Ask HN: Spouse not on the same page - <AUTHOR> Curious if anyone can share some experience with marriage. I married someone who isn't as intellectual as me. She was generally supportive of my tech interests and career ambitions when we were courting. At the time she had a job (though she had massive student loans). A few years into our marriage, my wife occupies (shall I say demands) a lot more time than before. She doesn't work anymore either (suffered job loss so is going through a bit of emotional stress - so essentially a couch potato - unlikely she will find a job at her previous position). We are in our mid-30s. Wife wants to turn homemaker, and have kids. I'm without any kind of support network. I make decent money in tech (120K+) so should be able to support a family. But feel overwhelmed. I thought my mid-30s was going to be my last chance to do something entrepreneurial. If we have a kid and just my income, that dream is gone. Any one else go through something similar? <comment><USER2> I hate to write this but you come across self-absorbed. I would have hated to be married to someone like you - "isn't as intellectual as me", "demands a lot more time", "emotional stress", "couch potato", "unlikely will find a job", "wants to turn homemaker ..". Just the number of negative expressions you used for your wife is staggering in a short little paragraph.

It appears that you see her as liability rather than asset. First, change your outlook toward your wife. If you can't value her properly, you are not going to value anyone else either. Startups require lot of sacrifices not only from you but also from others involved. Spouse and family do the most sacrifices to achieve entrepreneurial dream of a family member. Putting them down is not going to get you far. Learn to respect what others bring to the table.

I will suggest you forget about being "entrepreneurial" and focus on salvaging one project "Your wife, your marriage, and your relationship". Once you recognize the positive qualities of your spouse then talk about growing the family or becoming entrepreneurial.

 _ed: Apologies for being rough in my response. The OP just touched a raw nerve._

<comment><USER3> This response is a bit "rough", but I had more or less the same impression. I don't think this question was about being an entrepreneur and how to do this if you have a family.

The question is about what kind of girl you'd like to have instead of your wife. Or at least, that's how it comes across...

</comment></comment><comment><USER4> You need a marriage counselor, not advice from HN. You should also know that your 30s are not "your last chance to do something entrepreneurial". If you believe tech's ageist memes, I've got bad news for you: you're 10 years past what vocal tech morons think your prime was.

<comment><USER5> Of course, we do not know the author's exact situation, but this is the impression I got as well from the posting: he is unhappy with the status quo. Blaming the author for being "self absorbed" is counter productive, it always takes two people to make the marriage work, and the wife is just as responsible. Marriage counseling seems a very good option.

</comment></comment><comment><USER6> I don't want to go all Dr. Phil on you, but you have to sort a couple of things out with each other. Your wife isn't going to have kids, you both are. Before anything, make sure you get on the same page about having children. The responsibility is bigger than anything entrepeneurial you'll ever do, but so are the rewards. I'm like you, mid-30's, no succesful startup just yet, but I have two children. They're my no. 1 priority and inspiration. They don't stand in the way of working on my startup, although they delay the work somewhat, but I don't mind that.

Having kids is awesome if you're (plural!) ready for it. It also doesn't mean giving up on your dream. I work 4 days a week, I take care of the kids 1 day a week and the weekends, and work on my startup while commuting and on some evenings. It's perfect like this.

Whatever you decide, good luck. Shoot me an email if you ever want to chat about parenthood and startups!

</comment><comment><USER7> Sure, I'm in my mid 40's, married, bunch of kids, full time job. I've been involved with (failed) startups and side projects. I've also made a few things I'm proud of even if not hugely successful. Having a family definitely brings more pressure and time constraints but also a lot of benefits. It's not the end of life if you don't make it big in your 30's.

</comment><comment><USER8> This is not your last chance to so something entrepreneurial, but it is getting close to her last chance to start a family. (And quite frankly, for every year you continue to delay having kids, the physical stress of raising them is going to get that much more difficult. Much easier to handle a toddler at 30 than it would be at 35 or 40.) Your wife's desire to have children is not a hobby or an affectation, it's the human condition. Do what's best for your wife and children, and you'll be rewarded many times over.

As a bonus, you will quickly develop the ability to survive on far fewer hours of sleep per day. That'll come in handy when you're starting new ventures in the future...

</comment><comment><USER5> I think it's really up to you. If you do not feel comfortable being a sole provider for a stay-at-home-mom and a kid, do not do it. There is no point in doing something you feel forced into, nor will it bring peace into marriage. Resolve your marriage problems before jumping into irreversible decisions.

<comment><USER9> Second!

</comment></comment><comment><USER10> In order for your marriage to work it is likely that you will need both make compromises to create a life that you both can be satisfied with. You'll only get this through a lot of open communication with your wife.

I am really troubled by the fact that the first thing you mention about her is that she isn't "as intellectual" as you are, not to mention the other negative things you said about her in your post. I think those are all things that you need to pretty quickly determine whether or not they are a big deal to you. If they are, then this marriage is in for a rocky future.

Also, please don't have kids to try and fix your marriage. Get your troubles reasonably sorted out before you even think of bringing children into that environment.

</comment><comment><USER11> Hey there,

I'm in pretty much the same spot except that my wife and I had multiple children last year (yes at the same time). A few pieces of advice:

\- Having children will test your marriage like nothing before. If you are not happy now, consider that you are going to be even less happy in the future. The children will bring you boundless joy, but don't expect that to make your marriage better. Just my experience there.

\- Now that I am able to get some sleep again, I find that the quality of my ideas has improved. I have a lot less time to work on them, but the dream is not gone. I also found a job that allows me to work from home and provides a good pay with equity.

\- Your salary will suddenly feel like it is not enough. But it is. Consider what your parents raised you on and what sacrifices they may have made. My mom raised three of us while learning english and going to college. It wasn't easy. She made a quarter of your salary after getting a degree.

\- It is overwhelming, but like any test, you will find out who you are in the process, for better or for worse.

My wife has gone through that couch potato phase. I think that you have to get her to find something that will break the depression she is possibly going through. Help her to become motivated.

You are not alone.

</comment><comment><USER12> I'm in my mid 40's married, two kids, one in college. I am working a day job and a doing my own startup. I try to stay fit and stay away from sick people. Wife works but makes 1/3 what I make so it's going to be a hard transition if I decide to go full time startup, but its there. Don't worry about it, just do it.

</comment><comment><USER13> My advice is to get a job at corporation that pays twice or more than your current income. Just keep asking for this much and sooner or later someone will agree. When you'll see piles of money, more than you ever dreamt of needing, flowing in for doing easier things than you do today you'll stress much less about percieved inefficiencies of your wife and life. I was in similar situation to yours and used to sob on my birthdays and other yearly occasions. It all ended once I began to earn absurd amounts of money (for my standards). It really helps to earn more than you need to see how useless money is to shed of the fear of not getting rich disguised as ambition.

<comment><USER5> What a great advice - if you are feeling financially insecure, and feel like you have no support network - just get a job at $240K +. Why doesn't everyone just do that?

<comment><USER13> I'm not sure about exact numbers, but when you are 30 something and ask for a lot of money people are thinking you are worth it and the only question for them is whether can they afford you or not. And suprisingly some answer "yes" to that question.

</comment></comment></comment><comment><USER14> If I had to choose between having kids and starting a company, I'd choose the kids with no regrets. Startup life is overrated.

</comment><comment><USER15> Honestly, it's a myth that being an entrepreneur is the exclusive domain of the young. People in their sixties have successfully founded companies. Never let anyone tell you you're too old.

Having children, on the other hand... it would be great if the same were true there, but unfortunately biology dictates otherwise; this really might be your last chance for that. Besides it seems like this is also the time when your wife needs a break from the office grind. Maybe she'd feel like getting back to that in later years when children are grown up.

So to be honest, it sounds to me like she's right, this is the best time to have children, and think about the startup game at a later date.

<comment><USER16> To add to that, I don't think that having children precludes entrepreneurship or taking risks. There are plenty of counter-examples.

While kids are indeed an added financial responsibility (though when they're young, they don't require much), they can also help turn you into a more disciplined worker who makes more efficient use of the free time that they do have.

I recommend listening to the Bootstrapped with Kids podcast [0] for a window into this world.

[0] [http://www.bootstrappedwithkids.com/](http://www.bootstrappedwithkids.com/)

</comment></comment><comment><USER17> Having kids doesn't prevent you from being an entrepreneur. Many of my startup founder friends jumped in despite toddlers. And you've got time--nothing will stop you from self funding a startup at age 60.

By contrast, biological clock can stop her from having kids in about 3-5 years. She's likely wired to ramp up focus on wanting this. Shut up and make babies.

</comment><comment><USER18> someone who built India's largest private pharmacy network - Guardian Pharmacy - once told me that the key to a _sustained startup marathon_ is to make sure that your lifestyle does not worsen by more than 30%. So if you used to eat out three times a week, you should be able to eat out twice.

this holds true at any point in your life - whether you are a 20 year old doing a ramen startup or a 30 year old with kids. If you have the financial nest egg to be able to maintain a lifestyle at 70% of your original, you should do fine. Now, the way to achieve it is harder - this means that even when you are earning, you are proactively saving a lot ... which means not buying that latest gadget that your coworkers are buying.

This is very, very hard.

In short - dont worry... if you can save.

</comment><comment><USER19> Two important issues to keep in mind:

A) Wife is going through a _lot_ of stress as she has been let go and if she wants to work again is going to have to accept a significant demotion.

B) Wife is in her mid-30s and is rapidly approaching an age where she needs to have kids (if she wants them).

</comment><comment><USER20> Actually, I would advise you to get on and have the children earlier. Do you want to be an old Dad, straining to keep up with your kids?

I now have two children. I kind of wish I had had them earlier. When you are younger you have way more energy.

</comment><comment><USER21> Your chance to be an entrepreneur has a lot more years left in it than her chance to have kids. In her mid 30s, it's her final years to ever have them (with good odds to have them be healthy at least).

</comment><comment><USER22> I've raised a family of 3 kids, and never had anything but entrepreneurial jobs. Even started a couple. Choose the kind where you get paid. Simple as that.

</comment><comment><USER23> /r/firstworldproblems</comment>


Why add node modules to your versioning - <AUTHOR> http://blog.robertonodi.me/why-add-node-modules-to-your-versioning/

<comment><USER2> Great article.

I would love to see the bad side of adding them to your repository, for example, working with Linux and OSX developers at the same time.

<comment><AUTHOR> Thanks. I myself use Windows and lots of projects I worked on are running Debian in production. There were a few times you can see the bad side of it, but it always depends on your needs. A quick example would be with sqlite on windows and unix, but this is solved with pre-deploy preparation. Remember that we are talking about production and not development.

<comment><USER2> Thank you for your reply.

But anyway, adding them to your repository, is development domain, right?

How do you handle adding modules with binary to your repository? If you're using Windows to develop, and Debian to production, what is exactly you pre- deploy preparation to fix this?

<comment><AUTHOR> Regarding to development it depends on your needs and how mixed is your development environment (is everyone on a Unix system, or you can have Linux/Mac/Windows)

If you are concerned about mixing you binary with source in a repo you can always use `npm install --ignore-scripts` this should download modules without building them and add them to your repo afterwards, followed by a `npm rebuild` and adding created files to `.gitignore`

For the pre-deploy preparation what I'm doing now is preparing everything in a separate location (pre-deploy path), pulling new code rebuilding it if necessary, running tests if all went ok the code is moved to the final deploy path.</comment></comment></comment></comment>


Coding is not Computer Science - <AUTHOR> http://westoque.com/2013/09/20/coding-is-not-computer-science.html

<comment><USER2> The comparison between coding and computer science is kind of like saying that 10% of your code runs 90% of the time, which is usually true. Computer science is the 100% but coding is the 10% that gets to run on hardware.</comment>


An introduction to 3D on the Mac, Part I: models & textures - <AUTHOR> http://arstechnica.com/apple/guides/2009/12/intro-to-3d-part-1.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss <comment><USER2> Wow, that's just part 1? Really impressive content, better than several books I have on the subject. Ars Technica continues to impress.</comment>


Accessibility at Trivago - <AUTHOR> http://tech.trivago.com/2017/09/26/accessibility-at-trivago/ <comment><USER2>
                    Please upgrade your browser

We're sorry, but we no longer support this version of your web browser. Please upgrade to a new version to be able to access our site.

Download browsers here [[http://outdatedbrowser.com](http://outdatedbrowser.com)]

       trivago Copyright 2017 trivago | All rights reserved.

Nice.

Possibly someone is trying to make guesses based on User-Agent header? Then coercing user to install certain third party software?

In any event, the result is: if "wrong" User-Agent header, then _no access_.

Moreover, robots.txt does not list the UA header I used to test accessibility.

Idea: If website authors prefer certain browsers to be used, then provide machine-readable list of acceptable browsers. Better yet, provide list of acceptable User-Agent headers.

(Is this list provided by outdatedbrowsers.com? Not quite. For example, curl works fine and it is not listed.)

IMHO: User-agent header is a header not a browser. As in the old adage that "an IP address is an IP address assigned to an interface, not a computer."

The fact is, in some cases, the user is the only one who really knows what "browser" she is using.

</comment><comment><USER3> I think the move towards accessibility is great. I didn't know about pa11y so will probably bring it (or something similar) into our own build cycle to help keep track of WCAG issues.

We also find it's useful to test out the core functionality using the keyboard, but extend that to using a text only browser and Chromevox so we can get a feel for what user stories would get broken if JS breaks, the user is trying to use the tools in older/incompatible browsers or the user has visual impairment. So far, it's been quite enlightening and we've not run into anything within the core functionality that couldn't be fixed with better UX and competently written HTML.

<comment><AUTHOR> For what it's worth, ChromeVox doesn't see much use from users of assistive tech. If you don't want to pay for JAWS you're better off testing with NVDA on Windows or VoiceOver on Mac / iOS.

<comment><USER3> Thanks for the info! We may well switch over if that's what users are more likely to be using.

<comment><AUTHOR> It's very difficult to tell what people are actually using as assistive tech interfaces with browsers rather than connecting to the site directly, but you can run surveys. We did one last year on GOV.UK and found JAWS at 38.5%, ChromeVox at 1%: [https://accessibility.blog.gov.uk/2016/11/01/results-of- the-...](https://accessibility.blog.gov.uk/2016/11/01/results-of-the-2016-gov- uk-assistive-technology-survey/)

<comment><USER3> Again, thanks for the information. I'll definitely take that back to my team and see what we can improve on!

<comment><USER4> To provide some practical reasoning behind this: ChromeVox and software like it, naturally, runs in the browser. A blind person is unlikely to have a visual impairment which means they can't use a browser but can use every other part of the system without speech feedback. Therefore, system-wide screen readers see much higher use - who wants to keep switching between screen readers all the time?

On the plus side, though, keyboard predictability breeds accessibility, so any testing in this area is often better than none.

</comment></comment></comment></comment></comment></comment><comment><USER5> I am a little sceptical of using A/B tests on accessibility features. What, precisely, is being measured here?

The acceptance criteria for accessibility features are narrow to a specific group of users (actually, the users fall on a continuous spectrum). Furthermore, there are legal, ethical and moral obligations. Would those be thrown out if the A/B test was a fail?

<comment><USER6> > Would those be thrown out if the A/B test was a fail?

It sounds like it, yes.

> there are legal, ethical and moral obligations.

From the evidence in this article, Trivago don't give a shit (or didn't)

<comment><USER7> In these cases, no, they wouldn't be thrown out. The aim is always to accept accessibility changes but they still need to be tested first, just in case they have negative affects which would need further investigation to be fixed.</comment></comment></comment>


Stainless - A multi-process, Webkit based, browser for OS X inspired by Google Chrome - <AUTHOR> http://www.stainlessapp.com/ <comment><USER2> I just kicked off a long-running javascript function in it, and it locked up just like Safari or Firefox.

</comment><comment><USER3> There's pretty cool pop-up effect when you click on "screenshot" link.

</comment><comment><USER4> It froze my computer when I was using Rososo - ouch.

</comment><comment><USER5> Does it include Squirrelfish Extreme?

<comment><USER6> Presumably the question is whether it uses squirrelfish or V8, as it says its "inspired" by Chrome? Does inspired mean, "Wow, google made a browser from webkit" or does it mean that they base a lot from the chromium source code (a forked os x version of chrome?)

<comment><USER7> More like the former than the latter.</comment></comment></comment>


Marriott Concedes 5M Passport Numbers Lost to Hackers Were Not Encrypted - <AUTHOR> https://www.nytimes.com/2019/01/04/us/politics/marriott-hack-passports.html <comment><USER2> Will they be penalized? Was Equifax ever penalized?

The cost to them so far is some bad PR which will probably blow over. Especially for companies like Marriott and Equifax which have near monopolies (Marriott owns several smaller chains like Starwood and Ritz Carlton), this probably won't affect their customer loyalty. Particularly when it's safe to assume that the other chains are probably not doing a better job.

Marriott currently has no incentive to spend money to do a good security audit.

They had incentive to do their recent migration of loyalty programs, since Starwood's program was notably generous.

<comment><USER3> >Will they be penalized? Was Equifax ever penalized?

No and no.

Our Federal government is beholden to special interests, so no real legislation or regulation addressing this issue will ever occur. If Equifax (a brace of our economy) didn't receive the death penalty for what they were responsible for, nothing will occur to any future company.

<comment><USER4> I've been on the inside of some leaks and associated internal investigations. There may not be an external penalty, but these are a serious internal headache. You often have to bring in external people, who then always see the worst in everything. The board has to be kept up to speed. The meetings and late nights pile up. The absence of external penalty doesn't mean that those on the inside don't care. I'd say that most corporate infosec is motivated primarily by the desire to avoid internal investigations. Avoiding the need to report anything to shareholders and/or corporate partners comes second. External penalties is a distant third.

<comment><USER5> That's only motivation for InfoSec, though. The CEO has to be motivated to practice good security by the bottom line implications; if having a security incident means less profit, a conscientious CEO will make sure to mitigate that risk, or at least factor it into the tradeoffs of what to do.

Without any significant monetary threat, the ultimate cost of security breaches to a company isn't truly a big deal.

</comment></comment></comment></comment><comment><USER6> Nothing was 'lost'. A misplaced laptop is lost; records from a database are accessed (or 'stolen', but I think that's problematic as well). The fact that the access was possible says nothing about the hackers and everything to do with Marriott's security approach and posture. Can we please stop letting companies hand-wave away these attacks and stop solely blaming hackers?

I've worked with hundreds of companies' security teams. While I've seen a select few companies do a really great job, most were either negligent, incompetent, or both. I'm sick of the blame for this being laid solely at the feet of the abstract "hackers", rather than the people who make these attacks _utterly trivial_.

(Posted from a throwaway because Marriott may or may not be a customer of mine. Ugh.)

</comment><comment><USER7> Throughout my travels my passport number has been copied with an old school copier, entered into excel spreadsheets and held on to by various shops for collateral.

Not saying this isn't a shitty hack, but I feel like the passport is the least secured document attached to me I have.

<comment><USER8> I thought you should never, ever give your passport to anyone, especially for collateral. Right?

<comment><USER9> Dunno, depending on your country they can be pretty easy to replace and they do tend to work quite well as collateral.

This entirely depends on your situation, for example I don't think there are many places where it'd be a huge deal for a white westerner to lose their passport.

<comment><USER10> Are you sure you're not conflating IDs with passports?

Though, yeah, in Germany at least it's quite easy to replace passports

</comment></comment></comment></comment><comment><USER11> I would've thought by now the security consultant industry would be really robust and large corporations like Marriott would be advised to handle low hanging fruit like "encrypt everything". Anyone know the current state of the industry?

<comment><USER12>
      Anyone know the current state of the industry?

Large corporations are run by business majors who often have a disdain for computer science. Usually this leads to not hiring the top security experts (either through lack of knowledge or not wanting anyone smarter than themselves at the wheel).

I've personally seen this at a few jobs. It can go both ways as often CS-saavy startup founders are the same way towards business majors.

<comment><USER13> I think it's mostly the fact that the cost of data breaches is less than the savings (i.e. profit) from not implementing rigorous systems.

<comment><USER12> FREE and OSS CMS' encrypt customer data now.. Don't know where this myth that it costs money to do basic encryption is coming from..

<comment><USER14> It's not only the cost to encrypt something. It's the cost to create security policies, hire people who know the field, implement protections beyond encrypting data at rest, updating old software to deal with the new security measures, etc. It's never as simple as "just encrypt that field".

Until there's a good reason to do so people aren't going to bother.

</comment></comment></comment></comment></comment><comment><USER15> Why do they even have that many passport numbers saved in any format? I get what a spy organization could do with that information. What does a hotel organization do with it?

<comment><USER16> > _I get what a spy organization could do with that information. What does a > hotel organization do with it?..._

Give it to the spy organization.

Not being snarky. That was meant as a serious comment. Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel?

<comment><USER17> At least within the EU, it is required that hotels record the passport numbers of people who stay with them for potential future law enforcement use. Most countries just require the data be kept on file at the hotel, but a few regularly collect it in some kind of central database.

<comment><USER18> And, especially with a big chain, I assume that any information they collect (especially if they're required to collect it) gets put in a centralized database rather than depending on a paper copy being properly filed in a file cabinet someplace.

Somewhat OT but I was in Europe last month on a business trip. There's a knock on the door one evening. Imagine my surprise in discovering it's someone from the hotel who has come up with a few edible goodies for my birthday. On the one hand, it was a nice gesture. On the other, I was a bit taken aback. Where did they get that info?

I didn't really want to ask but a friend of mine later reminded me that they probably got it off my passport. I suppose this might have just been an informal process at this particular hotel. But I wouldn't be shocked to learn it was put in the chain's database.

<comment><USER19> How does GDPR play into the requirement to store passport numbers?

<comment><USER9> It plays. The way these hotels are doing this maybe probably isn't GDPR compliant, but the same applies to vast amounts of other things.

Hard to share any very useful insights on this, it's just the state of most things.

<comment><USER19> Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like? Can hotels be fined if they're found to not be GDPR compliant?

<comment><USER9> >Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like?

I'm not quite sure what you mean, but the answer is probably no.

>Can hotels be fined if they're found to not be GDPR compliant?

Sure, but is anyone GDPR compliant yet? I'd imagine that all the DPAs in EU are extremely busy right now.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Is anyone surprised that assigning numbers to people to identify them seems to backfire every time it's tried?

<comment><USER21> There is no problem with assigning people a number. the problem is that people start using that number as Verification, not as an identifier.

People treat your SSN as a password, when really, it just uniquely identifies you. Its basically an Email Address, not a password.

<comment><USER22> Don't use any service that considers SSN a verification.

<comment><USER13> Functionally useless advice if you ever have to deal with mobile networks, internet service providers, financial institutions, utilities' providers, any government, schools, universities, and the list goes on.

<comment><USER22> Those services take the SSN as _proof of identity_ and not just identity?

Wouldn't most people's SSN's be leaked already so using SSN rather than proper ID isn't much better than nothing?

<comment><USER13> Yes, when you call customer service you're usually asked to provide your SSN to verify you are who you are.

Some are finally requiring a PIN or passcode, but very few in my experience.

<comment><USER22> Providing you SSN identifies you no better than your email address or postal address. It's not a secret number. There may be a provider that has a 2FA. It should be a cheap way for them to get more business.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> Note that encryption at rest isn't a panacea. Since every system that accesses the data needs to have the decryption key, if the hacker is getting the data by hacking one of those systems, then the encryption at rest has achieved nothing.

<comment><USER24> Not a panacea, but always required. All disks eventually are thrown out. It doesn't prevent all attacks, but it's the only way to prevent a very common class of attack.

<comment><USER23> Yes, it's generally a good idea, even if it won't protect against most breaches.

There are also certain types of encryption at rest where it buys you absolutely nothing though, e.g. using AWS' builtin encryption at rest for S3. No one is going to break into the AWS datacenter and steal the data from the physical disks.

<comment><USER24> AWS decommissions hardware like anyone else. While I'm sure their processes include a secure-delete, no process is perfect and things are missed. It's worth setting the flag, especially since it's free.

</comment></comment></comment></comment><comment><USER25> Why does Marriott have passport numbers to begin with?

This really comes down to companies simply collecting way too much information. Consumers need to push back against this type of data collection. Only give information which is clearly required for their business and nothing more. Also the companies should only retain that information for long enough to conduct their business.

<comment><USER26> A lot of countries require hotels to collect information that proves that the guest is there legally.

<comment><USER27> In my country hotels are even required to make a photocopy of the passport/id when a Traveller checks in. Having your id being public is not more of a security issue than your name being public.

</comment></comment></comment><comment><USER28> Needs to be substantial penalties for these transgressions or it's just another "cost of doing business".

<comment><USER29> A lot of these are likely to have been from EU residents, so there certainly could be some very large fines coming their way, courtesy of the GDPR.

<comment><USER22> Wow, I didn't think about that - it applies to EU citizens even when not in the EU. And for a few types of business you _have_ to have physical presence where you operate (hotels is one) so the EU can always force Marriott to pay up or extort the money from their business in the EU.

</comment></comment></comment><comment><USER30> Curious question. How they could encrypt this information when managers at help desks in the hotels need that information, say, for verification? Isn't it steal password from temporary worker will be super easy anyway?

<comment><USER31> You can decrypt the encrypted info, which is what you want to do with PII at rest, which I'm _assuming_ is where the data was taken.

</comment></comment><comment><USER27> Why is having a person's passport number a security issue in the first place? What could a malicious person do if they have your passport number?

<comment><USER32> Unfortunately passport number is considered semi-secret to the point where you can retrieve very personal information with it or with a tiny amount of extra info such as last name + passport number. Passport numbers are also permanent, until replaced.

Or to put simply: Passport numbers make identify theft easier.

</comment></comment><comment><USER33> Uh, was in China more the once so I think if they are responsible it is not something they do not have ;)

I think I have become numb to this stuff. I just assume it's all out there and thus keep an eye on my credit reports, et.al.

I am more pissed about the basic level of OPsec I see at these companies. I am even more worried about the same thing at our Defence contractors and related companies.

</comment><comment><USER34> It seems law and regulation are going to have to clearly define and constrain what these organizations are allowed to collect _and what they are not allowed to collect -- or, rather, that everything else is off-limits._

Guests need to be offered the question of whether they care to share X data, and guaranteed that a "no" answer will not affect their ability to do business and receive services in the slightest -- nor the price they receive.

Many people scream bloody murder WRT regulation. However, here we have a clear and repeated industry failure -- one with significant knock-on costs and risks.

So, tough. You failed.

I could also cough up a protest on my part against the whole misleading notion of "self-regulation". _And_ point out that in an era of increasing consolidation into brands under very few and very large holding companies, effective competition -- including and with respect to data and security practices -- is largely absent.

P.S. Where data collection is required, standards and aggressive auditing should be funded and enforced.

People in the U.S. generally seem to have no problem with FDA regulation and inspection of meat production. (Not realizing how industry political initiatives continue to stress and periodically threaten this, e.g. inspection budgets.)

Well, it seems we're to the point of needing and FDA for data, or something like.

I say this with trepidation. And any initiative should come with a healthy dose of "audit the auditor", to keep requirements and process transparency to a maximum and minimize the governments' own carve-outs and attempts to siphon off the data whose processing are under inspection.

Back to my accounting days. How do you prevent mistakes, error, and fraud? Well, orthogonal processes with robust cross-checks certainly help.

<comment><USER35> The only reason the hotels are collecting passport numbers in the first place is _because_ of regulations requiring them to.

<comment><USER13> It also helps verify against people causing damage to the hotel. Business where the transaction is not a simple "seller provides item - buyer pays seller" have different risks involved, and therefore need to additional measures to protect against them.

Requiring credit cards, government issued photo ID, age over 21 are all methods of preventing guests who trash rooms, sneak in pets and cause noise disturbances, underage partiers, pimps and hookers, drug dealers, excessively dirty and causing pest problems etc from messing up the business. Same with car rentals and flights. Some people are problematic, and it affects other customers, and you need a way to mitigate the problem.

In the US, almost all local ordinances require hotel operators to keep track of who is staying in which room for a year or so (some even require photocopying, although that's not always followed), and to hand over that info to police whenever they demand it.

</comment></comment></comment><comment><USER36> Until someone is held responsible, big corporations would not care about customer's data. It probably cheaper to give everyone a year of credit monitor (which not everyone used) than implement security to protect customer's data.

This data breach is reporting every week, yet nothing is being done.

</comment><comment><USER37> Any data we turn over to companies should be treated as compromised. There should be a way to issue new SSNs. Things that can't be changed like birthdays, addresses, and last names shouldn't be stored by companies without very good reason.

</comment><comment><USER38> If you're doing a new startup, and have aggressive timelines, what security measures would you implement to protect PII from day 1? I'm an experienced dev but not a security expert.

<comment><USER23> Two factor authentication for all developer accounts, require TLS 1.2 to access the website and add HSTS, have some system for ensuring all SQL queries are sanitized, use bcrypt or scrypt with recommended settings to hash user passwords, add a content-security policy, enable secure and same-site attributes for cookies, as well as http-only, and add a double-submit csrf token. That should cover the basics to start with, in rough order of priority, assuming you're building a web app.

Also, in general, be conservative about what PII you collect; hackers can't steal information you don't have.

</comment></comment><comment><USER39> They will be punished in European Union where they have business presence. They had EU passports there. Under GDPR negligence is punishable.

UK ICO hopefully will intervene in few months.

In USA remedy actiona are class action lawsuit driven and corporations do not have incentive to change their behaviour.

</comment><comment><USER40> I logged into Marriott to change my password... and I couldn't. Their web page responsible for changing password times out. What kind of POS system is that?

<comment><USER41> Seems like you've been out of the loop. They've been experiencing massive computer problems since August.

[https://www.wsj.com/articles/inside-the-marriott-starwood- lo...](https://www.wsj.com/articles/inside-the-marriott-starwood-loyalty- program-turbulence-1543416010)

</comment></comment><comment><USER42> Companies should not be allowed to have such sensitive data or the punishment should be severe - I mean the entire board should look at doing time. Currently as the law is, the rich can just laugh and carry on.

</comment><comment><USER43> What can malicious people do with my passport number?

<comment><USER44> Create a fake passport to travel under your name and commit crimes. Try not to be surprised when you discover an arrest warrant in your name for sex trafficking in Belarus.

<comment><USER18> Not that one wants this sort of information to be leaked of course, but it's hard to see information that is routinely copied by hotel desk clerks and which is written down on countless forms is deeply sensitive information that will cause dire outcomes if it gets out.

<comment><USER45> You mean like your bank account number, which is constantly typed into online forms of all sorts of websites. Or your credit card number, which you probably say verbally into the phone to pay your bills?

Truth is, lots of extremely sensitive data exists in insecure states all the time.

<comment><USER18> For that matter, your bank account number goes on pieces of paper called checks that many of us give to individuals and companies all the time to pay bills.

So, yes, I draw a distinction between numbers that we hand out willy-nilly and truly sensitive information. There's a big difference between my checking account number and my health records.

</comment></comment></comment></comment></comment><comment><USER46> Now chant with me... GDPR... GDPR... GDPR...

</comment><comment><USER47> And to which software sweatshop was the IT out sourced to ?</comment>


Say No to the "Cashless Future" – and to Cashless Stores - <AUTHOR> https://www.aclu.org/blog/privacy-technology/consumer-privacy/say-no-cashless-future-and-cashless-stores <comment><USER2> The thing I don't like about the move to cashless most, is that it is very much centered around payment systems in the private sector. It makes the middleman compulsory. Our Australian government is moving to make all payments over $10,000AUD cashless only. Thus making middlemen practically compulsory. If government wants to seek their means of deanonymisation for money laundering, make sure that there's an easy way to do that without middlemen taking a cut.

<comment><USER3> > If government wants to seek their means of deanonymisation for money > laundering, make sure that there's an easy way to do that without middlemen > taking a cut.

Ah, but that would mean their mates at the big 4 would not get their fat bonuses.

</comment></comment><comment><USER4> Cash is freedom in ways that the "bank payments society" [1] (which people refer to with the euphemism "cashless") can never be. Cash is also resilient in ways that the "bank payments society" cannot be.

"In Praise of Cash" [1] is a fantastic essay on this. HN discussion on that from 2017. [2]

[1]: [https://aeon.co/essays/if-plastic-replaces-cash-much-that- is...](https://aeon.co/essays/if-plastic-replaces-cash-much-that-is-good-will- be-lost)

[2]: [https://news.ycombinator.com/item?id=13782561](https://news.ycombinator.com/item?id=13782561)

</comment><comment><USER5> I am not an economist, but in this world of negative interest-rates (now common in Europe), another reason for cashless is to prevent people from keeping cash at home, behavior that make sense when the bank is making you pay for having a positive account.

And as a cryptocurrency enthusiast, this cashless trend is also a way to make it harder to hide your crypto assets: hand-to-hand exchange of cash against crypto is indeed one of the best anonymization way.

<comment><USER6> It's basically a way to make bank runs illegal.

<comment><USER7> You have to pull out cash from the bank for a bank run to occur. Can't you buy gold or some other cash substitute instead?

Could be even more difficult to detect than abnormal spike in cash withdrawals via ATMs.

<comment><USER8> Spending money is taking money out of your bank account. Any event where more money leaves a bank than they have reserves to cover it is a run on the bank. I think what you may be elluding to is that digital transfer of funds makes the effects of a bank run different than than when cash is involved, since real money in hand cash is much more limited than a bank's total reserves.

</comment></comment></comment></comment><comment><USER9> This seems silly. Accepting cash endangers the lives of employees and generally enables all sorts of financial shenanigans. Rather than attacking the business, the ACLU should address the structural issues that prevent people from participating in the mainstream economy.

<comment><USER10> >> Accepting cash endangers the lives of employees and generally enables all sorts of financial shenanigans.

Financial "shenanigans" seem to be more likely with credit/debit cards actually.

<comment><USER9> There's something like 2 trillion dollars laundered annually, and a lot of this happens through shops that use anonymous cash transactions to do it.

<comment><AUTHOR> Source?

<comment><USER9> > "The estimated amount of money laundered globally in one year is 2 - 5% of > global GDP, or $800 billion - $2 trillion in current US dollars. Though the > margin between those figures is huge, even the lower estimate underlines the > seriousness of the problem governments have pledged to address."

[https://www.unodc.org/unodc/en/money- laundering/globalizatio...](https://www.unodc.org/unodc/en/money- laundering/globalization.html)

<comment><AUTHOR> I meant source for "a lot of this happens through shops that use anonymous cash transactions".

$2 trillion in $10 bodega transactions is 200 billion bodega transactions. Something tells me it's not the silver in the till that's the main problem. Or even the notes.</comment></comment></comment></comment></comment></comment>


My senior project: Cura, remote systems administration from your Android phone - <AUTHOR> http://freecode.com/projects/cura would greatly appreciate feedback, suggestions <comment><AUTHOR> would greatly appreciate some feedback, suggestions</comment>


Guide to Starting with Clojure - <AUTHOR> https://grison.me/2020/04/04/starting-with-clojure/ <comment><USER2> I'm fulltime Clojure since 2014, and I can't say enough how happy I am. I find a lot of joy, every day, in my work as working with a LISP really fits with how my brain think.

The community is great and the language leaks through the people: you'll often find very pragmatic (even conservative) approaches.

If you are looking for some more testimonials, look no further than Uncle Bob [0] and Gene Kim [1], but there's several more results online.

Lately, I tried to "modernize" a little bit the Clojure course that I used, many years ago, to start, and you can find it at [2]:

\- [0]: [https://blog.cleancoder.com/uncle- bob/2019/08/22/WhyClojure....](https://blog.cleancoder.com/uncle- bob/2019/08/22/WhyClojure.html)

\- [1]: [https://itrevolution.com/love-letter-to-clojure- part-1/](https://itrevolution.com/love-letter-to-clojure-part-1/)

\- [2]: [https://heliosmaster.github.io/academy/](https://heliosmaster.github.io/academy/)

</comment><comment><AUTHOR> Author here:

I recently gave a talk at work to show why Clojure is a good fit and show some of the possibilities and its ecosystem.

People got interested and wanted to try stuff but were overwhelmed with what to choose (lein, deps, boot) which editor to use, what's a REPL, why should I use one, how to use it (from the IDE) and some other stuff like where to learn Clojure.

So I decided to write an introduction regarding all that (covering IntelliJ & VSCode since it's the tooling people use at work). Don't hesitate to give feedback as this surely can be improved.

Note: it doesn't cover ClojureScript but I would be glad to cover it in the same manner in another post.

<comment><USER3> The site looks very slick. I like the end-to-end shaded background on code blocks.

Regarding content, it is very hard to write this kind of introduction because there are so many choices on how to set up the first project and most of those choices would be completely unfamiliar to those comming from other languages. My only recommendation would to set up a repo that would bootstrap the process, or direct people to Maria [0] CLJS notebook so they don't have to deal with compiler, REPL and unfamiliar IDE while also learning language.

[0] www.maria.cloud

</comment></comment><comment><USER4> Thanks for sharing the nice write-up! It's a bit more in-depth than the "hello world" tutorials out there, and mixing in a few dev tools and workflow hints is a nice touch. I'm still learning Clojure (dipped in and out over the last few years), and found a few gems that weren't covered elsewhere.

Visually- and organizationally well-done, too! The slang for JAR ("Jean- Michel") was a hilarious touch to include...

On related notes:

\- (ref. some of the comments and your "next steps" list) Another resource for newcomers is Clojure Koans ([https://github.com/functional-koans/clojure- koans](https://github.com/functional-koans/clojure-koans)). It's very easy to use these to learn and refresh, even a few minutes at a time. During the recent stay-at-home period, I've actually had my kids (12 and 15) do these exercises, and even used it as an opportunity to start teaching them about git, so they can share their work with me in segments.

\- (for anyone hankering to write something) I think one thing that is still not well-served for relative newcomers is doing webapps. The examples I found talking about Ring and Compojure were either dated in terms of dependencies or were a bit obscure in that there were both new concepts and syntax introduced at the same time, without a lot of explanation ("it's all in the docs" is not as helpful when you're new to the language, the idioms, and the frameworks all at once).

<comment><AUTHOR> It was a goal of mine to have up to date knowledge in it, latest deps and so on. I would be glad to write something else on writing web-apps with Clojure.

Thank you for your great feedback, I've added a clojure koans to the list of resources at the end of the guide and keep on learning and building Jean- Michels :) !

</comment></comment><comment><USER5> I think this guide is great! If we want people to use clojure we can't impose emacs on them too. This guide introduces clojure from where most developers are at.

</comment><comment><USER6> Clojure really needs the equivalent of Portacle; self contained directory with everything in it that's needed to just start coding without faffing about.

</comment><comment><USER7> After you start with Clojure, I can recommend doing the problems on [http://www.4clojure.com/](http://www.4clojure.com/). I had a lot of fun doing the problems and learning from solutions from others.

<comment><AUTHOR> Thank you, I added it in the website list at the end of the guide.

<comment><USER7> Thanks for making the guide. For me Clojure is also not my primary language. As you write: It made me learn a lot, and changed how I program in other languages. There is a subtle beauty in Clojure.</comment></comment></comment>


It's started - <AUTHOR> http://ostatus.org/2010/03/04/its-started

<comment><USER3> Am I the only one that doesn't think this makes any sense?

Perhaps the programmer in me is dying, but this seems like a programmery thing to do. "Look at this cool new trend! Let's genericize it! Let's make a protocol for it for the whole web to use!" I understand that open standards are the backbone of the web. but as far as I'm concerned - that's where I think it ends. I'm sure there's a standardized system for how water/electricity/gas goes in & out of my house, but once it's there I get to decide what happens.

Perhaps I don't see any value in the web where this standard is pervasive. OK, so my Facebook status, Twitter tweets, and Livejournal musings are all on this fancy standard. Now what? It can be crawled better? It can be aggregated? Why do I care? I can't think of a single thing that helps me as the content producer or helps me as the consumer.

Maybe it's better that I wasn't around when things like CSS were first being specified. I can't say if I would have complained or not. But this doesn't seem like CSS being spec'd. This seems like someone taking note of Geocities, Angelfire, and Tripod in 1999 and proposing a DIY website publishing specification. It seems stupid.

<comment><USER4> Imagine that to read my blog, you had to first sign into your blogger account. And that to read a wikipedia article, you first had to sign into your wikipedia account. And, when you want to read your email from your AOL friends, you have to first sign into your AOL account, but to read your email from GMail friends required first signing into your GMail account. And imagine this was the case everywhere. You could even take this further and imagine that to read techcrunch, you first had to load the techcrunch browser.

To various degrees this is the current state of microblogging services (or whatever you call them). I can't read my friend's facebook updates in google reader. I can't read the boston big picture in twitter. Even if my friends wire up their accounts so that their tweets end up in facebook, my facebook replies don't appear in their twitter stream. It's a big bucket of suckage.

As a user, I don't care about _how_ the electricity gets to my house, but I really really care that all my appliances can use that electricity, not just the ones that PG&E made. So I care that someone else cares about the _how_ and standardizes this. As a publisher, I want to be able to pick my publishing platforms - maybe more than just one (flickr+twitter+blogger) - based on how well their features meet my style. I don't want to have to choose my platform based on where my readers might be. As a reader, I want to pick my reader application(s), like Google Reader, Bloglines, or Facebook, but only have to pick one or two and to pick them based on features and usefulness to me, not based on where the people I'm interested in reading publish their content.

Is ostatus important to this? Maybe not. Are open communication standards important? You betcha.

<comment><USER5> _I don't want to have to choose my platform based on where my readers might be._

That's too bad, because if you don't target your writing style to your medium you're never going to have any readers.

You're going to produce the literary equivalent of a Java desktop application: Generic, out-of-place no matter where it goes, and slightly tone-deaf, like a sentence in a foreign language that's gone through an automated translation system.

Twitter is a social space with its own rules, traditions, and capabilities. Facebook is its own thing. Blogging is its own thing. Email is its own thing. HN comments are their own thing. Get these genres confused and you're gonna pull a Google Buzz. "Oh, I can derive a social network out of people's email address books and suddenly email will work just like Facebook!" Um, no. That's creepy and wrong, because my address book isn't my friends list, and email isn't like a Facebook status update.

These days, my own favorite writing medium appears to be the HN comment. I can't really explain why. But the style is unique: This comment wouldn't work on Twitter, chopped up into a slew of 140-character haiku. It would make a poor blog post -- it's too dependent on HN context, it doesn't stand on its own, and I'm mortally afraid to try and title it. [1] It would scarcely make an article or a book -- that would require actual thought! My Facebook friends don't care about hypothetical issues in social media design. If I wanted to email this to people, what list of recipients would I choose, and how could I be sure that I wasn't just spamming them?

Electronic media haven't diversified because we're somehow unable to figure out a standard. They've diversified because people like them that way. We _like_ a variety of media, perhaps because the audience we find in one medium is never quite like the audience in another, and because the constraints of a particular medium help us to shape our creations.

\---

[1] Perhaps my problem with blogging as a medium is that blog posts need both a headline and a body. They say that every additional field in a form halves the response rate.

When I'm in the mood to write a block of text I want to _write_ , not waste time trying to sum up that writing with a pithy title and figuring out which tags to apply to it. The urge to be a writer is different from the urge to be a publisher or a librarian.

<comment><USER4> You and I don't disagree in the least. I never claimed as a publisher that I didn't want to write to a specific audience, just that I didn't want to write to a specific platform. The audience I want to reach doesn't hang out on just one reading platform unfortunately.

You use one single web browser when you use twitter, facebook, blogging, email, buzz, and HN, don't you? You are standardizing on HTTP and HTML, but you already knew that.

I am certainly not suggesting only ever using one platform to publish. In fact I specifically mentioned 3 as a strawman that I might use (flickr+twitter+blogger). They serve different writing styles, but are not necessarily different audiences. My wife might be interested in following all 3, you might only be interested in my blog. That makes sense.

In the analogy to the internet, there are a million ways to run a website: apache, frontpage, nginx, blogger, geocities, angelfire. Yet, these websites all work in the same way at some level. I can read them all in one browser (*mostly), I can link between them, I can crawl and index them, and they all participate in the same DNS system making it easy to find them.

PS: The need to choose a title for a blog post isn't really relevant - <USER2> is nothing about blogging that requires content to have specific titles. Some specific blogging packages do of course.

<comment><USER5> _You are standardizing on HTTP and HTML_

Indeed. That's an excellent point. If HTTP and HTML didn't exist, we would be compelled to invent them... as we were fifteen years ago when we _did_ invent them.

However, HTTP and HTML _do_ exist. And all these other tools are already built on that common platform. So exactly what are we trying to further standardize? What remaining problem are we trying to solve?

Because the remaining technical barriers to publishing the same text on (e.g.) Twitter, Flickr, and Blogger are very few: A bit of login hassle (ameliorated by persistent cookies), a bit of copying and pasting. You can automate even more of these keypresses away [1], but I suspect that such efforts are approaching the point of diminishing returns. Because the ultimate bottleneck to publishing the same content on multiple platforms isn't really the time required to paste it. It's the time required to _recraft_ the content to fit each different medium, and the (far longer) time which you must spend _living_ in each medium's community before you learn the difference between what is locally appropriate and what is painfully tone-deaf.

\---

[1] See, e.g., <http://www.janrain.com/>.

</comment></comment></comment></comment></comment><comment><USER6> Isn't there enough automatic duplication of content on the web already? I hate looking for a blog post and having to sift through a load of horrible feed powered link farms - can't wait to be spammed from yet more angles.

</comment><comment><USER7> I think it is incredibly stupid to collapse practice to standard before it is ready. It calcifies and damages innovation.

<comment><USER8> How many million users counts as ready?

<comment><USER7> That's irrelevant. Are you prepared to have the format never change again? That is when you codify a standard, not before.

<comment><USER8> I think there's room for different approaches to standardization. For example:

1\. Write draft spec

2\. Implement it (steps 1 and 2 are backwards from the usual)

3\. Use implementation experience to revise the spec

4\. Lock down the spec into a standard

</comment></comment></comment></comment><comment><USER9> "Hard to believe it, but the OStatus process is underway."

Why is it hard to believe? It seems like four people from StatusNet wrote up a spec and are trying to turn it into an open standard. What was the hard to believe part?</comment>


Ask HN: What are exemplary REST APIs? - <AUTHOR> There are many good resources about writing APIs, but I'm also curious what the crowd here would consider great, exemplary REST API's? Looking for things like well-structured URI's, great design of request and response bodies, useful error handling, useful and beautiful documentation - as well as dealing with real-world stuff that can make API's and REST hard (pagination, wanting to do RPC style stuff specifically long-running tasks, etc.). Any good API's you'd recommend looking at for inspiration? <comment><USER2> I have always liked stripe [1] API documentation. Its very well structured and does have a beautiful documentation.

[1][https://stripe.com/docs/api](https://stripe.com/docs/api)</comment>


Copycat – A fault-tolerant state machine replication framework - <AUTHOR> http://atomix.io/copycat/ <comment><USER2> Copycat is a complete extensible implementation of the Raft consensus algorithm that was heavily influence by some of ZooKeeper's algorithms. You can read extensively about the Raft implementation in the architecture section of the docs. [http://atomix.io/copycat/docs/](http://atomix.io/copycat/docs/)</comment>


The Dangerous Perceptions of the New FTC Rules Explained [Part One] - <AUTHOR> http://siliconangle.net/ver2/2009/10/06/the-dangerous-perceptions-of-the-new-ftc-rules-explained-part-one/

<comment><AUTHOR> First of a multi-part series explaining the dangers of the new FTC blogger guidelines for users on the web.</comment>