We're shutting down ArcticStartup - please help my team find work - <AUTHOR> http://www.arcticstartup.com/2012/11/01/its-a-magical-world-out-there-hobbes-ol-buddy-lets-go-exploring

<comment><AUTHOR> I'm the guy running the company, or the guy who used to run it. It's been an awesome ride and a great learning experience. Most importantly though, I think we've been able to positively affect the Northern European startup scene in a sustainable way.

The hardest part of all this is to let go of my fantastic team. If you have part time, or full time work for them - please get in touch with them through the contact details in the post.

Hacker News community - you've been instrumental in spreading our news as well.

Thank you everyone.

<comment><USER2> I think it would be helpful if you updated the page to say what languages Dmitri speaks.

<comment><USER3> Hi,

The languages that I speak are: Russian (Fluent), English (Fluent), Estonian (Fluent), Swedish (Basic, Conversational).

In addition I can understand on a basic level a number of slavic and nordic languages.

Dmitri Sarle

<comment><USER4> Dmitri - this is mere serendipity as this fell into my inbox today - it is probably not useful, but it is a rare skill set wanted: (I have no idea why a recruiter think I am fluent in Russian)

I am afraid I know nothing about the role or the recruiter but it may be possible to remote.

<snip> Your details have been returned in a search for a Russian / Ukrainian speaking Senior Project Manager I am currently recruiting for a company in the Midlands please see link below for details of the role

Lee Brook Principal Consultant Follow me on: LinkedIn | Twitter

Modis 33 Queen Street, London, EC4R 1BR DD: +44 (0)207 038 6470 T: +44 (0)207 038 6400 F: +44 (0)207 038 6401 www.modis.co.uk </snip>

</comment></comment></comment></comment><comment><USER5> We might as well turn this into constructive dialog - does anyone have any thoughts on how to monetize niche online media? Our events went well, but didn't scale.

<comment><USER6> There are a few online media companies that are doing really well without organizing events. Copyblogger did really well by partnering with others to develop products that the community could benefit from.

Thats the route you have to take. Partner with others to develop products. You bring the audience. They bring the products that help the audience. Something similar to what EarlyToRise.com did - created a panel of experts each of whom bought their own product to the table. (<http://www.earlytorise.com/meet-the- experts/> )

<comment><USER3> Yeah, good point. The other thought that we had was to help the audience connect through some form of matchmaking. The e-commerce angle was also evaluated, to create a market for start-ups to promote and sell their products. This could also include a market for discounted startup event tickets and offers.

We have some other thoughts as well, but need to value and compare all the currently available options.

</comment></comment></comment><comment><USER7> As an aside, I think this is the best "We're shutting down" writeup I've seen. No complaining about how hard things were, no plaintive pointing of fingers trying to politely (or not) place blame, just a straightforward statement of facts followed by a well worded request to try to take care of your team.

Kudos for that, and best wishes to all involved.

</comment><comment><USER8> Wait, so what went wrong? Were you losing money? Have you peaked at an unacceptable level?

</comment><comment><USER9> It's a sad development. ArcticStartup has been material in keeping tabs on the startup-scene in northern Europe.

</comment><comment><USER10> ArcticStartup has been one of the shining stars of European startup journalism. Lack of English language coverage is something that afflicts many European startup communities, and I'm sure ArcticStartup has been pivotal in raising the international profile (to both investors and customers) of many of the startups they've covered.

I hope they manage to keep it going and retain the quality of their coverage.

</comment><comment><USER11> This is sad news! Arctic Startup developed immensely in the quality and depth of reporting in the last two years (props to both Antti and Greg on this). Granted it was impossible to keep up a deluge of posts, hastily slapped together or semi-sensationalist like some other European tech media do, but at least weekly, there was a pearl of writing to be discovered at AS. Hope that continues as a community-driven effort.

</comment><comment><USER12> Antii - we sell data on emerging private companies and their investors/acquirers. If you have any structured data about financing events/exits, would love to discuss (email in profile).

We are at www.cbinsights.com

Unrelated: Our team have been big fans of what you guys have been doing for a while. Class act btw on this shut down notice.

</comment><comment><USER13> Stay hungry, Stay foolish! Best of luck guys

</comment><comment><USER14> Antti and co, I was shocked to hear this. You have become almost an institution for the region and it's hard to imagine world without Arctic Startup. Huge congratulations to all of you for the awesome work you have done for Nordic and Baltic startup scene.

</comment><comment><USER15> Is there a similar site covering the UK and or western europe ?

<comment><USER16> These are the sites I tend to read:

France: <http://www.rudebaguette.com/>

Germany: <http://venturevillage.eu/> and <http://siliconallee.com/>

Eastern Europe: <http://goaleurope.com/>

Europe in general: <http://blogs.wsj.com/tech-europe/> \+ <http://thenextweb.com/eu/> \+ <http://gigaom.com/europe/>

My guess is that sooner or later there will be some publication, in English, covering startups in southern Europe (Italy, Spain, etc).

</comment></comment><comment><USER17> Ask HN: Who Is Hiring? (November 2012)

<http://news.ycombinator.com/item?id=4727241>

</comment><comment><USER18> Class act all the way; I hope everyone lands safely.

</comment><comment><USER19> Bad times, sorry to hear the news guys. I'd love to know more about why you've decided to take this path if you can share?

</comment><comment><USER20> The guys from TNW should definitely hire your team. They're doing a great job covering startups out of the U.S.

</comment><comment><USER21> Oh, that sucks. We seriously need good blogs to cover european startups.</comment>


Paxos in 25 Lines - <AUTHOR> http://nil.csail.mit.edu/6.824/2015/notes/paxos-code.html <comment><USER2> This is missing what to me is the most important part of the algorithm: a quorum of acceptors must propagate writes to the learners. With just what's shown here, you're not tolerant to network partitions that cause a subset of the "accept" messages to be lost.

That process can of course be optimized in a number of ways that drastically cut down on the network overhead as compared to the naive MxN write pattern, but what's written here is not safe on its own.

<comment><USER3> Mostly unrelated, but a fun fact about quorums that I enjoy noting whenever I can because it still seems under-explored: A quorum != a majority. Currently most (all?) production implementations I've seen of RAFT and the various Paxoses use "majority" as the quorum algorithm, so the two get mostly conflated.

In my layman understanding: Given a set, a quorum is some method to choosing a sub set, such that any two such sub sets will always have at least one overlapping member.

Majority is one quorum algorithm - given a set [A,B,C], the majorities are: [A,B,C], [A,B], [A,C] and [B,C]. Any two of those sets will have at least one member overlapping.

However, majority is somewhat wasteful, because the latency of these quorum- based algorithms are almost always bound by the slowest member of the quorum - the more machines you need to wait for, the more likely one of them will be outlier-slow.

You'd potentially be better off choosing a quorum algorithm that requires less than a majority - because that'd mean, in the best case, fewer responses to wait for, lowering the probability that one of those members will be very slow. There are drawbacks to this - it makes fault tolerance and provisioning harder to calculate - but it's got some cool potential benefits.

Some cool ones to explore here: [https://pdfs.semanticscholar.org/a243/7f18205414f6398b29c4f8...](https://pdfs.semanticscholar.org/a243/7f18205414f6398b29c4f86d59d76f27a200.pdf)

<comment><USER4> I would argue that by the time you've chosen Paxos or some other majority quorum commit protocol, you're already well aware that you're building a CP system, and that availability and latency aren't your main concern. A majority quorum is basically the most obvious (and somewhat brute force) way of providing serializable consistency in the system.

The one non-majority quorum commit protocol that most people are probably already familiar with is the "sloppy quorum" replication in Dynamo systems[1] (e.g. Cassandra, Riak, Voldemort, etc.). Basically, since the quorum is configurable on a per-cluster basis instead of being inherent to the protocol, and usually isn't a majority of the cluster, the system can still make progress when half of the nodes are unreachable. (But of course, as the paper notes, this means that you need to resolve conflicts some other way, which adds a whole bunch of complexity.)

1: [http://www.allthingsdistributed.com/files/amazon-dynamo- sosp...](http://www.allthingsdistributed.com/files/amazon-dynamo-sosp2007.pdf)

<comment><USER5> > you're already well aware that you're building a CP system, and that > availability and latency aren't your main concern

Assuming you've chosen correctly between CP and AP approaches, this tells us that availability and latency aren't as important as consistency. But there's nothing that says they aren't arbitrarily close...

<comment><USER4> Yeah, definitely -- I agree that the decision doesn't mean to just to blindly throw away availability optimizations once you've decided that consistency is important.

Actually, invoking CAP probably didn't add to my message. What I meant to say is that people don't talk about non-majority quorum commits that much because the interesting part is that the serializability comes with majority/ _overlapping_ quorums.

<comment><USER5> As I read it, the comment you were replying to was still restricting its discussion to overlapping quorums, and merely pointing out that that's not actually synonymous with majority.

<comment><USER4> Fair enough :) I guess my mind latched onto the "it still seems under- explored" part and wanted to try and respond to that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> I realize this is pseudocode, but I still feel like the bigger challenge is not in implementing a theoretically correct Paxos, but a production-ready one. It's probably pretty well-known the Chubby[1] team's experiences dealing with unexpected complexity from using Paxos in production.

A choice quote: "While Paxos can be described with a page of pseudo-code, our complete implementation contains several thousand lines of C++ code."

1: [https://static.googleusercontent.com/media/research.google.c...](https://static.googleusercontent.com/media/research.google.com/en//archive/paxos_made_live.pdf)

<comment><USER6> When I hear about these algorithms taking many thousands of lines of code in a "low-level" language like C or C++, I wonder how much of that could be simplified away if you didn't need to manually manage memory. Performance aside, how much of those "several thousand lines" would be unnecessary in a higher-level language?

I implemented Raft in a couple hundred lines of succinct JavaScript a few years ago. I can only imagine someone smarter than me could write a production-ready Paxos implementation in less than a thousand well-commented lines of JavaScript or Python.

<comment><USER4> > I implemented Raft in a couple hundred lines of succinct JavaScript

But is it production-ready? :)

None of the extra complications described in the paper were inherent to C/C++. It covered things like leader leases, log compaction, handling disk corruption, and group membership changes -- optimizations that weren't intrinsic to Paxos itself, but still crucial for running it in production.

Another choice quote from the paper: "There are significant gaps between the description of the Paxos algorithm and the needs of a real-world system. In order to build a real-world system, an expert needs to use numerous ideas scattered in the literature and make several relatively small protocol extensions."

Also, a random data point: etcd's Raft implementation stands at about 4000 lines of Go right now, not including tests.

<comment><USER6> > But is it production-ready? :)

Production-ready enough for my use case ;)

I also didn't mention Go in my post because--despite having managed memory-- it's syntactically very long. Not a complaint, but all of the Go code I've seen and written tends to be "taller and skinnier" (less dense?) than the code I've seen and written in other languages like Scala or Python.

</comment></comment></comment></comment><comment><USER7> [https://en.wikipedia.org/wiki/Paxos_(computer_science)](https://en.wikipedia.org/wiki/Paxos_\(computer_science\))

</comment><comment><USER8>
        1	proposer(v):
        2    while not decided:
        2	    choose n, unique and higher than any n seen so far

26 lines.

It's pseudocode, so not really only 26 lines as it needs some more supporting functions to "choose n, unique and..." and other stuff to make setting variable states atomic.

Good way to explain the algo though.

<comment><USER9> Number of lines is the most ridiculous metric anyway. Most languages have no line length limit, just replace all newlines with semicolons, and you have a one line program!

<comment><USER10> > Most languages have no line length limit

Some languages do?

<comment><USER11> ("Free-format") Fortran has a max line length of 132 chars, up from ("fixed- format") 72 chars on punch cards.

</comment></comment></comment></comment><comment><USER12> Curiously, Paxos takes exactly as many lines as a self contained interpreter for a pure functional programming language, written in C :-)

[http://www.ioccc.org/2012/tromp/tromp.c](http://www.ioccc.org/2012/tromp/tromp.c)

[http://www.ioccc.org/2012/tromp/hint.html](http://www.ioccc.org/2012/tromp/hint.html)

</comment><comment><USER13> For me this shows the difference between theoretical setting and what you would want to do in practice. I have been following 6.824 (where this is sourced from), to learn something about distributed systems programming and it was great fun to shed a lot of figurative sweat to convert those 26 (actually) lines into working "production" code. Hundreds lines of code, because in real- life we have packet loss, network partitions, etc. But the pseudo-code in the link itself is correct, however, it doesn't tell the whole story.

Now I am repeating that experience, as Akka project contributor ( [http://akka.io/news/2017/03/17/akka-2.5.0-RC1-released.html](http://akka.io/news/2017/03/17/akka-2.5.0-RC1-released.html) ) on getting delta-CRDTs into Akka. And again - what was a few lines of pseudo-code in the original paper, or even tens of lines of real code but in some ideal setting ( [https://github.com/CBaquero/delta-enabled- crdts](https://github.com/CBaquero/delta-enabled-crdts) ) is becoming literally thousands lines of "production grade" code.

Finally - I wholeheartedly recommend the 6.824 course to anyone interested in distributed systems. Even if you don't like strong consistency, you'll learn a lot about testing and debugging distributed systems, the knowledge you can re- use later in your career.

</comment><comment><USER14> Here's a version I wrote in C++ for ScalienDB about 5-6 years ago, this startup has since folded so it's dead code:

[https://github.com/scalien/scaliendb/tree/master/src/Framewo...](https://github.com/scalien/scaliendb/tree/master/src/Framework/Replication)

Paxos: for replicating data

PaxosLease: for negotiating a lease, eg. leader

Quorum: pluggable "majority" rules, not that important

ReplicatedLog: use Paxos for each append, initiated by leader

<comment><USER15> Pretty nice code.

</comment></comment><comment><USER16> everyone, please, read the following blog post before using any 'wow!'s in your next exclamation:

RAFT Explained – Part 1/3: Introduction to the Consensus Problem [http://container-solutions.com/raft-explained-part-1-the- con...](http://container-solutions.com/raft-explained-part-1-the-consenus- problem/)

"While Paxos can be described with a page of pseudo-code, our complete implementation contains several thousand lines of C++ code."

</comment><comment><USER17> I miss numbed code, cba scrolling up to a line and doing: end, return, space space, delete, enter, mouse, space space, end.

just type 8.5: code here

(float to insert between lines)

also no nesting.

then run a processor like go-fmt that checks the format for you.

and use the directory structure for class and methods, directory is a class, and a filename is a method.

</comment><comment><USER18> Or if you're interested in the opposite of pseudocode, here's a TLA+ spec for Paxos.

Related to yesterday's TLA+ video post [https://news.ycombinator.com/item?id=13918648](https://news.ycombinator.com/item?id=13918648)

<comment><USER19> You forgot to include a link to the spec

<comment><USER18> Ugh, so I did. Here's the link: [https://github.com/bringhurst/tlaplus/blob/master/examples/P...](https://github.com/bringhurst/tlaplus/blob/master/examples/Paxos/MCPaxos.tla)

</comment></comment></comment><comment><USER20> Interesting! This should be renamed to Paxos Pseudo-code in 25 lines.

</comment><comment><USER21> Can someone explain Paxos to layman. What is it even supposed to do?

</comment><comment><USER22> This is what I mean when I tend to say that all scientific papers should have a minimal reproducable working sample with instructions attached. Lets say I am interested in dam building with turbines and all its glory: One would assume that this is really complex cross cutting tech, but I still firmly believe that if you cant show me how to build a tiny sample dam that powers my mobile phone or my computer, you havent done your part to make your theory sufficiently reproduceable.

</comment><comment><USER23> Here's one in 1 line:

run_paxos()

<comment><USER24> Very succinctly put, regardless if it is a function call or a builtin statement :)

I have used something similar to defuse endless arguments about which language is more expressive, or better, and turn it into a more productive discourse. I simply make a tentative assertion that there is a perfect language for every problem, one where only one line of code is needed to solve the problem, it reads as follows: doit

Then I follow up with stating that the language is probably rather useless for anything else.

I don't know why it usually works to open up the discussion, it seems to me as such a trivial and obvious observation, but apparently the perspective is something many rarely come to observe without prompting.

I'm well aware that 'doit' can't really be considered to be a language, except in a very limited sense, it can also simply be a function call, which maybe helps to bring into focus the intersection between language, libraries and their relative applicability to the task that needs solving, and the environment it must be solved in.

Trivial, obvious but somehow deeply at the heart of writing the correct code to solve a particular problem, because everything is a tradeoff somewhere between extremes.</comment></comment>


Git from the inside out - <AUTHOR> https://maryrosecook.com/blog/post/git-from-the-inside-out <comment><USER2> I read somewhere about a person wanting to understand git, so they made .git itself into a repo and watched what changed as they used git normally. Thought that was pretty clever.

</comment><comment><USER3> Looks like this blog post was adapted from a video presentation by the author: [https://youtu.be/fCtZWGhQBvo](https://youtu.be/fCtZWGhQBvo)</comment>


Encrypted messaging coming to Microsoft's Office 365 next year - <AUTHOR> http://news.cnet.com/8301-10805_3-57613422-75/encrypted-messaging-coming-to-microsofts-office-365-next-year/?part=rss&subj=news&tag=title <comment><USER2> But is it end to end encryption?</comment>


Abstracting Ambiguity - <AUTHOR> http://blog.woobling.org/2009/08/abstracting-ambiguity.html <comment><USER2> I did some work on amb last semester in grad school, and my prof wants me to publish it. I didn't feel motivated to write a paper, though, because I couldn't see the point of amb. This article makes the value of amb clear, though: abstracting out control flow, specifically backtracking. Code no longer needs to "know" that it's doing a backtracking search.</comment>


The Rio Games Were an Unjustifiable Human Disaster, and So Are the Olympics - <AUTHOR> https://sports.vice.com/en_us/article/the-rio-games-were-an-unjustifiable-human-disaster-and-so-are-the-olympics <comment><USER2> but a profitable one. they just did the games under a close-to-dictatorial state and nobody on the international media cared the slightest. just business as usual.</comment>


I had to build a web scraper to buy groceries - lord-bazooka https://utkuufuk.com/2020/03/28/grocery-scraping/ <comment><AUTHOR> Of all the grocery companies in my area, only Walmart has it right: Choose an available pick up time, _then_ start online shopping.

All the others let you fill your cart, then at checkout tell you there are no slots available until the end of time. Waste of time, energy, and hope. F U, Target, Safeway, Albertsons, and Kroger.

<comment><USER2> Walmart is also tied for my top spot for in-person shopping during this. Walmart gets that spot because of their mobile app which does a pretty good job of telling me what is in stock at my local store.

My other top choice is a small (three store) chain in Western Washington called Central Market [1]. (If the name seems familiar, it may be from season 10 of "Top Chef" which was set in Seattle. Top Chef normally sends the contestants to Whole Foods for most shopping, but this was before there were any Whole Foods in the Seattle Area. They used the Shoreline Central Market instead).

They don't have a mobile app or online way to check stock that I know, but they seem to be doing the most of any grocery store I've seen to deal with the virus when it comes to in-store shopping.

1\. They've got separate cart return and cart pickup areas in front of the store. Every cart returned gets disinfected before being put into the pickup.

2\. They have installed plexiglass shields in the checkout lanes between you and the cashier.

3\. They have prominent marks on the floor for you to stand at while inline that provide good spacing.

4\. After each customer checks out, they disinfect the conveyor belt area and the credit card terminal area.

They are also nowhere near as crowded as Walmart, and the people that shop there seem to be paying more attention to social distancing.

[1] [https://central-market.com/](https://central-market.com/)

<comment><USER3> New Seasons Markets in Oregon and Washington are doing all these steps as well.

<comment><USER4> Our Whole Foods is also limiting the total amount of people in the store, so you have to wait in a line for people to leave before you can enter

</comment></comment></comment></comment><comment><USER5> Why is grocery delivery considered a 'safer' option than going to the store yourself. I actually prefer to do it myself. I'd rather be the one to lay hands on all my own products.

Why would you trust an unknown group of people to take all the proper precautions? Who picked the item by hand? Who is this bringing it to your door? Are you _sure_ they washed hands? Did they accidentally sneeze on anything? Is the vehicle sanitary? Also, I would imagine people doing these jobs are probably at higher risk of being exposed, just by nature of traveling & being in public all the time.

I would rather trust my own skills to be responsible and protect myself, rather than other unknown entities to touch all my stuff. All the supermarkets I've been to have someone at the door sanitizing carts as the hand them too you. I am hyper aware of avoiding touch anything unnecessary. I can keep as much distance from people as I want. I know my hands are clean when I start, and then avoid touching my face until I sanitize after.

<comment><USER6> The primary mode of transmission is through droplets from coughing and sneezing. Minimizing the amount of time you spend around other people is by far the most effective way to avoid getting the virus. If you put away the delivered items, wash your hands, and then don't return to the kitchen for a few hours, then it doesn't matter if the delivery person infected your items. The virus can't last all that long outside the human body.

However, from a public health perspective you should only use delivery services if you're in an at-risk group. Otherwise you're just transferring your risk onto another person and also doubling the number of people who could be infected by this trip to the store (assuming you live alone).

<comment><USER7> I've seen many reports of the virus lasting many days on plastic/hard surfaces. I imagine that's under lab conditions but still worth being aware of.

</comment></comment></comment><comment><USER8> Young healthy people shouldn't be doing this, the slots should go to the ill and elderly, people who are in immediate danger from catching the illness.

<comment><USER9> 38% of the people hospitalized with COVID-19 are between 20 and 54. [1] Everyone can catch the illness, everyone can wind up in the hospital, and depending on the state of the local hospitals, everyone is in immediate danger.

[1] [https://www.msn.com/en-ca/health/medical/close- to-40percent-...](https://www.msn.com/en-ca/health/medical/close-to-40percent- of-hospitalized-covid-19-patients-in-the-us-are-aged-20-to-54-report/ar- BB11r1LN)

<comment><USER10> That 38% figure is not relevent in this context, because it does not control for the demographics of the population in general. 45% of admisions are over 65, despite the fact that >65 makes up only 16% of the total population [0].

Further, according the the underlying report, of the 22-44 year olds admitted to the hospital, only 2-4% went to the ICU. The 75–84 bracket had 11%–31% admitance to the ICU.

Of the deaths reported, 80% were over 65, while the other 20% was 20–64.

Yes, this virus _can_ kill anyone, but statiscally speeking, it is far more likely to kill you when you are old. If there is a limited supply of a protective messure, we should prioritize giving it to the far more vulnerable.

[0] [https://en.wikipedia.org/wiki/Demographics_of_the_United_Sta...](https://en.wikipedia.org/wiki/Demographics_of_the_United_States#Structure)

<comment><USER11> So you get to decide that risking death for a 70 year old is worse than risking permanent lung damage for a 30 year old?

</comment></comment></comment></comment><comment><USER12> It seems like a lot of demand issues highlighted by the pandemic could be solved by queues. Instead of saying "there are no slots available", put the user in the queue. Process the queue in order. The improvement in wait time and demand accuracy would be a win for both consumers and the business.

<comment><USER13> Web queues are ineffective as shown by sneaker bots. You'd need actual ID style authentication of accounts. If you're talking about order queues than people will stuff the queue and cancel their orders or just have more hoarding if their multiple deliveries get processed. If it's FIFO same technical advantages will apply: bots can click much faster than humans ever will. I think the issue is more human nature and things moving to the web creating inequality between the technically adept and non-adept.

<comment><USER14> >Web queues are ineffective as shown by sneaker bots. You'd need actual ID style authentication of accounts.

...and that's rendered ineffective by SaaS bot companies that take your account logins and payment details and places the orders on your behalf, for a fee of course[1]. The economically efficient solution would be to auction off the slots, so at least the grocer is reaping the profit rather than some third party. It also has the benefit of capitalizing the grocer so they can hire more people and/or buy more equipment so there are more slots in total. Also, if it bothers you that some FAANG programmer can afford deliveries than some old granny, this can be alleviated by reserving a certain % of the slots to "needy" people (eg. old, disabled, sick, immunocompromised) subject to validation.

[1] kinda like [https://en.wikipedia.org/wiki/Domain_drop_catching](https://en.wikipedia.org/wiki/Domain_drop_catching)

<comment><USER15> This assumes it's easy to resell a slot, which may not be correct (eg if you have to put in your delivery address when entering the queue). Tickets are a very different commodity.

<comment><USER14> >This assumes it's easy to resell a slot

That's not what I'm saying. Rather than buying a slot (or an account) from the bot operator, you'd give the bot operator your order and address/account/payment info, so when the slots become available, the bot operator can place an order on your behalf.

<comment><USER16> Isn't that just what amazon should already be doing?

They need an option for people who are flexible with their delivery times, put in your order and they assign you a delivery slot when one opens up.

If a bot can do that, then amazon can just do it themselves and actually improve the user's experience.

How many people are working from home right now that don't can _when_ groceries get delivered other than "the next available slot"

</comment></comment></comment></comment></comment></comment><comment><USER17> I had to do the same thing to get an Amazon Fresh order. Well, not quite the same thing, I ended up writing an Selenium project that automated the Amazon Fresh checkout process till it got to a delivery window page that didn't complain there were no slots available.

If I can't get groceries, it's not the end of the world for me, since I can call on family if necessary, but I'd rather not make their stressful life any worse right now, since I'm not the only one in my family's circle that needs help.

There are no great answers, since I might have taken a slot from someone that can't write a web tool to scrape Amazon, and doesn't have a family to fall back on. It sucks on many levels.

<comment><USER18> Anytime I try to automate/scrape Amazon I get captcha'ed after a 1-2 attempts. Anything special you're doing with selenium?

</comment></comment><comment><USER19> Amazon Fresh (until a few days ago) was releasing slots 3 days out each night at midnight, so I've been saying up to place orders. Now it seems incremental throughout the day, but I've gotten lucky and nicked a spot. However, they don't have everything I need even normally. Now, it's even worse, so I have to order from multiple places. The local Mart's that deliver are still opening their slots at midnight, though usually for 8 days out, and again items ordered often go out of stock before delivery. It feels like a sureal video game.

<comment><USER20> Still better then Wal-Mart's site where everything is in-store pick up, and Target's site where everything is out but you can't tell until you click into the item and try to put it into a basket. My only gripe with Amazon is that it's too hard to distinguish between them and their third party sellers, and it's a pain to deal with the sellers. I also wish there was a button to report price gouging - I was looking for some emergen-c packs to flavor my water, normally it's cheaper then cool-aid and less hassle to mix, some fool is charging $109 for a box of thirty packets.

<comment><USER19> Yeah, emergen-c is either sold out or price gouged, a pattern seen across most vitamin-c products. But take a look at this-- it's a powdered form that can be mixed. Water works, but OJ might taste better. And the price per dose is very good: [https://www.amazon.com/Ascorbic-Antioxidant-Smoothie- Pharmac...](https://www.amazon.com/Ascorbic-Antioxidant-Smoothie- Pharmaceutical-Friendly/dp/B01HFOJBG2) As of this comment at least, it's in stock, about $28, there are other brands available too (search vitamin c powder) and it's at least as price-efficient per dose as normal pills/chewables.

Also, if you have Amazon Fresh, Amazon's Whole Foods, or Amazon Pantry (just opened again) available in your area, 3rd party price gougers aren't really an issue.

</comment></comment></comment><comment><USER21> >> everybody stays at home and especially avoids crowded indoor places like supermarkets.

I know I shouldn't do that, my doctor has advised me against it, but I have a headache today and this made it worse and I can't help myself so: this is an oxymoron. If everybody is staying at home, then supermarkets cannot be crowded. If supermarkets are crowded, then everybody is not staying at home. Both things can't be happening at once.

<comment><USER22> Everybody stays at home except for essential shopping in supermarkets. Not every statement is meant to be taken 100% literally, but I'm guessing you knew that and are being pointlessly pedantic.

<comment><USER21> You mean you're guessing I'm a pointless pedant? Thank you for your contribution to my Sunday headache.

</comment></comment></comment><comment><USER23> Shameless but very relevant plug: Monitoring a website for changes and sending data somewhere else is exactly what we do at [https://monitoro.xyz](https://monitoro.xyz)

It's the difference between maintaining a bunch of scripts and making sure they don't stop working abruptly, and having the data you wanted without headaches.

It also wouldn't make for such an elaborate article, but that's the cost of simplicity if you just want to get things done.

</comment><comment><USER24> We recently ran into this problem at Cooklist in the US. We ended up setting up the ability for our users to place orders up to 3 days out.

Our system then books their pickup order at midnight when the new pickup slots are opened. We are seeing that most pickup slots are filled for the next day by 9am.

It is interesting that the stores don't allow booking several days in advance anymore. It makes sense though because even with booking for the next day we are seeing that 25% to 50% of the order is substituted due to out of stocks.

</comment><comment><USER25> I've done the same thing in The Netherlands, as I'm doing the shopping for my grandparents. I noticed that I don't need it yet, but I did see that I might need it in the future since I need to stay awake until 23:59 at night, so I can snatch a slot at 00:00 at the most famous supermarket here.

My script isn't fully ready, but it's 75% complete and I'll complete the final 25% when I really do need it.

Also, these things are quite easy to make, so I expect a lot of techies to eventually do this.

</comment><comment><USER26> Few months ago someone had posted open source scraper that got 1k+ votes (or maybe not) - it was used by NYTimes for realtime alerts.

Someone remind me please.

<comment><USER27> You're talking about Huginn, right?

[https://news.ycombinator.com/item?id=21772610](https://news.ycombinator.com/item?id=21772610)

<comment><USER28> To clarify, Huginn is a framework/app server for scrapers and doing rest calls etc based on them

</comment></comment></comment><comment><USER29> Tips: the first session cookie is probably returned if you do a GET on the homepage of the website, so you can simplify your script by

Declaring the requests session, doing get on the homepage and then doing get on the endpoint

It will also prevent issue with session expiration

<comment><USER30> Hey do you have any suggested readings on how to better understand these structures and your reasoning?

</comment></comment><comment><USER31> I've done a few of those scrapers and mail to notify projects in the past, but I've recently switched from using email to a telegram bot, it's pretty great. Very easy to implement and doesn't spam your inbox.

</comment><comment><USER32> I must say, from the title I was expecting to be disappointed - but this is a very nice and clear example of a useful little hack combining python requests module and a little web page introspection.

I think maybe I'd have gone down to every 5 minutes, to be a little nicer to the end-point (especially when sharing the code) - otoh once a minute isn't to much of a hammer, I guess.

</comment><comment><USER33> I had a similar idea on Saturday and wrote a puppeteer based script which monitors Tesco.com and then pushes a screenshot to my phone if it finds a slot: [https://github.com/paulmaunders/delivery-slot- bot](https://github.com/paulmaunders/delivery-slot-bot)

<comment><USER34> hey - just tested your code - works great. I am no coder, but have installed and it runs fine. Quick question 1) Its now only checking for Group-1 which is 1hr fixed. Would like to include Group-4 which is the flexible slot. 2) Not just send notification - book the earliest one available.

How to do this?

</comment></comment><comment><USER35> The supermarket is a post WWII invention. Labour was expensive, so why not have the customer walk around and pick. Typically before WWII shop clerks handed items to waiting customers across the counter.

As any invention it can be reinvented.

Organic farmers started doing deliveries 20 years ago, to compete with the big warehouse boxes.

</comment><comment><USER36> Would be simpler to just plan four days in advance. Shopping used to be done once a week, or even once a month for bulk and frozen goods. Now it seems to a be what people do instead of going for a walk in the countryside. Makes even less sense now that you don't have to leave your bed to do it.

<comment><USER37> Maybe there are local dynamics at play (we are in a city in The Netherlands). But my wife has been doing the grocery shopping (since I don't have a driver's license). We would normally shop every day, but she is now going every 3-4 days. And after the initial 3-4 days of hoarding, the grocery stores are far less busy, probably because people are buying for multiple days at a time. She has had no problem keeping the necessary 1.5-2m distance.

</comment></comment><comment><USER38> Greasemonkey seems a much better weapon.

<comment><USER39> how?

</comment></comment><comment><USER40> The picture with his cookies contains the suspicious keys "hphone" and "hmail", which likely show md5 sums of his phone number and mail respectively.

Especially the phone one can easily be brute-forced (small search space). I wonder why they hash this in the first place?

I hope they're salted...

</comment><comment><USER41> Everyone should be ordering online regardless of age or increased risk. Limiting contact with individuals is the only way to stop the spread of this disease. The answer is that the surge in demand for delivery should quickly be filled on the supply side by delivery companies. The increase in business should go to providing hazard pay, PPE, and benefits for the supplying workers. This limits the number of people in contact with others while supplying jobs for those who have been unemployed during this time while increasing pay and benefits for those workers due to their increased risk vs reward. This is how capitalism is supposed to work in theory at least, to quickly adjust to market needs.

</comment><comment><USER42> I literally build the same thing here in the UK. I knew I couldn't have been the only one lol.

Good job.

</comment><comment><USER43> The best part of "blood in the streets" is old school hacker news posts like this. Kpi of creative progress to come!

</comment><comment><USER44> next, booking your grocery pickup as a service /s

</comment><comment><USER45> I couldnt find an appointment slot with safeway this past week. Ended up writing a quick script on lunch that did the trick. Ran it as a schedule task to run every 5 mins. Pretty hacky and unpolished but worked, got a text message a day later and checked out. Not sure if anyone could use it but here it is. [https://github.com/christru/safeway-delivery- check](https://github.com/christru/safeway-delivery-check)

</comment><comment><USER46> I've just been going to the grocery store as usual and it works great. You show up in the morning and there's no line yet and shelfs are full. Later in the day they meter entry so you can keep distance inside.

Don't be that ass who makes others do your shopping just coz you're too afraid to.

<comment><USER47> In store: you need to have someone stock the shelves, someone walk through the store and pick groceries, and someone handle the payment in person. Chance of infection: depends how long since someone coughed in the store.

Online: you need someone to stock the orders and wait for people to drive up for curbside pickup. Chance of infection: low.

Surely the second option is both safer and more efficient?

<comment> squeaky-clean Probably different regions but none of my grocery stores do online like that. They have someone walk the aisles and shop like a regular shopper, and check- out at the cash register like a regular shopper. They will even give you their receipt to verify the order. You're just offloading the risk of infection to someone being paid to grab groceries.

<comment><USER48> Think of the systemic effects. If everyone ordered online, fewer shoppers would go to the stores, changing the topology of infection from a mesh to a star. Spokes would likely develop immunity, and would be less surface area to test, if we had any tests /s

edit: not star, hub and spoke, sorry

</comment></comment></comment></comment><comment><USER49> Hehe, I had to do the same a week ago. The only difference is Slack'ing instead of mailing and also cart prepopulation because those delivery slots are taken out almost instantly in my city. This is in the EU btw, not specifying the country or chain to, well, to be able to survive longer.</comment>


The hiring process to become an Apple Store "Genius" - <AUTHOR> http://www.macblogz.com/2008/09/26/leaked-apple-genius-position-hiring-documents <comment><USER2> There is not anything particularly remarkable about this interview process or offer letter. I am not sure why the author would even write about this. If anything, I think it only makes him seem like a jerk. This guy applied and interviewed for a position he had no intention of accepting just so he could blog about it. This not only wastes an employer's time and money, but also robs another potential candidate of the opportunity for consideration.

<comment><USER3> Yeah. It's a pretty trashy blog, judging by this article. And here I expected something really interesting.

</comment></comment><comment><USER4> I can't escape the feeling that while seventeen bucks an hour is pretty good for a retail position, it's pretty lousy for anyone with the word "Genius" in their job title.

<comment><USER5> The word "genius" falls into the "if it's in your job title, you're not it" category.

<comment><USER6> That's the same with 'science' in the name of fields and 'democratic' for countries.

<comment><USER5> Yes, I was thinking of the comment that "if the name of your field includes the word 'science', it's not a science" when I wrote that.

</comment></comment></comment></comment><comment><USER7> Sounds just like the hiring process to become anything else. Send in a resume, go to an interview, get job offer. Cool?

</comment><comment><USER8> I'm astounded it pays that well. That's $34k a year plus benefits to tell people which iPod they should pick. I wish they had Apple stores when I was in college.

</comment><comment><USER9> I've struggled with deciding which job I would abhor more.

      A) Apple store genius
      B) Geek Squad member

Sounds like a fun poll opportunity.

<comment><USER8> I'd bet the Geek Squad doesn't pay $17/hr. Also, Apple doesn't make you drive around in a VW Bug painted in such a way as to somehow be even more emasculating than that car is normally. I always wonder what those cars burn faster, gasoline, or the self-esteem of the man behind the wheel.

Plus, I know the number 1 question people ask me when they find out I "work in computers", as they say, is "how do I make this Dell I got 7 years ago run faster?" At least with Apple, nobody owns one that's over 2 years old.

Even though I loathe the fanboys, I think I'd take the Apple store hands down.

<comment><USER10> Customer question: How do I make my 7 year old computer run faster?

Apple 'Genius': Buy a new Mac. Geek Squad: Uninstall bloated apps, remove startup programs, buy (cheap) memory upgrade, run optimization utilities etc.

Which answer takes more 'genius'?

<comment><USER11> Ok, I'm calling foul here. I had a friend who was trying to buy some new RAM for his older system. He is not super-nerdy so he took the RAM stick to Best Buy to see if they sold a similar module, or could at least tell him what sort of RAM it is. The Geek Squad guy took a look at the module, noticed that it was old, and immediately gave him a pitch about buying a new computer. The the PC platform has arguably a better set of tools and third party components out there to make more use out of old equipment, but Best Buy is still a company that sells computers, and thus make the most money by convincing people to throw out their old systems.

It ended up being an RDRAM module and thus could only realistically be found online, but people who are trying to upgrade an old system don't appreciate being given a sales pitch, especially if, god forbid, they are poor.</comment></comment></comment></comment>


72% of consumers make purchases from brands they follow - <AUTHOR> https://www.rawshorts.com/blog/how-to-use-twitter-effectively-small-to-midsized-business/ <comment><USER2> Surprising !!! Is it the right causality ?

I would have been less surprised if 72% of followers of a brand are already customers of that brand. And that's why they follow it: they already liked at least one product so are interested by news about the company.

But I guess that - if that explanation is true - then there's no need for rawshorts services... ;-)</comment>


World of Goo publisher bankrupt. - <AUTHOR> http://www.gamedaily.com/articles/news/world-of-goo-publisher-brighter-minds-media-goes-bankrupt/?biz=1

<comment><USER2> Sadly, I'm not surprised. I know that everyone loves downloadable software, but the piracy rates are just so high for PC games that it's incredibly difficult. You need to get distribution inside Best Buys - the publisher for Big Buck Hunter et al does exceptionally well but the gaming press never, ever talks about guys like that.

</comment><comment><USER3> Important distinction to make here between publisher and developer. The developers are 2dboy, although I'm not entirely sure why you need a publisher for a online downloadable game?

Also - Where's the iphone version already!? :)

<comment> jim-greer There's a retail version as well - though you're right, most of the sales were on Wii, Steam, and from 2dboy.com - they've done very well.

</comment></comment><comment><USER4> Does anyone know how this happened? It seemed like they were running a relatively low overhead business and had released some successful products. I seem to remember them complaining about a 90+ percent piracy rate- maybe that was the cause.

<comment><USER5> I think "they" were the developers, though (not the publisher), and they weren't "complaining" so much as commenting. I think this kind of piracy rate is pretty common with software.

</comment></comment><comment><USER6> Anyone know or have a link to the financial details?

</comment><comment><USER7> Well even if the publisher dissolves they probably can ooze over to a new publisher.

</comment><comment><USER8> how does this affect the developer? would this affect their royalties?</comment>


Join TEALS in Bringing Computer Science to High Schools in the US - <AUTHOR> http://c.codeday.org/l/327

<comment><AUTHOR> TEALS (Technology Education and Literacy in Schools) is looking for volunteers for next year to help teach Intro and AP Computer Science in high schools. TEALS is part of Microsoft's YouthSpark program, and is run and funded by Microsoft. I currently am a volunteer for TEALS, teaching Intro to CS to high school students. If anyone is interested or has any questions about my experience so far, let me know!</comment>


Palaver – Idle Random Chat - <AUTHOR> https://warm-ridge-8132.herokuapp.com/

<comment><AUTHOR> Hi, author here. I made this site as and alternative to Omegle, correct. I was interested in finding some way of meeting new people and making connections, which seems to getting even more difficult in this short attention span, information overloaded world. So far, as an experiment, it's worked for me and a lot of interesting users have come online and I've had some really great conversations. If you have any questions about the site's motivation, just ask.

Oh, and I made it in node and jquery and about 2 hours.

<comment><USER2> can it support more than 2 parties?

<comment><AUTHOR> No, just one on one for now. I was thinking of adding an option to pull in another random stranger, but that'll have to wait til tonite/tomorrow if I have the time.

</comment></comment></comment><comment><AUTHOR> New URL: palaverchat.herokuapp.com

</comment><comment><USER3> Like Omegle but with a more noble goal - less creepiness.</comment>


Ask HN: What are the most impressive companies for new grads to join today? - <AUTHOR> I'm a new grad and I'm interested in which companies are still considered prestigious in the eyes of engineers (over recruiters, general public, etc).<p>Are Unicorns like Uber and Palantir still considered prestigious? How about newer companies like Affirm and Blend? How do older companies like Amazon and Microsoft stack up? <comment><USER2> Pick the one that's the best fit for you.

I picked a job a few years back based on "it'll look good on my CV" \-- turned out to be the worst decision I ever made. That's not to say every job will end as badly as that did, but I realised quite early on that I just wasn't a good fit for the company, and they wanted a "yes-man" to say "you're doing everything right", not an engineer who'd say "this is good, but we can improve by..."

Picked my last job based on the number of people I had at the company, the offer and the general "vibe". Best decision I ever made.

Don't be afraid to interview at a couple of companies then choose between them. Don't pick solely on "this is the highest offer" \-- pick somewhere that feels like it'll be good for you.

And don't worry about prestige. About the only thing that'll put employers off are long gaps in your work history that you can't explain. But that's not a problem you're likely to have with a grad position :)

</comment><comment><USER3> Hard to go wrong picking any FAANGs or the big unicorns of the day. I'd recommend it over joining a startup, you'll learn good engineering practices. I started my career in startups out of college and I remember being the one always feeling things were done way too sloppily (poor testing, hideous build systems, code duplication, ... all in the name of speed), and in hindsight I was absolutely right. You don't want to be in that position.

</comment><comment><USER4> Honestly that's going to depend on the engineer. I never considered Uber or Palantir prestigious, and I have never heard of Affirm or Blend. That doesn't mean I'm right to think such -- with Palantir I'm biased for political reasons, and with Uber, I was also likely wrong not to think so, now that I think about it.

Well, I never heard of Affirm as a tech company to work at, but now I thank you're talking about the company offering loans at high interest rates for people buying stuff they can't afford. I'm not sure what's so prestigious about a humdrum finance company.

Amazon and Microsoft, everybody has heard of, and at least they require people with a pulse. They know how to ship good software, and they got real shiznit going down, and that counts for a lot. Depends on your role.

High hiring bar + works on cool stuff + high salary + company visibility is the general formula here.

</comment><comment><USER5> 90% of your happiness will be based on your manager/team, 10% on the rest of it. It helps to also enjoy the domain the company is working in. Try to figure out the stress level of the organization as well, particularly on the team you will join. Also get a sense that your manager will value your contributions.

</comment><comment><USER6> If you're joining a company because it's prestigious and looks good on a resume, instead of because you see the opportunity to do good work and learn from people better than you, you aren't a hacker--you're just some wannabe seeking affirmation.

<comment><USER7> Not everyone wants to be a "hacker" as you put it. Some people just want a safe career and to make good money. Nothing wrong with that.</comment></comment>


Show HN: A minimalistic Mac sleep prevention application - <AUTHOR> https://github.com/prashantgupta24/automatic-mouse-mover <comment><AUTHOR> A very minimalistic mouse mover application. If you work from home a lot and you would like to prevent your mac from sleeping whenever you do small activities (like taking a walk or a short nap), then boy this app is for you! Just simply start it once in the background and forget about it.

It knows when the system is being interacted with and does nothing then. But once it senses that the system is idle, it starts moving the mouse cursor by tiny pixels (small enough to go unnoticed by you but big enough for mac to think the system is busy).

Voila!</comment>


A Better Way to Use Twins for Developmental Research [pdf] - <AUTHOR> http://people.virginia.edu/~ent3c/papers2/Articles%20for%20Online%20CV/Turkheimer%20%282008%29.pdf

<comment><AUTHOR> "Almost everyone who has ever thought about heritability has reached a commonsense intuition about it: One way or another, heritability has to be some kind of index of how genetic a trait is. . . .

"Unfortunately, that fundamental intuition is wrong. Heritability isn't an index of how genetic a trait is. A great deal of time has been wasted in the effort of measuring the heritability of traits in the false expectation that somehow the genetic nature of psychological phenomena would be revealed. There are many reasons for making this strong statement, but the most important of them harkens back to the description of heritability as an effect size."</comment>


Area 51 is now in beta  - <AUTHOR> http://www.joelonsoftware.com/items/2010/06/22.html <comment><USER2> Great, looking forward to the web app discussion.</comment>


Miraculous Fingertip Regrowing Powder Strikes Again - <AUTHOR> http://singularityhub.com/2010/09/12/miraculous-fingertip-regrowing-powder-strikes-again-video/

<comment><USER3> I lost the tip of one of my fingers when I was young, to a slamming door. It grew back itself, without any magic powders.

"Little pieces (16mm or so) are possible, but most of our wildest dreams about regenerating amputated body parts are still a long ways off."

I just had to measure it when I read that. Funnily enough, the mark that this wound left starts at about 15 to 17mm from the tip. I remember I lost my whole fingernail but somehow it grew back perfectly shaped.

<comment><USER4> That's amazing, I didn't know that was even possible. 1.6cm is huge!

<comment><USER5> Depends on the age. Very young children can regenerate fingertips. That's about it, though.

<comment><USER3> I was about 10 years old, if I remember it right. Also note that the door completely missed the bone, although I remember being able to see a small part of it.

</comment></comment></comment></comment><comment><USER6> It might not be able to regrow the limbs today, but it is nice to know that somebody in the medical industry is actually working on improving our lives through new innovations.

Far too often it looks like they are happy just getting rent and doing a few modifications to existent patented medicine so that they can get another 20 years monopoly.

<comment><USER7> I voted this up after reading the first half - I disagree with the second half. It might appear that way sometimes, but it's wrong - <USER2> companies do a mix of billions of dollars in research (most of which never pans out), and also provide exits/buy-outs for smaller labs who make a discovery, which stimulates innovation as well. Some rent seeking, yes, too much, maybe, but pharmaceuticals have been on balance one of the most wealth creating industries over the last 20 years.

Azithromicin alone was worth the $120 before it went generic, and now you can get it for dirt cheap. People laugh and joke about things like Viagra, but it's helped a lot of people, especially as we're all living longer now. All sorts of other things. Pharmaceutical and medical research companies are amazing.

</comment></comment><comment><USER8> Can I regrow my dick?

<comment><USER9> Sorry, not yet. That's a pretty tough one to do, from what I've read.

But given the stories I've heard about some angry partners... I hope it will be possible eventually. :S</comment></comment>


Two years of Quicklisp - <AUTHOR> http://blog.quicklisp.org/2012/10/two-years-of-quicklisp.html <comment><USER2> Zach has done a great job of seeing a need in the Common Lisp community and writing a packaging system to meet that need.

I don't use Common Lisp as much as I used to but when I do I now use Quicklisp for every project.

A further benefit of Quicklisp is being able to browse available packages and quickly experiment with packages that may be useful. I think that Quicklisp tightens up this exploratory cycle.

</comment><comment><USER3> I suggest placing a link somewhere that will lead me to something telling me what Quicklisp is.

<comment><USER4> From a look at <http://www.quicklisp.org/beta/>, it looks like another single- language tool for smuggling code onto a box while failing to set up any interdependencies with the system's package manager. I don't like being so harsh, but "every language has its own packages and none of them interop at all" is a growing antipattern that eventually leads to horrible messes.

<comment><USER5> So write a blog post elsewhere about it. It's one I'd absolutely be interested in reading.

But posting this 'harsh' comment here is useless and detracts from useful conversation.

<comment><USER4> Seen complaints about startups which are obviously saving passwords in plaintext? Imagine how much worse it would be if all the "why you shouldn't it that way" criticism was consigned to obscure blogs rather than here. I regard this as that kind of problem--huge long-term drawbacks that people don't proactively go looking into and don't immediately deter implementing the idea.

<comment><USER6> If you want something done then you need to start on it yourself. Disregarding what QuickLisp has accomplished because you have to deal with more than one package management system is trollish. You'll probably want to start by designing a plugin framework that can support multiple versions of any given language. Also need to be able to bundle dependencies per application, on any operating system, so that you don't pollute the global package space for any one given application under developement. kthx

</comment></comment></comment></comment></comment><comment><USER7> This seems incredibly useful; for someone who wants to try it out, which is a good, open-source, cross-platform CL to try it on? The example uses SBCL, but I know none of the tradeoffs.

<comment><USER8> SBCL is perhaps the fastest open-source implementation of Common Lisp. It has incredible developers and a rich set of implementation-specific functionality. SBCL's "home platform" is Linux, but it runs on Linux, *BSD, Mac, and Windows (32-bit only for Windows at present). SBCL's native code compiler rivals C/C++ for speed when properly hinted. SBCL also has the highest-quality integration with emacs (via SLIME) and Vim (via slimv). The developers seem to expect that you will use SBCL with an editor, so the command-line REPL doesn't even have readline support. ITA Software uses SBCL to run all or most of QPX, the search engine behind sites like Orbitz and Expedia. SBCL does its own memory management and likes a large heap. Standalone executable size is large (20+MB) because it includes the compiler. SBCL is derived from CMUCL and thus has a 32-years-mature lineage and is very stable and performs very well. SBCL has excellent threading , Unicode, and 64-bit support.

CLISP is another implementation that is interpteted (i.e. not native-compiled like SBCL i.e. slower in most cases). It has a somewhat nicer REPL and debugger out of the box, and super-fast bignum support. I believe CLISP is what pg used to create Viaweb.

There is also Clozure Common Lisp (predating and not to be confused with Clojure). CCL is well integrated with Cocoa on the OS X platform and seems to be moving in the direction of ARM suport (iOS support in the future?). I have the impression that CCL may be more popular with OS X users, but I have yet to find reason to use it over SBCL on Linux.

ECL (Embedded Common Lisp) is an implementation that translates to C and uses gcc for compilation. ECL builds the tiniest executables (a couple hundred K or less) and is perhaps well-suited both as an extension language and for embedded platforms. ECL does not seem to support all of the libraries I've tried with it, but it supports enough of Common Lisp to be a viable platform for those who require its strengths.</comment></comment>


Amazon Introduces Tougher Rules to Fight Fake Reviews - <AUTHOR> http://www.scribblrs.com/amazon-fake-reviews/ <comment><USER2> Previously: [https://news.ycombinator.com/item?id=13055390](https://news.ycombinator.com/item?id=13055390) and [https://news.ycombinator.com/item?id=13037024](https://news.ycombinator.com/item?id=13037024).

</comment><comment><USER3> I really despise those _" I received this product at a discount for my honest review"_ reviews. "Honest review" my ass. Anyone who gets any kind of compensation for their review (even if only in the form of products or discounts) can not be trusted.

To compound the problem, the seller can see the past reviews of prospective reviewers, and pick those who've tended to give positive "honest reviews". This skews the reviewing even further off.

I've never ever seen an "honest review" that the reviewer made of a product they got at a discount that wasn't a positive review. Never.

Amazon's discount review program should be terminated. Only people who've paid full price for their products and have received no compensation of any kind should be allowed to do reviews.

<comment><USER4> > Anyone who gets any kind of compensation for their review (even if only in > the form of products or discounts) can not be trusted.

A weaker statement that is still useful is that they can't be trusted similarly to people who bought the product themselves. So it's fine to have sponsored reviews but they should be segmented.

</comment></comment><comment><USER5> Seems to me that Consumer Reports should implement a new program whereby customers that prove themselves to be trustworthy can submit a receipt and a review for a product, and if it is voted helpful enough (by other shoppers), that reviewer gets one free month of Consumer Reports subscription.

The result: verified, honest, reliable, helpful reviews. It would boost CR's value and give the world something it badly needs.

I suppose Amazon could do this with gift certificates or a month of free Prime or something.

<comment><USER6> I don't think that's why people buy consumer reports. At least for me it's about getting a professional review in the context of the product as well as against others in the same category from a source whose only interest is keeping the customer (me) informed. I'll admit that limits the selection of the products reviewed, but I'm OK with that trade off.

I think what you're describing could work well for Angie's List though (also a customer of theirs).

</comment></comment><comment><USER7> Obvious solution: only accept reviews from customers who actually purchased the product.

<comment><USER8> That is an obvious solution for extremely expensive items that do not sell much. It doesn't work if the seller can just pay people to buy the thing and then write a review, no?

<comment><USER9> I think they should be able to tell apart from people's purchasing history if they are "organic" buyers [normal people's consumption patterns of goods] or something organized to curry favorable reviews.

Sure someone could get paid to review an item and also be an avid consumer of a product, but in that case it would seem they believe in the item.

Imagine someone buys eneloop over and over, never offer a review, then purchases a no-name brand, gives rave reviews and goes back to buying eneloop again.

</comment></comment></comment><comment><USER10> I pretty much just look at what the 1-star amazon reviews say. That's where you find the low-end tail...

</comment><comment><USER11> Amazon is a completely dishonest company. Go look at the Xfinity internet reviews on their site. fully _eightfive percent_ of them are a single star. And YET... Xfinity has 4 stars overall. The problem isn't users creating fake reviews it's Amazon itself.

<comment><USER12> 54 verified 5 star reviews

16 verified 1 star reviews

The reason it's 4 stars overall is _because_ of the attempt to filter out fake reviews.

<comment><USER11> I don't think you are looking at the same thing I am.

[https://www.amazon.com/XFINITY-High-Speed-Internet- Exclusive...](https://www.amazon.com/XFINITY-High-Speed-Internet-Exclusive- Customer/dp/B01B6ZI3SS/ref=sr_1_1?s=electronics&ie=UTF8&qid=1480739748&sr=1-1#customerReviews)

There are over 900 reviews.

<comment><USER13> Yeah, but if you look at just the verified ones, they break out like the parent commenter wrote.

<comment><USER11> There are over 100 verified reviews, it doesn't seem like we re seeing the same thing.

<comment><USER12> It shows me exactly 100 verified reviews.

      5: 54
      4: 13
      3: 9
      2: 8
      1: 16

Average: 3.81 stars</comment></comment></comment></comment></comment></comment>


Facebook Launches Group-Buying Prototype - <AUTHOR> http://mashable.com/2011/01/26/facebook-buy-with-friends/ <comment><USER2> Apply this to actual products and services...Game over man, game over.</comment>


Ask HN: Best android development phone? - <AUTHOR>

I am going to be upgrading to a smartphone on AT&T.  I am torn between the Moto X, the HTC One, Samsung Galaxy S4, and the Samsung Galaxy S3. I am also thinking of buying a Google Nexus 4 on ebay.<p>I have an app in mind that would make heavy use of the accelerometer, gyroscope, compass, and possibly the barometer. Are any of these phones known for having great sensors? What does HN recommend? <comment><USER2> Wait for the Nexus 5. Rumor is that it will be announced tomorrow.

</comment><comment><USER3> I would recommend a nexus device. If you are really into sensors like temperature, humidity go for galaxy S4 otherwise don't. Nexus 5 is coming soon,to wait few more days to buy a nexus

</comment><comment><USER4> If you're price sensitive, get a Nexus 4. They're clearing stock at the moment, so it's probably $100 or $200 cheaper than it would otherwise be. You'll probably find that the ones on the Google Play store are cheaper than the ones on eBay.

If you can wait a bit and are not particularly price sensitive, get the Nexus 5 when it comes out in early November.

<comment><USER5> They have actually been sold out for about a month or so. The inventory has been cleared. Now they are above retail price through third parties.

<comment><USER4> Depends which country you are in. In Australia, both models are still available through the Google Play store. ($249 for 8GB, $299 for 16GB)

</comment></comment></comment><comment><USER6> Nexus. It's cheap and requires no contract.

</comment><comment><USER7> Definitely a Nexus phone. I would wait for the 5 if possible, it should be out soon.

(Or just get a 4, if you can.)</comment>


What's Your State Good At? - <AUTHOR> http://1bog.org/blog/whats-your-state-good-at/ <comment><USER2> and oddly, there's a smiley face denoting Good/Bad/Neutral Energy policies???

So to have good energy policies, drink lots of beer, participate in a gang, drive real fast, be rich, pack a lot of people in a small area, and reuse public buildings...</sarcasm></comment>


Why I moved to Switzerland to work in IT (2014) - <AUTHOR> https://medium.com/@iwaninzurich/eight-reasons-why-i-moved-to-switzerland-to-work-in-it-c7ac18af4f90 <comment><USER2> Switzerland is great. But I'm surprised at the "relatively cheap life" bit - everything there felt 2x as much as what we were paying in Germany, especially food. Restaurants were obscene. Many locals eat at the cafeteria at the local Migros, which was like the cafeteria at Whole Foods, just more expensive and not as good.

Having said that, it's also very safe, very clean, very pretty, and city infrastructure that makes the Midwest feel like Kabul.

Software engineer salaries in most of Europe are quite low compared to what you get in the US. In the US, I make about $110k before the perks kick in, and someone like me _might_ make 50k Euros in place like Amsterdam, if lucky, so it's good that Switzerland is competitive.

<comment><USER3> Due to the high salaries, things that are related to human labour are expensive. As a tourist you get a biased view of the country since you experience mostly the service industry.

</comment></comment><comment><USER4> Anyone know if there is much of a demand for .Net developers in Zurich?

<comment><USER3> Author of the article here. Just contact me via the mail in my HN-profile.</comment></comment>


Wanted: 5 Startups To Change the World  - <AUTHOR> http://www.readwriteweb.com/archives/wanted_5_startups_to_change_the_world.php <comment><USER2> "Haque then issues an open challenge to Silicon Valley: find a problem to fix that will change the world for the better and he will help you do it."

"His help will come in the form of free consulting time."

</comment><comment><USER3> So is anyone here up to the challenge? Eh?

<comment><USER4> Don't worry I got us covered. I agree with this guy and have chosen such a problem.

I'm targeting the problem of medication adherence. It's a 100 billion dollar problem. There are 435,000 people in the USA with HIV. Medication adherence at between 70-90% is the biggest cause of disease progression in people with HIV, because at this level, the disease is most likely to mutate. There are 1.5 million new diabetics each year. Diabetics who adhere have 33% less hospitalizations. Hypertension and high cholesterol are two others that have great benefits from more adherence.

Adherence is such a huge problem that a solution would have the same health effect as a blockbuster drug across disease types. The best part is, you don't have to resort to advertising. At 20$ a month (very cheap compared to the costs of non-adherence) we make 1 million dollars a year off every 4167 customers while solving a huge problem in an industry that has been unable to solve it itself. A couple studies that show our protocol is effective, improves outcomes, and is cost effective, and every insurance company and government healthcare agency becomes a potential client. With such a base of customers using our product, we can then innovate the hell out of the patient facing medical market.

This problem falls through the cracks. I think we can solve it, get great financial results, and lay the groundwork to solve other big problems in healthcare, and we are developing that.

</comment></comment><comment><USER4> Best piece I've read on YC.</comment>


Oracle JDK download is geo blocked from US - <AUTHOR> https://www.oracle.com/splash/edelivery/index.html <comment><USER2> I'm curious how anyone got this; I'm in the UK and I just successfully downloaded the 8u112 JDK without any issue.

Downloaded from this link with no mention of any geoblocking: [http://www.oracle.com/technetwork/java/javase/downloads/jdk8...](http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html)

</comment><comment><USER3> And from Germany. Now, the question that really interests me: Is it geoblocked from _Java_?</comment>


Don't rinse after brushing and other tips for better dental health - <AUTHOR> http://lite.cnn.io/en/article/h_18986a53758ad5e99b27e6d1fb6c60c0 <comment><USER2>
      Fluoride replaces lost minerals in teeth

Um, no.</comment>


ADP Begins to Roll Out a Zenefits Competitor - <AUTHOR> http://blog.zenefits.com/adp-2/ <comment><USER2> I admittedly don't know a lot about this situation beyond what I've read in the news the past day or so. However, isn't it the case that Zenefits is simply building an interface on top of ADP's payroll data? And, from what I've read, it seems like they did this without following the proper procedures (did they write some kind of web scraper?). So if that is the case, ADP has every right to block them. If the situation was reversed and a large company was scraping a startup's data to integrate into their own platform, the outrage would be directed quite differently. So Zenefits is plugging into ADP's data, not paying them for access, not following the proper procedures to get access, and selling an interface on top of that data for a 10% fee, and then they complain that ADP blocked them?

EDIT: Also, all of their press releases sound very immature.

<comment><USER3> Zenefits has their users create an admin ADP user. Then zenefits uses those credentials to pull whatever data they want. They chose this route instead of working with ADP's third party system (without giving any justification as to why). I might sympathize if ADP's API access was severely limited or extremely expensive, but it appears as if Zenefits made no efforts to go this route.

<comment><USER2> Exactly. If I found a third-party company that was having users create accounts on my systems for the purposes of pulling data out, I would block it too, probably more quickly than ADP did.

Imagine if a company asked for your Google password instead of using the proper API channels. I don't know many users who would do that.

<comment><USER4> > Imagine if a company asked for your Google password instead of using the > proper API channels

This would be more like creating a new Google Apps email account for someone, and allowing them to use it to (e.g.) manage things on your Google Drive (by sharing a group folder with them).

How many companies hire a 3rd party accounting / HR firm (or person) to manage their bookkeeping? How many of them create an ADP admin account for these people so that they can manage payroll? How is this that much different than Zenefits?

<comment><USER5> This is exactly how most resellers on Google Apps are set up, actually.

</comment></comment></comment></comment></comment><comment><USER3> This is getting ugly. Going against a ruthless goliath should help garner public support, but the way they are doing it is very unattractive to me. And as someone currently evaluating payroll solutions for small businesses, I'll be steering clear of them.

</comment><comment><USER6> Reading this story, the lawsuit story and in trying to keep up with this entire fiasco...

You end up feeling both sorry and a sour taste in your mouth for both companies. They're both obviously very good at "spin" and drumming up PR to win support of their audience.

I previously thought things would get settled amicably, out of court, with Zenefits saying "sorry", ADP saying "its okay" and the 2 companies settling on some decent structure to use ADPs API (or whatever thing they use for 3rd party access).

Now we are dealing with a situation where this is basically corporate-warfare hitting the "lala-land" of Silicon Valley.

Google, Apple, Microsoft and other tech companies generally have this corporate warfare amongst themselves and they also sometimes move in on other industries, catching those players off-guard.

With that in mind, and also the fact that Zenefits can no longer be classified as a startup - with +50 (or is it +100 employees) and a startup valuation of US$+4,5 billion - this is just another case of corporate warfare.

I shall now neither pity or care for either party of this story, because no matter how good the "spin" from each side is, this is just business as usual.

Any wall-street raider using HN may agree.

Edit: I'd also like to see how much longer this "post" stays as link number 1 on this platform, instead of getting "washed away" like yesterdays ADP link. Then we can also know for a fact that YC is actively pushing the agenda with their corporate interest in Zenefits (and proof that not all "good links eventually surface to the top", without someone pulling some admin-user strings at the top)

<comment><USER7> > With that in mind, and also the fact that Zenefits can no longer be > classified as a startup - with +50 (or is it +100 employees)

Ha, because of all of the manual entry they have to do as of February 2015 Zenefits had over 500 employees. When the CEO went on TWiST just a week or two ago he said they were over 1,000 and hiring 100 new employees a month.

They're burning hard and fast.

<comment><USER8> Why do they have to do manual entry?

<comment><USER7> A vast majority of insurance brokers / providers simply don't have an API or even an easy way to send insurance information. It's surprising how many HR related tasks are still very manual in 2015 especially considering you should be able to offload everything minus employee relations and hiring in HR.

</comment></comment></comment></comment><comment> noir-york I believe that this is called a 'free market'. Also, called 'underestimating your competition'.

This common misconception that big companies are hide-bound dinosaurs is dangerous for any start up to hold. Most large companies are indeed oblivious, but some elephants - if you tweak them hard enough - turn around and stomp you.

Always respect your competition. Some of them may be smarter than you think.

<comment><USER9> Something I've noted about the Silicon Valley startup mentality, and I'm seeing in this discussion, is a lack of understanding of just how difficult enterprise projects actually are. The attitude is often that big companies work so hard for so long and spend so much on projects and still have crap, that they must be lazy and stupid. This is _not at all_ the case. The enterprise is full of smart, hardworking, determined people - as good as Silicon Valley - and they _still_ wind up with crap and failure most of the time. That's not a reflection on the enterprise, that's a reflection on the difficulty of the problems the enterprise tackles.

Like I told someone at a Silicon Valley enterprise/health meetup last year... if you saw a startup with $50M annual revenue, you'd think they're huge, right? I've worked on three different projects larger than that, and they're all small potatoes in their enterprises.

</comment></comment><comment><USER10> I had never heard of Zenefits but I've read the articles that have come across HN thus far. From the standpoint of a non-customer they come across as more consumed with proving a point than just proving they are better.

I think they ought to adjust their strategy.

</comment><comment><USER11> How is what ADP doing (blocking access to their service from Zenefits so they can sell Opum), any different from what twitter does when it blocks services like meerkat from accessing their service when they want to build a business around periscope? I'm not saying that either organization (ADP or Twitter) is acting benevolently (obviously, they are both acting in a competitive manner) - I'm just trying to see if the two are acting in a similar manner.

<comment><USER7> As far as I understand Zenefits is doing both screen scraping and manual entry into the ADP systems and they may have never even talked to ADP. So instead of hitting an API directly where ADP may expect a large amount of requests Zenefits is hitting their normal website requesting hundreds or thousands of users every hour.

I would have blocked them too. It looks far too much like malice from the ADP side of things where it could be bot nets or something else versus a legit company.

</comment></comment><comment><USER12> Couple of points:

1)Zenefits has always known this could happen or at least they should have. You have to play nice with ADP. Because if they don't work with you, you are dead.

2)Zenefits has a super young CEO who doesn't know what he is doing. Where is David Sacks in all of this? Isn't he the adult supervision here? Maybe he hasn't run anything at this scale before? Maybe he and his Yammer gang don't know how benefits and healthcare work?

3)What were the VCs who invested at $4.5B thinking? Any technical due diligence would have brought this up. You had to clear this as a diligence item before you put a dollar into the company.

4)The lawsuit is a shakedown. Its time for ADP to collect its dues. Its nothing more than that. I expect ADP to extract a huge premium and then play nice with Zenefits in an out of court settlement. Everyone will have a face saving PR release after that. But isn't it interesting that this happens after they pick-up their $500M round? I have heard rumors this was going to happen in September last year. ADP waited until now. What a pest.

4)Time for Parker to go and be replaced with someone who has run billion dollar software companies before. And that's not Sacks.

</comment><comment><USER13> Frankly, the simple fact that there is a headline on the Zenefits site that says "ADP Begins to Roll Out a Zenefits Competitor" shows that they have seriously lost their focus.

<comment><USER7> Yeah if anything they should have "leaked" this story of a news outlet. Putting it on the site is just insanity.

</comment></comment><comment><USER14> I can understand that many people probably don't feel Zenefits is totally in the right in this dispute as a whole, but I struggle to see how you can dispute that ADP is being ridiculously two faced. I'm not sure how thinking ADP is better than Zenefits or that web scraping is bad or whatever people saying about Zenefits is relevant to the fact that ADP filed a lawsuit in federal court saying they're NOT making a Zenefits competitor and then sent out emails to customers saying explicitly that they ARE making a Zenefits competitor. Whatever else you think about this situation, that is obviously pretty screwed up.

</comment><comment><USER15> I guess it really depends on what ADP's terms of service say. It is their site and service. Clients can choose to stop using them. The Zenefits teams seems very immature, maybe they should pivot and start offering more full services.

</comment><comment><USER16> I highly doubt this is a "new" product. They have offered payroll/HR/benefits for eons. What would be game changing is if it is free...

</comment><comment><USER17> Who gives a fuck? In my opinion they are both competing for the same thing. Why even give either of the companies more publicity than they deserve?

</comment><comment><USER18> zenefits post about ADP is making me dislike them and I've never used their product.

</comment><comment><USER19> I'm gonna bet that ADP wins this one.

</comment><comment><USER20> IANAL but I belive the stock advice when you are facing a lawsuit is to shut up about it. "We don't comment on matters under litigation" is the standard line, and for good reason.

</comment><comment><USER21> This is pretty bad on ADPs part. But after reading the other HN discussion on this topic[1], it seems like this is a company destined for as fast of a fall as it rose. I hate to see big companies muscle out little ones, but I guess if you're going to rustle the feathers of so many, you're bound to make some powerful enemies.

[1] [https://news.ycombinator.com/item?id=9692635](https://news.ycombinator.com/item?id=9692635)

</comment><comment><USER22> It is likely possible to identify the email address + name that are blacked out email because of its pixel dimension if that is a major concern:

[http://snag.gy/DQEAX.jpg](http://snag.gy/DQEAX.jpg)

Just figure out the application and OS/browser rendering the email and compare each possible email/name combination with this.

It is like a one-way hash with a fairly small set of possibilities. May be a few hits though, rather than just one.

</comment><comment><USER23> It's interesting, because if Zenefits had already IPO'd they absolutely would not be able to take this approach. Too much shareholder risk. And this is just as much a David Sacks thing as it is a Parker thing. I have to believe after my 10+ years in Financial Services that David Sacks already disliked ADP from his PayPal days. Zenefits is going to lose this battle, but it's about the war.

</comment><comment><USER24> Blatant FUD from Zenefits. ADP's new product is an online payroll/HR SaaS that integrates across its entire product line.

Zenefit's product is a glorified remote bookkeeping service in which you enter data into the Zenefits website and they re-enter it manually, and usually incorrectly, into the ADP website and scrape the results, usually incorrectly, so they can post a response several days later to your Zenefits account page.

One is a SaaS (ADP) and the other is a remote data-entry service (Zenefits). Completely different. It's hard to argue that Zenefits should even be considered a tech company, since most of their "integration" functionality is driven by manual human labor and not technology. At best, Zenefits is a data- entry service with a nice, shiny UI.

EDIT: Also...the new product is actually just an offshoot of an existing product that my firm has been using for nearly a year. The new product, Opum, is simply the small-to-medium business version of one of ADP's existing enterprise cloud payroll/benefits products. It even uses the same (new) interface as the enterprise product.

<comment><USER25> If they are so "completely different" then why would the ADP rep say:

> "We are coming out with a product to compete with Zenefits, a full service > integrated online payroll and benefits solution."

I can't seem to argue with Zenefits stance that they are being sued for complaining that their access was cut off in an attempt to kill them off while ADP launches a similar product... On top of that who is ADP to cut off access that their clients are paying for? It doesn't matter if a human logs in or a computer, the cost to ADP is the same. Here they are blocking access for no legitimate reason while launching a competing product. This whole things stinks and I think the smell is coming from ADP....

<comment><USER26> > I can't seem to argue with Zenefits stance that they are being sued for > complaining that their access was cut off in an attempt to kill them off > while ADP launches a similar product...

That's not their claim. Their claim is that the reason they were cut off was because of this product launch. They haven't presented any proof of this.

Simple fact is, the claim is coming from a company that has already made it clear they are doing things they should not be doing. They have the burden of proof. They have a mountain to climb.

Edit: As mentioned in the GP comment, this claim is also false:

"Within the same hour they filed suit, an ADP sales rep started selling a brand new Zenefits competitive offering — called "Opum" — to our shared clients."

<comment><USER27> _> the claim is coming from a company that has already made it clear they are doing things they should not be doing_

I'm troubled by this assertion. I know firsthand that ADP will actively fight attempts to integrate with them; their APIs are bad, poorly documented, and have reliability problems. Should somebody attempting to do well for the customer--and, yes, make some money, but it's not like Zenefits is inventing problems to solve--not do well by the customer first and foremost?

Like, from my perspective: forget ADP, forget Zenefits. Is this better for the customer?

<comment><USER28> Zenefits could simply implement ACH themselves, as ZenPayroll has.

ADP is not a monopoly.

Zenefits built a model that vaguely value adds onto ADP by using a more modern web stack.

I'm no huge fan of ADP, but they're being generous to even consider _themselves_ to be _competing with Zenefits_.

<comment><USER9> The word "simply" does not belong in the same sentence with "implement ACH".

Signed,

Someone who worked on ACH for nine years.

ps: I'm pretty sure they're trying to do just that. But you have to consider just how incredibly difficult ACH is - not just from a coding perspective, but from a regulatory perspective. Banking and accounting legal entities need created.

pps: ADP knows good and well that Zenefits is working on their own ACH implementation with their buckets of cash. This is a preemptive strike.

</comment></comment></comment></comment></comment></comment><comment><USER9> This strongly suggests that the shutoff AND the defamation lawsuit were part of a planned strategy - that they're deliberately goading Zenefits' notoriously outspoken CEO.

Which does not bode well for their lawsuit, but I don't think they're out to win that anyway.

</comment><comment><USER29> Zenefits needs much much better Mar-Comm. This is getting embarrassing.

</comment><comment><USER30> And the rabbit hole gets deeper... I'm guessing this Opum product is smoke and mirrors to capitalize on this whole fiasco.

<comment><USER31> I think you should give ADP more credit. Even if they don't have the best product, I would assume they would've foreseen competitors in the front-end benefits field and have adjusted their business plans long before this back and forth. Companies that have been in an industry for a long time can often see industry changes coming, even if they don't have the agility to react quickly.

</comment></comment><comment><USER32> i hope ADP finishes this project soon i stop getting solicitations about it from a new recruiter every week

</comment><comment><USER33> I'm filing Zenefits in under the heading "companies that confuse 'disruptive' with 'douchebag'".

</comment><comment><USER34> "We call on ADP to stop making life more difficult for small business customers and live up to its corporate value: "integrity is everything.""

See: Twitter, Facebook, and even Google. All of these companies have destroyed 3rd party companies by basically using them as a test base for new ideas and features and then directly competing (and many times, cutting off the 3rd party completely).

If you are going to base your entire company off of a 3rd party, you better have a plan B if they completely cut you off.

<comment><USER35> This isn't that situation - Zenefits didn't build their entire platform on top of ADP; they simply offered an integration for a portion of their customer base that uses ADP.

<comment><USER34> It is the situation. They based a portion of their business on someone else's platform and it was pulled out from under them.

If it wasn't such a big deal, it wouldn't be all over the Internet.

<comment><USER35> 10% is not "their entire platform" [http://techcrunch.com/2015/06/09/payroll- giant-adp-cuts-off-...](http://techcrunch.com/2015/06/09/payroll-giant-adp- cuts-off-small-business-clients-access-to-zenefits/#.wg0aq7:Vih9)</comment></comment></comment></comment>


Facebook investors launch third attempt to remove Mark Zuckerberg as chairman - <AUTHOR> https://www.dailymail.co.uk/news/article-8261775/Facebook-investors-launch-attempt-remove-Mark-Zuckerberg-chairman.html <comment><USER2> The title also says,

> _but the vote is doomed to fail because of billionaire 's controlling stake > in shares_

And, warning: Daily Mail! It should be replaced with a more reliable source.

<comment><USER3> I saw the URL and immediately thought _nope_.

</comment></comment><comment><USER4> Ignoring the source, I thought MZ owns more than 50% of the voting shares. Is there any way it's possible for anyone to remove him from the board? Short of him committing forward fraud of some kind?

</comment><comment><USER5> There is a higher chance of pigs flying.</comment>


Ask HN: People who followed advice on 'Should I quit' HN thread - <AUTHOR> Did it work out for you? Any advice to someone on the same position as you where?<p>Thanks <comment><USER2> Can you link to the thread?</comment>


Full Docker Breakout Exploit - <AUTHOR> https://unit42.paloaltonetworks.com/docker-patched-the-most-severe-copy-vulnerability-to-date-with-cve-2019-14271/ <comment><AUTHOR> A PoC for CVE-2019-14271, which can be exploited by a malicious container to gain root code execution on the host.

</comment><comment><USER2> > The fix included patching the init function of docker-tar to call arbitrary > functions from the problematic Go packages. This forced docker-tar to load > the libnss libraries before chrooting to the container, and thus from the > host filesystem.

This seems like a band aid, not a proper fix. docker-tar is still run, chrooted into the untrusted container root directory, but in the host's namespace (i.e., ubcontained). As we all know, chroot on Linux is not a security barrier!

I think it would be better to run one docker-tar entirely inside the container, writing to a socket; with another docker-tar on the host reading from the other end of the socket.

Taking a step back though I have to ask why 'docker cp' has to execute anything at all. I would not expect that copying files would need to do anything other than open files within the container and read them. I suppose this would only be possible if the open syscall had a way to prevent symlinks being followed (O_NOFOLLOW is not sufficient because it only applies to the final file in the path, not any parent directories).

<comment><AUTHOR> Hi, OP here. You're correct on the symlink point, they're the reason chrooting is needed, as they caused several vulnerabilities in Docker and Podman cp in the past. The good news is that there is a new syscall designed to solve that exact problem, openat2(), which you'll be able use to restrict path resolution when opening files ([https://lwn.net/Articles/796868/](https://lwn.net/Articles/796868/)). It will make helper processes and chrooting to the container redundant.

Running helper processes entirely in the container is actually quite problematic, since they will be visible to proceses in the container that could try to affect their output. This solution though is used in Kubernetes, and it resulted in 4 vulnerabilities in the last year. Ariel Zelivansky and I just gave a talk on the security of the cp command in KubeCon, you can check out the slides here ([https://kccncna19.sched.com/event/d229f00f143036f7c488144e60...](https://kccncna19.sched.com/event/d229f00f143036f7c488144e604f91ea?iframe=yes&w=100%&sidebar=yes&bg=no#)) for more information.

As for the fix, I'm pretty sure newer Golang versions stopped dynamiclly loading libraries at runtime, which is nice. I Should have included that in the post but forgot.

<comment><USER2> Wouldn't you have the option of running the helper process within the mount namespace but not the process namespace of the container?

Regardless, openat2 looks like a much better solution. I hope it's backported to LTS distros so I can start relying on it before 2035...

<comment><AUTHOR> That's an option, an actually what LXD does. It's better then just chrooting, though in the case of this vulnerability even if docker-tar entered the mount NS, the exploit will still work.

</comment></comment></comment></comment><comment><USER3> I was never under the impression that docker was secure or even claimed to have security (do they?). I feel this is a common belief.

For me Docker felt halfway between VirtualBox and Parallels. And VirtualBox had shared folder breakout exploits as far back as 2007.

[https://www.coresecurity.com/content/advisory- vmware](https://www.coresecurity.com/content/advisory-vmware)</comment>


Transparent Git Encryption - <AUTHOR> https://github.com/shadowhand/git-encrypt

<comment><USER2> Please see the discussion on the git list where Junio recommends against this technique:

[http://thread.gmane.org/gmane.comp.version- control.git/11312...](http://thread.gmane.org/gmane.comp.version- control.git/113124/focus=113221)

Also, I notice you're using ECB. Shouldn't CBC be used?

<comment><AUTHOR> I have read that post and agree with him in principle, but it should be up the end user to decide if they want to use this.

As for ECB vs CBC, I recommend reading <https://github.com/shadowhand/git- encrypt/issues/2> which cover both ECB and fixed salts in depth.</comment></comment>