people) and not Russia(gov).

Their motivation, should they apply it to UK, US, Spain and France, should lead them to forbid having employees from those countries as well.

As a Swede, I would not like my gitlab sensitive data to be in the hands of US gov.

If you really believe national security agencies do not apply pressure to any tech employees just because they are X citizens of their X country - you need to mature a little bit more, perhaps read Snowdens book and look into what happened with Wikileaks.

<comment><USER91> Maybe Russian people should do something about their government then. Alas, it enjoys massive support.

<comment><USER92> Be careful.

This way you may end up justifying terrorist attacks against American citizens coming as a retribution for the foreign policy and military adventures of the democratically elected American government.

<comment><USER91> WAT?

<comment><USER92> What exactly did you fail to understand?

</comment></comment></comment></comment></comment></comment></comment><comment><USER93> Dumb customers are dumb customers, but the bigger question is how bad is Gitlab's backend architecture that this is a concern at all?

<comment><USER94> Why are you assuming that their backend architecture is bad when these positions touch sensitive data much more frequently than a software engineering position in companies globally?

In order to effectively support customers, you need to make a decision into how much visibility you'll give customers. Alternatively, you give your support the even more unfortunate circumstance of needing to request sensitive data.

SREs need to be able to work with hardware and software and by virtue of needing to take decisive action are in a similar situation.

</comment></comment><comment><USER95> So Gitlab will reject Tourist or Petr because they are Russian nationals (if they felt like working for Gitlab), I guess?

</comment><comment><USER96> I thought fairly standard industry practice prohibits prod access ACLs to engineers inside China or Russia.

</comment><comment><USER97> Well done. Bravo. No irony. Really well done. Thank you for showing the way.

</comment><comment><USER98> I consider not using Gitlab.

</comment><comment><USER34> I live in Spain but was born in Russia, I moved 3 years ago because I hate current russian government and still I hope russian and chinese companies and engineers will boycott Gitlab in response. Such offensive nationalism should not be forgiven.

<comment><USER99> You moved from a openly repressive country to another secretly repressive country. Congratulations ;) Hope you have the possibility to freely move around Europe, as you'll probably will need to use it in the future

</comment></comment><comment><USER100> actually if you read the comments, the internet in general wasn't super supportive.

kinda crazy, how different audiences get very different reactions.

</comment><comment><USER101> what if a customer came in requesting not having women engineers accessing their data? I wonder if gitlab would consider that

</comment><comment><USER102> This is one strange company.

Imagine if governments worked like this? Holy hell. This is what Assange should have aimed for instead of getting involved in geopolitical intrigue.

<comment><USER103> Audrey Tang Minister without Portfolio in the government of the Republic of China (aka Taiwan) advocated this type of radical transparency in government.

<comment><USER102> Radical transparency will change everything.

</comment></comment></comment><comment><USER104> It is a completely necessary action.

The National Intelligence Law of China, passed in 2017, demands that all its citizens "support, assist and comply with works on national intelligence", aka proactively collect intelligence for the regime. (Article 7)

(《国家情报法》第七条 任何组织和公民都应当依法支持、协助和配合国家情报工作,保守所知悉的国家情报工作秘密。 )

This also explains why Huawei devices SHALL be excluded from core communication networks of the free world.

Additionly, unless Jingping 11th go off from his power, the nation should simply be considered another Soviet Union, or even worse, the Nazi.

</comment><comment><USER105> In my opinion, GitHub should have blocked all Chinese IP addresses on the day the CCP decided to try to firewall it.

</comment><comment><USER106> Well, technically you should then block people from these countries irrespective of where they reside. They have extended families back in their home countries, so the spooks can still lean on them quite heavily, and there's nothing they'll be able to do.

This is why I refused to obtain a DoD security clearance when my job needed me to: I go to Russia to visit my family every 2-3 years, and I don't want to be in any way valuable to their intelligence services or the like, nor do I want to put myself or my family in danger.

All of the above is in spite of me having spent most of my life in the US by now.

IMO a better solution is for nobody to have permanent access, and granting it on as-needed basis, with a full audit trail. It's not perfect, but it's a heck of a lot better than the ineffectual geography-based blocking that you are implementing.

</comment><comment><USER107> Ever since the China attack in 2010 when Google pulled out of China, Google has prohibited access to user data from employees in China. They gave since expanded to a more general geographic blocking system.

I assume Gitlab lacks the sophistication to do this split of user data access vs other business operations.

Gitlab runs an open source company, so I don't understand why they are so concerned about China and Russia. Is it for anonymous/confidential customers?

</comment><comment><USER105> This is a great move by Gitlab. I'd love to see more companies going in a similar direction.

<comment><USER87> Yep. It also would be nice to provide a form where clients would be able to select race, sex, age, sexual orientation, religion and other employee parameters as they wish to build a real dream team.

<comment><USER105> Just a simple checkbox for "lives in a data-hoovering authoritarian regime" would be enough!

<comment><USER99> Basically all services in the US + Europe (and Russia, and China, and more) disappears with that inclusion.

</comment></comment></comment></comment><comment><USER108> I think one of the reasons should be that Gitlab does not have many enterprise customers in China and Russia. Native Chinese or Russian speakers are not needed for Support.

<comment><USER109> Russians and Chinese could not care less but gitlab. They have progressed so much in the last years, they have their own gitlab systems. Demonizing Russia and China for bad practices and not doing any introspection on yourself is hypocritical. US suppremacy is over. Get on with it

</comment></comment><comment><USER110> I understand the basic issues involved here. Both countries are doing very odd things when it comes to information and privacy. However, I feel like making this a "country issue" is really not exactly the right horse to ride on. Rather, I think it should be stated due to the security policies of these governments, we are banning them as information safeholds at this time or something of the sort. Then, the issue is LESS the country, and more the governmental informational policies.

<comment><USER78> But the problem isn't storing information in these countries in this case. It's how these are known to coerce nationals with ties to the homeland into spying for them.

</comment></comment><comment><USER39> @edjdev wrote There is an unacceptably high risk that these nations may apply pressure to individuals living within their borders with sensitive data access (based their role at GitLab).

Given the current australian law changes, the rampant israelian IT spy sector and despotic Belarus position on human rights, it's surprising that they only mention China and Russia. This whole debacle doesn't look good and makes one to loose all faith in Gitlab.

<comment><USER111> Debacle? The week hasn't even started yet. Let's take a moment to breathe.

China and Russia are known to put pressure or watch/listen on nationals who work in key positions in foreign companies.

As US allys Australia, Israel don't pose the same threat. A lot of information that could be gained would be available through the US government and shared with the those parties if there was a need.

<comment><USER112> That is a load of cow manure aka confirmation bias. Israel has no compunction spying on the US.

[https://en.m.wikipedia.org/wiki/Jonathan_Pollard](https://en.m.wikipedia.org/wiki/Jonathan_Pollard)

[https://www.google.com/amp/s/amp.theguardian.com/world/2019/...](https://www.google.com/amp/s/amp.theguardian.com/world/2019/sep/12/israel- planted-spying-devices-near-white-house-says-report)

There are definitely Chinese and Russian spies but there are spies from many countries besides those. The question is why are you singling out those countries and why now.

The reason is that there is a Cold War brewing between the US and China and this company has become an agent of that war.

The seems to be a propaganda war against China brewing in the US. I last saw this level of jingoism when Bush Jr decided to take over Iraq on the pretense of Saddam Hussein supposedly having nuclear weapons. All the TV network anchors were pushing for war and pushing the supposed threat. Later we find out it was all lies.

<comment><USER111> Spying is happening between all nations and the leaked cables showed this.

Why those two countries specifically? In Russia you can get imprisoned for a variety of political/strategic reasons if you refuse to cooperate. China implemented there own internet for spying.

When you visit these countries you are advised to buy new devices and throw them out on return to avoid backdoors.

General Powell misleading the UN and TV networks was based on having chemical weapons. Nuclear weapons is the fear with Iran. It was believed because the UN weapon inspector Hans Blix was being railroaded with fake traffic jams and other tactics preventing him from investigating. After he pulled out and Sadam had a history of using these types of weapons on his own people, it made the claim easier to accept without more proof.

<comment><USER113> Direct imprisonment in Russia isn't the reason for this topic, Federal Security Service had succesfully got their cooperation proposal accepted in most of the cases due to the unlimited number of ways they could coerce their target.</comment></comment></comment></comment></comment>


Flash. Must. Die - <AUTHOR> http://www.wired.com/2015/07/adobe-flash-player-die/

<comment><USER2> Quite ironic though, that the article got published on a site that still uses Flash.

<comment><USER3> Personally I thought the grey rectangles ("click to play" mostly eliminated my need for ad blockers) emphasized the point.

</comment></comment><comment><USER4> It's all well and good the current sentiment, however the last hold outs are legacy sites that have long been put into maintenance updates only and large sites that take years to change, like BBC News.

Firefox's change doesn't have the weight behind it. If Chrome followed suite it would be a different story.

</comment><comment><USER5> Truely</comment>


New YouTube layout is crippling to small-scale YouTubers & the overall UX - <AUTHOR> http://antonpug.com/2012/12/the-new-youtube-layout-crippling-user-experience/

<comment><USER2> I completely agree with this article. The new layout is absolutely not useful. There isn't even an easyway to get to the new videos put out by other people. It works OK for managing my subscriptions but finding new content and people just doesn't work with this layout. With the last few changes youtube has gotten increasingly unusable and my amount of time spent on the site has gone down atleast 90%. If others follow that trend then that can't be good for youtube

<comment><AUTHOR> I used to log on and get addicted to watching things that came up in suggested channels/videos, now I don't really learn about any new channels unless I go about deliberately searching for them. Bummer.</comment></comment>