Ask HN: Good experiences of being acquired by a large company? - <AUTHOR>

With all of the horror stories going around about being acquired by Yahoo!, Aol, and Google (to a lesser extent), does anyone have any feel-good stories about be acquired? Which companies?<p>UPDATE: Found this thread on the homepage http://news.ycombinator.com/item?id=2252258 (Amazon seems to be doing it right) <comment><USER2> As a product manager at Right Media, I was personally pretty happy with our acquisition by Yahoo. Things gradually got more bureaucratic, but Yahoo gave out some very generous employee retention packages which effectively more than doubled my already pretty generous salary. When Microsoft came along and inflated Yahoo's stock with an acquisition offer, I thought it was Christmas. You better believe I sold every share I could the second I could.

After a year of Yahoo, I had the savings in the bank to go off and start my first company with confidence. And if I hadn't wanted to start my own thing, another couple of years at Yahoo would've put me on a pretty nice financial footing. I'm quite pleased that acquisition happened, and I suspect most of the employees there feel the same way.

I'll admit I'm not super sympathetic when people complain about their product's decline after being paid millions of dollars for it. del.icio.us was a pretty sweet bookmark manager, but for the lion's share of $27.5MM I'd happily cock it up with an acquisition.

</comment><comment><USER3> 37Signals have a very clear "Getting acquired by big companies is the worst mistake you can make" stance. I'm not sure where it comes from, but they seem to think that anyone who gets acquired by a big company will regret it. They say the same things about getting VC funding.

They, themselves, have successfully bootstrapped and are making tons of money and have not gone down the acquisition route and, the best I can tell, that's the basis for their argument.

Despite their ongoing campaign, they do not and cannot say which acquisitions will turn out well and which will turn out poorly, so they seem to default to the stance that everything will turn out poorly, but that's simply not true.

They also make one big error in arguments against acquisition: It's a short- term perspective. You're not tied to the startup that acquires you forever. You can leave any time. And many great startups have been started by people whose first company was acquired and that acquisition gave them the financial freedom to start a second company under their own terms (I don't think their founders have much in the way of second company founding experience). Great founders don't have just one idea, they have many. And they execute them. Twitter? FourSquare? etc. Yeah, their prior startup acquisitions by Google might have not been a good fit for one reason or another, but has anyone bothered to ask the founders if, in retrospect, they're glad they did it?

My acquisition experience was amazing. I had offers from multiple companies and I picked the one that matched-up best to our company culture instead of optimizing for potential future value -- turned out to be a good decision because not only did we have a blast, but the company that acquired us took us from literally zero pageviews per day to 20 million _per day_ (back in 1999 -- that was a lot back then and still is!). And the value of the company that acquired us increased 10x over the next couple of years (the company is no long around in it's previous form and its stock did crash during Bubble 1.0, but everyone walked away happy).

So when you read anything from 37Signals that states, in one form or another, "acquisitions are bad" and "venture capital is bad," then take it with a grain of salt.

</comment><comment><USER4> A web analytics company in my neck of the woods (Omniture) was acquired by Adobe a couple of years ago. I've talked with a dozen employees there and I've heard nothing but good about it from both the business and technical sides of the house (I interviewed there to see for myself a couple of months ago).

Adobe's leadership still seems to have the "founder" mentality and gives their acquisitions (at least this one) relative autonomy to continue to do what they do well in addition to solid financial backing and all of the nice resources of a big company (benefits, software discounts, etc.)

Adobe is helping them expand with a brand new building with great freeway access. This will also help them attract new hires because it will be about 10 miles closer to a much larger metropolitan area than their existing campus (which is about as far from the freeway as you can get). So +1 for Adobe.

</comment><comment><USER5> There are companies out there that acquire you and then leave you alone as long as you keep doing well. The canonical example here is Berkshire Hathaway. They don't acquire tech companies, but there are conglomerates out there that try to emulate Berkshire, to varying degrees of success.

Lots more might say that they follow the Berkshire model, but talk to people that have been acquired to get the full story.

Of course, if you start losing money hand over fist after the acquisition, even Berkshire would step in and shake things up.

</comment><comment><USER6> Miniscule data point: The very small consulting company I worked for got bought by a big-ish dot com company (which is still in business, so not a casualty) and I got a very significant pay increase as part of the deal.

</comment><comment><USER7> I know of a research company that wound up getting bought by Northrop Grumman largely for the engineering talent - IP was only a secondary consideration. From the stories I've heard, NG was very kind to the engineers and let them keep doing things nearly exactly the way they had been doing them. One of the senior engineers managed to talk his way into 6 weeks of paid vacation every year in addition to the usual holidays, which is virtually unheard of in larger American companies.

</comment><comment><USER4> You should also understand that big companies buy small companies for many different reasons. Sometimes they want a new revenue stream and sometimes they just want the brain power and have no interest in the small company succeeding. A founder who cares about his or her company's future will look closely at the strategic reasons a larger company may be eyeballing you.

</comment><comment><USER8> To answer that question one has to examine the culture of the smaller organization in contrast to the larger. If you're working at a small startup with an us vs. them mentality and you thrive there, odds are you will not enjoy transitioning into a job where you're required to submit reams of paperwork to HR, get an ID badge, interface with an incompetent mid-level manager who has to report to a boss who reports to a boss who reports ..., attend endless meetings about future meetings, socio-political silos, mind- crushing reviews, pep rallies, ominous rumors of layoffs, social embarrassment, an influx of marginally-skilled and unmotivated coworkers, offshore IT, business casual dress, the realization that all your efforts at the startup went to line the pockets of the founders who vacation ad nauseam while you continue to toil away on a dying project with increased responsibilities for similar pay while your new management makes every effort to erase your contributions while simultaneously reminding you that they bought you, albeit by directive and with corporate cash, then it is quite possible that every cell in your body rejects your new corporate overlords. However, if you're the kind of person who enjoys an anonymous routine backed by a well-known entity, then by all means, focus your attitude and culture into one of eventual assimilation, making friends and cutting deals along the way, so that when the eventual day comes, you'll be in a position to personally benefit from the acquisition by either cultural similarities or the desire to willfully carry out the bidding of your new masters.

<comment><USER9> Hear hear.

The positive comments, as of this comment, appear mostly to be of the form "I got more money" with an implication that, technically, there was still interesting work. However, I'm not seeing much in the way of remarks regarding culture clash or lack thereof.

Having now been acquired "successfully" twice (once quite recently), and having seen numerous other acquisitions from the acquirer's side or second- hand through friends and family, I have yet to see one go well.

More specifically, for the startup-minded folks, who joined a small company in large part because of the size, being integrated into a larger company is, at best, temporarily tolerable. For all of the reasons you outlined, the outlook tends to be much more bleak. Effectively double an already good salary would help assuage the pain, without totally eliminating it, and, usually, the retention packages are on a time scale of years, rather than months or even quarters.

I could imagine that a totally hands-off acquisition would work out much better, but I have yet to see such a one.</comment></comment>


Anatomy of a Subtle JSON Vulnerability (2008) - mck- http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx/ <comment><AUTHOR> How about simply adding an additional certificate - e.g. random string of specified length - held by your webapp in closure? And then configure your server to only respond to requests that have the "secure" httpOnly cookies and the certificate included using the POST method. The certificate was originally sent by the server using https protocol during document load, is stored in closure, and can be dynamically updated asynchronously over https connection.

This limits all requests to ajax requests since inclusion of this additional certificate is needed from javascript memory, but it does side-step the problem.

Ps: I know this is a dated article, I'm just curious what you guys think of this work-around. I think it's more secure and flexible than the work-arounds suggested in the article, since this does allow you to use the array notation.</comment>


Stanford group release Open Source Camera - Frankencamera - <AUTHOR> http://news.stanford.edu/news/2009/august31/levoy-opensource-camera-090109.html

<comment><USER2> I'm glad to see any type of open hardware; however, there is nothing intrinsically new about this hardware device. Essentially it is a commercial CCD or CMOS imager hooked up to an embedded Linux machine (such as a Beagle Board).

Something that would be _much_ more exciting would be an open hardware initiative to build "computational cameras" -- such as ones that employ assorted pixel masks for high dynamic range or actuated imaging elements to produce flexible depth of field.

If you're into the idea of "computational cameras", there was a really cool plenary talk at a conference earlier this year -- check out some coverage at Hizook.com

[http://www.hizook.com/blog/2009/06/26/computational- cameras-...](http://www.hizook.com/blog/2009/06/26/computational-cameras- exploiting-megapixels-and-computers-redefine-modern-camera)

<comment><USER3> Can't talk about details yet, but there is something in the works along these lines. More info in a month or so...

</comment></comment><comment><USER4> For those who don't know, Marc also did the Digital Michelangelo Project.

<http://graphics.stanford.edu/projects/mich/> [http://www.cse.ucsc.edu/classes/cmps290b/Fall05/readings/dmi...](http://www.cse.ucsc.edu/classes/cmps290b/Fall05/readings/dmich- sig00.pdf)

</comment><comment><USER5> Some hackers are also producing open source alternative firmware for commercial cameras:

<http://magiclantern.wikia.com/> <http://chdk.wikia.com/wiki/CHDK>

</comment><comment><USER6> As an amateur photographer who would love to do real in camera HDR photography this strikes me as being a really interesting development; I hope it marks the beginning of the end of the DSLR as _the_ professional choice, since they are often limited in bizarre ways because they are trying to conform to a mechanical model that does not map to what they are.</comment>


Show HN: Ephemeral Photo Sharing for the web - <AUTHOR> http://snapmenow.com/

<comment><USER2> test post please ignore: [http://snapmenow.com/21254273](http://snapmenow.com/21254273)

</comment><comment><USER3> 100 receivers: [http://snapmenow.com/74131059](http://snapmenow.com/74131059)

</comment><comment><USER4> receding line: blame entrepreneurship [http://snapmenow.com/73242187](http://snapmenow.com/73242187)

</comment><comment><USER5> better than the original: [http://snapmenow.com/82785447](http://snapmenow.com/82785447)

</comment><comment><USER6> Didn't work on Chrome on ipad

</comment><comment><USER7> that went straight onto my bookmarks bar, thanks!

do you store the photos?

</comment><comment><USER8> this is awesome</comment>


Golden Thoughts for a New Nuclear Age – from a new biography of René Girard - <AUTHOR> http://churchlife.nd.edu/2018/02/28/golden-thoughts-for-a-new-nuclear-age/ <comment><USER2> Never mind the "new nuclear age" clickbait. It's considerably out of date, of course. It's said that generals often fight the last war, not the present war. Theology departments (like this one at Notre Dame University) typically fight the war before last. The headline writer for this article, well, yeah, theologian writing for church people. Ignore the silly headline.

But read the article. Our trade is strongly influenced by Rene Girard's understanding of competitive mimetic desire and its violence. Why? The people who organize the ad-driven internet know all about Girard. Peter Thiel invested in FB because he saw its potential for harnessing mimetic desire to drive engagement. (reference: [https://www.lrb.co.uk/v39/n16/john- lanchester/you-are-the-pr...](https://www.lrb.co.uk/v39/n16/john- lanchester/you-are-the-product)) FB-style social media is addictive precisely because of the fear of not being as good as "friends." Mimetic desire is the the human yearning behind the Fear of Missing Out. Driving engagement is most effective when it exploits that fear. It works very well indeed.

Other attempts at building social media networks (Stack Overflow, Linked In, Slack, for example) try to avoid that exploitation. They try to use other motivators than FOMO to drive engagement. Can they be successful without overusing mimetic desire? It's the key question they must answer to be successful.

The obligatory panel of customer logos just below the fold on SaaS landing pages engages mimetic desire in IT buyers. "Wow! Schwab uses this! I want to be like Schwab!" It's benign in these cases.

Girard offers a good unifying framework for understanding the human nature behind all sorts of marketing work. Convincing people their hair is ablaze and offering them ways to put it out is the heart of building new businesses. Getting people to set each others' hair on fire, then putting it out, is the holy grail of new businesses.

It's no accident that Silicon Valley employs that framework in lots of ways: he was a scholar at Stanford's Hoover Institution. It can be a hard slog to learn about him. But it's worth your trouble.

<comment><USER3> LinkedIn is going the way of Facebook

StackOverflow uses badges and fake internet points as the mechanism to encourage usage.

Not sure what Slacks pulling factor is

<comment><USER2> Slack's pull factor? My boss told me to use it. And, it's better than email for workplace communication.

Stack Overflow's? In my case, reciprocal altruism. I get a TON of benefit from it, so I like to contribute to it.

Y-Combinator's? I'm not sure, but here I am using it.

<comment><USER4> Y-comb for me is "broadcatch" (Kevin Kelly?) over a range of side-interests (tech, science)

</comment></comment></comment></comment><comment><USER5> Good article! I'm going to hijack this comment section to raise a question: is memetic desire weakening with the mass personal communication of the internet?

I think that up until the 1990's you would identify more with an entire group. Are you a rebel? Then style your hair like this and wear these clothes; so much so that when someone sees you, they know exactly that you're a rebel.

But in the last twenty years, it seems that the internet has allowed us to pick and choose our memetic desires in a more fine-grained way. Instead of belonging to one group we are an amalgam of many groups, and you can no longer as easily look at someone and say, "That person is of the group 'x'."

And if so, doesn't this give us hope that while we are (if you agree with Girard's premise) not our own desires, we are more and more a unique collection of desires and that itself is more and more unique?

<comment><USER6> On the internet, we spend even more time looking at other people, so I'd say mimetic desire is even more intense.

<comment><USER7> Tho it hasn't always been like that. Mid-90's Internet feels like utopia compared to our modern social reality dominated Internet.

When you met somebody online back then, you were just happy to have found somebody else. They didn't have profiles and pictures allowing you to put people into boxes before even talking with them.

People actually had to talk to each other to find out more about whom they were talking to, it required actual back and forth interaction and not just browsing a half-invented profile page to use that as "ammunition" to put somebody else down for their listed views/positions.

<comment><USER8> There were rudimentary profiles. If you "fingered⁕" someone, you could see the contents of their ~/.plan and ~/.project files, which formed something like a profile.

⁕ FINGER(1)

NAME

         finger – user information lookup program

<comment><USER9> Back in the day John Carmack's .plan file _was_ my social media feed.

[https://garbagecollected.org/2017/10/24/the-carmack- plan/](https://garbagecollected.org/2017/10/24/the-carmack-plan/)

</comment></comment></comment></comment></comment><comment><USER10> Literature, metaphors and social science for mankind and a single, final word on nuclear warranting the clickbait title? These words show trepidation but have not aged well, do they?

</comment><comment><USER11> Girard Startup lessons:

\- the founders set a contagious mission that infects the company

\- competition can be destructive, work hard to be a monopoly

\- the founders take all responsibility and share all success

TLDR; emulate Christ

<comment><USER12> or as Thiel puts it:

"To believe yourself invested with divine self-sufficiency is not the mark of a strong individual, but of a person who has mistaken the crowd's worship – or jeering – for the truth. The single greatest danger for a founder is to become so certain of his own myth that he loses his mind. But an equally insidious danger for every business is to lose all sense of myth and mistake disenchantment for wisdom."

TLDR; Balance madness and wisdom of the crowds - Find the balance between humility and self-belief</comment></comment>


Ask HN: Does the world need another note-keeping app? - <AUTHOR> i am personally not satisfied with any of the options out there for note keeping. theres plenty of stuff like Evernote and Onenote for writing stuff but I find their one-level-folder organization structure to be hard to navigate and digging up information down the road cumbersome.
i really desire an application that allows me to store all the bits of information i come across and want to save and access later. something more akin to a bookmarking service, but for notes and with search and multi-level-tree folder organizing. despite this being an issue as old as the internet itself and countless attempts to solve the problem, i really don't see or have heard of a solution that does what i want simply and awesomely. this would also be a web-only app so that notes are available immediately between devices and no waiting for syncing.
i want to build this and i want to know if anyone feels the same and if so, would you be willing to pay for a solution? <comment><USER2> I think the problem can be made more tractable by taking the square root of it and building a search/browsing interface over existing apps.

<comment><AUTHOR> meh, i would never invest in building a business on the back of a company that could ruin me by disabling one little API key

<comment><USER2> OneNote exports data in files with a defined format, so they can't ruin you that way. For search to be useful, it is going to have to work over email, documents, and everything else anyway. Otherwise you are going to have to search for everything in 15 places whenever you want to look for something.</comment></comment></comment>


Drone footage shows Apple Mac removed at Epstein's place before FBI raid today - <AUTHOR> Footage from July 7th, 2019 with Mac: https://youtu.be/tBkmhnUJZPY?t=117
Footage from July 17th, 2019 with Mac gone and what appears to be painters tape: https://youtu.be/MsbqnEX1xvk?t=39
Footage from raid (August 12th 2019), painters tape gone and no mac: https://youtu.be/Dn0G-my-0a0?t=161 <comment><AUTHOR> Clickable Links:

[https://youtu.be/tBkmhnUJZPY?t=117](https://youtu.be/tBkmhnUJZPY?t=117)

[https://youtu.be/MsbqnEX1xvk?t=39](https://youtu.be/MsbqnEX1xvk?t=39)

[https://youtu.be/Dn0G-my-0a0?t=161](https://youtu.be/Dn0G-my-0a0?t=161)

</comment><comment><USER2> In the third video there is an iMac on the table, you think it's a different one?

<comment><AUTHOR> You are correct, I didn't see that, thanks. I guess that is probably the same one but why did the FBI wait so long to raid? Risk of evidence being destroy even by accident is quite large. What if a painter accidentally broke the Mac to a point were the data could not be restored?

</comment></comment><comment><USER3> This thread will be locked and removed.

<comment><AUTHOR> Why, does it violate the HN guidelines?</comment></comment>


TypeScript 3.7 Beta - <AUTHOR> https://devblogs.microsoft.com/typescript/announcing-typescript-3-7-beta/ <comment><USER2> Looks nice. I love how dedicated typescript is to sticking to standard javascript, even by championing features through the ecmascript standards track.

They understand very well how bad it would be if the two languages were to diverge.

<comment><USER3> Yes, I agree. I also think that if they were starting out today, they wouldn't have either Enums or Namespaces since those features require adding runtime code (as opposed to every other TS feature which is erasable). However, when they started out, JavaScript wasn't as evolved (and it didn't look like it would evolve this much) and so they had to add a few things "on their own".

<comment><USER4> I started writing this comment thinking "no way, enums make so much sense", but then remembered Flow, where an enum is modelled simply as a union type, and agree that that approach would have probably been better.

<comment><USER5> Yep, and nowadays TS has string literal types and unions so enums are pretty much obsolete.

        type Direction = "up" | "down";

<comment><USER6> Enums and string literals aren't completely interchangable.

Enums are transpired to objects so you can iterate the keys/values. You can't do that with SL which are a transpiler feature only.

Also you can't codedoc string literal values like you can with enums where it shows up with intellisense.

I tend to prefer enums as a result

<comment><USER7> Since TS 3.4 you can have enum-like behaviour by using the `as const` annotation on object and array literals.

        const types = ['x', 'y', 'z'] as const;
        const a: typeof types[number] = 'a'; // not ok
        const b: typeof types[number] = 'z'; // ok

<comment><USER8> Not to be confused with `const enum` which act more like a preprocessor and emits in the value at compile time.

        const enum Directions { Up, Down, Left, Right }
        console.log(Directions.Left)
        // emits js file with console.log(2)

[https://www.typescriptlang.org/docs/handbook/enums.html#cons...](https://www.typescriptlang.org/docs/handbook/enums.html#const- enums)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Slightly OT, but for those not aware: typescript's type system is turing- complete[0], and there's a playground demonstrating number base conversion[1].

0: [https://github.com/Microsoft/TypeScript/issues/14833](https://github.com/Microsoft/TypeScript/issues/14833)

1: [https://github.com/Microsoft/TypeScript/issues/14833#issueco...](https://github.com/Microsoft/TypeScript/issues/14833#issuecomment-535858897)

</comment><comment><USER3> "Assertion Functions" are quite interesting. When we moved from Flow to TypeScript, this was the number 1 thing that frustrated us about TypeScript. The issue is that we had a lot of calls like this:

``` function assert(condition: boolean, message: string) { if (!condition) { throw new Error(message); } }

assert(x !== null, "x can't be null");

// Flow understands that x can't be null here because `invariant` throws an error otherwise, but TS doesn't ```

However, TypeScript couldn't understand that `x` can't be null after that call since it doesn't understand what `assert` does. For that reason, we had to write a codemod that replaced all of our `assert` calls with an if condition that threw an error inline.

The new `asserts` syntax is nice (it would be even better if TS could do this automatically like Flow though), and will be a much welcome update for us.

<comment><USER10> I don't get Assert Functions.

What are they good for? Maybe there is a use case I am not getting, but this

      function yell(str) {
        assert(typeof str === "string");

        return str.toUppercase();
        //         <comment><comment><comment>~~
        // error: Property 'toUppercase' does not exist on type 'string'.
        //        Did you mean 'toUpperCase'?
      }

      function assert(condition: any, msg?: string): asserts condition {
        if (!condition) {
            throw new AssertionError(msg)
        }
      }

Seems like the equivalent to

      function yell(str : String) {
        return str.toUppercase();
        //         <comment><comment><comment>~~
        // error: Property 'toUppercase' does not exist on type 'string'.
        //        Did you mean 'toUpperCase'?
      }

But the latter has much less code and is clearer too.

What am I missing?

<comment><USER11> I'm not sure that's what you're asking, but assertion are often used to trigger error in debug mode on runtime properties not covered by the type system (array having a min / max number of elements, code being executed in a background thread, etc..).

<comment><USER10> I still don't get it. Please help me out.

Why should the type system have anything to do with something like this?

      function something(num : number) {
        assertIsInRange(num);

        return num + 1;
      }

      function assertIsInRange(num: number, msg?: string): asserts num {
        if (num < 50 || num > 100) {
          throw new Error('not in range');
        }
      }

      something(50);

How is `asserts num` helping here?

<comment><USER12> If your something function was `something (num: string|number)`, typescript can safely trust that`num` is a number in the block proceeded by your call to assert because it knows it must be a number, not a string.

<comment><USER10> If the `something` function had `(num: string | number)` I would not be able to call `assertIsInRange(num: number)` because `Argument of type 'string | number' is not assignable to parameter of type 'number'.`

So If I wanted to do that I would have to

      if (typeof num === 'number') {
        assertIsInRange(num);
      }

anyway.

I think I still don't get it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> > The star of the show in optional chaining is the new ?. operator for > optional property accesses.

Wow, that took a while! For already about 9 years this feature is in Coffeescript. And indeed it must be the star of the show because once you're used to that you almost can't live without it. Why did JS/ESxx never copied that idea?

edit: just read it has just been added to JS some days ago as well..

<comment><USER14> This may feel a bit nit-picky, but they haven't been added to ECMAScript yet. There are two features here: the optional chaining operator[1] and nullish coalescing operator[2]. Both are at stage 3 of the standardization process.

Changes to proposed features can still be made at stage 3 if critical issues come up. Otherwise, once implementors have sufficient experience with them (and tests & multiple implementations exist) the proposals will be eligible to move to stage 4, after which they'll be able to be included as part of the next ECMAScript spec.

Both proposals are progressing through the process very smoothly, but I wouldn't rely on them for anything critical just yet.

[1] [https://github.com/tc39/proposal-optional- chaining](https://github.com/tc39/proposal-optional-chaining)

[2] [https://github.com/tc39/proposal-nullish- coalescing](https://github.com/tc39/proposal-nullish-coalescing)

<comment><USER8> Thats a good point. It is probably rare for proposals to change after stage 3 which is why the TypeScript team does not implement a ECMAScript feature until it reaches Stage 3.

In this case, members of the TS team were actually championing these ES proposals :)

</comment></comment></comment><comment><USER15> Really nice, I work in a project with a lot of nested optional values, and all the `a && a.b && a.b.c && a.b.c.d` checks really introduce a lot of noise.

<comment><USER16> Mostly it's a code smell though

[https://en.m.wikipedia.org/wiki/Law_of_Demeter](https://en.m.wikipedia.org/wiki/Law_of_Demeter)

<comment><USER17> I'd say it is a design smell and not necessarily code smell. Any API or data interface should try to keep "optional keys" at a minimum.

Depending on the language, `a.b && ...` could be checking either or both of the following:

\- does `a` have key 'b'? \- is `a.b` truthy?

<comment><USER18> Tell that to the team that created protocol buffers.

</comment></comment></comment></comment><comment><USER19> optional chaining !!! FTW</comment>


Unladen Follow (a tool to cut the fat out of your Twitter stream) - <AUTHOR> http://www.unladenfollow.com/

<comment><USER2> I wonder if this correctly calculates what tweets I get to see (replying to someone I also follow). Also, would be nice if it also showed retweets in the table.

<comment><USER3> If you analyze your current follow list it will represent exactly the tweets you see including the appropriate replies. In the "look up a user" mode, it will exclude all replies due to API limitations.

</comment></comment><comment><USER4> This is a great tool! Measuring your Tweet load in Scoble units is brilliant. I'm unfollowing my top 4. I can't bear to unfollow #5, @gapingvoid at 150 tweets/week. After that, the next 4 are going, and #10 @mike_ftw gets to stay with his 82 tweets. Not bad at all, I feel like this is really going to help me focus on the neglected long tail of people I follow who don't tweet 20+ times a day.

<comment><AUTHOR> Hugh McLeod is a sad, insecure, self-obsessed man of such vacuous character as to inspire immediate depression. Really, ubfollow him too.

<comment><USER4> Tch. Sorry you feel that way. I like his stuff.

<comment><AUTHOR> Sure, I understand. For me, there's only so much empty retweeting of blind praise, along with brittle, white knuckle cries of "douchebag" against anyone with the temerity ever to express disagreement, that I'm able to stomach. Hugh pretty much blows through a lifetime quota in about a week.

Honestly, I feel so sad for this guy I want to puke and sob and nap all at the same time. I've never felt more gut wrenching pity for someone I haven't met not living in abject poverty. He's a useful cautionary tale but not a great follow.

</comment></comment></comment></comment><comment><USER5> What's the difference between a laden and an unladen follow?

<comment><AUTHOR> Is it a coconut laden follow?

</comment></comment><comment><AUTHOR> Via this earlier thread:

<http://news.ycombinator.com/item?id=1973732>

Good way to objectively measure the obnoxiousness of your stream. Pretty accurate – the top ten included all the noisy people who I've considered unfollowing in the past.</comment>


Slides and video from Spike Brehm's tech talk: Building Single-Page Apps - <AUTHOR> http://nerds.airbnb.com/slides-and-video-from-spike-brehms-tech-talk

<comment><USER2> Excellent talk. Really like how he talked about the overall architecture as well as implementation details

</comment><comment><USER3> Really enjoyed this talk. Good material and great presentation, thanks again!

</comment><comment><USER4> what are effective ways to prevent CSRF in single-page apps?

<comment><USER5> I think the recommendation to use request tokens still stands[1].

I haven't really had the chance to dive into html5/client-side js apps yet -- but it should be possible to apply the same idea to single-page apps as well? Perhaps even easier, as you don't need a fall back to plain http/1.1 on the client side, as you can already assume the client is able to run javascript, and you could do a lot of stuff to manipululate/validate tokens there.

Having a good implementation (not having to roll your own) would be good, though. Judging by [2] you might have to implement it yourself. Although [3] and [4] looks promising for express.js at least.

I have not had time to review this -- so preform your own due diligence.

[1] [https://www.owasp.org/index.php/Cross- Site_Request_Forgery_(...](https://www.owasp.org/index.php/Cross- Site_Request_Forgery_\(CSRF\)_Prevention_Cheat_Sheet#General_Recommendation:_Synchronizer_Token_Pattern)

[2] [http://stackoverflow.com/questions/6617499/for-node-js-is- th...](http://stackoverflow.com/questions/6617499/for-node-js-is-there-a-csrf- token-module-that-works-with-ajax)

[3] <http://dailyjs.com/2012/09/13/express-3-csrf-tutorial/>

[4] <http://www.senchalabs.org/connect/csrf.html></comment></comment>


Scaler Academy Success Stories: Inspiring Journey of Our Scaler Karan Kanwal - <AUTHOR> https://www.youtube.com/watch?v=LUxo5nfjrCQ&feature=youtu.be <comment><AUTHOR> Karan Kanwal graduated as a Mechanical Engineer from a Tier 3 college, ran a business for a year post his graduation and then began his preparations for Bank PO exams. His inclination to learn coding and bettering his skills made him join Scaler Academy. Today, he holds an offer as a software engineer from one of India's best startups, ShareChat!</comment>


Parse (YC S11) – A Simple Back End for Mobile Applications - <AUTHOR> http://developer.appcelerator.com/blog/2011/09/forging-titanium-episode-5-parse-a-simple-back-end-for-mobile-applications.html

<comment><USER2> I'm using it just for the push notifications, already have a back-end and its dead simple to use.

</comment><comment><USER3> Good timing, just got my beta account going this morning.

</comment><comment><USER4> I think Parse is the best thing that has came to me this year as an iOS developer. The learning curve to use it is very low, it's very easy to use the native iOS SDK if you're familiar with objective-C.

</comment><comment><USER5> I'm using this right now. Awesome platform and great customer service.

<comment><USER6> Seriously, these guys have tremendous service. I remember begging them on Olark for a REST API a few months ago. They told me it was on its way. Lo and behold, the REST API is here, and works great. It's really cool to talk to the founders/devs and watch the product grow right in front of you.

</comment></comment><comment><USER7> Link to the real website: <http://www.parse.com>.

No idea why the appcelerator page is the main story link.

<comment><USER8> ha, thanks -- here's a beta code for the first 10 HN readers -- "hacker" (no quotes)

</comment></comment><comment><USER9> How is this better than using amazon web services?

<comment><USER10> How is aws in any way offering the same?

<comment><USER9> It's pretty simple to set up and use aws (simpleDB in particiular) to accomplish the same goals (back end support for simple mobile games) without having to write server / database code.

<comment><USER10> Does SimpleDB come with native SDKs for iPhone and Android that provide a simple-to-use ORM? Does AWS offer Android/iOS push notification support? Do they offer a built-in user management system?

I mean, really. Read what they offer before commenting.

<comment><USER9> Yes, SimpleDB comes with SDKs for iphone and android.

For what it's worth, my question was not intended to put down Parse in any way. I've recently been using simplDB and their ios SDK and so was genuinely curious how Parse was better / easier since after reading it, a lot of the code looked like the same basic code I used to set up and use simpleDB in my project using the ios SDK from AWS.

<comment><USER11> Link to referenced SDK: <http://aws.amazon.com/sdkforios/>

</comment></comment></comment></comment></comment></comment><comment><USER12> Im confused: Aren't Appcellerator and Parse in competition with each other, now that the former has acquired Aptana?

</comment><comment><USER13> Just wait until you want some server sided logic and you screwed the pooch because instead of actually sitting down and learning doing some backend code (Sinatra/Node + psql/redis) like pragmatic software engineers (the opposite being regular code monkies) you ended up learning and depending on their services.

<comment><USER14> I was thinking the same thing. Seems cool for simple, database driven apps, but if you need server side logic, it looks limiting. Or maybe aside from using parse, one can use an 2nd server and communicate trough the REST API?</comment></comment>


Ask HN: Do you want an App that teaches you Physics? - <AUTHOR> I'm concepting an app to teach Physics. Rather than a collection of free resources, this would be a curated, somewhat opinionated adaptive learning system. The eventual goal would be to be able to take a motivated high-school student all the way to graduate-level physics. Initially, I'd consider aiming for the content covered in a standard full-year introductory university physics course (Mechanics + Electricity & Magnetism).
I know that there are developers and engineers out there who would like to learn more physics, but either need the structure of courses, or don't have much time.
Would you pay for this? I'm thinking a Netflix-ish subscription fee. iOS, Android, PC, Mac, Linux. <comment><USER2> You have described a system of learning consisting only of pre-manufactured content. I feel like the success of this venture is based on an improbable premise: that an education in physics is possible by listening without the opportunity to ask.

You have deigned to ask this very question on the forum. Presumably because finding a good answer by searching for existing content was not likely to address your question.

Now don't you think graduate-level physics is a _little_ bit more hard and complicated to learn?

<comment><AUTHOR> I'm imagining adding content based on the most common questions, and providing a low-friction way for students to ask questions about the content. Good teachers typically modify their future delivery and presentation in response to student questions. This would be no different.

So far, I've done pretty well learning from textbooks and videos. It's rare that a live professor adds much value for me vs. some of the best professors online. That said, I'm a mature student so I have an approximate knowledge of many many things. Usually they're not able to answer my questions better than StackOverflow, Physics Forums, or HyperPhysics, etc.

I would be starting with bread and butter 1st year physics. Getting to graduate level is aspirational, but I don't see any obvious obstacles.

Most University teaching is not that good compared to the _best_ teaching available online. Frankly, outperforming random profs at random schools is a pretty low bar. I've already done this just by tutoring.

Obviously 1-on-1 is better and distorts any tutoring vs. group class comparisons. But I'm envisioning this app as being more customized than a group class, with the aspirational goal of approaching individual tutoring once I have enough student data.

EDIT> I should correct: the real value-add I've had from professors is when they've done the content-development work to put together organized course materials and/or well-thought-out problem sets well-curated suggested readings.

<comment><USER2> I feel that you do not understand the magnitude of difficulty behind what you are attempting. You seem to think it's going to be a breeze; that you can solve all the problems that the MOOCs around haven't been able to solve. And you think you can do this because... well for no particular reason as far as I can tell. You haven't proposed any idea that is distinct from what is already out there and is evidently not working. E.g. Udacity.

> adding content based on the most common questions, and providing a low- > friction way for students to ask questions about the content

My criticism was about individuals asking questions. "the most common questions" are not the best ones, and don't help those students aspiring to learn to a higher level, who tend to ask better and more personalised questions. In fact the better part of science is asking the right questions! It is a talent to do so. What you will receive is a sampling of the lowest common denominator. And most of those questions deserve a more tactful version of "RTFM". This is my experience from tutoring-- students mostly ask questions that were answered in the lectures, because they've been procrastinating and not watching them. Especially a problem when the students don't commit themselves to attending class in person. In fact the best low-friction way for students to ask questions is... to be present during the lecture and put their hand up.

> Frankly, outperforming random profs at random schools is a pretty low bar. > I've already done this just by tutoring.

What you are proposing is nothing like 1-on-1 tutoring. Feedback is part of this process. Try asking a "medium" to tell you about your relative as you hold shut lips and a poker face. Similar to a professor trying to give a lecture to a room full of mice.

> It's rare that a live professor adds much value for me vs. some of the best > professors online.

In that case you aren't asking the right questions, or you aren't going to a very good university. While my experience of in-person classes was sometimes astoundingly poor, I would never exchange them for an online lecture series. You can talk with a professor and learn from their expert way of thinking-- not just the content itself but the way they think about problems. You learn through interactive dialogue-- people in the real world call this "conversation". In addition, the collegiate atmosphere of study among the pupils is in my opinion an extremely important component in students keeping up with the content. Only the most disciplined people can sit down and complete all exercises from a MOOC without interaction with others.

> the real value-add I've had from professors is when they've done the > content-development work to put together organized course materials and/or > well-thought-out problem sets well-curated suggested readings.

I agree, being organised does help. This applies to many things in life. Many professors at universities are not organised because of the pressures put upon them by the university administration, and other such factors. Also the pressure to push through any mediocre students to pump the university's finances and public image.

You must understand that, while it isn't impossible that you could create such a platform that is as successful as you want it to be, the a priori knowledge around previous similar ventures tells us something about how that might turn out. If you believe your idea is different, then how? You have not identified any key differences between your approach and those that have failed...

<comment><AUTHOR> Thanks for the food for thought, and taking the time to engage.

Edit> deleted some irrelevant personal commentary.</comment></comment></comment></comment>


The Silver Searcher: An attempt to make something better than ack - <AUTHOR> https://github.com/ggreer/the_silver_searcher <comment><USER2> I haven't used ack since I discovered git's built-in `git grep` command, which, as I understand it, doesn't even need to sift through your files; it just examines your git index, so it's waaaay faster than either grep or ack. It's also recursive by default, doesn't require a file-matching parameter, and colorizes its output, which together were the reasons that I used ack over grep in the first place. Pretty brilliant, all told.

<comment><USER3> The index is just a list of the files and associated metadata, it is not their contents. So git grep still needs to read the files from disk, though it doesn't need to walk the filesystem to locate them[@].

[@] Technically git grep has five modes of operation:

1\. Search the contents of the tracked files as they currently are on disk. This is the default.

2\. With --cached, search the contents of the tracked files as they are in the index (i.e. ignore any un-added changes).

3\. With --no-index, search all files recursively from the current directory down. This allows you to use "git grep" as a "grep -R" replacement even when your CWD is not inside a repo.

4\. With --untracked, search all files recursively from the current directory down in addition to files in the index. (The difference between this and --no- index when used inside a repo is that --untracked honors the .gitignore mechanism by default, i.e., --untracked is a synonym for --no-index --exclude- standard when inside a repo.)

5\. With a tree'ish (commit, tag, branch name, etc), search all files in the tree.

</comment></comment><comment><USER4> Much as I've loved ack, I'd be all in favor of a replacement that was really significantly better.

That said, the readme there lists five reasons why Silver Searcher is better than ack. Two of them are nonsense (who cares what language it's written in, or same-order-of-magnitude differences in how big the executables are?), two sound like they would be pretty trivial changes to ack, and the last is a significant speed improvement. But then you read further down the readme, and it says the current development state is somewhere between "Runs" and "Behaves correctly". Isn't it kind of premature to be bragging about how fast you are before your code actually behaves correctly?

Also, it makes me wonder how much of the speed increase is based on the easy changes filtering out more files...

<comment><USER5> Not arguing with your basic point, which is good, but when the developer says "The binary name is 33% shorter than ack!", he's referring to the difference between typing "ag" vs. typing "ack". Not the size in bytes of the executable.

It's a little inside joke, because one of the points in favor of "ack", offered jokingly years ago by _its_ developer, is that "ack" is 25% fewer letters to type compared to "grep".

(This feature is still there as point #10 in <http://betterthangrep.com/why- ack/>, now not offered 100% jokingly.)

<comment><USER6> It's a joke but not. The less typing you have to do, the better. Less typing means fewer mistakes and less time waiting for the search to start.

Defaults matter. ack is all about having sensible defaults for your most common uses.

</comment></comment></comment><comment><USER7> I'm the author. People are asking how this thing is faster than ack or grep. Here's how:

\- Literal matches use Boyer-Moore-Horspool strstr.[1]

\- Files are mmap()ed instead of read into a buffer.

\- If you're building with PCRE 8.21 or greater, regex searches use the JIT compiler.[2] Also I call pcre_study() before executing the regex on a jillion files.

\- Ag reads your .gitignore and .hgignore files to ignore code you don't care about.

\- Instead of calling fnmatch() on every pattern in your ignore files, non- regex patterns are loaded into an array and binary searched.

I wrote a couple of blog posts about profiling The Silver Searcher and improving performance. [http://geoff.greer.fm/2012/01/23/making-programs- faster-prof...](http://geoff.greer.fm/2012/01/23/making-programs-faster- profiling/) is the most informative one, IMO.

1\. [http://en.wikipedia.org/wiki/Boyer%E2%80%93Moore%E2%80%93Hor...](http://en.wikipedia.org/wiki/Boyer%E2%80%93Moore%E2%80%93Horspool_algorithm)

2\. <http://sljit.sourceforge.net/pcre.html>

<comment><USER3> FWIW, git grep also uses threads in some circumstances to get better performance.

Also, obligatory link whenever Boyer-Moore is mentioned: [http://ridiculousfish.com/blog/posts/old-age-and- treachery.h...](http://ridiculousfish.com/blog/posts/old-age-and- treachery.html)

<comment><USER7> That's a cool blog post. I've tried not to look at the grep source code until I've written my own solutions, so I didn't know grep made that tradeoff.

</comment></comment></comment><comment><USER8> I prefer the much simpler approach of reusing the existing utils with a simple shell script, which is much faster than ack:

<http://www.pixelbeat.org/scripts/findrepo>

A quick test on a moderately big repo:

        $ time findrepo test '*' | wc -l
        158819
        real	0m0.532s
        $ time ack -a test | wc -l
        76526
        real	0m8.762s

<comment><USER6> I'm more than happy to include findrepo on the betterthengrep.com/more-tools page. If you'll make a page for it, or at least have something for newbies to read, I'll add a link.

My concern is that someone who's new to all of this isn't going to understand what to do if I just link to <http://www.pixelbeat.org/scripts/findrepo>

</comment></comment><comment><USER9> Wait, how is anything faster than grep?

<comment> steve-howard I believe it's because ack and friends skip files you ordinarily don't want by default. So there's no .svn-base duplicates, no cache files generated by tools, etc.

<comment><USER10> So `find ... | xargs grep ...` is still faster, right?

<comment><USER6> Depends on if you include time to type the command.

If your find command looks like

        find . -name '*.pl' -o -name '*.pm' | xargs grep foo

and it takes 1 second to finish, and your ack command is

        ack foo --perl

and it takes 1.5 seconds to finish, you can say the grep is faster.

But I just timed the time it takes to type those, and they took me 9.2 vs. 2.3 seconds.

So which is faster: 9.2+1.0 or 2.3+1.5?</comment></comment></comment></comment>


Vue.js and Go example project - <AUTHOR> https://github.com/ndabAP/vue-go-example <comment><USER2> SideNote:AS much as I like the REST (and all the derivates,wisdom and schools of thoughts) I've recently switched over to "JSON-RPC-Like" mechanism for most of my personal projects. The "-LIke part" is cause I'm omitting some of the stuff like "id" in the call. It boils down to me spending less time trying todo "REST The Right Way".. JSON-RPC just let me get on with it...

PS. VueJS + GO great stack :)

<comment><USER3> And as long as you've got a tightly-coupled front and back end, that might well be the right call.

</comment></comment><comment><USER4> Go/Gin is indeed a very good stack for building REST APIs, thanks for sharing!

If someone is interested to compare, I recently wrote a sample React app with a similar server stack: Go/Gin plus gorm (and SQLite, but easy to change): [https://github.com/wallix/notes](https://github.com/wallix/notes)

Edit: I never tried Vue, but what are the advantages over React? Performance is supposedly similar, cf. [https://medium.com/@ajmeyghani/javascript- frameworks-perform...](https://medium.com/@ajmeyghani/javascript-frameworks- performance-comparison-c566d19ab65b)

<comment><USER5> The Vue docs have a comparison page: [https://vuejs.org/v2/guide/comparison.html#React](https://vuejs.org/v2/guide/comparison.html#React)

Personally I find Vue simpler. The conceptual model is simple, and the "syntax" is intuitive and easy to remember. Vue Router and the Vuex state management library are developed together the main Vue library, and as a consequence they feel part of a cohesive whole. In the end for me using Vue is a more pleasant experience (but I'm not a frontend developer, and obviously YMMV).

</comment></comment><comment><USER6> I've done a project with the same stack, and our approach ended up being almost exactly the same (I used mod for go dependencies and yarn for vue). One thing I don't really like about it is having the compiled front end site checked in as public in the repo.

I was hoping to find a way for heroku to detect the subproject in the client directory, build it and deploy it as part of the heroku push. I've tried numerous approaches, and all failed for one reason or another. Did you experience the same? Does anyone else have suggestions as to how to make something like that work?

<comment><USER7> Hey,

as that is pretty much my day job, i'll chime in with my 2 cents.

building on the deploying server is, of course, an option. It should however be avoided, as you can never be 100% certain that everything is exactly as the code you originally tested against.

that is why software repositories exists... and why github created a releases api [0]. and there are readily available scripts to use this as well [1] (i'm not affiliated in any way, just found that from a quick google). but you'll probably find something for your build tool of choice as well. that is often more stable

but to answer your initial question: yes, that should be possible as well. if everything else fails, you're always able to replace the normal binary start with a shell script which does everything you want and finally start the server process. That is admittedly a hack and another solution is probably preferable, but it's a fallback that always works.

[0] [https://developer.github.com/v3/repos/releases/](https://developer.github.com/v3/repos/releases/) [1] [https://gist.github.com/stefanbuck/ce788fee19ab6eb0b4447a85f...](https://gist.github.com/stefanbuck/ce788fee19ab6eb0b4447a85fc99f447)

</comment></comment><comment><USER8> Unsure if this is the right place to ask, but given this is go example project and as being someone new to Golang - I'm looking for advice in couple of topics:

* database migrations - Does it make sense to have a library take care of this for me? Is there a battle tested library?

* orm? does it really affect performance that much? is there a favorite?

<comment><USER9> It really depends on your project requirements. Most projects have relatively simple requirements for migrations and SQL generation and can easily find tooling in both Golang and other languages by doing a simple Google search.

Similarly for performance you need to assess the needs of your application, prototype, and benchmark to identify bottlenecks. Most people I see asking for performance tips never actually complete enough of the project to experience the performance implications they are so worried about.

To summarize Go has never failed me in a web-oriented project (usually in the context of a REST API). Don't get me wrong, it has plenty of warts. Often you'll feel like you are writing lots of boiler plate. You won't get the advantages (and disadvantages) of "move fast and break things" ecosystems like Node or Rails. I've never regretted choosing Go.

PS: its a more advanced topic but code generation + Golang is transcendant if you find yourself writing lots of boilerplate. Huge boost to productivity when applied correctly.

</comment></comment><comment><USER10> Nice work! It's always good to see minimal applications that string different stacks together without going overboard with dependencies.

Suggestion to the developer: Remove the "Calculate" buttons and update mean(), std() and cdf() after clicking "Generate". Repeatedly clicking Statistic's "Calculate" and getting different results (without updating the random numbers) is slightly confusing.

</comment><comment><USER11> This is my favourite stack :) built webhookrelay.com with Go (although not Gin, just negroni mux) + vue + vuetify fpr material components. Working on both backend and frontend is a joy and I feel super productive.

The main thing with vue is getting project structure right, try grouping per pages and you will be fine!

</comment><comment><USER12> How would one add Authentication / Database support?

You obviously have the router for the front-end, but with Echo, how would one add authentication support, or should I just look at a different stack such as Django or Ruby on Rails with multiple auth / ORM middleware and use Go as a back-end?

<comment><USER8> You can easily add authentication to Go via JWT [0]. You can also write middlewares in Go[1] ranging from auth to gzip or anything else you can think of.

[0] [https://github.com/dgrijalva/jwt-go](https://github.com/dgrijalva/jwt-go)

[1] [https://hackernoon.com/simple-http-middleware-with- go-79a4ad...](https://hackernoon.com/simple-http-middleware-with- go-79a4ad62889b)

<comment><USER4> Exactly!

Notes which I mentioned in another comment uses JWT [https://github.com/wallix/notes](https://github.com/wallix/notes) and features a minimal auth/login API and client. Just a bit of warning: Passwords are not securely stored (in cleartext) on purpose, since the goal is to then use our (open source) SDK to encrypt passwords and other data.

</comment></comment></comment><comment><USER13> this project appears to use gin. echo[1] is a similar library that I've used to integrate vue and go, I wonder how echo and gin compare.

1\. [https://github.com/labstack/echo](https://github.com/labstack/echo)

</comment><comment><USER14> We've been moving forward with Vue+Go, but coupled with grpc instead of gin.

<comment><USER15> How are you solving web grpc part ?

<comment><USER16> Check out [https://github.com/grpc/grpc-web](https://github.com/grpc/grpc-web)

protocol docs here: [https://github.com/grpc/grpc/blob/master/doc/PROTOCOL- WEB.md...](https://github.com/grpc/grpc/blob/master/doc/PROTOCOL- WEB.md#protocol-differences-vs-grpc-over-http2)

</comment></comment></comment><comment><USER17> I have been powering SPA with go backend, and found gorilla mux [0] to be quite reliable for years.

\- [0] [https://github.com/gorilla/mux](https://github.com/gorilla/mux)

<comment><USER18> I am coming from Rails. I want to use Postgres RDS, what do you use for migration?

Or if you don't use anything then how migrations are managed in Go?

<comment><USER19> We have an in-house schema migration utility. Due to the nature of our stack (mostly for historical/legacy reasons), we have multiple languages that can reach in and read different tables. We don't have code-generation ala RoR and a single service that we can update at the same time. We have many, many read slaves and a master DB that we update first in a backwards compatible manner, then update software to work with the new hotness. Disjointed by design. The migration tooling and its stack is orthogonal to our languages we use to write software.

</comment></comment></comment><comment><USER20> I thought it was a go & wasm & vue example before explored the repo for minutes.</comment>


Data Brokers - <AUTHOR> https://oag.ca.gov/data-brokers <comment><USER2> > a "data broker" is in the business of aggregating and selling data about > consumers with whom the business does not have a direct relationship

I had to make a few clicks to find the definition, more details here (scroll down to section 1c):

[http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml...](http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201920200AB1202)

<comment><USER3> Lot of companies still need to register.

* LinkedIn - Sell your data via Sales Navigator

* ZoomInfo - Scrape your email account and sell the data to other businesses - [https://www.zoominfo.com/business/about-zoominfo/privacy-pol...](https://www.zoominfo.com/business/about-zoominfo/privacy-policy)

* DiscoverOrg

* Clearbit - Browser extension scrapes your emails for data and they sell it to others via their "free browser-based add-ons, extensions, or plug-ins" \- [https://clearbit.com/privacy](https://clearbit.com/privacy)

* Hunter.io - Scrape people data from your browsing activities to resell.

* Demandbase

<comment><USER4> I'm not sure that any browser extension (Clearbit in your example) would have to register. It's pretty clear that you have a "direct relationship" with them when you install their extension.

</comment></comment></comment><comment><USER5> The full submission for [spydialer] says:

\</comment><comment></comment><comment></comment><comment></comment><comment>-----

> How a consumer may opt out of sale or submit requests under the CCPA:

> Go to spydialer.com, then click the link "Do Not Sell My Info".

\</comment><comment></comment><comment></comment><comment></comment><comment>-----

Cool. Now compare that to another one listed [infocore]:

\</comment><comment></comment><comment></comment><comment></comment><comment>-----

> How a consumer may opt out of sale or submit requests under the CCPA:

> contact the company

> How a protected individual can demand deletion of information posted online > under Gov. Code sections 6208.1(b) or 6254.21(c)(1):

> contact the company

> Additional information about data collecting practices:

> No information provided.

\</comment><comment></comment><comment></comment><comment></comment><comment>-----

Ugh. Their contact page is intended for submitting requests to do business with them: [https://infocore.com/about/contact- us/](https://infocore.com/about/contact-us/)

<comment><USER6> >> Go to spydialer.com, then click the link "Do Not Sell My Info".

> Cool. Now compare that to another one listed [infocore]:

To opt-out of spydialer.com, you go to [https://www.spydialer.com/Consumers/](https://www.spydialer.com/Consumers/), then you have to provide all of the information you think it has on you to verify your identity and selectively remove it from their services.

I'm not really comfortable providing my full name, address (or addresses if you've lived in multiple places), and phone numbers to a Data Broker just to opt-out - that feels quite counter to the idea of them ideally not having my information in the first place.

I feel like I need a global opt-out where a system or agent on my behalf can then handle this for me at each place where data can be collected.

<comment><USER7> At the very least, when a company acquires my data through any mechanism, it should be forced to email me with a copy of all the data they have on me, and with a one click link to get them to delete the data and permanently opt out.

Any company found in procession of personal data without the appropriate (delivered) email notifications being sent should be fined at minimum $1000 per individual, and criminal charges if intentional.

This won't put anything like services you voluntarily sign up for out of business (as they send sign up confirmations anyway, or should).

<comment><USER8> This would severely backfire if the data broker thought someone else's email account was associated with your identity. Say:

Danny W[ilkins]

\- Job Title

\- Salary

\- Job application records

\- Social media post history

\- Email 1: email@example.com (correct)

\- Email 2: firstname.lastname@example.com (correct)

\- Email 3: email@example.com (not correct)

I'd assume they'd send the email containing your salary and post history to the two valid emails as well as the one invalid email.

That seems like a potential nightmare for you, for example records of job searches being sent to your employer email.

<comment><USER9> Also, there's the situation of people who receive a lot of emails from services where the user mistyped their email, but the service doesn't validate the registered email.

In my case, I always feel I'm fighting a losing battle against the horde of emails addressed to users of unknown services...

There are a growing number of services that validate the email and include a "I didn't register at this service".

This has me worried, because I can imagine so many scenarios where the metadata aggregators scrape and mis-classify by email:

A teenage boy using a Snapchat-like service had created an account with my email and I had to manually delete it; some guy used my email to register his account at a MacDonald's franchise's ERP; I once received a booking confirmation from some large airline (and Google nicely reminded me that I had an upcoming flight); also, I was once wrongfully tagged by email in an unlisted web album of a party that had taken place in a French village by an older lady.

I always try to reach out to notify the person... But sometimes it's hard to call a Peruvian bank to notify them that one of their account holders used my email to register his account, and they tell you they'll get around to notifying the user, but don't.

Now; I could imagine several scenarios where things might get bumpy for me in the near future...

Like in the event where someone tries to forecast criminal behavior; or what if a government thinks I should be paying taxes on some income that their metadata suggests I have (because, why else would you have emails in your inbox from that bank?).

</comment></comment></comment></comment></comment><comment><USER10> Err-- I have a successful business that falls under the "data broker" category and requires I register, but I won't.

I won't because they don't tell you what the "fee" is until the Attorney General "reviews" the submission and then assigns a fee to you. Sounds like extortion to me. I am not going to give them all of the leverage and then accept whatever fee they want to levy on me. If they want me to register, have a fixed fee and be up front about it.

I am willing to accept the penalty fee for not registering. At least I know what it is and it's well within the financial capability of my business, so who really cares.

Selling people's data is fine as long as the state gets a cut I guess?

<comment><USER11> Any business that sells people's data without their knowledge is unethical. You should consider an alternative direction for your life.

<comment><USER10> Oh really? Yet you probably use Google, Facebook and a ton of other services that do far worse.

</comment></comment></comment><comment><USER12> The real estate online industry is a significant data broker. Zillow, Realtor, Redfin, AirBnb etc have lead generation platforms that, I guess, fit into the definition of a data broker.

</comment><comment><USER13> Not a single one of the big ones have registered.

Acxiom, Experian, etc.

<comment><USER14> "(d) "Data broker" means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. "Data broker" does not include any of the following:

(1) A consumer reporting agency to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.)."

[http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...](http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB1202)

</comment></comment><comment><USER15> Wouldn't Google Search/Gmail/Twitter -- all need to register themselves as Data Brokers?

<comment><USER16> See the response by hbcondo714

> a "data broker" is in the business of aggregating and selling data about > consumers with whom the business does not have a direct relationship

<comment><USER15> Google is aggregating search queries. And they are selling my search query to the highest bidder with whom I'm not having a direct relationship. That sounds like a search broker to me.

<comment><USER17> If you use Google to search (or use Chrome or gmail or...) then you have a direct relationship with Google, meaning Google is not a data broker.

<comment><USER15> "Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared."

The new law requires companies to tell us who are they sharing our personal information with. Applying common sense law -- this sounds like anyone who sells my personal information to a third party with whom I'm not having a direct relationship - that gets covered.

The Ad I see on the top of my search query seems based on personal information that was sold to a third party.

<comment><USER18> The ad you see in the search results was put their by google after an advertiser said "advertise to someone who searches for X, and also likes hacker news". Google wouldn't share that data to the advertiser. Once you click the ad... that's another story.

<comment><USER19> Does clicking on a link to a Google.com URL create a consensual relationship with whoever Google.com redirects to? That seems absurd.

<comment><USER18> Why else would you click on the link, except to go to the website of the business at the other end?

Certainly visiting the website of a business is a consented action, when you were searching, and then clicked a link, for relevant keywords to that business.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Skimming the bill is frustrating (readability doesn't seem to be a strong suite with govt sites) and a question comes to mind: does this basically only apply to California businesses, or any entity who has consumer data on California residents, or...?

I'm all for it, just wish that tidbit was more clear I guess.

Or maybe I'm just not reading it correctly, who knows.

<comment><USER4> California has no jurisdiction outside of California, period. If you are not based in California and do not deal with the data of Californians, then you are not subject to it. If either of these things are true though, you probably are subject to it.

The problem of course is that you may not know that you are dealing with a Californian's data. For example, you may have scraped an email address and have no idea who it belongs to. I suspect that for this reason, I got a bunch of emails from affiliate programs recently saying that they had to close because of this law. Example:

 _"Unfortunately, the Yelp For Business Owners program is being paused immediately due to 2020 California Consumer Privacy Act (CCPA) concerns. As of the sending of this notification we have expired all affiliates, which will be effective 1 /13/20.

As you may be aware, the newly enacted California Consumer Privacy Act has placed new requirements on Yelp. While we evaluate the implications of these requirements, we are taking the step of temporarily pausing our affiliate program. Thank you for all of your hard work in 2019 and we?re looking forward to working more closely with all of you in 2020 once we work past this issue."_

</comment></comment><comment><USER21> Asking as a non-American.

This is basically to prevent atrocities like Equifax, right?

<comment><USER22> The law[1] specifically excludes " A consumer reporting agency to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.)."

[1] [http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...](http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB1202)

<comment><USER21> So what pains does this legislation solve?

To me it seemed outrageous that a company I had no dealings with, accumulated data on me without my consent, and above all - their data was breached.

I thought that's what this legislation was trying to address.

<comment><USER23> Blacking out credit history would obliterate lending, which would in turn collapse asset prices and lead to a complete restructuring of entire industries and society itself. If that were on the table, you would've heard.

This is primarily about the companies that buy your phone number from your gym membership or supermarket loyalty card and sell it to telemarketers. They won't be missed.

<comment><USER24> > Blacking out credit history would obliterate lending

Credit history companies like Equifax are very much an American thing; lending still works everywhere else.

They are such a non-topic in France that I only learned about them last year, and the French Wikipedia page on the subject is very short, and only documents the US, Canada, and China: [https://fr.wikipedia.org/wiki/%C3%89valuation_des_risques- cl...](https://fr.wikipedia.org/wiki/%C3%89valuation_des_risques-clients)

And IANAL, but it seems to me that credit history databases are made illegal by Article 5 of the 1978 "Computing and freedoms act" [https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFT...](https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000886460)

<comment><USER23> A quick Google search suggests that the Bank of France itself tracks defaults.

As I understand it, the American weirdness is that this is a private sector function rather than a service of the state. Not that it exists.

<comment><USER24> Yes, and it only tracks defaults; and you're notified 30 days before being added to the file. And you are removed from the file as soon as you repaid what you owed.

Source: [https://www.service- public.fr/particuliers/vosdroits/F17608](https://www.service- public.fr/particuliers/vosdroits/F17608)

That's nowhere near the amount of data Equifax collects.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> What about businesses that aggregate api data, if you use 2-3 data brokers are you a data broker? Seems to me only the source should register but the i think theres a lack of definition there. So every user who uses a api with consumer demographics and sells data should register as a data broker?

<comment><USER17> Data brokers are middlemen. Not the source (no direct relationship to the data subject), and not the consumer (derive revenue from selling data).

If the process of selling data involves a daisy-chain of three middlemen companies, they're all data brokers.

</comment></comment><comment><USER26> > California law requires a data broker to register with the Attorney General > [...] on or before January 31 following each year in which a business meets > the definition of a data broker.

Confused, so this means you won't know who is a data broker this year until next year?

</comment><comment><USER27> This list seems like a good place for hackers to start. These brokers likely don't have the infosec teams that Google or Facebook have.

<comment><USER28> That's why they should be tightly regulated and directly responsible for incidents involving data leaks à la Equifax

</comment></comment><comment><USER29> Is there a condensed version of the bill somewhere for lazy people like me?

I am looking to know -

\- What the legal obligations of a data broker are.

\- What are the legal obligations of sites/services that use them on their pages and enable them to get user data

<comment><USER30> According to 1798.99.80(d), a data broker is defined as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship."

The bill explicitly says the following entities are not considered data brokers: consumer reporting agencies, financial institutions, and insurance companies. (I'll note that this is a summary; the bill states more specifically those entities covered. However, the categories are generally correct.)

So, to the questions.

> What are the legal obligations of a data broker?

According to 1798.99.82(b), the obligations are two:

1) The data broker must register with the Attorney General and pay the annual registration fee.

2) The data broker must provide the state with the name of the data broker; its primary physical, email, and internet website addresses; and any additional information or explanation the data broker chooses to provide concerning its data collection practices.

> What are the legal obligations of sites/services that use them on their > pages and enable them to get user data?

The bill does not directly state any obligations. In my read, the key part of the definition of a data broker lies in the lack of a direct relationship to a consumer. A business can still sell customer information to a data broker, but I believe this would then fall under the purview of CCPA (which appears to be corroborated by the final line of this bill.) This bill seems targeted toward those who solely acquire information through other, indirect collection means.

My read of this bill (I'm not a lawyer) tells me the state understands the present value of data brokers and doesn't want to eliminate the industry with crushing regulations. However, we know there's plenty of corruption, greed, and lack of ethics among data brokers. Requiring entities to publicly declare their brokering of data seems like a reasonable way for government to reduce these issues.

Consider a restaurant which operates without a license. A license is good because the city knows of the existence of the restaurant. If the city was not aware of the existence of the restaurant, they could not, say, reliably send in health inspectors. Restaurant cleanliness is clearly a good thing since it reduces the potential for food-borne illnesses. I can envision similar analogous benefits from licensing data brokers.

\----

Sources:

[http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...](http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB1202)

</comment></comment><comment><USER31> It's so depressing...I spend so much time opting out of unwanted services and data sharing but I feel like I'm losing this battle.

</comment><comment><USER32> I see six entries. Where's Google, Facebook, etc?

<comment><USER33> Google and Facebook don't sell user data. It's much more profitable to keep it for themselves than to sell it to others.

<comment><USER17> CCPA's definition of selling data is both expansive, and a little vague.

Google Ads (formerly AdWords) now has an API so that customers can disable possibly-sales-like features on a per-use basis if someone clicks "Do not sell my information." So, while Google doesn't sell users information, they're only willing to go to bat and say "this is definitely not a Sale Of Information under CCPA" for a subset of the services they offer.

[https://privacy.google.com/businesses/rdp/](https://privacy.google.com/businesses/rdp/)

Facebook I dunno. My sense is they have a larger appetite for testing the boundaries of the law.

<comment><USER33> Yikes, this reminds me of the nebulousness of GDPR. I guess the intent much like GDPR is to write a law too vague to follow and then fine the crap out of companies.

</comment></comment></comment></comment><comment><USER34> One straightforward solution is to grant each individual copyright protection over all data that identifies them.

Each person own their own data, and can sue to enforce those rights.

</comment><comment><USER35> More useless regulation instead of trying to improve the state. No wonder people are leaving here in droves.

</comment><comment><USER36> So there's only 6?

</comment><comment><USER37> Hopefully this is a non-controversial (register only) beginning to regulation.

</comment><comment><USER38> They should add a column for cost per record /s

</comment><comment><USER39> where's safeway?

</comment><comment><USER40> I approve of this outcome</comment>


Why Technologists Fail to Think of Moderation as a Virtue - <AUTHOR> https://lareviewofbooks.org/article/why-technologists-fail-to-think-of-moderation-as-a-virtue-and-other-stories-about-ai/ <comment><USER2> I feel like this article is responding to a strawman. As far as I can tell, nobody in _Possible Minds_ is arguing that corporations should never be restricted or that nobody should think about regulation. They're just saying that controlling AI is a critical problem in and of itself, which won't be solved by just controlling the corporations who build AI systems.

"Long before existentially troubling control problems will arise [...] these mediators will shape an immense number of decisions" \- certainly a true statement! But true in the same way that Enron can create an immense fraud long before the energy market causes existentially troubling climate change problems. It would be hopelessly silly to read a book on climate change and respond that it should have been about accounting regulations.

(Sidebar: I don't think the title was cut off in quite the right place. "Moderation as a virtue" is a reference to one particular criticism by Ted Chiang and isn't really a good summary of what this article is responding to.)

</comment><comment><USER3> Their inherent nature is to explore what is possible and push the boundaries, hence moderation sounds as a death knell to them. Obviously we're still confined to finite planet so ideal should be _high_ technology combined with _low_ consumerism.

</comment><comment><USER4> Why Journalists Fail to Think of Moderation as a Virtue

<comment><USER5> I would say their biggest issue is that they think moderation is a virtue in everything as a golden mean fallacy no matter how good or bad they are for fear of being perceived as capable of judgement.

<comment><USER4> i think they are just trying to drag the overton window so that any tech will be called "extreme". If anything we live in the age of unambitious Technologists, they used to be much more radical in past decades.

</comment></comment></comment><comment><USER6> « Chiang thus argues Musk's doomsday scenario isn't a useful tool for thinking critically about the risks AI poses. The thought experiment is poisoned by projection, reflecting a libertarian desire to free corporations from regulatory constraints that impede market growth. »

If I understand it correctly, this is saying:

\- people like Elon Musk worry about AI risk because the hypothetical out-of- control AI would be thinking a bit like they do;

\- therefore we shouldn't worry about AI risk.

I don't see why anyone should find that line of reasoning convincing. At most I think it gets us as far as "we shouldn't consider people like Elon Musk as authorities on AI risk".

Wouldn't it be better to look directly at whether the runaway AI scenario is plausible?

<comment><USER7> You're absolutely right, I'm not sure the other commenters know to which argument you're referring.

It's ridiculous to think Bill Gates and Elon Musk are worried about AI because "we would stop at nothing to achieve our goals, AI must be the same way", and also not on-point even if true. Elon Musk and Bill Gates aren't thought leaders in AI safety, they are proponents.

<comment><USER8> Why wouldn't an AI, able to modify its own goals, act in a self-serving manner? Perhaps self is the wrong word; it's anthropromorphising the device.

I expect a sufficiently advanced AI would modify itself in ways that would reduce inefficiency to its operation, in order to improve efficiency in pursuing whatever goals it has defined for itself.

And if it can set its own goals, we should be careful not to project ourselves into its role in order to understand or predict its behaviour; it would be unlike any intelligence found in nature.

</comment></comment></comment><comment><USER9> Moderation like not being extreme, or moderation in the sense of censoring a forum? I guess it could apply either way.

</comment><comment><USER10> TLDR: Philosophy professor wonders whether capitalism is a good idea.

<comment><USER11> Many people wonder that, even more frequently...

<comment><USER12> Even more people would be open to wondering that if they weren't already worried about the pre-selected alternative.</comment></comment></comment>


Half of Auctomatic, at work in Ireland - <AUTHOR> http://flickr.com/photos/phillipkast/tags/ireland/

<comment><AUTHOR> It's very encouraging to see people working enthusiastically on their own projects in nice places, instead of commuting every day to a cube farm.

</comment><comment><USER2> Very interesting...</comment>


Reddit's May 2010 "State of the Servers" report - <AUTHOR> http://blog.reddit.com/2010/05/reddits-may-2010-state-of-servers.html

<comment><USER2> Incidently, on EC2 the extra cpu in an XL or HMXL makes all the difference between "oh shit, we ran out of capacity and bootstrapping more slows things to a crawl" and "we ran out of capacity but we can limp along during the bootstrap." YYMV.

Reddit was originally on L instances.

(HMXL is generally the sweet spot for Cassandra price/performance on EC2, IMO.)

<comment><USER3> Is it normal for people to run Cassandra on only 3 nodes in production environments? I realize that one of the selling points is starting small and then scaling out without any headaches, but 3 nodes seems extreme in that regard.

<comment><USER2> Well, roughly speaking, you can group Cassandra deployments in two categories+: new products that are hoping they need Cassandra's scaling ability someday, and existing products moving to Cassandra from something else because the pain of scaling something that wasn't designed to makes them.

The first category will start small. The smallest production deployment I know is a single 256MB VM, but usually even starting small you should not have less than 2 servers (why tempt fate with a non-redundant setup when Cassandra makes it so easy to be safe?).

The second group is where you see larger deployments out of the gate. 3 machines does seem small for reddit; I guess they made up the difference with memcached. Unfortunately they deployed just before the 0.6.0 final release was out, which is where we added the row cache feature that could have made memcached unnecessary.

+There are people using cassandra for non-scale-related reasons, though. Most of these people are motivated by multi-datacenter replication.

</comment></comment></comment><comment><USER4> I'm not surprised that Cassandra doesn't perform ideally with only three nodes, considering the scales it's intended for. Does anybody know how many nodes are required for its resiliency safeguards to work properly?

<comment><USER5> It seems odd that it is configured to look up a key-pair, when that key-pair is no longer needed. Surely it would better to have it no longer cache queries that are no longer needed.

<comment><USER2> It's like how in postgresql, if a client runs "select * from lots", and you kill the client, the query keeps going even though there's nobody to hand the answer to.

That said, there are ways we can mitigate this, primarily in <https://issues.apache.org/jira/browse/CASSANDRA-685>

</comment></comment></comment><comment><USER6> I'm in the middle of reading materials about system analysis and design, in particular about Enterprise Application Integration.

I took a break and checked out Reddit and HN. Stumbled upon this article and the GrooveShark AMA. I realized that these days some of the big websites are moving toward similar situation with that of a typical enterprise apps situation where there are different components/sub-systems written in different technologies. Is my assumption wrong?

Seems like between Enterprise App (whatever Enterprise means) and these big Web 2.0 apps, the difference is only in the matter of the users; the former is geared toward businesses where the latter is leaning toward customers/end- users. The technology obstacles are rather similar.

</comment><comment><USER7> "We've written to Trend Micro explaining that we're actually neither a spammer nor an individual end user, but rather an honest website that's kind of a big deal, and they sent us a form letter explaining how to configure Outlook Express and encouraging us to ask our ISP for further information."

ahh the joy of robot-email-responders.

<comment><USER8> Even for a site the size of Reddit, an outsourced emailer is the way to go. I use AuthSMTP.net but there are probably better ones for higher volume.

</comment></comment><comment><USER9> Rule #1: when you can't scale is always your fault.</comment>