Details Emerge About Victoria Taylor's Dismissal at Reddit - <AUTHOR> http://bits.blogs.nytimes.com/2015/07/13/details-emerge-about-victoria-taylors-dismissal-at-reddit/ <comment><USER3> Yishan Wong 2 days ago:

> Here's one.

> In 2006, reddit was sold to Conde Nast. It was soon obvious to many that the > sale had been premature, the site was unmanaged and under-resourced under > the old-media giant who simply didn't understand it and could never realize > its full potential, so the founders and their allies in Y-Combinator (where > reddit had been born) hatched an audacious plan to re-extract reddit from > the clutches of the 100-year-old media conglomerate.

> Together with Sam Altman, they recruited a young up-and-coming technology > manager with social media credentials. Alexis, who was on the interview > panel for the new reddit CEO, would reject all other candidates except this > one. The manager was to insist as a condition of taking the job that Conde > Nast would have to give up significant ownership of the company, first to > employees by justifying the need for equity to be able to hire top talent, > bringing in Silicon Valley insiders to help run the company. After > continuing to grow the company, he would then further dilute Conde Nast's > ownership by raising money from a syndicate of Silicon Valley investors led > by Sam Altman, now the President of Y-Combinator itself, who in the process > would take a seat on the board.

> Once this was done, he and his team would manufacture a series of otherwise- > improbable leadership crises, forcing the new board to scramble to find a > new CEO, allowing Altman to use his position on the board to advocate for > the re-introduction of the old founders, installing them on the board and as > CEO, thus returning the company to their control and relegating Conde Nast > to a position as minority shareholder.

> JUST KIDDING. There's no way that could happen.

[https://www.reddit.com/r/AskReddit/comments/3cs78i/whats_the...](https://www.reddit.com/r/AskReddit/comments/3cs78i/whats_the_best_long_con_you_ever_pulled/cszjqg2)

<comment><USER4> It's interesting that people criticized Pao for not being very engaged with the Reddit community (she was famously dinged for not knowing how to send a private message). Yishan Wong's repeated indiscretions show the downside of having Reddit's CEO also be an active Redditor.

<comment><USER5> "Downside" depends on which side you're on. From the perspective of an ordinary Redditor, Yishan forthrightness and transparency has probably been quite refreshing. From the perspective of the board, I bet they very much appreciate Ellen Pao's professionalism and silence.

Reddit is basically a society of 36M people now, roughly the size of Iraq. If it were a country, it'd be the 36th largest, bigger than Canada, Venezuela, and Taiwan. r/IAmA alone has 8.6M subscribers, r/AskReddit has 9M.

The biggest challenge of a leader is aligning interests. Many of those "citizens" are not aligned with the board, and are not even aligned with each other. It's no wonder that they keep burning through CEOs. Yishan may have been more aligned with the Reddit userbase (although even then, a good portion of the site hated him) and clashed with the board, while Ellen tried to please the board and ended up pissing off the whole userbase.

<comment><USER4> How did Pao piss off the userbase? What are the charges on her indictment?

* She was CEO at a time when Alexis Ohanian terminated Victoria Taylor. But Ohanian was the chairman of the company, Pao's immediate superior. And the circumstances of Pao's accession to CEO didn't leave much time for the company to sort the problems of an operational chairman out: Pao was brought in as interim CEO at the same time as Ohanian was installed.

* She was a principal in a high-profile gender discrimination law suit against a giant venture capital firm where she previously worked. One wonders what this had to do with her tenure at Reddit, but it _leads off_ the popular petition for her ouster.

* She presided directly over the termination of David Croach, who had leukemia. Croach claims he was terminated because he was unable to perform his job as community manager, and that he was unable because he was required to work from San Francisco --- a policy created by Yishan Wong. Reddit, through a spokesperson, disputed the veracity of Croach's story. We don't know why he was fired, but it seems like we do know that he was not --- as Pao's critics are very, very fond of saying --- simply fired "for having leukemia".

* She is married to Buddy Fletcher, who presided over a failed hedge fund and is accused of impropriety. This too is prominently recorded in the petition for her ouster, and, like her lawsuit, has little to do with her operational role. She is also accused of having deleted posts critical of her and her husband, but admins at Reddit later clarified that she not done that --- which makes sense, since we're talking about someone who couldn't even figure out how to send a private message on Reddit.

* She presided over a policy that banned the FPH subreddit. Reddit "free speech" advocates are very fond of suggesting that Pao was cracking down on objectionable speech at Reddit, and doing so selectively, so that white power subreddits were left to stand while FPH was banned. Of course, this leaves out the fact that FPH was banned for _harassment_ , not for hosting hate speech.

What am I missing?

I don't know that any of these summaries are dispositive. Maybe the FPH issue is more complicated than I realize. Maybe Croach's termination really was mis- handled (if he was fired simply for having leukemia, he has a very straightforward legal case against Reddit).

I only ask that we do not accept uncritically the notion that Pao placated the board at the expense of Reddit's community.

<comment><USER3> Question: How comfortable are you with well-upvoted and -participated-in discussion threads -- like the one we are participating in here -- suddenly dropping out of visibility on a community you contribute to in a matter of minutes, without explicit explanation and behaving other than how you might expect from the published details of the local ranking algorithm and official moderation policies, as this one has?

Your answer to this question might relate to the "popular" perception of the leader of reddit in the past ~year, whether honestly and solely earned by them or not.

<comment><USER4> Very. I have pet issues that I'll participate in, but HN is not a forum for resolving the tech industry's controversies.

To me, the most important moderation goal for HN is ensuring that members remain collegial and capable of discussion, even though we wildly different backgrounds and experiences.

"Hot" controversies --- Reddit is one, most political stories also --- can harm that goal. People get nasty in them. If dropping hot stories off the front page reduces nastiness, I am all for it.

Reddit is not HN. I have no idea how Reddit should be moderated. I try to minimize my participation on Reddit, because it's not moderated in a way that I find compatible with how I want to interact with people. That doesn't make Reddit evil, just, not for me.

(I am a semi-avid consumer of the "good" stuff on Reddit, though).

<comment><USER3> Fair enough, I appreciate your perspective. Here is an attempt to communicate my own, as someone "closer" to Reddit:

For very many habitual users of Reddit, the way in which it is probably most valuable is as the canonical general discussion forum of the web. An important part of the infrastructure of their perception and interpretation of the world around them, for pretty much any domain beyond the most incommunicably personal.

To read Reddit can be, in a surprisingly real way, like participating in a collective consciousness -- with all the addictive dependence [I say that in a non-judgemental way, not being able to come up with a less negative way to characterize it at the moment] that the type of speculative fiction which imagines such living arrangements usually predicts.

The practical side of this is that, for any given news event, cultural phenomenon, popularly-circulating idea, whatever: for these users it is instinctive to consult the reddit threads on the topic, as a deeply-ingrained part of their process for digesting and interpreting it. That those reddit threads will exist and have an active discussion on _any_ given topic is a given. Even if the local source of a news piece has a forum/thread of its own, it is fundamentally not the same thing.

It's been, in a hazy golden age that may have never actually existed, something close a total function for processing the events of the world, big and small.

One day, there was an event, a dumb internet drama event, but one for which the primary Reddit discussion thread was displaying a count of 20 thousand comments -- but on inspection, every single last one of those was showing up as [deleted]. That was the start of it for most users. Many have fixated on the specific topic of that initial drama as the source of the problem with Reddit, and many others have fixated on this fixation as the source of the problem with Reddit.

But there is a general sense that this is growing, spreading, and mutating, and seems to be cropping up in places that are not strictly predictable.

For example, there are persistent rumours that several of the more popular subreddits for which the news would be directly and explicitly on-topic, are systematically removing discussions about various global trade agreements currently being negotiated. Is it true? Maybe, maybe not, but the trust is broken.

\----

The main thing is (the perception that):

 _Now there is a partial function where before there was a total function._ That is disastrous damage in an information processing system.

\----

To these users, this is a very profound and frightening piece of damage, having extended a part of their cognition into this machinery that now seems to be failing. Panic sets in, which obviously means wild flailing at anything that pops its head up and can be in any way seen as responsible for the damage.

Hence, the reaction to Ellen Pao. _Especially_ after she made public statements of purpose that were easily interpretable by these users to the effect of "whatever else might be the source of the damage to your extended cognition, we intent to start deliberately doing some more damage to areas we don't consider important".

In the end, I very strongly suspect that the problem is much deeper and probably well beyond any control of the central management. If there were a way to, I would put money down on the prediction that the Reddit crisis, a direct continuation of the exact same crisis that's currently associated with Ellen Pao, will continue.

<comment><USER3> Also important to understanding this:

To the users I'm talking about, the "cognitive value" of Reddit is not entirely about directly being fed opinions to take up as one's own.

Many of these users find great value to being exposed to, they deliberately seek out for their own enrichment: idiocy, malice, counterfactuals, cognitive dissonance, debate (honest and otherwise), the whole range of perceptions and opinions.

To them, being exposed to these things is just as much of the value of Reddit as the "good stuff". And that seems to be the aspect of Reddit most strongly and immediately under threat.

Anyone who does not value this kind of experience (which seems to be a very large proportion of the people participating in this conversation at the most visible levels) is going to see any attempt to frame this type of content as valuable in any way as totally incomprehensible, evil, and malicious itself. So this part of things is pretty close to an impossible conversation to have in public.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> It is the nature of the role of CEO that you're going to take the heat for all company decisions. That's one of the justifications for their outsized compensation. Greater risk = greater reward. No one is forced to be CEO and being an executive essentially means you live your life on the line every day. It's not for everyone.

There was another thread on this earlier today and I think my comment there is applicable here too...

\--

Yishan seems to love to do stuff like this. While I personally find it interesting, it also seems pretty unprofessional. Some issues with this particular comment:

1\. Yishan no longer works at Reddit so I don't think he can be considered an authoritative source for what happened.

2\. Yishan appointed Pao so isn't unbiased when discussing her.

3\. The CEO's job is to represent the company. The chairman's job is to appoint the CEO. The outcome of events seems correct even if what Yishan says is true. reply

<comment><USER7> > _It is the nature of the role of CEO that you 're going to take the heat for > all company decisions. That's one of the justifications for their outsized > compensation. Greater risk = greater reward. No one is forced to be CEO and > being an executive essentially means you live your life on the line every > day. It's not for everyone._

I rather doubt that Ellen Pao's job description included "Dive under the bus to cover up bad decisions of coworkers too cowardly to own them."

Stop making excuses for assholes.

<comment><USER6> We don't actually know if that's what happened, this is based on a potentially disgruntled opinion of a former CEO.

Secondly, "Dive under the bus to cover up bad decisions of coworkers too cowardly to own them." is almost the precise definition of what the CEO role is. You represent the whole company for better or worse. You are the face of the company.

<comment><USER8> Why wouldn't it be "fire employees whose bad decisions are reflecting badly on the company, even if those employees are also on the board of directors"?

<comment><USER6> That's certainly one of their tasks. Pao didn't execute on that though.

</comment></comment></comment></comment></comment><comment><USER9> My suspicion is that Victoria was terminated for entirely legitimate reasons unrelated to the operation of /r/IAmA. She was a valuable employee and community member, and I don't believe the Reddit administration is foolish enough to remove her just because they wanted to modify (and possibly monetize) the format of AmAs. Much of the Reddit community frequently forgets that Reddit is a business (owned by a multinational media conglomerate, no less) that sometimes needs to make business decisions.

<comment><USER7> > _My suspicion is that Victoria was terminated for entirely legitimate > reasons unrelated to the operation of /r/IAmA._

If so, I really don't understand why there hasn't been an official justification yet. So much of the rage could have been defused by a prompt and earnest explanation of why she was fired. The fact that that hasn't happened seems to imply that the real reason would only make people angrier.

<comment><USER4> I don't understand why people seem to believe that if they just keep angrily asking about it, the company will divulge the reason for Taylor's severance. It is _extremely_ atypical for companies to reveal why they've chosen to let employees go.

It is also, literally, none of our business. Did Taylor ask people to dig into her personnel story? In a situation involving something as private and sensitive and reputational as a termination, you would want more than tea leaf reading: you'd want an overt affirmative consent from Taylor that she wanted the world talking about what happened to her at Reddit.

Apologies if that's what's happened, but I haven't seen it.

<comment><USER10> Why do you think people believe that? Maybe they are just trolls? Maybe they will just ask because it's easy to ask and someone might respond eventually.

It's not uncommon for a corporation to state why they are terminating an employee. GM terminates known engineers as scapegoats for negligence resulting in multiple deaths; many firms pre-announce mass terminations; some shut-down with no notice, save a publicly posted letter on the front door of their building telling the employees who show up for work that day that they no longer have a job ("sorry! but we _tried_ ").

Anyway, reddit left AMA out to dry by not arranging some kind of transition plan for the community, and instead created the perception of operating in secret to unknown ends.

<comment><USER4> I think people believe it because they want to believe it. Knowing feeds drama. Not knowing starves it.

It is very uncommon for companies to reveal reasons for employee termination. It may seem like that's not the case because the only termination stories you pay attention to are the newsworthy ones where the cause was stated, but that's an artifact of selection bias. Tens of thousands of people are let go every year from tech companies and their stories are never told.

</comment></comment></comment></comment></comment><comment><USER11> Ehm. This was known since the beginning: [https://np.reddit.com/r/IAmA/comments/3c0hcz/welcome_back/](https://np.reddit.com/r/IAmA/comments/3c0hcz/welcome_back/)

> Chooter (Victoria) was let go as an admin by /u/kn0thing.

<comment><USER7> Interesting. It's the first I've heard of it.

IIRC, it was also known from the beginning that the r/ShitNiggersSay et al. were banned, not for being offensive, but for doxxing people in violation of Reddit's few explicit rules. Once the mob locks on target, inconvenient little details like that tend to vanish.

<comment><USER12> It was known, but oddly not widely known. During the r/jailbait shutdown, Reddit was more successful in getting the word out about exactly where the line was drawn.

This time around many users claimed that it was the beginning of a clean-up campaign instigated by Pao. I don't know if the administrators failed to get their message across or if they were simply out-shouted by the mob.

<comment><USER13> Well the only explanation provided in the FPH round is that they were being shut down for "behavior not ideas". That's more of a "trust us, we did this for the right reasons" to me.

<comment><USER7> Literally the very next sentence after the words "behavior not ideas" was "Today we are removing five subreddits that break our reddit rules based on their harassment of individuals," later followed by "When we are using the word 'harass', we're not talking about 'being annoying' or vote manipulation or anything. We're talking about men and women whose lives are being affected and worry for their safety every day, because people from a certain community on reddit have decided to actually threaten them, online and off, every day." Source: [https://www.reddit.com/r/announcements/comments/39bpam/remov...](https://www.reddit.com/r/announcements/comments/39bpam/removing_harassing_subreddits/)

This is exactly what I was talking about. The truth is _right there,_ up front and easy to access, but you'd rather uncritically believe the voice of the mob.

</comment></comment></comment></comment></comment><comment><USER14> Here is the permalink to the comment made: [https://www.reddit.com/r/TheoryOfReddit/comments/3d2hv3/kn0t...](https://www.reddit.com/r/TheoryOfReddit/comments/3d2hv3/kn0thing_says_he_was_responsible_for_the_change/ct1ecxv)

I'm very curious to see if Alexis is responsible for the firing, then shouldn't the backlash against Ellen Pao change to be against Alexis Ohanian?

<comment><USER15> This was my main takeaway from the article. Ellen's changes to hate speech rules caused some backlash, but it sounds like she had nothing to do with Victoria's firing.

<comment><USER16> > Ellen's changes to hate speech rules caused some backlash

What changes to "hate speech rules?" Reddit still allows hate speech. What they curtailed were subreddits who existed primarily to harass people both on and off the site (e.g. other Reddit users, YouTubers, game streamers, people with public Facebook profiles, random members of the public, the entire Imgur staff, several Reddit admins, you name it).

That's why whenever this topic gets brought up people link to e.g. racist subreddits which still exist today, and then ask "well, why was XYZ banned, if those aren't?!" while entirely ignoring the fact that the banned subs were banned for HARASSMENT, not for having controversial opinions.

Subs still exist with the same controversial opinions as those who got banned. The difference is that the mods in the ones which survived actively follow Reddit's rules and don't harass innocent people. The mods on the banned ones were actively involved in the harassment and frankly should have been banned.

<comment><USER15> What changes to hate speech rules? These changes:

[https://np.reddit.com/r/announcements/comments/39bpam/removi...](https://np.reddit.com/r/announcements/comments/39bpam/removing_harassing_subreddits/)

I agree, they should have and should continue to be banned. It still caused controversy. Yes, their reasoning is that these subs have users that leave their cesspools and harass other people.

<comment><USER16> > What changes to hate speech rules? These changes

You linked to a page titled: "Removing harassing subreddits" that talks about harassment and doesn't contain the term "hate speech." Can you clarify why you think this has anything to do with hate speech rather than harassment?

</comment></comment></comment></comment></comment><comment><USER17> In what sort of corporate governance model does an executive chairman make an operational decision to fire a line employee?

<comment><USER4> A weird one, which the chairman has also taken an operational role managing one of the most visible and important departments in the company:

[https://news.ycombinator.com/item?id=9880953](https://news.ycombinator.com/item?id=9880953)

[http://blog.samaltman.com/a-new-team-at- reddit](http://blog.samaltman.com/a-new-team-at-reddit)

<comment><USER17> You're right, that is weird. However, since he had operational responsibility for "community" it sounds like it was his call.

<comment><USER4> He's the chairman of the board. A lot of things are his call. I'm just saying, that call made the CEO's job especially difficult. Keep that in mind if you're ever tempted to say "the buck stops with the Reddit CEO."

</comment></comment></comment></comment><comment><USER18> At the time I pointed out [https://news.ycombinator.com/item?id=9827489](https://news.ycombinator.com/item?id=9827489) that it was Alexis Ohanian who fired Victoria Taylor and set off the "blackout."

Ohanian seemed content to use Ellen Pao as a meatshield, whether she deserved it or not.

Imagine that: A Silicon Valley soap opera with no heros.

</comment><comment><USER19> This is in the new york times?

> The protest was the latest episode in nine months of tumult for Reddit, a > highly popular internet message board which has more than 160 million > monthly visitors. Under Ms. Pao's leadership, many users of the site have > been upset with what they have perceived as _major challenges to free speech > and a lack of censorship_. In May, Reddit users revolted when the company > instituted _stricter guidelines against prohibiting harassment on the site_.

<comment><USER20> No, it's on a blog hosted on the NYT website

<comment><USER21> I think he was trying to point out the contradictory and incorrect sentence that got by whoever copyedits the blog.

</comment></comment></comment><comment><USER7> So the Reddit mob was utterly wrong about Ellen Pao's complicity?

And they had such a good track record up 'til now.

</comment><comment><USER13> This is _very_ similar to one of the reports swirling before. If true, it is pretty awful for Alexis to keep letting Ellen Pao take the hit for it. There are other reasons that people dislike Mrs. Pao, but she doesn't need this final straw if it is truly Alexis' straw to bear.

</comment><comment><USER22> Notice also that this thread is now on the 5th page with 106 points at 9 hours at time of writing 12:59am EST 7/14.

In comparison there are currently older posts with less points or comments on the HN front page.

Obviously __someone __at YC /HN is driving this story down.

<comment><USER23> You're not new here, so you probably already know this, but when HN users flag a story, the story gets demoted. A sufficient number of flags kills the story altogether.

This is a very flaggable submission and that's probably what's happening.

<comment><USER22> Great point about flags but why is this story "very flaggable?" I don't see anything that breaks the guidelines.

<comment><USER23> I can't speak for anyone else, but when on the rare occasion I do flag something, it isn't just to enforce site guidelines but also to keep HN's submission and discussion quality up.

This is an article about Reddit drama and there have already been a number of recent submissions about that. There are only 30 positions on the front page and Reddit drama doesn't deserve one of them.

<comment><USER22> I see it the opposite way.

I don't think it's just "reddit drama" especially since reddit is a YC company and Sam Altman is on the board. Some of the revelations give some really interesting insight in how, what is considered a wildly successful web- startup, is (mis)-managed and some of the back-room dealings happen in the supposedly "meritocratic" valley.

I think this is ripe for really interesting discussion actually - <USER2> when it comes to how a massively public company that came out of such a technically oriented culture handles this much scrutiny.

</comment></comment></comment></comment></comment><comment><USER4> Why would Reddit have had a hard time simply installing Ohanian or Huffman as the CEO? Why would they need covert machinations to put the founders back at the helm?

</comment><comment><USER24> Why is an ex-employee (even if ex-CEO) being treated by the NYT as an authoritative source?

<comment><USER25> I don't know, because this is the NYT and they will treat anyone as a source? Frequently granting them anonymity when their position neither deserves nor requires it?

</comment></comment><comment><USER26> Reddit isn't Twitter or Facebook where a post on the wall is fine. Reddit is a discussion platform which requires a bigger time commitment.

Having the goal to have celebrities / famous figures be part of the reddit community seems rather naive. Given the time commitment, it would seem that the pool of potential AmA's would dry up. Also, having Victoria do the leg work would seem familiar to celebrities who would view it as normal to have an event handler.

</comment><comment><USER27> Just doesn't make sense. Sure, quickly eliminate someone's role, but why immediately fire the person? Why not even try to transition the person to a new role? Was she employed as an independent contractor?

Reddit clearly has both plenty of money, and plenty of work to be done. This explanation doesn't add up at all.

<comment><USER28> Alexis Ohanian has long been a proponent of viral marketing and native advertising on reddit. It's a very common thing for companies and movie stars to do AMA's in order to promote whatever they're working on. I'm willing to bet Ohanian wanted to make AMA's of this sort pay to play if they already weren't, which led to some friction with Victoria. (Of course this is only a theory.)

Here's him talking about marketing. [https://m.youtube.com/watch?v=IyyIGg12QZw](https://m.youtube.com/watch?v=IyyIGg12QZw)

</comment></comment><comment><USER29> Would be nice to hear Victoria's story from Victoria.

Regardless, I think with her reputation and respect - she'll likely be doing something even more exciting.

She's wisely avoiding stirring muddy waters for now...</comment>


Chrome: Faster and more battery-friendly - <AUTHOR> https://blog.google/products/chrome/chrome-faster-and-more-battery-friendly/ <comment><USER2> Note: this is from September.</comment>


Show HN: I Wanna Be Thy Copy - <AUTHOR> http://copy.sh/iw/ <comment><USER2> It seems that touching any surface causes instant death?

<comment><AUTHOR> Nope, try harder ;)

<comment><USER2> I got onto the second screen and ragequit.</comment></comment></comment>


Ask HN: Got a prototype, what's next? - <AUTHOR>

Hi HN community. I've just recently built a cool working prototype of an idea. I want to take it to the next level. I'm already late for submission to ycombinator winter funding cycle, but I do not want to wait until the next round -- time is precious. So, what should I do? Should I just pick a phone and start randomly calling VC firms? I'm not sure it would lead to a desired results. I'm fairly new to the world of VC funding, and would like to avoid some common pitfalls. Anybody has a practical advice of the next steps? <comment><USER2> 1.) Get the prototype in your customers' hands.

2.) Get feedback from your customers (i.e. you need to find out asap if they will use, or better yet pay, for your product).

If you hear the words "interesting," "cool," or "maybe" in their feedback; something is wrong with your idea. There's no product market fit.

If in your conversation they ask you how much does it cost or how do they sign up, then you might be on to something. This is what's known as a "win." A "win" doesn't necessarily mean you've struck gold, only that you might be digging in the right area.

Your goal is to accumulate as many of these little "wins" as possible to stay alive and ensure you're working on something somebody somewhere wants.

Good luck! Sounds like you're on the right track!

</comment><comment><USER3> Incorporate and get serious. Stop listening to the noise. Make your own decisions. Do something differently. Ask for payment. Those who find value in your product WILL pull out their money. Those who just try to be nice will not.

Become an expert in your industry. Work harder and longer than anyone else. Take breaks once in a while.

Wake up and do it all over again until you become big.

</comment><comment><USER4> Get out of the building and go talk to your customers. Learn how it does or doesn't solve their problem, go home, improve your prototype and repeat. By the time you can enroll for the next YC batch hopefully you can already show some real numbers.

</comment><comment><USER5> im with everyone who has commented so far. Get out of the building and get your customers using the prototype! Find and see if you will find any customers (Its not easy). It is always recommended you start with selling the idea to customers then get them to buy the idea/validate the idea. Other wise you might have to throw the prototype away since it doesnt solve any painful problem .

<comment><USER6> I am building an productivity email app - primary geared towards enterprises, organizations, and teams. What are some channels where I can reach folks to challenge my hack?

</comment></comment><comment><USER7> The hard part is not building a prototype but getting traction. What happens when customers use your prototype today?

</comment><comment><USER8> What's the user feedback on the prototype?</comment>


Synereo – A decentralized, attention economy-based social network - <AUTHOR> http://www.synereo.com/ <comment><USER2> First, absolutely: social networking must become decentralized. I think it's a great idea whose time has come.

Second, perhaps it's your marketing, but something feels not quite "there yet" about this: selling your unit of attention currency (AMPs) for money is a big red flag. Why hand over my social capital to just another set of folks who want to monetize it? I get that it's "decentralized", but the market aspect looks to me like you're still trying to maintain control.

Third: I'm absolutely excited about this idea, though, and will definitely keep an open mind. I'll start with your whitepaper and post any more thoughts (or retractions, or apologies!) here.

Good luck!

<comment><USER3> IMHO, they are selling some of the tokens so that they will have the funds necessary to pay for more development, for future PR, etc., according to their business plan.

I don't see another way of doing this, as working completely for free on such a big project isn't sustainable (this is what they're currently doing).

I don't think they will be monetizing your social capital, as this network will be P2P, decentralized and distributed, only you will benefit from your social capital; they only get the current funding for building the infrastructure and a set amount of APMs. They won't have revenues in the future from the network itself from what I understand.

Plus, I'm guessing they want to see that there are enough people who value what they've done, what they intend to do and that those people will form the initial community in Synereo's social network. At the end, if people aren't interested enough in what they're doing and don't see value in it, perhaps they shouldn't be doing it and I think this crowdsale will be an indication.

Personally I also got familiar with the team and I love the idea so I'm buying :)

All the best of luck!

</comment></comment><comment><USER4> "Synereo has a p2p stack that has been in development for over four years and that is already powering existing commercial services.

We have a _working_ distributed storage solution, a smart contracting system that's based on decades of research and established practices (see code examples and implementation details in our whitepaper), and an attention economy model inspired by the brain's neural networks."

[http://www.synereo.com/whitepapers/synereo.pdf](http://www.synereo.com/whitepapers/synereo.pdf)

[https://docs.google.com/presentation/d/12wZfRyF9XBMrc1ripXGf...](https://docs.google.com/presentation/d/12wZfRyF9XBMrc1ripXGfyNXCnO_MD7f2-Gc8AIa-v8o/pub?start=false&loop=false&slide=id.g4ecec4c43_30)

</comment><comment><USER5> I have been following the project for a while, I believe it has a strong team behind it and, from what I've read on their channels, they have been working on their tech for 4 years now. I'm really looking forward for an alternative, decentralized Social Network: Synereo even rewards users and content creators for their attention and artwork. This is too good not to support! Looking forward to get hands on when they'll invite people to beta test.

</comment><comment><AUTHOR> Synereo's CTO here, would be happy to get any feedback on our new project and answer any questions :)

</comment><comment><USER6> As this technology develops it will set the groundwork for the future economy, period. This just isn't an invention, its the trajectory of the future.

</comment><comment><USER7> I am excited about the idea of advertisers paying me for my attention rather than the ad agencies.</comment>


Need feedback – A clock to eliminate time zone calculations - <AUTHOR> I'd love to hear your thoughts/feedback on a product I'm working on (thehtime.com).
I'm building a new clock to eliminate time zone calculations for remote teams. Why? To simplify scheduling & communicating time when working globally. Well, this concept exists and is called UTC, however UTC isn't really used in our daily lives.
The clock I'm building utilizes a new UTC concept, a UTC that rotates with you according to your location on Earth. In other words, the clock knows where you are and adjusts itself for you. This unifies the reading of time everywhere at any given moment. Therefore, time zone calculations can be eliminated.
The idea of the clock (hTime) is not to change the clock, but to extend it by adding a new layer to it, a global time layer. hTime utilizes the same time system we all know, it comprises 60 minutes and seconds, and 24 local hours. On top of that, there is a new layer of 24 global hours represented in letters. Why letters? Simply to distinguish the local time from the global one, so numbers for local times and letters for global ones. This global layer is the one that adjusts itself for you and rotates according to your location on earth. This again unifies the ready of time.
So, no time zone math, no PDT, EDT, CEST, and no back and forth emails anymore. <comment><USER2> Random thoughts from a random person on the internet ...

I took me ages to work out what you are actually proposing. I found your explanation not to help at all. It is well-known to be difficult for the inventor to explain a new idea to other people. You have been thinking about this for ages, but others are coming to it without your level of knowledge, without your insight, and without your context.

I can see now, after 10s of minutes of thinking about it, how this might be a useful thing. Perhaps not for me, but certainly for some. The potential market is small, but anyone who _does_ have a use for this will, after a while, wonder how they got along without it.

It's a bit like a telephone, though, in that selling just one is a bit useless, you need multiple people all to have it, because it's a synchronisation system, and all relevant parties will need to have one.

Will this be a physical device? Or is it a web page? I don't understand how you intend to "actualise" it.

But certainly you need a better "hook" for people, and a better narrative to explain what it's doing, and why/how it will help.

 _Added in edit:_ I've now read some of the comments made elsewhere on previous submissions. Some of them are still relevant, but it still seems to me that your biggest problem is drawing people into understanding why your solution solves a problem.

<comment><AUTHOR> Thanks a lot for commenting, very helpful.

You're right, the current problem is drawing people to understanding and using the clock. Changing the way people perceive time isn't easy. However, it's a great challenge and that's what I'm currently working and focusing on.

I like your example of the telephone, the adoption trigger is definitely very similar. There has to be at least 2 parties in different time zones using it in order to get its benefits.

To your question, it's currently a webpage, you can check it out on [https://thehtime.com](https://thehtime.com). Basically I'm experimenting with it as a webpage. Once/if this works, I have many ideas of other products that can be built on top of it.

\- What could be a better hook for you if I may ask? \- Do you work/communicate across time zones yourself?

<comment><USER3> Have you considered making an API?

It also seems like what used to be called a user interface "widget." For this, a little piece of embeddible javascript might work.

In other words, making the clock something developers can use in their apps and something organizations can add to their websites might make the system easier to adopt.

<comment><AUTHOR> Yes, I'm considering and planning it. In fact, I'm thinking either building integrations myself like a Slack or Google Calendar one, or the widget idea, I have both of them on the short-term roadmap. Any other suggestions/feedback?</comment></comment></comment></comment>


Microsoft Launches Windows QuickStart Kit For Mac Developers - <AUTHOR> http://techcrunch.com/2013/04/02/microsoft-quickstart-kit-for-mac-developers-25/

<comment><USER2> Great deal. For $25 + shipping you get a Windows 8 Professional license, Parallels 8, and a USB stick. Just change the "disabled" attribute on the order button, and you're all set.

<comment><USER3> The "+ shipping" part amuses me. It seems to sum up the whole "out of touch" reputation that Microsoft has, whether deserved or not. Why wouldn't this just be a download?

<comment><USER4> Ever tried downloading a USB stick?

<comment><USER3> Yes, because they're totally charging $25 for a USB stick and throwing in Windows and Parallels for free, and the whole thing would be pointless without the USB stick.

<comment><USER5> 25$ completely goes to charity. But they could have still done it as a download though.

</comment></comment></comment></comment></comment><comment><USER6> Well, that was disappointing. Spent about 20 minutes trying to get in on this, only to find out it is sold out when the site finally loads. If they want developers to give Windows 8 a spin, they'll need to put in a little more effort to make this process less of a pain.

<comment><USER7> Yeah, I've been periodically refreshing it all morning, only to finally receive the 'sold out' message myself.

In all fairness, I don't have any immediate needs for Windows development, and it's by no means a certainty that I would have actually built something Windows-centric, so it's probably no great loss for either side.

</comment></comment><comment><USER8> My checkout experience:

Enabled the button, clicked it, nothing happened. Looked in Firebug at the Network console, saw a failure come back from the 'Pay' step.

Triple-checked my payment info, clicked the button once more. 25-30 seconds later, I got two consecutive "Something went wrong" javascript alerts. A minute or so later, I got two confirmation emails, lacking any useful details. I'm guessing I was charged twice.

Once it is possible to log into the site, I will see what my order status says. Right now /login continues to time-out.

<comment><USER9> Just did something similar, saw that I was getting an SSL Error in Safari from their JSONP Callback on <https://swish.com/swish-backend/...>, opened that link in another Safari window and it appeared to go through.

I have one pending charge on my credit card, not sure if anything else will go through, but I did end up getting an order confirmation.

Maybe whatever they're using to route SSL traffic through is falling over?

<comment><USER10> Mostly what failed was outbound bandwidth. Users weren't getting the JSON response from the payment page, though sometimes the payments went through. Confirmation emails were very reliable, though, (thanks Amazon SES!).

</comment></comment></comment><comment><USER11> The cynical developer inside me thought, "Windows 8 has so little traction among Windows developers, Redmond is trying to attract Apple developers out of desperation."

<comment><USER12> Ya, but look at it from a pragmatic business perspective, and this is Microsoft doing exactly what they should to court the prodigal developer: set up a zero hassle Windows environment on your favorite platform for cheap.

<comment><USER13> A US$25 sold-out USB stick is more friction than a download.

<comment><USER12> Haha, true. But it's a whole lot better than "Buy shitty VM product, then source a retail/whitebox copy of Windows, then Install and Patch, Install and Patch, and set up Dev tools for about $400."

<comment><USER13> Did it come with development tools?

<comment><USER12> Hrm, they label it as "iOS and UX to Windows porting labs". So in a sense.

</comment></comment></comment></comment></comment></comment><comment><USER14> A more direct link to the page to get the kit

[https://swish.com/swish-frontend/views/buy- devkit.html?p=dev...](https://swish.com/swish-frontend/views/buy- devkit.html?p=devkit)

<comment><USER15> Much thanks for the link. Although I also got a "something went wrong" javascript pop up, I managed to submit the order successfully by re-enable the submit button and resubmit it.

</comment></comment><comment><USER9> I think this is an excellent idea for Microsoft, but this web site has cratered under the load.

I'm assuming they're using Stripe from the little message on my JS console, but I'm having some serious trouble getting it to accept my payment (in Safari on Mac OS X, Chrome isn't connecting at all).

EDIT: I am getting "something went wrong :(" after clicking submit, two or three times now.

</comment><comment><USER14> Looks like swish is a little bogged down at the moment. My connection attempts are timing out :)

<comment><USER16> Indeed, same here. It does seem like it would be a popular offer.

<comment><USER17> Quite.

</comment></comment></comment><comment><USER18> This is what i got after forcing the jsonp callback: "Product sold out! Thanks for shopping."

<comment><USER19> It said Sold Out for me as well 10 mins ago, but I retried again and it worked :) #paystonotgiveuptoosoon

<comment><USER10> We upped the number available by 10% after it sold out, but then it sold out again in a few minutes. It's sold out for good now, I promise.

<comment><USER20> Will these kits be sold anywhere else? It's a bit of a shame for those of us that just got a bunch of timeouts before it was sold out completely.

<comment><USER10> MS may do another run of these, but we don't know. The other tools on modern.ie are genuinely useful too. We tested Swish using browserstack to resolve a thorny IE8 problem.

</comment></comment></comment></comment></comment><comment><USER21> Every time I submit the order I just get a javascript alert with "something went wrong :(" No idea if the order went through or not...

Edit: Got an order confirmation via email. However, I really think when you are dealing with payments you should implement a more detailed explanation than a javascript alert of "something went wrong"

<comment><USER22> I got that too, but immediately after I received an email from swish that stated my order is complete, and that I can check my orders at <http://swish.com/login/> (obviously not working right now).

<comment><USER21> I've not used Swish before and like you said I can't access the login page either. However, I never got any account details so do you know how you would login?

Edit: Managed to get on the page and create an account after some f5 hammering. Turns out all you need to do is create an account with the same email you used in the order and it will display the order status.

<comment><USER10> We wanted to make checkout easy, but maybe went a little too far. I'll add some more language to the confirmation email explaining what's going on. Thanks for posting the solution.

</comment></comment></comment></comment><comment><USER23> Besides building Windows 8 apps, I think you can even build Windows Phone 8 apps with this. It looks like Parallels now has support for all the virtualization / SLAT stuff that the WP8 emulator needs. (VMWare Fusion 5 has this as well.)

<http://kb.parallels.com/en/115211>

</comment><comment><USER24> SOLD OUT.

Just tried, submited payment info, got message back after a minute.

</comment><comment><USER25> This sounds great.

Parallels + pirated windows 8 isn't too hard to set up, but for any billable rate, $25 is a good deal.

</comment><comment><USER26> bizspark (www.microsoft.com/bizspark, free for startups) has windows 8 as part of the program (for free) which you can use in bootcamp.

<comment><USER27> Wow, what does it mean that you must "graduate" the bizspark program to keep the software?

</comment></comment><comment><USER28> Guys... stop clicking the link so I can get my order through.

k thx

</comment><comment><USER29> Makes me wonder if Microsoft would ever consider releasing IE for Mac OS X again. That would seem to be a good way to make sure Mac Developers target IE...

<comment><USER30> That's good in theory, but in practice it would likely be another browser/platform to test and debug.

<comment><USER31> AFAIK the last version was based on Tasman not Trident.

</comment></comment></comment><comment><USER32> Argh! I placed an order but due to the overload it said "something went wrong" I thought I'd give it time to cool down and now they're sold out :(

Oh well.

</comment><comment><USER33> Sorry if I missed this - but what do you get on the USB stick that isn't the same as downloading Parallels / Win 8 / IE10 combo they offer on the site?

<comment><USER10> On MS's site, you can download VMs for use with an existing Virtualization Platform like Parallels or Virtual Box. The VMs are guest operating systems with limited trial time. MS's docs suggest you use your VM manager to roll back when time runs out.

With the USB key promo, you get a full license for parallels and a full license for Win8.

<comment><USER33> Ah, ok. Thanks.

That makes it a pretty awesome deal. Shame they sold out!

</comment></comment></comment><comment><USER34> Does this mean you need to be a registered Apple Developer (with the ID and all the jazz..)? I can't get to the site to check, it keeps timing out.

<comment><USER10> Nope, you just have to solve a small easy "puzzle" to "prove" you're a developer.

<comment><USER35> joke's on them, i only know how to solve the puzzle using chrome

<comment><USER36> I managed to solve this one using the F12 Developer Tools in IE. Good enough tool for the job. Would use again.

</comment></comment></comment></comment><comment><USER13> Anyone wants to explain the motivation behind it?

Does Microsoft think the Mac developer community is somewhat relevant to their future?

</comment><comment><USER37> I managed to order, got the email but swish.com/login doesn't load.

Also, what are the credentials? Wasn't asked for any password ...

<comment><USER38> You have to create a new account on that page with the email you used when you bought the deal.

<comment><USER37> Thanks, managed to do it now.

</comment></comment></comment><comment><USER39> "Sorry, we are sold out of this item." Aw.

</comment><comment><USER36> :( USA Only...

<comment><USER40> It mentions international shipping on the billing page - is it still USA only?

<comment><USER36> Can't see anywhere for the country to go:

Name, Address, Apt/Suite, City, State/Province/Region, Zip

EDIT: I solved the puzzle ok, but the form which comes up only has the fields above

EDIT2: thanks - I think the problem is the website not loading properly due to congestion so certain page elements weren't visible.

<comment><USER41> If you click the "International" option under Shipping a Country field appears.

</comment></comment></comment></comment><comment><USER42> It worked for me, site was slow but I was still able to submit the order

</comment><comment><USER43> It doesn't work at all for me. Been trying for 15 minutes. :-(

</comment><comment><USER44> Sold out

<comment><USER45> Seems to be working again. Just submitted and got a confirmation email.

</comment></comment><comment><USER46> The frustrating experience of trying to order this is why nobody wants to deal with your platform... _sigh_

<comment><USER10> To be fair, the headaches today were our (Swish's) fault, not Microsoft's. If MS decides to run another set of these, we'll make sure we are better prepared.

Unless you mean the disabled "I'm a developer" button -- that was intentional and supposed to be fun.

<comment><USER47> Would you be willing to do a short post-mortem write up on the load challenges your site faced? Since you are part of the HN crowd, I imagine you did all the reasonable things and somethings still surprised you :)

<comment><USER10> Yep, we plan to write a blog post all about it, and what we'll fix going forward.

<comment><USER19> Please also do include in your blog post : 1. Which charities people donated most money? (my guess khan academy)? 2. Who's genius idea was to use 'disabled' attribute on the buttons? 3. How much traffic surge you got from TC, HN, Engadget?

</comment></comment></comment></comment></comment><comment><USER48> This just hit engadget.

</comment><comment><USER49> Well played MS.....

</comment><comment><USER50> Sold out :(</comment>


Orchestrating docker containers with Juju - <AUTHOR> https://plus.google.com/117270619435440230164/posts/XEcbYX5tHBM

<comment><USER2> Link to github repo: [https://github.com/bcsaller/juju- docker](https://github.com/bcsaller/juju-docker)

</comment><comment><USER3> Docker and Juju -- what a combination! And a whole lot of Golang. Nice work! I'd be very interested in seeing other Docker workloads Juju deployable and scalable...

</comment><comment><USER4> It would be nice to see this in action.</comment>


"How an Anonymous Accusation Derailed My Life" - <AUTHOR> https://quillette.com/2018/09/25/how-an-anonymous-accusation-derailed-my-life <comment><USER2> I wonder if a lawsuit for slander could work, either against the original creator of the list or media that reported about it.

I'm all in for supporting women and fighting sexual harassment, but this kind of bullshit has to stop. Successful lawsuits would deter false, spiteful accusations like this, and provide appropriate compensations for the accused.

</comment><comment><USER3> One of his anonymous accusers came out publicly in response to this essay. What she details definitely isn't rape, but it does sound like repeated harassment, and she says she has heard from other women who haven't yet come forward.

[https://twitter.com/lyzl/status/1044702812616216577](https://twitter.com/lyzl/status/1044702812616216577)

The author of the linked essay is suing the creator of the Shitty Media Men list claiming defamation. This seems like a poor strategy on his part, as it will get many of those previously anonymous women to detail their interactions with him and while they may not encompass rape or attempted rape either, they are overwhelmingly likely to make him look, well, shitty.

[https://www.thecut.com/2018/10/stephen-elliott-sues-moira- do...](https://www.thecut.com/2018/10/stephen-elliott-sues-moira-donegan.html)

<comment><USER4> > _The author of the linked essay is suing the creator of the Shitty Media Men > list claiming defamation. This seems like a poor strategy on his part,_

He absolutely should sue the creator of this list and whoever accused him of rape. It says so much that people think he shouldn't "because it will look bad".

<comment><USER5> Agreed. If he didn't rape anyone then whatever facts some out in court will be better than being on "the list".

<comment><USER3> Potential outcomes:

a) The rape allegations remain unproven. Perhaps he's awarded some damages from the woman who made a huge mistake originally posting the list, which she had acknowledged by immediately taking it down.

or

b) An alleged rape victim comes forward. Whoops!

Best case scenario where he IS innocent, he ends up where he is today, in purgatory. And either way, it seems likely women will come forward claiming various degrees of harassment and he'll look like a dirtbag regardless. Is that a win? Is pursuing it a smart strategy?</comment></comment></comment></comment>


Peru To Power 2 Million Of Its Poorest By Solar Energy - <AUTHOR> http://planetsave.com/2013/07/15/peru-to-power-2-million-of-its-poorest-by-solar-energy/

<comment><USER2> I would highly recommend to read this reddit comment.

[http://www.reddit.com/r/worldnews/comments/1iiz9x/peru_to_pr...](http://www.reddit.com/r/worldnews/comments/1iiz9x/peru_to_provide_free_solar_power_to_its_2_million/cb52c6d)

As it seems a lot of pro-peru-government PR is done currently to mask actual political activities.

        Right now in Perú we have some serious problems with the government.
        Today the congress elected members of political parties that even
        belong to the ruling party ("Gana Perú") as leaders of autonomous
        branches of the government ("tribunal constitucional", "banco central
        de reserva" y "defensoría del pueblo"). This is really bad, because
        the heads of organizations that are meant to protect the people from
        actions of the government and to make the government respect our
        constitution now belong to political parties.

        This means: members of the government, ruling party and allies taking
        control over the mechanisms that were originally meant to control
        them, and make sure they are working for the people. Now this
        institutions won't behave the way they should.

        We currently have protests in the central area of Lima near the
        congress and the "palacio de gobierno" (the residence of the
        president). Television has all the day covered the story of a
        peripheral fire as if it was the main thing happening. And reddit, you
        should know that the main thing in Perú right now aren't the solar
        panels.

        If you want to know something about Perú right know: we are unhappy
        and angry with our government and our inefficient political class. We
        are tired that they work for their own profit and not for the people.
        We are tired of corruption.

<comment><USER3> I'm an upper white class peruvian living in NA, and my contribution is going to be to say that people in the capital just want business business business.

The city is flush with money because of foreign investment, and absolutely any threat to the country's marketability, such as labor rights or environmental concerns or opposition to american foreign policy, is aggressively denounced by laborers on every forum they can find.

The government got to power on a massive wave of pro-social inclusion, anti- plutocrat sentiment, and the president turned out to be very meek in that regard, and his activist wife is now the focus of endless back and forth in the media spotlight.

I would take anything you hear about Peru's current political class with a grain of salt, we're suffering from libertarian fever a bit.

 __spot on reply by brazilian redditor: __[http://www.reddit.com/r/worldnews/comments/1iiz9x/peru_to_pr...](http://www.reddit.com/r/worldnews/comments/1iiz9x/peru_to_provide_free_solar_power_to_its_2_million/cb56kou)

</comment></comment><comment><USER4> Don't understand why they have to use the most expensive power. Even people in wealthy countries cannot afford living on solar, but the poor have to. I am quite sure there are more and better options.

<comment><USER5> It appears to be part of a rural electrification program for areas not currently connected to the power grid. The alternative would be a classic grid-building effort [1], but those aren't necessarily any cheaper, especially in mountainous areas. There's been some movement in recent years towards small-scale non-grid installations instead, e.g. in Jordan [2].

[1] Along the lines of [http://en.wikipedia.org/wiki/Rural_Electrification_Act](http://en.wikipedia.org/wiki/Rural_Electrification_Act)

[2] [http://www.uob.edu.bh/uob__files/458/vol1/6.pdf](http://www.uob.edu.bh/uob__files/458/vol1/6.pdf)

<comment><USER6> Yup, topography influences energy policy greatly in most countries. Peru is special because of its diversity...China-like in a much much smaller package. Mountains are good because of potential for hydroelectric plants, but not good to build a grid ON them. Jungle has proven a great source of natural gas, but the Andes mountains severs the jungle from the population centers on the coast.

I think solar for the mountain population is very interesting. They don't have anything at all now, not like we're increasing their current energy bill. It's cleaner than most other options, and very low environmental impact for these typical rural communities.

</comment></comment></comment><comment><USER7> High altitude equatorial nations have their perks, I suppose...

<comment><USER6> About time we got a perk -I'm Peruvian :). Seriously though, we've had more engineers graduating schools here and more money in state revenues, we're finally seeing that translate into smarter infrastructure projects.

<comment><USER8> I wish I can say the same energy, engineer, and infrastructure related comment about Puerto Rico.</comment></comment></comment>


We Don't Sell Saddles Here (2014) - <AUTHOR> https://medium.com/@stewart/we-dont-sell-saddles-here-4c59524d650d <comment><USER2> "By that measure, Slack is a real and large innovation. It is not as eye- catching as self-driving cars or implantable chips — it is not basic research-y kind of stuff. But, for organizations that adopt it, there will be a dramatic shift in how time is spent, how communication happens, and how the team's archives are utilized. There will be changes in how team members relate to one another and, hopefully, significant changes in productivity."

Slack is cool and all, we use it, I know lots of people that use it. It doesn't suck and doesn't make my computer crash. But let's be honest here -- there hasn't been a dramatic shift in communication or how my time is spent for the better. I can set up channels now and put gifs into my chat, which I then promptly disabled because it was annoying as fuck as everyone in the company began doing the same.

Personally I'm getting a bit overwhelmed with all the chats I have to maintain. There's Slack, because its pushed on me by my IT department. There's Skype, which I have for legacy co-worker interaction. There's GChat, which all my friends and family use. There's Facebook, which all my non-friend acquaintances use. In any given day I have 5 windows up, not counting the distractions from SMS and E-mail itself.

Nothing gets replaced...I just have to maintain more. Now I feel like its having the opposite effect. All this communication is actually making me _anti-social_.

<comment><USER3> The point of slack is that it is more than group chat, it's group chat that is easily extendable to your teams workflows. At my company we've extended it to support deployments, busting caches, executing jobs, etc. We've molded our project management processes onto it. It reports tweets about our company and it also reports errors in our infrastructure.

It's basically like a much-easier-to-extend IRC that is accessible to the mere mortal.

</comment></comment><comment><USER4> > The best — maybe the only? — real, direct measure of "innovation" is change > in human behaviour.

It just goes to show you - even if it's not a "new" product (group chat existed before) - really understanding an area and making the best product in a vertical _is_ innovation.

Every time I hear "don't compete, make something new", I think about the fact that before Google, there was Alta Vista. Before Facebook, there was Friendster and Myspace.

If a product us enough of an improvement for customers to spend time and money on it, it's successful. That simple.

</comment><comment><USER5> Meta Lab designed this post.

</comment><comment><USER6> this is from a long time ago. why is this up here again?</comment>


Show HN: Codeely - <AUTHOR>

<comment><USER2> "We're do not the kind of page where you could ask for problems on your code."

Has anyone really been far even as decided to use even go want to do look more like?

<comment><USER3> All joking aside, they really do need someone who speaks English natively to go over their content.

</comment></comment><comment> marco-fiset Clickable : <http://www.codeely.com/></comment>


No more Java 7 - <AUTHOR> http://www.jroller.com/scolebourne/entry/no_more_java_7

<comment><USER2> Sun were always a bit wary about the Java trademark after their tangle with Microsoft. That may be part of the issue, but honestly I think it's more likely to be down to the random bureaucracy of the JSR and JCP efforts.

I really don't buy the conspiracy theory and I'm puzzled to see the article up-voted so high without comment.

I'm much more interested in the question of what will actually arrive in Java/JDK7 and whether they'll ever move to a faster release cycle than the current geological process.

<comment><AUTHOR> It's not so much a conspiracy theory as a well documented public argument between Apache and Sun. You can decide who's right, but there's neither conspiracy nor theory there.

<comment><USER2> I disagree. It is a conspiracy theory about the implications of the naming conventions currently being used by Sun.

The "argument" between Apache and Sun is hardly well documented. He cites a two year old open letter from Apache to Sun, and then in a follow-up article indulges in a great deal of armchair lawyering.

The cited links to Sun developer blogs don't seem to support the argument being made one jot.

<comment><AUTHOR> There's an open letter [1], an FAQ [2], several documents on an open mailing list [3] and several updates in the ASF board reports [4].

Okay, so perhaps that's not "well documented" but it's also open and available for public review.

[1] <http://www.apache.org/jcp/sunopenletter.html>

[2] <http://www.apache.org/jcp/sunopenletterfaq.html>

[3] <http://markmail.org/search/?q=list%3Aorg.apache.jcp-open>

[4] <http://www.apache.org/foundation/board/calendar.html></comment></comment></comment></comment>


NIST's new password rules – what you need to know - <AUTHOR> https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/ <comment><USER2> The importance of this NIST standard cannot be understated. It has a requirement that passwords be hashed _with a random salt_! Microsoft Active Directory _does not use salts_!

I am trying to imagine the consequences to all the businesses and agencies that must adhere to these standards suddenly coming to the realization that they must replace their Active Directory installations and what that will mean for administering all their Windows systems. It's not going to be pretty.

You might be thinking, "but these are just guidelines!" Yes, but actually there's _loads_ of existing business contracts with wording that states the business must adhere to all NIST (security) guidelines. Also, you can bet that once this gets finalized other standards will follow suit.

It will be interesting to see what Microsoft does because salts were expressly _not_ added to AD because so much functionality cannot work with random salts in place. They're going to have to break backwards compatibility with a lot of functionality and many 3rd party products that synchronize with AD. Entirely new APIs are going to need to be written.

It will also become seriously annoying to create keytabs at large organizations since only domain admins will have that power once random salts are in place; making automation very difficult.

<comment><USER3> Do those contracts _really_ require adherence to NIST standards, including whatever future changes are made to them? I would have thought they'd be restricted to the guidelines as they are at the time the contract is signed.

<comment><USER4> You typically have to renew every few years for DoD.

</comment></comment></comment><comment><USER5> Recommending not expiring based on time is probably my favourite. I've worked at two places where that's been a requirement and my password has always been a passphrase combined with a sequencial number.

<comment><USER6> PCI compliance requires quarterly rotation of passwords and keys.

<comment><USER7> Nothing better than rules based on bad data and security theater.

<comment><USER8> If your password is compromised, it will only work until the next reset. That's better than having one that works for years.

<comment><USER9> That's true, but I'm having hard time thinking of a use case where a sustained, hidden compromise is 'worse' than a one-time compromise.

I mean, I guess they could login to your bank every week and transfer out $50 instead of just transferring out all your money on day 1, but... ?

<comment><USER10> There are quite a few scenarios where a sustained, hidden compromise is an (or several) order of magnitude worse than a one time obvious compromise.

The first to come to mind is a corporate espionage scenario. Do you want to know what your competitor is up to today, or do you want access to their briefings/CAD/code for the next 12 months? Long duration compromises also allow you to slip data out slowly, so a NAS doesn't show 200GB being transferred off in a matter of hours, but a slow drip of 100MB a day.

At a personal/home use level, long term access to a bank account allows an attacker to build up a spending profile, which depending on your habits, could be used for blackmail.

<comment><USER11> Anecdotal and only related to your last paragraph, but as a security researcher I can say that 99% of the time attacks on a personal bank account are never "long term." Most of time, regardless of skill, hackers get in, cash out and disappear. It's far more lucrative (and generally safer) to empty the account than try to blackmail someone based on spending habits.

<comment><USER12> I happen to know of a bank exploit in which the attackers compromised one thousand online accounts, and attacked all them (transferring funds) on the same day.

Presumably the attackers were worried that after several transfers the bank would notice and block further access, so they kept a roster of compromised accounts to attack all at once. I suppose that a password rotation policy would have helped mitigate damage in this case, though something like fail2ban or automated IDS would have been better.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> > Knowledge-based authentication (KBA) is out.

All the rules are great, but this one might be my favorite. Every time I faced a list of KBAs I felt like I was trapped in UCB's comedy sketch:

[https://www.youtube.com/watch?v=tMEjpXJZgIA](https://www.youtube.com/watch?v=tMEjpXJZgIA)

(If a common security device is bad enough for a comedy troupe to have a bit on it, maybe it could use some work.)

The worst KBAs I've seen are for United's frequent flyer program. Almost every question is of the form "What is your favorite X?" X includes items like "vegetable" or "summer sport." Maybe most people have strong opinions about the superiority of broccoli and tubing, but I was always just scratching my head. (The questions were mandatory and you could not write your own.)

<comment><USER14> Yes, my mother's maiden name is Een3oquu+P_a9oez0queiPhaeChaijoh, why do you ask?

Ironically, you usually can enter a string as answer to those questions that is more secure than the allowed password.

<comment><USER15> And then you call phone support and they ask you for it.

<comment><USER16> "I just entered a string of random characters."

"That is correct. Thank you."

<comment><USER17> mentally: "I knew he was the kind of guy who would do that."

"Go ahead and transfer all of the billing information to this address and change the email to firstname.lastname@example.com. Thanks."

CSR: "Sure, I'm happy to be of help."

</comment></comment></comment></comment></comment><comment><USER18> Looks like some good suggestions:

\- Glad they're recommending a stop to the pointless "password must be no longer than (16, 20, ...) characters". Aren't you storing a constant-length hash anyway?

\- Why do some logins restrict which ASCII characters can be used? When I see that I can use any symbol from '%!#&' or whatever list they provide, I can only imagine it's a really naive SQL-injection defense. Is there any valid reason for this?

\- And glad to see they're recommending against "security challenges". Half the time I'm forced to pick a security question, either none of them apply, a bunch of them are ambiguous ("what's your favorite movie?" \- uhh, I'll give you a different answer depending on my mood, etc.), or they're easily searchable ("where did you go to high school?")

Unfortunately I doubt the bad actors will pay too much attention to this. I know Google is planning on dinging sites that don't use HTTPS, is it possible they could ding sites for poor password policies?

<comment><USER19> I just use the security questions as another password, like my favorite color is JyQ|l[Duc-I6KrU-0k and I went to elementary school at ?YfBW+Yurh@m$lml":.

<comment><USER20> Those are rough when a customer service rep asks you for one of those over the phone... :)

<comment><USER21> I do this. I told the CS rep that my password hint was "just random characters mashed on the keyboard" and she accepted this and moved on. I'm not sure what to think of the security implications.

<comment><USER22> Replying to sibling.

Worse, if reps can see the answer, then this is equivalent to not hashing the passwords at all since you have a password-equivalent stored in plaintext.

<comment><USER23> FYI, if you click on the <x> minutes ago link above the post you can get a reply box even on new posts.

When I worked for t-mobile it was last 4 of the social unless the customer requests otherwise.

Few requested otherwise, and usually it was because they were annoyed about people being able to see part of their SSN.

<comment><USER24> >> they were annoyed about people being able to see part of their SSN

Part of? I worked for AT&T back when they merged with Cingular. We only asked for the last 4 over the phone, but the entire 9-digit SSN was shown in the app. Every single low-level employee had (has?) the entire SSN in front of them. Never dared tell a customer that little fact when they made a fuss over my having access to their last 4.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> I've written into several companies in the past saying "your password policy are bad for __ reason", and they always of course write back saying basically "our security team doesn't care, shut up". There've been quite a few times I've cancelled accounts right after signing up because of just how absurd they were (for instance I believe Trade King forces you to click type your password with the mouse on an on-screen keyboard just in case you have a keylogger malware).

It's great that there's now a "right answer", and it seems to be based on some solid research about what actually helps and what doesn't.

In a similar vein I wish there were somehow a standard for http login and change password requests. Right now password managers are pretty hit or miss about whether they can actually fill a form and log you in, sometimes it just can't find the right field, sometimes there's a javascript field check of some sort so you have to click into the field after the password manager fills it before you can submit, etc. Having some kind of a standard would let you more reliably be able to automate logging in, rotating all passwords (at least on accounts without MFA), etc.

<comment><USER26> There's not "Now a 'right answer'" NIST standards have been around for a while; the companies you've mentioned are just even more arrogant idiots than you originally thought :-)

</comment></comment><comment><USER27> Aren't passphrases kind of a bad choice for passwords? If all you are ever really guessing is the symbols that make up someones password, and you know that for example they have 4 words that make the passphrase, then you effectively only have to iterate 4 symbols with a known list of possibilities for each symbol (i.e. the dictionary).

If you compare the permutation space of a short passwords (length 7) with random characters (say ~80 potential symbols), with a long(er) password made up of 4 english words (say ~3000 potential symbols, the most commonly used english words).

        character_symbols = 80
        word_symbols = 3000
        number_of_character_password_symbols = 7
        number_of_word_password_symbols = 4
        permutation_space_characters = character_symbols**number_of_character_password_symbols
        permutation_space_words = word_symbols**number_of_word_password_symbols
        print('%.2E' % permutation_space_characters, '%.2E' % permutation_space_words)
        ('2.10E+13', '8.10E+13')

The words space is four times bigger, but in the same magnitude as the short (bad) password. I'm not an expert here, so I might have stuffed it up, but it seems like passphrases shouldn't really be encouraged?

I do love the recommendation to remove time-based password expiry though.

<comment><USER28> Everything in the article is spot on, I only wish they went further and recommended passphrases more strongly. It's correct horse battery staple and all that.

As for your calculation, you are about right. Except memorizing a completely random 8 character password drawn from an 80 symbol alphabet is /extremely/ unpleasant for most people, especially when you may have a few different passwords you use on a daily or weekly basis. And for passphrases, 6 words drawn from a 4096-word dictionary is typical. I use that setting (or even 8 words for more important things) and have easily memorized about a dozen passwords, even ones I use only once every few weeks.

4096 __6 = 4.7e21, about the same as an 11-character random password.

<comment><USER29> So you have memorized the equivalent of a 60-word nonsensical poem?

<comment><USER30> Well, you only need to memorize the passphrase of your password manager's file.

</comment></comment></comment></comment><comment><USER31> I love this. I despise the fact that my bank restricts passwords lengths to max 16 chars, hash lengths are constant, it is ridiculous. It is a BANK, if anything they should be more secure.

Instead they force me to make passwords that easily fit a password mask by restricting special characters and forcing at least one number, uppercase letter, etc. They are actually weakening the security in a vain attempt to get people to make stronger passwords. All they do is make it P@$$w0rd instead, no increased security, it is so predictable

I think disallowing SMS for 2FA will make it harder to get people to use it, if they finally decide to signup then they are informed they need an authenticator program. Also there have been times my phone was dead and I didnt have a backup plan.

<comment><USER32> > there have been times my phone was dead and I didnt have a backup plan.

This. Just recently this happened to me when I needed to get into my Gmail and I was shit out of luck. Didn't have my phone on me. The best Gmail would do was some sort of account reset that would take 2+ days (for good reason). I was entirely locked out, no solution short of returning home to get my phone.

Anyone recommend a solid backup plan?

<comment><USER33> In the Google case you can print a set of backup codes. See the security page under your account.

</comment></comment></comment><comment><USER34> > Knowledge-based authentication (KBA) is out

Finally! This is my biggest beef. I've taken to generating long random strings as answers to these questions but in some cases that's insecure too because they present you with a multiple choice set of answers and then it's obvious.

Also glad they're getting rid of ridiculous composition rules, hints, and password expiration.

</comment><comment><USER35> I would love to see an explicit recommendation of "no disabling paste" in the NIST standard... so that I can contact companies that do so and drive me nuts. The article implies that disabling paste would run afoul of the NIST standards, but is there actual language I could point to?

<comment><USER16> I would sure hope so. I managed to convince a company to allow paste in their login form by tweeting them this article: [https://www.troyhunt.com/the-cobra- effect-that-is-disabling/](https://www.troyhunt.com/the-cobra-effect-that-is- disabling/)

But I doubt most companies would be this reasonable if they have this level of stupid in their password handling.

</comment></comment><comment><USER23> The don'ts list is pretty much a christmas present from NIST. I hate all of those things. Worst is the stupid security questions.

<comment><USER36> Apple still uses those and it annoys me. Yes, others still use them too, but I give Apple extra crap because I think they should know better by now but either they don't or don't care.

<comment><USER37> You can't change your existing password in apple if you forget your secret question/answer. I gave gibberish to these secret pet/school. Now I am unable to change my password ;-)

</comment></comment></comment><comment><USER38> In addition to the standard salting and hashing, they recommend using an additional key stored separately from the data.

> A keyed hash function (e.g., HMAC), with the key stored separately from the > hashed authenticators (e.g., in a hardware security module) SHOULD be used > to further resist dictionary attacks against the stored hashed > authenticators.

I guess using a pepper is a better-than-nothing measure, if you don't have a hardware security module.

</comment><comment><USER39> > and should accept all UNICODE characters, too, including emoji

Hell no. This WILL lead to disaster, especially if people store their passwords in managers that may or may not mess up Unicode. UTF-8, for example, allows to encode the character "ä" as \xc3\xa4 OR \x61\xcc\x88. They look visually identical, yet fail any string comparison.

Not to mention the support calls "I'm in $random_foreign_country and don't have $random_char on my keyboard, cannot login"... good luck trying to match the kitty emoticon on your Android phone to the random font on a website to whatever input system iPhone uses. Or when they're used a German Windows keyboard and suddenly have to use a German Mac - basic stuff like the tilde symbol ~, pipe symbol | or the (square) brackets {[]} are not marked out on the keyboard.

I believe that it makes sense to display a warning "Your password may be impossible to type in another country/using a non-$current_platform keyboard" when such characters are encountered.

<comment><USER40> Personally, I think passwords should be opaque sequences of bytes that just happen to be mostly easily input on a keyboard, but I agree with the warning: some might even consider such a warning a _good_ thing.

<comment><USER41> The problem with that is, which keyboard? USA, German, UK, Japanese?

</comment></comment></comment><comment><USER42> Question: how do you store data encryption key for each user?

because:

\- you get the password form the user

\- compute the PBKDF2 with iteration and a salt, store iteration$salt$hash (where hash is the result of the PBKDF2 on the password).

\- when user logs in check that the hash matches the PBKDF2 on password with iteration and salt.

But now, i've a the data enccryption key (DEK) and i've to store it somewhere. I can't use the password directly to encrypt the DEK since the lenght must be 32 (or 16, or 24). I should use PBKDF2 to derive a 32 byte hash, but this value is already stored in the password_hashed field. Should I compute anoterh PBKDF2 with a different salt and a different iterations for the encryption of DEK? if so i'll store in the db just$iterations and encryption and apply those to the password (after the user logs in) to derive an encryption key for the DEK?

What's a good approach?

</comment><comment><USER19> I'm no security expert, but I'm pleased to see several things being forbidden that in the back of my mind, I always thought were a little fishy.

</comment><comment><USER43> What's the only thing worse / stupider / more annoying than secret questions?

Secret questions that don't even have a free form text box for the answer! That means you can't even put random text in them. You have to select from a pre-canned list of 5-10 options.

Good riddance!

</comment><comment><USER44> If SMS isn't a recommended 2FA, do they recommend some other means of 2FA?

<comment><USER45> Many [1]. Some examples, my comments in parentheses:

\- Out-of-Band Authenticators (mobile app over secure channel)

\- Single Factor OTP Device (like an OATH push-button, enter 6-digit code TOTP device)

\- Single Factor Cryptographic Devices (insert into computer)

(among others)

[1] [https://pages.nist.gov/800-63-3/sp800-63b.html#sec5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5)

<comment><USER46> Which is a real shame. SMS might not be perfect, but it's a real help when I don't have a better means handy. Its better than no 2FA, and it's saved my butt a few times when I get a text message saying "Here is your login code" and I'm out walking in the park.

I get a new phone every year, and Google Authenticator sucks for that, but it's by far the second most common 2FA provider. I just got a new phone today, and had to go disable 2FA on all my accounts then re-enable it to generate a new code. SMS is always a good fallback in my experience.

<comment><USER47> I got a U2F key, which neatly solves the problem as long as you have a USB port. The integration into the browser makes it painless and fast to use.

Adding bluetooth to work with mobile devices would make it a complete solution.

Edit: corrected U2FA to U2F.

<comment><USER48> How does a U2F key help you? Most places don't support U2F.

Bluetooth and NFC are standardized, and the first products are out. I really hope U2F and UAF are gone 'make it' in the market.

<comment><USER47> I think it's crucial for Gmail, because the popularity of email-based verification means that if you lose your email account you lose everything. Including the presidency, in John Podesta's case!

I also use it for Bitbucket and Githib, but I take your point and also hope it becomes a widespread standard.

</comment></comment></comment></comment></comment></comment><comment><USER49> > Applications must allow all printable ASCII characters, including spaces, > and should accept all UNICODE characters, too, including emoji!

Man, I predict a world of hurt here. Maybe it'll be okay if the standards also very prominently tell you you've got to unicode normalize before hashing, and tell you what normalization form to use (NFC I think?). Too many platforms/environments still don't have handy access to unicode normalization though.

<comment><USER50> It actually does:

[https://pages.nist.gov/800-63-3/sp800-63b.html#memorized- sec...](https://pages.nist.gov/800-63-3/sp800-63b.html#memorized-secret- verifiers)

</comment></comment><comment><USER51> Glad to see the knowledge based questions are being phased out, many are sadly answerable with a cursory search query or leaked in previous breaches.

I didn't see anything in there about security images/indicators, which have also been shown to be ineffective: "was this bank the image of the man snowboarding, or the woman skiing...?"

</comment><comment><USER52> Password strength is meaningless when the password can be reset via an email provider that allows weak passwords.

<comment><USER47> True. Google does a good job here - they support U2F (and other password hardening techniques), and additionally report any access from a new device. You do have to opt in to these measures, but at least they are available.

</comment></comment><comment><USER53> Password max length should be minimum 64 chars as specified in [https://pages.nist.gov/800-63-3/sp800-63b.html#aal_privacy](https://pages.nist.gov/800-63-3/sp800-63b.html#aal_privacy).

We want to know what compliance levels apply for the above rule in an enterprise product. Anyone knows where I can find compliance levels for Products targeted for Enterprise customers ?

</comment><comment><USER54> 8 characters seems very short.

I like asking people to pick 4 words and a number. Satisfies the length issues.

But... I love emojis and other things being possibilities. Cool.

<comment><USER55> They shouldn't pick 4 words, it should be randomly chosen for them.

<comment><USER56> At which point, they hit reset password (either on that page, or on successive logins) until they get four words that stick trivially... because they're a normal sentence.

<comment><USER57> Slow them down?

<comment><USER56> To bend a cliche, users interpret things in their way as damage and route around it.

</comment></comment></comment></comment></comment><comment><USER58> Seeing as NIST recommends PBKDF2 over bcrypt and scrypt should we assume that means NSA can crack PBKDF2 faster / more cheaply?

<comment><USER59> This is the first thing I thought too. I've consistently heard the opposite but am not a cryptographer.

The article Sophos links with regards to an explanation for choosing PBKDF2 over bcrypt or scrypt goes over numerous obviously bad practices like cleartext storage, then states the following, without further detail:

 __ _We'll recommend PBKDF2 here because it is based on hashing primitives that satisfy many national and international standards._ __

This seems like a vague and probably misguided line of reasoning. What specifically would make that recommendation rational? bcrypt wasn 't new in 2010 when NIST published the article recommending PBKDF2, and they haven't made the switch since. Dual_EC_DRBG was recommended by NIST in 2006 which makes me deeply skeptical of anything they say.

If anyone could provide the motivation for choosing PBKDF2 in reasonably terms I'd appreciate it.

<comment><USER60> The best motivation I've heard is here: [http://security.stackexchange.com/a/17088/77002](http://security.stackexchange.com/a/17088/77002)

Essentially, blowfish (Bcrypt) doesn't appear to be FIPS-compliant, so if you have to be FIPS-compliant, you use PBKDF2.

And, considering the rest of the comments about why Bcrypt is preferred over PBKDF2, it appears it's all about how a GPU gives a significant speed-up for PBKDF2 but not Bcrypt. But now there are FPGAs that significantly speed up Bcrypt in similar fashion, so it could all be a wash depending on who you talk to.

</comment></comment></comment><comment><USER61> What are the alternatives to SMS two factor authentication? Software like Authy? Even if it's easy to get around SMS wouldn't utilities like Authy also have vulnerabilities, or is the idea that at least they can be patched?

</comment><comment><USER62> I use passwords from [https://www.random.org/passwords/?num=4&len=8&format=html&rn...](https://www.random.org/passwords/?num=4&len=8&format=html&rnd=new)

</comment><comment><USER63> Also systems should always notify users if their password or email address has been changed, immediately alerting that they've been compromised.

2factor authentication is great so you always know if someone is attempting to login as you.

</comment><comment><USER64> Alas, Google forces me to use ASCII only passwords: [https://support.google.com/a/answer/33386](https://support.google.com/a/answer/33386)

</comment><comment><USER65> How the f@@@ on the year 2016 we have a 64 character max length password requirement!!

<comment><USER58> If you allow unlimited length, that a DoS attack. Ask the devs at Django

<comment><USER66> For which they set a 4K limit on password length. I think even the commenter you replied to would find that satisfactory, being much more than 64 characters.

<comment><USER3> It's pretty arbitrary when you get to 64, IMO. If a site enforces a maximum below that, I'll feel suspicious and treat the site as if it's storing my password in plain text; that maximum or higher reassures me that they probably know what they're doing.

Of course, one day, a 64-character password will be brute-forceable in milliseconds, but we hopefully won't still be having this discussion by then!

<comment><USER66> I agree, though I also think: why have some arbitrary limit at all? Mind you the 4K Django limit isn't arbitrary, they know that at some point beyond that they'll spend too much time in hashing-land and will have opened up a DoS attack vector.

I would argue 4K is effectively unlimited... maybe in the sense of an ISP/phone company "unlimited data plan" unlimited, but still... the likelihood of user knowing of the limit is very small. I use a password manager that maxes out at 100 characters in its password generator (a default I use because... why not?) However, in those small cases where I do use contrived passwords, I make use of passwords that are really pass-sentences (with a few extras thrown in). It's pretty easy for me to blow by 64 characters (and sometimes 100) in those cases; not because I think I'm gaining extra security due to length, but because I'm just throwing out the first, easiest to remember sentence that crosses my mind and that I know will be reasonably secure. A service that flummoxes that effort just makes it less likely I'll use the service (assuming that it's use is discretionary).

</comment></comment></comment></comment></comment><comment><USER67> FAL3 is not used in LOA- seems like it won't be used much.

</comment><comment><USER68> Relevant xkcd: [https://xkcd.com/936/](https://xkcd.com/936/)</comment>


Ask HN: Like ParenScript(Lisp Library), Is there anything for C#  - <AUTHOR>

I'm looking for a CL library which can generate C# from sexp. Similar to what Parenscript does (sexp to JS).
If not available, is it easy to write it from scratch?
Any pointers please.
Thanks. <comment><USER2> Well, there's Clojure which supports CLR. You will not get the C# source code out of it, but it will compile to CLR and run on Windows. As always, unless you already know the platform APIs pretty well, it's going to be hard to get started on a new platform with a new language where documentation is virtually zero, but if you know your way around C# and the APIs you should be ready to go.

<comment><AUTHOR> I dont think Clojure for CLR will be useful for me. Because I'm mainly looking for C# Code Generation (readable code).</comment></comment>


Intern for a SV-style Startup in Austin, TX - <AUTHOR> http://www.onedayoneinternship.com/internships/seeing-interactive/

<comment><USER2> This was a fun company to profile. I really enjoy learning about companies that help publishers monetize their content—maybe because it took me a long time to figure out how to monetize mine.

<comment><AUTHOR> Thanks for the profile BTW! How did you find out about us? My RSS scanner picked up the article and I e-mailed all of our top guys at the company asking who made this article happen--we still don't know, but it's one of the best write-ups we've had.

<comment><USER2> I run through so many companies, I usually forget where I found them within a few minutes of finding them. My guess is that I actually heard about you guys through HN or something that I found on HN. I really should get better about tracking where I find stuff!

If you guys put a press page together, be sure to add a link back to our article. (To other HN readers, this can be a really great way to build links for SEO.) Also, feel free to comment on the original post. We encourage employers to join and add to the conversation.

</comment></comment></comment><comment><AUTHOR> BTW, you can apply here: <http://seeinginteractive.com/company/jobs/hacker- interns/></comment>


Large BGP Communities beacon in the wild - <AUTHOR> http://mailman.nanog.org/pipermail/nanog/2016-October/088537.html <comment><USER2> Sorry, I may be missing something important from the linked discussion, but what is this BGP for? Is it an alternative to IP addresses?

<comment><USER3> Let's see if I can explain it concisely...

When you send traffic to an IP address, your router must know where to send it to. In consumer routers, you usually just have a default route for the whole internet towards your ISP's gateway, but the ISP must also maintain a routing table to know where the packet must go next, and BGP is the protocol most commonly used to advertise where each network resides.

Every ISP _could_ in theory maintain the internet routing tables by just having a set of static routes, but considering that the IPv4 internet routing table consists of over half a million entries at the moment (and it's growing), this is practically impossible. Instead, each ISP (or "Autonomous System") peers with others to advertise their routes to the network blocks assigned to them, _and_ often the routes they receive from other peers.

When you have multiple peers like this, the advertised routes contain as metadata the IANA assigned global AS numbers of each participant in the network up to the endpoint (the "AS path"), thus allowing routers to calculate the shortest route in case two peers advertise routes to the same network block. This also gives the internet its self-healing property, since if one router goes down, you usually have an alternate path available.

The BGP "communities" mentioned in the article are a way for peers to signal additional information about their routes. For example, an ISP can publicly claim that they will not forward traffic to routes advertised with a certain community, allowing a network operator to tell their transit ISP to drop DoS traffic to a subset of their addresses before it reaches their network, helping protect customers not under attack.

<comment><USER4> Note that the protocol has imperfect security, which is worrying:

[https://security.stackexchange.com/questions/56069/what- secu...](https://security.stackexchange.com/questions/56069/what-security- mechanisms-are-used-in-bgp-and-why-do-they-fail)

</comment></comment></comment><comment><USER5> Curious question for people with their finger on the networking pulse: are there planned changes for BGP related to IPv6/IoT or will the current scheme scale well?

I'm assuming "many more" networked devices being added to the global network will eventually result in more traffic and more ASs being connected.

<comment><USER6> Short answer is "no".

Long answer is, actually these changes already happened quite a while ago.

Most of the time, we tend to forget IPv6 is in fact more or less 20 years old now.

Support for IPv6 in OSPF (OSPFv3) was introduced in 2008 and support for IPv6 in BGP was added in 2007 (MP-BGP).

AS numbers encoding was also changed in 2007 (32bits ASN) to support all those new connected system.

</comment></comment><comment><USER7> It's not clear to me, what does the Large BGP Communities extension try to solve?

<comment><USER8> BGP is a path vector protocol so traditionally it only receives information from its direct peers. Community strings are for sending targeted info to a distant (or close) autonomous system, enabling you to effect mutually agreed upon changes in that AS. With a larger number if bytes available in a community strings it enables us to use community strings to convey a more complex set of instructions.

<comment><USER7> Thanks!</comment></comment></comment>