Clojure is for Type B personalities - <AUTHOR> https://gist.github.com/oakes/c82cd08821ce444be6bf <comment><USER2> I am a type B person (if this designation even makes sense), and have a diagnosed ADD.

However, I prefer statically typed languages like Scala, as it is easier for me to compensate for lack of internal discipline with external constraints.

<comment><USER3> This was my thought too: this has it backwards. I would rather have a computer do all the "Type A" perfectionism for me, thank you very much, so that I can carry on being my "Type B" self.

</comment></comment><comment><USER4> This is basically reinventing Steve Yegge's analysis in [1] of programmers into "conservative" (risk-averse, prioritize safety) and "liberal" (accepting of risk, prioritize expressivity), except less polarizing (because it doesn't involve political comparisons) and less thorough. Oakes also calls for reconciliation, while Yegge tips his hand as a hardcore "liberal".

[1]: [https://plus.google.com/110981030061712822816/posts/KaSKeg4v...](https://plus.google.com/110981030061712822816/posts/KaSKeg4vQtz)

They're both vaguely accurate but break down if you try to credit them with too much explanatory power (as Yegge does, IMO, but Oakes doesn't seem quite as reductionist).

<comment><USER5> Both, to me, sound like reinventions of ESR's "the cathedral and the bazaar". I like those definitions and the things they imply: bazaar-style work is simple, easy, and fast, it doesn't require much capital, but it doesn't scale past a certain size -- and it's not going to produce an architecture that can withstand firebombing 700 years after ground was broken for it.

I think most people can say pretty accurately whether they're in the "open for business by Tuesday" model of software development or the "700 years and undreamt-of threats" model... But if your product becomes a surprise hit, that's when you refactor your chaotic bazaar into a clean, legible, highly maintainable cathedral.

<comment><USER4> Cathedral and Bazaar are about different ways of organizing projects; Liberal/conservative or Type B/Type A are about individual programmer preferences. So they're not the same thing, although there's some amount of sympathy between them - one might expect liberal/type-B personalities to be attracted to bazaar work and conservative/type-A personalities to prefer cathedral work. But I don't know to what extent this is true, or testable.

</comment></comment></comment><comment><USER6> If you're interested in Clojure, the gist author (Zach Oakes) maintains a few cool projects [1]:

\- play-clj, a Clojure game library

\- Nightcode, an IDE for Clojure

\- Nightweb, an anonymous P2P social network in Clojure

and (non-Clojure) - SolidOak, an IDE for Rust

Also, his "Making Games at Runtime with Clojure" talk [2] is great.

[1] [https://github.com/oakes](https://github.com/oakes)

[2] [https://www.youtube.com/watch?v=0GzzFeS5cMc](https://www.youtube.com/watch?v=0GzzFeS5cMc)

</comment><comment><USER7> While I understand the sentiment, this conflates up-front design with compile- time safety, and opposes the latter to "quick, spontaneous changes". However, I feel that my iteration loop gets tighter thanks to compile-time safety, since I don't even have to run my application and test it to find most of its errors.

<comment><USER3> Yes! It is _so_ much easier to write a bunch of aspirational code when you know the compiler is going to tell you exactly why all of the stuff that can't possibly work won't work, so that you can go fix it.

</comment></comment><comment><USER8> Pop psychology meets programmer mythology.

<comment><USER9> My experience fits in his model though. I'm type A and more into ML languages than Lisp. Maybe not strictly type A: Java is too boring for me..

<comment><USER10> I guess we could actually test this empirically with a survey.

<comment><USER11> Maybe we should. I am a type A, but I prefer Scheme to any other language in existence. I actually came to Scheme via Clojure.

</comment></comment></comment></comment><comment><USER12> Somehow related: "The bipolar LISP programmer" ([http://www.lambdassociates.org/blog/bipolar.htm](http://www.lambdassociates.org/blog/bipolar.htm)).

<comment><USER13> Yep, that's me.

</comment></comment><comment><USER14> A vs B is a matter of reaction to stress (as it affects the heart), not organizational prowess.

</comment><comment><USER15> I'd argue that these might be polar examples and that a lot of people (maybe even the majority) fall somewhere in between. I for one cannot imagine being like the Clojure author, committing scratch-pad code into repo. At the same time, I despise the levels of complexity C++, Java and C# have introduced. Ruby and Javascript (and sometimes Python, Bash) are my goto. However, I like to organize things, keep them DRY. A project like Rails is extremely well architected for an interpreted language based on the authors observations. I highly doubt that it is an outlier.

</comment><comment><USER16> I have to say, I was trying to learn Clojure (instead of Common Lisp) and actually fell in love with Haskell when a friend explained that I don't have to write the type signatures - almost at all. Indeed; previously, I was rigorously doing type signatures on all functions in Haskell, and found it very annoying.

The only downside of that was it made sometimes harder to figure out the error. When you get run time type error, you can do the traces on the values and see where it happens more easily. In case of static typing error, you cannot even start the program. But perhaps this just requires some better practice.

And I also experienced the "when it compiles, almost correct" proverb from Haskell community.

The other thing that converted me to Haskell from Lisp was that I learned (theoretically, so far) about how to write interpreters using free monads. And you get type checking with it.

<comment><USER17> Type inference is cool for write fast but defeat the point of have a type system (IMHO).

I'm using F#, and without a IDE that tell me what kind of crazy type is the code I'm looking right know I can't function.

I have used delphi (love it!) and write the types is so minimal, and the benefit of clarity are great. I use a lot of python, I'm used to be unsecure about what exactly the types are. I use F#, and I'm even more unsecure about it. Is kind of infurating that the compiler _know_ what the types _are_ , but all of that is _hidden_ to me!

P.D: Type-inference is the thing I like less from F#. All the rest is great to me (Pattern matching, AGDT, etc).

I wish the editor show me the types in _read mode_ but I can write without type all in _write mode_. So, I write "a + b" and then when move out the line, the editor show "a:int + b:int" or something like that. That could truly be the best thing about the 2 worlds.

</comment></comment><comment><USER18> Pretty great article. I've thought alot about these issues aswell. The tension between the two types is difficult to deal with and I don't really know any solution, apart from mutual respect.

My characterisation of the two types would actually reverse the top- down/bottom-up labels: type-A's seem to be dithering around in the details, trying to assemble something larger, while type-B's get the big picture, but loose focus as they zoom in on the details. In practice this explains the outward appearance: type-A's obsession with getting the plan right (because they are chronically lost), and type-B's rapid tinkering (because they never know if their crazy idea is going to work or not).

The two types struggle to connect: type-A just sees the B as a big mess, and type-B sees the A as technically correct but missing the point entirely.

</comment><comment><USER5> So, "Clojure is for slobs?" Because that's what it sounds like the article is saying...

<comment><USER19> I didn't see it that way. More spontaneous and un-predictable is what I got.

<comment><USER5> Laziness, sloppy code conventions, cheap beer, gas station pastries...

<comment><USER20> The cheap beer I mentioned was Yuengling, which is definitely not for slobs =)

</comment></comment></comment></comment><comment><USER21> counterexample, I am type B but I like rigid languages.

</comment><comment><USER22> I find this offensive for some reason.

</comment><comment><USER23> But the error message though...

</comment><comment><USER24> I dont agree with this at all

</comment><comment><USER25> Loved it. Thanks!

</comment><comment><USER26> Robert X Cringely said that programmers are divided into nerds and geeks. The nerds do the wrong thing well and the geeks do the right thing badly.

The reason computers are a revolutionary productive technology is that when you put them together on a team they don't do what you would expect and do the wrong things badly but instead do the right things well.

I don't know how to use that story to write better Clojure, though.

<comment><USER13> Link?

<comment><USER26> Column was published before the web was invented (in the 1980s), so I have no idea.

</comment></comment></comment><comment><USER27> so much of this hit home. I'm disorganized. I like to just get at the meat of the problem. I don't sit on my hands shopping for programming patterns to use.

I compare the process of creating software much like pottery when you start out with clay it's not clear what the end result is going to be. But as you play around with it something forms, and you impose more structure and clear cut features with refactoring.

type b coders like us get a lot of shit for eccentric decisions that ultimately lead to breakthrough ideas or features but type A coders is almost always dominating with logic and aggression I see tensions between developers.

If what the article says holds true, I would say Type A coders are more for maintenance and Type B coders are the visionaries. Type B is the engineer that gets paid millions for writing MVPs as a early CTO while Type A engineers tendency to compete on everything leads to burn out and lower salary. Likewise Type B would be horrible in a corporate environment where as Type A would do well.

<comment><USER3> This is an extremely high-and-mighty perspective. If this is truly your worldview, you may do well to take a step back and consider upping your humility and compassion levels. Next time someone gives you shit for your eccentric decisions, maybe try _really_ asking yourself whether they might be right and you might be wrong. Next time you see somebody reading up on programming techniques and best practices, maybe consider that they might be wisely availing themselves of learning resources beyond themselves, rather than "sit[ting] on [their] hands".

I do agree with you that the tendency to compete to be the most "right" is a problem amongst programmers, but I don't really see that it fits into this whole (contrived, IMO) "Type A" vs. "Type B" thing. I've seen plenty of bikeshedding amongst the organized and the disorganized alike.

<comment><USER27> >The type A programmers are right that correctness and uniformity is important for building robust, maintainable software. The type B programmers are right that a tight feedback loop and experimentation is important for building simple, innovative software.

Almost early on in any startup phase, you want a type B to quickly build MVP without drama and then hiring type A to refactor it.

I've seen a startup get all worked up about structures, spacings, unit tests when they don't even have a customer yet, can't ship fast enough because of all these bottlenecks introduced by Type A architect.

In large corporation Type A would thrive where as the Type B wouldn't so I just don't see why you take what I said to the heart.

<comment><USER3> I really didn't take what you said "to the heart". I was more hoping to nudge you toward a greater self awareness. (I'm also being pretty high-and-mighty by thinking that's my prerogative, so there we are.)

The truth of the matter is that knowing when and how to build an MVP quickly without wasting time on the wrong things and knowing when and how to create reliable and maintainable software is _all_ part of your job as a software developer. Choosing one or the other as "that's just how I am" is shirking responsibility.</comment></comment></comment></comment>


Russian officials: Nope, we can't finish fixing the carrier Kuznetsov - <AUTHOR> https://arstechnica.com/tech-policy/2018/11/russian-officials-nope-we-cant-finish-fixing-the-carrier-kuznetsov/ <comment><USER2> The Russians know very well that the big carrier/battlewagon era is over. they can be killed by supervelocity missiles, so they are not going to waste another ruble - nor should the USA. Even Iran knows this and they are biuidling large fleet of small drone boats that can loiter at the surface and emit nothing unti they are commanded.</comment>


Kazuo Ishiguro (1989) - <AUTHOR> http://bombmagazine.org/article/1269/kazuo-ishiguro <comment><USER3> In these types of threads people always jump in and suggest their favorite books of the author. In my case, it's Remains of the Day and An Artist of the Floating World, the two novels they talk about in the article. I've been such a fan of Remains of the Day after reading it a couple years ago that I've bought it a couple times and shipped it to friends to make sure they read it. I read An Artist of the Floating World earlier this summer and that stuck with me as well. Fantastic fantastic. I've also read Never Let Me Go but it didn't quite do it for me, something felt off in a way that's difficult to express and not worthy of talking about here.

I'll say this though, make sure to read Remains of the Day and then move to Artist of the Floating World. Both about WWII and people's opinions and feelings from what happened in their world. Not the longest of novels, so reading them back to back is the way to go.

<comment><USER4> I've read the book (Remains of the Day), after reading a post here few years ago. Haven't read the one though (yet).

<edit> \- yes I did! Thank you [http://hn.algolia.com](http://hn.algolia.com) \- here is my post saying that I did (lol) - [https://news.ycombinator.com/item?id=7541291](https://news.ycombinator.com/item?id=7541291) \- but I can't find the post which mentioned it (must've been here)

</comment></comment><comment><USER5> Commenting here mainly as I don't want this to drop off. It's a good interview with a really very wonderful writer.

HN'ers unfamiliar with his work might really enjoy Never Let Me Go, a very affecting novel which you could plausibly call sci-fi.

<comment><USER6> I've read "The Remains of the Day" and "Never Let Me Go". Enjoyed the former.

I found the latter irritating to read -- roughly, many of the characters are "not in a great situation" when it comes to the role society has assigned them -- yet they are all accepting (perhaps that is too strong) or passive. No volition to change the status quo.

That doesn't mean it is a bad book, or bad literature, but reading pages and pages of characters focusing on interpersonal drama when they are trapped in this hideous situation pissed me off!

<comment><USER7> This is a major reason I so love Never Let Me Go. So much of our dystopian fiction chronicles characters that heroically resist the terrors thrust upon them.

But Never Let Me Go tells a much more human story: these characters, like so many of us, are swept up helplessly in the torrents and terrors of their world. And it's not that they're _unable_ to change the tide -- they don't even know that it's an option.

It is, for certain, quite frustrating -- just as it is in the world outside the book's covers.

</comment></comment></comment><comment><USER8> _I feel like a change. There's another side of my writing self that I need to explore: the messy, chaotic, undisciplined side. The undignified side._

His next book was _The Unconsoled_ , which is on the way to my mailbox. I'm a bit scared of it. It's supposed to be a glorious mess and impossible to enjoy if you try to make the wrong kind of sense out of it. I'm extra nervous (and also excited) because I didn't get much out of _The Buried Giant_ (or haven't yet, anyway.)

<comment><USER9> If your part-way through The Buried Giant, it has a solid ending (IMHO) - <USER2> Never Let Me Go, the characters realize that they have made some foundational assumptions that aren't quite right, but unlike that novel they do have the opportunity to change those assumptions - for better or worse</comment></comment>


Kaspersky Antivirus 2009 source code leaked - <AUTHOR> http://unremote.org/?p=317 <comment><USER2> Some one in the antivirus industry please clarify something for me. Which is more important/critical for an AV company: the software or regular virus definition updates. My guess is that the virus signature database is where they create maximum value?

<comment><USER3> I have been in the AV industry for a while and I would say both.

AV companies have a lot of behaviour analysis/decoding/parsing done inside their code that is as important as their "static" signature set.

In fact, I would say that having access to the code and how they analyze the files/memory/etc is more valuable to a competitor (and the "bad guys") than the static signature set.

<comment><USER4> In what sense have you ever been in the AV industry? I'm not sure whether this account belongs to David or Dre, but neither of you have an AV company on your LinkedIn profiles.

I admire you for building a business on cleaning up hacked Wordpress installs (seriously), but that's not the same game that Kaspersky is playing.

</comment></comment></comment><comment><USER5> More info here:

[http://news.softpedia.com/news/Former-Kaspersky-Employee- Res...](http://news.softpedia.com/news/Former-Kaspersky-Employee-Responsible- for-Leaked-Source-Code-181367.shtml)

It seems it's probably a beta version of AV 2009... Still embarrassing/potentially harmful to the company though - especially following the hacking of their website a few months ago ([http://www.computerworlduk.com/news/security/3244882/kaspers...](http://www.computerworlduk.com/news/security/3244882/kaspersky- website-hacked-in-fake-antivirus-attack/))

<comment><USER6> _...the source code remains the intellectual property of Kaspersky Lab and downloading, distributing or using it without consent is illegal._

Is it true that downloading it is illegal?

<comment><USER7> Yes, downloading is akin to making a copy without consent of the copyright owner. (Edit: At least according to the Berne Convention, which most countries have signed.)

Edit2: I think dchest is right and illegality of the act of downloading does probably not follow from the Berne Convention, sorry. Distribution (offering for download) certainly is and I think at least according to German law the resulting copy has to be destroyed. Mind you, I'm no lawyer and might be mistaken.

<comment><USER8> What about in the US? Can one be tracked/prosecuted simply for downloading?

<comment><USER9> Theoretically yes but usually they target distributors in preference to users. It's easier to get a verdict or judgment against the distributor because it avoids the question of "what is a copy" and how that applies to the digital space and also because people are less sympathetic to distributors. The thing with P2P applications is that everyone is also automatically a distributor.

</comment></comment></comment></comment></comment><comment><USER10> One thing that amazes me at most of commercial codebases I have seen (leaked or not) is the sheer size of them. How can one spend 1GB of source code on something like anti-virus program?

<comment><USER11> It's not limited to commercial code... Lots of codebases for complex applications are substantially large. Often the translation files filled with strings alone will be 50% of it.

<comment><USER9> Well, the Linux kernel source code is around 71MB compressed, I'd guess maybe 200MB uncompressed. That's quite a difference in source code size, and I think that the same is true with most OSS projects. The WINE project for instance is also < 100MB for the full (huge and extensive, including translation) source.

I think that commercial codebases just end up with a lot of cruft and nobody ever feels like cleaning them up (plus, there is incentive for keeping things a bit clunky as it buys slack-off time and/or extra hourly pay). As above, I also think they use other commercial/crappy components like third-party widgets that had the same treatment, so it all snowballs into a huge/unwieldy thing.

</comment></comment></comment><comment><USER12> Once again the human element proves to be the hardest to secure.

Three years in jail is a pretty solid sentence, but still, every company with employees handing sensitive data like this is potentially at risk. All it takes is one bad leave and your corporate crown jewels could be on the street.

</comment><comment><USER13> While the leaked code may ease the work of malware writers, keep in mind that whoever writes malware _regularly tests against all popular antivirus software_.

No point in releasing something only to get caught right away.

<comment><USER14> This is true, but if a test doesn't work with KAV, arguably it is now much easier to figure out why and find a workaround.

</comment></comment><comment> rw2- The torrent has lots of Chinese leechers.

<comment><USER15> Interesting fact. I wonder what they are up to!

<comment><USER16> Purely academic intentions I presume.

</comment></comment></comment><comment><USER17> Very interesting. This should be obvious, but I'd just like to remind everyone that given the source, nature, and intended audience of this file, it is fairly likely that it contains novel malware to catch people from other AV companies, and that you should not open, compile, or run anything from it without the full set of malware-safety precautions. Use only a virtual machine with no network connectivity.

</comment><comment><USER18> I realise that this is a pretty dubious request, but a part of me would much prefer to see a link to either GitHub or BitBucket than a torrent of a zip file.

<comment><USER19> Why? Cloning a repository doesn't improve the morality of downloading and viewing this code. In the same way that it is wrong to receive a stolen radio, you shouldn't touch this code with a 10 foot pole no matter how it's packaged.

<comment><USER18> As I said above, I realise it's a dubious request. I know it doesn't improve the morality either.

It's more for the sake of viewing the code. I associate those 2 brands with viewing/sharing code.</comment></comment></comment>


What if YouTube was still an independent company - <AUTHOR> <comment><USER2> Would not have survived as they were losing loads of money due to overhead on storage and bandwidth.</comment>


Hundreds of Protesters Killed in Latest "Mass Killing" in Egypt - <AUTHOR> http://www.nytimes.com/2013/08/15/world/middleeast/egypt.html?pagewanted=all&_r=0

<comment><AUTHOR> I decided to write a blog post responding to this article, partly talking about why I think this is relevant Hacker News, and also asking a lot of question - I certainly don't have a lot of answers...

[http://www.opine.me/egyptian-government-mass- killings/](http://www.opine.me/egyptian-government-mass-killings/)</comment>


A note to all creators — coders, designers, entrepreneurs - <AUTHOR> http://discovr.info/2012/10/a-note-to-all-creators/

<comment><USER2> Everybody wanna be Michaelangelo, don't nobody wanna bust rocks.

</comment><comment><USER3> Motivation for the entrepreneur. :v</comment>


Selenium 2.0: Out Now - <AUTHOR> http://seleniumhq.wordpress.com/2011/07/08/selenium-2-0/ <comment><USER2> Official website here: <http://seleniumhq.org/>

For those who don't know what Selenium is (or forgot, like me), it is a system for testing web applications. It includes the following components:

\+ Selenium IDE (Firefox add-on for creating and replaying tests) \+ Selenium Remote Control (run tests in multiple browsers and platforms) \+ Selenium Grid (run tests in parallel across multiple servers)

I'm not affiliated with the project, I just wanted to provide a quick intro for those in a hurry to learn a bit about it.

<comment><USER3> I often wonder why dev blogs rarely include a link to the main site. As often as not, I have to type in the name or search on it because the blog masthead doesn't provide any background information or navigational aids to the new visitor.

</comment></comment><comment><USER4> A couple of years ago my company was in the process of purchasing QTP, an expensive testing product. I had suggested Selenium instead of QTP, but for whatever reason we went with QTP.

But we couldn't afford QTP licenses for everyone who wanted or needed to use it, so some people started writing tests in Selenium instead. Two years on, we're getting rid of QTP and switching entirely to Selenium. We're not doing it just cost reasons though, people just like using Selenium much more than QTP.

Hats off to the Selenium team for such a excellent tool!

</comment><comment><USER5> Selenium is one of the my hidden tricks to get good karma at my jobs. Everywhere I work I find a need for Selenium and everybody thinks it is awesome.

</comment><comment><USER6> Looking forward to trying it out. Many, many thanks for providing such an excellent tool. I was writing automated tests before Selenium, and it has been a seismic change in browser automation. Between you guys, JMeter, and Robot there really is a credible open source automated testing stack now.

</comment><comment><USER7> I used the 1.x versions of Selenium pretty heavily at my last job and the JavaScript selectors could get pretty hairy (even with jQuery).

Does anyone with experience with Selenium 2.0 know how much of a boost WebDriver gives for performance? Especially doing tests of a SPA with a lot of AJAX could get hairy and slow.

</comment><comment><USER8> Selenium has always been one of my favorite projects. You can tell someone has been thru the stress-test wringer if they know its ins and outs. The newer grid stuff looks great, although I haven't played with it yet.

</comment><comment><USER9> For those who prefer using Ruby, try the ruby bindings:

<http://rubygems.org/gems/selenium-webdriver>

Now wrap your tests in RSpec and you're good to go.

<comment><USER10> I would look at Capybara before using webdriver directly in Ruby. With Capybara, with one line of code, you can change from using webdriver, to using the native rack driver, or a full headless browser setup like capybara-webkit, or akephalos for headless httpunit (which runs javascript).

<https://github.com/jnicklas/capybara>

drivers:

<https://github.com/thoughtbot/capybara-webkit>

<https://github.com/bernerdschaefer/akephalos>

</comment></comment><comment><USER11> congrats guys, awesome project saving drudgery for web developers and testers across globe

<comment><USER12> I'm one of those developers.

Last summer, I took over a troubled Ruby on Rails project; the code was a mess, overly complex and bug-ridden, lack of meaningful unit tests, and an unhappy client.

I needed integration tests. After trying and failing with Cucumber, I switched to Selenium IDE.

A year later, I'm very happy with Selenium. The project is turning around and I sense the client is warming up to me.

I now use Selenium on almost all my projects.

<comment><USER13> What is it that made you fail with Cucumber and succeed with Selenium?

<comment><USER12> The existing codebase, and the fact that I'm charging by the hour on a project who's budget is 3x initial estimates.

The site was, and still is, stuck at Rails 2.1.1. And, at the time, I was not using RVM or Bundler. Meanwhile, I was putting out fires on a daily base on a live system.

With Cucumber, I was unable to run even a simple feature against the codebase. I'd get an exception, fix it somehow, then get another. After 20 minutes of that, I started looking for other options.

And on top of that, I did not know the codebase: brand new project.

The quickest path to stable ground was Selenium IDE. Just hit the record button and start writing integration tests. I quickly gained enough confidence to change the underlying code. And I was working within a budget of only a couple thousand dollars a month.

What I've grown to love about Selenium, as opposed to Cucumber, is its complete separation from the site it's testing. An integration testing framework can take a long time to master; I'd rather 1) minimize that time, 2) learn a tool that can be applied to as wide a variety of projects as possible.

</comment></comment></comment></comment><comment><USER14> Just to mention another tool: For quick regression testing I found the iMacros for Firefox addon very easy to use: [https://addons.mozilla.org/en- US/firefox/addon/imacros-for-f...](https://addons.mozilla.org/en- US/firefox/addon/imacros-for-firefox/)

I also like its ability to read CSV files out of the box ("table driven testing").

</comment><comment><USER15> Was using 2.0beta3 of Selenium2 with IphoneDriver for around 4 months and it has been great. The quality was very good that I don't see a need to rush and switch to the actual 2.0 release :P Great work to the team!

</comment><comment><USER16> Nice work and a giant Congrats to the entire Selenium team

</comment><comment><USER17> Great job guys! It seems like there is an opportunity here to build a good testing service around selenium grid. Has anyone done that yet?

<comment><USER18> Isn't that what Sauce Labs is all about?

<comment><USER14> yes, and browsermob, and alertfox

</comment></comment></comment><comment><USER19> great work!</comment>


Dtags: directory tags for lazy programmers - <AUTHOR> https://github.com/joowani/dtags <comment><USER2> If you don't want to manually tag each directory, I'd suggest autojump ([https://github.com/wting/autojump](https://github.com/wting/autojump)). It'll automatically track visited directories.</comment>


New Maps icon is pretty but will kill you - <AUTHOR> http://i.imgur.com/zQqzj.jpg

<comment><USER2> As a side, I thought the blue line gives it an awkward imbalance.</comment>


Microsoft Issues Warning For 800M Windows 10 Users - <AUTHOR> https://www.forbes.com/sites/gordonkelly/2019/06/29/microsoft-windows-10-upgrade-registry-warning-upgrade-windows/ <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=20317669](https://news.ycombinator.com/item?id=20317669), which was the first submission of the original source that this article points to.

</comment><comment><USER3> This title seems a bit alarmist.

<comment><USER4> As is the majority of Gordon Kelly's writing for Forbes</comment></comment>


Getting started with shaders: signed distance functions - <AUTHOR> https://jvns.ca/blog/2020/03/15/writing-shaders-with-signed-distance-functions/ <comment> GuB-42 Here is the article that started everything

[https://www.iquilezles.org/www/articles/raymarchingdf/raymar...](https://www.iquilezles.org/www/articles/raymarchingdf/raymarchingdf.htm)

iq didn't invent the technique, but he popularized it. His website has a lot of tutorials on making demoscene effects, especially for 4k intros. He is also one of the makers of shadertoy.

<comment><USER2> I was surprised to learn he was behind the Oculus Quill (VR art and animation software). He started posting very well produced video lessons on SDFs. I enjoyed this recent one: [https://www.youtube.com/watch?v=PMltMdi1Wzg](https://www.youtube.com/watch?v=PMltMdi1Wzg)

<comment><USER3> You might also be surprised to find out that he was a co-author of shader toy, and he was previously at Pixar where he did much of the procedural work behind The Good Dinosaur.

</comment></comment></comment><comment><USER4> There's a disclaimer missing from this article (and many others like it), writing a frag shader to generate 3d geometry is generally not the ideal way to actually render stuff unless you're doing demos (with some exceptions).

The other thing that gets me is these articles say "here's how you write a shader" but shaders are much more than a fragment shader over the whole screen (like what shadertoy provides).

<comment><USER5> He's using ray tracing, I thought this was the typical way of doing it. Do you have references on alternate methods?

<comment><USER3> So, specifically, he is ray-marching a signed-distance field. Which has some interesting properties.

One of the major down-sides is it's often more difficult to create the boundary surface, fewer editors and the like. More common methods are polygons, subdivision surfaces, and nurbs.

So, one common technique as you mentioned is ray-tracing, the key difference is ray-marching samples the world at intervals (often regularly spaced, but in SDFs you can search for the boundary since given any location, you know the distance to the closest surface) where ray-tracing you intersect each primitive directly, and normally build up data structures (BVH, for example) to minimize the amount of individual tests you need to do.

Another common technique, used almost exclusively in every real-time case (games, CAD tools, etc) Is rasterization, where you project the triangles into screenspace and intersect them with the pixels, the main difference being that your outer loop is now "for each triangle" rather than "for each pixel"

The differences might seem pretty subtle, and in a sense they are. But they have pretty enormous ramifications on the design of a renderer, how they handle content and their performance characteristics.

<comment><USER6> It's she, not he: [https://twitter.com/b0rk](https://twitter.com/b0rk)

<comment><USER3> Thanks for the correction.

</comment></comment></comment></comment></comment><comment><USER7> One of my coworkers did a basic implementation of SDF (signed distance fields) based on the Valve white paper [1]. He was implementing smoothing for fonts but the work applied to most vector shapes. IMO, it gave exceptional results and he claimed it was a reasonably simple implementation.

1\. [https://steamcdn-a.akamaihd.net/apps/valve/2007/SIGGRAPH2007...](https://steamcdn-a.akamaihd.net/apps/valve/2007/SIGGRAPH2007_AlphaTestedMagnification.pdf)

<comment><USER8> msdfgen : [https://github.com/Chlumsky/msdfgen](https://github.com/Chlumsky/msdfgen)

</comment></comment><comment><USER9> I went deep down the art of code rabbit hole on YouTube, a great channel for learning about shaders.

I wrote this blog post on writing interactive SDF shaders:

[https://jasmcole.com/2019/10/03/signed-distance- fields/](https://jasmcole.com/2019/10/03/signed-distance-fields/)

</comment><comment><USER10> Shameless plug - But if you are interested in 2D SDFs and some interesting ways they may be practically used in games, I wrote a bit about it here: [https://blog.sb1.io/intro-to-2d-signed-distance- functions/](https://blog.sb1.io/intro-to-2d-signed-distance-functions/)

<comment><USER11> I did something sort of similar for the basic menu controls in a little game I made, visible here [0].

It's a fun puzzle to work out how to draw things like a question mark or on- off power icon in a fragment shader. Definitely not the easiest/quickest way to construct a UI though, especially with weak math-fu like mine.

[0] [http://pengaru.com/~vc/tmp/q.png](http://pengaru.com/~vc/tmp/q.png)

</comment></comment><comment><USER12> So signed distance functions turn out to be quite hard to design for more complicated shapes. You can cheat by having the distance far aware from the surface being not quite accurate -- but there are limits to how much you can cheat before you have unwanted rendering artifacts such as blobs or holes.

"Boolean" operations on these signed distance fields pretty much always cheat, except for Union, which can be done with a max(a,b) operation.

Deep Learning can be used to attempt to learn a function approximating a true signed distance field for a shape. [https://deepai.org/publication/deepsdf- learning-continuous-s...](https://deepai.org/publication/deepsdf-learning- continuous-signed-distance-functions-for-shape-representation)

I think signed distance fields may turn out to be significantly better than old school raytracing if we can have super-optimized distance field functions!

<comment><USER13> The union operator also produces incorrect distances for the interior of the union volume, which is a problem for things like shadow cone tracing. See [http://iquilezles.org/www/articles/interiordistance/interior...](http://iquilezles.org/www/articles/interiordistance/interiordistance.htm), I've actually been struggling with this in my SDF implementation.

I'm still a big fan of the union operation since GPU rasterizers can trivially hardware accelerate it, which means you can render a bunch of objects in one go and know that it will be performed at near-optimal efficiency by the GPU. I've been combining that with a packing technique to render 3 depth slices at once in RGB (plus an extra duplicate slice in A) so that I can accurately sample any point in space with a single bilinear texture read.</comment></comment>


Why CEOs should play Magic - <AUTHOR> http://broadcastermage.com/why-ceos-should-play-magic/

<comment><USER2> A disproportionate amount of tech CEOs (and I suspect older HN readers) also played D&D. Correlation or causality?</comment>


Gem Updater: Update gems in your Gemfile and fetch their changelogs - <AUTHOR> https://github.com/MaximeD/gem_updater

<comment><USER2> > Before running your test suite and checking everything is fine, the first > thing you do is probably to look for the changelogs of updated gems.

Uh, no, the first thing you do is run the test suite.

<comment><USER3> Indeed. How about an analogous tool to the OP that uses binary search to deduce which updated gem(s) break the build, and then uses binary search on the intermediate versions of those gems to tell you exactly which version is the first bad one? _Then_ spits out the changelog for that version ;)

</comment></comment><comment><USER4> Does such a thing like this exist for npm? Where it feels like things are updated, like daily.

<comment><USER5> Yes, it does. It's called Gemnasium.

<comment><USER6> Not really the same thing, is it? Gemnasium is a paid service. As far as I know, it relies on monitoring your source code on Github, which requires granting it access to your Github account. The OP's tool is a command line tool that generates a changelog only when you ask for it, and requires only local access to the code.

<comment><USER7> Hi, Gemnasium founder here. Let me clarify things a bit :) Gemnasium is a paid service for private projects only, and security notifications. It's free for opensource projects. If you don't want to share your github repo with us (and I completely understand that), you can push your files to our API using http requests, or directly our CLI : https//github.com/gemnasium/toolbelt Modern projects use more than one package manager (ie: bower or npm + something else). You don't need to mix tools with gemnasium, we support projects with multiple deps type.

Feel free to contact me if you have any question!

<comment><USER6> I appreciate the feedback, but you're not really contradicting anything I said.

Most companies have private projects, so you end up having to pay for Gemnasium. And you do have to somehow upload stuff to your service to make use of it.

Like the grandparent, I just want a command-line tool to document updates to NPM modules as part of Git commits.

> Modern projects use more than one package manager

Our projects are very modern indeed, and we use just one package manager per project. Node.js projects use NPM (for server and front end packages), Ruby projects use Rubygems, etc.

<comment><USER7> Ok, but there's a difference between sharing _all_ your files and just a bunch of non-critical ones (Gemfile, Gemfile.lock, etc.) :)

<comment><USER6> Agreed. But why do I need to share anything at all when a local command-line program already has all the information (or can gather it from npmjs.com or whatever)?

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Would be cool if it took a command-line arg of a specified gem(s) to update...

<comment><AUTHOR> That would be totally doable, thanks for suggesting it

</comment></comment><comment><USER9> We use this in our app, and it has been a real time saver. No excuse to be outdated anymore :)

<comment><AUTHOR> Yes the whole point is to save your time from repeatedly looking for changelogs. I'm glad this could help in your project !</comment></comment>


How to Fix Facebook Before It Fixes Us - <AUTHOR> https://washingtonmonthly.com/magazine/january-february-march-2018/how-to-fix-facebook-before-it-fixes-us/ <comment><USER2> Quit using it. Let's go back to the way the internet used to be, y'know with instant messaging and a multitude of cultures that have their own ecosystems. Let's stop consolidating all of this information and wealth in the hands of people who don't give a shit about what makes us different (unless it sells an ad).

<comment><USER3> Go back to what, the AIM and Myspace domination? Before Facebook it was Myspace that was the juggernaut of the social media sphere.

As the number of people that can freely access the internet grows, you see them focusing around a single social media platform. That's because social media strongly benefits from centralization, it's easier to talk to family and friends if you don't have to manage fifty different accounts.

The idea that there was a 'multitude of cultures' before Facebook is just wrong. There was the main social media platforms and a bunch of niche offshoots. That's why this is such a tricky problem to fix because even if Facebook vanished tomorrow, eventually there would be another platform which absolutely everyone would circle around.

<comment><USER4> Not AIM and MySpace, but things like XMPP, where you could use one chat client and connect to your own Jabber server, Twitter, and Google chat.

One solution is open, decentralized protocols.

The article addresses that a little bit here:

> ...the internet platforms were able to pursue business strategies that would > not have been allowed in prior decades. No one stopped them from using free > products to centralize the internet and then replace its core functions.

<comment><USER3> It's a solution to a separate problem. You need to make something easy to use for the masses, you need to make it safe from bad actors and you need to actually advertise it.

It's easy to talk about open and decentralized protocols but social media is a popularity contest, not one based off the best or most free platform. As the article mentions nothing was and nothing is stopping them from capitalizing on open and free products, followed by gutting and replacing them.

<comment><USER4> They build their products on open technologies and then attempt to extinguish the open technologies.

XMPP, RSS/Atom, and HTML are three examples of EEE in modern times.

\- XMPP => proprietary chat that locks users in

\- RSS/Atom => algorithmic news feeds that lock users in

\- HTML => AMP -- if you want distribution, they tie your hands with markup and monetization restrictions

\- etc.

</comment></comment></comment></comment></comment><comment><USER5> > we should consider that the time has come to revive the country's > traditional approach to monopoly. Since the Reagan era, antitrust law has > operated under the principle that monopoly is not a problem so long as it > doesn't result in higher prices for consumers. Under that framework, > Facebook and Google have been allowed to dominate several industries—not > just search and social media but also email, video, photos, and digital ad > sales, among others—increasing their monopolies by buying potential rivals > like YouTube and Instagram. While superficially appealing, this approach > ignores costs that don't show up in a price tag. Addiction to Facebook, > YouTube, and other platforms has a cost. Election manipulation has a cost. > Reduced innovation and shrinkage of the entrepreneurial economy has a cost. > All of these costs are evident today. We can quantify them well enough to > appreciate that the costs to consumers of concentration on the internet are > unacceptably high.

With the current deck of politicians, it is highly unlikely that anything will be done to address this

<comment><USER6> Hyper-restrictive copyright and network access laws (coupled with aggressive interpretations a la the RAM Copy Doctrine) are the key overlooked components that have allowed the net to devolve into a giant AOL-Keyword-ized walled garden.

Fix these laws (which doesn't necessarily mean abandoning their core concepts) and the floodgates will open with fresh competition. This is never discussed because these legal mechanisms undergird a _massive_ part of the tech and media industries. It is better to fix the anti-competitive mechanisms at the source than to use the anti-trust kludge to break down people who have simply exploited them too well.

<comment><USER7> Underlying driver for this is that an unregulated market favours economies of scale and network effects and therefore trends towards monopolies. This is particularly pronounced and accelerated on digital platforms.

</comment></comment></comment><comment><USER8> "Fixing yourself" automatically fixes the "Facebook problem". Because then, Facebook will be completely irrelevant to you.

<comment><USER9> The question isn't whether Facebook is relevant to you. It's whether it's relevant to 300 million other people.

If a problem as 300 million causes, you still have a problem if you cut that down to 299,999,999.

<comment><USER10> Society has always been manipulated. Facebook has nothing on religions for example.

The real question is whether an individual checking out from Facebook harms themselves in some way e.g. less able to find work? We just need to make sure Facebook never gets endorsement as some kind of identity / passport.

<comment><USER9> > Society has always been manipulated.

True. And people have always murdered each other. But when millions of people are murdering each other we call it war.

My body is fighting some millions of germs right now. If you add an order of magnitude or two to that I'll be sick. Or dead.

A camel can carry a lot of straw. Enough straw can crush a camel.

At some point we have to deal with the problem.

</comment></comment></comment></comment><comment><USER11> > When citizens of the United Kingdom voted to leave the European Union in > June 2016, most observers were stunned. The polls had predicted a victory > for the "Remain" campaign. And common sense made it hard to believe that > Britons would do something so obviously contrary to their self-interest.

Y'know, I suspect that Leave voters thought leaving _was_ in their self- interest — or at the very least that voting 'Leave' send a message which was in their self-interest.

What I find perhaps most interesting here is how the narrative about political campaigns has changed in four and eight years. When Mr. Obama won twice, his campaign's adroit use of the Internet was praised by the media; when President Trump (for whom I did _not_ vote) won, his campaign's — and other actors' — use of the Internet has been reviled by the media.

I think all of this is just due to psychic aftershocks from the 2016 election: folks just can't believe that their candidate lost, that they live in a country which rejected her. The sad fact of the matter is that Mrs. Clinton was _easily_ the worst candidate that the Democrats have put forward in a generation — she makes Mondale, Dukakis & Kerry look charismatic! Pretty much any Democrat in the country could have won the election — heck, Tim Kaine (the Democratic vice-presidential candidate) would almost certainly have won handily.

My own theory is that outside meddling in the U.S. election was intended to weaken Mrs. Clinton's administration. I don't think anyone expected Mr. Trump to win.

> It reads like the plot of a sci-fi novel: a technology celebrated for > bringing people together is exploited by a hostile power to drive people > apart, undermine democracy, and create misery. This is precisely what > happened in the United States during the 2016 election.

You know, there were an awful lot of folks who felt pretty similarly in 2012. I don't think many of them tried to undermine the freedoms of association & speech, although perhaps some did.

<comment><USER12> > Mrs. Clinton was ... [not charismatic]

I've never understood this line; she always seemed charismatic to me.

I'm curious -- can you name a female politician you consider charismatic?

<comment><USER11> > I'm curious -- can you name a female politician you consider charismatic?

I hate to say it, but the first example which leaps to mind is Mrs. Palin. There's no _there_ there (as anyone who watched her vice-presidential debate performance would know) but she was, at the time, quite charismatic.

Senator Gillibrand might count, but I've not seen her speak often enough to have an opinion.

Certainly with someone like Baroness Thatcher one knew that she had a brain, and she was keen to use it, but I don't know if she was _charismatic_. I don't think that's a word anyone would apply to Mrs. Merkel, either. Maybe Indira Gandhi? I don't know enough about her to know.

<comment><USER12> What do you think of Elisabeth Warren?

<comment><USER11> I think that Sen. Warren had more charisma before she entered politics (this is probably true of Mrs. Palin, too). There's certainly a strong group of people for whom she has quite a bit of charisma today, but I don't think that they're a terribly large electorate (although they are probably disproportionately represented in the media, which will certainly help her).

She's certainly smart, but that's not the same as charisma.

</comment></comment></comment></comment></comment><comment><USER13> I quit Facebook around Christmas time. Felt weird at first, but overall it's been a position experience. The Chrome blocker plugin I use to enforce my quitting keeps a count of how many times I've attempted to visit it. I'm in the 40s now. If I spent 2 minutes per visit, then I've saved 80 so far!

<comment><USER14> I blocked reddit. I can still use it via incognito mode if it contains useful information while doing Google search result. What I've learned is that, I wasn't really addicted to reddit as much as my bored fingers were. I don't miss it.

I also blocked cnn.com, and couple other sites that I habitually go to. I may even add HN to the list. Sure there are some gems to be found here, but I find myself coming here more to read comments and headlines. It has essentially turned into reddit for me.

<comment><USER13> For me it was/is the same thing- bored fingers go cmd-t + faceb... + enter out of habit

</comment></comment></comment><comment><USER15> This quote sums up, for the most part, how the system is gamed; "People tend to react more to inputs that land low on the brainstem". Maybe parents and schools should teach kids more about how not to respond in such a fashion.

<comment><USER16> I get the impression that well meaning teachers, parents, guardians, friends, strangers, and everyone else HAS been trying very hard for a very long time. Socrates, Buddha, Jesus, Mohammad, you think they were trying their darndest?

The problem is that even if we give ourselves well meaning instructions that will benefit ourselves in the medium to long term, invariably we will come to betray ourselves.

Personally I think it stems from a censor-breaker strategy that emerges from the complexity of the limited hardware we have that needs to quickly solve real world problems.

<comment><USER17> In my experience teenagers are often better at ignoring "lower brainstem" attacks than their "teachers, parents, guardians," etc. Much like a DOS attack, ignoring this shit early and often is the dominant success strategy.

<comment><USER16> I'd be very interested in your experience as that goes against what I understand about human neurocognitive maturation as echoed by insurance rates, suicide rates, violence, teen pregnancy, etc...

</comment></comment></comment></comment><comment><USER18> Search for 'tax' finds one instance:

> This allowed the platforms to centralize the internet, inserting themselves > between users and content, effectively imposing a tax on both sides.

Sadly this does not contain the obvious fix: tax ads.

<comment><USER19> I'd love you to go into more detail with this proposal. How would taxing ads be different than just taxing corporations?

<comment><USER20> I like the idea. Ads could be treated as pollution.

<comment><USER21> Ads _are_ pollution. Information pollution.

</comment></comment></comment></comment><comment><USER22> Facebook's monopoly is a problem because, increasingly, Facebook's dopamine- driven tools replaces traditional civic society. They're easier. They're superficially more pleasing. They're often addictive. And any company in control of the sphere in which people congregate and interact then controls /how/ we congregate and interact. And if you control how we congregate and interact then you control how we exert control on those who we chose to rule us. As soon as you change that quality, quantity and ability you change the whole basis of society. And therefore how that society presses its current rulers and chooses its future rulers. And this is happening and has happened. And it may not be for the best.

</comment><comment><USER17> I wish TFA had opposed Facebook for the right reasons and in the right way. It really is a massive waste of our collective thought and attention, but apparently that's only bad because then we voted for the guy that the TV talked about _all the time_. (You know another era in which we voted exactly as TV told us to vote? Before the internet existed! Oh Facebook you have ruined us!) Also apparently the answer is to expand FCC's role until it defends Facebook against all competition in precisely the manner in which it has long defended Bell Telephone against all competition. Democracy in action!

(And Google? Does TFA actually contain an argument against Google, or did he just mention it a bunch of times? Oh right, they stopped funding a think tank. To a Washingtonian that would probably constitute a high crime. Out here in flyover country, that doesn't even rate a "meh".)

If the author really wanted to help, rather than insert himself and his cronies into the regulatory state, he'd be getting Sanders and Warren on a reality show with Snoop Dogg and Mama June, right away. Or he could act like what he claims to be, a "technology investor", and start funding the innovations that will eat the heart out of an increasingly old and ungainly Facebook. It's _interesting_ that he made such a big deal about his visionary investment in Facebook without bothering to tell us if he is still invested. (Which, obviously, he is, which is why he wrote TFA about this wonderful "movement" which coincidentally totally aligns with Facebook's interests.)

</comment><comment><USER23> "Dear diary, here is how I repeat what thousands of people have been saying about Facebook/Google/etc. for years."

I am wondering how someone seemingly oblivious to what Facebook is can be a successful investor.

<comment> aaron-lebo I'd agree, it was obvious what FB and Zuckerberg were from the beginning. But we all see what we want to and what we allow ourselves to see, so it's commendable that they are seeing it now and speaking against it.

<comment><USER23> It is human nature. We all grow up and regret mistakes. Most often in public for the sake of showing how we have grown.

</comment></comment></comment><comment><USER24> > All software platforms should be required to offer a legitimate opt-out, one > that enables users to stick with the prior version if they do not like the > new EULA. "Forking" platforms between old and new versions would have > several benefits: increased consumer choice, greater transparency on the > EULA, and more care in the rollout of new functionality, among others

Interesting. Although if this applied to all software platforms, I suspect startups are going to be hit a lot harder than the big co's. Maintaining this level of "forking" seems like a nontrivial engineering task.

> Eighth, and finally, we should consider that the time has come to revive the > country's traditional approach to monopoly

Feels unclear how this would help. It feels difficult to craft anti-trust laws that big co's can't reason their way out of. But IANAL, so please correct me if I'm wrong here.

</comment><comment><USER25> hmm. if one grasps the basic idea behind this (recently top-HN-ed) weird- machines+exploitability stuff: [http://ieeexplore.ieee.org/ielx7/6245516/6558478/08226852.pd...](http://ieeexplore.ieee.org/ielx7/6245516/6558478/08226852.pdf?tp=&arnumber=8226852&isnumber=6558478) and extrapolates "weirdness" further from hardware/OS/application into a social-network-as-system... there might be many ways to hack it to do something useful for someone. How about Machiavelly-as-a-service, anyone?

</comment><comment><USER26> Pretty long article that I doubt most will read in its entirety, if at all.

It was, however, a good read about social engineering, and I've summarized the points made and the solutions proposed below:

>Fear and anger produce a lot more engagement and sharing than joy.

>The result is that the algorithms favor sensational content over substance.

>Continuous reinforcement of existing beliefs tends to entrench those beliefs more deeply, while also making them more extreme and resistant to contrary facts.

>The Russians appear to have invested heavily in weakening the candidacy of Hillary Clinton during the Democratic primary by promoting emotionally charged content to supporters of Bernie Sanders and Jill Stein, as well as to likely Clinton supporters who might be discouraged from voting.

>We also have evidence now that Russia used its social media tactics to manipulate the Brexit vote.

>A team of researchers reported in November, for instance, that more than 150,000 Russian-language Twitter accounts posted pro-Leave messages in the run-up to the referendum.

>[B]ad actors plant a rumor on sites like 4chan and Reddit, leverage the disenchanted people on those sites to create buzz, build phony news sites with "press" versions of the rumor, push the story onto Twitter to attract the real media, then blow up the story for the masses on Facebook.

>Facebook and Google responded by reiterating their opposition to government regulation, insisting that it would kill innovation and hurt the country's global competitiveness, and that self-regulation would produce better results.

>Polls suggest that about a third of Americans believe that Russian interference is fake news, despite unanimous agreement to the contrary by the country's intelligence agencies.

Solutions proposed:

1) [I]t's essential to ban digital bots that impersonate humans

2) [T]he platforms should not be allowed to make any acquisitions until they have addressed the damage caused to date, taken steps to prevent harm in the future, and demonstrated that such acquisitions will not result in diminished competition.

3) [T]he platforms must be transparent about who is behind political and issues-based communication.

4) [T]he platforms must be more transparent about their algorithms.

5) [T]he platforms should be required to have a more equitable contractual relationship with users.

6) [W]e need a limit on the commercial exploitation of consumer data by internet platforms.

7) [C]onsumers, not the platforms, should own their own data.

8) [F]inally, we should consider that the time has come to revive the country's traditional approach to monopoly.

<comment><USER27> I suspect people worried about these issues are a bit more likely to make time & muster attention to read the articles on the topic.

This article was at the very end of my one-sitting article-reading endurance, but it had enough of a flow for me to finish with only a bit of skimming near the end.

Thank you for preparing a great summary :)

<comment><USER26> You're welcome!

After reading a few paragraphs I realized it was going to be largely anecdotal, so I figured paring it down would save some people ten or twenty minutes. I agree, however, that the flow made it more manageable to enjoy.

</comment></comment></comment><comment><USER28> This year is election year in Sweden and we know the Russians spread disinformation during the Finnish election through social media. They've had plenty of practice for taking on our small country.

Denmark, Norway and Finland have a populist, far right party in their respective government coalition, Sweden and Iceland are the only Nordic countries that have resisted. I fear this will stop being the case. The Sweden Democrats are already polling highly and something bad, anything, wether it's a recession after this long bull market or a politically charged murder could quickly be blamed on immigration and spread like wildfire on social media by people who love simple answers to complicated questions.

<comment><USER29> Aren't you overestimating facebook influence and underestimating the real life? If "evil Russia" is spreading misinformation isn't it a great opportunity for traditional media to expose and correct the misinformation? Censorship will mate the matter only worse.

<comment><USER28> I don't really think I am underestimating it, we can see a clear connection between supporters of Trump (and other far-right populist politicians) and the disinformation they've received from Russia. I'm not suggesting Russia started the angry movements that are dismissive of experts and government officials to begin with but they could potentially swing other people to join the already existing movement.

We already know this is possible. The media has managed to influence elections multiple times, so has celebrities and religious officials (in Sweden, one of our most beloved children's books authors is credited with influencing the 1976 election a lot) and Facebook makes the angry person with a catchy meme as influential for a few weeks.

The thing is that too many don't trust traditional media even when it's revealed Russia were influencing elections. As the piece stated, more than 30% of Americans believe Russian meddling in the US election is fake news, even though the US intelligence community has no doubt they were involved. 30% is absolutely enough to swing an election.

So, I'm not really suggesting censorship, neither is the opinion piece linked in the OP. Let Facebook be responsible for the defamation resulting from these malicious posts and you can bet your ass they'll throw money at stomping out this problem.

</comment></comment></comment><comment><USER30> It is obvious for reading just a few lines of this article that the author is extremely biased in support of Clinton and Democrats and he only cares about media manipulation when he loses. If media manipulation in his side it doesn't matter.

I am not American and from my point of view Democrats totally own media attention in the US. They own the artists and famous people space, they own most important TVs and newspapers and so on.

In fact Trump won because of their support, as they only talked about him in preelection time, as they believed Trump was way weaker than other Republican candidates.

Now this man is socked not because Facebook is a manipulation media, like TV or Newspapers, but because other entities could control it as well as they can.

For this man it was obvious that Hillary was going to win (because they control most media) so it was a big surprise that people could actually vote on their own in a democracy system.

The day they lost the election he wants to talk with Zuckerberg to "make them aware of the problems" of facebook not being a totally biased platform like the New York times or Washington Post is.

Again as a non American I don't want to be manipulated by either side. I don't want to be forced to go to a WWIII just because some people can't deal with losing a democratic election or because some guy impulsive action.

So it looks to me that the best solution is to design alternatives to facebook that are not as centralized and to start using them even if they are not as good.

<comment><USER17> I wish we Americans were sensible enough to implement the suggestions you make here. I'm not optimistic about that, however.

</comment></comment><comment><USER31> Just curious ... show of hands, how many people here have never been on Facebook?

<comment><USER17> I created an account once, in "incognito" mode, but I only sent one message and never posted anything... It turned out that someone who couldn't be emailed or telephoned because he "was only on Facebook" also didn't respond on Facebook. Shocking!

</comment></comment><comment><USER32> Give me one good reason on why we need Facebook.

<comment><USER33> Gossip, life, entertainment, procrastination. Nothing wrong with that at all.

</comment></comment><comment><USER34> I stopped reading after so many I's in just the beginning. It's an all about "me" piece.

<comment><USER35> I agree the article is incredibly long (him establishing his credentials is almost an article onto itself), but I assure you that the article is not just about him. :-)

One of the other commenters gave a succinct bulleted overview. I recommend you check it out, if you're interested in what the article was actually about.

[https://news.ycombinator.com/item?id=16092602](https://news.ycombinator.com/item?id=16092602)

</comment></comment><comment><USER36> People still use facebook?

</comment><comment><USER37> Facebook never fixed me so I didn't have to fix it. No account. Ever.

<comment><USER37> Who's nerve did I hit that it got voted down?

<comment><USER38> The nerve that you're responding to the title, not the article.

</comment></comment></comment><comment><USER39> Nuke it from orbit.

<comment><USER40> Would you please stop posting unsubstantive comments here?

</comment></comment><comment><USER41> The author justifies his desire to regulate facebook with election outcomes he finds personally unpalatable. (u mad, bro?)

Yes, visceral content has high engagement. But is this really new information?

How can you recommend content regulation without exacerbating the problem?

</comment><comment><USER42> Its been 1.5yrs since, I had uninstalled FB app from my phone due to battery usage and havent used it since. Most of my friends are on WhatsApp and we have groups for each occasion like roadtrips/ bdays etc. I follow few on my friends on Instagram, which I occasionally see before making my next travel plans. Its feels more appropriate to share in the right context, unlike FB which feels like a public restroom.

<comment><USER43> > WhatsApp

> Instagram

You're still using and supporting Facebook services, then.

<comment><USER42> Those 2 services are a lot better than Facebook newsfeed, which is basically a pile of garbage!

</comment></comment></comment><comment><USER44> Don't use Facebook or any of their properties like Instagram, Whatsapp, etc. Just as important, tell others not to use Facebook (et al). Tell your children not to use Instagram and Whatsapp (they won't care about Facebook as that is 'for older people'). When someone proposes using Facebook to plan something point out that Facebook is not the right venue for such activities, use email instead. If your neighbourhood wants to start a 'Whatsapp group' tell them to use an alternative (Telegram comes to mind). If your local council wants to communicate through Facebook just tell them to quit doing so as they have no business pushing their constituents towards any commercial entity, let alone towards Facebook. Just steer anyone and everyone away from Facebook (and similar companies for that matter but Facebook is the one to kick to the curb first). Don't be a zealot and bring up this subject when there is no call for it but don't be shy to voice your opinion when it is warranted. Make sure to be able to answer questions as to why Facebook should be shunned.

Yes, you do run the risk of being seen as a Don Quichote who probably even uses Linux but so be it.

<comment><USER38> Don't this, don't that - geez. Tell what TO do, what TO use. Saying not to without solutions is completely useless noise.

<comment><USER44> Smokey told you not to play with matches. Way back in time one of your ancestors told another of your ancestors not to play in the crocodile-infested Limpopo river. Frank Zappa sings about some parents warning their children to watch where the huskies go and not to eat that yellow snow.

Sometimes it is necessary to warn people about something. They can make up their own mind about what to do instead, it is not as if the internet is useless without Facebook (et al) after all? Do you really think it is necessary to tell people what to use instead of Facebook when the options are so abundant and clear, not to mention the fact that they were around when Facebook was naught but a glint in the eye of whomever M.Z. got the idea from?</comment></comment></comment>


Why is Google Paying $400MM for AdMeld? High Frequency Trading - <AUTHOR> http://www.betabeat.com/2011/06/21/why-does-google-want-admeld-so-bad-high-frequency-trading/

<comment><USER2> Earth to techwriter... Google already has a full realtime exchange stack. They're buying publisher relationships.

<comment><USER3> Yes and no.

It's true that algorithmic traders from Wall Street will be let down when they come to RTB trading and see how simple and undeveloped the ad ecosystem is compared to financial services. Arbitrage is still important but not the driving force for advertisers' success. Reach is more important: being able to show ads to more of the users in your targeting segments.

Google made the Admeld move for _reach_. It's partially a "publisher relationships" play, certainly not the technology, but mostly just the easiest way to get a giant new chunk of RTB volume.

I thought this blog post summed it up well: "It's the QPS, Stupid" [http://jaysears.com/2011/06/10/google-admeld-the-need-for- di...](http://jaysears.com/2011/06/10/google-admeld-the-need-for-diabolical- liquidity/)

<comment><AUTHOR> Agree - Google is more interested in expanding its power in the RBT market than "purchasing publisher relationships".

The latter would be a dubious strategy given Google's place in the ad business.

</comment></comment></comment><comment><USER4> I'm not sure this article is a particularly well-informed summary of the state of things.

For one thing, the acronym is RTB (Real-Time Bidding), not RBT, and the analogy to HFT is rather thin. For another, Google's existing Ad Exchange already has extremely substantial impression volume. Google isn't so much "jumping into a market" as the article claims but rather bolstering and broadening their existing position.

The market is decidedly emerging but it's further ahead of what this article portrays.

</comment><comment><USER5> Practically, what does HFT actually mean to ad business? Am I correct that it's about being able to bid for ad placements according to _real-time_ CTR/CPA analytics?

That would be neat, I can imagine writing automated robots distributing your ads in sub-optimal ways, moving with your target audience from website to website during the day.

</comment><comment><USER6> Clear that people don't understand what high frequency trading is.

</comment><comment><USER7> Ramirez! Flash crash that ad.</comment>


From Python to Go to Rust: an opinionated journey (2018) - <AUTHOR> https://tech.allo-media.net/point/of/view/2018/03/22/from-python-to-go-to-rust.html <comment><USER2> As a Python dev getting into more Rust development, I'm surprised whenever I hear of this as a progression towards better tools, rather than a way of adding new tools into my belt.

Django/Flask are great tools for spinning up a CRUD application with authentication/authorization, API endpoints, and a template language if I don't want to build out a React or Vue SPA.

Rust is a great language that's opened me to new domains of programming, and also gives me the ability to write more performant, hardened API endpoints at the expense of productivity in hours (this gap will definitely shrink as I get better and as rust frameworks mature, but I'd be surprised if it went away entirely)

If a developer views a suite of tools they know very well as "something they used to use", they're more likely to make future architectural decisions based on incorrectly viewing framework-powered python as a relic of the past, rather than a viable (and often preferred, if hours of work are factored in) alternative.

<comment><USER3> I get the fascination people have with Rust and I love to use Rust myself. Part of the fascination certainly _is_ it's tooling and that Rust nearly seems to force you to make the right decisions. I've never wrote in a language were I were so focused on the structure of my program rather than hammering in what I felt. And when you hit compile and it works, it usually does so flawlessly.

However I use Python very often still, just not for every task. Just like you said: Rust is another tool in the tool box and it isn't that single purpose machine that you buy and use once for a single project, it is that japanese handsaw that is incredible useful and powerful in the hands of the right person. But sometimes you just need to make many cuts fast and then the handsaw (no pun intended) doesn't cut it.

Python certainly has it's place for me, but so does have Rust..

</comment></comment><comment><USER4> > _I compiled the code and … no error message. Everything went fine. But?! I > just added a field to a struct, the compiler should say that my code is not > good anymore because I'm not initializing the value where it should be!_

This is your big hangup with Go? You added a new field, didn't use that field anywhere, and the compiler didn't complain? I've heard a lot of valid criticisms of the language but this is a new one for me.

<comment><USER5> I wouldn't have left Go just because of these but before you write this off as minor thing, I would suggest you look this as one of the core language design decision. It reveals two important language philosophies:

1\. Go doesn't follow "you pay for what you use" model.

2\. Go isn't too deeply invested in compilation as means for catching errors.

Above are not binary language decisions. If you go in one direction strongly then there are consequences in other. Therefore all languages chose some balance point (aka compromises). Go has chosen a balance point that is weaker than Rust (and may be even C++) but stronger than Python.

<comment><USER6> > 2\. Go isn't too deeply invested in compilation as means for catching > errors.

Except when you've imported a package you're not currently using, that is a mortal sin :)

</comment></comment></comment><comment><USER7> I've yet to try Rust. But Go is the best and worst thing to happen in my career. Best because it's amazing, worst because now I don't like working in other languages.

I'm trying elixir currently, and it makes me want to rip my hair out. No for loops, no typed parameters, implied returns. Who in the world though any of this was a good idea? IO.puts() refuses to print certain objects (list of ints) and just prints a newline, making it useless for debugging.

I'm very very excited to try Rust, and I'm glad I've been able to choose the languages I work with up to this point in my career.

<comment><USER8> Just wanted to correct some things, as a fan of both Elixir and Rust.

> No for loops

But we do have for loops? That's what comprehensions are: [https://elixir- lang.org/getting-started/comprehensions.html](https://elixir-lang.org/getting- started/comprehensions.html)

> no typed parameters

But if you need types on your parameters, you have Guards, which... check for type? Sure, you don't type every last parameter, but if you want that you can upgrade to Dializer and get that feature too. It's just not as useful as you likely treat it.

> implied returns

I understand that some may not like this, but it comes out of the idea that generally, you want to avoid "side effects"\- ie, things in code that happen without anyone but the original function causing them being able to tell. Elixir doesn't completely lack them, as that would be pretty unreasonable, but it does at least ask that you're clear about the purpose of functions by having them always return _something_.

> IO.puts() refuses to print certain objects (list of ints) and just prints a > newline, making it useless for debugging.

This seems like something must be going wrong. `IO.puts` certainly prints lists of ints, however, it might also be mistaking them for a charlist, which is definitely a concern. That's why generally, you want to use `puts` for text, and `IO.inspect` for data structures. As an added convenience, if you want to annotate your data structure with text, you can modify `IO.puts` like so: `IO.puts "List: #{inspect(list_of_numbers)}"`. That will parse the list to the inspect version and insert it into your `puts` line.

For the record, I'm not saying any of these necessarily shouldn't be a reason to not like Elixir- we all have our preferences, but the reason behind many of these choices is philosophical, and I'd be happy to explain anything else that has puzzled you, if you're still interested in learning more about Elixir.

</comment></comment><comment><USER9> I went from python to go to nim. Actually I still like go - but nim is an easy transition from python.

I think nim is the best thing out there for building tiny CLI utilities. It's a fun language to code in.

<comment><USER10> Nim is very nicel Not that it matters much in most cases, but the compiled binary sizes are also quite low compared to Rust.

<comment><USER11> Do you ever regret choosing "coffeescripter" as your handle? I loved CS and contributed to the CoffeeScript Redux compiler but the language is definitely pretty hated these days...

</comment></comment></comment><comment><USER12> That's a bizarre reason to stop using Go. I can't really think of many realistic instances where that would bite you.

</comment><comment><USER13> I was working on a simple Rust CLI program to parse JSON from the Github API, but I got turned off by some of the unfriendliness of the available http libs. One http library pulled in dozens of other crates and turned my 10 line program into a 50MB binary [0], while another had an unpleasant api [1].

[0] [https://docs.rs/reqwest/0.9.18/reqwest/](https://docs.rs/reqwest/0.9.18/reqwest/)

[1] [https://docs.rs/hyper/0.12.29/hyper/client/index.html](https://docs.rs/hyper/0.12.29/hyper/client/index.html)

Maybe I have too much desire for instant gratification, but it sucked the fun out of the project.

<comment><USER14> "Crates" are just compilation units. Do you feel "turned off" if a C/C++ library includes "dozens" of source code files, some of which might come from outside projects? (A sibling comment mentioned --release already, which is obviously something that one should be familiar with when discussing Rust's performance.)

</comment></comment><comment><USER15> The "zero value of a type should be useful" concept is pretty fundamental to Go's design. You can imagine compiler tooling that didn't alter the language allowing you to catch unintended uninitialized values, but a language that changed the underlying default would no longer be Go.

</comment><comment><USER16> rust is great if you have enough experience to pick it up without dying trying. and you need to start reading the book. the enforced safety helps even experienced devs with a formal background to reinforce and see some concepts more clearly.

all that said, when you have to do advanced things and go unsafe, it can feel really annoying (fighting the compiler) and limiting. most common problems can be modeled in rust without issue, but if you have a clear idea of something that you want to do that's more advanced... the language will actively work against you, that's its goal. that has both a good and a bad side. maybe it will get better in the future. still an awesome language today.

</comment><comment><USER17> I went through the same path as OP. But instead of discarding them I am still using all three of them. And at least for me Python and Rust don't even compete with each other.

</comment><comment><USER18> Biggest issue for me is the compile time. Especially in comparison to Go it's a huge difference. At work we have a huge codebase with over 1M LOC. I guess for bigger projects you need proper interfaces so you can split up your code into multiple libraries.

</comment><comment><USER19> I would suggest F# to the op. Even though I have limited practical experience with it, from what I've read and see it checks op's checkboxes.

</comment><comment><USER20> _> This was the show stopper for me. I realized that I couldn't rely on the compiler to get my back when I was doing mistakes._

No! One shouldn't mindlessly rely on the compiler "to get your back." Instead, one should code (or alter code) so that you've manipulated the situation, such that the compiler will flag any errors. With a language like golang, this means that you should make sure that the "zero values" are always copacetic. (Analogous to crash-only software.)

</comment><comment><USER21> python</comment>


Vendors who charge extra for single sign-on - <AUTHOR> https://sso.tax/ <comment><USER2> > In short: SSO is a core security requirement for any company with more than > five employees.

Which kinda gives the game away, right? It's not that SSO is a luxury feature but that it's an IMMEDIATE signal that you're dealing with an org that can afford to pay.

It's absolutely a security feature but that doesn't mean it should be free for any reason other than I don't want to pay for it. So I wish them the best in bullying the companies into giving me free things. We just dropped $100k on a security product last week so I'm in the market for freeing up room in the budget.

<comment><USER3> That's self-reinforcing. SSO is an immediate signal that your org can afford to pay because SSO is so expensive, and SSO is expensive in part because the entire ecosystem is expensive enough to make IDP per-seat licenses a smaller fraction of the overall bite.

SSO isn't optional; startups of basically all sizes should be using it, almost from the jump. It's not a thing you're supposed to invest in when you finally hit, like, 100 employees or something; it's as important for a 5-person team as a 20-person team.

I get the concept of price discrimination and have no on-spec moral qualm with it. But charging extra for SSO is no different than charging extra for MFA; in fact, MFA as a feature is _harder_ to deliver than SAML.

<comment><USER4> >startups of basically all sizes should be using it

We've routinely deployed our softare to customers who pay us 7 figures. We have literally had to enable SSO only twice in the last 5 years.

There's a difference between _should_ and _actually does_.

<comment><USER3> I agree. But part of that is because the whole ecosystem of SAAS services charges 2-3x just to enable it.

<comment><USER4> Perhaps. From our experience SSO is synonymous with "ADFS".

So maybe we're biased there. It never occurred to me that SSO would be used by smaller orgs so we never bothered putting that into our base pricing.

</comment></comment></comment></comment></comment><comment><USER5> I think SSO is a pretty effective feature upon which to do feature and price discrimination. It's a value-based pricing choice, not a cost-plus pricing choice. Engineers are frequently uncomfortable with such pricing decisions.

<comment><USER6> Yeah an organization with SSO almost certainly has deeper pockets than one without. Maybe not if it's just _slapd_ , but SAML = money feels fair.

<comment><USER7> From a difficulty/cost perspective, implementing OIDC as a service provider literally takes half an hour. (I did it this week.) It's neither complicated nor complex and it doesn't rate the eye-popping premiums that are being charged for it.

From a value perspective? If you want the current woeful state of security to continue, sure, maybe you can argue that it's a good idea to charge more for tools to better secure a business's operations. But that sucks. We should be encouraging small businesses to properly secure their ops, because it very well may be _our_ data that they're dealing with. And we shouldn't be encouraging service providers to make that harder.

<comment><USER8> You just made the case for higher pricing. If it's that valuable then it's worth the price to secure it. It's not that sso costs money to implement it's that the price is tied to value of the data and the organization security needs.

Edit: I do agree with you that a lot of enterprise pricing can feel like the vendor simply figured out a % of your ebitda and decided it sounded good to them. But in the examples in the article, most enterprise pricing was fairly well documented / published. If you want to really get into some of the bad actors don't look at the list from the article, look at the enterprise platforms that are easily into the hundreds of thousands per month... I won't name names but if your an enterprise IT manager you know who they are.

<comment><USER7> No, I made the case that it's a public good to hold that the trivial effort necessary to provide better security can't in good conscience be an upsell. Making it harder to assume a good security posture is bad citizenship and should--frankly, must--be opposed. People are harmed when companies think "security" is an optional feature, and that's not acceptable from either a vendor or an end implementor.

<comment><USER8> To be honest, I find it very difficult to argue against the point you're making. I think it is somewhat logical to have SSO be the demarcation between individuals and enterprise, but if I rewind a decade or so, I imagine the line then was HTTPS (which today is totally ridiculous -- everything is/should be HTTPS). If I could go one step further, I think it's completely wrong for SaaS to blunt force security policies on user's accounts (i.e. ACME would like the ability to read/write to your Google profile). I think enterprises should be able to enforce their policies on the SaaS provider rather than the other way around. And to build for that...I think is going to be a little more complex than a typical user/pass. Maybe everything should be a little more expensive?

<comment><USER7> There's a whole tier between "individual" and "enterprise", though, and it's called "small business" and they probably have a lot more of your (and my) stuff than we'd be comfortable having YOLOed around. ;)

Enterprises forcing their policies is pretty easy if they're an SP to your directory, FWIW. I've had great success with Okta for this, but I've written SPs that talk to arbitrary OIDC providers and it works pretty well too.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> No, it's just simple and good price discrimination.

Don't think of SSO as a "tax" you have to pay on top of what is otherwise a cheap and fair base price.

Rather, think of the enterprise price (which includes SSO) as the fair base price that allows the vendor to stay in business and pay their costs.

While everything else (non-enterprise) is severely discounted, in the hopes that if you do become enterprise you'll pay full price then.

And you need _something_ to prevent enterprises who can obviously afford to pay, from buying 1000's of seats at discounted rates. So you discriminate based on something they absolutely need: SSO.

It works really well.

<comment> w-j-w But this just means that small companies are more permanently priced out of SSO. Small companies should be using it to be more secure, but that list gives you a pretty good idea why they can't.

<comment><USER10> I'm interested by why you think this. In the scheme of costs of having employees, the software costs are very low.

</comment></comment></comment><comment><USER11> I just finished adding SSO to the (very small) SaaS company that I work for, and this page gives me mixed feelings.

Yeah, SSO is a security feature and you expect to get security for free. But SSO is not free for us as the service provider. We pay a vendor (Auth0) a decent amount of money to handle all the hard stuff. We also have to manually set up SSO for each of our customers who want it, which can take anywhere between 10 minutes to several hours depending on whether the customer has set up SSO before. For these reasons, we charge an annual fee for SSO on top of the regular subscription fee. We're just not big enough to absorb the cost.

<comment><USER12> I agree. We are B2B company and while we include the price of SSO with the contract, we also only work with "whales".

It takes us about two or three hours of coordinating with our client to configure SSO and that's if they only use it for authentication. If they use it for authorization also where we base their permissions on claims they send us - as oppose to an admin in their side configuring their users - it's a lot more coordination.

We host our own Ping Federate instances.

</comment></comment><comment><USER13> How many times do we hear complaints from the community about open source shipping with insecure defaults, yet we expect security to be a premium feature we must pay for from SaaS?

</comment><comment><USER14> I work at a place that has banned the use of SSO because it allows an attacker to compromise one set of credentials and have access to everything. Good times

<comment><USER15> That's what 2FA is for!

And even with SSO, your credentials don't have access to everything, because no one employee should have access to everything. People should only have access to the IM channels, git repos, etc that they are actually involved with. Admin accounts and especially critical systems should be set up to require separate/additional authentication.

</comment></comment><comment><USER16> Why isn't Auth0 on that list? For most enterprise customers SAML is required for SSO. However SAML is locked behind their enterprise plan (and enterprise is stupidly expensive).

On top of that now enterprise plans now require you to pay by connection as well. So if you want to allow multiple customers SSO connections the cost starts increasing drastically.

<comment><USER11> Auth0's pricing really disappointed us, but we don't have the resource to switch to another vendor at the moment. We're a SaaS who need a few dozen enterprise SAML connections, but each connection only has 5-10 logins per month. Their sales team flat-out told us that our only option is the $25k/year enterprise plan plus more for each connection. It's totally bonkers.

<comment><USER17> SAML is not that difficult to support in Rails with few Ruby gems; took us a couple of weeks to implement, most of that sorting out various integration snags with customers.

(SaaS with 5 to 500 logins per customer)

</comment></comment></comment><comment><USER18> Please add Clubhouse and Notion to that list.

[https://clubhouse.io](https://clubhouse.io)

[https://notion.so](https://notion.so)

<comment><USER19> They accept pull requests: [https://github.com/robchahin/sso-wall-of- shame](https://github.com/robchahin/sso-wall-of-shame)

</comment></comment><comment><USER20> The list is innately disingenuous. For most of these products, SSO isn't the sole differentiator between pricing tiers, there are also significant functionality differences.

<comment><USER3> Who cares what the other differentiators are? If you have to pay for all of them to get SAML, then that difference is what SAML costs.

</comment></comment><comment><USER21> So companies should have a moral responsibility to give away security features for free ? There is certainly a cost incurred while implementing such fesutres.

</comment><comment><USER22> So security should be free? That kind of implies something about its worth that I might not think is the author's intention.

<comment><USER13> > So security should be free? That kind of implies something about its worth > that I might not think is the author's intention.

By this sentiment, does Let's Encrypt debase the value of security as well?

<comment><USER22> Good point.

</comment></comment></comment><comment><USER23> Heh, the GitLab on-prem pricing note of "$4 per u/m²" looks like "4 dollars per user per square meter".

</comment><comment><USER24> What does the unit "u/m" mean?

<comment><USER25> Per user per month.

So Slack's "$6.67 per u/m" means each month you pay $6.67 for each user who has signed up. Your company has 20 users? You pay $133.40 each month.

</comment></comment><comment><USER26> I understand the list of companies provided here are fairly large businesses, but the text in the post seems to send a different message.

Maybe I am misinterpreting this, but I have had this conversation quite a few times in the past month alone with other engineers and execs, and I have to take an entirely different stance.

If you are trying to bootstrap a SaaS start-up (or even if you arent and just want to be frugal and/or keep technical complexity low) I do not think that outsourcing your authentication to a third-party provider, especially at cost, is necessarily the best choice.

A) In the developer community chats I am in, the auth provider that pops up the most in conversation is Auth0. Personally, I do not see how they stay in business because their pricing is (in my opinion) egregious. $228/mo for 10,000 monthly active users. However, they do have a free plan up to 7,000 monthly active users. The sheer volume of people who continually bring Auth0 up means that they either build products which never gain significant traction & have never had to scale, or have money to blow. So there is the cost-factor argument.

B) While you can make the argument that the vast majority of people have accounts with SSO providers, I would play Devils Advocate and say that there also exist people who are uncomfortable either providing that identity regardless of the anonymity/security meaures in place, or because they do not want to associate an identity from a primary authentication provider with your site/service. So there is your please-the-people argument.

C) From a technical perspective it CAN be easier not to opt for SSO integration. What I mean by this is, for the past half-decade, the majority of the products I have built have used bcrypt-ed passwords. And that works just fine. For getting things off the ground you can go far with a solid password hash-and-compare implementation.

Something roughly like the following is free, super easy to implement, and covers a large percentage of usecases:

\- Store password with an algorithm like bcrypt or Argon2 on sign-up, compare on login

\- Opt-in 2FA by using OTP via SMS or email

\- Issue a SecureRandom session token each time a user logs, and use it as the identifying mechanism in a JWT or similar

\- Make your auth logic verify the JWT and look the user up by the session token

\- You can emulate the blacklisting/all-token revoke functionality major auth providers have by clearing one/all session tokens in the DB

I am sure someone who knows much, much more than me about security show up in the comments below this and tell me I am idiot, but this is my two-cents at least ¯\\_(ツ)_/¯

(Side note edit: I think that there is a burgeoning problem in the developer community where new engineers reach for the easiest thing and wind up with a stack full of nothing but X-as-a-service, which in this case includes authentication. I am not sure how many junior devs could implement basic password-hash JWT authentication from scratch. The fact so many of them are readily paying $2,500/yr per 10,000 users for JUST authentication is mildly terrifying)

<comment><USER27> The other side of this is as an org, with say 5 - 100 employees, who are all on Okta for example - and want to be able to login to those systems listed using their single Okta creds - this isn't being an about implementing an auth system to authenticate a bunch of users, but being able to give your employees easy, auditable access to the 10 - 30 SaaS product they use daily, via SAML or OIDC

<comment><USER26> Ohhh. I'm a bit slow; yeah for sure that makes a ton of sense then.

</comment></comment></comment><comment><USER28> "A website written by someone who doesn't understand enterprise pricing"</comment>