Disney+ streaming uses draconian DRM - <AUTHOR> https://hansdegoede.livejournal.com/22338.html <comment><USER2> > desktop Linux and many Android devices only support level 1. In this case > e.g. Netflix will not offer full HD or 4k resolutions

And yet 4K webrips of recent Netflix shows are readily available on torrent sites.

I don't understand who these higher levels of DRM are trying to target. They obviously don't stop the serious pirates from ripping and sharing the content with everyone. Yet the lower levels are "good enough" to stop average users from trivially downloading and keeping the file, like you might do with an plain, embedded MP4 file.

<comment><USER3> DRM punishes paying customers and does nothing to stop piracy. It reminds me of those "you wouldn't kill" segments at the start of DVD's that you couldn't skip, but just moaned at you to not pirate the DVD. But the only people they were telling this to was paying customers who bought the DVD. People who pirated the DVD, just plugged it into their computer, ripped out the content then published.

<comment><USER4> Sure, but why? Do the rightsholders believe that these mechanisms are effective at making them money somehow? How correct are they - are these mechanisms effective at stopping _some_ amount of casual piracy and converting that into purchases?

<comment><USER5> It's pretty simple: They pay a hot shot company to try and stop piracy and thats the best they can come up with.

Piracy can't be stopped but thats not what they want to hear.

Piracy can be greatly reduced by distributing the content via Netflix but thats not what they want to hear.

<comment><USER6> > _And yet 4K webrips of recent Netflix shows are readily available on torrent > sites._

and:

> _Piracy can be greatly reduced by distributing the content via Netflix_

Aren't you guys saying different things? One is saying people already pirate on netflix, and the other is saying netflix removes the need for piracy.

If you're saying the same thing, I would interpret it to mean that piracy is greatly _reduced_ on netflix, but not entirely eliminated. But if that be the case, would that not be evidence of netflix' anti-piracy measures working?

<comment><USER7> DRM doesn't inconvenience pirates, but piracy inconveniences consumers.

It's inconvenient to free up 50 GB of hard disk space to torrent of a 4k netflix rip you found off some shady torrent site. It's much more convenient to just give netflix a few bucks a month. That inconvenience comes from law enforcement action against pirate sites and many users having trouble managing their hard drive space. Not from DRM.

<comment><USER8> It may be inconvenient to free up some disk space (citation needed, anyone on HN has probably got terabytes of free space _somewhere_ ), but the inconvenience of certain streaming platforms, or even the total hostility to watching anything ad-free (even paid users) will knock people into the piracy camp. There is _no_ source where I can watch AAA movies that I buy on my laptop legally in 4K as it is illegal to break Blu-ray encryption (and I run Linux). I buy or rent movies I want to watch on my Apple TV in 4K, but what am I supposed to do if I want to watch something on a plane for instance?

Anything that is on Netflix I watch. I can't watch amazon prime on my Apple TV because their region system is broken (yes, if an amazon employee is reading this, please fix having prime in multiple countries) so battlestar galactica and other shows in their catalogue aren't available come from other sources.

<comment><USER7> I'm talking about the typical consumer, not a HN user. Most people aren't running linux, have legal streaming options available to them, don't have terabytes available to them at any particular moment (maybe they have a few terabytes of portable harddrive in a closet somewhere, but not mounted and ready to roll.)

Are there scenarios where typical consumers turn to piracy? Sure, aboslutely. They generally do that when a convenient legal way isn't an option (e.g. region locks screwing them over.)

<comment><USER9> > Most people aren't running linux, have legal streaming options available to > them... Are there scenarios where typical consumers turn to piracy? Sure, > aboslutely

my wife - a non-tech person, really - falls in to this camp. she's turned to torrenting things because the experience of streaming is just... slow. and bad. and stuttery. oh, and we still get ads on things (hulu, for one). She figured out how to find free streams for soccer matches - when we paid for "real" streams, they still had ads taking up 20% of the screen. And still somewhat jittery/stuttery (but - those 2 minute car ads at the start of the stream were _never_ jittery).

yeah, the 'free' stuff experience isn't always great, but when the paid experiences are still kinda crappy, what's the point of paying?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> >Widevine has 3 security levels and many devices, including desktop Linux and many Android devices only support level 1. In this case e.g. Netflix will not offer full HD or 4k resolutions, but otherwise everything works fine, which is a balance between DRM and usability.

This reminds me of my very short foray into streaming services. I purchased a month of Netflix, or rather I got their 1 month trial, and opened the website to watch something. First it didn't open on Firefox, and they told me to install Chrom(ium). I didn't like it, but went away and `apt install`ed Chromium. Then it blocked my account because I was using a VPN. I liked this even less (I gave it a credit card number, so they know I'm not a bot or something using a VPN to hide traffic), but I still disabled my VPN. Mind that these two steps already cost me 45 minutes of browsing through FAQs and forums to figure out.

Then I finally open something, after installing proprietary software, a new browser, and disabling my privacy-protecting VPN. I'm presented with a video playing in glorious 1280x720 resolution. I just laughed to myself, closed the tab, and opened thepiratebay.org.

So let me get this straight. I'm _paying_ for a service and I get _headaches, restrictions upon restrictions, and mandatory malware_ , all for the _privilege_ of watching gimped resolution content? Whereas if I went on piratebay I could get a 4K mkv file I can watch anywhere I want, no internet and no software required? You can fuck right off.

Strikes me as odd how anyone can describing paying for a shit service as "a balance between DRM and usability".

<comment><USER11> People outside the United States have to suffer through all that for access to _a subset_ of the full Netflix library. And Netflix is one of the better companies in that regard. Most of them simply tell me the content is "not available in my country". And when people ask them why, they have the gall to blame "piracy".

<comment><USER12> Ironicallly I think this is why the privacy 'war' can never be won by these corporations. I live in a small European country where even if you subscribe to Netflix, Amazon (which isn't officially available here), cable TV, and whatever else you can find, you still won't get a lot of new movies and shows that you may want to watch. The only way you can get them is by pirating them, so that's what people do.

The problem is piracy isnt geo-blocked, so if someone here pirates a movie and shares it, it's also available to someone in the US.

I'm not sure why they keep pushing these technical restrictions, when really the issue is they don't allow people to buy their content in the first place.

<comment><USER13> Yep, I couldn't agree more. I've tried subscribing to Amazon Prime purely for the shows/movies (not like we have next day shipping or something), and I couldn't find a single movie/show that's not geolocked. Not even their originals.

</comment></comment></comment></comment><comment><USER14> The hand-wringing in this thread is sort of amazing — especially since 99% of the people complaining weren't going to subscribe anyway.

Look, if there are indeed issues with actual ChromeOS (and not the Chromium variants — but the full mostly-proprietary Google procured ChromeOS), I fully expect that to be fixed — you might not get 4K support (but there are what, 3 Chromebooks with 4K screens? Plus, most streaming services do not support 4K on web browsers period - even Netflix only offers it on Windows. Mac users with 5K screens have to use Boot Camp (and even that isn't a guarantee) to watch 4K in the browser) — but if Chromebooks are an issue, I fully expect that to be fixed.

As odious as DRM is, I just can't bring myself to be surprised or overwrought by its existence. Yes, it is largely more about appearances than actually solving piracy — but those appearances matter. The big thing that has pulled people away from piracy is convenience. And with the exception of Linux on the desktop users (a population that is small and only getting smaller, as the main distros don't even care about the desktop or non-server users anymore), Disney+ seems to offer that. The people that pirate because of DRM would have pirated anyway. I pay and subscribe to more content than 99.99% of the population — but I also download whatever I can't get from an online service and I feel zero guilt and make zero justifications for my choices. And that'll remain true for Disney+ — even if there wasn't a DRM scheme at all (which just isn't ever going to happen).

DRM sucks, sure, but are we really surprised? And I'm sorry, but I'm not ready to boycott a streaming service with tons of content because it doesn't support Linux in the desktop.

<comment><USER15> I probably would pay for it if it had linux support. But since it doesn't, I won't. Every device in my household is either linux or Android, and I primarily stream from desktop linux. If disney+ doesn't work on that there is no rason for me to pay for it.

</comment></comment><comment><USER16> Interesting. I'd been toying with signing up for Disney+ at some point (when does it even go live officially?). But if this is the case, I absolutely won't be getting a subscription as I use Linux as my desktop OS.

"No Linux support" == "no customer"

<comment><USER17> While I agree with the philosophy that Disney should try to support as many platforms as possible, I really don't think it will notice the Linux market is missing.

Cost of building and maintaining a Linux client > Potential revenue from Linux users.

<comment><USER18> This impacts those using ChromeOS, if I read it right. Disney May want to support that.

Isn't ChromeOS Linux under the hood?

<comment><USER19> Yeah ChromeOS is Linux under the hood. Probably the most mainstream desktop class OS based on Linux. A family member's Windows laptop quit booting up, and wanted a new one. Talked them into a Chromebook since they mostly just use the web, and didn't want to spend a lot of money. Figured ChromeOS would be less bloated than the other traditional desktop OSes too, especially if not wanting to spend a lot on hardware as I feel a similarly priced Windows laptop would be slow probably due to the lower hardware.

Wouldn't surprise me if a lot of kids have Chromebooks too, which would be Disney's target. There's some decent models that are cheap and probably more secure than just giving them a Windows Laptop.

Also recently they added official support for Linux apps themselves, that's in beta called Crostini. They run inside of a container. But before then no Linux apps could be installed even though it's Linux under the hood, but I know there was some unofficial ways.

I was apart of the CR-48 beta where they sent out free laptops to test with. Surprised they did that in the first place, but it just sits in the closet now and very slow, no longer gets updates but used to use it alot more when it was new and feeling special since part of the beta program. So with Linux support, part of me wants to buy a newer one. Could run Node and VSCode on a Chromebook!

<comment><USER20> * Wouldn't surprise me if a lot of kids have Chromebooks too*

Given how many schools want kids to have portables and Chromebooks have become the cheap choice, this is going to be a problem.

</comment></comment></comment></comment></comment><comment><USER21> AmazonPrime video does not delivers HD content in Linux... I tried everything switching browsers, changing User agent, wine, running virtual box. I seems some type of DRM is not implemented yet in Linux. Netflix is the same I think.

I happily pirate content now.

<comment><USER22> You can get 1080p streams from Netflix on Linux (for 99% of their collection) by switching your user agent to ChromeOS. Their check is just:

        a = /CrOS/.test(a.userAgent);
        this.Fma = this.Aw = q.Gu.PV;
        this.Qm = [x.$l.nV];
        this.oo = [x.V.vA, x.V.wA];
        a && this.oo.push(x.V.TH);

It very much is _not_ "DRM not yet implemented".

Both Prime and Netflix are fully capable of streaming their highest quality under Linux - if you have the driver support.

Unfortunately they have a bunch of hacky stuff trying to prevent it, rather than allowing the user's browser is to make the decision.

<comment><USER23> That's one reason I use it. If they switch to nazi DRM I'll drop them. If Disney won't play on Linux meh whatever then on them. I'm sure they won't miss me, and I won't miss them much either.

</comment></comment></comment><comment><USER24> Anyone who's used Disney's existing streaming service will, I am certain, tell you it it truly awful. It's incredibly slow, saddles you with massive downloads regardless of device or connection type. The app sometimes just doesn't open at all.

I really hope whatever they're making is not based on what they are doing currently.

<comment><USER25> This whole thread has been rather surprising to me, we've been enjoying Disney+ for a few weeks now and I've been amazed how wonderful all the content is. I've never seen any errors or the issue described in this article (I'm on Mac).

The only thing about the UI that I miss is that it does not respond to keyboard shortcuts (like pressing spacebar to start and stop the playback).

But overall, I've been very happy and impressed with the service.

<comment><USER26> Are you from the future?

In all seriousness though, how are you able to enjoy Disney+ currently? It has yet to launch. According to the Disney+ website it launches in just under 23 days from now.[0]

0\. [https://disneyplus.com](https://disneyplus.com)

<comment><USER27> It was released early in some regions like the Netherlands for testing and promotional purposes.

<comment><USER26> Thanks, I of course didn't read the article before asking my question. Glad to hear it works well so far. Looking forward to it when it goes live. Cheers!

</comment></comment></comment></comment></comment><comment><USER28> Having had Disney as a client in a past life, I always assume they will go for the most draconian, despotic IP control imaginable...as a starting point.

They are cultural not wired any other way, and cannot be mollified. They are a horrible company.

</comment><comment><USER29> >In this case e.g. Netflix will not offer full HD or 4k resolutions, but otherwise everything works fine,

I don't understand the point of this type of thinking. Video DRM isn't like Denuvo where it can actually get you a few days or even weeks before any pirated versions exist on the web. If it can be watched by a human pirates will copy it, even if they have to rip it straight from the display controller of their monitors. I have never once had the slightest difficulty or delay in finding pirated versions of video content on Day 1 or even before, and at the highest-produced quality and resolution. Why do providers think making life hard only on paying customers is a good thing?

<comment><USER30> They do this because Hollywood doesn't understand technology. Netflix understands technology and understands this stops no one, but they are licensing the content from Hollywood, who thinks this behavior actually helps.

Netflix is forced to play ball with them.

Your next question is usually, "Why doesn't the Netflix original content not have these shenanigans then?".

The answer is that most Netflix content is still made by Hollywood studios, so they have the same restrictions. Netflix is only a distributor in most cases, not the content creator.

The other answer is that it is a lot more complicated in the software and for testing to say "can this content be played at 4K based on the publisher?" than to just say, "DRM level 1 means no 4K".

<comment><USER31> Was waiting for this reply, happy to see it come from the mighty jedberg. For those that don't know, click on his bio, he's definitely 100% spot on here

</comment></comment></comment><comment><USER32> So, at least from my basic research, the levels seem to be switched in this post: L1 is the highest level, not L3. So if Android and Desktop Linuxes support L1, that should not be an issue. Perhaps its is a minor error and he meant L3.

That being said, is it possible for the user to have their Desktop Linux support L1 somehow? Android is a Linux that clearly support L1 and can show these formats (I imagine), so can that be accomplished on another Linux?

<comment><USER33> Android depends on the hardware, but generally speaking Western devices support Widevine Level 1 and its implemented in hardware. Desktop Linux will only ever support Level 3.

But Chrome on Windows also supports Level 3, and Disney+ works in Chrome, there, so the article isn't correct.

<comment><USER21> Why do say that Linux will only ever support Level 3? Is there some fundamental limitation?

<comment><USER33> There's the fundamental limitation that the odds of any maintainer rewriting the entire graphics pipleine to secure the video path from the user for DRM on Linux is roughly zero.

<comment><USER34> A corporate sponsor might rewrite it... Chrome OS did it after all...

Probably wouldn't get merged into mainline Linux tho due to all the DRM opposition

</comment></comment></comment></comment></comment><comment><USER35> As always, the pirate bay offers a DRM free alternative. Maybe one day the media companies will learn that the one thing consumers cannot stand is being inconvenienced, even slightly.

As long as their solution provides less value than pirating, or is a bigger pain in the ass than pirating, they will lose.

Unfortunately for them, pirating has become so easy, that unless they become like iTunes, they are dead. Just a matter of time.

<comment><USER36> I think you greatly overestimate how many people pirate content.

</comment></comment><comment><USER37> Everyone here freaking out about DRM and how they think they're entitled to free pirate it if Disney don't offer the format they want. While I'm just looking at all my TV's that support casting from my phone by default. Who even watches movies on their computer anyway. Your TV will support it natively if not right away just buy a Chromecast or Roku and be done with it. There are worse things to freak out about.

<comment><USER38> > Who even watches movies on their computer anyway.

I do for example. I don't own a TV, my beamer is directly connected to my PC. Just because your use case is covered doesn't mean everyones is.

> Your TV will support it natively if not right away just buy a Chromecast or > Roku and be done with it.

"If it doesn't work for you, just buy new hardware." \- I'd call that entitled. I prefer to just don't subscribe to a service forcing me to buy additional hardware due to customer unfriendly DRM.

</comment></comment><comment><USER39> I like to think that if Disney+ doesn't work on Chromebooks, the "freshmen hivemind" (aka all of the freshmen) will solve it by complaining to Disney relentlessly. Seriously, not sure if Disney has thought through the market penetration Chromebooks have in the K-12 market AND the correlation between those students/districts and discretionary income for "yet another streaming service."

</comment><comment><USER40> Nit, since this confused me when I was looking for more context: for whatever reason, Widevine security levels are ordered in decreasing security (whereas the article has them backwards).

Widevine on Linux only supports L3, which means that there's no guarantee that any processing is done inside the CPU's trusted execution environment. Which, uh, reads as "no security guarantee" to me.

<comment><USER41> I'm not really ok with other people's code running on my Secure Enclave.

BitTorrented video has no security guarantee either.

<comment><USER40> The security guarantee here isn't for the user, though. It's more of a placebo effect for the content producers.

<comment><USER42> That's the funny thing about this whole thing they keep using terms like security when what they're really talking about is anti- saving/copying/skipping/fastforwarding and region blocking.

</comment></comment></comment></comment><comment><USER43> Content publishers sometimes demand certain DRM features in order to license their content. For example, they can dictate that only X devices can watch content Y. They can also demand restriction to how content is stored on devices etc. So until the content publishers change their restrictions, DRM will be there and will be annoying to customers :(

<comment><USER44> Disney owns all the content they're streaming.

</comment></comment><comment><USER45> Could this be fixed by disassembling the widevine .so/.dll and altering the function that returns the "security level" so that it always returns the highest level?

<comment><USER46> As I understand it, the DRM authenticates the physical monitor/TV with a key on the hardware. That part is uncrackable because authentication is done on Netflix-side.

But as for whatever is rejecting Linux but allowing Windows/macOS, that has to be completely in-software. I think you are right--this could be bypassed by changing a register value somewhere. This sounds like a fun project.

<comment><USER45> >But as for whatever is rejecting Linux but allowing Windows/macOS, that has to be completely in-software.

Yeah that's more of what i was referring to.

</comment></comment></comment><comment><USER47> Disney's existing streaming service, Disney Life, is using Silverlight, so anything's better than that.

<comment><USER24> This explains a lot. But even the apps which can't be, are truly awful.

</comment></comment><comment><USER48> "First of all, as always my opinions are my own, not those of my employer."

Why do you need to write that? It's a benign article and more so it's about as protective as the useless "Store is not responsible for carts that damage your car" signs.

<comment><USER49> Companies react in strange ways. I recall a forum post a few years back about an issue with a backup solution. The poster ran into a problem and shared it in response to a question.

Someone from the storage company went apeshit, figured out who the poster was, and met with the CIO of the guys employee to get him to remove the post.

<comment><USER50> I really hope he's swimming in lawsuit money.

</comment></comment></comment><comment><USER51> I'm pretty sure Disney is optimizing for the majority of their audience who use Windows, OSX, iOS etc, not developers/hackers who run desktop Linux. I'm curious about Android though.

<comment><USER52> Optimizing how?

<comment><USER53> Disney is focusing on traditional popular consumer markets.

Linux doesn't have a large enough number of users for their consumer-focused video streaming service at this time.

They'll probably move down-market after nailing the experience on the first few platforms.

side note - I love the number of comments about piracy as the other option, as if Disney is reading this page - or cares much about a small market (linux consumer-users)

</comment></comment></comment><comment><USER54> I'm a simple man, you treat me like a thief, I behave like one, I'm not paying for single DRMed video, I pirate it. I do pay for music though. On bandcamp.

</comment><comment><USER55> > Disney+ OTOH seems to have the drm features kranked up to maximum draconian > settings

Is this likely for legal reasons then? Maybe Disney doesn't want OS's outside of the main consumer audience to have the ability to stream. Linux could be feared for capturing streaming data and scraping sites. It's a lot more customizable of an OS.

Sort of like when Sony dropped Yellow Dog Linux on PS3.

What other non Linux devices are having this problem?

</comment><comment><USER56> MLB Advanced Media was created to stream baseball games for MLB.tv. They did such a great job that other sports networks, ESPN, and even HBO have licensed their technology to successfully roll out streaming and handle the GoT bandwidth crush.

I'm looking forward to Disney+, and it's a shame that in 2019 a company as large as Disney with a back catalog and list of properties as massive as Disney can't simply step off the starting blocks with technology that lets them focus on the stories. The only stories I've read lately about the service is about the technology...

</comment><comment><USER57> I see a future where media consumption via general purpose computing platforms is dead and only special super locked down devices can only play certain media. Seems like Disney+ will start us down that road

</comment><comment><USER58> I don't get the article, seems a bit of premature noise. They said they are aware of it and working on it. Just because it has not been fixed in 1 month during trial period does not mean they will not fix this.

Side note I had a recruiter call from disney + team to work on their app for windows. They are building this thing in wpf. I passed.

</comment><comment><USER59> Well unfortunately for Disney, my main TV box is an Ubuntu NUC so I will definitely not be subscribing to it. Just like when the NHL did the same - when there were better piracy options than your paid for service (which I might add I had no problem paying for for years) - you want to ask questions.

</comment><comment><USER60> From their response it sounds like they are on it, it's still 3 weeks until the official launch in the bigger markets and it's only live in NL as a test market right now.

To me it sounds like a normal bug for an edge case. It's made out to be much more than it actually is with this clickbait title.

</comment><comment><USER61> I do care about Linux, but I'm not using it to watch Disney+. I stream from my Android phone to Chromecast, which works great the first time. After a while the phone seems to lose track of the fact that it's casting and I can't stop it or start a different movie.

</comment><comment><USER62> Is Disney+ expected to work _fully_ before launch date? Isn't in 'testing' right now as described by the author? Why is everything expected to be perfect while still in testing?

From this text, it sounds like Disney is actively working on the issue. The product has not launched yet.

I'm not sure what the problem is. Aside from a faster initial customer support response (for a product that isn't even out!) _would could Disney have done differently here?_

I understand that Disney+ may not launch with (or ever have) Linux support, and that would suck. But no evidence of that is presented here. And the author expects a resolution for a complex issue for a pre-launch product in testing phase from a major corporation _within days_? That seems aggressive and unrealistic timeline to expect a fix.

Edit:

The author writes "Their so called help-center does not even know about "Error Code 83"" (with some attitude and prejudice, I'll note); but also writes that Disney responded with "We are familiar with Error 83.". Confusing.

<comment><USER63> You're ignoring the analysis that Disney+ seems to be blocking use entirely at the lower "security level" assessed by Widevine.

It would not take significant time or effort for them to change the threshold value if it were something they considered broken.

It seems prudent at this point to avoid becoming a paying customer until they address it, if you care about this sort of thing.

<comment><USER62> > It would not take significant time or effort for them to change the > threshold value if it were something they considered broken.

Do you have reason to believe this? To me that sounds like a complicated change with significant potential business impacts. Have they signed contracts already where this kind of security is ambiguous? Does changing the flag actually solve the issues on all devices or do other issues present, since they have been untested? Testing must happen post-change, I would imagine.

The issue still sounds complex to me. I use Linux and I want Disney+ to support it, obviously. But I don't see Disney as being in the wrong here (yet) - they're potentially just working on the issue before release. We'll see, I guess.

</comment></comment></comment><comment><USER11> > {"errors":[{"code":"platform-verification-failed","description":"Platform > verification status incompatible with security level"}]}

Any information about this "platform verification"? What exactly are they verifying and how?

</comment><comment><USER64> This is a naive question but I've always wondered, what motivates people who distribute pirated content for free?

I get why someone would consume pirated content but why would someone take the risk of publishing pirated content? Is it the ad traffic that the publishers get?

<comment><USER65> To some, it's a game, it's a challenge, and it comes with recognition and/or reward -- potentially in the way of private services or paid requests.

Or, as the quote goes, "some men just want to watch the world burn", whichever world they deem unworthy of existing.

</comment></comment><comment><USER66> There won't be much of an overlap on the Venn diagram of Fedora users and Disney+ subscribers.

Raise a hand if you're shocked that Disney would use the highest level of DRM possible, given their history of guarding their intellectual property...

</comment><comment><USER67> While some streaming services might work with Linux, almost all will not show HD or better quality. Just torrent everything, its so much easier, this DRM clusterfuck just gives you less reason to feel bad about it.

</comment><comment><USER68> Is _anyone_ surprised that Disney would DRM in draconian ways?

</comment><comment><USER69> Are we forgiving Walt Disney for having 'trouble makers' blacklisted and investigated by HUAC? I'm not.

Even if they made something besides pablum, I wouldn't be interested.

</comment><comment><USER70> Use torrents, those are DRM free, easy to use and often just as good if not higher quality than streaming services.

</comment><comment><USER71> You would think Disney would want to support chromeOS because of its widespread use in schools

</comment><comment><USER72> Back to piracy it is, I guess.

<comment><USER73> But _why_? Is there something Disney has that everyone _needs_ to have?

My first reaction to stuff like this is simply that I can't be bothered -- if Disney don't want me as a customer then I'll simply ignore their service.

This is a serious question; I'm quite ignorant when it comes to the content of the current Disney IP portfolio and I'm not really a consumer of mainstream media.

</comment></comment><comment><USER74> Is anyone really surprised?

</comment><comment><USER75> Is there any other future?

</comment><comment><USER76> Ironically, scrolling for the article is broken on iOS Safari.

</comment><comment><USER77> Torrent sites use no DRM and the speeds are higher.

</comment><comment><USER78> I believe it morally justifies downloading Disney+ content via torrents.

<comment><USER79> Oh come on, "Disney won't stream their stuff to my niche OS" is not a reason to get their stuff without paying. You can wait for a DVD, you can scrounge a used device that will run their DRM, or you can decide you hate all DRM and boycott their stuff until the unlikely event they offer a copyable version. Lots of people work hard making this shit, and they have bills to pay, these things don't just spring fully-formed onto a hard drive like Athena from Zeus' skull. _Maybe_ there's some morality going on if you buy a ton of merch for what you watch. Maybe.

Or you can reward the companies that _do_ support your niche OS by paying for their stuff, _that's_ pretty unassailable.

I am far from without sin in this area, but I don't try to make excuses. Watching stuff without paying its asking price is stealing.

<comment><USER80> Niche or not "Disney won't sell me content I want to buy" seems like a tough position for Disney to argue past.

This was the argument back in the days when movies wouldn't be released in many countries as the market is too small.

What do you expect potential customers to do? Should they buy new computers? Not watch Disney stuff?

I think I would expect the latter, but if they aren't Disney's customer then them pirating isn't losing Disney any business.

<comment><USER81> > Niche or not "Disney won't sell me content I want to buy" seems like a tough > position for Disney to argue past.

I feel that is such an entitled attitude. Watching Disney+ is hardly some inalienable human right nor essential for survival. Why would anyone think their right to use a service, and cosume content, overrides Disneys well- established ownership?

<comment><USER80> What's wrong to entitled attitudes?

I feel like "entitled" is some sort of jerk buzzword. Entitled is a wonderful thing. I think it's good to be entitled to not being exploited by billion dollar companies making decisions that make like worse for people. Even if it's just a little worse like not being able to watch a movie with your kids. Sadly, we're not entitled to such a thing.

Why is Disney entitled to oppressive "well-established ownership?" I'm not sure how one is more entitled than retaining copyright for 70 years after the artists who create something die.

</comment></comment></comment></comment></comment><comment><USER82> I was planning on subscribing instead to a VPN that supports peer-to-peer torrenting.

</comment><comment><USER83> I can't imagine the vast majority of their customer base uses Linux, and was likely left out as a fast follow as it isn't worth being a supported system until they can see it gains traction.

</comment><comment><USER84> While I understand why Disney is getting much hate here at HN, I don't think Disney really deserves it; Let's face it, Linux is a very niche OS.

Just flipping on a switch for level 3 on Linux also takes money, as then they have to check whether it's working at every deploy, provide customer support for them, etc, ...

And there's people in this thread that DRMs are pointless... but IMO DRMs aren't useless, it works as a small barrier for users to not copy. Think about two hypothetical people A and B for example;

When DRM exists: A talking to B "Hey, I've watched the movie XXX from Disney+ last night, you really should subscribe to see that great movie!"

When DRM doesn't exist: A talking to B "Hey, I've watched the movie XXX from Disney+ last night, you really should see it. I'll give the movie file in my USB tomorrow."

I don't like the company-tired nature of DRMs, but not much of a solution exists, esp when DRM was rejected by the web standards.

<comment><USER85> When DRM exists: "Hey I watched this movie that hasn't been released from Disney last night, have a copy and you can enjoy it too!"

The only thing preventing this stream working on Linux is someone paying Disney the licence fees. It's nothing to do with control of end product quality. Disney does not provide support for customer technical problems.

<comment><USER84> > When DRM exists: "Hey I watched this movie that hasn't been released from > Disney last night, have a copy and you can enjoy it too!"

Only if the value of time consumed trying to break the DRM is lower than the Disney+ subscription fee. And I think for the majority, the Disney+ subscription fee will be lower.

<comment><USER85> For a lot of people I know, there's more cost than just the subscription fee, there's also buying equipment to support that streaming service.

It's like people recommending I upgrade to Windows 10 when the machine I am using is barely capable of running Windows 7. It's not just $10 a month, it's also $1000 for a new computer to watch it on. Or a new TV which means buying new furniture since the current cabinet can't hold anything larger than 30" and the smallest TV I can buy is 44".

Then there's streaming requiring 25Mbps when my Australian NBN struggles at 12Mbps.</comment></comment></comment></comment>


Impressive - list of sites already running on Stack Exchange - <AUTHOR> http://meta.stackexchange.com/questions/4/list-of-stackexchange-sites

<comment><USER2> Recently launched an implementation of StackExchange for startup questions:

<http://answers.onstartups.com>

</comment><comment><USER3> I'm surprised some of those sites felt that it was worth paying $129 a month for it. It's cool software, but those strike me as some small niches.

<comment><USER4> Right now it's free during the beta. (I setup a stackexchange for startup questions: www.ExplainBusiness.com).

It took about 2 hours and you don't need to provide a credit card yet. It will be interesting to see what % of these trials convert to paying customers though.

<comment><USER3> Oh cool, I didn't realize that. Maybe I'll check it out as well. Thanks!

</comment></comment></comment><comment><USER5> What a plague! So now there are a bunch of sites with horribly oversized text and numbers?

<comment><USER6> Oh no! And all of these sites will be generating useful content, fooling their users into thinking that's more important than text size and kerning! What will we do?

</comment></comment><comment><USER7> There is also a new site for BlackBerry smartphones, let's see if this will indeed be a serious competitor to the many other BlackBerry forums out there.

You can check it out a <http://know.bbhacker.com>

It took me less than 1 hour to set it up and get it going. This could be really helpful for everyone who wants to create a custom support site.

</comment><comment><USER8> Aside from PR, what does Stack Exchange offer over Slinkset[1] (now Posterous) ?

1- <http://slinkset.com/>

<comment><USER9> Not to be snarky but-

you have obviously never used stackoverflow, nor have read any article covering stackoverflow internals.

<comment><USER8> Not to be any more snarky, it seems to me that you're confusing the stackoverflow _site_ with the Stack Exchange _platform_. Put simply, the latter "powers" the former much the way news.arc "powers" Hacker News or Wordpress "powers" countless specific blogs.

Perhaps I should rephrase my question: what makes Stack Exchange worth the price they charge when Slinkset is free?

<comment><USER9> I think my comment still applies. The comparison is not even equal in my opinion. Not to take credit away from slinkset at all, I have an account there =).

You are right, I have not used the stackexchange platform, but seeing the end result of both makes me fail to see how there is even any comparison.

Slinkset says it creates social news sites. StackExhange says its a knowledge exchange platform.

 _To me_ I read that slinkset intends to be a handy social media tool. Stackexchange intends to be wikipedia for questions and answers.

Hardly similar.

So to answer your question. All the people stackexchange is likely targeting and intended for, probably don't even put slinkset in the same conversation based on their needs.

<comment><USER8> Although it's clear each describes their service differently, _setting aside their public relations_ it appears to me the basic service they offer is basically the same: they make it easy to setup community sites where people can post things, vote on things and accumulate karma. Whether those things are news articles, answers to questions or other things (like reviews of silly iphone applications e.g <http://iphone.lockergnome.com/> ) makes little difference technically.

What I'd really like to know, ideally from someone who has worked with both, is if there are any particular features one or the other offers that actually do matter.

Or perhaps this is an example of where developing good PR is more important than focusing on features?

</comment></comment></comment></comment></comment><comment><USER10> Paid advertisements (PR BS) on HN? =) Did I miss something?</comment>


Ask HN: What is the expected knowledge level for jr dev jobs? - <AUTHOR> I started learning on my own a few months back and want to to apply to jobs in a years time. So what are the things that I must know for me to viably get a job? <comment><USER2> Most important thing you need to know is what field to target. After knowing this you can start thinking what is needed for this field.</comment>


Fauci: 'Bizarre' White House Behavior Only Hurts the President - <AUTHOR> https://www.theatlantic.com/politics/archive/2020/07/trump-fauci-coronavirus-pandemic-oppo/614224/ <comment><USER2> Fauci has the enviable position of being objectively correct on almost everything he says, and being correct on a topic that pretty much everyone cares about and can _see_ he's correct.

You can observe the difference in how resilient such a position is against political games and maneuvering, compared to a position that is based in subjective or differences of opinion-based matters (where the each side may have legitimate claims that have to be weighed).

When some issue draws heavily on subjective factors, you play games like this and you will lose against people who are more politically skilled than you.

But in this case, right makes might. I love it.

<comment><USER3> I'm not sure it's so cut and dry that he's resilient to political games.

I follow right wing groups to understand the cognitive structure they use to understand the world and new events, and they're currently comparing him to Josef Mengele.

<comment><USER4> How right wing, we talking dailystormer?

<comment><USER5> They might actually like Mengele there.

<comment><USER6> They'd still happily wield him as a rhetorical cudgel, probably, though.

</comment></comment></comment></comment></comment><comment><USER7> As an outsider watching this stuff happening it is always exciting but predictable. This is the end of Fauci, the narrative is being told, he is on his way out.

<comment><USER8> I don't believe that he's an appointee of the President, so it's not clear to me where things go from here. If the White House can fire him, they will, but can they?

</comment></comment><comment><USER9> Surely it hurts quite a bit more than "only the president"?

<comment><USER5> I'm reading it as "(only) (hurts the President)," not "(only hurts) (the President)."

From the article:

> "Ultimately, it hurts the president to do that," Fauci told The Atlantic in > a series of interviews this week. "When the staff lets out something like > that and the entire scientific and press community push back on it, it > ultimately hurts the president."

</comment></comment><comment><USER10> There is always 2 sides to every story.

Here is an op-ed from a top level cabinet official coming straight at him. Specifically stating Dr Fauci has been wrong at every major call.

[https://www.usatoday.com/story/opinion/todaysdebate/2020/07/...](https://www.usatoday.com/story/opinion/todaysdebate/2020/07/14/anthony- fauci-wrong-with-me-peter-navarro-editorials-debates/5439374002/)

As with everything, it would seem that the truth is somewhere in-between.

Skepticism seems to be the order of the day

<comment><USER11> > As with everything, it would seem that the truth is somewhere in-between.

I hate this sentiment. I agree it's largely true, but it makes a large difference whether that `correct point' is halfway in between or 95% on one side.

Whether your intention or not, naively suggesting the truth is in the middle without any further clarification comes across as a cheap political ploy.</comment></comment>


Towards Inferring Mechanical Lock Combinations Using Wrist-Wearables - <AUTHOR> https://arxiv.org/abs/1710.00217 <comment><USER2> Modern high security combination locks are digital, the rotation for each number is random. [http://www.kaba-mas.com/kaba- brand/products/906098/x-10.html](http://www.kaba-mas.com/kaba- brand/products/906098/x-10.html)

However the S&G electromechanical is direct dial, so would be susceptible. [http://www.sargentandgreenleaf.com/products/electronic- locks...](http://www.sargentandgreenleaf.com/products/electronic- locks/model-2740b/)

However people usually open locks with their dominant hand, and wear their watch on their non-dominant hand, so it seems to be a small risk overall.

</comment><comment><USER3> The paper is specifically about mechanical combination locks. Although fascinating in the sense of modern tech defeating old-school security, most people would encounter a combo lock these days only on gym and school lockers.

I'm more concerned about codes on keypads and passwords on keyboards being captured by cameras, either hidden spy cameras (like at ATMs) or ubiquitous security cameras that you don't even notice anymore.

Cameras are a bigger threat and I haven't seen any good novel ways to defend against that. Years ago there was an ATM pin pad that had changeable digits on each key. It shuffled the digits for each user, and you could read the digits only if you looked head on. But it didn't catch on.

<comment><USER4> _" Cameras are a bigger threat and I haven't seen any good novel ways to defend against that."_

My method is not novel, but to guard against cameras and shoulder surfing when typing in a code on a keypad, I've always just covered my typing hand with my other hand.

At some banks, I've seen keypads retrofitted with raised sides, presumably to make viewing the keys from the side impossible. Your hand is still visible when you type on those, though, and so I would guess the keys that you type could be inferred from your finger motions. Anyway, the top of the keypad is not obstructed (so that the user can see it themselves), so a camera from above or someone from behind might still directly see what keys you type, so I still cover my typing hand with my other hand even when using these types of keypads.

</comment></comment><comment><USER5> Who wears their watch on their right hand? That's weird.

Cool demo, I guess.

<comment><USER6> Pretty common to wear a watch on a left hand and a fitness tracker or separate smart device on the right, though</comment></comment>


Don't Do This in Production - <AUTHOR> https://stephenmann.io/post/dont-do-this-in-production/ <comment><USER2> I want to underline this bit:

> they hired a team of developers without having a technical person on staff > to vet them

For any non-technical entrepreneurs reading this: please don't do this. If you aren't competent to hire developers, please borrow or rent a few trusted technical experts and use them as a hiring committee. Otherwise you are less likely to hire the _best_ technologist, and more likely to get the _most glib and appealing_ technologist.

Over the years I have met far too many smooth-talking consultants and would-be employees. And I've seen them cause enormous garbage fires when managers hire beyond their ability to evaluate. The size of these garbage fires are a direct result of what got them hired: if someone is good at telling managers what they want to hear, they can go a very long time saying, "Yup, we're building it and it will be great! Just you wait and see!"

And then, no matter who you hire, demand a "ship early and often" schedule. Ship to internal users. Ship to alpha users. Ship to external testers. Heck, ship to just person for just one narrow use case. The earlier you can start seeing real-world success or failure, the earlier you can course correct.

<comment><USER3> I was going to call out this quote : _If you read this far hoping for an answer, then I'm sorry: I don't have a simple one. This is a difficult problem to solve._

And yet there is an answer, it is _hire an experienced engineer_. And the author glosses over the problem by not realizing they "solved" the problem by hiring him.

It is the bad calculus where one "experienced" engineer is going to cost you maybe $150K - $200K and yet you could get anywhere from 3 to 10 junior engineers for that depending on how far out you go.

It would be awesome of there were some sort of certification for "experience" sort of equivalent to the guild master status, it isn't an education thing it is a "oh yeah I've seen that before, lets not do that here's why" kind of thing.

<comment><USER4> If you aren't technical yourself, how do you separate an experienced engineer from one who, well, isn't? This was the fundamental problem that the company failed to solve, and frankly I don't think there's any easy solution around it.

<comment><USER5> Agree with this. Same applies to any expert: how do you identify an experienced marketer? Or accountant?

<comment><USER6> To hire someone with expertise to solve a problem in a domain where you aren't an expert: You find people who claim to understand the domain, and then discuss the problem with them in depth. Your goal is not to evaluate them in general but to understand how they analyze the problem and how they'd deal with it.

You may have to hire them as consultants. You have to dedicate a day or more to discussion with each of them -- maybe considerably more if your problem is complex. You have to reveal information about your plans and/or the condition of your systems that may make you anxious or embarrassed.

After you've gone over the problem separately with five or ten putative experts, you will have a pretty good idea which of them understand it (if any), and you will also know how to ask much better questions going forward.

If necessary repeat this process, using your better understanding to find better experts and gain a better map of the territory.

Once you can rank expertise in your domain reliably, you might hire one (or more) of the known experts, but the best ones will be hardest to hire. Or you may use your new meta-expertise in the domain to look for more junior hires who have an unusually good grasp of your issues. Also, you may be able to get the best of your experts to act as advisors.

This takes a lot of time and may cost some money depending on the domain. But not doing it will take more time and cost more money in the medium to long term (and even in the short term sometimes).

<comment><USER7> AKA become expert.

I wonder if the people who become fantastically successful simply have the ability to evaluate expertise, without having any of it. i.e. by "reading" people, in some sense.

This relies on the "expert"'s own evaluation of their expertise, which mightn't be accurate, because of Dunning–Kruger, or conversely, self-doubt. So, one would need to "read" those too.

<comment><USER6> You definitely can't trust people's self-evaluation either way. Lots of really skilled people are self-critical. "Reading people" of course helps but it is nowhere near enough.

But you don't have to become an expert. If I hire a plumber or carpenter, I _cannot do_ what they can. But with enough work I can understand which plumbers or carpenters will do a good job.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> _"Move fast and break things," they said. It turns out that's a pretty bad idea when your business relies on a small number of large customers. Broken products tend to scare them off, which in turn tanks your business. There's a lot to be said for building things that work, but "move slowly and steadily towards a goal" just doesn't have the same ring._

 _In reality, there's a balance between moving fast and and moving slow. It's difficult to communicate that balance because every type of product demands a different balance. I suppose that intuition comes from experience, which is a terrible answer for someone trying to learn._

I'm guessing this continuum also depends on the nature of the business one is in. In a fast-moving, consumer-oriented world like social networking, "move fast and break things" is probably very good advice.

In a slower-moving, enterprise-oriented world, "move slowly and steadily without breaking things" is probably the right orientation. Those kinds of companies probably die in fast-moving consumer land.

A while ago I read an article about the programming teams that work on the space station, on satellites, and that sort of thing. Alas, I cannot find the link right now, but the gist was that those teams move very slowly and work very hard towards correctness. Any bug found is generalized and their entire code base scoured for similar bugs. That's a different environment than social networking.

<comment><USER9> Most enterprise customers I've dealt with don't even care about things breaking that much, they care about control. That's the much bigger thing. Things break. Let's just make sure we don't break things while our customer is dumping silly amounts of money into an EU-wide advertisement campaign. Or we tend to freeze updates during christmas, due to the christmas business of our customers.

With those guys, it's fine to execute risky changes on productive systems, as long as those changes are tested, communicated, scheduled to a non-critical time of the customers and include backoff-plans.

But yes, this naturally slows things down, or makes systems more complex and expensive due to redundancy and staged rollouts.

<comment><USER10> Enterprise wise, they are very forgiving in my experience unless it affects _their_ customer. Then they are very unhappy, understandably so.

</comment></comment></comment><comment><USER11> Bugs will always happen in production. The important part is not developing everything correctly. "Move fast and break stuff" is a decent philosophy, _as long as you can learn from mistakes and fix recurring problems_.

When a bug in your application presents itself in production, something very specific should happen: 1) identify the symptoms, 2) isolate the causes, 3) address the issue in production, 4) perform a postmortem to identify the next steps, 5) fix the problem's causes throughout _the entire supply chain_ so it cannot happen again.

A lot of organizations get stuck only doing steps 1-3. That's not good. Operational processes are just as important, if not more so, than development processes. They're what ensure that when you find inefficiency or bugs, that they not only get fixed, but that they never happen again. This means actually making policy changes, training changes, etc in addition to just fixing code.

This is the heart of lean manufacturing that supposedly influenced a lot of modern software development methodology. But some people may have forgotten that the lean manufacturing chain doesn't end at development.

<comment><USER12> > Bugs will always happen in production.

This is not some universal law. It's true only when the project/team is not willing to make the trade-offs (like development speed) needed to deploy bug- free code. For most software it's better to release with bugs, but not so for all software. For some software, like safety critical projects, things launched into space, etc, it's better to take your time and release without bugs.

Besides, good development practices, good requirements, good change control, and good testing can prevent the vast majority of bugs from reaching production. Sadly, this idea that bugs in production are inevitable is pervasive in industry.

<comment><USER13> In order for that to happen, you would need perfect practices, perfect requirements, perfect testing and perfect 'change control', and an inhuman ability to never make a human mistake in the understanding of any one of those things within your team of equally perfect people, so add perfect communication on to the list.

Anything less than perfection at any stage will be a vector for bugs, whether that bug is a syntax error, unexpected behavior, or a fully tested and functional feature that doesn't meet expectation.

Mistakes are inevitable and not necessarily bad when you handle them well (move fast and break things says nothing about what you do with all the breakage, so feels immature). Calling them bugs doesn't change that.

</comment></comment></comment><comment><USER14> "Move fast and break stuff" is a decent philosophy if and only if the consequences of breaking stuff are survivable.

If breaking stuff means that your website looks weird, that's survivable.

If breaking stuff means that performance sucks for a while, that's survivable.

If breaking stuff causes unavailability during a critical period of end-user demand, a few incidents might be survivable.

If breaking stuff causes your company to have a terrible reputation for privacy, security, or competency, that might not be survivable.

If breaking stuff causes your company to divulge financial information, that might not be survivable.

If breaking stuff ends up costing your customers any significant amount of money, that probably will not be survivable.

<comment><USER15> >If breaking stuff causes your company to have a terrible reputation for privacy, security, or competency, that might not be survivable.

I reckon this stuff is particularly survivable. You can be like Linode, fuck up everything over and over again and still do just fine.

<comment><USER16> > _You can be like Linode, fuck up everything over and over again and still do > just fine._

Source? Because every time I've read about Linode they had glowing user reviews, including on HN...

<comment><USER17> It blows my mind that people still give glowing reviews to Linode when in 2013 hackers breached their systems and stole credit card numbers and customers reported their credit cards were being used maliciously and Linode got away with saying "nuh uh": [https://www.theregister.co.uk/2013/04/16/linode_breach/](https://www.theregister.co.uk/2013/04/16/linode_breach/)

Or again in 2015 when Linode's poor security lead to PagerDuty being hacked: [https://www.securityweek.com/how-attackers-likely- bypassed-l...](https://www.securityweek.com/how-attackers-likely-bypassed- linodes-two-factor-authentication-hack-pagerduty)

You can find some more discussion in previous HN threads about it: [https://news.ycombinator.com/item?id=11136399](https://news.ycombinator.com/item?id=11136399)

</comment></comment></comment></comment><comment><USER18> This something I don't understand about certain startup founders. If you're starting a company, you should have at least one absolute monster of a developer. Someone who is capable, communicative, and with a deep pool of knowledge. Someone who can attract, hire, and lead other good developers. Not your buddy Steve who made an iPhone app or two. Not that developer who has some PHP experience and built a React app once. A real, terrifyingly good developer. The aphorism "first class people hire first class people; second class people hire third class people" comes to mind.

Granted, I'm a pretty inexperienced developer, but I see companies being founded by people who are even less competent and less knowledgeable than me.

And sure, finding a competent person is hard. But it's like the movie Seven Samurai. Can't afford to pay a samurai? Find a hungry one. There are plenty of developers who are young, but still good. And if you can't even do that, then take any and all money you have, and pool it to find one or two (or seven) developers who can find other competent people.

<comment><USER19> _> There are plenty of developers who are young, but still good._

I was young, and I was good. (Now I am moderately young, and I'm very good.) But I am a better talker than I was a developer. Only recently have I really become as good a developer as I am a talker. How are those startup founders supposed to evaluate me?

</comment></comment><comment><USER20> So a team of inexperienced developers made a system that mostly worked with some hiccups, could be debuged by an expert in 1 day, and fixed on a tight launch timeline. Looks like a success story!

<comment><AUTHOR> It was definitely a success story. The company, their customers, and my company all benefited. It wasn't all rainbows (the story is a bit longer and more complicated), but it worked out well for everyone in the end.

</comment></comment><comment><USER21> Many developers are commenting in here trying to fix a problem. I am a developer but I now run a business. From a business point of view, there is no problem here. Code has been delivered and it is running in production successfully. It might not have arrived at that point in the most efficient manner, but the point is that the business has executed successfully here. There is no issue. This is a lot further than most businesses get. If you see a problem to be fixed here then you are looking at a small picture of the business.

<comment><USER22> Are you discounting that technical debt is a thing/matters?

What gets delivered isn't just a set of features, it's a piece of software, which implements those features, but might have a whole bunch of baggage attached which can make it really hard (or easy) to change those features or add new features in the future, or to allow the software to adapt to changing external conditions.

I don't think this is specific to software. E.g., I'd imagine it'd be possible to build a building a lot faster if you didn't need to worry about it not collapsing in five years.

\---

Though to be fair, the mere presence of technical debt on its own is not a problem; there is some amount of technical debt that's appropriate, and it's hard to know exactly where that is. You certainly can't get by just ignoring it completely.

</comment></comment><comment><USER23> There's a great book _Apprenticeship Patterns_ which gives real answers and advice to developers. It addresses the situation described in a few different ways and offers different strategies. Most of them boil down to how to pick a team where you will learn the most quickly while not drowning.

[https://www.amazon.com/Apprenticeship-Patterns-Guidance- Aspi...](https://www.amazon.com/Apprenticeship-Patterns-Guidance-Aspiring- Craftsman/dp/0596518382)

<comment><USER24> Of all the books I recommend for junior/intermediate developers, this is the one I demand they read. I wish the the free online version was still available, but it doesn't appear to have survived O'Reilly's switch to the subscription model.

</comment></comment><comment><USER25> One thing I see amongst many of developpers, is that they write code like it will work in production. OTOH, I tend to write code that will crash nicely : good error reporting, ability to continue after a crash, write code that handle only the data it needs, make sure queries address the smallest possible set of data, log a lot. Interestingly, that's a lot of code I have to write anyway because it helps me to write my programs (I mostly don't use debuggers).

<comment><USER26> I agrret with you, but want to say I think it's important to write code that is "brittle" enough to just satisfy the requirements. I've seen a lot of "edge case that probably never happens" code that ends up causing problems down the line because it does get hit, but for a unexpected situation and ends up mangling data.

Especially in the paradime of black box/microservices, if something comes in that doesn't line up with a known senario, there should only be enough code to log the data and raise an alert/error. Having something bad happen, and handling it so it becomes 'less bad' and doesn't get flagged, escalated, and tested properly is going to cause issues.

<comment><USER25> >>> I think it's important to write code that is "brittle" enough to just satisfy the requirements

100% agree and the idea behind my post was that writing code in such a way requires a lot of experience and an appropriate mindset.

</comment></comment></comment><comment><USER27> > all of these developers lacked experience.

This is nothing knew unfortunately.

Working for large corporations I've often notice this :

Either the devs on the project don't have the required experience and will deliver poor quality code creating immediate "legacy" , or either it'll be outsourced to another company with no governance plan to review the code quality creating a "black box".

Because there is very little standard and regulation in software industry about competence, you can have two devs claiming they are "Software Developer" with one able to deliver a full project by himself the and the other not capable of creating a simple web page in HTML.

Hence , I've noticed very little company understand the importance of "tech" , "IS Governance" and investing in their staff in general, they often see "tech" as a constraint like : "We have to do a website for our customers , otherwise we'll loose market share" and not "We have to seize the opportunity to create a platform for our customers, it will drive growth massively"

This is sad , but this is pretty much the standard in corporation these days.

</comment><comment><USER28> There's no reasonable way to write code suitable for "production" in general, because there are so many conflicting requirements. Just among internet services, components need different kinds of robustness for content websites, communication, e-commerce, email, banking, social networks, internal corporate services, and more.

There do exist components suitable for most environments, like Postgres, but usually at the cost of 10x complexity over what'd be needed for the pure functionality. That engineering is worth it for things like databases that get used everywhere, but not for any custom component.

</comment><comment><USER29> Can someone give an example of a blog post that gives example code yet warns "not to do it in production"? I've programmed and read about programming for decades and can't recall ever seeing anything like this.

It's hard for me to take this article seriously without even a single example -- I can't tell if this is a strawman or not.

Is it about code that isn't thread-safe? That relies on undefined behavior? That doesn't scale? That has race conditions?

"In dev" and "in prod" can mean so many different things (is it about scale? or running on different OS's? or running unattended? or running on different hardware? or running compiled?), out of any particular context they're essentially meaningless, and in case particular case, it would seem to be the particulars that matter...

<comment><USER30> First result from DDG. [https://blogs.msdn.microsoft.com/canberrapfe/2013/02/16/powe...](https://blogs.msdn.microsoft.com/canberrapfe/2013/02/16/powershell- web-access-very-quick-start-yep-powershell-in-your-web-browser/) the thing in that example is that a thing is not properly configured but good enough to get started with in development.

Second result: [https://stackoverflow.com/questions/1475297/phps-white- scree...](https://stackoverflow.com/questions/1475297/phps-white-screen-of- death) describes how to put debugging statements in the code which is good for local development but which shouldnt be kept for production.

</comment></comment><comment><AUTHOR> This blog post describes my motivation for writing a blog. It's mostly a written memoire for myself to remember in detail what motivated me to start writing, but I thought HN readers might have some good feedback, so here it is. Would love to hear any stories you have of production fiascos.

</comment><comment><USER31> > If you read this far hoping for an answer, then I'm sorry: I don't have a > simple one. This is a difficult problem to solve. The solution is too large > for a single blog post, changes every day, and differs subtly for every > project.

Crazy idea, what if we found one of these people who writes these blog posts, an especially well vetted and knowledgeable one. Maybe even one who writes the frameworks and software these people are using. _cough_ [https://pragprog.com/book/phoenix14/programming- phoenix-1-4](https://pragprog.com/book/phoenix14/programming-phoenix-1-4) _cough_

What if we took this person, and paid them money to write a bunch of blog posts about on topic, in a way that it read in a linear fashion? We could even maybe hire someone to help them, to proof read and make helpful suggestions.

We could give the knowledgeable developer a year or so to write the blog posts, then print out the blog posts, bind them together with glue, and SELL IT!

People could pay money for the well researched, well edited series of blog posts about a specific topic written by the expert. I think I'll name this blog-printed-out-onto-paper... a honkycat. After it's inventor.

\---

Sarcasm aside, I find people's insistence on googling and sifting through half-thought-out blog posts infuriating. I am a HUGE proponent of a well written book about a software product. Compare "Programming Elixir" to their free online book and documentation. It's night and day. And I can always look in the same place for reference, the book. Written by Dave Thomas.

A book has: ( At least ) one author, one editor, and a publisher. All of these people work hundreds of hours to produce a useful manuscript. A blog post is something a script kiddie shits out because they're trying to get their first programming job.

Yet people say the same thing: "A book?!? I can just find it on the internet" and do the same thing: "I'm sure I'm smart enough to just start writing this software without any prior experience in the language, or forethought" and make the same mistakes over and over.

Skip the blog. Read a book.

<comment><USER32> Finding a good book is not particularly easier than finding a good set of blog posts. While the quality of books is on average significantly better, finding books where the material was written in the past year is much harder.

Particulary in the trendy JS world, where there might not be a good book for the stack you are using, and even when there is, you ask questions online and get responses that are roughly "It hasn't worked like that for 6 months, why are you trying to do it this way?"

You give the example of the Phoenix book; I don't know if that's what this team was using. If it was not, the fact that there is a good book for that stack is not particularly relevant. If they were using Phoenix, then the fact that there is not a good book for most stacks would explain why they wouldn't consider looking for one for the stack they are using.

<comment><USER33> > Particulary in the trendy JS world, where there might not be a good book for > the stack you are using, and even when there is, you ask questions online > and get responses that are roughly "It hasn't worked like that for 6 months, > why are you trying to do it this way?"

[http://boringtechnology.club](http://boringtechnology.club)

</comment></comment></comment><comment><USER34> I find this a result of pervasive command and control structures which inevitably lead to low trust environment.

Something breaks, so the manager naturally thinks he must add a control that will prevent the person or a from ever being able to do it.

Very soon nobody can do anything without approvals by managers so far removed from actual decision that they don't even know the names of components being subject to change. The change then must travel from the only people that know what the change is but are absolutely barred from ever seeing production environment to people that being so focused on operations don't have time to actually understand what the change is.

Once you are being treated as untrustworthy it will show in the rest of your work. Why code correctly from the start when you are not deemed trustworthy to do it correctly and there is lengthy testing and approval process to make sure you are not going to bomb your company?

The correct step is to recognize, that introducing more controls can very soon lead to low trust between employees which is self-fulfilling prophecy. When you are not allowed to do something because you are not deemed trustworthy to do something, then soon you have no experience and then this serves as a proof that the initial decision was correct.

<comment><USER35> On the flip side, it seems that many young devs think that they should be allowed to do anything they want, without oversight whatsoever. I don't know of any other industry where junior people have this sort of arrogance. Usually people recognize they are junior and work to both learn from and gain the trust of their seniors.

In development land, the attitude is "seniors are old, useless, and outdated" and any form of oversight at all "removes trust." E.g. A young dev suggests building their own database. After being told politely that this is an enormous task full of seriously hard problems and that it's not feasible to try, they yell about their "ideas being shot down" and that the work environment "lacks psychological safety."

<comment><USER34> That's generally true.

What is important, though, is how the very young devs are molded the first time they come to an organization.

I have long experience working for various enterprises. One outlier company I worked for is Intel. Intel or at least the organization I worked for seems to be aiming to hire almost exclusively fresh out of university just to be the first one to "mold" the young engineer. Young engineers are immediately treated as adults trusted with their projects. Managers (not all, but I would say majority) seems themselves as shepherds rather than commanders. They will ensure projects are assigned to engineers and that engineers create value and they will try to debug if there is any cause of concern but will not assume the typical "single point of contact, single point of decision and authority on everything" role seen in most corporations.

This of not true of all managers at Intel but it was very striking to me when I joined the company with some 15 years of experience in dev under my belt.

Junior engineers seem to adjust to this immediately and seem to genuinely try their best to do best and try to seek wisdom which there typically is a lot of in the close vicinity.

</comment></comment></comment><comment><USER36> Copypasta from other codebases happen to work better in non-production environments because the input space is smaller in virtually any non-prod runtime space than in prod.

This makes for a larger intersection of inputs to the copypasta that produce outputs that are expected by the blogpost/googling developer and inputs to the copypasta that produce outputs that are generated at non-prod runtime.

When you don't quickly see what's semantically wrong with the code (the problem mismatch) because you pasted it and it just worked (maybe with a few small tweaks), then you quickly forget about it and black-box the snippet in your head. Then, when input space gets real-world and things break, because the copypasta never had much cognitive gravity (because you didn't think much about it), it doesn't attract log dump elements in your log-scanning brain as much as stuff you had to think through yourself does.

I guess you could automate some static checks for this by some massive trawl of snippets from a few websites (at least popular SO posts in the same language?) and finding verbatim matches in your codebase. Sounds massively impractical to do this at scale though. Does anyone know tools that do this?

</comment><comment><USER37> "Move fast and break things" only works if your company has a stranglehold on a monopoly and your user base is used to bugs in production. Terrible advice for just about everyone else. You want your users to have the best experience possible, rather than do your QA process for you.

EDIT: I should say my point is: "moving fast" and "testing things" are goals that aren't contradictory. You can and should do both.

</comment><comment><USER38> This post was completely not what I expected it to be.

The "do not use in production" is the programming equivalent of taking a strong stance on an issue but then appending "but hey, I don't know" or "don't take my word for it".

They completely defeat the purpose of the entire statement and in the production comment's case, the code samples.

Let's ask a different question, what am I supposed to use in production? I had an email discussion with some blogger who wrote about a very narrow problem which I needed to solve. Their code samples worked, but poorly. The entire thing was a dumpster fire but it solved the problem and were the only one I could find after days of Googling and Stackoverflowing.

I did not care about their "do not use in production" comment. I needed their solution in my production system. What was I supposed to do?

Sorry for ranting, but I believe it is irresponsible to put code out there which shouldn't be used except for when it is the point.

</comment><comment><USER39> Some time ago I was writing some software in Go in my spare time (just for fun and I could spend my time how I liked it). As I wasn't completely sure what it should look like in the end, so I thought it would be reasonable to skip writing tests in the beginning and just write the code and add tests afterward where they would be necessary.

Fast forward I had to write the whole code twice. The second time I wasn't completely sure how it should look like either, but I put a much greater emphasis on interfaces and modularity. That way I could guarantee that parts of the program were actually doing what they were supposed to do, which made the bug hunt so much more effective.

So sometimes the longer way is actually the faster one and experience matters when it comes to recognizing such situations.

</comment><comment><USER40> Building a good team is hard. Yet companies think they can hire an engineer which had a senior position somewhere and be fine. Senior or 10y experience can mean literally nothing, it doesn't qualify for a central role in a team, nor does it tell anything about quality. Expecting something grand from a bunch of rookies is simply dumb. Writing better blog posts or smart essays won't change anything. A rookie needs to follow the wrong path and fail with it. Good mentoring can speed things up, but you still need to let them fail. Team building is vastly underdeveloped in software engineering, it is not even a serious thing. Yes if you start out with a good guy that carries the newcomers, then you're golden. But that is mostly just luck.

</comment><comment><USER41> Even for an experienced programmer this stuff happens, and it's the most frustrating experience I've ever had. It's the stuff that happens when management and C-level just "wants stuff" to be buzzword compliant. And, every day/week/month the requirements change. This weeks feature X has "top priority" and then amnesia kicks in and now feature Y is the next best thing. As a programmer-now-manager I try to shield people from this, trying to find the gems among the rubble of business meetings. But it's tricky, so this really resonated with me:

"I have an overwhelming empathy for developers in this position. They have more information than they will ever need, but it's completely disorganized. It's like trying to build a ten piece puzzle, except you have to find the ten pieces within a pile of 10,000,000,000 pieces, all of which are square, and you don't know what it's supposed to look like at the end. Good luck."

Even with a team of highly experienced developers things quickly turn to a mess if it's not perfectly clear what to work on. I don't mean things like "button should go 1px north to align with header". That's trivial. In fact, I would go so far as to say: most production-ready programming is trivial. Trivial in the sense that someone, somewhere, solved it in a way that's correct. But, when it is not /crystal/ clear what the requirements are, what the business case is, or what the edge-cases look like: oh my. I've been in the incredibly unlucky position of only being in settings like this. Start- ups, academia, R&D positions. And, as a result even with the best intentions and the best teams you'll still produce production-quality garbage. Mostly because incentives were misaligned and there was no coherent vision. Agile story-driven development only works when there is leadership that has the guts to say "no", and when there is something well defined to work on. Sometimes I yearn for some CRUD webstore ... at least then the things are knowable. Anyway, just my rant. I'll probably go the meme-way of becoming a plumber/welder/etc at some point ;-)

</comment><comment><USER42> > helped mentor their developers

This is typically missing from startup culture.

Anecdotally, mentorship improves everyone involved, but I don't know if there's data out there showing if engineering mentorship within a startup improves its chances of success (or is otherwise beneficial [1]).

To some extent, groups like YC participants and alumni end up being mentors to each other, but I doubt that extends beyond the founders. Might the OP have an opinion on something like a rent-a-mentor program/startup?

[1] Not that certain benefits, like productivity, would be enough to motivate a change, as evidence by the open plan office situation

</comment><comment><USER43> > If you read this far hoping for an answer, then I'm sorry: I don't have a > simple one. This is a difficult problem to solve. The solution is too large > for a single blog post, changes every day, and differs subtly for every > project.

 _[Cough]_ \- Hire a few more (expensive) experienced developers? It might not be a silver bullet, but it goes a long way towards avoiding the situation described in the blog post. Also, get help from a trusted technical friend to hire the initial one.

FWIW I see something similar with almost every client I get in my own neck of the wood. Growth is flat. Turns out nobody is worrying about whether they're building a product anyone wants - they're doing it on paper but nobody is actually talking to end-users. Marketing is under-delivering. Turns out it's all juniors worrying about bringing traffic without wondering if it's the right type of traffic; or they're not measuring anything, plain and simple. Sales aren't selling enough. Turns out it's all juniors who aren't selective or systematic enough; or sales are doubling as pseudo-project managers and/or pseudo support-engineers because nobody is managing operations. Projects take forever to deliver. Turns out the project "manager" holds nobody accountable to deliver any specific task let alone by a certain deadline. The list could go on, and on, and on.

</comment><comment><USER44> Naw, you can totally write garbage code and still get acquired for $100 million. Happens all the time.

</comment><comment><USER45> MSDN used to make their code samples as simple as possible for educational reasons, until they realized everyone was just pasting them directly into production applications. So they started adding error handling, etc.

</comment><comment><USER46> Doesn't this highlight a continuous issue,that folks in our trade, do not have any meaningful and up-to-date professional certification?

<comment><USER22> Is there a clear indication that certification helps in other fields?

(Admittedly this seems like it'd be very hard to verify, since most fields either legally require certification or don't have it, and there's probably tons of other variables that would get in the way too.)

</comment></comment><comment> brian-armstrong Another angle to look at this through is that they hired a team in spite of only having business, non-technical minded people. It all worked out in the end when they added consulting to clear up production issues near launch. From a business perspective this is surely a win in all ways, even if not as efficient as it could be. Not every business is a Google.

</comment><comment><USER47> > They hired the first developer, and he vetted the second developer, and so > on until they had a development team

This is hard for a startup in their early stage. Not sure how mature the company was, but let's assume it was young enough to have this very problem.

Direct team hire is a double-edged sword. It works well when your team is very competent and good at weeding out false positive. Basically, when you have a bunch of senior people with maybe a couple junior and mid-level teammates. A normal distribution is actually perfect for a team. Having a direct contact with your future teammate allows you to know the person ahead of time, especially for a very team. Furthermore, direct hire means you are hiring not just a generalist. Your SWE may not know what to ask a network engineer, even from a coding point of view. The downside is what happened in the story.

The way I'd like to go about it is to make sure we have two interviewers per round, even from the same team would be far better than one person vetting.

</comment><comment><USER48> > Before I go any further, I'll continue my story.

It seems to me that that sentence has no significance at all and can be removed safely ;)

<comment><AUTHOR> Point taken, and sentence removed. Thank you!

</comment></comment><comment><USER49> If you're an amateur or a hobbyist then these excuses are all just fine. Stuff is hard. But a professional should not being doing this sort of thing - we're literally talking about copying something labelled _do not do this_. The moment you ignore that warning is the moment you've forsaken your professional development. This problem only compounds.

That said, a professional can still cut corners as and when appropriate (and clearly label and explain such things) but that's not what's happening here, is it?

The advice I would give in this situation is simple: _stop and think_ about what you're doing. If you can't do that, you're not a professional, you certainly shouldn't call yourself an engineer and without that skill you stand no chance of improving.

</comment><comment><USER5> This is interesting - many of the comments here are correctly asking "what if you don't know an expert to help vet the engineers and the system?" I feel the same way when trying to find dentists or accountants. I simply don't know how to know who will perform completely!

So, here is my pitch: if you don't have technical expertise, and you realize that you need someone to help understand just how the heck to get started with technology, what to build, and determine if you even need engineers, then hire me! I'll help!

[https://www.jaygoel.com/consulting/](https://www.jaygoel.com/consulting/)

</comment><comment><USER50> I usually leave a URL for stack overflow answers or other advice as a comment in what I'm working on. I know some areas of my code are more sensitive than others. It is good to have an understanding of what you are doing of course. Sometimes a stackoverflow link is removed simply because the mode of thinking is wide spread in the application and I no longer need the note to it. Might be worth searching for my links in the code when it is time for release incase there is any funny business. Stackoverflow usually tells you if you "shouldn't do it in production".

</comment><comment><USER51> I dunno.. whenever I read 'don't do this in production' I spend ages trying to really understand why - only when I feel I've got a real handle on what the pitfalls are would I go forward. I've done that ever since I started programming over 20 years ago and I still do it now. Sometimes it takes me longer to code a solution but I do feel I spend less time figuring out why stuff breaks.

It's not just experience. It's about hiring curious and diligent people.

</comment><comment><USER52> > At the end of the day, the best way to get more money is to have other > offers.

Actually, the best way to get more money is to already have a job that you are willing to leave.

</comment><comment><USER53> > _There's a lot to be said for building things that work, but "move slowly > and steadily towards a goal" just doesn't have the same ring._

I'm reminded of one of my math professors. When a student asked him "How do I do this problem?", the prof would always respond "Carefully and correctly". And then he'd laugh at his own joke and give the student a real answer.

I thought it was funny. And I liked the alliteration.

</comment><comment><USER54> Copying and pasting internet code into production that says "Don't do this in production" is not a lack of experience problem, it's a lack-of-reading problem or a rushing-things problem; the latter is typically caused by management putting deployment dates on features without understanding the technical cost.

</comment><comment><USER55> When you publish some code you can be pretty sure someone will use it in production, whether you advice against it or not.

</comment><comment><USER56> I work with a consultant that dealt with emergency situations that had the motto, "be brave, be bold, deploy"

In a different situation three of us figured out a solution for a critical situation. We voted on deploying with the thought "well we can't guarantee it will work, but it won't make things worse"

<comment><USER57> They have not recently been working at the TSB :-)

The TSB a medium size UK bank had a very well publicised disaster - when doing a one way no roll back possible switch from an legacy IBM system to a Java based one

</comment></comment><comment><USER58> This was a problem with people. Specifically, people who force people to commit to a known deadline on something they dont know how to do.

Someone got promoted for delivering business value, and they were smart, they left before it all blew up.

Get 'er done without context and fire them for failure is bad management.

</comment><comment><USER59> _But what other option did these developers have? They had to deliver something, and they had never released a production application before. So they did what any sensible person would try to do, and they learned on the job._

And yet, so many people push back on my complaints about the shallowness of the education many recent CS grads are getting. No, it's not an irrational fear of the next generation. It's an awareness that some large fraction of recent grads sporting high GPAs don't have enough basic background knowledge to know what they don't know and keep themselves out of trouble.

What would we think if companies let non-engineer/architect managers put together teams of completely mechanical engineers and architects, who then went on to build faulty bridges and machines that started to call apart? People would be calling foul. Given the societal, privacy, and financial consequences, it's way past time for the programming field to grow up!

<comment><USER60> It's the same in every industry and every domain. A new grade needs a few years of practice before he can contribute well to any real project.

However companies don't always have dummy projects for years, just to practice and drop afterwards.

<comment><USER59> _It 's the same in every industry and every domain._

No. In most industries, groups of novices don't get to do something that gets pushed out to production.

</comment></comment></comment><comment><USER61> "... fix issues as I went along. Without unit tests or automated deployments, this took almost a year."

One of the first things he should have done was to get them Joel-test compliant, otherwise he's wasting the money they pay him.

</comment><comment><USER62> "most fast and break things" only if you have an idea about the implications of your actions and you are confident you will be able to fix the broken parts which in production without losing revenue or customers.

</comment><comment><USER63> Stephen Mann: the subscribe button on your site is broken (at least on mobile web)

<comment><AUTHOR> It should be a link to an RSS feed. I'll change it to link to my newsletter signup form. Thanks!

</comment></comment><comment><USER54> "The only clear issue was lack of experience"

"In this case, however, it had a nefarious twist: all of these developers lacked experience."

Am I missing the twist here? It was already mentioned as the primary problem.

<comment><AUTHOR> Good catch! macns is correct: "all" should be bolded.

</comment></comment><comment><USER64> "If it's stupid but it works, it isn't stupid".

I liked the post, but I'm not sure that I agree.

<comment><USER65> To take one of the classics of bad copy-past examples: "If the 'use-PHP-with- MySQL' example you copied is stupid, works, and also causes your production database to be hacked due to SQL-injection, it probably was stupid"

The problem is to tell the difference between "ugly stupid" and "dangerous stupid"

</comment></comment><comment><USER66> So, what shouldn't i do in production? This article was unhelpful.

<comment><USER67> The snippet of code copied from a blog into production software was only a small detail. You obviously missed the entire point of the article.

</comment></comment><comment><USER68> The solution? Blockchain. /s

</comment><comment><USER69> Summary: The author clickbaits the title with "don't do X". Proceeds with a life story of his struggles ommiting what X is.

<comment><AUTHOR> Sorry about that. I guess I didn't really think much about the title sounding like clickbait. The phrase is what motivated me to write the post, so I used it as the title. Perhaps I should put quotes around it?

<comment><USER70> Quotes would probably be more "accurate," but I don't think they'd quell this person's (unwarranted) complaints. I believe sharing your story was valuable and I look forward to reading more of your blog.

<comment><AUTHOR> Updated. Thanks!</comment></comment></comment></comment>