Ask HN: How much should I ask for? - <AUTHOR>

I'm posting this under a throwaway account in order to give details.  From this thread - http://news.ycombinator.com/item?id=1591225 - it seems people like discussing money here so I wanted to ask for input.
I've been contacted by a place I've worked for before about hiring me on a contract.  This would be the fourth time I have done work for them.  The first two times I was working as an employee - I quit to go do something not software related, came back and then got laid off.  The third time I was hired on contract.
As an employee, the first two times, I earned $23/hr (there would have been benefits on top of that but I never made it past the probation period).
For the contract, I asked for $36/hr and it was accepted.
Since then, I have been working on a contract at another place and earning $45/hr.  This contract will end soon (or be reduced to just a few hours per week).
This company does client work which they bill at approximately $100/hr  so I know there is a limit to what financially makes sense to them no matter how good my work is.
I was thinking of asking for $55/hr this time around but that seems like a huge jump from their point of view when I was earning $36/hr at my last contract with them - just six months ago.
I should note that not getting the contract wouldn't be a bad thing.  I would be interested in having the free time for a while to work on my own projects.
I would be interested in hearing other people's viewpoints. <comment><USER3> If they really bill at ~$100/hr, they should certainly be comfortable with paying $50/hr to subcontractors, maybe more. (It's common to double a subcontractor's rate and bill that to the client.) So definitely don't take anything under $50.

Asking for $55 and being ready to take $50 doesn't seem crazy at all to me, but since you don't care too much whether you get it but _also_ don't want to burn a bridge, ask for a daring "wow, it makes it worth it!" but inoffensive figure. Given their margins, I'd say that's $65-75/hr.

<comment><USER4> A standard multiple for consulting shops is 3.15. As in, bill your contractors out at 3.15X what you pay them. Anything lower and you won't be able to keep up with overhead.

It sounds like they're doing that with this guy, so he probably won't be able to get much more out of them.

<comment><USER5> I haven't seen 3.15 before. That seems pretty high to me. 2x is closer to what I have experienced before, some times less if the overhead is low. If a company needs 3.15x, then they have some pretty serious overhead issues. Perhaps this is true for large consulting shops, I've only dealt with smaller ones.

</comment></comment></comment><comment><USER6> What region/location are you in?

All those rates sound very low, especially when you look at what you actually net after taxes and all that.

$75/hr would seem the be the floor, IMO, unless you're in a very low-tech area like the middle of Utah or something.

<comment><USER7> $75/hr rebilled at $100/hr doesn't really make sense for the prime contractor. That's valuing the sales effort, client relationship, billing risk, etc., etc., at $25.

Having been a prime contractor who hired subs for overflow work, we'd generally never go above 2/3 of the prime rate.

If you want to make $100/hr, you generally have to go sell yourself to a customer, not act as a subcontractor.

<comment><USER8> I would say that depends entirely on the subcontractor and your relationship with him/her. Someone you're bringing on just to meet availability demands, maybe.

Someone who is already well known and respected for what they do, you should be prepared to offer a better deal for. In fact, you may end up being able to raise your own outgoing rate if you find folks willing to work for you who are really great.

But of course, the risk does end up in the hands of who owns the contract. And if there isn't sufficient trust with between you and your subs, a premium helps protect you from that.

But this practice may be keeping you locked into a cycle of only getting help from low to mid skill level developers, who end up going elsewhere once they've grown a bit more.

</comment></comment></comment><comment><USER9> Purely based on your own cost structure, in an apples-apples comparison to the FT job you had before, anything less than $50/hr is a giveaway.

As a subcontractor for a $100/hr project, you have wiggle room between $50-$75/hr. It's probably not a huge amount of wiggle room, because as someone making $46,000/yr FT, you're not doing anything super hard to replace.

You are a maze of twisty little passages, all alike.

(a) You need more contracts, because your current BATNA ($45/hr via contract quite possibly being worth less than $23/hr FT) sucks.

(b) You need to eat, and so you may need to take an unnecessarily low rate from your original employer. If I was them, and I was all business, I'd refuse anything more than $36/hr. In this economy, procurements not letting us raise any rates, have to be equitable to other workers, yadda yadda.

</comment><comment><USER10> After many years billing as a consultant I found that I was happiest when I ignored bill-thru rates and just focused on getting a fair rate commensurate with my market value.

Unless the gig you are ending is unusual, or short term, it would appear that your market value is at least 45/hr. I would either offer that, or if you want to test your value, increase it to 50. If the company does not value your time at that rate, they won't pay it. As a consultant it's important to remember when you're discussing rates with a client, it's not a reflection of your personal worth, just your economic value.

You can test your market value by either offering them a lower rate, or trying to find other work at 45-50 hr.

Over time I learned that when I felt I was getting too busy it was time to rate limit the work I was getting by raising my rates. Or vice-versa.

</comment><comment><USER11> Don't let your previous salaries anchor you. Think about what you are currently worth and what you want to make now. Ask for more. Compromise with other benefits or a lower salary as appropriate.

<comment><USER12> I think the problem will be that the previous salaries have anchored the _company's_ idea of his/her worth. Regardless, I agree that it's best to ask for what you feel you are worth.

</comment></comment><comment><USER13> Ask for $55, then agree to meet in the middle at your current $45 if they balk.

Unless you're set on getting $55 out of them :)

<comment><USER14> I disagree. Contractors should never waiver on their prices. Whatever your asking price is you should always be willing to walk if your price isn't met.

<comment><USER10> I disagree strongly. Changing your price isn't wavering, it's negotiating. Companies hiring consultants aren't that different than most parties you would negotiate with.

For example they tend to respond to standard negotiating techniques, such as quoting them a higher standard rate then offering a discount in negotiation.

Walking away is fine as long as your confident in your ability to immediately get work at your rate but it doesn't prove your rate out - people paying it does.

There is a slightly dated, but highly relevant book I'd recommend - <USER2> Ruhl's Computer Consultant's Guide - [http://www.amazon.com/Computer- Consultants-Guide-Strategies-...](http://www.amazon.com/Computer-Consultants- Guide-Strategies-Successful/dp/0471176494)

<comment><USER9> Slip scope, never rate. Rates can only rarely be raised.

</comment></comment></comment></comment><comment><USER15> Since they came after you, tell them to make you an offer and you'll consider it.

</comment><comment><USER16> I would suggest reading this: [http://stackoverflow.com/questions/197139/fair- contract-sala...](http://stackoverflow.com/questions/197139/fair-contract- salary-compared-to-permanent-salary)

Obviously, I can't speak for your situation, but there's a good chance you're undercharging.

</comment><comment><USER17> Go for 65, then lower to 55. If they bill 100, they want some profit, but they mostly don't want to loose their client if they can't handle the work themselves. Really, ask 65 with a straight face.

</comment><comment><USER18> I suppose you could draw your line at around 50, but check out what they have to say at first from their point of view.

</comment><comment><USER19> Ask them to pay you what they think you are worth.

<comment><USER20> This is the one thing that I WOULD NOT do. The must successful contractors that I've worked with always take charge of the negotiation and try to say things like "going rate" or "standard rate", essentially stating their prices authoritatively. If they're paying you to be an expert, than you should maintain that persona through to your billing and price negotiation as well.

<comment><USER21> I've always heard the adage "the first guy who mentions a number loses".

<comment><USER22> I'm not sure if I got the exact word for it (english isn't my first language) so I'll call it the "anchor price" effect.

Basically, if you are the one who mention the first number, you can set the "anchor" of the conversation. This mean that if you ask for 55$ first and they try to offer you 40$ You can focus on the fact that it's around 30% lower than your asking price.

On the other hand, if they mention 40$ first, you are the one who has to convince them to give you 30% more.

PS : I'm not saying you are wrong, just bringing another point of view on that.</comment></comment></comment></comment>


Starting-Up and staying in Boston - <AUTHOR>

The HackerNews MeetUp last night was lots of fun. Thanks to everyone who made it!
I asked someone in the current YC batch how many in the current YC companies are staying in Boston.
To his knowledge: none!
That is a big surprise. What does it mean for those of us that like the town and would love to stay? <comment><USER2> Boston seems like the Second City of startups. Great place to get started but not the big time.

When the SFP started, I had no idea that Boston had much current startup activity. I mean, I knew a couple places that started there but not as many as, say, Seattle. But I think now it's a great place for the first stage of a startup's life. Lots of hackers and lots of financiers that can get you going. But the M&A, influential investors and press is just so extremely concentrated in the Bay Area.

Don't get me wrong, I'm an LA guy and am fond of Cambridge, so I'm not a homer here. But that's the reality, especially for companies as determined to make it as the YC companies presumably are.

</comment><comment><USER3> Of course, there are lots of Boston area startups beyond the few YC funds. And most of those doing YC don't have Boston roots, so they might not have much reason to stay.

To the larger point, Boston needs a stronger and more vibrant community of hackers, esp. for those interested in the web.

And I'm bummed I missed the meetup last night...

<comment><AUTHOR> That's a good point. It would be interesting to know how many from the current group were from the area. Also knowing how many are actually moving to the Valley vs. moving back to where they're based.

I'm sure there will be another meetup, but maybe not before Oct 18th :)

</comment></comment><comment><USER4> Is this a rhetorical question? The answer seems obvious...

<comment><AUTHOR> What? That all startups must move to the Valley?

I find that hard to believe.

<comment><USER4> I know you find it hard to believe. Otherwise you wouldn't be asking yourself a rhetorical question.</comment></comment></comment>


Show HN: Viggo – a completely new way to share in real world interactions - <AUTHOR> https://itunes.apple.com/hr/app/viggo/id956526128?mt=8

<comment><USER2> This was the exact same business idea as Color.

[http://techcrunch.com/2011/03/23/color-looks-to-reinvent- soc...](http://techcrunch.com/2011/03/23/color-looks-to-reinvent-social- interaction-with-its-mobile-photo-app-and-41-million-in-funding/)

<comment><AUTHOR> Color has some similar elements, but Viggo is quite different.

With Viggo we are introducing new paradigm where you only see and manage content in the air around you, where air is like an ad hoc shared resource for collaboration. There are no profiles, users and user connections, etc... - only pure content in the air.

Also, Viggo is not just about "videos and photos", we see a greater opportunity in redefining how content is shared in real world interactions. You can share documents, contacts, links, you can create collections ("folders in the air")...</comment></comment>


Patriot Missiles Are Made in America and Fail Everywhere - <AUTHOR> http://foreignpolicy.com/2018/03/28/patriot-missiles-are-made-in-america-and-fail-everywhere/ <comment><USER2> This is the pac-2 missile which was fielded in 1990 and not designed to combat these kinds of missiles.

PAC-3 is much more advanced and the kill vehicle much more accurate.

<comment><USER3> "In fairness, the system deployed in Saudi Arabia — the Patriot Advanced Capability-2 or PAC-2 — is not well designed to intercept the Burkan-2 missiles that the Houthis are firing at Riyadh. The Burkan-2 flies around 600 miles and appears to have a warhead that separates from the missile itself."

Seriously? The system can't intercept threads it wasn't designed to? That's the article?

<comment><USER4> It wasn't designed to, but the system keeps being deployed to defend against these threats. Leads to a question: What's the point of continuing to deploy something that, by all (unclassified) accounts, seems to have no real utility?

<comment><USER5> That's how procurement, and especially military procurement, works in most countries which have some degree of corruption. Or at least: when there isn't any good oversight by the stakeholders. Seems like the procurement of Patriot missiles was driven more by a need to "buy from the USA" than as an actual credible way to thwart actual threats. Which is incredibly surprising EVEN after knowing how this works because presumably the Houthis are using Iranian/Iran-derivatives of missile systems and Iran is supposed to be the primary geo-political rival to the Sauds. (Makes me wonder what else won't really work in an actual war).

Let me say that I'm a pacifist 100%; diplomacy comes first and all that but war is really where you can't lie and all your bad decisions are right there in your face and fuck you up completely if you didn't think hard enough through these things. This particular incident reminds me of when the Pakistanis procured the latest F-6 aircrafts from the US but were unable to use them effectively in a war against India (1971) because their pilots were not sufficiently trained in how to handle the advanced aircraft systems.... oops.

<comment><USER4> Sadly a very accurate statement. US allies are encouraged and sometimes required to buy US weapon systems even if they have no real utility, need, or capability to use them. Often they purchase them directly from the US government (versus the manufacturer), this is one way the US government directly makes money, provides a form of corporate welfare (for the defense industry), and subsidizes its weapon system development.

<comment><USER6> I'm not seeing a problem here, assuming the hardware sold works as intended of course.

<comment><USER4> > even if they have no real utility, need, or capability to use them.

This is the critical part. The hardware may work as intended, but if no one can operate it what use is it? If it works as intended but is ineffective against the enemies weapons or techniques what use is it? Or if there isn't even an enemy to use these systems against? But to play ball with the US as an ally, nations can be placed in a position where they're making these purchases whether appropriate or not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> The mentioned 1991 issues with the Patriot Missile were due to an issue converting integers to floats.

      The [system's] prediction of where the Scud will next appear is a function of the Scud's known velocity and the time of the last radar detection.
      Velocity is a real number that can be expressed as a whole number and a decimal (e.g., 3750.2563 . . . miles per hour).
      Time is kept continuously by the system's internal clock in tenths of seconds but is expressed as an integer or whole number (e.g., 32, 33, 34 . . .).
      The longer the system has been running, the larger the number representing time.
      To predict where the Scud will next appear, both time and velocity must be expressed as real numbers.
      Because of the way the Patriot computer performs its calculations and the fact that its registers are only 24 bits long, the conversion of time from an integer to a real number cannot be any more precise than 24 bits.
      This conversion results in a loss of precision causing a less accurate time calculation.
      The effect of this inaccuracy on the [system's] calculation is directly proportional to the target's velocity and the length that the system has been running.
      Consequently, performing the conversion after the Patriot computer system has been running continuously for extended periods causes the [system's estimated Scud position] to shift away from the center of the target, making it less likely that the target will be successfully intercepted.

See also [http://cs.furman.edu/digitaldomain/themes/risks/risks_numeri...](http://cs.furman.edu/digitaldomain/themes/risks/risks_numeric.htm)

<comment><AUTHOR> There was just a single failure due to the arithmetic bug (and they patched the software the day after it happened). The general bad performance of Patriot missiles in the gulf war was because shooting down ballistic missiles is hard, not because of a discrete bug.

Incidentally, although this is often described as a "floating point bug", the actual arithmetic was 24-bit fixed point. In order to convert from tenths of seconds to seconds they multiplied by 1/10 = 0.00011001100110011001100. If they had used a floating point format with a 24-bit mantissa, they could have multiplied by 2^-3 * 0.110011001100110011001100, giving 4 more bits of precision, which would probably have been enough to intercept the missile! :)

Also perhaps interestingly, the problem only arose because a software upgrade had introduced a new function to do the conversion more accurately, but didn't call it everywhere. If they had used the old inaccurate conversion throughout, the errors would mostly have cancelled out.

See [http://www-users.math.umn.edu/~arnold/disasters/patriot.html](http://www- users.math.umn.edu/~arnold/disasters/patriot.html)

</comment></comment><comment><USER8> Patriot missiles did more damage than Iraqi SCUDs fired at Israel (they are technically responsible for the only Israeli casualty in the war) in 1991 which is why right after Israel went on full steam with the development the Arrow.

US missile defense was always a mess.

</comment><comment><USER9> Just wanted to say, for sure there's wrong stuff everywhere (a couple of versions of failed missiles maybe), somewhere in the system, but America is by far one of the best countries in the world to have been born, and I'm not being a crazy fan or something, just stating the facts. I think many people in there just like to critizice a little too much about everything, not usually from objectivity (not knowing how actually difficult is to keep things going ok). Many would like to have half a country like the one you have there. Just saying.

</comment><comment><USER10> Theory: it's a bluff. You want to at least convince the enemy that their missiles are getting shot down. Trying to mislead the enemy via newsmedia is at least a century old (in some ways much older).

Problem: social media, and a very fragmented internet newsmedia sector, make this less effective than before. The Houthis no doubt are aware that the Saudis are not successful.

</comment><comment><USER11> Maybe it's only good at friendly fire? [http://news.bbc.co.uk/2/hi/uk/2877349.stm](http://news.bbc.co.uk/2/hi/uk/2877349.stm)

 _Patriot: killing allies in the skies and civilians on the ground since 1990._

<comment><USER11> Son et Lumière - full of sound and fury, signifying nothing

[http://www.moonofalabama.org/2018/03/two-failures-in-one- day...](http://www.moonofalabama.org/2018/03/two-failures-in-one-day-missile- defense-is-an-embaressment-it-wont-work.html)

</comment></comment><comment><USER12> PAC2 is downright dangerous to the people firing the missiles! From failing to intercept, exploding too late, software bugs, the whole system is an engineering joke.

</comment><comment><USER13> I don't know anything about this issue but am interested in learning more. Has anyone read any other reports like this about the Patriot system?

</comment><comment><USER14> Fortunately, there's a sucker born every day:

[https://www.reuters.com/article/us-raytheon-poland- patriot/p...](https://www.reuters.com/article/us-raytheon-poland- patriot/poland-signs-4-75-billion-deal-for-u-s-patriot-missile-system-facing- russia-idUSKBN1H417S)

<comment><USER15> FWIW Poland is getting the PAC-3 Missile Segment Enhancement (MSE), a newer variant that entered service in 2015

[https://www.bloomberg.com/news/articles/2018-03-28/poland- si...](https://www.bloomberg.com/news/articles/2018-03-28/poland- signs-4-75-billion-patriot-missile-deal-with-u-s)</comment></comment>


Kindle Edition of Effective C++ for $2.99 (US) - <AUTHOR> http://www.amazon.com/Effective-Specific-Improve-Programs-ebook/dp/B004V4420U/

<comment><USER2> When I click through, the Kindle Edition costs $31.30.</comment>


Show HN: PC-Hardware Recommender - <AUTHOR> http://www.pc-kombo.de/

<comment><AUTHOR> It's my project for quite some time now. Note that it is in german and using data for the german market.

Basically it grabs as much cpus and gpus as possible from amazon and then uses two benchmarks to calculate the best combination for the budget.

I'd appreciate any feedback</comment>


Show HN: Dweb.page – Your Gateway to the Distributed Web - <AUTHOR> https://github.com/PACTCare/Dweb.page <comment><USER2> It's been quiet around IOTA for a while, ... incomprehensible why anyone would use IOTA for anything. it is run by people (come_from_beyond and other questionable characters whose understanding of Math can best be summed up as "Numberwang"). People who think that collision resistance doesn't have to be a primary feature of a hash functions.

the IOTA guys have been ignorant towards any criticism from the cryptography experts (ask people like Matthew D Green and others). IOTA is a total clusterfuck. Don't use it. Or if you do please check at least twitter to see what people with an actual idea are really saying.

[https://ftalphaville.ft.com/2018/04/25/1524628801000/FUD-- in...](https://ftalphaville.ft.com/2018/04/25/1524628801000/FUD--inglorious- FUD/)

[https://twitter.com/peterktodd/status/938397135862714373](https://twitter.com/peterktodd/status/938397135862714373)

[https://twitter.com/search?q=%40matthew_d_green%20IOTA](https://twitter.com/search?q=%40matthew_d_green%20IOTA)

<comment><USER2> Also if you find problems with the project, would be a great idea to use the issue tracker: [https://github.com/PACTCare/Dweb.page/issues/2](https://github.com/PACTCare/Dweb.page/issues/2)

<comment><AUTHOR> Here also my repsons, since people might not open the github issues: "I'm aware of these early issues, and I'm also aware that they replaced the hash function with KECCAK-384 for the proof of work and in general have grown a lot since then as well as hired a lot of people including cryptographers. But all that aside, this project uses IOTA simply as an immutable database with some additional spam protection. For the encryption, we are using the web crypto API (AES256-GCM). If you have ideas for a potential IOTA replacement feel free to share them. I'm completely open here. For example, I looked into orbitdb, but I haven't included it for multiple reasons (e.g., hosting an ipfs gateway inside a website isn't ideal and it hasn't any spam protection)."

<comment><USER3> You might find Holochain to be a suitable replacement for IOTA.

[https://holochain.org/](https://holochain.org/)

<comment><AUTHOR> Interesting project. Thanks for sharing it, without the typical cryptocurrency fight. I'm in this simply for learning and playing around with the technology.

</comment></comment></comment></comment></comment><comment><USER4> Why on earth would you use IOTA for this? Even ignoring its ignominious history, the security paper itself acknowledges that IOTA currently isn't an "immutable ledger" at all:

>at the moment the log entries on IOTA will be deleted after a certain time and won't be stored indefinitely on the ledger. Therefore, it is highly recommended to download the generated CSV files from time to time, which contain all the information about the logs. It is expected that the IOTA Foundation will release a solution for this problem in the coming month.

<comment><AUTHOR> The advantage of IOTA compared to for example OrbitDB is that you want some kind of proof of work for the metadata. Otherwise everyone can just create instantly millions of fake entries. However, regarding the mentioned snapshot problem, you can of course then create a simple copy of the IOTA tangle entries on orbitDB.

</comment></comment><comment><USER5> "Distributed Web" \-- Wikipedia fails me, but some clarity emerges from

[https://ipfs.io/](https://ipfs.io/)

"IPFS aims to replace HTTP and build a better web for all of us."

[https://medium.com/textileio/enabling-the-distributed-web- ab...](https://medium.com/textileio/enabling-the-distributed-web-abf7ab33b638)

"the basic idea is we identify content by its cryptographic hash... I can simply ask the IPFS network for the file with that exact CID, the network will find the peers that have the data (using a DHT), retrieve it, and verify (using the CID) that it's the correct file."

<comment><USER6> Could this possibly make search engine monopolies impossible?

</comment></comment><comment><USER7> Tutorial: How to host your own file transfer service on your pc [https://blog.florence.chat/tutorial-how-to-host-your-own- fil...](https://blog.florence.chat/tutorial-how-to-host-your-own-file- transfer-service-on-your-pc-22698c9d6362)

</comment><comment><AUTHOR> Thanks for all the upvotes! I quickly created a tutorial on how to host your own writable ipfs gateway and support the distributed web: [https://blog.florence.chat/tutorial-host-your-own-ipfs- node-...](https://blog.florence.chat/tutorial-host-your-own-ipfs-node-and- help-the-next-generation-of-web-2860eb59e45e) If you find any errors or have any questions just let me know.

</comment><comment><USER8> Looks great. Especially because it seems to have a distributed search solution. How well will IOTA scale?

Does IPFS really not have a Windows installer? Because that actually requires a lot less effort for non-technical people than a chdir and then running something in cmd.exe

<comment><USER9> For IPFS you can use Siderus Orion: [https://orion.siderus.io](https://orion.siderus.io) as it is designed for non-technical people

<comment><USER8> That's great. There should be an MIT option though.

</comment></comment></comment><comment><USER10> Your logo looks almost identical to web.com's logo.

<comment><AUTHOR> Interesting. The logo actually took me only a few minutes is based on my previous logos (e.g. pact.care). I'm always just using quicksand plus dot, since I'm not a designer

</comment></comment><comment><USER11> Perhaps not the best name, given the similarity to `dweeb`.

<comment><AUTHOR> I know :-D, but there are also these articles: [https://hacks.mozilla.org/2018/07/introducing-the-d- web/](https://hacks.mozilla.org/2018/07/introducing-the-d-web/) [https://www.theguardian.com/technology/2018/sep/08/decentral...](https://www.theguardian.com/technology/2018/sep/08/decentralisation- next-big-step-for-the-world-wide-web-dweb-data-internet-censorship-brewster- kahle)</comment></comment>


California Legislature Sells Out Our Data to ISPs - <AUTHOR> https://www.eff.org/deeplinks/2017/09/california-legislature-sells-out-our-data-isps <comment><USER2> California residents: write your representatives! [http://findyourrep.legislature.ca.gov/](http://findyourrep.legislature.ca.gov/)

<comment><USER3> How many decades of writing representatives and wasting votes will it take before people wise up? Clearly this isn't working, time for a new strategy.

<comment><USER4> Fair enough. Let's crowdfund a lobbyist.

Alternatively, get involved in the city Democratic clubs and county central committees here in California. Politicians do pay attention to people who organize fundraisers for them, and the local groups are where the next generation of politicians are picked. Politics is a lot like science in that regard: policies last until their supporters die, or are term-limited.

<comment><USER5> > Fair enough. Let's crowdfund a lobbyist.

That's essentially what nonprofits like the EFF are.

</comment></comment></comment></comment><comment><USER6> Be sure to vote for next year's ballot initiative which imposes similar privacy protections on all businesses in CA, including ISP's.

<comment><USER7> Which one is that? There are only 3 certified so far and none of them are about privacy: [https://ballotpedia.org/California_2018_ballot_propositions](https://ballotpedia.org/California_2018_ballot_propositions).

<comment><USER8> [https://ballotpedia.org/California_Consumer_Personal_Informa...](https://ballotpedia.org/California_Consumer_Personal_Information_Disclosure_and_Sale_Initiative_\(2018\))

Added: I haven't looked closely at either, but it seems at a glance that the initiative is far broader than the bill (which only applies to ISPs), so would guess the initiative will attract a truly massive negative campaign if it makes it to the ballot.

<comment><USER9> Good. And I hope that the response to every negative ad, opinion piece, etc. is "So, about Equifax and their punishment..."

Being able to hang the Equifax albatross around Google, Facebook, etc. is going to be glorious.

</comment></comment></comment></comment><comment><USER9> This is the actual headline, and I hate the EFF for creating it.

There is a _VAST_ gulf between not passing a bill that would have created a positive situation, and actually passing a bill that creates a negative situation.

In addition, this need for this bill was created by the _FCC_ ripping up the privacy protections, so it got introduced very late in the session. As the article points out, the fact that it got this far so quickly is a huge deal.

<comment><USER10> Yeah, the EFF also tries to have it both ways, starting off with the inflammatory sell-out headline and opening of the press release, and then claiming that the bill is just stalled until next year, has wide support in the legislature that is what enabled it to get so far despite the late introduction, and has momentum for next year. It's a real failure at coherent messaging.

</comment></comment><comment><USER11> FWIW, you can find info about AB 375 on the CA legislature's website, including history and bill analysis:

[https://leginfo.legislature.ca.gov/faces/billAnalysisClient....](https://leginfo.legislature.ca.gov/faces/billAnalysisClient.xhtml?bill_id=201720180AB375)

The Bill Analysis section contains a document, Senate Floor Analyses [0], that explains the context of the bill, and lists the entities that have taken a position for or against the bill, e.g. supported by the ACLU and SF Mayor Edwin Lee, opposed by AT&T, Google, and various chambers of commerce.

The latest event for the bill is "9/16/2017 Ordered to inactive file at the request of Senator McGuire". According to this glossary [1], the "Inactive File" means:

> _The portion of the Daily File containing legislation that is ready for > floor consideration, but, for a variety of reasons, is dormant or dead. An > author may move a bill to the inactive file if they wish not to take it up > until a later date. Once a bill is on the inactive file, it requires one > day's public notice to place the bill back on the daily agenda_

From what I can tell, Senator McGuire (a Democrat), voted to pass it out of the energy committee in July [2].

Sorry, I don't have any specific knowledge about the CA legislative process other than what I can find ono Google, so I don't know what the reasoning or bureaucratic implications are for shelving it, but it's not a done deal apparently.

[0] [https://leginfo.legislature.ca.gov/faces/billAnalysisClient....](https://leginfo.legislature.ca.gov/faces/billAnalysisClient.xhtml?bill_id=201720180AB375#)

[1] [http://www.cacttc.org/assets/documents/Glossary%20of%20Legis...](http://www.cacttc.org/assets/documents/Glossary%20of%20Legislative%20Terms.pdf)

[2] [https://leginfo.legislature.ca.gov/faces/billVotesClient.xht...](https://leginfo.legislature.ca.gov/faces/billVotesClient.xhtml?bill_id=201720180AB375)

</comment><comment><USER12> Corruption prevails.</comment>


Watch Your Freedom (Because Apple's Not) - <AUTHOR> https://www.fsf.org/blogs/community/watch-your-freedom-because-apples-not

<comment><AUTHOR> "Apple's failure to release the source code for these products and software violates users' freedoms to study, modify, and distribute software"

and more in the campaign to boycott Apples use of DRM and to promote free software</comment>


Gmvault: gmail backup. Liberate your emails - <AUTHOR> http://gmvault.org/ <comment><USER2> if your tagline is "For geek and non-geek users." then you probably should not be depending on users to open a shell and type commands there to access their emails.

For this to be remotely useful for non-geeks, try adding a small IMAP server so people can access the mails through their mail clients. Having to re-upload all mail back to a (presumably new) gmail account will take ages and accessing the mails locally is not really helpful these days with mime encoding and HTML email.

On a related note: If you have a small box with a PTR record laying around somewhere, you can use my setup described at <http://pilif.github.com/2011/02/how-i-back-up-gmail/> to route all incoming and outgoing mail through a mail server you own as it moves to and from gmail.

If you ever lose your google account or its data, all mails will be on your small box in convenient maildir format, ready to be served over IMAP.

<comment><USER3> > _try adding a small IMAP server so people can access the mails through their > mail clients. Having to re-upload all mail back to a (presumably new) gmail > account will take ages and accessing the mails locally is not really helpful > these days with mime encoding and HTML email._

One of the stated purposes of this tool is to "liberate your emails" by letting you keep local copies of every e-mail you send and receive. If you need to use a third-party IMAP server to keep a backup of your e-mails, how does that liberate you? Now you're dependent on two online services instead of one.

Reading locally stored e-mails would be a problem for non-geeks, though. But I think the right way to solve that problem would be to offer a program to read those e-mails, or even better, a plugin to a popular mail client (such as Thunderbird) so that the e-mails can be accessed through the mail client. Depending on the "cloud" just detracts from the stated purpose of this tool.

<comment><USER2> I wasn't talking about a third party IMAP server. I was talking about adding an IMAP darmon right in the backup application itself.

That way, if your google account goes away (I guess we all agree that administrative account lockout is way more likely than google actually losing data) and you need an email RIGHT NOW, you would just configure any imap client to use the daemon provided by the backup application (localhost:143)

Or it could bundle some web based mail client and then open a browser.

It's impractical to reupload the whole backup to gmail before being able to access your mail.

<comment><USER3> Thanks for the clarification, it seems that I misunderstood your comment. A local IMAP server would fit right into my suggestion of mail client integration, without the headache of writing a plugin.

But now you've got a background process running on a privileged port, yikes! (It's got to be a daemon that starts automatically, because "non-geeks" will not understand why they have to start another program before accessing their mail in Thunderbird.)

<comment><USER4> Better option (IMNSHO), if someone wants to read the email they don't REALLY care if it's as an email. So a reader application that parses the DL'd file so that you can do rudimentary search, find what you want, and then copy/paste as necessary.

</comment></comment></comment></comment></comment><comment><USER5> Just a few weeks ago I was looking for exactly this piece of software! What brilliant timing.

But a quick question of concern - gmail is pretty smart and can tell when I am just using it for bulk storage. If you send yourself 8 emails in a short amount of time, each with maximum sized attachment sizes, gmail will politely tell you to cut it out for a while.

Does this software run the same risk? I am wary to let it just keep barging in after connection errors, if there's a chance gmail will get upset and ban me from my own account. My gmail is my lifeblood, and I want to back it up from the entity that scares me the most of taking it away from me.

Thanks for making this!!

<comment><USER6> It should be no different from what would happen if you connect a new imap program that does a full sync of your mailbox, which many do.

</comment></comment><comment><USER7> Sweet! I'm gonna keep my gmail backup on my google drive!

<comment><USER8> Err, isn't there a flaw in that plan?

Surely the back-up should protect you in case you lose access to your Google account...

<comment><USER9> I think he was trying to be subtly ironic. Perhaps too subtle.

<comment><USER8> I wondered that after I wrote the reply.

However, I bet some people do use google drive to back-up other google services. It's not ironic, just foolish IMO.

<comment><USER10> You can always create different Google accounts for each service. My "main" account (Reader, Youtube, etc) was never tied to my Gmail & Calendar account, and the probability of losing both at the same time is rather small.

<comment><USER11> Not as small as you may think. Do you really believe that Google can't connect the dots (or the IP addresses) and figure out that both accounts are associated with the same person?

<comment><USER12> They'd have to tread carefully. Would suck to have an entire university banned from Google services ;)

<comment><USER11> True... but I imagine they can also distinguish between frequently-shared IPs and rarely-shared ones.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Great tool, awesome work. Gmail should really offer a link to backup your mail though. I know you can do it with mail clients and this, but its annoying I cant just download one big zip file from gmail itself.

<comment><USER14> I imagine (and I'm not speaking for my employer here) that it has to do with cost: if the easiest way to backup your email is by using IMAP or POP, it's essentially an incremental backup mechanism. If the easiest way to backup your email is by clicking a link which contains all your email in a .zip file, it would be a non-incremental backup system and its cost would be much higher, because people would be far more likely to repeatedly download the same emails.

<comment><USER13> Maybe there could be a few options? Download all mail, download by month, download by year? Seems like they could solve that problem pretty easily and would be very awesome.

<comment><USER14> Offering different zipfiles for months/years wouldn't solve the problem. "The problem" is that when you have hundreds of millions of users, the easiest mechanism needs to be an efficient mechanism. Adding links for months/years would still leave the _easiest_ mechanism as the least efficient: I know that I, personally, would continue to download the "all mail" zipfile just to ensure that I didn't miss anything. I cannot imagine my mother or grandmother doing anything different.

</comment></comment></comment></comment><comment><AUTHOR> Thank you all for the feedback and support. It's been great and proved that a simple tool up for that task is needed by plenty of people.

If you would like to participate and help me developing Gmvault contact me on twitter at @zoobert or via email: guillaume((dot))aubert((at))gmail((dot))com

I will now work hard to finalize Gmvault and produce the first final release (available within a month).

If you would like to report some issues or would like extra features: submit them to <https://github.com/gaubert/gmvault/issues>

</comment><comment><USER15> No promises, but I think we will enable this on rsync.net storage arrays...

We already have s3cmd in our environment, so you can:

ssh email@example.com s3cmd get s3://rsynctest/mscdex.exe

So if we put this into the environment, you could call it over SSH:

ssh firstname.lastname@example.com gmvault sync firstname.lastname@example.com

... which is fantastic.

More like this.

<comment><AUTHOR> Awesome. Let me know if you need some support.

<comment><USER16> Any chance you could build S3 support into Gmvault? So you could cron it on a linux box to connect to Google and push all the data into an S3 bucket? If money is an issue, I'd be interested in footing the bill.

<comment><AUTHOR> This is something I have in mind: Cloud save. It will be added in the roadmap. Please contact me and I will keep you in the loop. Regarding the money I am thinking of adding a donate button to support the project.

</comment></comment></comment></comment><comment><USER17> Small nitpick: the application name "Gmvault" is inconsistent with the tagline "Liberate your emails", since one does not normally associate vaults with liberation. Maybe something like "protect your email" would be more vault- appropriate?

<comment><AUTHOR> ;-) I like that. Thanks for helping me keeping the theme right

<comment><USER17> Also, don't go with exactly "Protect your email", since it sounds kind of bland. Just something like that. Maybe "Safeguard your email". Find an exciting synonym for "protect"!

<comment><USER18> Or maybe "Stash your mail"

</comment></comment></comment></comment><comment><USER19> I just use fetchmail to grab everything (except spam) from gmail anyway but this:

"With the restore command Gmvault can recreate your gmail mailboxes in any Gmail account. All attributes such as Gmail labels are preserved and recreated. With restore, you will recover your Gmail account exactly as it was."

I would use it just for that! When I wanted to unify my email/calendar etc. under one account there didn't seem to be anyway of transporting existing gmail over. Gmail doesn't even have a way to do it if you decide to start _paying_ them!!

</comment><comment><USER20> Granted this isn't working for me to begin with (<http://i.imgur.com/yLzyy.png>), but will this tool work to archive Google Apps email accounts? eg. Gmail accounts that do not end in gmail.com?

<comment><AUTHOR> At the beginning of the bash script gmvault there is a variable called GMVAULT_HOME. If instead of .. you had the full path to the gmvault-v1.0-beta dir that should work. If there are more problem could you please run it like this: $>sh -x ./gmvault sync .... and send me the console print.

I will fix that in the next version. Thanks for the feedback

<comment><USER20> Still not working for me, I will send you an email. Thank you for working on this tool though - our company would gladly pay for an enterprise version of this (especially if it was a bit more seamless and integrated with Google Apps somehow).

</comment></comment></comment><comment><USER21> Hey: I"m trying it out, and its not entirely clear if its properly incremental. To whit, if I halt it mid backup and start it up again, it seems to start from scratch all over again.

am I miss interpreting how its working?

</comment><comment><USER22> For anyone trying to get the Linux version to work, here's what worked for me.

1\. Download the tgz and unzip.

2\. Create and activate a new virtualenv in that directory.

3\. easy_install -U distribute (in my case, the version of distribute installed by pip was too old for imapclient)

3\. pip install logbook gdata imapclient

4\. Replace bin/gmvault with the following

        #!/usr/bin/env python
        import sys
        import os

        sys.path.insert(0, os.path.abspath(os.path.join(sys.path[0], '../lib')))

        import gmv.gmv_cmd as runner
        runner.bootstrap_run()

<comment><AUTHOR> the release on HackerNews is a bit premature. I wanted to test the response and was not expecting so much interest. I will fix the deployment issues on Linux and Mac OS X. You can download the tgz and run a michael said.

You can also use easy_install or pip. It is on Pypi Create a virtualenv as it is better and do: pip install gmvault (or easy_install gmvault)

See <http://gmvault.org/install.html#py_install> for further info

</comment></comment><comment><USER23> wha's the difference between this and a tool like offlineimap?

<comment><USER24> As an OfflineIMAP user, I see a few immediate differences:

1\. OfflineIMAP expects standard IMAP servers. GMVault has special casing to handle Google's wonky IMAP support, along with features like labels and the "All Mail" directory.

2\. OfflineIMAP is GPLv2 (or 3, at your option). GMVault is GPLv3.

3\. OfflineIMAP syncs to either a local Maildir or another IMAP server. GMVault syncs to its own custom on-disk representation.

4\. OfflineIMAP uses a username/password to log in to servers. GMVault uses XOAuth.

5\. OfflineIMAP is fully bi-directional by default; local deletion propagates to the remote server. GMVault notes that "manually deleting emails or emails' directories does not prevent Gmvault from working."

6\. GMVault can encrypt its own archives. OfflineIMAP cannot.

Basically, GMVault looks like a much less general-purpose tool, but in its specialization, should allow for a much nicer experience for users that simply want a backup for their GMail account.

I'm fond of the versatility that OfflineIMAP gives me (I can restore my mail to any IMAP server, not just GMail; I can access the local Maildir with other applications like Dovecot and Mutt; etc.), but excited about the possibilities of GMVault for friends and family.

"Do you have your GMail backed up? No? Here, let me install GMVault for you..."

<comment><USER25> I believe that OfflineIMAP now has gmail-specific code (type = Gmail) :

[http://docs.offlineimap.org/en/latest/MANUAL.html#sync- from-...](http://docs.offlineimap.org/en/latest/MANUAL.html#sync-from-gmail- to-another-imap-server)

<comment><AUTHOR> it is only to backup specific target labels (or imap directories). If you ever restore your Gmail account with OfflineIMAP then I think that you will loose partly this information. I would say the purpose of these tools is different.

</comment></comment></comment></comment><comment><USER26> I used another Gmail backup tool once that made all my emails "read". Does this do that too?

<comment><AUTHOR> Normally yes or as I said above it is a bug and you should report it there: <http://gmvault.org/report_pb.html>

<comment><USER26> Thanks for the reply. Your answer is confusing, but I see from your other replies that GMVault is supposed to preserve read/unread status.

<comment><AUTHOR> I responded to the wrong comment. Normally it should preserve unread messages

</comment></comment></comment></comment><comment><USER27> Oh wow - this is really interesting. I just released a VERY similar program called `gmail-safe` yesterday. I was going to do a Show HN sometime today.

If anyone is interested, here is the URI: <http://eblume.github.com/gmail_safe/>

Note that this is my first Node app. It needs a lot of polish. It is published under the MIT license, though, which some people here might enjoy.

</comment><comment><AUTHOR> tools is still in beta. Comments, features are welcome.

<comment><USER28> I love the idea, but I wasn't able to use it. <http://cl.ly/2m170D012X370n1g2K0S>

OSX has some niceties for python apps, you could use py2app to make it an actual binary rather than a folder or bundlebuilder.

<comment><USER29> Same here. Installing with pip (not in a virtualenv), and I get

        Cannot find the python executable to set env var PYTHON_BIN.
        Please check where your python binary is.

<comment><USER30> if python is in your path, just edit gmvault, delete the PYTHON_BIN stuff starting at line 24 and add PYTHON_BIN="python"

That should work if python is on your path.

<comment><USER29> Thanks, works like a charm now.

</comment></comment></comment></comment></comment><comment><USER31> Nice tool! I think the default sync interface should show a progress bar (like wget). Now it says: Processing 7890 emails, but then it prints a line for every email. I don't need to see every email in a list, but I would like to see how long it takes to complete. Update: I see it does print that every once in a while. I would skip the other lines... :)

<comment><AUTHOR> Thanks for the feedback. I will think on how to present operation progresses (progress bar and so on with curses and so on)

</comment></comment><comment><USER32> I think it is great that you are getting a lot of good feedback and constructive criticism from the community, but I just wanted to say thank you! I've been looking for a simple tool like this for a while, and Gmvault is perfect. I'm sure that you will add polish and new features in the future, but I'm glad that you released when you did.

</comment><comment><USER33> My first thought was "cool, I certainly have to use this", and switched to something else.

I just came back and started to perform a backup. I think you should, too. This is insurance.

For the author: the link from the "Learn More" is broken. It should probably point to _install_ , not _documentation_.

<comment><AUTHOR> Thanks I fixed it. Sorry for the premature launch I think it was somehow a mistake (too early) but I needed a boost to be sure that I was doing something useful.

</comment></comment><comment><USER34> I think people familiar with command-line tools are already probably doing what I do, which is to use mbsync to sync a remote gmail imap account to a local maildir. It even easily supports multiple sync account/maildir pairs via its somewhat confusing config file format.

<http://isync.sourceforge.net/mbsync.html>

</comment><comment><USER35> If this fails/stops in the middle of syncing, will it restart at the point of failure or start from the beginning again?

<comment><AUTHOR> Yes it has these kind of mechanisms are embedded: If there is an error in the middle of a syncing then Gmvault will wait few seconds and try to restart the current operation. After 4 attempts it will leave in error. Gmail imap servers can start to throttle the transfer and also cut the connection. Gmvault also has a restart mode (option --restart) to restart where it was. Actually up to 20 emails before because Gmvault save its "position" (email id synced or restored sucessfully) regularly.

</comment></comment><comment><USER36> As it stands, this could not work with local mail clients because of the custom storage format. Why is that, gmail meta data?

It would be very impressive if gmailvault functionality could be combined with a local mail client then you could get both a full (uploadable to gmail) backup of the gmail-box and non-browser access.

</comment><comment><USER37> No resume functionality? Or am I just missing something? I've got ~3 GB of emails in my Gmail, and GVault's ETA is 4 hours.

It already timed-out once (no discernable reason), and after restarting, went right to email number 1 (forgetting about the 1800 emails it had already gotten through).

<comment><AUTHOR> Thanks for the feedback. There is a restart functionality use the --restart option (see gmvault sync -h for more info). Also note that when you restart from scratch, if the email has already been downloaded and is identical then the download is not performed. So only scanning the mailbox is faster than having downloads.

Regarding the timeout, please send me the error message you had and if it is a bug I will fix it but note that sometimes Gmail cut the connection without any reasons. There is also a retry reconnect process (up to 4 times) if it is not a fatal error (cannot recover from them).

<comment><USER38> Restart doesn't seem to be available. <https://github.com/gaubert/gmvault/issues/4>

<comment><AUTHOR> yes it is there for the restore operation but not for sync. It will be available in the next version (to be released in 2 weeks)

</comment></comment></comment></comment><comment><USER39> Does this use SSL to grab the emails?

<comment><USER24> Be default, yes: [https://github.com/gaubert/gmvault/blob/master/src/gmv/imap_...](https://github.com/gaubert/gmvault/blob/master/src/gmv/imap_utils.py#L194)

However, if I recall correctly, Python's built-in SSL support doesn't do certificate verification, so you're still completely open to man in the middle attacks.

<comment><USER40> That's a good point, and a tool like this probably really should be verifying the host.

(To the author) See [http://stackoverflow.com/questions/1087227/validate-ssl- cert...](http://stackoverflow.com/questions/1087227/validate-ssl-certificates- with-python) for multiple options to accomplish this.

</comment></comment></comment><comment><USER41> It didn't work for me (TypeError: 'NoneType' object is not iterable), I opened an issue on github.

<comment><USER42> Here's a workaround from the GH issue's comments:

Solution: set 'Show in IMAP' in Settings->Labels->All Mail on gmail.com

[https://github.com/gaubert/gmvault/issues/2#issuecomment-555...](https://github.com/gaubert/gmvault/issues/2#issuecomment-5557075)

</comment></comment><comment><USER43> You might want to consider another name in light of the Google Vault product: [http://www.google.com/enterprise/apps/business/products.html...](http://www.google.com/enterprise/apps/business/products.html?section=vault)

</comment><comment><USER44> Wow, very cool! This is exactly what I needed right now. I had bad dreams about what would happen if my Google account disappeared all of the sudden, but didn't do anything about it yet. Now I will be able to sleep better!

</comment><comment><USER45> Has no one mentioned search? intra-gmail search is nothing short of an atrocity compared to the google.com search... A search feature capturing partial terms "Aft" in "Afternoon" would more than make this service viable.

</comment><comment><USER46> I've been doing this for quite some time using getmail [https://wiki.archlinux.org/index.php/Backup_Gmail_with_getma...](https://wiki.archlinux.org/index.php/Backup_Gmail_with_getmail)

<comment><AUTHOR> It is only one way: Gmail to disk. When you restore the emails to a Gmail account you will loose part of the info (labels, ....).

</comment></comment><comment><USER47> "After that Gmvault will automatically authenticate itself using the credentials stored in $HOME/.gmvault (or %HOME%/.gmvault for Windows). " how are the credentials stored offline?

<comment><USER48> Probably as clear text. You can delete the file if you want to.

<comment><AUTHOR> Nop they are stored encrypted with a key randomly generated

</comment></comment></comment><comment><USER49> How is this better than <http://code.google.com/p/got-your-back/> which does almost exactly the same thing?

</comment><comment><USER50> When restoring a gmail account (say I want to upload all the backed-up emails to a new account), would the date information be preserved as well?

<comment><AUTHOR> Yes of course. Date, Gmail labels and IMAP flags (READ, UNREAD, ...) are preserved. Otherwise it is a bug so please refer to <http://gmvault.org/report_pb.html>

<comment><USER50> Another question: Does gmvault work behind a proxy?

<comment><AUTHOR> If the proxy let you connect to the Gmail IMAP server, I don't see why it wouldn't work

</comment></comment></comment></comment><comment><USER51> What is the switch to encrypt the archives? gmvault -e? I haven't been able to find it in the documentation.

</comment><comment><USER52> Why would a techie need this product? We know how to turn on POP3 in a mail program.

</comment><comment><USER53> Can this store mail in mbox format? In what header do the gmail labels go?

<comment><USER24> The source is pretty easy to read. Here's how it's working: [https://github.com/gaubert/gmvault/blob/master/src/gmv/gmvau...](https://github.com/gaubert/gmvault/blob/master/src/gmv/gmvault.py#L38)

(It stores each mail in two separate files: a .eml file with the message body, and a .meta file with metadata.)

<comment><AUTHOR> I will take that as a compliment. Yes files are all stored individually as .eml file. All the extra Gmail info (labels, ...) goes in .meta

</comment></comment></comment><comment><USER54> Is there a way to make Thunderbird or Mac's Mail do the same thing?

<comment><USER9> Yes, but it won't keep the gmail labels etc. And I doubt it would do a restore to gmail.

<comment><USER55> Ah, so this is the value-added proposition.

</comment></comment></comment><comment><USER56> does this have any issues when you have 2-part authentication configured for Gmail? Well, I guess I'll find out in a second and report back :)

</comment><comment><USER57> How does this compare to mbsync?

<comment><AUTHOR> mbsync is a IMAP sync tool. Gmvault is a dedicated Gmail tool so it preserves all Gmail specific attributes like the labels, ... and allow you to restore all your emails in a Gmail account. With mbsync you might be able to upload your emails on a gmail account but you would then loose lots of information and your restored gmail account would be end up being very different.

</comment></comment><comment><USER58> Is there any data transmitted to servers other than Google's?

<comment><AUTHOR> Nop of course not. You can check the sources to be sure that Gmvault is only talking to Gmail. You can also use XOAuth (token security mechanism) to allow Gmvault accessing your account. This is by the way the recommended authentication way.

</comment></comment><comment><USER59> OP: I understand I will collect down votes with this comment but, seriously, you gave credit to everybody in the footer except to Twitter Bootstrap, which you didn't even bother to personalize. Is that part of the brogrammer code, guzzle down some redbulls, fire up bootstrap and don't even bother about it?

Invest a bit of time in the looks of your service/startup, if it looks like the next service/startup, it's just another Boostrap themed website that people (I assume) are tired of.

<comment><AUTHOR> Uuuuh I think there is scale issue. This is an open source tool that I am willing to support. I do not intend to create a start-up here. Still you are right and I will reference bootstrap.

<comment><USER59> I understand that and it's pretty awesome. Have the frontend on Github and I can help you tweak it out. Open source stuff should look awesome as well.

<comment><AUTHOR> It is available on the gh-pages branch of the Gmvault github repository (<https://github.com/gaubert/gmvault/tree/gh-pages>). Pull it and submit your suggestions. Many thanks.

</comment></comment></comment></comment><comment><USER60> Crappy design + twitter bootstrap default = tab closed. If you are serious about releasing a product ffs make sure it's polished. If the attention to detail I see in the splash page is similar to the attention to detail in the actual product (which is what I assume automatically), my faith in it is close to zero.

This is ESPECIALLY important when I'm authorizing you with access to my emails -- and there is no way I would do that for someone that I assume is not serious about their product.

<comment><USER61> You left out the part where you were swirling your wine in its glass and adjusting your top hat while angling your nose sharply toward the sky.

HN is a place where lots of launches happen. A place where open mindedness is a plus. Seriously.. if this is actually your attitude, you might miss some cool things. Take a step away from the hive mindset every now and then.

<comment><USER60> There's no hive mindset here - I just looked at the page, noticed that it had really poor and sloppy design, and assumed that it was a poor and sloppy product. It's called 'judging a book by it's cover' and is something that everyone does automatically (regardless of the classic advice).

Craigslist aside, you'll be hard pressed to find a successful product that has no attention paid to design whatsoever. Design is important, and it makes me really sad to see it neglected, and so many people supporting not caring about design here (as indicated by comments like this and downvotes)

<comment><USER10> Design is important, but this project has a decent design, your prejudice against Bootstrap -which I'm pretty sure most people don't share- notwithstanding.

The typography is decent, the utility of the project is immediately understood (without even having to scroll), the call to action is present and it's two clicks from the main page to having the application downloading.

You're advocating for "prettiness," which is frankly the least important part of design.</comment></comment></comment></comment>


Tulip: cross platform graph visualization software - <AUTHOR> http://tulip.labri.fr/TulipDrupal/ <comment><USER2> That looks really impressive. I'll definitely have to give it a try.

Here's hoping the source is decent to read, too, Graphviz is a nightmare and I've been curious how to do some of these things.

</comment><comment><USER3> This is great. I've found myself needing a nice canvas-based graph visualization tool; I might just look to their code (thank goodness for LGPL!) for inspiration. When I start the project up and it gets a bit of velocity behind it, I'll post the github link.

<comment><USER2> While Tulip is significantly more capable, have you seen Canviz before? It's graphviz rendered on a canvas.

<http://code.google.com/p/canviz/>

<comment><USER3> Very interesting; I'm much more interested in building graphs similar to this (and animate them), albeit in 2D, though: [http://tulip.labri.fr/TulipDrupal/sites/default/files/upload...](http://tulip.labri.fr/TulipDrupal/sites/default/files/uploadedFiles/images/Image_affiche.preview.jpg)

<comment><USER2> I've seen desktop-code that does that, but nothing in JS so far.

One site I've found has been particularly full of quality material, including lots of open source projects: [http://www.dmoz.org/Science/Math/Combinatorics/Software/Grap...](http://www.dmoz.org/Science/Math/Combinatorics/Software/Graph_Drawing/)

</comment></comment></comment></comment><comment><USER4> I've used this a lot, probably the only tool to visualize large graphs without just coding something yourself.</comment>


Objective-D – alternative or supplement to Objective-C - <AUTHOR> http://www.antonzherdev.com/post/73410788562/objective-d-alternative-or-supplement-to-objective-c

<comment><USER2> Fascinating approach, although I'm skeptical of such "layers" put over Objective-C. The main problems I've had when trying to write languages on top of Objective-C have been the painful interop with C types, specifically with C's lack of RTTI and ObjC's buggy "@encode" concept. So I'm curious to see how this project deals with that.</comment>


NPM proxy users receiving ERR 418 I'm a teapot - <AUTHOR> https://github.com/npm/npm/issues/20791 <comment><USER2> 2 hours after the incident was responded to by an npm employee and the status is still green: [https://status.npmjs.org/](https://status.npmjs.org/)

I love fake status pages!

<comment><USER3> Overall, the system is up and running. I believe, the issue only affects a subset of users behind proxies.

<comment><USER4> This is why I make clients drop/replace SaaSs. When SaaS don't update status page, or in a transparent and prompt way, because it's not 100% outage it rages me, especially if the reports are found elsewhere - twitter/reddit/hn.

<comment><USER5> You force your clients to do things for trivial reasons that send you info a rage?

<comment><USER4> I don't consider a non working status page trivial. Yes, if a SaaSs send me into a rage then there probably dozens of red flags already, yes I will work with clients to drop or replace such SaaS with one that can communicate, absolutely as it usually falls under my devop remit. This doesn't apply to npm as not a paid Iaas/SaaS, but more to point out the number of shit SaaS that don't manage their status updates probably. Imgix in the past for example, Linode when Ddos - absolutely shambolic communication, and so on

<comment><USER6> Wouldn't that be more of an issue of not having an SLA between SaaS and client?

If the silly non-automated dashboard is part of the SLA, then it costs someone money/liability/trust to not maintain it, otherwise "who cares as long the issue gets resolved, people who care about the issue are tracking the bug report?"

</comment></comment></comment></comment></comment></comment><comment><USER7> Really disappointed in NPM lately. These past few months have been downright silly. How many major problems like this affect other package managers?

<comment><USER8> what else in these "past few months" are you referring to? as a moderate npm user i am blissfully oblivious.

<comment><USER9> In the past few weeks:

* NPM 6 stopped working with Node 4. Rather than actually fix it, they just left it broken for several days because it was already fixed in the upcoming release, and I guess they didn't want to do an emergency release: [https://github.com/npm/npm/issues/20716](https://github.com/npm/npm/issues/20716)

* There was a several hour period where you could publish packages, but then they would 404 when you tried to download the new version.

* They switched to using Cloudflare on Friday, and broke Yarn in the process: [https://mobile.twitter.com/jamiebuilds/status/10001984632696...](https://mobile.twitter.com/jamiebuilds/status/1000198463269699584)

* Somehow while switching to Cloudflare they blew away a bunch of the packages that had been published during the previously mentioned window. They also blew away _all_ the versions of some packages. Last Friday night you couldn't 'npm install gulp'. Never gave any explanation for this: [https://github.com/npm/npm/issues/20766](https://github.com/npm/npm/issues/20766)

About a month ago there was a bug where npm would change permissions on a bunch of system files and render you entire system unusable in you ran it as root. But that was OK because the bug was on the "next" version of npm, not the one you'd get by installing 'npm install -g npm'... Except there was also a bug in the current version of npm that installed the next version of any package by default, so it did in fact blow up a bunch of machines.

Now, apparently, they are a teapot.

<comment><USER10> And the real problem with all of this is that npm has become so ubiquitous that you _can 't_ get away from it if you're doing client side development (not even by switching to yarn).

You simply have to endure it, and accept that every now and again, for reasons entirely beyond your control (and at a quite possibly very inconvenient moment) it's going to break.

This really annoys me, but what can one do? At least it's fixed now.

<comment><USER11> > This really annoys me, but what can one do? At least it's fixed now.

Install your own repository manager? This is the standard in every company I've worked for so far, at least in the Java world. Artifactory supports NPM, so set it up as a proxy.

<comment><USER10> That's interesting - thanks. Of course, it has a price tag, but so does the rest of our pipeline, along with our time.

<comment><USER12> As far as the monetary price of implementing such a system, Nexus OSS[1] also supports NPM proxying and is free for basic usage.

[1] - [https://www.sonatype.com/nexus-repository- oss](https://www.sonatype.com/nexus-repository-oss)

<comment><USER13> We have Nexus in a subnet for faster installing. We had to write scripts porting over lockfiles from npm to nexus and back.

This had to be added to a precommit hook to not break CI. Seriously, package.json should allow to specify what endpoints should be used if available in a given order. Now it's up to each dev team to handle.

My main concern is that it's brittle. Nexus caches exact versions and nothing more so we don't even have assurance that it will work nicely when NPM goes down.

On the other hand lockfiles are awesome. I missed them back in 2012... copying over node_modules on USB drives was not cool.

<comment><USER14> You can specify what registry to use with a simple project-based .npmrc file. We have ours point to our Nexus npm proxy.

<comment><USER13> That's what we eventually do but the lockfiles don't care, a resource url is a resource url. We use yarn too which does proxies only in .yarnrc IIRC.

Do you have an externally available Nexus? Using ours through a VPN beats the main purpose - fast(er) installs. That's why for WFH scenarios we have a script to switch between our proxy and NPM.

<comment><USER14> Our Nexus setup is internal only. For WFH, we have hundreds of folks using a corporate VPN which routes to our office, and then our office routes to our AWS VPC, which is where our Nexus installation lives. I set this configuration up and haven't had any real issues with it, nor do I see any reason to switch between a proxy and npm.

If a developer is using an older buggy version of npm that doesn't respect .npmrc and changes a lock file to point back to npmjs.org entries, we deny the PR and ask for it to be fixed. Right now that check is unfortunately manual, but there are plans to automate it. It can be easy to miss at times though, since GitHub often collapses lock files on PR's due to their size.

For us, the main purpose of using Nexus as a proxy is to maintain availability and to cache/maintain package versions. If you're using Nexus to make things faster, then you probably shouldn't be using it. If you want faster installs, look into using `npm ci`.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Relevant comment by wgrant:

        The body of the 418 is {"error":"got unknown host (registry.npmjs.org:443)"}.
        Looks like some npm clients are appending the port to the Host
        header, but only when going through a proxy, and that's confusing
        the registry.

It seems to be based on combination of npm:node version.

<comment><USER16> Sure, but why is anything in the chain returning the 418 "I'm a teapot" error message?

My guess is someone wanted to use some code for "I don't really know what this error is", saw the 418 and thought "that's cute!"

Be careful, "cuteness" and "cleverness" has a way of biting you in the behind.

<comment><USER17> > Be careful, "cuteness" and "cleverness" has a way of biting you in the > behind.

Generally speaking I tend to agree, but in this specific case how is sending a 418 "biting you in the behind" worse than sending a more proper 500 error? (Or perhaps a 400? Hard to say exactly, feels like the server is having unexpected errors since it cannot properly parse the hostname.)

<comment><USER18> If I'm doing quick generic error handling, I'm going to assume anything in the 500 range is a server issue and display an error of the sort. If it's in the 400 range I'm going to handle the common ones and then assume it's the client's or user's fault. _(And of course a user fault is really a client validation fault.)_

So yes, returning a 4XX for a 5XX is problematic.

<comment><USER17> But is that relevant to _this specific_ case? The problem is not 3rd party clients, it's the npm client itself - so I don't know how error handling is relevant? (In the general case, yes of course it is, but in this and the parent comment I'm specifically talking about issues in only the narrow use case here.)

<comment><USER19> The error was on the server side, not the client side. The server was not following the HTTP spec. The fact that it was server side was why they were able to fix this so quickly.

Since it was a server side error, and the issue was not a client side one, the 500 error code is most appropriate. The fact that the npm client itself is the first one to trigger this error is not the issue here, as it could have just as easily been yarn or another client. Following standards are important, and we weren't trying to make tea.

</comment></comment></comment></comment></comment></comment><comment><USER20> A moment of sympathy for the engineers who have to explain their non technical project manager on why their application is getting this error.

<comment><USER21> I learned my lesson not put cutesey messages in the logs the hard way. I was young and dumb and in my case it was for a restore from backup system. A customer had failed hardware and was trying to restore from backup. It was failing and the funny message all of the sudden didn't sound too funny when customer was reading it back to me in their own voice over the phone.

<comment><USER22> Oh I've done that too as a rookie. Software displayed an error message when the application was in a state that was impossible for it to be in, at least in theory. The error message was a line from 2001 Space Odyssey: "I'm sorry Dave, I'm afraid I can't let you do that". Of course when it ended up getting displayed it was displayed to a customer called Dave who has never seen (or read) 2001 Space Odyssey.

The first lesson was to avoid funny error messages in the future. The other was that "impossible" things tend to happen surprisingly frequently in software.

<comment><USER23> With 7 billion people on the planet, one in a million events are guaranteed to happen to about 7k people.

Law of stats of large numbers etc

<comment><USER24> There's a lot of different possible 1 in a million events, though...

<comment><USER23> True. I really intended it as 7k people will have had the _same_ 1 in a million event. Sorry that wasn't clearer.

</comment></comment></comment></comment></comment></comment><comment><USER25> Here's to hoping that all my yarn caches will continue to carry me through this.

Seriously, though. I'd love to get a look at their SLA and how they define "uptime" for their "org" and "enterprise" users. I don't think most teams are running out the door to throw their money at npm, and it's this type of instability that creates mistrust amongst developers.

<comment><AUTHOR> Yarn seems to be unaffected with this issue so I imagine you'll be fine. There's been a few users (including myself) who simply swapped out npm for yarn and have had the issue resolved. It doesn't really address the root cause but in this case, it's presumably some bit of logic in the actual npm client itself rather than the registry.

<comment><USER25> Last time I checked the yarnpkg registry is still a proxy to npm, unless they've started hosting. I haven't checked in some time.

<comment><USER26> yarn is basically an npm wrapper that add caching, so even so, it's good for avoiding intermittent errors

</comment></comment></comment></comment><comment><USER27> > The HTTP 418 I'm a teapot client error response code indicates that the > server refuses to brew coffee because it is a teapot. This error is a > reference of Hyper Text Coffee Pot Control Protocol which was an April > Fools' joke in 1998.

[https://developer.mozilla.org/en- US/docs/Web/HTTP/Status/418](https://developer.mozilla.org/en- US/docs/Web/HTTP/Status/418)

<comment><USER28> yeah but, no but...

</comment></comment><comment><USER29> They say they've fixed this in this related issue ([https://github.com/npm/registry/issues/335](https://github.com/npm/registry/issues/335)) but I can't tell what change was made. The only discussion was around accepting a port number in the Host header. All well and good to fix what I assume was a config bug. But I can't tell if the secondary (but arguably more important) issue of returning valid error messages was addressed. I'm not sure what the exact right error message should have been. If the server was intentionally differentiating host headers with port numbers then probably 400 or possibly 404. But I'm guessing this was just a plain and simple bug and that 418 was set as a cutesy catchall "something unexpected happened" error status to be sent in some exception condition. I hope they've changed that to return 500, which would at least honestly accept blame for the issue.

<comment><USER30> I'm guessing they used 418 to mean "I have no idea who you think you're talking to" (not entirely unfitting as 418 was proposed to indicate the coffee pot you're talking to is actually a tea pot), considering it was triggered by having the Host set to something it did not recognise. But they should still have used a real error code and a more informative message.

</comment></comment><comment><USER31> What makes me sad, is that this error (caused by the mis-use of the 418 status code) and a previous issue (I forget the link) where a web dev was complaining that 'I'm a teapot' was stupid and should be pulled from the specs, will result in 418 being removed from the standard, and the humourless suits win again.

If we can't have a little bit of levity in our lives, then what's the point of it all ?

<comment><USER32> > the humourless suits win again

I think this is misguided. Clearly, there are plenty of humourless prudes, even amongst Us, the Blessed T-shirt Wearers. To wit, the "campaign" to remove the 418 code did not originate in a corner office.

<comment><USER33> Being a "suit" is a state of mind, not an article of clothing.

<comment><USER34> "Hey man, I'm not a suit." "Yeah you are, you just don't know it yet."

(Entourage, [https://youtu.be/E-v1hOJCphI?t=78](https://youtu.be/E-v1hOJCphI?t=78) (NSFW video))

</comment></comment></comment></comment><comment><USER35> > I'm gonna lock this for now, because I'm sure it's gonna get plenty of > traffic. You really don't need to respond to repeat what every other poster > is saying. The registry team has been informed.

It's alright if they want to lock the thread to prevent a massive +1 spam, but at the very least they should have given a link to track the status of this.

When your production systems are down, "thanks for the report" is not a good enough response.

<comment><USER36> His tone is all wrong here:

> You really don't need to respond to repeat what every other poster is > saying.

Obviously they did need to because no one from the team had responded yet. Also his response without any link to track the status is rather disappointing but entirely what I'd expect from the NPM team.

<comment><USER37> *her/their tone, if you care

As the person mostly on the hook for [https://news.ycombinator.com/item?id=16435305](https://news.ycombinator.com/item?id=16435305) (as I recall), I can imagine she/they would be a little on edge.

Still not a good look. . .

<comment><USER30> I see no reason why "they've screwed up before so it's okay if they're being dismissive and intransparent" would ever be a valid argument. The point of excusing past mistakes is that they are learning opportunities.

If anything, the filesystem permissions bug only makes this worse because it was a destructive bug in a widely promoted release (even if it was technically not supposed to be stable -- npm employees actively recommended using it on twitter) and npm's reaction was fairly dismissive (because it's not a stable release for production use, dummy).

<comment><USER37> Only intended to explain, not excuse. I totally agree.

</comment></comment></comment></comment></comment><comment><USER38> It actually reads like an IoT protocol, way ahead of its time in 1998. Life not only imitates art, but eventually catches up with parody:

[https://tools.ietf.org/html/rfc2324](https://tools.ietf.org/html/rfc2324)

<comment><USER39> I suspect the joke was inspired in part by a certain well known coffee pot monitoring system that preceded it: [https://en.wikipedia.org/wiki/Trojan_Room_coffee_pot](https://en.wikipedia.org/wiki/Trojan_Room_coffee_pot)

</comment></comment><comment><USER40> Just been fixed, apparently[0]:

> We've fixed this -- we now accept the port appended to the host. @wgrant's > comment was most helpful, thank you!

[0] [https://github.com/npm/npm/issues/20791#issuecomment-3926484...](https://github.com/npm/npm/issues/20791#issuecomment-392648459)

<comment><USER41> They did fix it, but e.g. appending a period ([https://registry.npmjs.org./](https://registry.npmjs.org./)) still throws a 418 - I expect this to bite them someday (eventually). I don't understand why their Host: parsing is so strict; it seems unnecessarily restrictive.

<comment><USER42> 418 is really a confusing response here. They should fix that ASAP by giving a normal error message.

<comment><USER41> I would recommend (if any NPM people are reading this) that the error for an unknown Host header be changed to 404. Bad host headers are already filtered out by Cloudflare (which returns 400), so any host headers that make it through would represent "unknown"/"missing" hosts (hence 404).

</comment></comment></comment></comment><comment><USER43> \- Obligatory reminder that the NPM system is a failboat.

\- Public Service Announcement: Don't board the failboat.

<comment><USER10> Thanks, but what's the alternative when yarn relies on npm infrastructure? Like it or not, you're still using npm. It's got so you basically _cannot_ do serious client-side development without one of them.

<comment><USER44> "Enterprise development" is not the same as "serious development". Anyone still doing regular old JavaScript without the transpiling and megaframework dependencies is arguably taking their task more seriously than those who are.

<comment><USER45> I'm sorry, but after having used TypeScript there's no way I'm ever going to back to writing pure JavaScript anymore (for anything but the most trivial stuff). It's borderline irresponsible, IMO.

<comment><USER44> I'd like to say I love typescript, too. It's better for collaborative development than raw JS. My point is different, that working in the "low level" or raw JS, obfuscated or not, is where the substantive work happens. Good example is the people working on frameworks.

</comment></comment></comment></comment></comment><comment><USER46> Perhaps it really is a teapot.

<comment><USER47> It isn't being asked to brew coffee, though, so it's a mis-use of the spec.

<comment><USER48> Or maybe you're asking a teapot to install npm packages.

</comment></comment></comment><comment><USER49> This HN comment is probably one of the best explanations of why npm can be objectively said to be unreliable. I think it deserves attention.

[https://news.ycombinator.com/item?id=17176486](https://news.ycombinator.com/item?id=17176486)

</comment><comment><USER50> Okay, I appreciate npm and everything, but nowdays new versions come out on a weekly basis yet something still breaks, either locally or in the CI for us. This made me fear two things the most lately: `npm i` and `npm i -g npm`.

</comment><comment><USER51> I'm sure the anti-NPM brigade is on its way, but I recall there being a huge backlash against removing this error code from Node a few years ago.

<comment><USER30> The problem isn't that Node supports this error code. The problem is that it's used by the registry.

Heck, technically the problem isn't even that it's used by the registry, the problem is the npm client is a broken untestable mess and users seem to routinely unearth extremely surprising bugs.

This all has very little to do with teapots. The fact they used 418 and didn't provide a useful error message only makes it more interesting to talk about.

<comment><USER51> Yeah, fair point.

</comment></comment></comment><comment><USER52> // This code will never execute

</comment><comment><USER53> The last comment is locking the issue because too many people are responding saying the same thing. This comment makes me want to reply and say the same thing too, but I can't now.

<comment><USER54> Locking a discussion with zero-unreasonable responses as "too heated" is bad optics, but I think locking the discussion is a pragmatic decision, as the NPM team has been alerted about the issue and any meaningful comments would get lost in the noise otherwise.

<comment><USER55> It's likely that the "too heated" is GitHub putting words in the mouth of the repo admins. I don't think you get to choose the text of that message.

ETA: The options are "off-topic", "too heated", "resolved" and "spam". It looks like you can also elect to not give a reason, though...

</comment></comment></comment><comment><USER56> Is it too soon to call this Teapotgate?

<comment><USER57> It's 'too soon' until the water is boiling. Then it's 'tea time'.

</comment></comment><comment><USER58> It's appalling how bad the NPM development team is. Do they have any sort of test suite at all? I'm switching to Yarn.

<comment><USER59> I'm reminded of when npm was beginning to get popular and all the web devs I worked near were acting like it was pure gold and the first of its kind; as if other package managers like maven or apt never existed.

These days I just have to laugh and shake my head.

</comment></comment><comment><USER60> I'm wondering if returning 418 is some sort of "off by one" error. Maybe their list of error codes are in an array, meant to send 500, but picked n-1 falling on 418?

</comment><comment><USER61> My favourite HTTP response...

<comment><USER62> [https://http.cat/418](https://http.cat/418)

</comment></comment><comment><USER63> Why connect to npm through a proxy?

<comment><USER64> Because corporate won't let you connect without one.

</comment></comment><comment><USER65> I'm going to cancel my paid subscription and remove my private packages. npm's incompetence has been a joke for years and it's a real shame they're propped up so highly by Node.

<comment><USER66> Better choice: move away from Node.

</comment></comment><comment><USER67> Comments about the error not being helpful!

Presumably the npm community is full of web devs. Given that how can they not know the http codes, especially one as famous as 418?

<comment><USER68> I didn't know 418 and I'm a web dev. Http status codes are a tiny part of my job

<comment><USER69> Not only that, but if you're returning this status code you're almost certainly doing something wrong or user hostile.

<comment><USER70> What if it really is a teapot? Not that farfetched with today's internet connected devices.

<comment><USER69> I still don't think returning a 418 (in the realm of client errors) is the correct code, _even if it is a connected teapot which you 're trying to identify!_

I think the appropriate action would be a client sends an HTTP HEAD to the service, which responds 200 "TEAPOT".</comment></comment></comment></comment></comment>


BookingBubble – Easy meeting room booking system - <AUTHOR> http://www.bookingbubble.com/

<comment><USER2> I am very ashamed to say this, but what about outlook calendar integration? In many big companies rooms are still booked that way... also, maybe you want to make your page customizable so that you can put the company's logo. Finally, login: if I am using a company's laptop, I don't want to remember a password for each service I use.

<comment><USER3> No shame there at all: I dislike Outlook, but calendar and resource manage in Exchange is pretty frikkin' awesome. Microsoft got that right a long time ago, no one comes close yet. AFAIK. YMMV. IANAL, but that's not really relevant.

</comment></comment><comment><USER4> What exactly is the difference between this one and the one you posted a few hours ago?

[https://news.ycombinator.com/item?id=8441863](https://news.ycombinator.com/item?id=8441863)

<comment><AUTHOR> BookingOctopus is a custom service for building booking systems from one of our clients.

</comment></comment><comment><AUTHOR> Integrating Outlook I think is an awesome idea. Thank you!

</comment><comment><USER5> MVP?

<comment><AUTHOR> MVP for BookingBubble will be ready in around 1 month, if this was the question.</comment></comment>


Scott Adams: Knowledge that Matters - <AUTHOR> http://dilbert.com/blog/entry/knowledge_that_matters/

<comment><USER2> The parachute books suggests that a good proxy for the skills you are _good at_ is the skills you _enjoy using_. The argument is that you usually don't enjoy something for which you have little ability.

But another argument for this is that you only become successful by sticking at something - you know, it's mostly "turning up", overnight success takes a long time.

And there's the Dweck/Gladstone observation that it takes 10,000 hours to become good at something. So if you enjoy it (not necessarily find it pleasurable, but meaningful and worthwhile), you can do that.

I don't know if you can become world-class with 10,000 hours alone, or if you need a special potential. But one thing seems clear to me: if you have _some_ aptitude, and you practice 10,000 hours, you'll be damn good. And if you enjoy it, find it meaningful and worthwhile, it's probably pretty close to maximum fulfillment.

</comment><comment><USER3> _But imagine if you were born knowing you had the natural aptitude to be the world's best brain surgeon, or guitar player, or graphic designer._

I see several problems with his argument here:

1) Talent is not that important. Geniuses in any field are made, not born, through long hours of focused practice. Granted, some fields (such as sport) have minimum physical standards to be competitive but for the most part it's due to effort.

(Focused practice refers to practice that's actively aimed towards identifying weak points and improving them. If, to take a simple example, you spend several years writing similar "hello world" programs in C you aren't going to get very far.)

More information on this can be had in the work of Anders Ericcson (a leader in the field of expertise research).

A profile can be found here: [http://www.theaustralian.com.au/news/health- science/success-...](http://www.theaustralian.com.au/news/health- science/success-is-all-in-the-mind/story-e6frg8gf-1111118649674)

2) Even if you accept that there's some sort of talent-based destiny, people are still likely to have characteristics that could make them great in a wide array of fields. For example, if you're strongly analytical you could be a programmer, or a quant, or a research scientist, etc.

3) What if the field you're great in isn't valued by society? You might know that you could be a great artist, but there are great artists who are starving and miserable. On the other hand you could be a mediocre accountant (or whatever) and have fun outside your career while not living hand to mouth.

4) Finally, he seems to suggest that what he had was the aptitude to be a great cartoonist. However, looking at Dilbert, Scott Adam's main strengths seem to be excellent persistence and good salesmanship. These qualities (and I'd say they're far more useful qualities than artistic ability and a brilliant sense of humor) could have carried Scott to success in many other fields. The reason he's a great cartoonist is because it interested him, not because of some innate talent.

</comment><comment><USER4> the thing you are best at isn't really relevant if there is little demand for that skill. being good at something also doesn't necessarily mean enjoying it. the world's best accountant probably dreams of being a pro baseball player.

it's easy to think like this when you have an awesome job like drawing comics. i've encountered similar sentiments from other people who have awesome jobs.

<comment><USER5> I think the world's best accountant would enjoy accounting. I don't see why it would necessarily be more boring than many other jobs, and by and large only people who love their job invest enough time to be the best. (We're not talking "pretty good" here, after all.)

<comment><USER6> The world's best accountant probably hasn't seen an actual balance sheet in ages.

He's probably struggling to be an effective manager somewhere.

<comment><USER7> The world's best accountant is an oxymoron.

You either do accounting properly, or you end up in jail. Other than that, there's very little that can be assessed about accounting profession.

Or maybe you indeed meant those Enron and Madoff accountants?

</comment></comment></comment></comment><comment><USER8> What matters:

If you aspire to do something great, you need knowledge of what you are good at, a love for what you are good at, and you need to be good at something many people care about, but few people are good at.</comment>


What's the Deal with End-User Licensing Agreements? - <AUTHOR> http://blog.upcounsel.com/end-user-licensing-agreements/ End-user licensing agreements are becoming an ever important legal aspect for app developers. While the app store EULA covers some terms, it is limited. <comment><USER2> What do you think about the new regulations concerning app developers in California? It seems to be enforcing more of a penalty than the usual issue of badly implemented EULA/TOU?

<comment><AUTHOR> Yes, the attorney general has been going after app developers that DO NOT have privacy policies and fining them $2,500 for every download without a privacy policy.</comment></comment>


Mythbusters RFID episode banned - <AUTHOR> http://www.bit-tech.net/news/2008/09/03/mythbusters-rfid-episode-banned/1

<comment><USER2> Here are some places Bruce Schneier talks about RFID, notice most of these are about RFID in passports, which is definitely public interest, and a big risk:

[http://www.schneier.com/blog/archives/2009/02/cloning_rfid_p...](http://www.schneier.com/blog/archives/2009/02/cloning_rfid_pa_1.html)

[http://www.schneier.com/blog/archives/2006/08/hackers_clone_...](http://www.schneier.com/blog/archives/2006/08/hackers_clone_r.html)

[http://www.schneier.com/blog/archives/2004/10/rfid_passports...](http://www.schneier.com/blog/archives/2004/10/rfid_passports.html)

[http://www.schneier.com/blog/archives/2005/04/rfid_passport_...](http://www.schneier.com/blog/archives/2005/04/rfid_passport_s.html)

[http://www.schneier.com/blog/archives/2006/11/uk_rfid_passpo...](http://www.schneier.com/blog/archives/2006/11/uk_rfid_passpor.html)

[http://www.schneier.com/blog/archives/2005/10/rfid_car_keys....](http://www.schneier.com/blog/archives/2005/10/rfid_car_keys.html)

<comment><USER3> There was a UK TV show (The Real Hustle) which demonstrated Passport skimming at in one episode. They had a scanner in the bag and just hung around and airport bumping into people till they got lucky.

Scary stuff.

</comment></comment><comment><USER4> Published: 3rd September 2008

Didn't you guys go to HOPE?

EDIT: link

<http://www.thelasthope.org/talks.html>

<comment><USER5> Discussions from over a year ago:

<http://news.ycombinator.com/item?id=294831>

<http://news.ycombinator.com/item?id=294455>

</comment></comment><comment><USER6> I assume it makes no difference if Texas Instruments is on the record saying, "...it was waiting "for Mythbusters to let us know when they were planning on showing the segment" when they heard "that the storyline had changed and they were pursuing a different angle which did not require our help."

I mean, that sounds like a line from the Godfather. Creepy.

All the same, this issue is a matter of the audience, not of producing a good debunking of RFID. Any debunking that wouldn't be viewed by millions of people, via Discovery, would presumably be "all good."

I think the disappointment, then, is that we really wanted to see an entertaining and thorough deconstruction of RFID... and while hackers can be thorough, they don't have the audience to justify producing something that is highly entertaining.

</comment><comment><USER7> The Mifare-cracking presentation at 23C3 (Chaos Communication Congress, in Berlin) <http://news.ycombinator.com/item?id=825150>

<comment><USER8> This should be it's own separate submission. Please submit this as it's own story sp332.

</comment></comment><comment><AUTHOR> I was watching this video (Adam Savage : FAILURE - Defcon 17 Talk) ~ <http://www.vimeo.com/6006731> and wanted to find out why some random hacker asked about RFID.

</comment><comment><USER9> I love that the article had a huge American Express ad served up with it!

</comment><comment><USER10> Is this the first documented case of a MythBusters metamyth?

<comment><USER11> I understand that things of this nature have happened before. In one of the segments from his well-known talk on failure, Adam Savage mentions that it happened with (I believe) Crest over teeth whitening strips.

</comment></comment><comment><USER12> Seems more like it was nobbled than banned.

</comment><comment><USER13> So what is the basic hack you RFID hackers?

<comment><USER14> MitM + Brute force against weak-ass key. German, but not necessary for basic understanding: [http://sar.informatik.hu- berlin.de/research/publications/SAR...](http://sar.informatik.hu- berlin.de/research/publications/SAR-PR-2008-21/SAR-PR-2008-21_.pdf) or skip the theory: <http://www.openpcd.org/Downloads.releases.0.html></comment></comment>