You need multiple SAML IDP signing keys - <AUTHOR> https://www.stackallocated.com/blog/2020/saml-idp-no-shared-keys/ <comment><USER3> Two ways I deal with this:

1) Insist on encryption of the SAMLResponse (that way, the SP has to do it correctly, or they'll have no idea who is accessing the app) 2) If they won't do encryption, I test exactly what they are talking about in this article

To test, I have my own IdP set up, and I either do IdP-initiated sign-on or spoof the IdP URL using /etc/hosts on my localhost and try to log into the app with a signed SAMLResponse using a key the SP doesn't know about. If it works, I immediately tell our CISO. I even scared one vendor so badly just explaining that I was going to do this that we never heard from them again.

<comment><USER4> Encrypting the Response only ensures that the SP knows how to decrypt it - <USER2> that they are verifying other fields, like the Audience field.

If you use a separate encryption key for each SP, then great - but you could just as easily use a separate signing key, as the article suggests, and far more SPs support this.

Of course, it is still possible the SP does not validate the signature at all, or does so erroneously.

<comment><USER5> SAML typically uses RSA-OAEP or RSA-PKCSv15 for KEM. You usually get the cert from that from the SP (since otherwise you hold the private key), so I'm not sure how that goes sideways. The SP might still use the same encryption keys for each peer, but that should be fine.

You're right that per-SP pairs are still the right answer and for the reason you point out: much wider support.

<comment><USER4> Duh - of course. Good point. As long as each SP has its own encryption key, this would be a valid solution assuming SP support.

</comment></comment></comment></comment><comment><USER6> If your IDP is providing identity, does it matter who the audience is? presumably the contract is "if this blob is signed with this certificate, then the identity encoded in the blob is the user's identity" because the SP was configured to only trust a certain certificate for identity.

What the article is saying is a bit nuanced in that the IDP can theoretically provide a different user identity for each service, but in reality, does that really happen? Seems like if you're doing that you're starting to mix authentication with authorization.

The picture in the article that says that the idp provides the answer to "login to cat", "log in to to payroll" is wrong imho. the IDP is providing the answer "username is X", and that's it.

<comment><USER5> The article provides examples of the IDP providing using different _IDP identities_ but I couldn't find an example of it suggesting different _user identities_.

The problem is the SAML assertion is effectively a bearer token, which is fine if it's specific to a service, and not fine if it can be replayed. If you want to unmix "authentication and authorization" as you put it, you're going to need a way to bind that credential further. You can either do that with some unspecified scheme that nobody implements, or you can do that by just using per-SP keys as the article suggests.

What do you propose we do instead?

<comment><USER7> If your SP supports it, you use SAML attribute assertions to model group/role memberships and only grant access to users in the appropriate groups.

Or you have your IDP (say ADFS) only permit issuance for authorization requests which are appropriate, again by reference to (say) AD group memberships.

If your SP doesn't even validate the audience for the assertions, then you're definitely going to be in a bad place - but the question there is "how do I limit the damage this braindead SAML implementation can do to my enterprise and how do I make sure I never buy software broken like this again?" rather than a screed suggesting authentication and authorization are the same thing.

<comment><USER5> Are you suggesting that there are "levels of broken" here, where an application that doesn't do audience validation will almost certainly screw up group membership assertion?

<comment><USER7> My experience is that many vendors will happily say "SAML 2.0 integration for SSO" when they mean only that they can pick a username out of an identity assertion. I personally haven't seen one which mismanages audience validation.

Above and beyond that, support is tremendously variable. Ability to do JIT provisioning/re-provisioning with user roles etc mapped to attribute assertions is something like nirvana and about as commonly realized.

"SSO once you have pre-provisioned the user out-of-band via our application- specific API" is more common (bonus marks for SCIM). Also "SSO assuming you can provide access to an LDAP server where we can look the user up".

<comment><USER5> OK, but my question was specific. You appeared to hint that anything that doesn't do audience validation is so horribly broken that it's unusable. That's not only very different from my experience (audience confusion, and particularly domain confusion bugs are super common), and I think there's a good reason for that. If your integration claims to be able to consume group assertions but it doesn't, that will be immediately visible to anyone trying the integration. If you screw up audience validation, no-one will notice until they perform a very specific test that the vast majority of vendorsec programs will never test for, and a good chunk of the ones that do will have signed a contract that prevents them from testing or at least publishing findings.

(Completely agreed that the vast majority of SSO integrations only let the IdP assert identities, not group memberships.)

</comment></comment></comment></comment></comment></comment><comment><USER8> As a SAML service provider, what's the easiest way to tell if my implementation has this problem?

I'm guessing I should: 1) Go into my Okta dev account, create a 2nd "okta app" (SP instance) pointing at my hosted application, which should create a new entity ID 2) Start an IDP-initiated login attempt from this 2nd okta app, and verify I get an audience mismatch error

<comment><USER4> This should work as long as your chosen Entity ID for your second Okta app doesn't match the actual Entity ID of your SP.

</comment></comment><comment><USER9> I don't understand why all security assertions must always be provided to each service provider.

This is probably something fundamental I'm misunderstanding about SAML, but when you authenticate for a particular SP, why does the response automatically include every assertion? It seems too obvious to just configure which claims are issued for each service provider. That wouldn't require any special crypto stuff.

<comment><USER10> It doesn't. The concern is that all of these assertions are captured by the browsers, who are given custody of the signed assertion as part of the SAML POST flow. The attack being contemplated here is that you have a SAML IDP configured for Cat Sharing Application and for Internal Admin Application; a attacker's browser holds onto the Cat Sharing Application assertion and feeds it to the Internal Admin Application, and, because SP SAML libraries are terrible, the Internal Admin Application honors it.

<comment><USER11> One hopes the Oktas of the world had this figured out and this is more a problem when you host your own IDP.

<comment><USER12> This is part of what makes this class of bug so bad; it's not something you can "fix" at the IDP without doing exactly this. The issue occurs when a Service Provider (SP) is misconfigured, and in many cases the IDP doesn't actually get any sort of feedback that would let them detect the issue.

<comment><USER11> Is there a way to audit that kind of misconfiguration?

<comment><USER10> Yes, tediously, with auditors who understand SAML and the (very informal) literature on SAML attacks. Hence, the concern.

<comment><USER13> Wouldn't it be enough to enter an invalid audience when configuring the IDP? If the audience is ignored the sign-in flow still allows you to log on and you know the SP is broken.

<comment><USER5> Sure, but two reasons that's not quite optimal and you might not want to do that in practice:

1\. This tells you the SP is broken; just using individual keys means that doesn't matter anymore if the SP is broken or not. Individual keys is in your control, fixing the SP much less likely so. And you can just set up a practice of doing it for everything and now it's one less thing to test for.

2\. That still requires a bit of testing that's somewhat annoying to set up, which most vendorsec practices don't have time for. It's also only one of dozens of things you need to test for. Ignoring audiences is super common, but a more subtle problem is that you can sign a valid SAML assertion _for the wrong domain_, and now you can sign in as a competitor's staff.

As you hint at, having an SP that'll just self-service accept any random metadata.xml at least gives you a fighting chance :)

<comment><USER13> My question was more related to it being tedious. And now you say it requires a bit of testing which is annoying to set up. Isn't testing this just a matter of changing the audience field to something incorrect and try to sign on? This should take like 2 minutes?

<comment><USER5> If you just change the audience field, the signature will be invalid, so it might tell you the SP won't accept a bad signature, but it doesn't tell you that the SP would accept a correct-signature-for-wrong-audience assertion. And now we've explored two states in that very big tedium space I mentioned; it still doesn't tell you anything about e.g. canonicalization bugs or cross- domain bugs. Those are much harder to test, because they require your IdP to sign specifically crafted assertions malicious, so you can't test them with your standard Okta install or whatever.

So, sure: you can test this one specific bug by replaying an assertion for a different SP. Or you can make your IdP use new key pairs every time and then you're definitionally immune to the entire bug class forever with every SP. Even if replaying the SP takes 2 minutes, getting the tester to a place where they can exploit it takes way longer for most companies, so it's much more effective to just eliminate entire classes of bugs via policy.

TL;DR: you're right (modulo the amount of time) for this particular bug, but why bother? And if you're going to bother testing, why test for this one specific bug that's cheaper to avoid a different way? (I can think of a reason to test; but then the tedium comes in :))

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Hmm. I use simplesamlphp. What would be the easiest thing to change to?

<comment><USER15> I implemented simplesamlphp idp two weeks ago, seeing we are a PHP shop it was the obvious choice. Somewhat rethinking that decision now, wondering the same thing.

<comment><USER16> > seeing we are a PHP shop it was the obvious choice

A Google search for 'php saml' has php-saml as the top result. I'm curious to know why you chose simplesamlphp over php-saml ?

<comment><USER4> php-saml is a toolkit for making your application a service provider (i.e. able to accept Responses/Assertions from IdPs) so that users can single sign- on to your application.

SimpleSAMLphp is a framework/application for creating your own SAMl IdP (i.e. able to send Responses/Assertions to service providers) so that your users (e.g. in an enterprise) can login once and then single sign-on to the rest of your applications.

</comment></comment></comment></comment><comment><USER17> sounds like an idea of a mix of the better parts of SAML and Kerberos (with the result being kind of fixed Kerberos where SP would store a public key to trust instead of its own private). Of course one may end up with the result being the mix of the worst parts ("Twins" movie comes to mind by association :)

<comment><USER18> SAML is close to what you'd get if you tried to port Kerberos to web technologies. Unfortunately, there are more shitty SAML implementations than Kerberos ones.</comment></comment>


The Case of the Phantom Caller - <AUTHOR> https://www.gimletmedia.com/reply-all/104-case-phantom-caller <comment><USER2> This was some fantastic investigating by Alex in this episode. Reply-All has done some really great journalism and reporting, including their episode on the fake tech support phone scam[0] and a more recent episode on the effect of the Backpage laws on sex work in general[1].

Tangential but related: I've been getting spam phone calls from local-to-my- number area codes (760, 619, and 858) at a rate of about 2-3 a day for more than a year now. It's funny because I don't live in San Diego anymore, so they're not actually local calls for me. VZW seems unwilling or unable to stop it. Robokiller, which promises incredible results catches 1-2 calls a week, but because the spammers are using SIP spoofing they never actually call from the same number, making it hard to compile a consistent and relevant blacklist.

Frankly, if I didn't have a chronic medical condition, and the specialist I see for it didn't require that I be able to receive phone calls to deal with scheduling, I would have insisted all of my regular contacts switch to FaceTime Audio, Signal, Telegram, etc and just disabled incoming telephone calls to my phone entirely.

[0] [https://www.gimletmedia.com/reply-all/long- distance](https://www.gimletmedia.com/reply-all/long-distance) [1] [https://www.gimletmedia.com/reply-all/119-no-more-safe- harbo...](https://www.gimletmedia.com/reply-all/119-no-more-safe-harbor)

<comment><USER3> > Robokiller, which promises incredible results catches 1-2 calls a week, but > because the spammers are using SIP spoofing they never actually call from > the same number, making it hard to compile a consistent and relevant > blacklist.

Note too that the spammers are using _valid_ phone numbers belonging to other people, which means that a blacklist will start to block real people.

I know because someone else was getting constant spams from someone who was using _my_ number! AFAICT there's nothing I can do about it

</comment></comment><comment><USER4> I just want to say that I really enjoyed this particular episode and thought Alex did an amazing job of figuring out what was going on. Where ever there is a system tied to payments there will be someone trying to game the system for profit.

</comment><comment><USER5> Since this was from September, I am really interested now as to how the FBI investigation has gone. I'm just imagining some AT&T greybeard in suspenders putting his hands up and slyly saying "you've got me".

</comment><comment><USER6> Kind of reminds me of the footage in William Gibson's 'Pattern Recognition.' Hearing this also made me more curious about phone scams than anxious, which is a nice change.</comment>


Crowd-sourced Music Video - <AUTHOR> http://donottouch.org

<comment><USER2> WOW! This is absolutely incredible. I can't believe no one up voted it here!</comment>


Summer internship for teenagers? - <AUTHOR>

do any companies provide summer internships for teenagers ? <comment><USER2> Yes. Its fairly common. It helps if you have something you can point to to display your technical ability or aptitude, but my company regularly has internships for a half dozen students.

<comment><AUTHOR> even international ?

</comment></comment><comment><USER3> Our startup hires paid teenage non-technical interns. Email is in profile.</comment>


Dead Malls - <AUTHOR> http://deadmalls.com/ <comment><USER5> In my opinion, the suburban mall has always been an aberration and a contradiction. In the dispersed urban system that is the suburbs, malls attempted to offer the synergy and community that the dense city can offer - <USER2> walkable (from within) "city center" to buy what you need, for people to meet up and socialize, and so on.

And yet they weren't - they were sprawling monoliths only accessible via car. They weren't integrated meaningfully into existing city centers or the existing communities of the city. They were erected and expected to produce their own mini-city and mini-community, which they did faithfully for some years as they filled a niche that is otherwise unavailable to suburbanites.

But they don't make sense, not in the traditional city that can be navigated without a car, nor in the modern city that is thoughtfully designed with cars as a secondary concern and not as the first class citizen.

The final token that big box stores offered - a variety of goods that cannot be matched by smaller local stores - is mostly extinguished by the convenience of e-commerce which gives us access to _nearly any_ product straight to our door. This is why the most successful remaining big box stores are those that offer products that can be troublesome or impossible to ship - Home Depot, Ikea, etc

<comment><USER6> I don't see the contradiction. There are lots of suburban-styled malls inside "traditional cities" (dense urban areas), that look and work basically the same way, but are urban. Seattle has one or two of them, Portland has one, Minneapolis has one, London Ontario has one -- all of these within the core downtown.

Suburban malls are not uniquely suburban. Many of them are in suburbia because they originally targeted average/regular/middle-income people, so they are built in the places where those people are allowed to live (which in the US, is almost exclusively suburban areas).

Generally speaking, "Dead Malls" has little to do with malls dying (in the US, _we 're still building brand new malls today_), but has more to do with demographics shift (middle income people now live in different areas) and target market shifts (many new malls have moved up-market, there are less wealthy people than working-class people, and wealthier people generally don't live in the then-new 1970s/1980s suburbs anymore, they now generally live either full-downtown-urban or far-exurban)

<comment><USER7> The Eaton Centers in Toronto and Montréal also come to mind. They're huge, and intimately plugged into the center of the city, including being directly connected to subway stations.

That said, they're also, I suspect, mostly for tourists.

The Milwaukee area's malls really make the situation for suburban malls clear: The city buses do go to the malls, but the malls wouldn't let them drop people off by the door. They stop at an open air bus shelter at the far end of the parking lot.

<comment><USER8> Why didn't they want bus traffic directly to the mall?

<comment><USER7> My first guess would be concern that buses driving all the way up to the mall would somehow impede the flow of traffic for cars.

My second guess would be that, Milwaukee being such a suburban flight city, there are certain. . . _perceptions_. . . about public transit and the people who use it. I used to end up in some rather uncomfortable conversations when people found out I regularly used public transit.

My best guess would be that it's officially one, and unconsciously both.

<comment><USER9> It's also worth noting that navigating the mall parking lot is very slow for buses, and increased travel time on bus routes

1\. Increases opex significantly, up to the point where you may need an additional bus and driver to provide the same frequency

2\. Is bad for anyone making a trip passing through the mall

</comment></comment></comment></comment></comment></comment><comment><USER10> I still think a dead mall would be a great startup incubator - each small group gets its own office, tons of shared space to interact with each other, food court for local restaurants to cater to everyone, some big anchor spaces for the larger companies (or even a local data center), and even some built-in back offices for the property managers.

<comment><USER11> I feel like malls have potential as massive culinary incubators, with the tired chain clothes store replaced with massive arrays of experimental restaurants and bars. This is anecdotal, but every 1-2 weeks I go to a mall I work near for lunch, yet for the two years I have been doing this I have yet to purchase any non-food merchandise (though I got close when browsing one of the bookstores).

<comment><USER12> I could get behind this. But it has to be different from current mall fare. I hate chain restaurants. Food courts tend to be sandwiches or fried crap passed off as ethnic.

When I lived in Boston there was a place in Chinatown called the Eatery. When you walked into the main room it had probably 15 different stalls, all with different types of Asian food. Everything was made to order. A mall converted into something like that I could get behind.

<comment><USER13> Food trucks serve this role in a few American cities (Portland, Austin). Nothing like the hawker stalls of Singapore, but fairly diverse.

<comment><USER14> Unfortunately the greatest concentration of food carts in Portland has gotten shut down. The land is being developed into a condo :-(

</comment></comment></comment></comment></comment><comment><USER15> It just needs galleries, I'm not going to read a blog post about a defunct mall without any pictures..

<comment><USER16> The YouTuber Dan Bell has a series where he explores dying or abandoned malls, juxtaposed with archive video from when they were alive and vaporwave music.

[https://www.youtube.com/playlist?list=PLNz4Un92pGNxQ9vNgmnCx...](https://www.youtube.com/playlist?list=PLNz4Un92pGNxQ9vNgmnCx7dwchPJGJ3IQ)

<comment><USER17> Those videos have a very interesting aesthetic, it kind of reminds me of what happens when someone who doesn't know how to make videos (and thus doesn't know the current trends) starts making them, in the process inventing their own, totally new style.

<comment><USER18> Vaporwave aesthetics are pretty interesting. The late 80s - mid 90s period of pop culture seems to have a lot of nostalgic and pseudo-nostalgic appeal for a lot of people.

<comment><USER19> It's weird. My partner and I are late twenties and talk a lot about 'nostalgia for something never truly experienced'.

We were too young to experience the '80s, and most of the '90s passed us by as children. But now, looking back, there is such a strong appeal - <USER3> was still exciting without the societal consequences and complications - <USER4> really only used computers to play games and not for productivity. The anxiety and stress of social networks did not emerge until we were effectively adults and therefore a bit more immune.

Anyway, we love Com Truise, HOME, Flamingosis, and other artists (Simpwave on youtube!) creating a neo-retro-synth-vapour kind of pastiche, but it's odd to think that it's all referencing things that we are experiencing only in hindsight.

<comment><USER20> It's even odder from the perspective of someone who actually lived through it. I'm guessing the way I feel now is similar to how people my parents' age felt with all the hippie culture appropriation my friends were doing in the 90s.

</comment></comment></comment></comment></comment></comment><comment><USER21> There's a dead mall by an old office I used to work at. Stranger Things Season 3 rented a side of the mall and transformed it into an 80s mall.

This mall should die anyway. It has an H Mart and a Macy's no one goes to.

[https://www.gwinnettdailypost.com/multimedia/photos- stranger...](https://www.gwinnettdailypost.com/multimedia/photos-stranger- things-season-at-gwinnett-place- mall/collection_f2d9b7f2-9df0-11e9-a599-2b125d10940d.html)

<comment><USER22> WOW! that site slurps up so much personal data they won't even allow me to view it from Europe in case they violate GDPR... "451: Unavailable due to legal reasons

We recognize you are attempting to access this website from a country belonging to the European Economic Area (EEA) including the EU which enforces the General Data Protection Regulation (GDPR) and therefore access cannot be granted at this time."

</comment></comment><comment><USER23> Andrew Yang has thought of this (like seemingly everything else). He's calling for amongst other things matching federal grants for helping repurposes dead malls (and the 300 malls he says will likely close over the next 4 years) for other purposes.

[https://www.yang2020.com/policies/american-mall- act/](https://www.yang2020.com/policies/american-mall-act/)

</comment><comment><USER24> Bright Sun Films on YouTube should get a shout out here. He produces a series called Abandoned, which covers topics like this.

[https://www.youtube.com/user/BrightSunGaming](https://www.youtube.com/user/BrightSunGaming)

</comment><comment><USER25> I said it before and I'll say it again: the fact that malls are (justifiably) regarded as a treasured social institution in communities seems ridiculous to me. It's a statement on the failure of a society to provide places for meaningful interaction beyond consumption, or places to feel safe that are not guarded by private security.

<comment><USER21> Have you ever tried a park? There are probably 5-10 parks within 5 miles of me including a huge river parks and nature preserves.

People grilling, kids playing, walking/running/biking/kayaking/paddle boarding and people just sitting and relaxing. Lots of social interaction.

If you're out of grade school a mall is not an appropriate place for social interaction.

<comment><USER26> There are a lot of places where parks are nearly unusable for months of a year. I'm not in an extreme climate by any measure, but there are 3 months when socializing in a park is at best uncomfortable.

Why do you specify "out of grade school"? Isn't the fact that the mall is the go-to for grade schoolers just as big a problem? Where are kids and adults _supposed_ to hang out in a group without having to host in their small home?

<comment><USER21> Gyms, parks, bars, and restaurants are the usual suspects. Dog parks are great too. I'm also trying to get into a community garden and take a class at an art center, I'll likely be on the younger side in the last two.

Kayaking (not whitewater) and fishing are my two favorites especially if you combine the two. I usually talk to any fisherman I see and people come up to me at the ramp to chat.

<comment><USER26> None of those places are meant as hangout locations, and all of them require paying. Malls were useful to kids because being there was free for essentially an unlimited amount of time. Sure, you'd buy a soda once in a while, but that's not enough to be allowed to spend 4 hours in a bar or restaurant.

A closer use case would be neighborhood centers, but in my area, those are mostly closed in the evenings or at least reserved for private use.

<comment><USER27> Where do you live that you have to pay to access a public park?

<comment><USER26> Read the rest of the thread. Parks aren't really an option for about 1/4 of the year where I live.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> Hosting co Rackspace's HQ is a former mall in San Antonio, Texas [https://www.nytimes.com/2012/10/31/realestate/commercial/rac...](https://www.nytimes.com/2012/10/31/realestate/commercial/rackspace- revitalizes-a-defunct-mall-into-an-unorthodox-tech-campus.html)

<comment><USER29> AboveNet built out a datacenter in a mostly derelict mall in the middle of downtown San Jose. At the time the irony of ecommerce servers in an abandoned mall was fresh and surreal.

</comment></comment><comment><USER30> Retail Archaelogy is another great YouTube channel on the same subject: [https://www.youtube.com/channel/UCR2LNeZSqINp0WTd_eWCIGg](https://www.youtube.com/channel/UCR2LNeZSqINp0WTd_eWCIGg)

</comment><comment><USER31> Some unexpected racism in the story for the Harding Mall in Nashville, TN:

> Throughout the many years, this mall really saw the tenants come and go. It > was no big deal until foreign language people and gangs took over this part > of Nashville.

<comment><USER32> I fail to see racism in the quote, it seems to be describing demographic shift of the mall as it fell out of popularity.

> Then just as Harding Mall thought it was the end, it was not. Due to the > high levels of foreign people and foreign languages, a local enteprenuer saw > hope in the old mall cinema. He leased the space and ran movies that cost > about 50% less than what other theaters charge today and they were all > foreign speaking films.

<comment><USER33> > foreign language people and gangs took over this part of Nashville

This is clearly grouping "foreign language people" and "gangs" together. The phrase "took over" has negative connotations.

It's pretty clearly saying that it is bad that people who speak foreign came into the area, not just neutrally "describing [a] demographic shift of the mall "

<comment><USER32> > The phrase "took over" has negative connotations.

If you want it to, sure, it absolutely can!

> It's pretty clearly saying that it is bad that people who speak foreign came > into the area, not just neutrally "describing [a] demographic shift of the > mall "

No, it really isn't clearly saying what you're ascribing. That's your reading into it what you want to see. No one cries racism when an article about affluent whites taking over a neighborhood. This is just a different shift.

<comment><USER5> >No one cries racism when an article about affluent whites taking over a neighborhood.

People absolutely do, even when words as strong as "took over" aren't used. Whenever race is mentioned wrt gentrification, it's one of the top comments|

For example [https://news.ycombinator.com/item?id=19819695](https://news.ycombinator.com/item?id=19819695)

> With the passage of the Civil Rights Act, we as a society decided that > racial segregation was bad, and trying to demonize people people buying > homes in a certain area due to their race was wrong

...

> Not okay to tell some one he ought not live somewhere because of his race. > This is true regardless of what that race may be.

<comment><USER32> Well I was clearly wrong to claim "no one," but that has no bearing on whether the user-submitted article referenced was written with actual racial animus as asserted, or was just ill-phrased observation.

</comment></comment></comment></comment></comment></comment><comment><USER34> The Dead Malls site links to another treasure trove of retail history - [http://pleasantfamilyshopping.blogspot.com/](http://pleasantfamilyshopping.blogspot.com/)

For example, the clip in this post is a fascinating glimpse of Los Angeles in 1954. [http://pleasantfamilyshopping.blogspot.com/2012/02/shopping-...](http://pleasantfamilyshopping.blogspot.com/2012/02/shopping- in-los-angeles-1950s.html)

</comment><comment><USER35> In cold climates, why not turn dead malls into giant indoor parks?

That way people could go jogging in a T-shirt in February.

Especially the malls that have big skylights, you could plant trees and greenery inside.

Maybe install a few pools.

</comment><comment><USER36> I live next door to a large, modern, outdoor mall (which is very popular; it's a horrible pain in the butt around Christmas). These are obviously not the "dead malls" that the site is referring to.

As a kid from the 90s living two miles from a near-dead mall and within 25 miles of 3 completely dead ones, I'd love to see them convert the walking areas into a large skating rink[0]. Heck, I just ordered a Onewheel and live in an area that is regularly covered in snow -- that'd be a hell of a venue to roll around in.

Granted, it's a terribly inefficient use of the land, after insurance/marketing/staffing costs, etc, it'd probably be impossible in most places to charge a ticket fee that would be profitable.

[0] I have to believe this has been done somewhere, already. The Lions used to play at this horrible venue called The Silverdome in Auburn Hills, Michigan. After they moved to the new stadium in Detroit, they used to do open skating on the weekends around the outer concession area (the large ring you walk through to get to your seats). It was a few bucks plus rental fees and was always busy.

<comment><USER37> There's a medium sized mall in my town and it's doing very well, it is always quite busy. Similarly there are huge malls in OKC and Tulsa which are doing great, they are full and have the most expensive retail space in the state. However Crossroads Mall in OKC became completely abandoned. I feel like there are lots of other factors involved in the success and failure of malls.

</comment></comment><comment><USER38> I have occasionally toyed with the idea of buying a dead/abandoned mall and turning it into an enormous adult playground.

<comment><USER28> They seem to be popular with airsoft players [https://www.youtube.com/watch?v=HrGdr537jCw](https://www.youtube.com/watch?v=HrGdr537jCw)

<comment><USER39> Drone racing would be good too.

</comment></comment></comment><comment><USER39> One of the local "dead malls" is thriving as a collection of about 3 strip malls surrounding the common parking lot. Each "strip mall" has one or two big box stores and a couple have a line of smaller stores.

Of course, the two story mall itself, with its internal hallways and rows of boutique stores, is gone.

<comment><USER40> One of the places I remember most vividly from my childhood Christmas times was the "Shopper's World" mall in Framingham, MA (which is indeed listed in the above Dead Malls website). It was a two story mall that was wrapped around and open to a central grassy area. While incredibly dated now looking at pictures, the architecture was pretty cool and memorable. They tore it down in the mid 90's and replaced it with a very boring big-box plaza mall that looks exactly like every other one in existence. It still does a fine business. Makes me sad any time I go there now.

Additionally nostalgic, the local Hostess bakery was across the street pumping its exhaust into the air. Whenever you went to the Shopper's World mall, the whole area smelled like Wonder Bread.

</comment></comment><comment><USER41> I've always been drawn to weird, haunting, empty urban spaces. I also feel an affinity for vast spaces with huge, elaborate skylights like you find in malls. Throw in some nostalgia and I'm enjoying this YouTube channel.

</comment><comment><USER42> Google is leasing the Westside Pavilion in LA, looks really nice: [https://www.youtube.com/watch?v=BkggQS0eTSw](https://www.youtube.com/watch?v=BkggQS0eTSw)

</comment><comment><USER43> Maybe they should advertise their dead mall as a fun hide and seek venue :)

<comment><USER44> this is pleasantly relevant given today's Ikea Ireland news

<comment><USER43> It seemed synergistic to me :)

</comment></comment></comment><comment> your-nanny Dead malls should become foodie plazas with childcare for diners.

</comment><comment><USER45> Here in California I've noticed the newer open outdoor malls are doing better.

</comment><comment><USER46> Sidenote: isn't it a bit odd that they have a merchandise page?

[https://www.cafepress.com/deadmalls](https://www.cafepress.com/deadmalls)

<comment><USER47> I had a niche site like this back in the day, and I also has a merchandise page built on Cafepress. I didn't sell a single shirt, but I had fun by the idea that I might. Cafepress pages take at most 30 minutes to create.

<comment><USER48> Heh, me too, and some random guy on the other side of the world actually bought a clock with my logo on it. Other than a few mugs for myself that was literally the only sale I ever made. I often ponder what became of that clock.

<comment><USER49> Did you ever try to track it down? A documentary connecting buyers and sellers of low-quantity sale cafepress items might be lovely.

<comment><USER50> Cafepress should automate that connection.

</comment></comment></comment></comment></comment><comment><USER51> We should fill them with internet-connected theme parks filled with 3D printed displays.

</comment><comment><USER52> The truth is, every mall right now is a dead mall. Just like every mechanical watch is an inaccurate watch - it seems that most people opt to use malls primarily for emotional reasons.

With Amazon and Walmart now offering next day delivery for almost nothing and the changes in many American neighborhoods - the countdown is on for these vestiges of 1980's Americana.

<comment><USER53> > it seems that most people opt to use malls primarily for emotional reasons

People also like to try on clothes before they buy them, to make sure they fit.

<comment><USER52> I completely agree but with services like Prime Wardrobe and Bombfell etc you can have a box of clothes delivered to you in 3 different sizes and return what doesn't fit.</comment></comment></comment>


Google employees pushing for nationwide legislation banning forced arbitration - <AUTHOR> https://www.recode.net/2019/2/28/18244755/forced-arbitration-employees-google-walkout-activists-congress <comment><USER2> The problem with arbitration is bias. Companies volunteer to hire the arbitrator and the arbitrator routinely rules in favor of the companies because they know where the money is coming from.

The problem then seems to be not the idea but the implementation. If we could get rid of the bias, arbitration could be an effective solution to resolving workplace disputes in a manner much faster, cheaper and with less headaches than courts.

The problem of bias in arbitration doesn't seem like an insurmountable one to me. Imagine if both the employee and the employer had to agree to an arbitrator or arbitration company - failing which the matter has to go to a state run court.

Imagine if there was a rating system - where people or lawyers can rate arbitrators on their fairness and knowledge of the law.

Arbitration is widely used in b2b settings. The problem with employee employer arbitration isn't the arbitration itself, it's the power imbalance and the employers control of the arbitrator.

What legislation should target is employers who control arbitrators and use them as a rubber stamp court.

<comment><USER3> It's not just bias. Most disputes are settled through negotiation rather than arbitration or a lawsuit. The results of negotiation depend on the parties' BATNA, or Best Alternative To Negotiated Agreement. If the company's BATNA is forcing you through cheaper binding arbitration rather than a more expensive lawsuit, you're not going to get as good of settlement offers in lieu of the formal dispute resolution process.

Another way of thinking about it: reducing the price of formal dispute resolution will cause induced demand. There are disputes that employers would send to arbitration if possible and settle out-of-court if not. It's not necessarily the case that making dispute resolution cheaper _per case resolved_ will result in less money spent on it _in aggregate_.

<comment><USER4> This is the first time I've heard an argument _for_ the crazy high cost of the US court system.

Realistically though the BATNA is no lawsuit at all because the plaintiff can't afford it.

<comment><USER3> Lawyers will take strong cases against deep-pocketed defendants on contingency, obviating that need.

<comment><USER4> That's only for the most obvious of cases lacking any nuance. Further in such cases the lawyers take much of the recovered so the plaintiff collects pennies on the dollar - while risking their professional reputation.

Its a matter of degree, Companies know they can screw employees under a certain amount where its not worth it to challenge them in court. With court costs as high as they are that amount is in the tens of thousands of dollars.

</comment></comment></comment></comment></comment><comment><USER5> "No worker is safe until all workers are safe. No consumers are empowered until all consumers are empowered," said Tanuja Gupta, one of the organizers of the Google Walkout and a member of the spinout group End Forced Arbitration at a press conference in DC announcing today's legislation. "We call on Congress to quickly pass the Forced Arbitration Injustice Repeal Act."

Gupta ( if you know who it is) can not be sure of it..

</comment><comment><USER6> what percentage of the employed population are google's employees?

<comment><USER7> A better question: what % of employees are (often unknowingly) covered by forced arbitration clauses.

Google employees have an advantage over lower wage workers because in america people with money are more important to legislators than those with less.

</comment></comment><comment><USER8> Are they invested in law firms? Because that's the logical explanation for taking up this silly cause.

<comment><USER9> Arbitration is the result of a power imbalance between labor and employers, an attempt to subvert the ability to seek recourse in the justice system. It is wildly disingenuous to insinuate investment in legal firms is the motivator.

Uber and Chipotle are two examples of arbitration working as intend by employers.

[https://www.reuters.com/article/legal-us-otc-uber/forced- int...](https://www.reuters.com/article/legal-us-otc-uber/forced-into- arbitration-12500-drivers-claim-uber-wont-pay-fees-to-launch-cases- idUSKBN1O52C6) (Forced into arbitration, 12,500 drivers claim Uber won't pay fees to launch cases)

[https://www.latimes.com/business/hiltzik/la-fi-hiltzik- chipo...](https://www.latimes.com/business/hiltzik/la-fi-hiltzik- chipotle-20190104-story.html) (Chipotle may have outsmarted itself by blocking thousands of employee lawsuits over wage theft)

<comment><USER10> The Chipotle example is news because it is precisely not working as intended by the employer - it is preventing Chipotle from mounting a single deep pocketed defense for all of the cases together, and forcing Chipotle to address the claims one by one in small claims arbitration, which will may cost it more than just paying out.

<comment><USER11> Curious, isn't it. Google cancelled their forced arbitration policy so soon after we saw it going so badly for chipotle and uber...</comment></comment></comment></comment>


Ask HN: What tech events are you most excited about? - <AUTHOR>

Would love to get some input from the HN community.  What tech events are you most excited for?  Are there tech events that you have attended in the past that you learned alot from?<p>I'm trying to see what events I can attend this year to network and learn more about the community. <comment><USER2> Google IO</comment>


Things To Do When You Win The Lottery - <AUTHOR> http://www.forbes.com/sites/deborahljacobs/2012/02/11/10-things-to-do-when-you-win-the-powerball/ <comment><USER2> While all of that seems to be sound advice, i probably never have to worry about having such obscene amounts of money ;)</comment>


Ask HN: How did you find interesting startups to apply to? - <AUTHOR>

I'm moving to the Bay area next summer and I plan on becoming a business developer/salesman for a startup. I have two questions:
1.) How do you find growing startups that have really interesting visions? I read Tech Crunch, HN, etc. and sometimes I find some and I think how the hell have I never heard of them?! Obviously there has to be more out there.
2.) Is there a Monster.com for Silicon Valley startup jobs? I've been reading Angellist and I really like how they are upfront with salary and the skills they need. Are there other sites like this? <comment><USER2> For point #2, <http://startuply.com> is a site that caters only to startups. The monthly Hacker News "Who's Hiring" thread is another place to start (ex: <http://news.ycombinator.com/item?id=4463689>).

Networking is always the best, but it is good to look at the whole field.</comment>


Ask HN: What did you pay for firstnamelastname.com - <AUTHOR> just curious what a reasonable figure is for a domain like matthewsmith.com or davidrandall.com, guess it probably depends if your name is common or not? <comment><USER2> Mine was far too expensive, so I spent three years getting a Ph.D. and bought drtomallen.com instead.

</comment><comment><USER3> Assuming your first+last is already being parked by someone? Was able to get mine at a registrar, but it was my nickname where I paid a "premium" about 7 years ago... five letters and I really wanted it. Negotiated a guy from $3000 to $300. More specifically, his first response was $3000 then I waited three months and offered $300. He had a formal landing page.. no different from hugedomains.com - I've noticed for non-brandable "premium" domains these services are trying to get $1-2k for personal domains.

</comment><comment><USER4> I pay $10/y, one of the benefits of having a rather not popular last name

</comment><comment><USER5> About $50/year on initial registration, but that's because .coms were so expensive then / seemed expensive / didn't find cheaper options.

Then $10 / year. And now $15 / year on a registrar I trust with security a fair bit more.

Reason for a change in paying a little more for a much better (perceived, at least) service was I started getting mails from someone with the (almost same) name suggesting I 'give' him my domain name (and Twitter, and Gmail, and LinkedIn, etc). Give him. As 'I was not using it'. Despite having it as primary email address for ~15 years and a small placeholder page for namecard, logins, ssh, personal projects, cloud hosting, etc. Persistent, timed emails, every 6 months or so. And he was in SEO so perhaps somewhat cluefull of dark arts, so move to a non-cheapest registrar.

If you're on the reverse, check your registrar is providing a secure service, for example passwords not (or seeming to be, based on login hints), in plain text.

</comment><comment><USER6> I have a relatively uncommon last name, so I got my domain name at the standard price for a domain name ($11/year at Dynadot)

</comment><comment><USER7> My last name is shared with about 8 people in my country, so I managed to snag lastname.ca and now my email is firstname.lastname@example.com (but I still own firstname.lastname@example.com which is a mouthful.) lastname.com is parked but it keeps getting renewed shortly before it expires. Both domains cost around $10/yr

</comment><comment><USER8> I reached out to the owner of my name.com and we agreed on $100. He wanted $4000 but when he realized that I just wanted to host a personal site he was happy taking $100.

</comment><comment><USER9> I tried lastname.email but had trouble validating the address email@example.com at a lot of places. Lucked out though and found a tld with the last two letters of my last name, now I'm firstname.lastname@example.com and I think it's slick. Hard as hell to explain to customer service reps that there's no '.com' at the end of it though.

</comment><comment><USER10> I'd probably pay up to $500 but really it's all up to you.

I registered firstnamelastname.com a few years ago which was fortunite as there a few of my name about. Someone later registered my local county domain and used to putting heavy religious stuff on it so I regret not buying that one too now as occasionally people confuse .com and the country domain.

</comment><comment><USER11> I originally tried to find lastname.com, but that was already taken. So I got lastname.me. Now my email is firstname.lastname@example.com. Later on I registered firstnamelastname.com and fistnamelastname.me just to be safe.

The .me domains are more expensive, but I really like them for use as a personal domain. I pay $75/y for three domains.

</comment><comment><USER12> $1000

:(

Took me almost 10 years to get. Finally used network solutions certified offer service instead of paying the 10k and 5k previously quoted.

<comment><USER13> After 10 years, doesn't sound too bad actually.

</comment></comment><comment><USER14> I got it a long time ago, so just ~$10/year for over a decade.

I did once get contacted by one of my dopppelnamers, who happened to be the lead guitarist of an 80's one-hit wonder band (and now solo), but I didn't want to give it up.

I have the .com, but he dominates SEO for our name.

</comment><comment><USER15> I think I just paid the regular .com amount from when I first registered it 10 years or more ago.

My surname also ends in BY so I recently bought a Belorussian domain for it so my website is [firstname].[partofsurname].by and email address is [firstname]@[partofsurname].by

</comment><comment> saiko-chriskun I've been using nbolt.io even though I own neillbolton.com. Is the .com worth it?

<comment><USER16> nbolt.io sounds better in my opinion.

</comment></comment><comment><USER17> FirstnameLastname.com was taken so I registered firstname-lastname.com ($8 back then). Though, I'd waited for 3 years for FirstnameLastname.com to expire and when it happened I grabbed it.

</comment><comment><USER18> I have an unusual last name - firstinitiallastname.com was about $10 per year.

</comment><comment><USER19> It depends on how common your name + lastname is. I have a very common first name + last name among Indians and plenty at silicon valley but I got mine few years back at my registrar for $13 per year.

</comment><comment><USER20> both my first and last name are very rare so I could get it for $10/yr

</comment><comment><USER21> £8.10 firstnamelastname.com

£4.46 firstnamelastname.co.uk

Fairly common firstname, Surname: 18,714th most common surname in the world, Approximately 27,829 people bear this surname

<comment><USER22> Where did you get the stats?

<comment><USER21> [http://forebears.co.uk/](http://forebears.co.uk/)

</comment></comment></comment><comment><USER22> I have a relatively uncommon last name, so I got my domain name at the standard price for a domain name ($11/year at Namecheap)

</comment><comment><USER23> I have lastname.localtld costs me $15. I think local tlds make much more sense for name domains than generics like .com.

<comment><USER24> I picked $firstname.$localTLD in 1999, at the time I had to use register.com and I paid $79 a year for about five years. Nowadays the pricing is closer to $10.

</comment></comment><comment><USER25> $10 for a .name domain. I think it's appropriate for personal sites, although .com would be nicer.

</comment><comment><USER26> I've got an .se domain with my unique last name which is something around $15 per year.

</comment><comment><USER27> ~$12/year for jonaseinarsson.se and .com (it wasn't taken)

Semi-common name in Sweden.

</comment><comment><USER28> I'm lucky. Exotic name. And I've had it for 10+ years. $10/year

</comment><comment><USER29> I got firstname.it for around 7$ PS: 4 letter uncommon first name

<comment><USER30> I raed.it. Good looking website.

<comment><USER29> Thanks, it helps with the job hunt.

</comment></comment></comment><comment><USER31> Just make up a middle initial and put it on your resume :)

</comment><comment><USER32> my name + lastname mix is rare so i just paid regular registration fee

</comment><comment><USER33> myname .com was several hundred(?) so i moved to myname.co and it's about 11$/year.

</comment><comment><USER34> $10 per year - alexkras.com

</comment><comment><USER35> $7.99/yr I believe.

</comment><comment><USER36> got mine in around 2005 for about $8 a year

</comment><comment><USER37> $11/yr

</comment><comment><USER38> I paid 10.

</comment><comment><USER39> $10

</comment><comment><USER40> 12 USD :D</comment>


Kim Dotcom shows off new mega service - <AUTHOR> http://www.theregister.co.uk/2012/12/09/kim_dotcom_shows_off_new_service/

<comment><AUTHOR> It's probably gauche to make the first comment on one's own submission, but what does any of the following mean?

"shows a 2048-bit key being generated."

"To strengthen the key, we have collected entropy from your mouse movements and keystroke timings."

I'm not a crypto guy so the above sounds like marketing/gibberish to me.

<comment><USER2> It's not gibberish, you could easily google it: <http://en.wikipedia.org/wiki/Entropy_%28computing%29>

> This randomness is often collected from hardware sources, either pre- > existing ones such as mouse movements or specially provided randomness > generators.

<comment><AUTHOR> Thanks for the link.

</comment></comment></comment><comment><USER3> Looks solid to me. Megaupload will be back as an even better cloud service with this. Let's hope the speed is still the same :)</comment>


Linux Foundation Pours $200,000 into R language - <AUTHOR> http://www.infoworld.com/article/3047181/application-development/money-talks-linux-foundation-pours-funds-into-r-language.html <comment><USER2> The original title is "Money talks: Linux Foundation pours funds into R language".

What is the Linux Foundation doing funding the R Consortium? R _can run on_ Linux, but it really has nothing directly to do with Linux per se.

And this isn't the first time I remember thinking, "What in the world is the Linux Foundation doing with _that_??" They're also funding the development of a real-time OS kernel for IoT devices.[1] Just feels like their mission is creeping, creeping....

[1]: [http://www.linuxfoundation.org/news- media/announcements/2016...](http://www.linuxfoundation.org/news- media/announcements/2016/02/linux-foundation-announces-project-build-real- time-operating-system)</comment>


What happened to Orson Scott Card? - <AUTHOR> http://www.salon.com/2013/03/07/end_game_for_orson_scott_card_partner/ <comment><USER2> Interesting. The author of that article sees Ender as very empathetic, and marvels that someone like Card could have written him. I disagree. 1) I don't think Ender was a particularly empathetic character, and 2) authors are not their characters. A little piece of me lives inside each of my main characters, but I don't necessarily see the world the same way my characters do. Card was an adult when he wrote about Ender Wiggin. He might have drawn from his childhood experiences, but he was not Ender.

</comment><comment><USER3> I'd love to see more examples of his writing that show exactly what his views are - rather than just supposing that someone who holds a conservative viewpoint on gay marriage is automatically a nutjob.

There is a big difference between holding a public policy opinion I disagree with and arguing "for the violent overthrow of the American government because of its failure to ban gay marriage and to outlaw homosexuality generally."</comment>


Kim Dotcom's Napkin Calculations on Cost of Surveillance Data Storage - <AUTHOR>

Source: Dotcom's Twitter feed @KimDotcom (https://twitter.com/KimDotcom)<p>Despite what you might think of him, these calculations are interesting: obviously Dotcom's got a lot of experience in the data storage space.  If he's right, it's incredibly cheap - little wonder it's tempting for the authorities.  Anyone got views on these figures?<p>/// Tweet 1 "Pay attention to my next two #NSA tweets! They will blow your mind. This is based on my own research & analyzing public data."<p>/// Tweet 2 #NSA spy cloud has 40+M hard drives & 150 exabyte of capacity. Enough to store all (US networked) emails, sms, calls & chats for 38000 days.<p>/// Tweet 3 The #NSA stores daily: 10B emails 500TB + 3B sms 500GB + 5B chatmsgs 1TB + 1.8B calls 2PB + misc 1PB at a daily cost of USD 550,000. CHEAP!<p>/// Tweet 4 The cost of a single F-35 U.S. fighter jet is equivalent to 278 days of total #NSA surveillance storage cost, capturing EVERYTHING. <comment><USER2> 5-6 years ago I used to tell conspiracy theory dudes that even if the feds wanted to slurp down all the data they wanted it would cost them too much for it to be effective and processing power would never be able to churn through it fast enough.

Now I realize thanks to the Google/Facebook big data era. Server storage/processing/bandwidth ability has increased exponentially from that time and everything has gotten cheaper. So this our reality now. It really feels like the start of some William Gibson novel come to life.

</comment><comment><USER3> Tangentially related, certainly to Ike's warning, I've read total cost now of entire F-35 program is something like 1.3 trillion dollars.</comment>


17 y/o kicked out of house - seeking devilishly motivated partner - <AUTHOR> https://docs.google.com/document/d/1ETJKRU16YORFCZ5YRdYEEdgQI9_5fFiaWVyepAp-PJo/edit?usp=sharing <comment><USER2> Lots of good responses here, but my 2 cents: Work on your writing. Aim for simplicity and clarity. Avoid words like "explicate" when "discuss" works just as well.

Students with strong STEM interests often undervalue good, simple writing. But learning to write is really about learning to communicate. And one of the most important skills for success, especially as a founder, is communication.

I recommend Strunk & White's Elements of Style as a quick guide to most of the things you need to know about writing.

<comment><AUTHOR> Unequivocally, I agree. Effective communication involves gauging the audience qualitatively and responding accordingly.

Thank you for your insight. Do you have any feedback about the ideas that which I was attempting to communicate?

<comment><USER2> Sure. In respse to your general point about desire and success, I would advise you to read this: [http://www.harvard.edu/president/2012-baccalaureate- service-...](http://www.harvard.edu/president/2012-baccalaureate-service- updraft-inexplicable-luck)

Start at the paragraph that says, "Extraordinary, indeed."

You may not agree with her overall point, but your life will not be the worse for having considered it.

</comment></comment></comment><comment><USER3> "My rationale is simple. If one wants to succeed, one will succeed. If one does not succeed, one did not want to succeed enough. Consequently, one was not willing to make the proper sacrifices required to succeed. Success is a function of desire. That's it."

I admire your ambition, but if you really believe the above you have a lot to learn about life. Best of luck with your endeavors!

<comment><USER4> Biggest problem with teenagers(I had my own when I was in my teens). They think their eagerness, fresh introduction to the world, and their raw energy as something that is going to stay forever.

Note, as a teenager you have least responsibilities. Hardly anything to lose when you fail, full of energy. And the only way you can go is up. And this is as easy as it gets, once you step into your 20's at every step there has to be a compromise, if you don't you will eventually anyway.

Though I wish this kid succeeds. But in general it takes two big failures, where things went wrong from reasons outside of your control to get a grip of the actual reality of life.

Basic things in life like hard work never change. But its important to realize merely just raw hard work is never enough. And there are people in this world who fail, despite working as hard as any one else. It takes experience to understand that.

<comment><AUTHOR> Success is simple. Success is working on what you love. If you work as hard as possible on something you love, doing so is far more rewarding than any and all extrinsic rewards.

</comment></comment></comment><comment><USER5> If you can't get As in high school humanities because you're too busy managing a single desktop computer & residential internet connection, you're probably not half as smart as you think you are.

You should take about 5-10 years off for introspection.

<comment><AUTHOR> I disagree with this claim. It is my firm belief that high school grades do not reflect intelligence. But rather, applied work ethic. Indirectly, I chose to get poor grades by allocating my time to things I thought were of greater importance. Then again, is that in it of itself indicative of ill-wit?

<comment><USER5> Why is your writing so formal?

<comment><AUTHOR> English Department Conformity ;)

<comment><USER6> Suggestion: Write as if your audience isn't full of English majors. Several reasons for this:

* There are lots of really, really smart people who aren't so good with English but still make good decisions and can help you. Don't alienate them.

* There are lots of really, really smart people who speak another language first and English second or third. Don't alienate them.

* Some people might find long words or complex language to be annoying. You might not like people like that, but again, sometimes those people are the very ones making important decisions, and it might be best not to alienate them.

You can still be correct and interesting without being complicated (look at this comment for example), and I'm sure your grasp of our language is good enough that you can be straightforward and simple without dumbing down your message.

In short, make people feel good about themselves when you're around, and they'll feel good about you.

</comment></comment></comment></comment></comment><comment><USER7> "The very instant I graduate High School, no longer will I conform to the societal bullshit that which I have been subjected to my whole life."

Please realise that societal bullshit doesn't go away after high school. You may find yourself disappointed if you expect a major reduction just because you leave the realm of the underaged.

"I don't care if you've never programmed, developed, or designed in your whole life. My only requisite is that you carry more motivation and determination than all of Y Combinator combined. "

That's a rather high requirement :) Great enthusiasm!

<comment><USER8> It's especially weird to see such resentment of authority from a fan of Apple, the heavy-handed authoritarians of the industry. He's going to have a bad day when they won't let him ship and don't explain why.

</comment></comment><comment><USER9> Believe it, it's possible to not succeed yet want to succeed more than anyone else on the planet. Go to college. Take 4 years to earn a qualification as something to lean back on just in case anything goes wrong.

You'll still be 18 in college. You can still do things on the side. You are 17 years old, and have no experience dealing with other people. The fact you are willing to let anyone invest in you without knowing them speaks volumes about how little you know how hard it is to succeed. Despite wanting to.

Edit: s/no\ /very\ little\ /g

<comment><USER10> >Believe it, it's possible to not succeed yet want to succeed more than anyone else on the planet

absolutely

<comment><AUTHOR> I wholeheartedly disagree.

<comment><USER11> What separates success from failure is the ability to learn from your failures and to try again. You failed at both so far.

<comment><AUTHOR> Would you please be more specific?

<comment><USER11> I don't know the conditions of why you left but assuming it's relevant to the letter then you failed to focus on things that matter like school, family, etc. This is a life lesson that cannot be learned with words alone, family and friends are much more important than money or success, it takes many a lifetime to learn this.

</comment></comment></comment></comment></comment></comment><comment><USER12> A couple years ago, I was exactly like you. (I'm from the Champlain Valley myself.)

But in the 3 years since, I learned that people are infinitely more important than my technical abilities will ever be. My hubris brought me down.

Things like this just aren't going to win you friends. If you want people to invest in you, not your ideas, (a statement which is itself filled with hubris), you have to grow up and realize the world around is a lot more than code.

<comment><AUTHOR> My letter came across as quite hubristic - I know. In truth, I like to think I am humble. But, then again, that is so relative. And, something difficult to communicate while trying to prove competence.

Thanks for your feedback, morgante.

<comment><USER3> Trying to lace your writing with competence is one of the quickest ways to undermine your own credibility. Be patient, go to school, and put in your time and one day you'll find that you come across as competent without any extra effort.

</comment></comment></comment><comment><USER13> Your story isn't unique. Thousands of people on this forum were kids just like you once. Put some code on your GitHub profile. That's the most important external link you could have included in this post, yet it's conspicuously missing.

Spend some time in the business world learning to "conform to the societal bullshit" and spend your evenings bootstrapping your next startup. You sound like you have the technical skills to be a developer, but lack the maturity. It does not impress people when you use big words. Smart people explain things in a way that dumb people can understand.

You don't need a partner - you need a job.

<comment><AUTHOR> Cmwelsh, thank you for your feedback and time. That sounds like dogma.

<comment><USER13> I don't mean to be condescending - this is advice that I learned the hard and long way. I wish you the best.

<comment><AUTHOR> No offense taken on my side. Thank you for your time and input. Best of luck to you as well.

</comment></comment></comment></comment><comment><USER14> I emailed you a longer letter, but I wanted to encourage the following:

1\. Focus on your classes now. You're a student, and until that changes, you need to do your best to stay the best student you can be.

2\. Don't see YC as an endgame. College will open up more chances to go do stuff than ever before.

3\. You shouldn't use your age as an excuse not to build stuff now. Go learn a language or start hacking on a project. Now. Just because you can't sign up for something like AWS (which is just a waste of money compared to other providers) doesn't mean you can't get stuff done on your own box.

</comment><comment><USER15> A lot of people here are recommending you stick it out with school. I had your attitude 5 years ago. I was (am) very smart and entrepreneurial, and I hated high school. My senior year, I only took 4 classes, showed up at 9:15 and left at 11:45. I got mediocre grades at best.

I stuck it out with school, went to college and got a CS degree. College ended up being excellent, but my advice to you would be not to go... yet.

The best thing you can do is find a programming job or internship. Learn to work hard (rather than talk hard), build things (publicly on github is best for opening up opportunities), save money, and go to college in several years. College will be the best experience of your life, and if you do it when you're 22-26, you will get way more out of it than the rest of us who went straight after high school. Make friends, build things with them, and use the education to become a far better engineer than you ever were. You will then be able to build something amazing.

I can guarantee you if you go out now and try to build a company at your stage of skill/experience/age, you will build a heap of crap, that you might be able to sucker some company into paying you a million dollars at best. But you will have squandered your talent, and you will not be as amazing as you could have been.

P.S. like other people have said, stop writing as if you're referencing a thesaurus for every sentence, it reeks of immaturity and naivete.

</comment><comment><USER10> >Invest in me, not my ideas

why is it any better just throwing money in a window

<comment><AUTHOR> I'm not sure what you mean by that.

<comment><USER16> Yes. Because there are many, many 17 year olds just like you, or better than you. There are very few who are "successes", at age 17.

To invest in you is like putting money in the lottery. In fact, if I were you, I would distrust any offers you DO get, because those people are probably not good with their own money and would not have YOUR best interests in mind.

<comment><USER17> well put, I second this sentiment. The people chiming in on HN who are advocating a more thoughtful approach, of figuring out how to make school work out, are the folks on your side.

it takes time and years of effort to be successful. Make it easier by forcing yourself to level up with more education etc first.

</comment></comment></comment></comment><comment><USER18> _" No longer will my school's nurse have to cosign my bank account."_

That sounds like an interesting story in and of itself.

<comment><AUTHOR> You have no idea.

</comment></comment><comment><USER19> Have you considered that in the future, you may regret having written this? Anything you post on the internet that is tied to your real identity (such as this) can work against you later in life, especially when it comes to employment. Keep in mind that the first thing most employers will do is put your name into a search engine.

If I were you, I'd let HN comments run their course for feedback, and then delete or protect your Google Docs link once things slow down.

Also, too much enthusiasm can be a bad thing, especially if it crosses the line into hypomania or mania. The insidious part is that people who are in such states usually don't know it and cannot recognize that they are. I don't know if this is relevant; just something to be aware of.

Sorry to sound like such a downer. Fortunately there's a lot of other advice here that's a bit more upbeat. Good luck.

<comment><AUTHOR> I did consider the effects that this posting may have on my future. It is very true that things you post on the internet can work against you. It is equally true that things you post on the internet can work with you. Thank you for your feedback and suggestion.

Best of luck to you, too.

</comment></comment><comment><USER20> If you want to do something big, go to college and major in a non-CS subject. People are realizing social/apps has been so overdone and that there are more interesting and profitable ideas to work on -- ideas that require domain expertise in more than just CS, like healthcare, neuroscience, biotechnology, ecology, electrical/mechanical engineering, physics, real estate, interior design, architecture, etc. You can look to the recent YC classes for evidence of this trend.

At worst you'll graduate with a degree and lots of friends at 22 with almost twice that left before you qualify to receive Social Security benefits.

<comment><AUTHOR> I would love to go to college. At this point in time, it does not seem financially feasible. And, I love CS. Thank you for your feedback.

<comment><USER2> You should discuss this with your school counselor. Or better yet, reach out to schools directly. Many schools that are seemingly too expensive to attend, e.g. Ivy League schools, are actually very cheap once you factor in financial aid.

</comment></comment></comment><comment><USER21> 1) I take it you're choosing: no university -- that's a big decision. If you're good, having no degree is a non-issue (it wasn't for me), but there IS huge value in the academic/social environment of a good university.

2) Make a splash, meet people, cycle ideas NOW. Anyone expressing a sentiment of reservation towards you is being... resentful? It's clear you're willing to take risks and accept failures. Writing what you did was a positive experience for you, even as people criticize it.

3) Very few people understand that we all have what we want. Good job.

</comment><comment><USER22> Best of luck but try to be cautious in who you trust. Make sure anyone who bites on this offer to work with you is not trying to just take advantage of you because of your age.

Is interesting seeing the difference between all the comments about how useless college is in one thread and here so many recommending college. That said I loved college and couldn't imagine my life if I haven't taken it. Paid for itself within a couple years too.

</comment><comment><USER23> You're young, motivated, and determined to forge your own path in life. That's a good thing. I will, however, gently remind you that you are still a teenager, and thus, you are not exactly alone in your desire to be a nonconformist. I can only advise you to learn how to conform, even if you don't want to, because, despite what you may currently think about success, you need more than desire. You need other people.

</comment><comment><USER24> You admit to bypassing a filter at school. This is a criminal offence in many areas. You may want to think about not disclosing that so publicly.

You say that Google shutdown your adsense account. That is, depending on the reasons, significant. You're not allowed to set up another account, so you're hampering your ability to use that monetisation route. (I welcome corrections, especially from any Googlers reading.)

<comment><AUTHOR> Bypassing the filter certainly was an offense. I was prosecuted by the school district in direct accordance with their policy. I have served my consequence and am now absolved of that offense. Google did shut my Adsense account down. I have not opened another.

</comment></comment><comment><USER25> Let me tell you my own personal story. Take from it what you will.

My first passion in computers was programming. Before any games (other than Microsoft Flight Simulator), it was programming. I started when I was 8, in QBASIC. By the time I was 14, I was hacking away at 3d graphics, physics sims, my own OS kernel, etc. That was also the age at which I completed my highschool, as I was homeschooled after 5th grade.

It was at this point that my parents wanted me to go to college, but I didn't want to. We fought over the issue a lot. I ended up going and dropping out of 3 or 4 different universities. My longest stay was around 3 years' living away from home on campus. That was my first time really being out in the world by myself. I learned a lot, made friends, played video games seriously for the first time. I failed or barely passed most of my courses (even the computer science ones), withdrew from a lot of quarters (they didn't have a semester system). But when I participated in coding competitions I felt the most alive I had ever been and I usually won them. During all this time I had the dream of starting my own company, something which I had known since before I had graduated highschool.

That's how my teens years passed. I was a very ambitious, headstrong, rebellious, and emotional teenager and early-20s guy. I dealt with depression and some probably bipolar-like symptoms. All this combined into a cycle where my parents kept pushing me to go to college and complete it, and I would relent and accept, but I wasn't able to go through with it. Around the time I was 18 I started to look for work online, and I found an online project from a small company. I ended up entering into a long-time remote working relationship with them, doing projects here and there. I was getting some income (but not much).

When I was around 22 I was back at community college as otherwise my parents would have kicked me out. I was a bit more emotionally stable now, so I was able stick my classes, but overall, I very, very much disliked the college experience. It was here, at community college, that I met a guy who told me about the hot iPhone app market. I started hanging out with him and I started coding on his laptop (he didn't know any technical stuff). Eventually I ended up building my first app in Xcode. I decided to partner up with him and form a company. My own company! I thought. This is the dream coming true! But I had no experience in setting up a business, and the only reason I partnered up with this person was because I was very excited. No rational thought went into it. We started off slow, then it just took off. At one point we had more than one app in the top 25 of our category, and even one in the top 5! We were so excited and the money was just rolling in. But that's when the internal problems came to a head. The more money we made the more problems. He wasn't pulling his weight, I was doing all the work, he was acting the "boss" etc etc. Eventually we broke up, I left. The app plummeted in ranking as our quality of work suffered and the updates stopped coming. At one point, I had spent 2 months sleeping nights at the office and coding in the day because of the pressure from my business partner on me to "work". It took a huge toll on me mentally. I finally realized he was just using me and decided to break away. But I wasn't up to the task of fighting him for the company, I just wanted to make a clean break ASAP because of my mental state. Well, I did it. It was such a relief. I put it behind me and continued on. I went back to working remotely with that small company I used to do projects for before. For about a year that kept me going.

Which brings this story to the present. Now I'm 26 years old. That small company wasn't able to keep paying me, so I searched for 2 months for a job. I got one recently. The pay is decent, flexible hours, have to work at the office though, nothing too exciting, but I'm satisfied. I have some stability in my life. I was going to a university again. I had decided not to pursue computer science as a major again, instead going for physics or mathematics. But I quit that once again so I can do this job. Now, on the side, I have a startup project going again, with another person I worked with at my previous startup. We're taking things slow (a little slow right now), but it's nothing I can't manage working the weekends. I still have that dream and that passion. In fact, I have many dreams, the smallest of which is to have a successful tech company. But my now 26 year old brain is a bit more emotionally mature. I have some practical real world experience behind me. No matter what anyone says, that real world experience is invaluable. I have decided not get my degree after all. What would have happened had I stuck to the "normal" path, and not fought my parents over going to college? I would probably have had a degree at 18, and with my skills a really good job at a big tech firm lined up when I graduated. In eight years I would have been making at least 4x what my current (first real) job is giving me. I might even have been married with kids. But that wouldn't have been ME. _This_ is me. This is the path I have made for myself, and I honestly regret nothing. I will keep trying. At 26 years old I feel kind of old. How old will I be when my company is successful? 28? 30? 40? I don't know... that's kind of disappointing, but I'm gonna keep at it.

I think many here will tell me - I should still go back and get a degree. But I've made my decision and I'll live with it. And my life also doesn't revolve entirely around me being a hacker or having my own startup or wanting to be the next Instagram or what have you. I have many passions around which I base my identity. If my next startup fails, I won't lose myself in the process. And I'll still be financially stable with a regular job. Keep that mind as you forge your own path in life. Don't focus everything you have on one little thing. Give yourself something to fall back on financially. And have your sense of self rooted deeply AND widely - so that a failure in any one part doesn't make you personally feel like a complete failure. I came close to that in my first startup. And I can't imagine what I would have been like mentally had I not had other passions in which I could still feel successful. Well, I guess now I'm lecturing you and I kind of promised not to do that in my first sentence... But I'm not telling what to do. Take whatever path you want, but I think you should keep these things in mind.

<comment><AUTHOR> Thank you for sharing. In my eyes, you have already succeeded. In my eyes, you succeeded right when you stopped drinking the Kool-Aid. You are doing what you love to do. Consequently, all work you produce is great work. I have nothing but admiration and respect for your decision to forge your dream.

</comment></comment><comment><USER26> I am a developer on the Road Redemption team.([http://www.kickstarter.com/projects/darkseasgames/road- redem...](http://www.kickstarter.com/projects/darkseasgames/road-redemption))

We also got greenlit last week.

Tell me more about your Pipe Bots iOS game. You can email me at email@example.com if you'd like.

<comment><AUTHOR> Hey pfisch, thanks for taking the time to read my letter. Congratulations for the greenlit, that's quite a feat!

I'll get in touch shortly.

</comment></comment><comment><USER27> If you operate in the bitcoin economy, you don't have to wait until you're 18.

</comment><comment><AUTHOR> Apologies for external link. I am limited to 2000 character description.

<comment><USER28> Brevity is the soul of wit.

<comment><AUTHOR> Shakespeare?

<comment><USER3> I'll sacrifice some potential wit and explain that your writing style is rather self important. It's not uncommon at your age (not trying to be insulting here) but you need to balance your desire to self-promote with a demonstrated ability to get to the point. People will notice more if you show instead of tell.

Your letter has a lot of words in it which are clearly used in an attempt to impress. Coupled with the numerous grammatical errors (read it aloud, carefully) and breathless tone, it will likely remind many on HN of their younger selves, emphasis on younger. I hope you do find someone with your intensity, because those have been some of the most rewarding friendships I've had (I'm 30 now but remember what it was like to be your age).

<comment><AUTHOR> Thank you for your feedback.

It would be so much more helpful if you could provide specific examples within my writing that are grammatically incorrect.

Lastly, to comment, I am very curious to know why I am receiving more feedback on my style of writing rather than the ideas I am attempting to communicate.

<comment><USER3> > I am a ... left-brained neurosis (did you mean 'neurotic?' not sure what > this means) diet regimented monk (did you mean 'diet regiment monk'? not > sure what this means) zealous disruptive product fiend (did you mean > 'zealous fiend for disruptive products'? not sure what this means).

> "All of the above is far too subjective to have any empirical value. So, > here is a quick and porous synopsis of my "experience" over the years"

This would read better without the disclaimer, flowery words, and air quotes, e.g.: "Here is a summary of my limited experiences"

> "Age 11 (as far back as I can recall in my life)"

Really? Anyway, why is this important? This whole paragraph would be better if you left out the commentary: "Age 11 - Discovered that I could ping youtube.com and use the resulting IP to get around my school's DNS blocking. I didn't really know what I was doing, but I knew what I wanted to do with the rest of my life."

Also, phrases like "my technology inception" stick out like a sore thumb and will make you sound grandiose, regardless of how many disclaimers you include.

> Eight months later, my port-forwarded router became an LLC with 6 full-time > employees.

I know what you are trying to do here, but unless you really mean that your router had business papers and employees better keep it simple, especially since this is a story about how you took money from people to run a business whose operations were highly dubious at best.

> Meanwhile, my grades in all but anything STEM were an abysmal.

This is the kind of error you'll catch if you read your prose aloud carefully. Also, "to the demise of the business and the other employees" makes it sound like your mother killed them. I think you meant 'dismay'. Normally I would not comment on these kinds of things, but since you asked...

Your surprise that your your style is attracting more attention than your ideas is another thing that you'll eventually grow out of as you age and learn more about human behavior. In part it's because people feel smart when they notice things; anything that is simply asserted by you will be immediately suspect and scrutinized against other information, namely your other works and overall tone.

This is not unfair, it's actually a big part of communication. You transmitted more information than you intended, and that has business implications.

<comment><AUTHOR> This is constructive feedback. Thank you for taking your time to do this. What should I do to improve the letter's overall organization of ideas?

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> In your first sentence you say "trust me - I deserve it".

I find it hard to trust you when you didn't even tell us the reason your parents kicked you out.

Care to tell us that?

<comment><AUTHOR> Ah, you are misunderstanding me. I was saying that I deserve getting kicked out of the house. And, you are going to have to trust me on that.

</comment></comment><comment><USER30> If you have the opportunity for independent study, take it. I did that for part of my senior year and it freed up a huge amount of my time.

<comment><AUTHOR> You could say all of my studies thus far have been independent ;)

<comment><USER30> In particular I had the opportunity to not go to school at all. I had to show up to a trailer in a school parking lot one day a week for tests and to get my assignments. Some weeks I was there for 30 mins, some weeks a few hours. It just depended on the current course load. I was able to do a quarter's worth of work in about a month because they let me go at whatever pace I could manage. It suited me well and I wish I had discovered that option earlier.

</comment></comment></comment><comment><USER31> Dare I ask why your mom "removed" your computer and why you deserve being kicked out of your parents house?

<comment><USER32> I suspect you're not going to get an answer to that one.

<comment><USER29> I don't think so either because I posted a comment at [https://news.ycombinator.com/item?id=6325772](https://news.ycombinator.com/item?id=6325772) which was just ignored also.

</comment></comment></comment><comment><USER33> Your young plenty of opportunity for growth, patience is virtue.

</comment><comment><USER34> Sent you an email.</comment>


Ask HN: Does Salesforce really make sales teams more productive? - <AUTHOR> <comment><USER2> Generically or specifically? CRM systems can be useful, but specific SFDC configurations are often hard to use or inappropriate for field people. Depends on the deal you get and whether you're set up properly - SFDC is quite a complex system.</comment>


Akamai Releases FoxTorrent 1.0 - Firefox BitTorrent Add-on - <AUTHOR> http://www.techcrunch.com/2007/04/27/akamai-releases-foxtorrent-10-firefox-bittorrent-add-on/ <comment><USER2> "This is a BUG, not a feature."

That's the way BitTorrent is supposed to work, by definition. If it didn't, the client would soon be banned for leeching.

If you don't want this to happen, don't run BitTorrent.

Calling this a "bug" is like complaining that your email program sends mail, or that your web browser downloads web pages.

"I had no idea that firefox extensions could spawn processes."

A Firefox extension can do just about anything that any other program can do. It can contain arbitrary C++ XPCOM components. Be careful out there.

</comment><comment><USER3> From the website: Background Downloading Continues to work even after your browser window has been closed.

This is a BUG, not a feature. When I close my web browser, I certainly DON'T want any extensions kept running, especially when they accept incoming connections.

When you launch foxtorrent, it spawns a child process that listens on port 9421. I had no idea that firefox extensions could spawn processes.

</comment><comment><USER4> This is really great.</comment>


Hillary Clinton Email Archive - <AUTHOR> https://wikileaks.org/clinton-emails/ <comment><USER2> It's _interesting_ the lack of Emails regarding the State Department, aka Hillary, Deciding on using the Clinton Foundation to disperse over $10 Billion in funds for the Interim Haitian Recovery Commission. [https://wikileaks.org/clinton- emails/emailid/333](https://wikileaks.org/clinton-emails/emailid/333)

Five years later and there are serious questions as to where the money went and why so little of it provided any permanent structures. So much so Haitians have protested outside of the Clinton Foundation Offices. [http://www.brooklyneagle.com/articles/2015/4/10/haitians- pro...](http://www.brooklyneagle.com/articles/2015/4/10/haitians-protest- outside-hillary-hq-brooklyn)

</comment><comment><USER3> This one is interesting (from Google)

[https://wikileaks.org/clinton- emails/emailid/12166#efmAMoAbj](https://wikileaks.org/clinton- emails/emailid/12166#efmAMoAbj)</comment>


If you were the last person in the world, would you build a parser? - <AUTHOR> http://procworld.blogspot.com/2011/03/writing-architecture.html

<comment><USER2> tl;dr: use the builder pattern instead.

My answer to the headline: "heck yeah, that would be prime concentration time!"</comment>


Ask HN: I need a Python mentor. - <AUTHOR>

A big problem that I've always had (not only with programming, but other things as well) is that I have a hard time focusing on and improving a single skill. I seem to rather be OK with a number of technologies rather than great with one or two technologies.
I've decided that I really want to learn Python and that, by doing so, I'll become a better programmer. I've always heard that after you really learn your first language, the rest are just learning the syntax. Learning a language is not the same as learning how to program.
I'd like to find a Python mentor. I need someone that is willing to help me take over the world, one script at a time. If you're interested then shoot me an email at firstname.lastname@example.com. <comment><USER2> A large part of it is what you want to use it for. Python is commonly used in a variety of areas, from web development to numeric computation. Giving some bounds of what type of programming you'd like to do might help narrow down a fit.

<comment><AUTHOR> To be honest I'm not exactly sure what kind of programming I want to do. I'm thinking it will probably be related to the web in some way.

</comment></comment><comment><USER3> Download web2py and go through web2py.com/book</comment>


If You Really Want to Help Musicians, Then Help Me Finish Making This Film… - <AUTHOR> http://www.digitalmusicnews.com/permalink/2013/11/25/unsounddocumentary

<comment><AUTHOR> Hello all. I just posted this because I believe that we have reached a point where tech and the real world are on a collision course regarding Music. This documentary that the article speaks about discusses the collapse of the music industry in large part because of the tech industry. There are good and bad points on both side of the argument, but I submit that no matter your point of view, we all have to agree that it is not working. I welcome some thought by any of you working in a music tech and wonder if you have any thoughts on how we will fix this growing dilemma. Thanks.(Disclaimer: I am the Founder of a streaming music start-up)</comment>