Environmentalist didn't speak for 17 years to learn how to listen to opponents - <AUTHOR> https://www.cbc.ca/radio/outintheopen/breaking-silence-1.4526352/this-environmentalist-didn-t-speak-for-17-years-to-learn-how-to-listen-to-his-opponents-1.4527401 <comment><USER2> I did 3 months hard core full time Yoga in an ashram some years ago. As part of the program; I didn't speak, read or write for a month. Or cut nails or hair, but that's another story :) As an added bonus; the entire group followed the same program, which meant that I didn't have to listen to them either.

The main take home for me was that most of the things that I feel are really important to say in my daily life aren't. Once it was over, being expected to speak felt like a burden.

<comment><USER3> I've once met a German saying that I wholeheartedly adopted, "blessed be those who have nothing to say, and nevertheless remain silent".

(Don't remember the German original - I don't speak German)

There's also a more philosophical take from Wittgenstein IIRc.

<comment><USER4> I searched and found "Gesegnet seien jene, die nichts zu sagen haben und den Mund halten!" which is the desired quotation but it's attributed to Oscar Wilde [1] so probably originally English since Oscar Wilde is also quoted to have said "Life is too short to learn German" (though he did learn German according to Wikipedia).

[1] [https://www.gutzitiert.de/zitat_autor_oscar_wilde_1481.html](https://www.gutzitiert.de/zitat_autor_oscar_wilde_1481.html)

<comment><USER2> Tell me about it.

I've lived here for three years, with a native speaking partner; but it's just not happening much.

Before that I spent three years in school studying German, all gone.

I don't like the language very much, I guess that could be part of the difficulty. It's just too damn complicated, the same way C++ is complicated.

<comment><USER5> > I don't like the language very much, I guess that could be part of the > difficulty. It's just too damn complicated, the same way C++ is complicated.

Interesting comparison. I find computer languages incredibly easy to pickup. Human languages on the other hand have been much more difficult. I only speak English and sometimes even then my words come out in the wrong order or I forget words entirely (+).

(+) I once forgot the word "and" \- as a result I struggled for a day to speak/write many complex sentences.

</comment></comment></comment></comment></comment><comment><USER6> Anyone who found this story intriguing should immediately go buy "Climate: A New Story" by Charles Eisenstein. He explores how we use "war language" when talking about environmental issues and how that undercuts our efforts... then he proposes how we get out of that conversational rut, with allies, people on the fence, and even climate change deniers.

<comment><USER7> Read it for free here: [https://charleseisenstein.org/books/climate-a-new- story/](https://charleseisenstein.org/books/climate-a-new-story/)

</comment></comment><comment><USER8> I naturally don't make small talk as much as people usually do, and came up with a saying when people tell me that I'm "so quiet":

 _If you 're always talking, you can't hear what's going on._

<comment><USER9> I say this to my kids _all_ the time! They never stop talking... in fact, half of the people around me never stop talking. It's astounding they ever manage to learn anything, honestly.

<comment><USER10> Some people just need to voice every thought in their head. The best is when two of these people start rambling to each other, they can go on for hours.

I used to date someone who always read everything out loud and talked things out verbally while writing. Which they claimed helped them think but I'm not convinced.

<comment><USER11> > The best is when two of these people start rambling to each other, they can > go on for hours

A phenomenon otherwise known as "conversation".

<comment><USER12> No, that's just people talking at each other. Conversation is when they listen to each other too.

</comment></comment></comment></comment></comment><comment><USER13> John Francis's talk[0] was one of the very early TED online videos to go viral- definitely the first one I remember watching, introducing me to the entire TED format. Pretty powerful speaker.

That said, having studied ASL for a few years in University I find the view of "not talking" pretty simple. So much can be communicated without your vocal chords, so much can be "said" without speaking. Though, maybe that was part of his point.

[0] [https://www.ted.com/talks/john_francis_walks_the_earth?langu...](https://www.ted.com/talks/john_francis_walks_the_earth?language=en)

<comment><USER14> ASL and other sign languages are literally languages. There are linguists that study how subfields in linguistics that traditionally only applied to spoken languages (e.g. phonology) have analogues in sign languages[0], so its now widely appreciated that anything expressible in spoken languages as a class is expressible in sign languages. All of that to say "not talking" has nothing to do with talking in a sign language.

John Francis took a vow of silence. He wasn't talking in a non-spoken language; he was not talking. There is a lot you can do with non-verbal communication (i.e. non-linguistic communication, through your body), but that isn't nearly the same thing as speaking a sign language.

[0] See Diane Brentari's research for example: [https://mitpress.mit.edu/books/prosodic-model-sign- language-...](https://mitpress.mit.edu/books/prosodic-model-sign-language- phonology)

<comment><USER13> > ASL and other sign languages are literally languages

100% agree.

> He wasn't talking in a non-spoken language; he was not talking ... that > isn't nearly the same thing as speaking a sign language

I disagree.

ASL 1000, first class, my professor was telling us elaborate, hilarious stories without ever speaking and none of us "knew ASL" the language. But he was communicating to us using a plethora of skills that a person fluent in Signing knows how to use.

When we say that ASL is a language, that doesn't mean standing statically and one sign at a time signing each one like a pictograph. A huge proportion of the language is in the nuance, the non-words, the expression, the acting and movement. That doesn't mean ASL is _just_ that acting part, but pretending that what Francis was doing has no relation to ASL is a stretch in my mind.

What he was doing while 'not speaking' has a lot in common with what I'm doing when I'm signing with Deaf people.

<comment><USER15> Huh? How was he communicating if he wasn't speaking and wasn't signing? You never say.

<comment><USER13> If I wink at you then raise my eyebrows suggestively, was I using English? No, English is a spoken language. Yet if you didn't know ASL, you'd know what I was saying, right? So which language was I using?

Much of ASL communication- but not all by any means- uses this sort of communication that is very language agnostic. To really get good at Signed languages, you need to use a lot of these skills. That's what I mean when I say that ASL isn't a list of specific signs matching to words, it's a very complex system of communicating ideas.

My professor, one of the most wonderful teachers I've ever had, was a master of communication. He could tell us hilarious stories without speaking English and without us knowing ASL because he could communicate without language.

And my point to all of this is that saying that what Francis was doing isn't Signed Language misses some nuance in what Signed Language is.

</comment></comment></comment></comment></comment><comment><USER16> Silent protest is hardly the same thing as not speaking in order "to learn how to listen to opponents."

<comment><USER17> If you watched the video, you'd realize this has nothing to do with any sort of protest.

He originally decided to be silent for a day simply for being tired of arguing and wanted to rest - and then realized he began listening more as a result.

</comment></comment><comment><USER18> Does a vow of silence include texting or email? He says in the video that he wrote mail, so I'm wondering where one would draw a line.

<comment><USER19> I think a vow of this sort is a very personal one, so I'd guess the rules are sort of up to him, it sounds like he stopped speaking, but communicated in other ways. The article mentions he earned his PhD during his 'vow' so I would guess he'd have done at least a bit of writing in addition to mail.

</comment></comment><comment><USER20> This article is very short but does a good job touching on an aspect of his life.

To anyone interested in John Francis, consider reading his book _Planetwalker_. It's beautiful, unique, and inspiring. Think I'll read it again soon.

</comment><comment><USER21> Long term vows of silence actually seem like they can produce pretty unhealthy result also - this is a story of a situation where a couple of people died during a long term vow of silence.

[https://info-buddhism.com/geshe_michael_roach-Death-and- Madn...](https://info-buddhism.com/geshe_michael_roach-Death-and-Madness-at- Diamond-Mountain.html)

Edit: grammar + I'd note even many practices that involve asceticism give some warning about extreme asceticism - the "middle way" of Buddhism is middle between ordinary life and extreme practices.

<comment><USER22> That's a pretty broad statement drawn from one strange case.

<comment><USER21> Meditation broadly is known for having both risks and rewards[1] (edit: studying qigong I heard occasionally of the dangers of qigong psychosis[2], a related problem). Extreme meditation can produce greater discipline, clarity and so-forth. But it stands to reason it can produce more problematic results too.

[1] [https://qz.com/993465/theres-a-dark-side-to-meditation- that-...](https://qz.com/993465/theres-a-dark-side-to-meditation-that-no-one- talks-about/)

[2] [https://www.ncbi.nlm.nih.gov/pubmed/10336217](https://www.ncbi.nlm.nih.gov/pubmed/10336217)

<comment><USER23> I don't subscribe to asceticism in the least, but the perceived benefits and dangers are subjective and unlikely to be shared with health professionals. What you are referencing sounds like a similar situation.

I believe the least painful life is lived on the middle path so I broadly agree, but not all will.

<comment><USER24> I don't think it's controversial that meditation practices can be problematic for some people with or predisposed to certain mental health issues. Some people just can't be left to their thoughts. If thoughts are unhealthy and a disorder effects self-regulation of and responses to one's thoughts, meditation may only make things worse, and has proven to do so.

<comment><USER23> Problematic to mental health professionals, maybe. Not everyone aligns their life around the same values of western medicine.

<comment><USER24> So suicide, onset of manifest schizophrenia, and similar results are _not_ problematic outside Western medicine? Because there's significant and AFAICT largely undisputed evidence of spikes in these phenomena at retreats, schools, etc for meditation.

Other HN commenters have said that it's well known by teachers in the West and IIRC I've read articles that it's also well-known among priests and monks in Eastern traditions--so much so that the ancient practices and teachings incorporate rules and stories designed to address it. The names or labels attached may differ between Western medicine and Eastern religion, but the phenomena are the same and generally considered negative and harmful, nor positive or curative.

It's rare but real. What's to be gained from denying it? It doesn't reflect poorly on meditation in the slightest, it's just an admission of our human frailty and that there are no panaceas.

<comment><USER23> Who am I to judge the quality of your life? Nobody can judge that but you.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> im curious to know how he got through the oral defence of his phd. would they grant an exception for these circumstances? pretty cool

<comment><USER26> How would ANY other non-speaker do it? Presumably there are plenty of deaf PhD's about who have never, nor have the ability, to speak.

<comment><USER25> accommodating a disability is different than a vow, though, right? it just strikes me as interesting.

<comment><USER19> True, though I imagine most universities would also honor a candidates religious needs in this sort of situation, which would fall more under a personal choice rather than a physical impairment.

</comment></comment></comment></comment><comment><USER27> Sounds like he wasn't doing much "active listening"

</comment><comment><USER28> Canadian taxpayers give a billion dollars to the CBC every year. In return we get American-centric stories on the front page that seem to reflect our governing party's ideology.

<comment><USER29> Gee, a state funded news outlet turns out to be the political mouthpiece of the ruling party? Who'd have thought this could happen?

As it stands, though, many news outlets in the USA demonstrate that they don't need to be state funded to be political mouthpieces. I see real journalism happening at the state and local level at this point. It seems mostly the big players that can afford to not do their jobs.</comment></comment>


Revenge Of The Killer Script Kiddies - <AUTHOR> http://techcrunch.com/2011/08/20/revenge-of-the-killer-script-kiddies/

<comment><USER2> I think a lot of sites that are like off the radar or think there community is behind them, take a lack in security, and they really shouldn't. Security is one feature every site should think about number #2 or when they say give there users a quality experience if you don't have security then there is no quality</comment>


Web Application Launch Checklist - <AUTHOR> http://blog.iweb.com/en/2009/02/web-application-launch-checklist/2156.html

<comment><AUTHOR> largely inspired from <http://news.ycombinator.com/item?id=485553> but adapted for those doing web applications</comment>


The Minimum Wage Machine - <AUTHOR> http://blakefallconroy.com/18.html <comment><USER3> It's a wonderful piece. One wonders if the experience of the machine would change much if it awarded 6 pennies a second, though. The purpose of the performance is that the labor is soul-crushingly pointless, right? And that anyone who turns the crank is _seen as_ engaged in soul-crushingly pointless work, right? Those both strike me as true even if you're using my 1% Machine.

<comment><USER4> I could get thru a LOT of audiobooks while pulling that lever.

<comment><USER5> That's because the lever doesn't contain the shitty working conditions, danger, pressure, back-to-back shifts, forced overtime, and the knowledge that even that pitiful machine can be snatched away from you at the whim of bastards, and society will blame it on you.

<comment><USER4> democraticunderground.com is thataway. This is ycombinator.com, where people know they can improve their working conditions and get rich even if they are in rough conditions. Grimy work, risks, pressure, 100 hour weeks (making "overtime" laughable), and knowing it could/will all come crashing down - <USER2> all with society blaming you - is what you make of it.

<comment><USER5> Imagine society as being like an array of arrays of humans. There's lots of levels, but there's a clear trend where low numbered arrays are large and high numbered arrays are small. Some of the arrays aren't full, and there's an operation where you can swap up to the array above you if there's a gap. And it's theoretically true for a number of swaps to carry you all the way up to the very short arrays up top. But there is no particular operation to grow the width of an array, in fact the high numbered ones have been getting more cramped. So the trajectory of any one human might end right the top, and you can guarantee some humans definitely will, but the _expected_ trajectory of a human is stagnation in the low numbered arrays.

This should make you understand why the American Dream is a cruel and manipulative lie on the population level, even as it's undeniably true on the individual level.

Also note: the only thing meritocracy adds to the above is competition for the level swaps. Assuming it works perfectly, it becomes a bubble sort, where the humans with most merit semi-randomly bubble up into the highest numbered arrays. _The arrays do not become larger._ And now you've told the people in the low numbered arrays that they deserve all the crap they're getting.

<comment><USER6> > _And now you've told the people in the low numbered arrays that they deserve > all the crap they're getting._

Well, a privileged upper array member to feel that way is somewhat tolerable.

The worst for me is when some idiot from the lowest numbered arrays, by an enormous combination of factors (which he mostly attributes to his "hard work" and "effort"), jumps several levels up, and then assumes that everybody can do it, and the other lower levels are just lazy slobs for not becoming rich themselves...

<comment><USER5> Yeah. Although the thing that model warns is that _even if everybody was perfect on merit_ \- smart, educated, adaptable, personable, hard working and lucky - only the same percentage of them will rise. All merit gives you in this rat race is first call on the opportunity to rise.

Of course this is an over-simplified model. In real life the stratification of society is a bit flexible. A great many people could rise to CEO without saturating the demand. But by no means everybody.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> But what you don't see is the line of people outside the door, whose labour is worth less than $7.25 per hour, but who can't find (legal) work because of the minimum wage laws.

<comment><USER8> That's the idealized assumption in a simple supply/demand, all-else-equal model, but there's actually little empirical evidence that minimum wages, at least at the level contemplated in the U.S., actually do have an impact on unemployment in the world world, except on part-time work by teenagers. So economists' consensus has weakened on that from what it was if you had polled them 30-40 years ago.

One among many possible positive effects of higher minimum wages is to shift the threshold at which it becomes profitable to upgrade low-tech processes to computerized ones, which can modernize sectors of the economy, and create some highly paid jobs [1]. Another positive effect is to redistribute more money to people in the remaining low-end jobs. But economies are complex and full of feedback loops, so those aren't really well established either.

[1] As an AI researcher, of course, this benefits me: humans undercutting us is one of our top problems with deploying research in the real world.

<comment><USER9> Well yeah, that's because most people who are making minimum wage are... teenagers working part-time. At its current level the US minimum wage has very little impact on anything, positive or negative. Very few jobs are worth so little, and most of them are being worked by immigrants who get paid under- the-table anyways.

<comment><USER10> Knowing a few people that make or have made approximately minimum wage for the time I've known them, and seeing the age of people working at various low-end jobs, I would like to see some statistics to compare to your statement to my anecdotal evidence.

<comment><USER11> I'd also like to see underemployment / multiple job stats too.

All this talk about minimum wage, haven't seen mention of living wage.

</comment></comment></comment></comment></comment><comment><USER12> If this piece is displayed publicly, such that anyone who is willing can work for minimum wage, what sort of artful, philosophical statement would be made when one enterprising individual attaches a solar powered motor to the crank?

<comment><USER13> Why does it have to be solar powered?

<comment><USER12> Just to avoid complicating things with electricity costs. Maybe if you spliced into a city power line you could also make a statement about reliance on government subsidies.

</comment></comment></comment><comment><USER14> Did I just.. appreciate modern art for the first time?

<comment><USER15> Yes. Yes you did. Dubious whether to call it 'modern' however. That term in the art world is super tricky. I might fall to contemporary - but that also brings it's difficulties. If you want to be really wiley, you could call it post-genre :)

<comment><USER16> > post-genre

Interesting name for a genre.

<comment><USER15> I always thought it was wonderfully ludicrous :)

</comment></comment></comment></comment><comment><USER17> I feel sorry for people who have built their careers around the fine art of crank turning, it is only a matter of time before their jobs are automated away.

</comment><comment><USER18> I highly recommend the first episode of Morgan Spurlock's "30 Days" TV show called "Minimum Wage"[1]

Morgan and his girlfriend try to live on minimum wage for a month in Ohio. This is some of the best TV I have ever seen.

[1] [http://en.wikipedia.org/wiki/List_of_30_Days_episodes#Season...](http://en.wikipedia.org/wiki/List_of_30_Days_episodes#Season_1:_2005)

<comment><USER19> There's also a book in a similar vein called "Nickel and Dimed: On (Not) Getting By in America" [1]. Fairly good read.

[1] <http://en.wikipedia.org/wiki/Nickel_and_Dimed>

</comment></comment><comment><USER20> I always wanted to ask these questions to a knowledgeable group of people:

\- What if there was a worldwide law about minimum wage at $7/hr?

\- How would world economies react?

\- Would it end poverty? destroy economies? ignite wars?

\- Who is responsible for not existing such a law?

Interesting links?

<comment><USER4> Money is not wealth. Money is just a convenient abstraction facilitating barter. If you have little to barter, compelling the buyer to give you $7/hr (or suitable unit equivalents) only serves to devalue what $7 represents. If you legislate paying the gas station clerk $100/hr, soon a gallon of gas will cost about $50.

Money just divides up the total value in an economy. Forcing people to trade more wealth, however represented, for less value can only wreck an economy.

The economic law of supply and demand is responsible for not existing such a law.

Links? news.ycombinator.com - it's all about the reality of creating wealth.

<comment><USER21> Deabstraction of money doesn't really make your argument any clearer as it has no bearing on the law of supply in demand except to make clear that it's arbitrary and can be changed at any time.

Gas is a commodity so the price wouldn't fluctuate like that. At least not for a long time and not for economic reasons other than greed. Of course, greed is a natural market force, but it's not like that there would be a gas shortage from everyone being able to afford to fill their 20 gallon tanks.

<comment><USER22> Who covers the difference between the $7/h gas station attendants currently make, and the new $100/h? How do they do this without raising prices? Where does the farmer buy gas so as not to have to raise the price of food to match?

<comment><USER21> I was working under the assumption that the government would subsidize the difference.

<comment><USER4> Correction: government would confiscate the difference from other hard working people and encourage low-end workers to stay in those low-value jobs. Really screws up the labor market: "why work harder? I'm getting $100/hr running a cash register!"

</comment></comment></comment></comment></comment></comment><comment><USER23> If one were inclined to experiment, you could increase the payout of the machine to above minimum wage but with a small chance on each crank rotation that it would deliver a small electric shock.

</comment><comment><USER24> Does the machine withhold and file payroll taxes too?

<comment><USER21> No, so it's being about 33% too generous. It should be depositing a coin every 7.5 seconds if my calculations are correct.

Just think about that for a second. 7.5 seconds is a long time to wait for a penny, especially if you have to stand there running a crank the whole time, I'd just build a shack in the forest and start eating tree bark and berries instead.

<comment><USER25> What are your calculations? Medicare & Social Security should be 7.65%, federal income tax should be 10%, of which about half should fall under the standard deduction (assuming they're working about 30 hours a week). What's the rest?

<comment><USER24> Don't forget the employer matching 7.65% that they're obliged to hide from you.

</comment></comment></comment></comment><comment><USER26> It should have gold coins in the top plexiglass but output pennies.

</comment><comment><USER15> That is great art! Really makes you think

</comment><comment><USER27> How about the armless, who can't turn the crank? Sounds like a job discrimination case waiting to happen.

<comment><USER28> There are lots of jobs armless people can't perform, and hence cannot be hired for.

<comment><USER29> Sometimes stated as "blind people can't be bus drivers", also known (in the inverse) as a Bona Fide Occupational Qualification or BFOQ [1]

[1] [http://en.wikipedia.org/wiki/Bona_fide_occupational_qualific...](http://en.wikipedia.org/wiki/Bona_fide_occupational_qualifications)</comment></comment></comment>


Ask HN: Successful Non-Founders, was it worth it? - <AUTHOR>

I've been asked if I would join a startup with as a non-founding, but critical hire.  I've been offered a great amount of equity according to my research. I like the company a lot and think they're on to something.  I can figure out most of the pros and cons of joining them, but don't have a sense of what it could be like assuming a really positive outcome.  For those who ended up at really successful companies as non-founders, was it worth it?  Were you happy with your equity when the company sold or had an IPO?  Did the final outcome fall short of your expectations in any way?<p>Though the details are sparse, I used a throwaway to not upset the founders. <comment><USER2> What you make will probably a lot less than the founders. But if the company is successful, that will still be quite a lot more than what you get from a regular salary working at a big company. And what you end up learning is also quite a lot more.

So, if you are not starting your company and if you believe in what the founders are doing, I would say go for it.

<comment><AUTHOR> Thank you for the response. I also have an startup idea I'm excited about, but its chances of success are much more unknown than this existing startups. The founders are pretty well connected, so it seems I'd be learning a lot of things that I might not if I were the founder the first time around.

</comment></comment><comment><USER3> Here's one data point from a $270M exit:

Joined post-series-A at 0.2%. These initial options eventually got diluted down to 0.05%. I did get "re-upped" with more options over the years, so when the company exited seven years later, my total was about 0.085%.

I ended up with an extra $227K for my efforts. This was on top of an above- market salary. Not too bad, but did fall short of my expectations.

</comment><comment><USER4> At the risk of stating the obvious, equity gets diluted. A great amount at the start may be trivial after several funding rounds. You might run the numbers for high, low, and middle scenarios.

[http://www.avc.com/a_vc/2010/10/employee-equity- dilution.htm...](http://www.avc.com/a_vc/2010/10/employee-equity- dilution.html)

Good Luck.

<comment><AUTHOR> Thanks for the link, I hadn't seen that post yet. Dilution is my main concern, so I'm curious how it ended up effecting others that made it through. The non- monetary gains would be excellent without question!

<comment><USER4> From observation, FU money is unlikely. There is probably an inverse correlation between the likelihood of FU money and the likelihood of multiple funding rounds.</comment></comment></comment>


Ask HN: Are web/marketing agencies inherently difficult to scale? - <AUTHOR> I've worked for two agencies but have much more experience with one than the other (4 years vs a couple of months). I want to know if this is the typical life cycle of a web marketing agency that is largely B2B to small-medium businesses.
I saw their company in two different "stages" of its life when I've worked for them. First as a junior contract developer making about half of local median pay (the contract mentioned a shift to full-time with higher pay but never followed through on that). In my first time working there, the business was being run from another company's sublet rooms. Structure was "top heavy" over 50% being management that delegated tasks to off-shore teams. Being a local dev in the company was a rarity.
Two years have passed, at some point I was seeking work and decided to go back to my old company since the founder was interested in having me do consulting work for them. I was paid just slightly more than my time as a junior dev, and usually put projects that had clients that didn't interact with the other employees beside myself and the PM. It was very silo'd in. Pretty much, do the work that their regular employees don't have time for.
During this time they had already moved into their own dedicated office. There are still a lot of kinks in the armor but at least things feel more organized in the company. Local dev team is still barebones with the management largely directing off-shore workers. And then I started thinking, if this is 3 years of growth I wonder what is the next step to take this business to the next level.
Do agencies form some proprietary tech that make them attractive for large co's to pick it up and buy them? Is that a general case? I am not thinking of starting a business, but I don't see if there's, if any, way to properly scale up to a national level. Is the agency model just inherently restricted to scaling? Could they expand their vision and scale up? <comment><USER2> I don't know if a web agency is hard to scale but there is no benefit to the agency or the customers in doing so.

Long ago, I worked for a failing agency which had once been the largest in town and the founder was convinced the problem was price competition from individuals who didn't have to pay for the overhead of a secretary, sales staff, health insurance, etc. I think the problem might have been more was that was intimidated by price competition and would lowball quotes for jobs such that we made a small profit on 4 out of 5 jobs and gave it back and then some on the last job which we quoted too low.

If you are successful your salespeople and devs will realize they can make more money working on their own account (after all you've busted your ass for years and thing you deserve the money instead of them.) Then they leave, you have to hire new people who are less experienced, and you've got more competitors to deal with.

Another issue is that the technology base of an agency inevitable erodes.

That firm was early to the web and used a rather unusual language with a "visual programming" interface for making web pages. It was way ahead of its time in 1997 the same way Cold Fusion was and was an advantage for them at the time.

They got the beat down from an up and coming company that was using mainly Ruby on Rails. (Actually I walked out of the first company and got a job at the second two days later)

A few years later that Ruby shop was heading for the tubes and everybody was struggling to retool to make single page applications.

Ten years from now the "Google Platform" will be a ghost town and the next thing will be Gopher++ or something.

</comment><comment><USER3> It comes down to management. Management needs to understand how SEO/Marketing/Digital Marketing works and they need to know how to scale it properly. It takes a lot of internal training and knowledge of that industry. There are a lot of meaningless tasks that digital marketing companies do that aren't moving the needle for clients.

I'd look at client retention rates, as well. A good agency should have high client retention rates. If they're just bringing in new clients for a few months and then the client leaves, then there's something seriously wrong.</comment>


Ridley Scott wants you to co-direct his next movie - <AUTHOR> http://www.youtube.com/lifeinaday <comment><AUTHOR> This is what the youtube logo for the past couple days has been counting down to.</comment>


Obamacare could help fuel a tech start-up boom - <AUTHOR> http://www.computerworld.com/s/article/9242833/Obamacare_could_help_fuel_a_tech_start_up_boom <comment><USER2> Obamacare is NOT about health insurance. It's about catastrophic injury insurance, which you are very, very unlikely to ever need. In the past, in the event of catastrophic injury, you declared bankruptcy and the hospital ate the bill. Now, in theory, some insurance plan will be on the hook for those costs.

Because of the way co-pays and deductibles work, you have to be in the top 10% or maybe 15% of health care spenders before you even break even with what you've paid in on a Bronze plan (by far the most popular self-purchased plan). Catastrophic injury type health insurance has been available for awhile, at reasonable rates, unless you had a serious pre-existing condition. So there's not much new here except for improved access for the chronically ill (or their breadwinners), who seem unlikely to be prime candidates for entrepreneurship.

It's incredible how much disinformation there is around ACA fueled by political agendas on both sides, and how little most consumers understand of the law's actual impact on the health care and employment markets.

<comment><USER3> I wish it was about catastrophic injury insurance. I'm a single, healthy 33-year-old guy with no kids, so it'd be perfect for me. My annual healthcare expenditures are virtually zero, year after year, right now. Coverage in case of a heart attack or cancer would be awesome, because I can't afford a $100,000+ hospital bill, but otherwise I rarely even have a cold or the flu.

I live in California which, as the first state to comply with ACA, has numbers available for me up at coveredca.com.

The bronze plan requires me to pay a 30% deductible for the category of "High cost and infrequent care". So if I get cancer, my $200k bill (just to start, cancer treatment can go on and on) is still a $60k bill. I'm still bankrupt.

The Silver 87 plan also has a percentage-based deductible. Have to go up to the normal Silver plan to have a flat rate. For my age it'll cost over $200 a month if I make $30k/yr or more.

Also, all the plans, whether bronze silver platinum or anything else, include MANY MANY things other than "catastrophic injury coverage". Everything from prescription medication to preventative care visits.

I really really want a "catastrophic injury only coverage" option but I don't have it. That's what insurance SHOULD be, to cover you in case of significant financial loss. Imagine how expensive car insurance would be if it covered oil changes, or homeowner's insurance would be if it covered minor repairs?

For someone that's lamenting the "disinformation around ACA", I really don't think you've checked the actual costs/plans involved. Well, I have, and let's not pretend that Obamacare offers plain and simple catastrophic coverage because it doesn't. Look at the website and see for yourself. That's California only of course but I doubt the other states will be able to do much better.

<comment><USER4> _So if I get cancer, my $200k bill (just to start, cancer treatment can go on and on) is still a $60k bill. I 'm still bankrupt._

The plans all have maximum annual out-of-pocket expense caps, above which you get 100% coverage, so it wouldn't be nearly as high as $60k. Checking the website, the out-of-pocket expense for the California Bronze plan is limited to $6,350/yr for an individual, or $12,700/yr for a family. This is precisely so that you can have a finite exposure that can be self-insured by keeping savings in an account.

So in your example, if you were on a family plan and hospitalized, you'd pay the first $5,000 entirely out of pocket (the Bronze-plan deductible). Then you'd pay 30% of the next ~$25,650 in expenses (~$7700), which would bring your out-of-pocket expenses for the year up to $12,700. At that point you've hit your out-of-pocket cap, so if there are still bills past $30,650, the plan would cover the entirety of the remainder.

The Bronze plan is essentially a high-deductible plan, but with the partial- coverage in between zone: you pay everything below $5,000, and nothing above $6,350/$12,700. The minor exception is that you get one deductible-free preventative-care visit per year.

<comment><USER5> How is that not a blank check to the medical industry ? I mean if this is true, it seems like it'd be trivial for the medical industry to exploit this loophole.

<comment><USER6> > How is that not a blank check to the medical industry ?

For one thing, because 100% coverage for medically-necessary care doesn't mean that everything that the provider would like to get paid for is medically necessary, and insurance companies are very enthusiastic (to say the least) about pursuing and denying and even clawing-back-payments-after-the-fact for _unnecessary_ charges, even when they are only on the hook for some portion less than 100%; with 100% coverage, they are 100% motivated.

</comment></comment></comment></comment></comment><comment><USER7> This article seems to make a lot of jumps that I'm not sure I follow. E.g. it says "anywhere from 19% to 50% of non-elderly Americans have some type of pre- existing condition". 29% to 50% is pretty wide range, but what "some type" means? Is it a cold? Is it a case of acne? Is it cancer? Is it debilitating chronic disease costing hundreds of thousands to manage? Is it a trifle that no insurer would care about? No idea. This phrase is completely useless for me if I wanted to estimate if a lot of Americans would be denied coverage due to pre-existing condition or not.

>>> The average age of people who create a tech start-up is 39, and not 20-something

This may be true, but how many of these people can not afford any health insurance? I know a lot of startups created by millionaires, but also a bunch created by penniless students or completely middle-class people. In what proportion are they among startup founders? Again, if I wanted to evaluate how many startup founders benefit from ACA, I can not do it based on the article.

>>> There is a big difference between mortgaging your house on something you can control, and risking going bankrupt by an illness because of something you can't control,

This does not sound convincing - most startups depend on thousands of factors they can not control - from Google releasing competing product a week before their launch to sudden storm in East Asia taking out one of the vital suppliers to fashion change driving clients to or from particular product. Presenting it as if startup founders control everything besides their healthcare costs sounds very non-convincing.

Unfortunately, this article makes a claim that is not properly supported by the data in it and can not be evaluated by the reader due to low relevancy of data provided.

<comment><USER5> I'd say the most common pre-existing condition is being a heavy (ex-)smoker.

<comment><USER7> Being a smoker is not a disease, AFAIK. But again, HIPAA Title I as far as I know provides for uninterrupted coverage regardless of health conditions, doesn't it?

<comment><USER5> That's probably why they call it a "pre-existing condition", not a disease.

</comment></comment></comment></comment><comment><USER8> I was under the impression this would increase the cost of insurance for younger people in order to allow insurance to better cover older people and those with pre-existing conditions....

<comment><USER9> It might do that, but so what? A slight increase in fixed costs, with a massive decrease in variance will decreases the risk of medical bankruptcy considerably, even for the young.

You seem to be under the impression that all potential entrepreners are young, without dependents, and without pre-existing medical conditions. Not true.

<comment><USER10> Note also that (as I understand it), if someone already has insurance they can maintain it through HIPAA. The main difference in that case from the new law is that they can't let their insurance lapse or there is no obligation for the insurance company to renew it.

<comment><USER11> Lots of insurance plans people had are being cancelled since they don't provide coverage mandated by ACA.

</comment></comment></comment></comment><comment><USER12> From a previous article in the Wall Street Journal [1]:

"The Kauffman-RAND Institute for Entrepreneurship Public Policy in Santa Monica, Calif., says the law could increase the number of new U.S. businesses by as much as 33% over several years"

[1] [http://online.wsj.com/article/SB1000142412788732405970457847...](http://online.wsj.com/article/SB10001424127887324059704578471122746420826.html)

</comment><comment><USER13> If only it was health care cost reform instead of insurance reform.

I simply do not understand how the 80% of insurance costs being spent or refunded is going to be true.

If you pay $5000 a year for insurance and you go for one checkup that year - are they going to give you $4000 back?

Somehow I suspect not. And I doubt it covers dental.

Everyone is quick to point out you won't lose your insurance for this or that - but can't they just raise the rate to the point where you miss a payment? Last time I checked your car insurance or life insurance is quick to drop you when you miss a payment or two.

And just like student loans, I suspect costs are going to rise to the point of your maximum insurance coverage.

<comment><USER14> No, they don't give you back $4000. They get $5000 from 1 million members and have to justify spending $4 billion. That savings gets passed back to you as a lower rate the following year. The point of 80%, I believe, is to drive the "for profits" out of the industry. With only a 20% margin, once you factor in the overhead, they are going to have to be aggressively lean.

This is the end run around price controls, call it profit controls.

<comment><USER15> It's profit controls for _insurers_ , not for providers, though. It doesn't particularly control delivered costs, except very indirectly (due to the lag between premiums and expenditures).

If provider prices go up, insurers can raise their premiums and still stay at 80%.

<comment><USER14> They have also liberalized the insurer market, so instead of 1-3 insurers per state you can choose one from CA, NY, or TN. If you get insurance through work it is up to HR to find the best rate. If you go alone you can use the exchanges.

</comment></comment></comment></comment><comment><USER16> I am almost 32 years old and pay $120/month for insurance with Kaiser (I have been very happy with them, and even had surgery done under Kaiser). I don't think this is necessarily a huge expense in the startup world, where people often spend this much on cable tv, cell phone plans, etc. I would guess a fair amount of people interested in entering the startup space are younger and healthier than I am. I am a little bit dubious that such a health care system would cause a startup boom - in fact, if you look at other countries with similar health care policies, they have far fewer startups per capita. This is not to say its a bad idea (you be the judge of that) - just that I don't think it will instill dramatic change in the startup scene.

</comment><comment><USER17> It's an interesting idea, but this post provides an interesting contrast: [http://www.thedailybeast.com/articles/2013/06/05/obamacare-j...](http://www.thedailybeast.com/articles/2013/06/05/obamacare- job-killer-or-entrepreneurial-turbocharger.html)

Basically, if insurance coverage is really creating "Job Lock" then the potential entrepreneurs will also likely be locked in by salary needs to.

<comment><USER18> While concerns over an interruption in salary are certainly legitimate, just uncoupling health insurance from employment will decrease the barrier to switching jobs and increase mobility.

It's worth noting that the "job lock" that you're referring to is a rather recent phenomenon. Employer-sponsored health insurance was essentially an accident of WWII wage and price controls (source: [http://www.nber.org/bah/2009no2/w14839.html](http://www.nber.org/bah/2009no2/w14839.html)). Because health benefits were exempt from WWII-era wage controls, employers used them to attract employees. Furthermore, because the employer contribution is paid in pre-tax dollars (i.e., employer-sponsored health insurance is effectively subsidized by the government), it became an attractive way to provide greater overall compensation to employees than otherwise possible.

However, the issue of coupling employment to insurance was quickly apparent, which is why we have COBRA (since 1985), but even that is more of a patch than a fix. Regardless of the merits or demerits of Obamacare, uncoupling employment from insurance is (theoretically) a positive outcome for everyone, whether one is an entrepreneur or not. We're already seeing firms shift their cheapest plans to exchanges ([http://online.wsj.com/article/SB1000142405270230479580457909...](http://online.wsj.com/article/SB10001424052702304795804579097422592424860.html)). Increasing health insurance portability should make jobs less "sticky" and result in a more efficient distribution of labor.

<comment><USER19> Indeed. BTW, I think Obamacare has largely been an exercise for how to take a broken system and "fix it" if by "fix it" one means stack everything against the individual and for big pharma/medical device manufacturers.

The problem is we have used health insurance to chain people to jobs for a long time now, and the result is that it is very hard to be self-employed in the US (much harder than in any other country in the world). This needs to be decoupled whether it is "buy your own insurance," or whether it is something like Canada's province-by-province single payer approach.

</comment></comment></comment><comment><USER20> Hmm. If this is true, then why do there seem to be more (and more successful) tech start-ups in the US under the pre-Obamacare system than there are in, say, the UK, where almost all healthcare is covered by taxes and is free or nearly free at the point of use?

I guess it's not implausible that there's a separate factor that makes the US a better place to do a startup, and the current healthcare situation counts against that factor. But still.

<comment><USER6> > If this is true, then why do there seem to be more (and more successful) > tech start-ups in the US under the pre-Obamacare system than there are in, > say, the UK

There's pretty much more of everything in the US (except maybe castles and titled nobility) than there is in the UK.

~40 times the land area and ~5 times the population has that effect.

</comment></comment><comment><USER21> That headline reminds me of how the iPhone 5 was going to save the US economy.</comment>


Electric black cabs hit London's roads - <AUTHOR> http://www.bbc.co.uk/news/business-42221375 <comment><USER2> That is a pretty bad title. It should be hybrid cabs, not electric cabs, and - coincidentially - I was talking to a London cab driver a while ago about going electric and he reckoned that it would be terrible for business if the cab could not be charged overnight because the only thing that mattered to him was how much his cab would be on the road and his daily mileage comfortably exceeded the projected battery range of any electrical cab offering that he was aware of at that point in time.

Hence the petrol engine, which will more than likely be the main propellant for these cabs, so it is a nice PR move but let´s wait to see how many miles are actually driven electrically before we get all happy.</comment>


A Numeric Type for Go? - <AUTHOR> When programmers complain about the lack of generics in Go, a common mitigation proposed is to use a interface. In many cases, it's possible to find an operation common to all the types to be supported; in the worst case, an empty interface can be used.
This doesn't satisfy many Go programmers, so a proposal for generic types has been made, containing the contract keyword:

    contract Ordinal(t T) {
        t < t
    }
 So a contract looks basically like an interface, which doesn't require a type to implement a certain method, but to support the use of certain operations on it.
When I think of operations and types that apply to them in Go, the following categories come to my mind:
1. Equality, expressed by == and !=, which is supported by most Go expressions. 2. +, which adds up numbers and concatenates strings. 3. Other operations for arithmetics and comparison: -, *, /, %, <, >, <=, >=. 4. Accessors and qualifiers: . and []
Complaints about the lack of generics in Go are often heard from programmers that want to implement numeric libraries. They basically want a type, which support the operations of the first three categories, which are basically the numeric types: integer, floating point and complex numbers.
So an abstract "numeric" or "number" type could eliminate a lot of the use cases for contracts. Is this an option being considered? Or isn't there just any benefit over using the double type for numeric computations? <comment><USER2> I would consider asking on /r/golang or the golang-nuts mailing list.</comment>


Liquid – A Language Integrated Quantum Operations Simulator - <AUTHOR> http://stationq.github.io/Liquid/ <comment><USER2> It's not open source as the title says, they just store a crippled version of the binary on Github. Check the "source" directory if you don't believe me. It's almost comical the way it's set up.

<comment><USER3> There are lots of samples at [https://github.com/StationQ/Liquid/tree/master/Samples](https://github.com/StationQ/Liquid/tree/master/Samples)

what makes you think its crippled?

EDIT: Do you use this kind of stuff? It's a little outside of my wheelhouse.

EDIT EDIT: I just set through a youtube lecture about this thing and its freaking amazing. I wish that I worked with stuff like this. Complaining because they didn't release some part of this as "to your liking OSS"...you need to hush. This thing is awesome and science is cool.

EDIT EDIT EDIT: [https://youtu.be/4mMizLpIVKs](https://youtu.be/4mMizLpIVKs) This was the ACM talk that I watched. Wow.

<comment><USER4> >I just set through a youtube lecture about this thing and its freaking amazing. I wish that I worked with stuff like this. Complaining because they didn't release some part of this as "to your liking OSS"...you need to hush. This thing is awesome and science is cool.

'To your liking' has nothing to do with it. If the title said it was open source, and its not, its not open source. Just because its 'cool' doesn't forgive misinformation.

<comment><USER3> The samples are open source. They extend and use F# which is open source. The page that is linked to doesn't say anything about open source, just that it's on GitHub. (It also says it runs on Linux and .Net, both of which are...)

The person that I was replying to said that the title claimed it was open source. I didn't see that. It seemed like they were just complaining because didn't look like every other GitHub repo.

I don't think that there was 'misinformation'...but thanks to thought police HN is still free of people trying to subvert open source software by releasing research tools for free? Yay. We're saved.

EDIT: Was calling it crippled 'misinformation'? There doesn't seem to be anything impairing its operation from the reading that I did.

<comment><USER4> >...but thanks to thought police HN is still free of people trying to subvert open source software by releasing research tools for free? Yay. We're saved.

You're free to take your baseless claims elsewhere. I said if the title did include that, then it is false. Perhaps the original title did have that, I don't know. What you would do in that case is discuss that, and not make up things about thought police.

<comment><USER3> Whatever captain freedom. Consider me thoroughly chastised.

EDIT: So I guess calling it crippled wasn't misinformation?

EDIT EDIT: Never mind. I don't actually care what you think.

</comment></comment></comment></comment></comment></comment><comment><USER5> Surely the very first thing I do with my first quantum computer is to run .NET on it.

<comment><USER6> I don't think we're at the state where people are trying to run simulations of quantum computing, on quantum computers.

</comment></comment><comment><USER3> There are some great lectures on youtube about this...it's been in development for quite a while.

EDIT: There's a video section on the support page. It's dope.

</comment><comment><USER7> There is a template language called "Liquid" by Shopify. One of you has to change the name to avoid confusion.

</comment><comment><USER8> Why was the mention of Microsoft removed from the title?

</comment><comment><USER9> One of the prereqs is a pkg called mono. That gave me a bit of nostalgia.

</comment><comment><USER10> "LIQ𝑈𝑖⏐〉" is a very strange logo...

Doesn't seem terribly legible to me.

<comment><USER11> It is for the physicists. The D is a ket...

<comment><USER12> Well, I have to admit I didn't realise it was supposed to read 'Liquid' until I read this comment. Somehow I had missed the title.</comment></comment></comment>


Mozilla's revenue increased significantly in 2016 - <AUTHOR> https://www.ghacks.net/2017/12/02/mozillas-revenue-increased-significantly-in-2016/ <comment><USER2> I tend to voice a lot of upset opinions about Mozilla, but I am still grateful for the work they do. It's nice to see that they have such a big resource pool to work with, as they are one of the few groups that I think genuinely cares for it's users.

It's also nice to be able to show other groups: Yes, you can be a "do good" company, and make a good living.

<comment><USER3> > It's also nice to be able to show other groups: Yes, you can be a "do good" > company, and make a good living.

...so long as a "don't be evil" mega-corp continues paying for it

<comment><USER4> That's a silly way to look at it. They're paying for a service that Mozilla provides to them, as a business transaction. Being a "do good" company obviously doesn't mean requiring that of every one of your customers: There's not a company in the world that isn't economically connected to something you'd consider "evil" by a couple degrees of separation at most.

<comment><USER3> > They're paying for a service that Mozilla provides to them, as a business > transaction.

IMO, _this_ is a silly way to look at it.

Mozilla's existence is critically dependent on a single "customer" that requires the privacy-focused "do good" company to preset a user's default search choice to an anti-privacy track-you-everywhere company.

don't get me wrong, it's a great [and necessary] compromise for the money and being easily changeable. i hope firefox can regain user share so that google continues needing it.

<comment><USER4> That makes a lot more sense. Your initial comment without this context sounded like economic contact with someone reduced you to their level of "goodness", which I strongly disbelieve. That isn't to say that you shouldn't draw any lines about who you'll do business with, but this line in particular didn't make a lot of sense.

</comment></comment></comment></comment></comment><comment><USER5> For those who will come in and complain about why Mozilla needs so much money:

[http://robert.ocallahan.org/2017/12/maintaining- independent-...](http://robert.ocallahan.org/2017/12/maintaining-independent- browser-is.html) discussed just a few days ago [https://news.ycombinator.com/item?id=15836027](https://news.ycombinator.com/item?id=15836027)

</comment><comment><USER6> "Mozilla ditched Yahoo recently however in favor of Google, two years before the five year contract would be up for renewal. The terms of the new deal with Google have not been revealed yet, and it remains to be seen whether this new deal will give Mozilla's revenue another boost in 2017."

Apparently Firefox 57 when it is installed tries to switch the users default search engine to Google.

Whether it asks for user permission to do so, I am not sure.

Do the terms of the deal actually require them to do this?

<comment><USER7> I'm not privy to the search deal, but my understanding is that this is driven by our internal user research and metrics, which show that a significant number of users have a search engine other than what they prefer or expect. In these cases, users usually choose to directly navigate to their preferred search engine to search, instead of using Firefox access points. That's a poor user experience, so our focus here is on ensuring users have the defaults they want.

The decision tree is roughly:

1\. If the custom engine is one of our default options, keep it.

2\. If the custom engine was set by an add-on, keep it.

3\. If the custom engine uses HTTPS, prompt the user to actively choose by opening about:searchreset, and do not prompt again after the user has made a choice.

4\. If the custom engine uses insecure HTTP, silently reset to the default.

You can open about:searchreset yourself to see what the prompt looks like.

Code at [https://dxr.mozilla.org/mozilla- central/rev/a928be5dacc3b544...](https://dxr.mozilla.org/mozilla- central/rev/a928be5dacc3b544e29c0612b3f8cda6447df802/browser/components/nsBrowserGlue.js#2197-2210)

<comment><USER8> Re 3.: I think that's a terrible promtp. The prompt says, my _settings_ might be outdated and I should switch back to Google as a search engine. What's the reasoning here? Why is implied that the _settings_ are outdated if I use a custom search engine? No other _settings_ are checked/affected by this prompt, so why frame it as a _settings_ issue at all?

Re 4.: Why silently, why not a prompt here?

<comment><USER9> Using an HTTP based search engine should be explicitly opt-in, imo. Moving it to https by default seems like the right choice for non-technical users.

</comment></comment></comment></comment><comment><USER10> If you want me to take you seriously talking about revenue, don't show me half a balance sheet.

<comment><USER11> Links to the audited financial statements are available at the bottom of [https://www.mozilla.org/en- US/foundation/annualreport/2016/](https://www.mozilla.org/en- US/foundation/annualreport/2016/)

<comment><USER12> I think the point is they should have shown a cash flow statement.

<comment><USER13> You don't need a cash flow statement to show revenue. And if the cash flow statement is prepared using the indirect method (start with net profit, and adjust non-cash items) it may not even show revenue at all.

<comment><USER12> You don't, but it works a hell of a lot better than a subset of a balance sheet at a single point in time.

<comment><USER13> Probably, but sometimes both will be equally useless.

</comment></comment></comment></comment></comment></comment><comment><USER14> I imagine that if AOl had known the value of a browser back when they spun Netscape out, they would have made a different decision.

Given Mozilla's revenue and market share, it means Chrome is a multi billion dollar product.

<comment><USER15> With the size of Chrome's market share it isn't just money; it's power too. Google has enormous control in this area, that is to say, the internet.

I would expect a company like Facebook to worry about this near-monopoly and help out the competition, or possibly add to the competition by making its own browser. That's a browser I'd never trust.

Facebook does have their apps though, which are independent from Chrome. But most people use Android, and Google controls that too.

<comment><USER16> Yeah, I'm often surprised Facebook hasn't published their own browser yet. Though then again I guess their other strategy is to move people away from browsers.

</comment></comment></comment><comment><USER17> Wow, those income and expense figures are incredible! Am I the only one that didn't realise just how _big_ Mozilla is?

<comment><USER18> I am surprised as well, especially the point that they must own so much furniture that it is specifically mentioned in their assets sheet.

</comment></comment><comment><USER19> Are _Investments_ a tangible, liquid asset?

Or is this line item from subjective valuations, like owning equity in private unicorns?

That would seem to make a big difference in financial health.

</comment><comment><USER20> Firefox, please I need my tabbed browsing back! One click and boom it opens a new tab after clicking a link, opening a bookmark, rendering a search result and etc!

Tab Mix Plus made Firefox my default browser yet it's not supported and or there's new substitute :-(

I reverted back to the previous release but then it seemed After a week to start displaying hacked behavior. Started opening tons of windows with each click.

<comment><USER21> As a TreeyStyleTabs fan, I am 100% happy with Firefox 57.

As you probably know, no other browser (other than ones based on older Firefox versions) supports anything like Tab Mix Plus. And there's a reason for that.

</comment></comment><comment><USER22> Mozilla should do Ubuntu.

</comment><comment><USER23> Yes, and also continued to lose market share!* I wish they would stop changing the user interface so frequently.

* [https://www.w3schools.com/browsers/default.asp](https://www.w3schools.com/browsers/default.asp)

<comment><USER24> I beg to differ, I wish they would not remove the previous interface when introducing a new one and offer the user the freedom to choose the one she prefers.

This is one major gripe I have with mozilla and firefox: depriving the user of the freedom to choose and forcing change upon them.

This constant interface change is affecting many of the older people for whom I provide technical support. They all relied on classic theme restorer extension to be able to use their browser and dropping support for the "legacy" extension gave them a hard time and the solution has been to drop firefox for waterfox or to drop the computer to get one of those tablets.

<comment><USER25> > This is one major gripe I have with mozilla and firefox

Looking at this page, you seem to have more than one ...

<comment><USER26> Right now there are 81 comments in this thread and bigbugbag has written 18 of them.

<comment><USER27> I know that people can be salty about open-source projects, because you sort of feel like you can get involved and they're supposed to be the good guys and then you notice that billions of other people just as well want to get involved, or at least be considered, and that your opinion is in the minority and they can't make the impossible possible.

But man, how can be you this persistently salty about it? Even just writing all of these comments must have taken at least half an hour.

</comment></comment></comment></comment></comment><comment><USER28> Well, i've been running firefox pretty consistently since I switched from Netscape all those years ago. I've tried pretty much every browser out there, and have a fair number of them installed but came back to FF...

But 57, is likely the end. Yah, they fixed it. Its a little faster, but it still seems to consume RAM/CPU until my whole machine grinds to a halt. Previously, when it did this I could be assured that it likely wasn't consuming more than ~2GB and a little more than 100% of a core.

So, unless they fix this decade long RAM/CPU consumption problem they have, i'm getting rid of it. I don't mind having to kill it every couple days, I just can't stand having to wait 30+ seconds for the task manager to swap in so that I can kill it. At least on linux I can constrain its resources, but i'm not going to run it in a VM (like I do java) just to have some control when it goes all piggy.

(some of this is likely my own fault, and happens with other browsers too, since I haven't managed to cure my tabitus habit of failing to close tabs i still have interest in).

<comment><USER29> Does Chrome fare any better?

<comment><USER30> Chrome has a serious issue with too many tabs open in the same window. Eventually the tabs cannot become any narrower and will ovwrflownto the right with no way to scroll. This is a known and unfixed issue since day one. So the Chrome UI does provide a sort of limit on the number of tabs you can reasonably have open and comparison becomes difficult. I use Vivaldi which is also based on blink and has a better UI for many tabs. This browser has way worse memory consumption than Firefox and I believe the results are similar to what you would get with Chrome.

</comment></comment></comment><comment><USER31> The Mozilla Treasurer and Chair are still taking $1M each, right? Why is this scandal going unreported?

Are there really no experienced managers willing to run this potentially great organization for $300k/year? Why would we want people who are willing to take so much money from an open source project?

Why are there 1200 people at Mozilla and so little product to show? Why do they constantly spend all of their revenue? Why is it continuing to lose marketshare? Why is there no oversight or improvement after years?

It _appears_ a lot like Mozilla is a corrupt organization taking bribes from its competitor (Google) to not actually compete. There may even be a need for government intervention.

Mozilla spends all of its money, so it's in a perpetual state of needing more. Google probably makes it known that any serious competition would result in the money faucet being shut off.

A competent and uncorrupt Mozilla could have built a Google Search competitor by now and even better browser. It's disappointing.

<comment><USER24> This is something I wondered about for quite some time now. How come so many employees and so much spent money with so little to show for it.

Reading the reason for dropping alsa support or refusing to have better linux integration it seems mozilla is short on dev time and resources which they clearly are not.

Do you remember when they got 10 000 people donating money to pay to place an ad for firefox 1.0 in NY Times while at the same time they had revenue in tens of millions of dollars ?

Mozilla had a strong stance against a content blocker in firefox for what ? 15 years ? Whatever they said to justify this position it is obvious that the actual reason is conflict of interest with their main source or revenue.

Isn't it strange that while their user base has been divided by 5 their revenue has been up by more than a hundred millions ? Even more so when this revenue is based on number of users being sent to search engine of this commercial partner.

Has anyone on HN and explanation for this ?

<comment><USER32> Their user base has not been divided by 5. Their market share is way down, because they are not growing with the pool (not surprising given their lack of success in Mobile), which is a different metric.

They are paid for the number of eyeballs they send to their search partners, and it's still a few hundred millions users. Also, it seems that they were underpaid compared to other companies like Opera and Apple were getting per user.</comment></comment></comment>


Nokia has as many people for smartphone software as Apple does for all products - <AUTHOR> http://www.asymco.com/2011/02/04/nokia-employs-as-many-engineers-for-symbian-and-meego-as-apple-does-for-all-its-product-lines/ <comment><USER2> In my mind, this proves how important it is to hire people that can hit the high notes

        The Creative Zen team could spend years refining their
        ugly iPod knockoffs and never produce as beautiful,
        satisfying, and elegant a player as the Apple iPod. And
        they're not going to make a dent in Apple's market share
        because the magical design talent is just not there.
        They don't have it.

        The mediocre talent just never hits the high notes that
        the top talent hits all the time. The number of divas
        who can hit the f6 in Mozart's Queen of the Night is
        vanishingly small, and you just can't perform The Queen
        of the Night without that famous f6.

<http://www.joelonsoftware.com/articles/HighNotes.html>

<comment><USER3> I don't disagree but when you say this "proves" that point I'm not sure that's true. You can just as easily hire people that can "hit the high notes" and fail because of mismanagement. The best example of this is Apple's Copland (a.k.a. System 8) Operating System. To quote Wikipedia...

 _At WWDC '96, Apple's new CEO, Gil Amelio, used the keynote to talk almost exclusively about Copland, now known as System 8. He repeatedly stated that it was the only focus of Apple engineering and that it would ship to developers at the end of summer with a full release planned for late fall._

(Source: <http://tinyurl.com/2lrwzd>)

So even with the entirety of Apple's engineering resources devoted to it this project still collapsed. As far as we know Nokia could be in the same boat with a bunch of high note hitters being held down by poor management.

<comment><USER2> There are 10x managers just like there are 10x engineers.

</comment></comment></comment><comment><USER4> Am I the only one that finds Asymco to be transparent and unsubtle pandering?

Nokia's got higher R&D than Apple, but Apple's got higher profits, so Nokia are stupid and Apple are smart.

If Nokia had lower R&D than Apple, then Apple would still have higher profits, so Nokia would still be stupid and Apple smart.

So how is this any different from his other 900 posts pointing out that Apple have high profits? What analysis or insight does it add?

<comment><USER5> It tells you something about how the competition is doing, and a particular area where Apple excels.

Knowing how Apple compares to the competition, and what they do differently, is interesting.

</comment></comment><comment><USER6> There's some room for complaining about the "smartphone" classification. Most Symbian-based phones would not qualify as smartphones in the US. I'm on my third, and they're _pretty_ smart, but not having touchscreens really puts them in a separate market segment.

And those phones run Qt, too, which this analysis lumps in with MeeGo. So, if you counted up just the people Nokia has working on touchscreen phones, you might find it about matches the iPhone team.

Which, mind you, is still not a ringing endorsement of Nokia's efficiency. My N86 has some advantages (1) over, say, my wife's Android phone (a Backflip running 2.1), but Android has a lot more room to improve.

(1) Mostly quality of the phone UI, as opposed to computer UI. For example, the N86's voice control works with my headset. On Android, voice dialing requires you pull out the phone and press a button; with Symbian, you can just push the button on the headset. I now consider that essential; if I had to drive without a feature like that, I wouldn't be able to make calls.

<comment><USER7> >On Android, voice dialing requires you pull out the phone and press a button

That might be a quirk on your particular model of phone or headset, or maybe it was fixed with 2.2. The N1 definitely supports the headset button for voice commands.

<comment><USER6> That's nice to know, since I'm hoping to get an NS One Of These Days.

(I _know_ it's not the headset, since it's the same one I used to use with my Nokia, and it worked fine. But I could well believe it was a problem with the phone.)

</comment></comment></comment><comment><USER8> No matter what you say about Nokia, I love them. Here is why: \- Easy designs \- Affordable phones \- user replaceable batteries \- Cheap and fits in with my upgrade cycles \- the N900.

<comment><USER9> The N900 certainly wasn't cheap. In fact, the fact that I'd have to shell out another few hundred for a replacement smartphone is the only reason I haven't thrown it against a wall. I have it overclocked, and it's _still_ dog slow. :(

<comment><USER10> Do you have the latest Maemo version? It made it a lot faster.

<comment><USER9> I think I do: 20.2010.36-2.002

A bit of searching didn't tell me what the latest Maemo is supposed to be, but did imply that it was released last October, so I'm sure it would have popped up for install by now.

</comment></comment></comment></comment><comment><USER11> I was going to submit a comment about how poorly written the article is. Instead I will just mention that this has always been one of Apple's best qualities. They have managed to stay lean and capitalize on the inability of their competitors to do the same.

</comment><comment><USER12> Might be interesting to look at the total salaries instead of just the headcount. I understand Nokia did quite a lot of cheap outsourcing in the last decade.

<comment><USER13> According to Asymco's data, Nokia also spends 10.2% of their phone revenue on R&D, versus 2.5% for Apple.

<comment><USER14> Except R+D at nokia means anyone not actually bolting phones together.

Having 4 competing operating systems, each with their own layers of management and their own VPs all fighting each other - counts as R+D spend.

<comment><USER6> Four? I see S40, Symbian, and MeeGo.

Or are you counting the touch-based and non-touch-based Symbians separately? There'd be some justice in that.

</comment></comment></comment></comment><comment><USER15> this is like some were saying 'hotmail has as many users as google has for all of its products' for gmail.

now look where gmail is and where hotmail is.

</comment><comment><USER16> So? What are we supposed to take away from that? They have more numbers? That doesn't extrapolate to better products or better anything.

<comment><USER17> >That doesn't extrapolate to better products or better anything.

Agreed. So maybe we should be asking how Apple is growing faster than Nokia with fewer resources?

<comment><USER18> Nokia suffers from the mythical man-month. They've only recently discovered that throwing 6,000 engineers at Symbian didn't make it better.

<comment><USER14> But to be fair - they have now hired another 6000 HR managers to work out why not

<comment><USER5> That's not very fair :-)

<comment><USER14> Don't worry they have set up a series of "Strategy Boutiques" (seriously!) to get over it

[http://www.slideshare.net/whatidiscover/open-innovation- in-a...](http://www.slideshare.net/whatidiscover/open-innovation-in-a-large- enterprise)

</comment></comment></comment></comment></comment></comment><comment><USER19> I read in an article that I cannot track down right now that Steve Jobs has gathered some of the world's leading experts in aluminum, process engineering, glass - the creative power of Apple lies in its breadth and astonishing depth.</comment>


Linux Trojan "Hand of Thief" - <AUTHOR> https://blog.avast.com/2013/08/27/linux-trojan-hand-of-thief-ungloved/

<comment><USER2> > The Linux operating system is designed to have high level of security. > However, this year a few attempts to attack Web servers by backdoors > redirecting traffic or malicious apache modules have been discovered. The > aim of this Trojan is to compromise user desktop systems. With features > designed to abuse sensitive browser information, it could advance Linux > users a step forward in this specific environment. The same threatening > environment in which Windows users have existed for years. The statement > that the Linux platform is absolutely secure now seems even more illusive.

Once you have the ability to run code on a system (as someone dropping this trojan would), all bets are off. This has nothing to do with "security" and it's quite misleading to say that it does. I'm no fan of Linux from a security perspective, but this story has no impact on the security posture of a Linux system, period.

<comment><USER3> Bets aren't off. Look at what Chrome, NaCL does, or how iOS and Symbian (yeah) and Android (eh Linux there actually) isolate.

Privilege escalation bugs are getting rarer.

If Ubuntu put the browser in a LXC etc things could move forward.

Bets not off! We should carry on trying!

<comment><USER4> Please correct me if I am wrong, but I think all the OS's that you referred run apps on sandboxes with strong limitations on the file system access. If that is the case then the compromises might not worth it on desktops

<comment><USER5> If I'm not mistaken, Ubuntu ships Firefox with an AppArmor profile that restricts it by default.

(Question for those in the know: what exactly does it prevent firefox from doing?)

<comment><USER3> Yes it does. But I want defense in depth: I want it contained, I want OpenBSD- style randomisations and so on.

</comment></comment></comment></comment></comment><comment><USER6> So first question came to mind: how do it inject code to processes? You need something for that: working exploit, CAP_SYS_PTRACE capability, you name it. Googling reveals just bunch of stupid articles that don't mention what you need to "install" that trojan.

According to [http://www.techrepublic.com/blog/linux-and-open- source/hand-...](http://www.techrepublic.com/blog/linux-and-open-source/hand- of-thief-malware-could-be-dangerous-if-you-install-it/)

      The good news is that Hand of Thief must have the root
      (or sudo) password in order to install.

So how would it be? "Yow, just add this line to sources.list and run apt-get cool-hd-wallpapers-2013"?

Hello there. I'm the unix virus. Please sudo run me.

<comment><USER7> Think about how much software is blindly cloned from Github and executed by the unaware without so much as a look at the source. That's only one vector.

<comment><USER8> Yeah but none of the software I blindly download from any source gets run as root.

<comment><USER9> Can't guarantee that, can you? Say you run it as non-root and it sits there waiting for 'sudo * \n' and captures whatever you type after. Your non-root software could then execute itself with sudo using the password that it's captured.

<comment><USER10> Don't you need root to read keystrokes not being sent to you?

<comment><USER11> Not under X11. See `xev -id $WINDOW_ID` for a demonstration.

There's the XACE (X11 Access Control Extension) that tries to make it harder to snoop, but I don't believe that it's enabled by default in most distributions.

<comment><USER12> I tried this, I started gedit then xwininfo to get the window id then xev -id and then started typing in gedit. I saw event information but didn't see what characters were being typed so what's the point you're trying to make?

<comment><USER13> I do see what characters are getting typed when I do the same thing. For example:

        KeyPress event, serial 28, synthetic NO, window 0x2000003,
            root 0x2b7, subw 0x0, time 322414662, (225,283), root:(1057,269),
            state 0x0, keycode 26 (keysym 0x65, e), same_screen YES,
            XLookupString gives 1 bytes: (65) "e"
            XmbLookupString gives 1 bytes: (65) "e"
            XFilterEvent returns: False

<comment><USER12> I barely see half that information so something's different about how we're doing it. I'm Ubuntu 12.04 btw.

<comment><USER13> Do you see all the information when you let xev make its own window rather than look at a different window?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> > The statement that the Linux platform is absolutely secure now seems even > more illusive.

What now? When did anyone ever claim Linux was "absolutely secure"? Second, how is an attack that depends on the user installing malicious software evidence of a security lapse in the system itself? If you're just going to run anything I tell you to run, I'll give you:

sudo rm -rf /

<comment><USER15> I am not an expert on linux, but I always assumed there are less malware first because much more people are using windows - target audience much bigger, second - malware creators wouldn't want to create viruses for the systems they use.

<comment><USER14> Linux certainly is not immune to malware in general or even `viruses` in particular, but a virus isn't a very effective means of attacking "Linux." While it's usually used as a catch all for any malware, a virus is a specific type of malware. It needs to be able to infect a machine then spread. Most Linux installations use a security model that requires an administrative (root or sudo) password to install software. The biggest challenge that virus authors have when targeting "Linux" is the wide range of distros.

When you target Windoze you can write a .exe file and convince your victim to execute it. What type of file would you use to attack Linux users? If they use RPM, you could use a .RPM file. If they use Debian or Ubuntu, you could provide a .deb file. If you are attempting to send your virus to every email address in the victim's address book, you would need to know the package manager of the victim before deciding which attack package to distribute. Certainly, you could distribute the package as a script which determines the OS then grabs the appropriate package from a repository and installs it, but then you're exposing a lot of information about your attack to every victim. Eventually someone catches it.

So no Linux is not immune to viruses, but it's more the platform than the audience that prevents these attacks. When you want to attack Linux users, use a rootkit instead. Actually... please don't attack Linux users, there are enough Windoze users out there, and you shouldn't attack them either... because... ethics

</comment></comment></comment><comment><USER16> I read the article twice, but failed to find the attack vector. How would you get infected by this, short of running it yourself manually?

<comment><USER17> It's a trojan, not a worm

[http://en.wikipedia.org/wiki/Trojan_horse_(computing)](http://en.wikipedia.org/wiki/Trojan_horse_\(computing\)) [http://en.wikipedia.org/wiki/Computer_worm](http://en.wikipedia.org/wiki/Computer_worm)

<comment><USER18> That should be obvious from reading the linked article, and I think someone asking for the attack vector would know this as well. It is a valid question, we know that people are tricked into installing the trojan but every article about this so far has been light on details as to how they are tricked. A browser exploit, malicious software repository, no confirmation on anything so far.

</comment></comment></comment><comment><USER19> "The known version of Hanthie is starting processes using a fake Kernel process in user-space called [flush-8:0] and starting from the init process instead of the kernel process. So the current detection can be performed from user-space with the following script:

            if [[ $(ps -eaf|grep "\[flush" | tr -s " "  |cut -d" " -f 3|grep ^1$) ]];   then echo "Infection suspected";   else echo "No infection suspected"; fi

"

from [https://www.circl.lu/pub/tr-15/](https://www.circl.lu/pub/tr-15/)

</comment><comment><USER20> Can anyone explain how the form grabbing for Chrome works? For a code base as large as Chrome's, how would one go about finding the function(s) involved with sending POST data? There was a thread on HN about a month ago about Hand of Thief which sparked my curiosity. I was able to write a crude form grabber for Firefox, but couldn't figure out how to do it for Chrome.

For Firefox, I know about PR_Write (There's some information for how to form grab Firefox under Windows which I found applicable). Since PR_Write function is in a shared library, you can use LD_PRELOAD to get Firefox to call your custom form-grabbing PR_Write, which can then call the original one.

Not trying to do anything malicious - just genuinely curious.

<comment><USER21> This applies if the function you are looking for is not easily accessible, i.e. not an exported symbol in some shared library.

You find the function you are interested in in Chromes code base, then look for it in the compiled binary or library its located in (with debug symbols, usually). You build a pattern from the functions code bytes. You then inject your evil library into the target process (also through LD_PRELOAD, but there are tons of ways) and have it search in the process memory for the function from the bytes you acquired previously. You temporarily change the page protections and overwrite the first few bytes of the target function to instead jump directly into your code.

You have to be careful with calling conventions or you will corrupt the stack, and often you want to preserve the original bytes of the function such that you can call into it from your replacement function.

This is what is called a hook, or a detour. Microsoft even has a library for this that does all of the previous in a neat package ([http://research.microsoft.com/en- us/projects/detours/](http://research.microsoft.com/en-us/projects/detours/)), but the basic redirection is very simple.

</comment></comment><comment><USER22> >Immediately after start, the Trojan checks if it does not run in a virtualized environment

What would be the performance implications of running everything under a virtual machine on a very light host OS? The idea had not previously occurred to me, but it seems like there would be a ton of advantages to that, including increased security.

I know that some compatibility issues will vary depending on VM software, but from a pure performance perspective, what kind of loss are we looking at?

<comment><USER23> These days, not much, 5-10%. Most VMs "cheat" and are effectively paravirtualized (e.g. using guest additions that talk to the hypervisor directly).

<comment><USER22> I played some with VirtualBox and an Ubuntu install, and it looks like the graphics support really isn't there yet (WebGL didn't work at all, for example), but I might give it another shot with a non-free alternative at some point.

</comment></comment></comment><comment><USER24> So as it seems "commercial" malware is coming to the linux desktop: Are there already any good, free anti virus programs for linux?

I had a quick look at [http://www.clamav.net/](http://www.clamav.net/) but it seems to target mainly windows stuff attached to mails and from some comments on the net isn't that reliable at detecting known malicous stuff ...

<comment><USER25> I haven't looked in awhile, but ClamAV actually did very well in some third party virus tests. You shouldn't need a Linux specific product. Good AV systems detect viruses for multiple platforms irregardless of the host performing the scan. It's actually really hard to gauge AV effectiveness, so take those published tests with some healthy skepticism. ClamAV detects Linux and Windows viruses, but does not include an on access scanner. It's usually fired off manually or hooked via other programs (spam scanners).

There is however, a fuse FS ClamFS [http://clamfs.sourceforge.net/](http://clamfs.sourceforge.net/) that provides on access scanning for Linux with ClamAV. I have no idea how much overhead that incurs, but it probably isn't a small amount. A lot of enterprise offerings provide on access scanning (McAfee, F-Prot, Kaspersky, and more).

I'd imagine there are Firefox and Chrome add ons as well.

</comment></comment><comment><USER26> TIL: create a scsi device named after the pattern virtual box uses and be immune to all trojans.

</comment><comment><USER27> The article states "we observed an anti-monitoring check (no communication if wireshark or tcpdump is running)". Does anyone how how resistant it would be to logging of outbound connections with iptables?

</comment><comment><USER28> How do we detect it's presence ?

<comment><USER29> Not entirely sure about detection, but it seems like you could just add some "fake" indicators to your distro to make it look like it's a VM instance and the trojan will helpfully delete itself.

</comment></comment><comment><USER30> Much ado about nothing.</comment>