Ask HN: I work for consulting firm that's illegally moving bank code to GitHub - <AUTHOR> A big bank in Australia has outsourced its work to my consulting company and when I started work at this bank (One of the biggest in Australia) I noticed that my consulting company is illegally uploading bank software to github.
They do this because each consultant needs to have background verified by the bank security advisors which takes around 2-6 weeks and moving all the software to github allows all consultants to start working immediately (without waiting for background check to complete).
I pushed my code to github without my knowledge the first day and brought this matter to my higher ups in my company but they threatened to take me off the project if I "impeded the workflow of the team".
Now, my rest of the contract fees hasn't been paid out.
A software lawyer said I could be implicit in this activity (which he says is NOT criminal but civil liability) because I pushed my code to the company github on internet (Regardless of my intent or ignorance)
I am an independent contractor with the consulting company. The Financial Ombudsman said I do not qualify for lodging a complaint since I am not  "technically an employee"
What's the way out? And will I be in legal trouble if I lawyer up? <comment><USER3> A. Shut up now. B. Stop talking about this. C. Shhhh! Shut up! D. Get a lawyer

It sounds like you're a good guy who want to do the right thing. But no one here can fully understand your situation, and it is not smart for you to be discussing this here. Find a lawyer who can give you good advice and protect your interests.

<comment><AUTHOR> >It sounds like you're a good guy who want to do the right thing

As much as I sound like I am trying to do the right thing all I am doing is avoid going to jail by doing illegal things and earning to feed my family

<comment><USER4> I don't want to (a) duplicate work and (b) misstep so I'm asking first - <USER2> you like me to ask in /r/AusLaw about this whole thing? I don't think there's much difference between me and you asking; just trying to be helpful.

EDIT: I'm leaving this comment here, but I just learned that /r/AusLaw does not provide legal advice under any circumstances. Asking them would likely get you the same "find a lawyer" advice you've gotten here.

<comment><AUTHOR> Thank you for being helpful. I really appreciate it. I did checkout /r/auslaw and noticed that do not provide any legal advice under any circumstances.

<comment><USER4> I'm very curious about whether you've made any progress in figuring out how to resolve this yet. Primarily for your sake, and also because of the side effect that this is an excellent learning opportunity for others.

I noticed your response to the person who provided the anonymized email address. Hopefully that proves helpful!

One request: it would be really awesome if you could provide an update when this has all blown over (which I realize might be months from now - although I hope the $ side gets resolved way before then!).

On the one hand bumping old threads doesn't surface them again, on the other hand I'd say it would be a 50/50 chance whether an update post would ever actually reach the front page on here. Somewhere on Reddit might be a better idea, but I'm not (yet) quite sure where would be a good practical, relevant and high-visibility spot to put it.

<comment><AUTHOR> No progress at all. I am about to give up and start looking for new contract.

Consulting company: Does NOT want to talk about it at all.

Bank: They were shocked by the news but since I am not their employee they can't reveal their decisions to me. I think they don't want to rock their boat and the consulting firm is major part of their IT division.

Ombudsman: I am technically not an employee. They want to help me but consulting firm refuses to communicate

Lawyers: Understable that they don't want to get involved unless I pay fees (It's like asking me to take a look at perl code for free). Too expensive and risk that I could be counter-sued. Plus it could potentially be criminal liability (With bank code and even customer data used for UAT on the internet).

<comment><USER4> Ugh. I've been staring at your post for a while wondering about solutions.

I wish there was some way to turn this situation into the bank thanking you with some kind of consideration.

At least it's good to hear that the bank now knows about it, although that doesn't really solve your situation.

I take it that fees are a problem because the contract payouts were stopped, more or less? (As infuriating as that type of situation is) For example I know of one lawyer in NSW who takes computer-related work - for mid-range three figures :/ (that said, would this be interesting to you?)

It sounds to me like it would be a very good idea for you to get a concrete, unambiguous idea (ie sit down and work it out with someone) of where you sit in terms of civil liability, relative to your total and utter ignorance (for example, what's the difference between (a) signing up for this contract, (b) walking into the building for the day and (c) committing the code? IANAL (!!!) but I reckon the argument of intent is equally weak with all examples). It's possible you may be less vulnerable than surface/kneejerk intuition might suggest - but of course I could be wrong. (I have absolutely no idea.)

Besides making it clear to the lawyers about the _immediate /current_ liquidity situation, the bank and ombudsman don't seem completely against you, and I wonder how far you could go with that.

I assume you've reiterated _all_ of the context (without unnecessary details, unless that's okay) with the Ombudsman, to see what ideas they might be able to come up with.

With the bank, you've probably scored a few points with the security and related folks there. If the consulting firm is integrated into the bank then that might point to systemic breakdown elsewhere, but on the other hand, their silence could simply be professionalism on their part while they mete out corporate knuckle sandwiches. (Or I could be being ridiculously optimistic.) Maybe you could chase them down and see if they'd be interested in having you on board; worst (ish) case is that you find more of this kind of thing and get even _more_ points. Something to keep in mind.

Finally, have you tried Legal Aid? They're not lawyers per se, but they may be able to give you a bit of a foundation to headscratch through this with. I would definitely call them. (It's only 3PM!)

As a last resort another contract may turn out to be necessary, and I hope that works out if it comes to that. But don't completely give up, even after that point - you refused to do work that could legally compromise you because it violates corporate policy and standard security access controls, due to the craziness and laziness of others. You should still receive your contract payout.

lol at the perl code bit :)

If you want to get in touch, my email is in my profile, and the username you've picked isn't taken on Gmail yet FWIW; there's really nothing interesting Gmail can leak. Just use a fake name/birthday for the associated G+ account that will get created.

<comment><AUTHOR> Unfortunately there are no solutions. The consulting firm is too firmly entrenched within the bank and the bank cannot make any decision without harming themselves. I have resigned and I will post an update on HN soon.

<comment><USER4> Wow.

For what it's worth, thanks very much for the concise headsup.

I think I can safely assume you'll provide a good idea of your experience in that update!

I'd really appreciate a link to it when you post it - I don't want to miss it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> First of all - get a lawyer.

Secondly - get a lawyer.

I don't know what state you're in, but Reddit's /r/AusLaw has a thread[1] which has the various law societies in each state, who can give you advice, and information about community legal centres.

[1] [https://www.reddit.com/r/auslaw/comments/1u776a/looking_for_...](https://www.reddit.com/r/auslaw/comments/1u776a/looking_for_legal_advice_australian_legal/)

<comment><USER6> Multiple forms of bad behavior here: working w/out clearance; making confidential code publicly available; conditioning payment on illegal/unethical conduct.

Definitely a lawyer - a new one, since if you were satisfied with the first one you wouldn't need to come to HN.

Some questions to ask the new lawyer:

\- Under applicable law, would you prevail in court to get your fees if you could only fully "perform" your obligations to contractor's satisfaction if you violated law? I'd expect answer to be yes, which could be noted to contractor's in-house counsel.

\- Under applicable law, in your situation, if the contractor continues to sit on the complaint without action, is there any possible argument that you would be required to escalate to the bank or a regulator? That's critical info for your own protection and also could inform what your lawyer says to contractor's in-house counsel, if you go that route.

</comment></comment><comment><USER7> Anonymously heads-up the country-level information security officer of the bank in question with a link to the Github repo. CC the country head.

Working on code without security background checking confirmed is an absolute no.

This will completely torpedo your employer, but that might not be so bad if this is their attitude to information security.

Edit: As anonymous as you can. Have a lawyer present. Don't take advice from the internet like it is legal opinion.

<comment><AUTHOR> The consultant is running wireless hotspots to copy the software. All I want is the contract money they agreed to pay me for this project. They froze the payment because I complained about this, at best unethical, behaviour.

<comment><USER8> You will need a lawyer to determine your own liability here, to determine the best path to report this to the bank, and to check your contract to see how you can force the payment to be delivered. Save any and all communication between you and the contracting firm, ideally on a device that they do not control, and don't communicate in any way that can't be recorded for your own protection.

Once things reach this stage you need a lawyer

</comment></comment></comment><comment><USER9> If they're refusing to pay you, as mentioned in a comment, get a lawyer. Now.

The lawyer can help you recover your wages AND advise you about the legal implications of both your and the company's handling of the code, and of any action you might take to reveal it.

</comment><comment><USER10> I am not clear on one important detail: Is the code being pushed to a public or private GitHub repository?

In any case, there are 2 issues:

1\. Your employer (the consulting company) does not want to pay you for the work that you have done.

2\. Your current assignment involves supposedly illegal activities (putting the customer's (i.e. bank's) code to GitHub) in which you do not want to participate.

In order to resolve issue #1, get a lawyer, analyze your contract and if its terms were indeed broken, sue the company.

In order to resolve issue #2, simply do not do it. Quit the job. If the matter bothers you and you want to stop the supposedly illegal practices from occurring again, talk to the customer (i.e. the bank, _not_ your employer). They must have some means of internal whistleblowing. Find out what it is and how to raise a concern. It should be possible to do it anonymously. As soon as you do it, your part is done. From that point on, it is their responsibility to take the matter further, should they wish to do so.

<comment><AUTHOR> 1\. Theoretically I am the asshole. I refused to push the code to github and the company refused to pay me.

2\. Yes, I refused to do it until proper channels were established but I ended up looking like a sore thumb when other employees didn't mind pushing/pulling from github.com via wifi hotspots.

I can talk to the bank, I can quit the job but the bottom line is that I will be without any cash inflow. My lawyer said that the consulting company is one of the biggest one and they will make sure that I don't have another job (Which is kind of true because of reference checks)

<comment><USER10> You did not answer the question.

And how exactly can your past employer "make sure" that you do not have another job? I do not get your remark about the references check.

If your potential future employer will be interested in references from your past employers and if they find out something which raises concerns, they should want to hear your side of the story as well. You will get every chance to explain what exactly happened and why you acted as you did. If they do not like it, you probably would not want to work for them anyway.

In any case, do not get intimidated and do not worry too much about the loss of income. It will be temporary. You have all the freedom to choose your next employer. Do so wisely.

</comment></comment></comment><comment><USER11> A word of warning - it's quite straightforward to do a Google search for 'site:github.com {bank_name}' for the large Australian banks, and find a repository that looks like the one you describe.

You might want to contact the HN admins and ask them to completely scrub this entire thread, as it could well get you into trouble.

<comment><USER12> I don't get your comment. Assuming we are not talking about public repos here. OP's employer did set up a private github repo where contractors collaborate on bank's code. This cannot be searched by google. The problem OP has is that the code should not be hosted outside bank's own infrastructure and contractors should not have access before they pass background checks. According to my understanding.

<comment><USER13> it's a public repo

[https://news.ycombinator.com/item?id=13679334](https://news.ycombinator.com/item?id=13679334)

<comment><USER14> No. They said it's on the public GitHub, as opposed to private GitHub enterprise installation. Not that the repo itself is public.

<comment><AUTHOR> This is correct. It's a "public github" as in it's on *.github.com with access to all employees of the consulting company regardless of the background check (That's the whole idea of them moving to their github repo)

<comment><USER4> I think there's a small misunderstanding here that I'd like to clear up explicitly.

Public GitHub repos are viewable by anyone with or without an account. You can view and clone the repo if you know the correct URL.

Private GitHub repos are only accessible to those given access.

Within the scope of this terminology, my understanding is that this repo is private. I think I'm right based on [https://news.ycombinator.com/item?id=13682657](https://news.ycombinator.com/item?id=13682657) and [https://news.ycombinator.com/item?id=13682501](https://news.ycombinator.com/item?id=13682501). Am I right?

Within the scope of corporate security, I understand that the code is being moved out of the local intranet onto a non-corporate-managed Web service. However, GitHub manage private repos for some fairly high-level groups (or at least I assume they do), so their data protection policies are clearly very decent. (I at least know that individual floors on the building are keycarded, which is nice. I learned this from a story posted here by a guy who got fired.) So, even though this is an impressive level of stupid, I'm relieved that no leaking can/will happen (particularly for your sake now you've posted this here).

OP, please note that several people have reached out to you from top-level comments. If you could add a new comment listing an email address (IANAL but a new gmail one would probably be okay), or even better yet put it in your profile, that would probably result in some nice leads for you.

<comment><AUTHOR> > I understand that the code is being moved out of the local intranet onto a > non-corporate-managed Web service

Spot on and this is what I meant. By "public github" I meant code on the internet but accessible to anyone in the consulting company. There are multiple modules and they are moved to github,bitbucket and stash.

This also means people without background checks or ANYONE in the organization has access to ALL the code of the bank. In the bank ONLY people in specific departments have access to specific code (As is customary for all IT industry)

I am not trying to be a whistle-blower and mr goody two shoes. I am very angry that my refusal to upload code to the internet is resulting in non-payment of fees and threats that I will never get a contract in this city. And as an independent contractor I am truly terrified of uploading bank code to the internet; I don't want to end up in jail for stupid reasons.

<comment><USER4> Gotcha.

Hmm, so this is violating standard access controls. I can appreciate your freaked-out-ness...

I understand you're not trying to make a scene (especially considering the circumstances!) and are simply trying to resolve what is effectively a legally-tangled paycheck bug.

Have you made any practical headway with figuring out how to resolve this? [https://news.ycombinator.com/item?id=13682560](https://news.ycombinator.com/item?id=13682560) looks interesting, and [https://news.ycombinator.com/item?id=13682806](https://news.ycombinator.com/item?id=13682806) sounds helpful also.

PS. FWIW, I'm in Sydney myself :) although I'm not working at the moment.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> As a consultant, this is why it is a good idea to have a corporate entity to absorb contractual liability...and why it is a good idea for that corporate entity to have no assets.

Practically speaking, and skipping the 'hire a lawyer' part. It is likely that if there is legal action, it will be directed at the consulting company first and foremost because it is likely to have deeper pockets and be backed by an insurance policy that was acceptable to the bank.

Generally, the insurance company will settle based on its exposure rather than outright liability. These things rarely wind up in court. Which brings me to my second recommendation, have insurance for errors and ommissions.

Good luck.

<comment><AUTHOR> Yes, what you are saying is true and that is indeed how I have worked in financial industries. I have my own ACN (C-Corp) consulting company with Indemnity/Liability insurance through which I work.

However this muddies up as I consult to a consulting company which in turn consults to the bank. I was informed by the Ombudsman that this was a common way to work in Silicon Valley and US has laws that clarifies it however Australia has not updated the laws regarding this "double employment"

<comment><USER15> Thanks. I tried to avoid getting too specific since I knew Australian law would be different, i.e. in the US the normal form of protection would be an LLC or an S-corp (tax pass through closely held entity) and a consulting firm in the US would very rarely be a C-corp (taxable income at both corporate and individual levels).

What employment means is also different. A person consulting to a consulting company that consults to a bank would have no employment relationship with either the bank or its direct consultant. The person might have an employment relationship with their own company that was contracted to the bank's direct consultant.

All of which _ought_ to be governed by contracts...which I failed to mention, but I'd not be surprised it they were in play here.

<comment><AUTHOR> Off topic: It would be good to have C-Corp and be taxable at both corporate and individual levels because companies pay a flat tax while individuals are tiered. This way we can choose our salary and leave the rest in company.

This however severely complicates cases like mine which has three pass-thru contracts

<comment><USER15> In the US, there is a cap on the wages to which social security tax applies. That tax amounts to approximately 15.5% of gross salary when the company portion and the individual portion are combined, the effective tax rate for an individual is much less progressive than portrayed in popular political opinion. It is also the case that control of a C-corp offers much less personal liquidity than is possible with an LLC. In addition, the layer of complexity for a C-Corp is likely to require more meaningful (from an individual perspective) expenses on legal and accounting services.

All things being equal, it makes sense to optimize on taxes. Most of the time, all things aren't equal.

</comment></comment></comment></comment></comment><comment><USER16> I would use the consulting company's open door policy and go up the chain... right to the country lead partner and mention this to them in writing. Believe it or not ethics is extremely important to consulting companies as trust and future work depends on this - and bring up any fears of being dismissed for bringing this up to their attention.

<comment><AUTHOR> >consulting company's open door policy

Just a heads up (regardless of my case):

Company open door policy exists to protect the company. Even the HR is there to protect the company. Even in US, whistle-blowing or rocking the boat will result you in being fired faster than you can say Oklahoma backwards.

</comment></comment><comment><USER17> I am not a lawyer, but I think we can safely talk about the commercial aspects to this.

1\. The bank won't chase you for what you've done. You have nothing the bank wants. The bank's legal team have bigger fish to fry. It's not cost effective for them.

If you want to walk away from this and forget about it, no-one will ever bring it up.

2\. Nothing will happen between the bank and the consulting company. If you want to make life interesting, you could send an anonymous tip to the bank's auditors (likely to be Deloitte or KPMG). There will be a slap on the wrist for the consulting company, and they will be forced to put in some kind of better access control. Which they will then bypass unless the auditors come looking.

3\. The only issue for you is getting your contract paid out.

If you and the consulting company's contract can be heard in Australia, you could try small claims court. There might be an equivalent in your own country if not. This is cheaper for the litigant and doesn't require legal representation (in Australia). There will be a process to follow (send a letter of final demand, etc. etc.).

I've never had to execute a small claims court case, because just the threat of it is enough to make most companies behave themselves and act like adults and negotiate sensibly.

In your case, the consulting company doesn't want it announced in court that they are violating the security of their customers (and that the reason you couldn't complete the contract was because you didn't want to be complicit in it). That costs them more than paying out your contract. Therefore they will settle before it gets in front of a judge.

But getting there will take weeks and months of heart-ache and stress. Decide whether it's worth it.

Just my $0.10 from 20 years doing consulting work with large enterprises.

</comment><comment><USER18> "Illegal" how? Against an actual Australian law, or do you think it's against the terms of the master services agreement the bank has with the consulting company. Have you seen that agreement or the specific statement of work they're operating under?

<comment><AUTHOR> I have worked in Financial sector for a long time and know that copying bank software illegally is criminal in US and probably civil in Australia.

I program for the bank via the consulting company and my code is on the internet. Plus my contract is frozen with fees until I withdraw my complaint to IT of my consulting company.

Not sure who to talk to in the bank. HR said I have to resolve with my consulting company but I am pretty sure the HR doesn't understand the implication of copying software

<comment><USER19> Is the illegal part generic for any software because of copyright and licensing or is it specific for banks? If the latter, what are those laws based on? Why is it not the same as any software for any private company?

</comment></comment></comment><comment><USER20> You're doing the right thing, please look out for yourself though!

You're pretty much inviting media in on this now before you're ready.

Delete post, it's a short list here in AU and I know which one of them I'd look at first. Get more legal advice before going any further.

</comment><comment><USER21> Tricky spot. You need a lawyer to write what's called a letter of demand for the rest of your contract fees. If your consultancy has any sense that should resolve things. Don't contact the bank as that could backfire. Suggest contacting [https://www.slatergordon.com.au/dispute- resolution/contract-...](https://www.slatergordon.com.au/dispute- resolution/contract-and-debt-recovery)

</comment><comment><USER22> My speculation is you're working for cognizant am I right?

<comment><USER4> I'm not seeing any GitHub organizations in Australia with that name...

</comment></comment><comment> eelliott<AUTHOR>
If you're in Sydney and want to have a chat email me edward at flagshiplegal.com.au.

</comment><comment><USER24> Seems like if you notified one of the higher ups in charge of security at the bank, they would probably take care of it. And maybe you could parlay this into your own consultant agency by being honest and promising to follow the rules and take their security seriously. But definitely consult a lawyer. I have no stake in your future. And free advice is often worth every penny you pay for it.

</comment><comment><USER25> Firstly you need to take care of yourself. If they are refusing to pay you and you are coming here to make an "anonymous public statement", it is fair to assume that your employer didn't like what they heard or quite simply how they were told. It is important to remain true to your values, raising it with your employer and explain why you are uncomfortable with that would have been my number one suggestion. She/he should be able to understand. It looks like she/he did not, my suggestion would be to raise it to she/he managers and managers manager. Always calmly and respectfully, as most likely there isn't necessarily a malicious intent.

Secondly, if you are really keen to reach out to the bank I'm happy to do it for you as I know quite a few security teams in the major banks. But please do not disclose who you are. Email me at firstname.lastname@example.com

<comment><AUTHOR> Thank you for the polite response. I did speak to the consulting company HR and their response was extremely rude with them going as far as saying they will make sure I never get a contract with anyone else in "(this city)"

The federal ombudsman offered to mediate the issue but they flat out refused to talk to either the ombudsman or me and the ombudsman has no power to force them (as they are technically not my "employer")

I am sending you an email

<comment><USER4> Hi. I think this comment shows up at the top of your user comment page so I'm adding this here.

I understand that things didn't work out but I'm very curious to find out what direction you went. An update would be hugely appreciated :)

</comment></comment></comment><comment><USER26> What rights has the bank given to the consulting company regarding the software?

If the bank has stated that the software can't be on github and your company is putting it there then it sounds like a legal trouble between the bank and consulting company with you as the whistleblower, if you decide to lawyer up

<comment><AUTHOR> There are strict security in place to prevent any "leaks" of software which means all USB ports are disabled in company devices, the company network has disable git/github/bitbucket and our security manual explicitly states that the code cannot leave the intranet.

The consultant bypasses this by running wireless hotspots

<comment><USER14> Talk to a lawyer. Especially because you're asking about Oz advice on a primarily us site, so common understanding of the law may be different. And whatever you do, consider if you can afford getting both fired and sued right now - even if people tell you you're right.

Also I'm assuming that's 100% the public GitHub service and not an on-site, or specially negotiated GitHub enterprise system?

<comment><AUTHOR> 100% public github because they want to give access to new employees who do not have access to enterprise system.

<comment><USER27> Please tell me you're not saying they're using a public repository (one reachable to anyone, even people not logged in to GitHub).

<comment><AUTHOR> Sorry, that's not what I meant. I mean *.github.com and NOT an enterprise level private repository.

If you go to the company's public github & bitbucket profile you cannot see the project but you can see all the devs and all these devs have access to the code.

The logic is: All the employees are able to work with minimal delay (caused by background checks)

<comment><USER27> Thanks for clarifying. It appears some other people in this thread ran to conclusions. Although the situation is still bad, just not immediately disastrous.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Just a clarification that I posted here:

By "public github" I meant code on the internet (from the bank intranet) and accessible to anyone in the consulting company (public as in public network). There are multiple modules and they are moved to github,bitbucket and stash. This also means people without background checks or ANYONE in the organization has access to ALL the code of the bank. In the bank ONLY people in specific departments have access to specific code (As is customary for all IT industry) This in turn means all contractors that git sync have all code on their machines regardless of their access.

The consulting company is not breaking rules just for the sake of it but to speed up development although what they doing is illegal.

<comment><USER28> > _although what they doing is illegal_

I can't add much to help you, but I'd be interested what laws requiring background checks for this look like, could you tell me where I can find more about that? (I would have expected this to be "just" a contractual requirement between the bank and your employer)

</comment></comment><comment><USER29> Ask a lawyer, also asking programmer for legal advice is like asking doctor for stock advice. They might think they have a good idea of what to do, but 99 times out of 100 that's because they have no effin clue what they're doing.

</comment><comment><USER30> If I were you I wouldn't worry about doing anything about the code being on Github. You need a lawyer to get the money you're owed, and then find another job.

As far as the bank goes: this is what they get when they outsource their work to an unscrupulous company. The company you're working for likely cheats both ways - don't expect to be treated any better in the future. They probably screw a lot of their employees over. They seem to have no issue doing illegal things. You don't want to be working for a company like this.

</comment><comment><USER31> _Now, my rest of the contract fees hasn 't been paid out.

A software lawyer said I could be implicit in this activity ...

...

What's the way out? And will I be in legal trouble if I lawyer up?_

I'm not sure why you are asking for advice on Hacker News if you've already spoken to a lawyer. Has the lawyer advised you to lawyer up?

There's nothing wrong with whistleblowing, or even venting on HN if you feel you were robbed by the consulting company of contracting fees, but I don't see the point of seeking legal advice here, under these circumstances.

</comment><comment><USER32> I have contacts in the security team of most banks in Australia. Happy to help

</comment><comment><USER33> Did you intend for your username to give away where you work? Unless of course Odecee is not the firm here.

You should probably check your professional indemnity insurance is all sorted out if you are a contractor.

</comment><comment><USER34> One thing that I haven't noticed anyone here mentioning is:

Document everything you've done. Everything. It may help protect you.

But get a good lawyer.

</comment><comment><USER35> What in the fucking fuck! How hard is it setup your own git server for the consultants to use?!

</comment><comment><USER36> Contact the CEO of the consultancy. Assume he/she doesnt know and would like to know. Do it in writing. Then write registered letters to all directors of bank if no satisfactory answer and remove yourself from project, and send threats of legal action if not paid in required time.

If you are upfront with the bank, it is unlikely they will take legal action against you. In the event they do, you will be protected by your limited liability company (assuming you are operating through one).</comment>


Escrow.com launches payments API - <AUTHOR> https://www.escrow.com/api <comment><USER2> Seems to be big news in the domain industry..

[http://www.dnjournal.com/archive/lowdown/2017/dailyposts/201...](http://www.dnjournal.com/archive/lowdown/2017/dailyposts/20171025.htm)</comment>


Vulnerabilities in mobile networks opens Bitcoin wallets to hackers - <AUTHOR> https://www.ptsecurity.com/ww-en/about/news/285038/ <comment><USER2> Slightly less exciting TLDR: as many of you already know, SMS isn't a good second factor for auth. That includes entrusting your Bitcoin wallet's private keys to a company using SMS for 2FA. Let's mention "cryptocurrency" as well to show up in more news alerts.

<comment><USER3> Paypal is offender number one. I don't understand why they can't use google authenticator. Is it some kind of pride thing, like paypal and Amazon?

<comment><USER4> Basically its a hangover from the PayPal football days (A PayPal branded Verisign 2fa token hardware device) they used to sell.. No idea why they don't transition over to Google Auth Style TOTP Algo.

But They still haven't ported all their systems to 2FA yet. Some pages require you to enter your password and append your 2fa token to the end of it (Mainly when logging in on mobile) and I know of a couple of stores that due to their PayPal integration I can not get to the final "Pay Now" page on paypal even though I successfully log into PayPal. But when you would normally get to that final page to press "Pay" the page just times out. I have to disable 2fa and do it again.

You can use "Symantec VIP" (it was renamed after Verisign was brought out). Though they don't make the sign up very easy. You have to go to the 2 factor page ("Security key") under security, press "Get security key", when prompted to enter your phone number press "cancel" then press "Activate your PayPal or VIP (VeriSign Identity Protection) token" and then enroll up as normal.

Its not Google Auth and it kinda feels like I can now gaining a collection of 2FA apps (iirc Namecheap's non sms 2fa is powered by Authy but you can not use Authy) so I do which they would all adopt a standard.

</comment></comment></comment><comment><USER5> I was targeted this evening by a hacker who ported my phone number, and then got into FB + Yahoo (SMS reset).

The motive appears to be bitcoin, based on the people contacted via facebook.

Is it possible the initial PIN that was sent by Tmobile was intercepted via SS7? I am trying to find out if my phone (android) is compromised as well.

The accounts and phone number are back under my control but I want to find out the vector as soon as possible -I don't trust tmobile to honor requests not to allow porting.

<comment><USER6> What a frightening experience! I'm sorry this happened to you. Curious to understand how these attacker obtain your phone number in the first place? I mean it's not something you publish widely right?

<comment><USER7> I don't mean to say it was OP's fault but you shouldn't really use your primary phone number for 2FA anyways. Using a burner dumb phone dedicated only for 2FA should be standard, right?

<comment><USER8> Standard? As far as I know, the majority of users dont even use 2FA at all. How do you expect them to have a dedicated phone for it...

</comment></comment></comment></comment><comment><USER9> Coinbase is not a Bitcoin wallet any more than your bank is a USD (whatever your local currency is) wallet.

This has no relevance to Bitcoin wallets.

<comment><USER10> Well, Coinbase provides what it calls Bitcoin wallets. But yes, they're just accounts, which control Bitcoin wallets.

Still, this is what many have come to think of as Bitcoin wallets.

Me, I only use local wallets. If I had lots of Bitcoin, they'd be offline.

<comment><USER11> I think it's important to hammer in the distinction into the minds of the public. The takeaway being that one should not treat coinbase as a wallet and thus should never leave coin in their accounts.

For example my boss lost coin trusting it in the hands of coinbase. He has contacted support to no avail. And there are no legal reprecussions for them doing this, just as Paypal reserves the right to freeze or steal your assets.

</comment></comment></comment><comment><USER12> How many times do we have to read that X is vulnerable to SS7 attacks? This has been going for the last couple of years.

SS7 in itself is huge disaster, I can recommend the following presentations: [https://media.ccc.de/v/31c3_-_6249_-_en_- _saal_1_-_201412271...](https://media.ccc.de/v/31c3_-_6249_-_en_- _saal_1_-_201412271715_-_ss7_locate_track_manipulate_-_tobias_engel) and [https://media.ccc.de/v/31c3_-_6531_-_en_- _saal_6_-_201412272...](https://media.ccc.de/v/31c3_-_6531_-_en_- _saal_6_-_201412272300_-_ss7map_mapping_vulnerability_of_the_international_mobile_roaming_infrastructure_- _laurent_ghigonis_-_alexandre_de_oliveira)

tldr: everything that uses sms is vulnerable.

edit: as others already mentioned, use offline 2fa like google authenticator.

<comment><USER13> > How many times do we have to read that X is vulnerable to SS7 attacks?

Until all those whose job it is to secure the various Xs stop ignoring the problem?

</comment></comment><comment><USER14> _Cryptocurrencies offer unprecedented transaction speeds_

Lol.

<comment><USER15> Maybe not Bitcoin, but most other currencies have near-instant transactions. Even Bitcoin's transaction speed outperforms wire transfers (in the US) by a matter of days.

<comment><USER16> Actually, I was shocked how quickly Bitcoin transfers were. About a week ago I watched someone transfer me $10 in BTC and I got "unconfirmed: $10" within a few seconds.

It wasn't confirmed until a few minutes later, but that was enough time to assume everything was fine and to keep doing stuff in the meantime. Concretely, you can assume almost every unconfirmed transaction will be confirmed, and you'll almost never be wrong. That means Bitcoin is effectively instant for every transacfion you don't need to care about, and in the other cases you can just wait a few minutes.

</comment></comment></comment><comment><USER17> So, a little anecdote, a friend of mine was the victim of an attack and wanted my advice. The attackers used the SS7 hack, but he also used a phone based TFA, and somehow attackers were able to get the keys to this. He was able to get some of his coins elsewhere on a paper wallet, but they got everything in his hot wallet, and he received a notification that his coins were being moved out of his cold storage. Thankfully this process takes some time, so he was able to get that company on the line and stop it (probably pure luck that the attackers didn't intercept this). I told him to lock down the cold storage and trash his phone (based on the level of control that would be required to get TFA private keys). So, there hasn't been any further analysis done on this attack (the cold storage coins are safe, that's the main thing), but just want to mention this to get your gears turning. It's possible coins being stolen this way are being used to fund a nuclear program - keep them close.

</comment><comment><USER18> Sadly, as far as I know, Paypal only allows SMS. I believe business account, you cannot link your Paypal to Braintrees and thus you cannot use any 2-auth authenticator.

If I am wrong, please correct me, but I see no other options on Paypal, which is ridiculous, considering Paypal is such an important service. SMS should not be used for any critical services, but in cases like Paypal there is no choice.

<comment><USER19> It is possible to enroll hardware tokens, but I believe SMS is a prerequisite.

It's also allegedly possible to deactivate in a bunch of other ways, e.g. by adding a new credit card.

[https://github.com/dlenski/python- vipaccess](https://github.com/dlenski/python-vipaccess)

<comment><USER18> Paypal itself I do not believe supports hardware token. If that is possible, it should be a bug, because that's a non-public feature...

</comment></comment></comment><comment><USER20> I wonder if you could use the interest in bitcoin wallets as a canary for device compromise - load up servers, phones, desktops, etc with unprotected wallets, add a small amount of bitcoin and set up an alert system if the funds are moved.

</comment><comment><USER21> Mobile phones should be used as a hot wallet storing small amount for convenience. The rest of the bulk should be on a [https://trezor.io/](https://trezor.io/)

<comment><USER22> Or a paper wallet, which is free, although it involves jumping through some extra hoops.

Here's the steps the steps commonly advised for Ethereum (also works for storing ERC-20 tokens):

Look up "My Ether Wallet" (be extremely paranoid and treble check the URL so you don't get scammed with a fake duplicate website). If you follow the steps below, your wallet is as hack-proof as a Nano/Trezor (just store the paper wallet securely, because it's the same as cash when the wallet is loaded with Ether).

1\. Create an offline MEW wallet, on a secure PC not connected to the internet (e.g. boot Linux ISO from a read only DVD)

2\. Print out the wallet details (will have the private key, a QR code for the wallet address, and another QR code for the private key).

3\. Send a small amount of Ether to test that you have the correct details (if you bought on Coinbase, use their app to scan the QR code of the paper wallet). The Ether should show up in the wallet within a few seconds (use etherscan.io to check your new address).

4\. If the test went ok, send the remaining Ether from Coinbase -> MEW.

5\. (Optional) Backup a digital copy of the MEW wallet on a clean USB, that you exclusively use for that purpose. Store the wallet details in a password manager on the USB, e.g. KeePass, Keeweb, (any open source password manager that is kdbx compliant). This is convenient for when you wish to do transfers. Make sure you don't accidentally copy these details to another PC, upload them online somehow, etc.

<comment><USER23> HN user jrruethe offered his 2015 guide to bitcoin paper wallets a week ago:

[http://jrruethe.github.io/blog/2015/04/23/bitcoin-paper- wall...](http://jrruethe.github.io/blog/2015/04/23/bitcoin-paper-wallets/)

src: [https://news.ycombinator.com/item?id=15246588](https://news.ycombinator.com/item?id=15246588)

</comment></comment></comment><comment><USER24> Clickbait, has almost nothing to do with Bitcoin "the first cases of attacks exploiting SS7 were registered in Germany, in which money was stolen from bank accounts"

</comment><comment><USER25> Use the Fiber Luke ! [https://www.fibretiger.co.za](https://www.fibretiger.co.za) :P

</comment><comment><USER26> This is why I use a hardware wallet [https://trezor.io](https://trezor.io)

<comment><USER27> I'll be a happy man when the code and specs for this little guy become public:

[https://firefly.city](https://firefly.city)

("Airgap" ETH wallet for $5)

<comment><USER27> Oh shit, I swear I did not see that coming

[https://www.reddit.com/r/ethereum/comments/71jc83/firefly_up...](https://www.reddit.com/r/ethereum/comments/71jc83/firefly_update_the_5_diy_hw_wallet_fireflycity/)

New crowd-funding page!

</comment></comment></comment><comment><USER16> Arg. I wish this article were more substantive, since it's an important topic. But there are no details.

<comment><USER28> After tons of reports of Coinbase accounts being broken into they looked into it, replicated it and then reported it.

SMS isn't a secure nor authenticated transport and never has been. Avoid anything that uses SMS as a transport for secrets or phone numbers as auth.

It's not just SS7 vulns but also number portability.

afaik Coinbase is still using SMS as an optional second factor, while iCloud still only allows SMS.

<comment><USER29> > while iCloud still only allows SMS

? I've had 2FA turned on for my iCloud account for a while, any time I've needed to authorize a device I've had to approve it on my iMac or iOS device, it doesn't use SMS.

<comment><USER28> you can approve login requests using notifications but you need at least one backup trusted phone number on your account

see step 2: [https://support.apple.com/en- au/HT204915](https://support.apple.com/en-au/HT204915)

"trusted phone number" is an oxymoron</comment></comment></comment></comment>


President Truman Did Not Understand - <AUTHOR> http://members.peak.org/~danneng/decision/usnews.html <comment><USER2> One could also argue that Leo Szilard did not grasp the political realities of his time.

Whatever the ethical considerations, negotiating with Japan was not an option after the massacres as reported by the US press.

Also a demonstration would have been more difficult to frame in terms of "it cost us $2B but we won the war without invading".</comment>


Show HN: Image-triangulation – Delaunay and Voronoi from scratch - <AUTHOR> https://github.com/MauriceGit/Delaunay_Triangulation <comment><AUTHOR> Hey guys,

it's my first post here, but I've been reading for a couple of months.

And right now I am ready to share some stuff I made. Please feel free to ask, criticize or suggest alternatives :)

A couple of months ago someone here (don't have the link anymore) inspired me to finally sit down and implement a delaunay-triangulation and voronoi from scratch.

What the python-script (drawTriangles.py) does is:

\- take an image, extract points dependent on the contrast and color difference of the image (more points on edges or in contrast-rich parts).

\- triangulate the points with a delaunay-triangulation (from scratch).

\- transform the delaunay-triangles into voronoi-regions.

\- render the triangles and voronoi-regions into new images with the average color for each polygon (from the original image).

The delaunay-triangulation runs in Omega(n logn) but I'm not 100% sure if also in O(n logn). The transformation into voronoi-regions runs in O(n).

Please tell me what you think :) Best regards Maurice

<comment><USER2> Nice work. The triangulation is a nice structure to get to know. You might be interested in something called data-dependent triangulation. The idea is that non-conventional triangulations (i.e., not Delaunay) make for good interpolating schemas, based on assumptions such as smoothness in the color intensity profile and so on. I wrote a Master's thesis [1] about this among other things such as decimating a dense triangulation mesh in strategic ways (using edge detection).

[1] [http://uu.diva- portal.org/smash/record.jsf?pid=diva2%3A85902...](http://uu.diva- portal.org/smash/record.jsf?pid=diva2%3A859026&dswid=-6921)

[Edit: My old blog with plenty of pictures: [https://femtondev.wordpress.com/](https://femtondev.wordpress.com/) ]

<comment><USER3> That blog contains some impressive image processing with examples, thank you for linking.

</comment></comment></comment><comment><USER4> Very cool!

In case C++ is your jam, ten years or so ago I adapted Steven Fortunes highly efficient sweep line algorithm to C++.

Some info here - [http://www.skynet.ie/~sos/mapviewer/voronoi.php](http://www.skynet.ie/~sos/mapviewer/voronoi.php)

A desktop app I built to use this code, generating Voronoi and Delaunay graphs, along with way more robotics/navigation/map generation stuff called MapViewer - [http://www.skynet.ie/~sos/mapviewer/main.php](http://www.skynet.ie/~sos/mapviewer/main.php)

Code on Sourceforge (yes, 10 years ago people) - [http://www.skynet.ie/~sos/mapviewer/voronoi.php](http://www.skynet.ie/~sos/mapviewer/voronoi.php)

<comment><AUTHOR> Very nice!

No problem with C or C++ (I am mainly working in C for OpenGL stuff for years).

I chose Python because I wanted to concentrate on the algorithm (didn't know, if there were obstacles along the way...). So in Python I could just go for executable pseudo-code :)

</comment></comment><comment><USER5> Very cool!

Is it possible to modify the algorithm to use vertex color instead of triangle color? It is possible to do interesting stuff like Homeworld 2 backgrounds.

[http://simonschreibt.de/gat/homeworld-2-backgrounds/](http://simonschreibt.de/gat/homeworld-2-backgrounds/)

<comment><AUTHOR> You mean like interpolating the colors from each vertex?

Yes, it's possible and quite easy to do so :)

I make a list of things to do - Homeworld 2 is on it ;)

</comment></comment><comment><USER6> This is awesome! I worked on a very similar project a few months ago, which I also posted to HN: [https://news.ycombinator.com/item?id=10418829](https://news.ycombinator.com/item?id=10418829)

Looks like yours is quite a bit more polished :)

</comment><comment><AUTHOR> All right, I added some pictures to the README of the repository, so you don't have to dig around to look at them :)

</comment><comment><USER7> well done, i guess...</comment>


Opera TV Store brings HTML5-powered web apps, browsing to TVs, set top boxes - <AUTHOR> http://www.geek.com/articles/gadgets/opera-tv-store-brings-html5-powered-web-apps-browsing-to-tvs-and-set-top-boxes-2011092/

<comment><USER2> Only requires 300mhz processor to run? So it doesn't support games, canvas animations or WebGL then, which is a big part of the draw of HTML5 now.

Might as well just call it a web STB and be done.</comment>


Ask HN: Any VCs in Toronto, Canada? - <AUTHOR>

Has anyone here ever reached and/or worked with any VCs in Toronto?<p>If so, can you please share who they are. <comment><USER2> Check out JLA Ventures. They are based in Toronto and just recently raised a new $100 million fund. Rick Segal is their most visible partner and he seems to be a very stand-up guy. <http://ricksegal.typepad.com/>

</comment><comment><USER3> <http://www.punctuative.com/vcdb/>

</comment><comment><USER3> I remember reading about VC's/angels near U of Waterloo, might want to check that out.

</comment><comment><USER4> i would suggest contacting the guys at b5media.com and talk to them - they are based in toronto and have received funding.</comment>


Dear Gap, I have your new logo. - <AUTHOR> http://weblog.muledesign.com/2010/10/dear_gap_i_have_your_new_logo.php <comment><USER2> Posts like this seem like the designer equivalent of the music labels spending years complaining about how sharing music is wrong and trying to put the "evil" back in Pandora's box, while millions of people merrily continue to download music off bittorrent anyway. The reality of the internet is that people can easily solicit work on spec from thousands of designers, and they will get good stuff in return. Will it be great? Rarely. But it'll be good enough for most, and if it's not, they're out nothing. See 99designs.com.

This seems like classic game theory. While it's in the design industry's collective best interest to never work on spec like this, it might be in an individual designer's best interest to design Gap's logo for free. And even if it's not, if most of them think it is, you've still lost. Believe me, I understand that Gap's move here is a slap in the face, but many designers out there will do it anyway, just for the chance to say they designed Gap's logo.

<comment><USER3> To be fair to the music labels, they at least have copyright law on their side. This is more like how professional journalists whine about bloggers.

<comment><USER4> Crowdsourcing involves getting many people to work for you for nothing; after which, you only pay one person.

I don't think it's surprising that many people dislike the idea.

<comment><USER5> Alternately, crowdsourcing involves many people getting the chance to try their hand at something that, normally, only one person would do.

I don't think it's surprising that that one person dislikes the idea.

<comment><USER4> The argument that the designers (/entrants) benefit isn't anything other than disingenuous posturing.

Crowdsourcing doesn't give many people an 'opportunity' to try something new - it provides the client with cheap design.

There's a very clear motivation behind providing design in this way, and the designer is always going to lose out.

<comment><USER5> The "designer" gets a little bit of scratch and exposure they never would have gotten otherwise. The "client" gets a design that meets their budget, and which is likely to be much better than what a professional designer would do for the same price. Who's losing out here?

<comment><USER6> > and which is likely to be much better than what a professional designer > would do for the same price

Why would you think a novice on the web with Photoshop will automatically do better than a professional with experience and who is looking beyond making a cool design?

Logos aren't just pieces of art — they also brand a company. Crowdsourcing will never match a professional brand designer.

<comment><USER7> And why would you think that a novice on the web with Photoshop _couldn't_ do better than a 'professional' with blah blah blah, especially when this new logo is amateur hour at best and utter crap at worst.

I sincerely hope that the entire Internet is being trolled by The Gap on this one, given that the alternative is entirely depressing.

Either that or this logo is legit, meant to last, will work on consumers, and in turn will reduce designer's hourly rates around the world. :)

<comment><USER8> Is there any doubt that they were trolling with this new logo? It looked like a placeholder from the first moment I saw it, and I know __nothing __about design (see historious).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER2> _I researched your customers. Talked to a variety of them, in fact. Asked them not only about The Gap, but about their own lives. Their needs. Anxieties. Their thoughts on the future. I took all that into account.

I also interviewed employees in a few of your stores. (They're quite dedicated, you know.) I asked them how they felt about the company and about their interactions with customers. Because customer service may actually be the most important part of your brand. And the logo's job is simply to help evoke those pleasant experiences._

Does anyone else find this pretentious? I somehow doubt that most of the world's biggest brands have logos that came about through this process, or at least are measurably different than they would have been if a talented designer came up with something that felt right and looked good.

[http://www.murdercapers.com/corporate/companyLogos/CompanyLo...](http://www.murdercapers.com/corporate/companyLogos/CompanyLogosNew.jpg)

I bet a lot of those are just variations on the original logo of the company when it was started. Maybe I'm completely wrong though; just seems like if you'd expect _anyone_ to think that designing a new logo should include hundreds of hours and dozens or hundreds of customer and marketing surveys, it would be a branding firm who wants to charge you for all that. I'm not sure anyone else would be able to tell the difference between a logo that came from that process and one that came from a few hours of a great designer throwing out ideas.

<comment><USER9> It's not pretentious, it's just what happens with a big budget rebrand. I don't know if I can explain my take on all this that well, but I'll try: You can either do something at one level, playing off gut-feel/fairly safe assumptions and get it 80% right, or spend 10 times as much, do research and _maybe_ get it 95% right.

That said, in an argument, designers will talk about all those lovely theoretical things they were trained to do. Then, most of them will just sit down and muck around with fonts, shapes, etc until they have something that fits the bill.

Same is often true with web design (my gig). You can use your experience, gut, etc to create a $10k site, or you could spend $100k to get something not miles dissimilar but involving actual usability testing (instead of gut feel decisions), buckets of documentation, etc. You could spend $100k on a single page microsite if you wanted to take everything to the extreme with endless focus groups, eye-tracking tests, etc. Or you could just put the branding in the top left, use buttons that look like buttons, remember what worked from last time you did some A/B tests, make the text legible, etc.

It's a funny game. Most of the time I estimate/quote by rolling dice rather than spending hours trying to guess the budget of a client or the level of polish they want to pay for with a site.

<comment><USER10> I think it's inaccurate to say most designer's work process is to "just sit down and muck around with fonts, shapes, etc until they have something that fits the bill". Of course design is a process but all those "lovely theoretical things" tell you where to start. If you're quoting by rolling the dice, you're not quoting effectively.

<comment><USER9> I don't want to truly trivialise it, but I imagine a lot of it is brainstorming, thinking, and gut feel than direct conversations with customers, market research, etc.

And I have to disagree on the dice. The best situation is a client giving me their budget and me telling them the best way to spend it (often, not all of it). So, when the budget is not disclosed, instead of spending hours trying to guess their pricepoint, I just randomise the approach and then fill that budgeted time in the best way possible.

</comment></comment></comment></comment><comment><USER11> So let me get this straight: Gap first _hires_ someone to design a logo, and it's universally panned by the design community. They then ask the community "if our new logo is so crappy, why not see if you can do better?" Then, the design community bitches at Gap for not hiring someone to design their logo? Does this seem a bit odd to anybody else?

Also, it's hard to bitch when your whole career depends on something as subjective as logo design. Because of this subjectivity it's possible a design rookie out of high school could design something as cool or cooler than the seasoned professionals, and do it for a _fraction_ of the price (or free). Conversely, that same subjectivity allows people to get away with charging outrageous fees for design work (i.e. <http://en.wikipedia.org/wiki/NeXT#cite_ref-rand_16-0>)

It seems to me like Gap is damned no matter what they do.

<comment><USER12> I find it almost 100% more interesting that some of the people the design "community" exalts on a frequent basis, and even then some of the community itself didn't present any serious submissions when the call came. They all made fun of the idea that GAP was crowdsourcing a new logo.

That's slacktivism on a level Facebook breast cancer awareness can't even touch.

Participate or stfu is my opinion, but I'm no designer.

<comment><USER13> Did you even bother reading the article? As a designer I find most of the options presented to be humorous, or sub-standard at best. Nearly all of them miss the mark far worse than Gap's own new logo does. I wouldn't expect any serious submissions simply because why would anyone work for free for a multi- billion dollar corporation?

</comment></comment></comment><comment><USER14> A bit of background on this. Gap just updated their logo, its getting pretty heavily slammed by the design community (I too think its god awful)

More here: [http://www.creativereview.co.uk/cr-blog/2010/october/new- gap...](http://www.creativereview.co.uk/cr-blog/2010/october/new-gap-logo)

BTW the author's twitter feed, @Mike_FTW is one of the funnier feeds to follow.

<comment><USER15> Anyone know what the business case for this change was? What was wrong with the old logo? I'm having a hard time understanding what the thinking was here.

<comment><USER15> Answering my own question, I found this in the Advertsing Age:

<http://adage.com/article?article_id=146353>

I don't think this is going to end well for Gap.

</comment></comment></comment><comment><USER16> _I've redesigned your logo. It's behind the post-it above. It's unbelievably good. Fantastic, even. I'm convinced it's what you need._

aaaaaaand it turns out to be crap. Your policy of 3 (or whatever) "redesigns" turns out to give me 3 more crap designs and then, according to the contract, I have to pay you anyway. I spent $5,000 like that. Never again.

<comment><USER17> So designers should do the initial work for free? So their customer can say "nah, I don't like any of them" and then suddenly a design looking _remarkably_ similar appears on their website/products, courtesy of a much cheaper 'designer' working off the 'rejected' design comps?

<comment><USER18> No, designers should not be expecting to form guilds or a cast and be treated like one. They're not a special kind of workers.

That is, assuming they do want to be treated like workers and not as artists. You hire workers, you don't hire artists, right? It'd be pretty derogatory for the real artist..

</comment></comment></comment><comment><USER19> So, what i think is missing is this link that explains exactly what this dude is writing about:

      Thanks for everyone's input on the new logo! We've had
      the same logo for 20+ years, and this is just one of the
      things we're changing. We know this logo created a lot of
      buzz and we're thrilled to see passionate debates
      unfolding! So much so we're asking you to share your
      designs. We love our version, but we'd like to see other
      ideas. Stay tuned for details in the next few days on this
      crowd sourcing project. [1]

So, in this context, i think the rant makes a bit more sense. Equally funny is iso50's description of this as "a tropicana,"[2] which is a zing i never thought i'd hear.

But, i want to throw out there that this impulse to violently reject or passionately protect logos has an analog in language. "All living languages are always changing"[3] and same goes for logos and brand identities. Much like language or fashion, logos evolve and whatever.

And for everyone that's all "oh that's shite, i could do better," I invite you to really try your hand at this sort of thing with actual real life constraints and (gasp!) real life clients. There's all sorts of design work you can do without a client, but it takes a special type to actually, you know, design _for_ somebody else and more hopefully, design _with_ someone else.

[1]: <http://www.facebook.com/gap/posts/159977040694165> [2]: <http://blog.iso50.com/2010/10/06/gap-redesign-contest/> [3]: <http://www.lsadc.org/info/ling-fields-change.cfm>

_edit_ formatting goofs always get me

<comment><USER20> I think what's really missing is the answer to: Who is this "Gap" of which you speak?

<comment><USER19> yeah, i mean _it's The Gap._ really, is this a brand we're actually getting worked up about?

</comment></comment></comment><comment><USER21> Before I realized what this post really was, I tried to peel off the post-it note with my mouse. Now _that's_ an entry that would have gotten some attention.

<comment><USER22> I thought it _was_ the post-it note, and this was all satire. Guess I better read this again.

<comment><USER23> I did too. And then I got to thinking that a post-it note with "Gap" written on it might make a pretty good logo.

</comment></comment></comment><comment><USER24> Call me cynical but a very similar play happened with Kraft and their launch of a new Vegemite+cheese spread.

They named it "iSnack 2.0", were met with strong derision, opened up a naming contest, and finally settled with the consumer-selected "Cheesybite". This whole rigmarole earned them quite a bit of publicity. People were even buying- up the iSnack-labeled jars before the renaming thinking they'd become collector's items.

[http://en.wikipedia.org/wiki/Vegemite#Vegemite_Cheesybite:_n...](http://en.wikipedia.org/wiki/Vegemite#Vegemite_Cheesybite:_new_recipe)

"iSnack 2.0" and the new Gap logo are too terrible to happen innocently.

</comment><comment><USER25> 99designs entries: [http://99designs.com/logo-design/contests/design-better- gap-...](http://99designs.com/logo-design/contests/design-better-gap-logo- community-project-54693)

<comment><USER26> Perhaps 2% of the logos there could be taken at all seriously. The one which makes the A in GAP look like a pair of jeans is at least clever. But wow is there a lot of garbage there. Thanks for sharing the link!

<comment><USER27> There have been a ton of other designs submitted to ISO50. Some aren't too bad: <http://blog.iso50.com/2010/10/06/gap-redesign-contest/>

<comment><USER23> There are some good ones there. Personally I like number 42.

It seems to me that a place called "Gap" should have a gap somewhere in its logo.

<comment><USER26> I'd actually disagree. It's just a brand - your mind should associate the name and logo with connotations and feelings regarding their clothes and their shopping experience (and probably sex, it's a youthful clothing store). You shouldn't be thinking about what the word "gap" literally means - it's orthogonal to the meaning of the brand.

</comment></comment></comment></comment></comment><comment><USER28> I'm not a design genius-- but when I saw Gap's new logo I think I knew what they were going for, and imho I doubt it was created haphazardly. The new logo is exemplary of the transition of "best practice" design principles from print to electronic media.

They unabashedly violated two rules of logo and print media design, and it's so blatant that I can't believe it was an accident. Their logo features a gradient (print-media epic fail), and two low-contrast overlapping colors, the P and the background square (also a print-media epic fail).

I hope that the executives do not knee-jerk a reaction and demand a logo redesign, but instead play out the campaign and see how it pans out. I'm not convinced it was a mistake.

Perhaps the real redesign wasn't the logo, but their website and online presence?

</comment><comment><AUTHOR> I should have provided some context since this isn't exactly the usual HN subject matter.

Earlier this week, Gap Clothing changed their logo from the old iconic blue box logo to the new one which is essentially another Helvetica wordmark and a box placed in the corner. Mike's post (the main link), which is employing quite a bit of insincerity, assumes you knew about this before hand.

Brand New, a great brand identity blog, has more and a lively discussion about it - [http://www.underconsideration.com/brandnew/archives/dont_min...](http://www.underconsideration.com/brandnew/archives/dont_mind_the_gap_or_the_square.php)

</comment><comment><USER29> Whole post is silly and pretentious. If the design really _is_ so great that Gap thinks it's worth using, then legally they'll have to pay him to transfer the copyright before they can do anything with it.

So cut out the stupid ego-drenched drama and just show the logo. He'll get a lot farther that way than demanding compensation up front anyway. Even if Gap rejects the logo, it will stand as a nice portfolio/concept piece if it is really good as guy claims.

<comment><USER30> He doesn't have a logo.

</comment></comment><comment><USER31> Simple response:

The value of a product is set by the consumer, not by the producer. (This is true for over-inflated values as well, so don't bitch.)

If the value set is too low for the producer, he either has an inflated sense of worth, or isn't doing a good enough job of educating the consumer, or both.

<comment><USER18> And here I was thinking that it was both demand and supply. Damn you, Adam Smith!

<comment><USER31> 250 years ago, the notion of infinite supply didn't exist.

In a vast majority of cases, infinite supply is exactly the world that many producers live in these days, especially on the internet.

</comment></comment></comment><comment><USER32> Many clever alternate designs (and parodies) have been posted on the ISO150 blog:

      http://blog.iso50.com/2010/10/06/gap-redesign-contest/

<comment><USER33> Clickable: <http://blog.iso50.com/2010/10/06/gap-redesign-contest/>

</comment></comment><comment><USER34> I hope I'm not the only one who added style="visibility:hidden;" to the post- it-note image hoping to be pleasantly surprised.

</comment><comment><USER35> Posts like this misunderstand how decisions about corporate logos are made. You need to back-stab the ad agency and cozy up to the marketing VP to change the logo.

Posting like this on the web just invites the marketing VP and the account rep to go out to dinner and laugh at your feeble attempts, over a couple of stiff drinks.

It really is exactly like Mad Men.

</comment><comment><USER36> A lot of the comments in this thread seem to imply that brand specialists will always deliver a quality logo. I can think of one recent example where that wasn't the case: the London 2010 Olympics logo. It cost £400,000 and was negatively received by the public and many industry professionals:

<http://en.wikipedia.org/wiki/2012_Summer_Olympics#Logo>

</comment><comment><USER37> This was the first thought I had when I saw their "if you can do better" press release.

Kind of depressing from such a large brand, to be honest. As if it wasn't bad enough getting this kind of "Well it's just a design, it takes like five minutes, I can sketch one up right now! So here, you can do it, but we're giving you peanuts" mentality from smaller clients.

</comment><comment><USER38> Brilliant

</comment><comment><USER39> And now I have a vision of the word "Gap" with fingers pulling at the G and the p.

Yes. Blame goatse on me. But once you see it, it never goes away.

</comment><comment><USER40> Well played. How about a sneak peak?

<comment><USER41> I don't think you quite understand the sarcasm in the article (or perhaps I misread it...?)

<comment><USER42> I did not understand either, I feel I am missing some context to this post that the writer should have included.

<comment><USER43> I think it was pretty clear that he was being sarcastic, but only up to a point. I am still left wondering if he actually has a logo to show or if he is offering his services in a professional capacity, or not.

<comment><USER44> Neither. It's just rhetorical.

</comment></comment></comment></comment></comment><comment><USER45> The new logo is horrendous.</comment>


SpaceX CRS-3 Launch delayed - <AUTHOR> http://new.livestream.com/spacex/events/2833937/statuses/46351749

<comment><AUTHOR> Disappointing!

As many would know, this launch will include the testing of firing of the booster's engines as retrorockets to return the launcher to earth in a controlled manner. Landing gear will also be deployed before the booster ditches into the ocean. This test will be a major step towards having boosters return to earth and landing gently for quick turnaround for relaunch.

With one of the major costs associated with rocket launches being the retrieval and overhauling of the boosters, having the boosters land by themselves (non violently) will probably lead to huge reductions to launch costs.</comment>


How To Ruin The Day of a Programmer [XKCD] - <AUTHOR> http://www.xkcd.com/859/

<comment><USER2> Dup: <http://news.ycombinator.com/item?id=2206813>

Some discussion there.

It's generally suggested that if an XKCD is vaguely relevant to HN then it was posted the day it first went up.

<http://news.ycombinator.com/item?id=1882957>

</comment><comment><USER3> This goes along with one of my favorite t-shirts to wear around my brother, who is a little OCD (aren't we all?).

O.C.D.

(Obsessive Compulsive Disorder</comment>


Transparency at the Office: Psst...This Is What Your Co-Worker Is Paid - <AUTHOR> http://online.wsj.com/article/SB10001424127887323644904578272034121941000.html <comment><USER2> I once did a short stint at a phone survey company that specialised in health and social welfare surveys. I wasn't on this particular survey crew, but I remember a colleague telling me that it was strange - a stranger rings up and with your consent conducts a 20-minute anonymous survery on the subject of abuse, sexual or otherwise, that the respondant suffered as a child.

It was a delicate survey and required a fair bit of rapport building, and _lots_ of 'I need to remind you that the next question is voluntary'... but we were still getting plenty of respondants, and the weird thing was that despite being a (relatively) anonymous stranger with which you have just shared some sensitive, deep secrets about childhood abuse, the question that most balked at was the 'income level' question in the demographic rundown at the end.

<comment><USER3> I think our culture (well, American, capitalist society is all I can really comment on) has a very strong implied link between income and worth/value. We have magazines that routinely have lists of the highest paid / richest people. People give incredible leeway to highly paid execs, as if due to the number of zeros on their paycheck they clearly have to be right/smart. There are sayings like "that decision was made above my paygrade", that seem to show there is a pretty tight linkage, mentally, between income and value as a human.

I don't agree with this mindset at all, mainly because I don't believe most organizations are truly meritocratic in any objective sense. It's a good PR story, but people, evolutionarily, tend to "look out for their own", for whatever traits puts someone in that in-group. I have seen many examples of people espousing meritocracy but clearly considering those with the most "merit" as being one in the same with "those they already seem to like", coincidentally enough. That isn't necessarily a bad thing, with balance. I think a 100% meritocratic org would be lacking in basic humanity and kind of a terrible place to work. All humans make mistakes, have struggles, have setbacks, etc...

Even with that being said, and me not believing in the income -> value/worth link in general, I would not be comfortable talking about my salary with most friends/family. I live a comfortable life with little stress about money, but bragging about that (which even trying to downplay it sounds like a humblebrag) seems wrong somehow.

<comment><USER4> >I would not be comfortable talking about my salary with most friends/family.

In my family, it was always taboo to talk about money --my father hardly ever discussed money with friends (that I recall). So it was instilled in me that "money-talk" was somewhat "vulgar". To this day, I can only guess my siblings' fiscal positions.

On the other hand, when I lived in the East (Asia), people there openly talked about money/salary, etc. It was one of the acceptable topics at personal intrductions, in addition to where are you from, what do you do and have you eaten.

So, I think it's totally cultural.

<comment><USER5> That's interesting. I've never felt any reservation in talking about my income, except to coworkers. I just feel like it invites resentment if mine happened to be higher, even if on a sub-conscious level.

<comment><USER6> There's such saying: "Gentlemen don't talk about money..."

<comment><USER7> That saying is so old, it ends "... and women don't touch it."

<comment><USER6> Probably from that times of James Bond:

<http://www.youtube.com/watch?v=NRaDQZGFdBs>

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Near the bottom of this article is an interesting post mortem of RethinkDB's transparent salary policy. When it was posted years ago [1] folks here took pretty kindly to it, though some were skeptical [2].

I'm kinda disappointed (who doesn't like to know?) but also not very surprised that it didn't work out. Negotiation doesn't work super well if the other players have complete information about your strategy.

[1] [http://web.archive.org/web/20100722162634/http://rethinkdb.c...](http://web.archive.org/web/20100722162634/http://rethinkdb.com/jobs/)

[2a] <http://news.ycombinator.com/item?id=1210336>

[2b] <http://news.ycombinator.com/item?id=1190533>

<comment><USER9> Hey, I'm slava @ rethink. If you have questions about how things went, I'm happy to answer.

<comment><USER10> What if you had front loaded the open salary information in the hiring process? Something like, "We have a no-haggle policy on engineering roles. In order to streamline negotiations, please only apply for this job if you are comfortable with X starting salary and Y options. We are very fair and promotions are rapid (see our comp ladders here), but want people to join who share our sense of efficiency."

Law firms manage to pull this off with a standard $160k base, and probably something similar works in other spaces?

</comment></comment></comment><comment><USER11> I've always felt uncomfortable about how employees are not supposed to talk to each other about their salaries.

To me, it reeks of manipulation feels just like saying to a child "Here's some candy, but you have to promise not to tell anyone I gave it to you, OK"

ugh.

<comment><USER12> There's nothing stopping you from talking to other employees about salaries. It's a myth that is propagated by companies in order to keep you in the dark about what they are paying other people, to deprive you of information, and to keep you at a disadvantage in any negotiation.

<comment><USER13> Also, it is very much a western thing. I have a lot of Indian friends and they happily trade salary information amongst each other. This reduces any informational asymmetry that exists in such situations.

<comment><USER14> I don't know if it's only a western thing. I'm in Eastern Europe and we still consider this subject a taboo (at least in IT).

edit: To be more clear, you can talk about it with friends but not with your colleagues.

<comment><USER6> It's not a taboo thing. In my contracts I've had always clause that all the information are confidential, including salary amount. And I can be sued by company if I break the agreement.

<comment><USER15> How can such a thing be legally binding. Did you tell your wife? Can they sue for that? What if you're not married to your partner? Your bank and every person who has seen your bank statement (a lot of people) knows what you're earning. Can they sue for that?

<comment><USER6> It's allowed to say that to your spouse. I think the regulation is just to prevent from publishing on web page or sending email with your real documents. If there is leak from the bank, the bank is responsible. In practice you talk about your salaries but in unofficial way, with a beer in a pub, but you never show the official contract.

The other interesting thing is clause about installing not approved application on your laptop. Everybody does it - your favourite editor, messenger, file manager etc. But when they want to fire you, they say that you've broken the rule and you're going to be sued unless you agree to leave company immediately without any punishment.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> When I was working in New York City, I always found employee secrecy over the salaries pretty interesting. It seemed like a taboo to tell someone your salary or ask them what they're paid.

I understand why employers would want to disincentive salary disclosures but employees? Your peers salary is clear indication of your valuation to the company and there should be every incentive to share. Back home in India, pretty much everyone knows each others salaries for all sizes of companies.

<comment><USER17> What I also found weird in NYC is that people can be really cagey about their rent, because our have a rent ceiling that most landlords won't let you go past, and that's a multiple of your salary. So if someone's paying X amount of rent, you know that their salary is at least Y. It's really strange.

<comment><USER18> Really? I didn't notice this at all while living there. And it's also hard to peg someones rent with respect to their salary because some people chose to live beyond their means while others would potentially live 'cheaply' in order to save enough to buy a place.

</comment></comment></comment><comment><USER17> In my last job I was in a position where I got to see all the salary wrangling that goes on behind the scenes, and it was pretty awful. You get people with power dishing out preferential treatment to their mates, you get situations that are incredibly unfair but for whatever reason can't be easily resolved, and you get a lot of gossiping and speculation that is wildly unproductive for a company. I've never worked anywhere with salary transparency but I'd love to try it - I think with the right people it could work well but I'm sure there's plenty of scope for petty jealousies of other kinds. But I did come away with the fact that the secrecy in many cases is often to hide things that your average worker is going to be offended by, i.e. how much executives are paid.

<comment><USER19> I've worked for a large company where if you know someone's band (and you generally know that just because you do, not by asking about) and how long someone has been there, you know within about a grand, how much they get paid.

I now work for a place where I'm told to never talk about my salary, yet 5 members of the (very small) company were invited into my salary review.

I often think that the more they stress to not talk about it, the more likely it is I'm underpaid compared to my coworkers.

</comment></comment><comment><USER20> This is not too uncommon for government employees, including (e.g.) professors, coaches, doctors at state schools. For example, I had no idea top surgeons raked in that kind of dough. Damn. <http://www.sacbee.com/statepay/>

<comment><USER21> If you want to be pissed, look up troopers. Last I looked, there were a whole bunch making over $200k.

</comment></comment><comment><USER22> there are 2 types of people in the office, happy people and those who know the salaries of others.

<comment><USER23> And the first is exactly what managers want -- engineers who have no idea, whatsoever, what they're worth.

<comment><USER24> Quite the contrary. If an engineer asks for considerably less than they're worth, that goes into the "may be out of touch with his profession" column.

With the exception of starters and a few semi-autistic outliers, engineers that have no idea what they're worth generally aren't the best of engineers. Not _asking_ for it however is a different matter.

<comment><USER25> That's just not true. Many, many engineers severely undervalue themselves for a variety of reasons. For some, underconfidence. Even for those that are confident in themselves, for many there's a fairness issue. ("Do I really need more than 100K?") Also, if they're in one underpaid job, the anchoring effect is pretty strong. I know someone who was in DC for <70k, applied to work remotely for a Valley company, and when they said yes, he asked for a big raise to 90k. They valued retention enough that they decided to actually pay him what he was worth and what comparable teammates got, tens of thousands a year more.

People are socialized to try to make others happy, not inconvenience someone by asking for more than they feel is necessary and fair, etc. This does not speak to their competence, though it might also mean that they're less effective at making you realize how competent they are once you hire them (because they're also the type of people who don't flash all of their accomplishments in front of you).

Women also tend to fall into this even moreso because of gender socialization.

</comment></comment></comment></comment><comment><USER26> I can see how this is interesting, but it seems like it would be too easy for no one to ever be happy. Employees tend to either over or under value themselves pretty strongly, and while trying to level the playing field seems like a good idea, it's just inviting confrontation if you have a mix of both (like a lot of workplaces). Combine that with the proclivity for workplace lawsuits at even a hint of discrimination (in the US) and I don't see how this could ever gain wide adoption.

I also think the idea of scheduled raises breeds a sense of complacency.

</comment><comment><USER27> "...employees are each assigned to one of nine fixed salaries..."

Reminds me of a less-complicated general schedule salary table: <http://archive.opm.gov/oca/12tables/html/gs.asp></comment>


Ask HN: What's new in CS? - <AUTHOR> So, I got a CS degree back in '03, and took some master's level classes in '06. What I've been wondering is, have the undergraduate and graduate curriculums changed in the last decade? Is there anything really new that's being taught at universities that hasn't percolated to the industry yet?<p>A request: let's not get into a discussion of Deep Learning, please. I studied Convolutional Neural Nets in my ML class in '06; they finally made it out of the lab and niche digit recognition applications, but they aren't new. <comment><USER2> I don't have a direct answer to contribute, but your title and the post are potentially asking for different things - university curriculums are mostly static things with a ton of inertia, and within a decade there's probably mostly been superficial changes only, like switching the programming language of choice.

I'm still interested in learning about the few changes that would have occurred, but the original question, of what's new in the field of CS research itself, is IMO a much more interesting one.</comment>


Auto-closing ssh tunnels - <AUTHOR> http://www.g-loaded.eu/2006/11/24/auto-closing-ssh-tunnels/

<comment><USER2> Would compression help much for an ssh terminal connection? The only time I usually hear about compression is in the context of an ssh tunnel.</comment>