The Great Decoupling - <AUTHOR> http://avc.com/2015/05/the-great-decoupling <comment><USER2> Note that the decoupling correlates closely with the computerization of society/business around the mid-1980s.

The market for most types of human labor is soft in advanced economies, and getting softer. We don't grow the economy by assembling a huge workforce to do/build something, we grow it when (relatively) tiny teams build a new tool, create a new market or disrupt an existing industry.

One could argue that there are lots of projects out there that could use people to do physical labor. My response to that is that it has become _extremely_ expensive to employ workers in physical jobs in the US, due to declining health of the general population (obesity, etc) and the overhead of things like disability insurance/worker's compensation. Since the US has essentially no social safety net to speak of, the primary source of welfare ends up being workplace injury-related benefits. This produces a powerful secondary-gain situation that incentivizes injury for those who work physical jobs.

I don't think people _intentionally_ get hurt of course, but rather when they do sustain an injury it becomes economically advantageous to prolong it as much as possible since the job is hard and their pay for working is so low. Usually it's the only way for menial laborers to get a paid vacation, and (sadly) getting permanent disability benefits is like early retirement.

I'm not advocating for getting rid of those benefits, but rather changing the incentives so that working pays more, everybody gets some form of paid vacation, and that there are safety nets/alternatives for the poor. We need to recognize that our economy simply needs fewer people working to function (I don't know if the basic income is the right solution, but it could be).

<comment><USER3> >> Note that the decoupling correlates closely with the computerization of society/business around the mid-1980s.

It also correlates closely with the decline of labor unions.

<comment><USER4> Hi. I'm a software engineer. Show me a union whose membership improves my life, and I'll be happy to talk.

Bear in mind that _improves_ is present-tense for a reason.

<comment><USER2> We don't need a union per se, but a professional association (aka guild) would be fantastic. As professionals we need to stop letting employers be the sole arbiter of competency, and we also need to institute a code of engineering ethics that is independent and based on sound theory and practice (rather than whatever the business wants at any given time).

Imagine being SEOA (Software Engineer Association of America) Level 1 certified and never having to do Fizz Buzz at an interview again. Or a Glassdoor-like employer database that gives you a clue what you might be walking into. Independent health insurance coverage, etc. There could be lots of great ways it would improve the average engineer's life.

<comment><USER5> Also imagine not being able to get a job because you tried to implement some new and cutting edge process or program and were black balled for life.

That's also what guilds do.

</comment></comment></comment></comment></comment><comment><USER6> Personally, I blame spreadsheets. Well, not spreadsheets per se, but their ability to ease quantification of certain money streams above others. They make it easy to optimize profit margin in the short term, and dismiss long- term, difficult to quantify investments. The short term numbers are nice and solid, and the long term risk and investment are fuzzy.

In the near past, this focus improved the economy, but now I think we're in a stage of overoptimization of short term profits over real value. You can see where real GDP is now beginning to tail off in the charts - it happens later than the salary drop but it's there. Company lifetimes are getting shorter (showing misallocation of risk & R&D, and less buffer to weather mistakes & downturns), general numbers of new business starts are lower (suspect this is a side effect of less time & salary for workers).

Worker salaries are hit as a big side effect too.. how you do quantify long term value of a worker - it's easier to quantify short term worker outputs as shallow primary effects and ignore the longer term secondary effects of retention and experience. Now compare fuzzy secondary effects against the calculation of short term profit projections. You can see how jobs are easily slashed, or moved overseas... even if three to five years down the line you lose some efficiency (it's not quantified so it doesn't exist in a cost- benefit trade off).

</comment><comment><USER7> > the professors put forth as potential solutions [...] education, > infrastructure, entrepreneurship, immigration, and basic research.

Couldn't the other solution be less greed on the part of business owners? It seems like the bigger issue is that they just aren't paying their people enough.

<comment><USER8> > _Couldn 't the other solution be less greed on the part of business owners?_

Greed has very little to do with the problem. If one business pays their employees slightly less, and gains an edge over the competition by doing so, it forces their competitors to either adopt the same lowered pay rates, or slowly be defeated in the market. Only one "bad" actor has to be 'greedy' to force the entire market to chase lower wages. Often this can become a self- perpetuating system, driving down wages.

It is probably impossible to prevent this sort of behavior. The incentives to avoid chasing lower wages do not exist, or are very weak. Also consider that higher wages increases incentives for businesses to automate labor. Even if you create a higher minimum wage, the pace of automation will increase.

The fact of the matter is that the supply of jobs now no longer matches the number of employable people, and the supply will continue to shrink, indefinitely.

<comment><USER9> this is part of it. however, things are just out-of-whack economically.

in my company, we pay our most-senior engineers above-market wages, for a variety of reasons including retention, schedule demands, etc. for example, we pay a senior remote sysadmin in the south/midwest $150k. we are based in southern california where that salary would still be above-market.

the truth of the matter is even if we paid him 200 grand, his real income would probably not be as good as it was 30 years ago. our local california engineers can't afford houses+family no matter how much we pay them (within reason - assuming single income). i know people from the previous generation who own multiple houses on what were modest single incomes.

something fundamental is driving the cost component of everything through the fucking roof, without a corresponding increase in purchasing power. employers/managers can be only so generous - the dollar just isn't going as far.

in other words, the actual purchasing power is accruing at the _very very_ top in an entirely different class of ultra-rich people. small biz owners, middle managers and employees are getting shafted even though everyone is trying their hardest to keep things on an even keel.

<comment><USER10> >something fundamental is driving the cost component of everything through the fucking roof, without a corresponding increase in purchasing power.

If I had to guess, the "something" is the conversion of capital gluts at the top of the economy, boosted by cheap borrowing rates, to drive speculative bubbles in all available "assets" \-- things you can invest in to get a capital gain. Since most of the world doesn't tax land values, land values have soaked up much of the speculation, making real-estate unnaturally, uselessly expensive across most of the civilized world.

<comment><USER11> Real estate speculation by foreign investors has definitely driven housing prices to levels not supported by the locals- Vancouver BC being a prime example of this.

I've always wondered what the best way to prevent this would be... if non- residents were prevented from buying more than a single small property in a country, would that help at all?

<comment><USER10> >I've always wondered what the best way to prevent this would be... if non- residents were prevented from buying more than a single small property in a country, would that help at all?

Land-value tax is what experts generally recommend.

</comment></comment></comment></comment></comment></comment><comment><USER12> One interesting thing that happened in 1971 (right when the income divergence occurred, which I view as the major problem) was that Nixon closed the gold window:

[http://en.wikipedia.org/wiki/Nixon_Shock](http://en.wikipedia.org/wiki/Nixon_Shock)

Association of course does not prove causation, as a graph of murders and IE usage will demonstrate. But it is suggestive. I wonder if the unlimited leverage that the financial system had access to after the gold window closed allowed them to suck out more and more of the productivity gains.

This graph suggests that this might be so:

[http://www.yesmagazine.org/blogs/david- korten/images/financi...](http://www.yesmagazine.org/blogs/david- korten/images/financial-sector-as-percent-of-u.s.-gdp)

<comment><USER13> An alternate hypothesis is that starting in 1971, labor union participation in the US began its decline.

Rather than needing to use leverage, as you suggest, they just directly filtered the increased productivity gains to the top of the company.

Also, I'm not really sure that your graph shows anything except that the financial industry has been growing since the 40s.

<comment><USER4> Also related is that that's roughly when automation began replacing unskilled high-wage labor.

A lot of things happened at once, I think.

</comment></comment></comment><comment><USER14> The decoupling is also obvious when comparing advanced degree employment and income versus those with only high school or 'some college'. It's also pronounced between majors, with STEM earning more. these trends have accelerated since 2008.

</comment><comment><USER15> My theory is that we're in danger of a global repeat of the Great Depression that hammered North America and, to a lesser extent, Europe in the 1930s.

The last one, in the 1920s, was caused by ill-managed prosperity, I would argue. You had sudden gains in agricultural productivity, which led to crashing commodity prices, which eventually led to rural poverty. One might have "expected" farmers to move into the cities and become the new middle class, and some did, but that doesn't work out so well when thousands or millions of poor, hungry people are doing the same thing. What was just "rural poverty" (of course, half the country was still rural) in 1925 became more widespread by 1927-28 (noticeable slipping demand for consumer products) and finally was recognized as a Great Depression after it tanked the stock market in 1929-32.

We have, in 2015, a _lot_ of ill-managed prosperity. We have a culture in Silicon Valley that _glorifies_ ill-managed prosperity. (What else do you call funding _Clinkle_?) And the same thing that happened to food prices in 1900-30 (slow at first, accelerating toward the end) is happening to _almost all human labor_ in 1985-2015.

It may not end well. Including the damage brought by the war, I'd argue that most of Europe didn't get out of the Depression (manifest somewhat differently over there, especially in the fascist countries) until the late 1950s.

<comment><USER16> Are you saying that poor peasant led to the Great Depression? I thought runaway speculation did...

<comment><USER14> Thee cause was probably a combination of speculation, leverage, overbuilding, and so on.

No one really knows the exact trigger, but a popular opinion seems to be that the Smoot–Hawley Tariff Act made it worse -although even that is debated.

The stock market crash lead to margin calls and the sudden evaporation of millions of dollars of wealth and that probably triggered a cascade effect, as business obligations could not be met due to the sudden loss of wealth.

</comment></comment></comment><comment><USER17> The obvious solution is birth control. It's not that there are too few jobs, it's that there are too many people. Offer free permanent birth control to any low income person who wants it. This is only a partial fix of course, but one that would help long term.

<comment><USER18> > The obvious solution is birth control. It's not that there are too few jobs, > it's that there are too many people.

Jobs aren't fixed, such that reducing the number of people will align people with jobs. Reducing people will reduce jobs, so if you commit to that method of trying to get them in alignment, you'll end up tail-chasing with more and more aggressive population reduction efforts until you recognize that the approach doesn't work.

<comment><USER17> I disagree. With mass production/farming/entertainment/etc you can provide for N number of people with N/k people. This has not always been the case. There were things not getting done, so when automation came along it freed up people to get some of the less critical things done. I believe we are rapidly moving into a time when there are not more things to be done and we actually have an excess of people (see China and India for examples). I knew it was a huge risk to my rep to post that, but hey, gotta get the idea out there.

More specifically, lets say it takes 10,000 people to meet the needs of 12,000 people. You might then think it takes 20,000 to support 24,000, but you'd be wrong. Increasing production does not scale that way, there is a sort of viable minimum after which scaling is easier. So 5000 people would not be able to serve 6000 because there isn't the critical mass needed to do everything (these number are purely fictional of course).

It's like mining. It takes a lot of people to dig and move earth, but once society gets advanced enough we can have bulldozers and dump trucks, and as you need more mining you just use bigger machinery rather than more machinery with more operators - or you make them autonomous so there fewer operators.

TL;DR the number of people it takes to provide for a society is not directly proportional to the size of the population.

</comment></comment></comment><comment><USER14> Ultimately, I think this whole debate on wages, STEM, wealth inequality, and automation boils down to IQ. [http://greyenlightenment.com/winner-take-all- nation/](http://greyenlightenment.com/winner-take-all-nation/)

IMHO, people are falling behind because of low IQs and the winner-take-all economy that enriches some, but doesn't leave a whole lot for everyone else. Today's hyper-meritocracy is amplifying the socioeconomic ramifications of individual cognitive differences such that a person with an IQ >110 is much more likely to succeed than someone with an IQ <90, whereas decades ago the disparity wasn't so obvious.

The solution, on the other hand, -I don't know. No one really knows, and that's why this is such a big debate. So many people realize that this is one of the most pressing issues of the 21st century. How are we going to develop a compromise or solution that handles automation-related jobs loss and inequality. Some propose a basic income; others want redistribution; others wants more spending on education, and so on...

From students fresh out of college and in debt, to people looking for jobs, or people who have been laid-off, we're all a part of this debate. Economics is not just for economists - now more than ever we all experience it in our everyday lives.</comment>


Hidden-Variable Theory - <AUTHOR> https://en.wikipedia.org/wiki/Hidden-variable_theory <comment><USER2> The is usually discussed in conjunction with Bell's theorem which tells that if there's a hidden variable theory, it must be nonlocal. Nonlocality breaks the universal speed limit and nobody is happy with that.</comment>


Moments, the best of Twitter in an instant - <AUTHOR> https://blog.twitter.com/2015/moments-the-best-of-twitter-in-an-instant-0 <comment><USER2> twitter obviously desperate to get trending topics/news connected to people, ads, extend the reach of tweets etc ..... but this sort of curation stuff is tough -IMO you should be able to rely on your own follows, but I suppose that's only pro-users and not 'casuals' who just follow their friends and celebs. haha

I find that if a story is big enough, it will keep getting shared thru the day, commented on etc...so even like, those waking up on the West Coast, you'll know what big news broke over in NYC at 8am Eastern within a short time...... (or further, what happened in the EU overnight etc)

and what of trends/hashtags? If there's some big news shouldn't be able to click the trend/hashtag and see that twitter sort of 'Top Tweets' to get the jist?

<comment><USER3> I used twitter quite a bit for a couple years, tried to be a good "pro user" that gets tons of value from the service by painstakingly curated my own feed, and eventually left because it was all too much. I'm interested in news, have little interest in my friends (on twitter that is; I like my friends more in real life) and zero interest in celebrities. If that makes me a "casual", oh well! Moments seems like a fantastic product to me, and might bring me back as a user.</comment></comment>


Do you like online privacy? You may be a terrorist - <AUTHOR> http://publicintelligence.net/do-you-like-online-privacy-you-may-be-a-terrorist/ <comment><USER2> This is golden. I think I might be a terrorist.

I...

1) Shield my screen in public places ( I don't want snoopers reading my emails....) 2) I pay cash most of the time (Helps me save money as the change goes into a change jar never to be spent again) 3) I have multiple cell phones. (One for business, one for personal)

4) I use a proxy to shield my IP address 5) I encrypt my computer and files, I send password protected compressed files. 6) I communicate with people I have never met in video games

7) I sometimes keep track of hackers and learn of vulnerable websites and infrastructures

Seriously though I am not keen on the flier. I think terrorism and extremists work best in fragmented societies. If you live in a small village where everyone knows everyone then the oddball or outcast will naturally be viewed with curiosity and suspicion. However, in towns and cities where you sometimes don't know your neighbor.. this is where a suspicious person can thrive.

Fliers like this encourage you not to trust to your neighbor. It screams. "The guy next to you might be a terrorist!" and encourages you to be distrustful. Its not healthy. It helps propagate the climate of fear. You expect messages like this in a police state not in a supposedly free country.

<comment><USER3> > I sometimes keep track of hackers and learn of vulnerable websites and > infrastructures

You're on a website called "Hacker News", for starters. Am I the only one who's had to deal with related idiocy when on a public computer? (Also, using PuTTY with the default black screen can get you kicked out of places for "hacking".)

<comment><USER4> >(Also, using PuTTY with the default black screen can get you kicked out of places for "hacking".)

Has this happened to you or anyone you know?

<comment><USER3> It's happened to me as stated.

Back in public school, I had a friend who got banned from using the computers for several months for VNC'ing into his home computer. Because it was "hacking" - no other rationale, no complicating factors.

To use the car analogy: it's like getting arrested for using a remote to unlock your car instead of a physical key. (Or, more accurately, like getting your license taken away for several months. Which may make even less sense.)

</comment></comment></comment></comment><comment><USER5> From: Ten Steps to Close Down an Open Society: [http://www.huffingtonpost.com/naomi-wolf/ten-steps-to- close-...](http://www.huffingtonpost.com/naomi-wolf/ten-steps-to-close-down- a_b_46695.html?view=print)

 _4 Set up an internal surveillance system

In Mussolini's Italy, in Nazi Germany, in communist East Germany, in communist China - in every closed society - secret police spy on ordinary people and encourage neighbours to spy on neighbours. The Stasi needed to keep only a minority of East Germans under surveillance to convince a majority that they themselves were being watched.

In 2005 and 2006, when James Risen and Eric Lichtblau wrote in the New York Times about a secret state programme to wiretap citizens' phones, read their emails and follow international financial transactions, it became clear to ordinary Americans that they, too, could be under state scrutiny.

In closed societies, this surveillance is cast as being about "national security"; the true function is to keep citizens docile and inhibit their activism and dissent._

</comment><comment><USER6> So Obama signed the National Defense Authorization act which allows the indefinite detention of citizen and non-citizens declared as terrorists of the united states. Lamar Smith is pushing a bill that will require ISP's to store all information on U.S. Citizens that tie to an IP address. Now the FBI is saying you are a terrorist if you try to hide your ip. So now if you don't allow the government to capture all information about you from the internet you can declared a terrorist which in-turn will cause you to be held in jail indefinitely..... or im just paranoid.

<comment><USER7> _you can declared a terrorist which in-turn will cause you to be held in jail indefinitely_

It probably won't be you. By the time they'd come looking for you, these laws will have been laughed out of the Supreme Court and a few political careers will be dead forever.

<comment><USER3> > these laws will have been laughed out of the Supreme Court

It makes me mighty uncomfortable how often we have to fall back on "because the supreme court" (or more generally, "because courts" - there are a lot of lower-level justices doing their jobs admirably, and they don't get nearly enough credit) to convince ourselves that we're not heading for a closed society. Eventually, someone will grab enough political capital to pull an Andrew Jackson and decide to just ignore and possibly arrest them - at which point we're absolutely screwed.

We're at the point now where viable presidential candidates can openly admit that they don't believe the courts are worth obeying. It's time to start worrying.

</comment></comment></comment><comment><USER8> Switching SIM cards is perhaps not common in the US, but in Europe it's very common. If you take the Eurostar from Paris to London the people changing SIM cards as they come out of the Channel tunnel are not terrorists, they are people who don't want to pay high roaming charges.

Also, paying cash in an Internet café doesn't seem like unusual behavior at all. Many people who use them will be students and people traveling who may not want to hand over a credit card in a foreign country.

<comment><USER9> Here in France it's often hard to pay for anything under 15 or sometimes 30 € with a payment card. Big chains and supermarkets often have a very low minimum (think 0.50 €) but smaller shops have no problem indicating you the closest ATM. To the point where the second phrase you say in a shop is often "C'est quoi le minimum pour la carte ?".

And yes for Internet cafés. Absurdity.

<comment><USER10> I believe that credit card merchant agreements in the US prohibit any minimum amount for card purchases. You can occasionally find places that do it, but they're breaking their agreement and risk punishment for doing so, so it's rare.

<comment><USER11> In big cities in the US it's very common for many businesses to either have a minimum for card purchases, or charge extra for small purchases, or offer "cash discounts" -- regardless of what the actual law is.

<comment><USER12> It's not law (though there may be state/local laws also), it's the merchants' agreements with Visa/MC/Amex/etc. Cash discounts are allowed - you see them with gas stations quite frequently - but minimums and surcharges are disallowed and the merchant will almost certainly get into trouble with the credit issuers if it's reported.

It's almost entirely small businesses that try to flout their agreements - you'll rarely see any major business try because of the consequences.

</comment></comment></comment></comment></comment><comment><USER13> This is of course ridiculous.

I can be found in a cafe almost more often than not. I...

1) regularly use encryption for all traffic while in a cafe. Would you yell out your credit card in a cafe over the phone? It's easier to encrypt everything than handpick.

2) regularly have multiple phones out on the table. I'm usually doing Android dev.

3) travel up to six kilometers to get my _good_ coffee. Apparently unwillingness to drink McD coffee is a sign of a terrorist?

4) love coffee and drink way too much of it. So if I'm a little twitchy from that third Americano I may be a terrorist?

5) prefer to pay cash to limit my spending so I don't get that fourth Americano.

6) Like to get out. Just because I have Internet at home and I'm using it somewhere else doesn't make me suspicious.

That being said, I have been suspicious of people using Internet at coffee shops before. But usually it's that guy who has parked right in front of the coffee house for the third consecutive day and has his laptop out. (I noticed his car when going to the cafe one day and realized he was just getting porn. The cafe owner and I had a good laugh about it.)

I have also called police about a young man who had made a giant map of downtown and making sniper signs and lines of sight across it. He also really wanted to talk about a recent mass murder. The creepiness and attention seeking was enough to set off internal alarms. The police followed up with me after and were very professional.

The only people I ever terrorised in a coffee house are the Mactards who think it is fine to bittorrent and bring even simple email checking for everyone else to a screaming halt. So far, it is the only useful thing I've ever made in Python.

</comment><comment><USER14> "What should I consider Suspicious?" "People Who:" "Act nervous or suspicious behaviour inconsistent with activities"

Whoever wrote this should go back to both English class (grammar!) and circular logic class (I should consider someone 'suspicious' because they have 'suspicious behaviour'?)

<comment> loup-vaillant It's not circular logic. It's an appeal to intuition. When they say a suspect is someone who act suspect, they really mean "act in ways you _feel_ is suspect". There, you know that if someone is glancing sideways, then your feeling suspicious is enough to mark that person as suspect (or so the flyer says).

Anyway, that's just as bad: it teaches you to be paranoid.

<comment><USER15> _> Anyway, that's just as bad: it teaches you to be paranoid._

What taught me to be paranoid weren't retarded fliers like these. That honor goes to the people who caused me to pick up the practices described on this flier in the first place - organizations like the FBI, government increasingly evolving towards police states a and, last but not least, corporations like Google or Facebook, whose practices can at best be described as amoral.

</comment></comment></comment><comment><USER16> An interesting snippet from the "General Public" version (as opposed to the parent "Internet Cafe" version)

       It is important to remember that just
       because someone's speech, actions,
       beliefs, appearance, or way of life is
       different, it does not mean that he or
       she is suspicious.  Instead, focus on
       behavior and activities that are unusual
       or out of place for the situation and that
       appear to be suspicious.

       The activities outlined on this handout
       are by no means all-inclusive but have
       been compiled from a review of terrorist
       events over several years.  Some of the
       activities, taken individually, could be
       innocent and must be examined by law
       enforcement professionals in a larger
       context to determine whether there is a
       basis to investigate.

[source: [http://info.publicintelligence.net/FBI- SuspiciousActivity/Ge...](http://info.publicintelligence.net/FBI- SuspiciousActivity/General_Public.pdf)]

It looks like they acknowledge the same individual complaints as noted in the comments here but I think they miss the overall point that people are innocent until proven guilty. It sounds like they are saying only law enforcement professionals are qualified to determine whether someone displaying some of these behaviors is really innocent.

I'm not saying someone needs to have charges pressed against _before_ being investigated. Instead, I'm saying this is a dramatic shift to our social obligations and interactions: the person next to you is now no longer innocent by default, he is a potential terrorist and it is your responsibility to monitor his activities and if they show any unusual behavior to bring in the police/feds.

<comment><USER17> Agreed.

Note "some of the activities _could_ be innocent" ... really? ... "and _must_ be examined by law enforcement" ... ok then ... "to determine whether there is a _basis to investigate_ ".

Sure smells like an end run on "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause..."

Here the "could be innocent" implies default of not being innocent, and the law enforcement gets involved _before_ determination of basis to investigate.

It's "If you've got nothing to hide, why are you hiding it?" in flyer form.

<comment><USER18> Doesn't this set up 'probable cause to search' because the LEOs get a complaint of suspicious behaviour from a civillian? It certainly seems to be an easy way to bypass the 4th.

</comment></comment></comment><comment><USER19> Would it not just be simpler and cheaper for the FBI and DOJ to print a flyer that says: "You are all under arrest, on suspicion of Terrorism. Report to your local Police station for processing."

I mean, really - what kind of insanity is being entertained in the US at the moment?

</comment><comment> loup-vaillant That gives me the urge to display suspicious behaviour just to make them lose time. As I live in France, it shouldn't be so risky yet.

Seriously, if more people where actively protecting their privacy, it would no longer be suspicious to encrypt one's email. But some people need to do it first.

<comment><USER20> _Seriously, if more people where actively protecting their privacy, it would no longer be suspicious to encrypt one's email._

This is an excellent point! At least open source OS systems should make encryption the standard option. But even Ubuntu seems unable to pull this off and more or less in stagnation on this - despite EFF's efforts ( [https://www.eff.org/deeplinks/2011/05/help-bring-disk- encryp...](https://www.eff.org/deeplinks/2011/05/help-bring-disk-encryption- ubuntu-live-cd) ).

<comment><USER21> Firstly, Ubuntu Alternate CD has an excellent installer, it's not text-based as in you have to type in commands, or compile anything, it's just like the Windows XP installer, except for all the sideloading of drivers. You can set up an encrypted LVM, or whatever partitioning scheme you like, the default settings also seemed very sensible so you don't even have to touch anything. Secondly, regular Ubuntu installer offers to encrypt your home dir.

</comment></comment></comment><comment><USER20> Let's guess what else is going to make the list 10 years in the future.

Suggestions: \- saves files on a local storage system and not on a cloud service. \- is not caring a smart phone \- owns a variety of "wires" to connect different devices

</comment><comment><USER22> OH MY GOD, I'm in a coffee shop and there's this guy that keeps "apparently using tradecraft"! He won't stop!

Do cross words constitute a "coded work sheet"? That old lady really looks intent on figuring it out.

And those fourth graders keep sending suspicious messages on that PC game! Like "PWND" and "teafrag"...

Well, I'm fucked, but it could be worse:

[http://www.periscopepost.com/2012/01/britons-denied-entry- to...](http://www.periscopepost.com/2012/01/britons-denied-entry-to-us-after- homeland-security-doesnt-find-destroy-america-twitter-joke-funny/)

</comment><comment><USER23> Apparently indirect democracy isn't working as well, as we would like it to work. Anyone knows somebody that would vote directly for such paranoic measures (what happens on airports, SOPA, PIPA, ACTA, all that propaganda for restricting freedom)?

This security and copyright madness reminds me of middle ages witch hunts, and fighting heretic. Most people didn't cared about witches, nor heretics, as long as nobody said them they should.

Governments and religions created that paranoia, and then it just lived on.

I like this [http://www.britannica.com/EBchecked/topic/261344/Henrician-A...](http://www.britannica.com/EBchecked/topic/261344/Henrician- Articles) solution to the problem of government instilled paranoia.

It was possible in 1573 to demand of king, that he would keep the promises, he made before people elected him. People just made him sign a treaty, that if he started religious persecution, he will not be a king anymore accordingto law.

Why now, in the age of democracy, we can't hold our representatives responsible, and can't demand that they will keep their promises? I would gladly vote for someone, that signed such documents before elections, that says he won't be fighting terrorists by restricting freedom. But in our system such contracts are void, if I understand correctly.

</comment><comment><USER24> The word 'online' isn't even necessary anymore. "Do you like privacy? You may be a terrorist" still pretty much describe the world surrounding me right now. For context I live in France and this is what's happening here: [http://bugbrother.blog.lemonde.fr/2012/02/01/claude- gueant-v...](http://bugbrother.blog.lemonde.fr/2012/02/01/claude-gueant-va- ficher-les-honnetes-gens/) (sorry it's in French and I have work to do.)

</comment><comment><USER25> Most of this stuff applies to the Military and FBI. Guess they're all terrorists.

Or maybe you're only supposed to care about encryption and privacy when you work for the government?

</comment><comment><USER26> This appears to be some sort of phishing site. I first look at it using an iPad with the built-in Safari. Since the font size was too small (can't help it, I'm old!), I tried to pinch and enlarge and the text transformed into a blurry image with my email address (iPad/Safari security issue?) displayed and a button inviting me to have it sent to me by email.

Using Chrome on my laptop, I get a warning that there are too many redirects.

</comment><comment><USER27> I'd like to see this in official context. While I have no serious doubt that our government would issue something like this, anyone can make an official looking PDF.

</comment><comment><USER28> It's a correlation-causation problem. I'm sure terrorists ARE all about online privacy, so if you're all about online privacy, you MAY be a terrorist. But when you break it down, maybe 80% of terrorists (a small group) favor online privacy, but only 0.0001% of those who favor online privacy (a large group) are terrorists.

The same reason I have to take my shoes off at the airport: because one asshole tried to hide plastic explosives in his over a decade ago.

</comment><comment><USER29> Can one of you American citizens submit a FOIA request so they release the supporting documentation and research for such claims? I would if I were an American.

</comment><comment><USER30> One more sign that the western world (not only the US and maybe not only the western world) is facing serious signals of McCarthyism 2.0.

</comment><comment><USER31> What do they expect? That a terrorist is going to hide some top secret weapon information in a steganographic photo?

This is just ridiculous.

<comment><USER32> No, that's not crazy, it's just crazy to think that anyone is going to notice someone doing stego in an internet cafe, since anyone doing stego is already going through huge efforts to hide what they are doing. The idea behind good stego is that you encrypt something important, stego it into an image, then post that image (i.e., dead drop it) somewhere where the recipient knows to look. But when this is done (on either end), of course, all that appears is happening is that the person is either upload or downloading an image. When you consider some of the Usenet groups out there with bajillions of images posted a day to them, this would probably be a pretty effective system, assuming your stego program is good enough to embed the data into the image itself and is not just encapsulating it into the metadata or something.

The one interesting thing to come out of this sheet is that apparently terrorists are heavy stego users.

</comment></comment><comment><USER33> When do you think 4Chan, Reddit, or ... GASP ... even HackerNews start to become considered honeypots for terrorists?

</comment><comment><USER34> This reminds me of the "Du bist Terrorist" campagin. <https://www.youtube.com/watch?v=pdIA0jeW-24> (German with English subs)

Most of these terrorist indicators seems like common sense to me. Paranoia over reason once again?

</comment><comment><USER35> I think a lot of people are missing the point. The document clearly states "Related to Internet Cafe".

Now, I agree that I would still want my privacy in an Internet cafe, as well as paying cash, and using multiple phones. But some of the other stuff doesn't make much sense in an Internet cafe.

<comment><USER36> They even say it's suspicious that someone shields the screen from view of others. WTF? I consider most of my communications essentially private and I don't want anyone to be eavesdropping.

</comment></comment><comment><USER37> I find this to be way more hilarious than disturbing in all their cluelessness.

<comment><USER38> After all, nobody expects the Spanish Inquisition...

</comment></comment><comment><USER39> <channeling Jeff Foxworthy>

You might be a terrorist if...

</comment><comment><USER40> Time to turn myself in I guess!

</comment><comment><USER41> Terrorism is a military tactic, saying "you are a terrorist" is about as meaningless as saying: "You are a right flank", "You are a military operation" and "You are a deployed F16 bomber". It's this double speak and new-think that is damaging our country, not the demand for basic human rights.

<comment><USER42> A terrorist is someone who employs the military tactic of terrorism, just like a guerilla is a practitioner of guerilla tactics. I don't see the problem here.

<comment><USER41> The problem is that terrorism is a strategy that America also uses in war. Calling the terrorists evil because they blow up civilians in another country is calling war evil. Its the double-think and hypocritical nature of the word I don't like.

What makes the planes into the world trade center more evil than the hundreds of thousands of bombs used to blow up suspected enemy hideouts in iraq, Iran and Afghanistan?

<comment><USER43> I think it is all about intention. Intending to kill innocent civilians is different than accidentally killing them while trying to target enemy combatants.

(Of course, these differences mean nothing to those who were wrongly killed.)

<comment><USER5> >> _I think it is all about intention._

Isn't the US the only country to have ever used nuclear warfare? Therefore willingly and knowingly killing countless innocent civilians?

<comment><USER44> True, but I wouldn't consider this terrorism. For me, the distinction between terrorism and general warfare is that terrorist acts are carried out by non- state actors (or people acting as proxies for a state). The war in Afganistan, the bombing of Japan, etc. was carried out clearly and explicitly by the United States government.

This is why I find the phrase 'terrorist government' to be absurd.

<comment><USER45> Terrorism, initially, described acts performed by a government. Interesting that people consider this to be absurd nowadays.

<comment><USER46> Source?

<comment><USER5> >> _"Terrorism" comes from the French word terrorisme,and originally referred specifically to state terrorism as practiced by the French government during the Reign of terror._

<http://en.wikipedia.org/wiki/Terrorism#Origin_of_term>

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER47> You may call me Achmed. <http://www.youtube.com/watch?v=1uwOL4rB-go>

Seriously though did they lower the requirements to become a government employee even further? Who comes up with the stuff? I would laugh but it's actually kind of disturbing that these are the people who we rely on to prevent actual "Terrorists" from doing "Evil".

</comment><comment><USER48> funny thing is if you read Obama's wife comments on privacy she could be label a terrorist..

Why are both democracies and non-democracies so damn afraid of having choosy and thinking citizens? What are the World governments hiding?!</comment>


One Man Who Gives Thanks Daily - <AUTHOR> http://www.businessweek.com/bwdaily/dnflash/content/nov2007/db20071121_579464.htm?campaign_id=rss_tech Are you reaching for your potential? <comment><AUTHOR> Are you reaching for your potential?</comment>


Worst-case optimal joins, in dataflow - <AUTHOR> http://www.frankmcsherry.org/dataflow/relational/join/2015/04/11/genericjoin.html

<comment><USER2> Related (Referenced in the article):

[http://arxiv.org/abs/1203.1952](http://arxiv.org/abs/1203.1952)

Chris Ré covers this in his CS345 course at Stanford.</comment>


SEC Charges Former CEO of Jumio Inc. with Defrauding Investors - <AUTHOR> https://www.sec.gov/news/press-release/2019-50 <comment><USER2> For those who don't want to read the press release, it's Daniel Mattes, former CEO of Jumio Inc.

He agreed to pay more than $17 million to settle the charges

</comment><comment><USER3> Confused why there are being labeled a "mobile payments company." I thought Jumio was an identity verification service?

<comment><USER4> I think their original pitch was that they had an OCR service for credit cards. It's still on the website: [https://www.jumio.com/id-verification/bam- checkout/](https://www.jumio.com/id-verification/bam-checkout/)

</comment></comment><comment><USER5> Steal 17 million dollars from investors, literally not a day in jail.

Steal 17 dollars from a department store and see how that goes.

Welcome to America.

<comment><USER6> > _Steal 17 million dollars from investors, literally not a day in jail_

We saw similar comments following the SEC fining Elizabeth Holmes. Criminal investigations take longer than civil proceedings, and the SEC doesn't have the power to bring the former.

<comment><USER5> Elizabeth Holmes is in jail?

<comment><USER7> She's currently out on $500,000 bail while the criminal charges against her proceed, but prison time is at issue with the charges.</comment></comment></comment></comment>


Mondays Really Do Suck - <AUTHOR> http://apps.facebook.com/usa_gnh/

<comment><AUTHOR> This Facebook app's stats show that happiness climbs steadily during the weekend, then drops as soon as Sunday reminds us that Monday is coming. Once the doldrums have past, happiness begins a steady rise.

Also, I wonder if any of these are tied to the sudden dip in happiness on January 22nd, 2008: <http://en.wikipedia.org/wiki/January_2008#2008_January_22>

Heath Ledger, perhaps?

</comment><comment><USER2> I wonder what words they consider to be "positive" and "negative".</comment>


FaceBook Creating Their Own Currency - Will it Catch? - <AUTHOR> http://www.hypebot.com/hypebot/2011/01/how-many-facebook-credits-is-your-song-worth.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+typepad%2FDqMf+%28hypebot%29

<comment><AUTHOR> <http://developers.facebook.com/blog/post/451>

more info.</comment>


MetaEvents for Rails: DRY Up, Structure, and Document Your Mixpanel Events - <AUTHOR> https://swiftype.com/blog/introducing-meta-events.html

<comment><AUTHOR> I'm more than happy to answer any questions about this gem. It was built as the result of ~2+ years using Mixpanel intensely with Rails, seeing the scaling challenges that result, and then tackling them. I'd love to help anybody else make their Mixpanel implementation better, too. (And, no -- no affiliation with Mixpanel whatsoever beyond being a happy client.)

<comment><USER2> Just wanted to say that this looks awesome; I'm going to try it out right now and will definitely be in touch.</comment></comment>


Our Commitment to Our Content Reviewers - <AUTHOR> https://newsroom.fb.com/news/2019/02/commitment-to-content-reviewers/ <comment><AUTHOR> Seems to be in response to [https://www.theverge.com/2019/2/25/18229714/cognizant- facebo...](https://www.theverge.com/2019/2/25/18229714/cognizant-facebook- content-moderator-interviews-trauma-working-conditions-arizona) , which is posted here [https://news.ycombinator.com/item?id=19245537](https://news.ycombinator.com/item?id=19245537) .</comment>


Lans.py: capture usernames, passwords, messages and inject arbitrary HTML - <AUTHOR> https://github.com/DanMcInerney/LANs.py <comment><USER2> Could anyone point me to a resource that offers a high level explanation of how stuff like this 'works'? I'm happy to spend time parsing the source code but that won't tell me how/why you're able to intercept HTTP requests or w/e is happening. I just want to understand :'((

EDIT Looking for something more complete than a wiki article on ARP spoofing

<comment><USER3> > how/why you're able to intercept HTTP requests or w/e is happening.

Basically, in a typical LAN, you _think_ the server is communicating directly with you alone, but in fact it's broadcasting to everyone. Your NIC and OS just happen try not to receive it.

</comment></comment><comment><USER4> doesnt all switches protect you from arp poisoning? or am i missing something on the attack vector? i understand the proxy part is cool... but the vector appears to be a non issue. i just skimmed the readme...

<comment><USER5> Most certainly not. Many _enterprise_ switches can be/should be/are configured to protect against it -- but most consumer grade (home) switches I've seen don't.

Not sure what the status of various wireless routers/aps (eg: software ap on *bsd/linux).

<comment><USER4> i think what you call home switches are hubs. they operate on different network layers, hence the different name.

<comment><USER6> I don't think hubs (ie. the sort of switch that indiscriminately transmits every packet to every port) have been in widespread use for ages anymore.

</comment></comment></comment></comment><comment><USER7> Can't wait to see what they call the GTK version

<comment><USER8> The name would be appropriate, anyway, because it can be used for penetration testing :D

</comment></comment><comment><USER9> Please use 2 or 4 spaces while writing python code. It becomes impossible to read.

<comment><USER10> I agree with you for code samples in READMEs, but for actual code allow people to respectfully disagree [1].

The benefit of tabs is that you can open it in your editor and set you editor to view tabs at whatever your spacing preference (2 or 4 spaces).

That github doesn't let you specify the tab-sizing you wish to view the code at is no fault of the author's (it would be a nice feature for github to add).

Please don't throw PEP8 at me :)

[1] [http://lea.verou.me/2012/01/why-tabs-are-clearly- superior/](http://lea.verou.me/2012/01/why-tabs-are-clearly-superior/)

<comment><USER11> Why not? It's a convention almost everyone has agreed upon. More than 95% of python code out there uses spaces[1]. The new PEP-8 prefers spaces over tabs. I have configured my text editor to put 4 spaces when I press the tab key and auto-indent with 4 spaces as well. Now, if I want to contribute to a project which uses tabs instead of spaces or use such a project in my own code, I have to change my text editor preferences every time I open those files or fork the project and convert tabs to spaces.

Tabs may have some advantages over spaces, but uniformity is far more important.

[1] [http://sideeffect.kr/popularconvention/#python](http://sideeffect.kr/popularconvention/#python)

</comment></comment></comment><comment><USER12> Does this defeat SSL or SSH?

<comment><USER13> There is a tool, SSL strip that removes SSL from the target machines https request dynamically. While not breaking SSL it is effective on a non observant user. [https://github.com/moxie0/sslstrip](https://github.com/moxie0/sslstrip)

</comment></comment><comment><USER14> inject a javascript that intercepts the form submit action. Send it to another server, don't stop the event.

You have all passwords now ^^

</comment><comment><USER15> any penetration testing companies after you yet? you have some amazing potential! fantastic work.

<comment><AUTHOR> I wish! That's the dream job.

</comment></comment><comment><USER16> hahaha aawesome! :P</comment>


CRU climate scientists did not withold data - <AUTHOR> http://news.bbc.co.uk/1/hi/science_and_environment/10538198.stm

<comment><USER3> Title is misleading.

The report claims that the CRU didn't withhold data simply because "any independent researcher can download station data directly from primary sources and undertake their own temperature trend analysis". So basically, the CRU withheld their own data/source code, but they didn't cover up other people's data. Huh?

Even the report admits that "there has been a consistent pattern of failing to display the proper degree of openness". This sounds like an attempt at whitewashing, basically giving reporters a justification for ignoring the whole mess.

<comment><USER4> You obviously didn't read the next paragraph:

"Writing computer code to process the data "took less than two days and produced results similar to other independent analyses. No information from CRU was needed to do this"."

Personally I can understand them not wanting to "fully comply", given the number of FoI requests they would've received and their tone. Have you seen the vitriol over at Climate Audit?

edit: It gets even better a bit further down: "Asked whether it would be reasonable to conclude that anyone claiming instrumental records were unavailable or vital code missing was incompetent, another panel member, Professor Peter Clarke from Edinburgh University, said: "It's very clear that anyone who'd be competent enough to analyse the data would know where to find it. It's also clear that anyone competent could perform their own analysis without let or hindrance.""

<comment><USER5> The number and "tone" of the requests is irrelevant.

If they want to ignore or not "fully comply" with FOI requests - <USER2> shouldn't take public funds.

<comment><USER6> If you're a university researcher in the UK it's impossible not to take public funds. All universities (bar one) are publically funded.

<comment><USER3> Then don't be a university researcher.

In fact, if you don't want to reveal your top secret source code/data, _don't publish in science journals_. It's utterly ridiculous that journals still exist which don't require source/data to be released.

<comment><USER7> The data was available.

If you want to independently verify it, the best way is to write your own code and see if it spits out the same/similar results.

</comment></comment></comment></comment></comment></comment><comment><USER8> In reality it matters little what these self-examinationary enquiries come up with, because the climate scientists have lost the PR war with this one, and that's the crucial court of opinion. A few committed internet posters will point to the results and say 'but they were exonerated' - when in reality the enquiries all endorse the opinion they acted poorly.

We've gone past the high water mark of human-caused climate change now - perhaps in history the runup to Copenhagen will look like the high point for the cause. Governments the world over are turning their back as an issue. There'll always be a committed band of supporters and promoters but once governments see it as a dead issue then everyone else will move on.

The good news in all this is that as the smoke clears from the FUD surrounding climate change, it will allow alternative energy sources to be evaluated on their eficiency merits, rather than how well they link in to some government- invented paper-swapping scheme. Removing the demonisation of C02 will allow people to concentrate on the real environmental costs of any energy source and decide if the cost is worth it or not.

</comment><comment><USER9> From the original report [1]:

"It was not our purpose to examine, nor did we seek evidence on, the science produced by CRU. It will be for the Scientific Appraisal Panel to look in detail into all the evidence to determine whether or not the consensus view remains valid."

[1] [http://www.desmogblog.com/sites/beta.desmogblog.com/files/ph...](http://www.desmogblog.com/sites/beta.desmogblog.com/files/phil%20jones%20house%20of%20commons%20report.pdf)

</comment><comment><USER10> But the report does ask for better handling of the blogosphere, plus opening up data and source code: <http://blog.jgc.org/2010/07/cce-review-report.html>

<comment><AUTHOR> Good post.

The Guardian has an interesting article from this past Sunday about scientists being more open.

[http://www.guardian.co.uk/environment/2010/jul/04/climatecha...](http://www.guardian.co.uk/environment/2010/jul/04/climatechange- hacked-emails-muir-russell)

I, for one, welcome this openness, and hope that it leads to the removal of fundamentalists from both sides from the debate. No doubt there is a big problem, and we won't solve it when people are merely shouting at each other.

<comment><USER11> If you remove fundamentalists from both sides, won't there be new fundamentalists: the first and last elements of the spectrum?

<comment><AUTHOR> I'm hoping the new extremes are not ideological fundamentalists.

</comment></comment></comment></comment><comment><USER12> This looks like a whitewash to me. It wasn't just about whether they withheld data or even source code. One of their tactics, revealed by the leaked emails, was to publicly berate the scientists who opposed AGW to publish their arguments in peer reviewed journals. In private they worked to get journal editors fired, ignore journals that published opposite views, discredited and hampered the careers of opponents, etc. More importantly, this whole approach of focusing on one little fact and using that to "prove" there was no conspiracy is like focusing on the glove that would not fit in the OJ trial. If you read the leaked emails the pattern seems pretty clear -- these guys were not engaging in science but politics.

<comment><USER13> Large amounts of government funding for scientific research create an equally large incentive to produce results which are politically useful (or at least, not politically inconvenient). In the case of AGW, the easy "solution" is massive expansion of government regulation in all spheres of life, as well as creation of new markets for government carbon indulgences, an excellent mechanism for enriching politicians and selected corporate cronies.

Any contrarian viewpoints are excluded both explicitly and implicitly, because ideas that resemble what's already been published in journals are those most likely to get funding. The vast majority of scientists aren't gonna jump off the gravy train and potentially sacrifice their tenure.

</comment></comment><comment><USER14> [http://www.youtube.com/user/greenman3610#p/a/029130BFDC78FA3...](http://www.youtube.com/user/greenman3610#p/a/029130BFDC78FA33/1/5WvasALL- hw)

direct link: <http://www.youtube.com/watch?v=5WvasALL-hw></comment>


Just open sourced my 10k LOC PHP & MySQL invoicing app - <AUTHOR> https://github.com/tlhunter/neoinvoice <comment><USER2> What exactly did you dislike about CodeIgniter? For me CodeIgniter is probably what I'd use if I had to go back to making PHP applications so I'd like to hear any reasons you had against it.

<comment><AUTHOR> CI was built in the PHP4 days, and for that reason it has a lot of cruft left over. For example, there is no autoloader. Also, classes are loaded as singletons, and are assigned to properties of the controller, which I put into the 'magic' category, and isn't compatible with IDE autocomplete features (I'm a VIM user, but it makes things easier for a lot of developers).

//CI Class Load Example:

$this->load->library('example'); $this->example->something();

//Raw PHP Class Load Example:

$this->example = new Example(); $this->example->something();

As you can see, the latter is a little more obvious about what is going on.

<comment><USER3> What PHP framework would you use if you had to today? Kohana? Yii? Something else?

<comment><USER4> I'm not the OP but almost any PHP project these days has me reaching for Symfony 2[0] or her little brother Silex[1] paired with Doctrine 2[2].

[0]. <http://symfony.com/> [1]. <http://silex.sensiolabs.org/> [2]. <http://www.doctrine-project.org/>

<comment><AUTHOR> Symfony is nice, Zend 2 is going to fix everything from ZF1 and is worth keeping an eye on as well.

I've dabbled in Doctrine before, but the memory usage looked a little too high for the convenience it offered.

<comment><USER5> Out of curiosity what are you doing in PHP where memory usage is an issue? PHP's standard life cycle, while having numerous disadvantages, avoids a lot of problems with memory usage.

It's a rather different beat, but you might checkout Propel (<http://propelorm.org>) for a different take on a PHP ORM. It has a static build phase unlike Doctrine which turns some people off, but if you can get past that it's a rather nice ORM.

<comment><USER4> If you think that your project is going to grow into a substantial code base, I would NOT recommend Propel.

A lot about their active record implementation violates POLA with various gotchas and code generation gets tedious and unwieldy with models that contain many fields or relations.

<comment><USER5> Interesting, I've been using Propel for so long I've probably internalized all the gotchas. What in particular caught you off guard?

<comment><USER4> My favourite is probably:

Say you want to add a product to an existing order in the database...

$orderProduct = new OrderProduct(); $order = OrderPeer::retrieveByPK(1);

$order->addOrderProduct($orderProduct);

Now, if ANYWHERE after this point in the code, something calls $order->getOrderProducts() before you call $order->save() (like a validation routine or something) you will lose that new OrderProduct and it will not be persisted.

It's bit me more than once, especially as you start to spread code around that depends on traversing the relationships - can be a very tricky bug to spot.

<comment><USER5> Propel's implementation of related collections definitely could use some improvement. In your example, you wouldn't necessarily lose your new object, it just wouldn't be persisted through a call to the parent order to save. My general habit is to call save on a newly created object directly, and as soon as possible. Regardless, I definitely agree this is one (and there are some other points) where Propel definitely has rough edges.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Thanks for sharing! I wished more people would share code of projects they are no longer interested in. The educational value ('how did he/she built this') is worth a lot, regardless of the 'quality' of the code. Thank you!

<comment><AUTHOR> I have the exact same sentiment; I pretty much open source all of my old projects for people to learn from (I taught a small meetup for a while, it was useful to explain both the good and the bad). I add DEFUNCT to the description if they are really old or have a lot of bad practices. Here's the rest: <https://github.com/tlhunter>

<comment><USER7> That's an excellent idea. I should go add that to some of my horrible, horrible C code, lest someone think that 10 levels of indentation, not using c-style strings, non-portability, architecture assumptions, lack of error checking, and blocking sockets is a good idea...

Or that macros without bounds checking that cause segfaults unless debugging is a good idea...

What was I thinking?

<comment><AUTHOR> Heh, I'm not well versed in C, but it sounds scary.

You can also throw comments in the code where the bad stuff is so that it has more visibility, as well as suggestions for how to better solve the problem. Sometimes people learn best from bad code!

<comment><USER7> Good idea.

It should sound scary, it's the worst code I've ever written.

I wrote it 2 years ago with the idea "working first, correct later", but I haven't finished the latter yet...

</comment></comment></comment></comment></comment><comment><USER8> I remember writing invoicing systems like this. Then I realized I probably shouldn't reinvent the wheel or break GAAP. :/

<comment><AUTHOR> Yeah, there is a ton of competition. I started building this without having done proper research.

<comment><USER8> See, the thing is: creating an invoice is an 'accounting' event that needs to be thought out a bit. Like a double entry general ledger, receiving payments, proper audit trails, the inability to modify an invoice after 'posting' it, batches, periods, and other goodness.

Otherwise, you get this ugly term: embezzlement.

But kudos for opensourcing it and standing up to criticism from hecklers like me.

<comment><USER9> I disagree, as a business should think first in the broad context of product/market fit, which is a very dynamic issue, and not all markets need the kind of depth in an accounting product you describe.

<comment><USER10> The only case where that my be true is the case where you have a sole proprietor where the owner is the only one who touches the books. As soon as you have a bookkeeper who is not the owner, or multiple owners you do need that kind of depth.

<comment><USER9> I'd bet the OP intended it for use by sole proprietors like himself, and that he never aimed to build a product for bookkeepers. There's plenty of a market for invoicing software that targets sole proprietors.

A product with as much depth would likely appeal to accountants or those that assist them directly.

</comment></comment></comment></comment></comment></comment><comment><USER11> great to see this open sourced - sorry to hear you closed neoinvoice though

the web based invoicing market is extremely crowded and very hard to complete against the likes of freshbooks.com

though i went the opposite route to you and its working $ for me

created the open source app <http://simpleinvoices.org> first, got large user based, then offered premium hosting at <http://smarterinvoices.com>

<comment><USER10> I think at one point we had some LedgerSMB users using SimpleInvoices and importing data into LedgerSMB.

I think the difficulty with invoicing is that it is so heavily tied to everything else one might try to do in a business, from tracking inventory to CRM to financial accounting. This doesn't mean that one can't do this, but the interconnections seem to be key.

<comment><USER11> re ledgdersmb \- yep - the ledgersmb crew did some great work to the SimpleInvoices code to make it work for them

re interconnections

* depending on the target market

* the people who need integration already do some form of accounting already - and a 'full stack' accounting solution like <http://xero.com> is more appropriate for this market

* simpleinvoices market is people with no accounting system or desire for debit/credit stuff so we have make no attempts to make quickbooks, etc. integration work

</comment></comment></comment><comment><USER12> Just as a quick look, this thing is riddled w/ potential sql injections..a number of unchecked/unescaped uri controlled variables. In some cases there's validation of numerics w/ +=0, but in many cases (e.g. $sort_col) there's none.

<comment><USER8> you mean you shouldn't trust user input?

<comment><AUTHOR> The arguments to controller methods (in CI) are passed through some regular expressions. CI goes as far as to destroy all GET variables (which I highly disagree with).

<comment><USER12> GET's are all removed (by default), but for uri segments you'll just get some character filters, and some anti-xss attempts (assuming you have that on). Nothing anywhere near sufficient to prevent sql injection. Again, didn't dig too deep, but I don't see any validation that would prevent me from doing some level of at least blindsql..

<comment><USER13> I think CI rejects anything in the URI which isn't alpha-numeric. Would that solve the issue?

<comment><USER12> Kind of, anything in permited_uri_chars is allowed. This includes spaces, slashes, commas, %, and a handful of others by default. As I said only skimmed quickly so maybe I'm missing it. Will take a deeper look in a bit once not on mobile.

</comment></comment></comment></comment></comment></comment><comment><USER14> Is that mochaUI? Looks like it.

Tried using it recently and it actually was quite nice despite the lack of docs and other various hiccups.

At any rate, thanks for putting it out.

<comment><AUTHOR> Yeah, it's MochaUI. About two years ago, the project was mostly un-maintained, I haven't looked at it recently though.

</comment></comment><comment><USER15> Okay, so coming from a user of CI 2.0 mind you and using integrated smarty templates with it, I would have to say after using even a micro-framework say silex, I could build a much better enterprise application with modern php5.3/5 features than i can with CI. The major problem is it feels really dirty to include/require statements with CI. Also to build re-usable code within the confines of their existing library system you have to build all your constructors with a single $param argument. The models are junk since they are really just a place to store organized function calls. Their database abstraction is an abomination. Generally the only thing good about CI is that you can break up your source into a marginally logical fashion which can it improves maintainability.

Now as for this application being written in Code Igniter? I don't really see it as a problem since it means it will be easier for lesser experienced dev to pick up and run with the ball. In time they will learn it's major deficiencies and they will move on. But i think there is room for improvement, in fact I think this would be a great project to port to another maybe more robust framework and is a good project for learning new framework translations.

I will say however that the author wanting to rewrite a product like this in nodejs is really only going to make something like this more inherently difficult to maintain since javascript code tends to get more complicated than your typical java / php / python app as it grows. Granted you do have js at your finger tips it is still largely un-tested on massive scale for large application development. It however has shown great promise for handling extreme traffic in terms of concurrency, but it handles it mostly by using async libraries which pile everything into queues of some sort some where. So your code is littered with async callbacks everywhere. Anyways.. Not only that, but the biggest problem of all is the inability to intelligently step through your code with some kind of IDE beyond using a browser-base debuger such as webkit inspector or the online IDE cloud 9.

I don't hate nodejs. I just think people are jumping on the band wagon way too quickly for server-side hosting. For websockets it's a great solution, I just don't like seeing it as "the only solution" for some peoples projects. I'd rather see a more hybrid approach.

</comment><comment><USER16> I'm curious, I remember a posting a while back that you were trying to sell this app through Flippa? Any details of that experience you would mind sharing (nothing but tire kickers, not the right market, buyer fall thru, etc...)?

<comment><AUTHOR> Long story short, not a single bid. A lot of people would ask some questions, but would seem to ignore the info on the page. I didn't bother paying extra to have them tweet the site on their twitter, since they tweet seemingly hundreds of times a day and nobody seems to listen.

I'm used to selling items on the Envato marketplace, which provides all of the 'advertising' for me. But it seems that with Flippa, there is so much noise and one has to do their own finding of buyers.

</comment></comment><comment><USER17> I didn't look through the PHP or MySQL code but the front-end has a clean look (from the video), which is more than is expected from most people who take it upon themselves to develop an invoicing system

<comment><AUTHOR> Thanks! The public facing layout went through three major revisions and the final one is based on 960.gs. The layout of the app is governed by MochaUI, but it is a custom theme.

</comment></comment><comment><USER18> How many users did you have?

<comment><AUTHOR> There was only about 120 users at its peak. I hesitated, was never ready to make it a real money-making business, and therefor didn't really advertise it.

<comment><USER19> I've a few questions if you have the time.

Did you never charge? Or were you charging? What were the reasons it was / you were not ready to make it a money making business? Any mistakes or lessons learned while building/running the software? Where did the 120 users come from?

As someone who is looking to create their own product soon I'd be really grateful for any response you can give.

Thanks

Alan

<comment><AUTHOR> For a few months I had the ability for users to sign up for a paid account, but I never pushed it. After that, I just disabled the feature altogether.

The most advertising I did do was a 125x125 ad on a website used by web developers (DavidWalsh.name) for one month. I didn't get a single user through that ad though.

The biggest lesson learned is that an app like this really needs someone who is good at marketing. I'm just a programmer, but if I had found a marketer and pursued the development of the app, I'm pretty sure it could have been successful.

Another take away is to research competitors. I never looked them up since I actually built this mostly for myself at first, and just kept adding new features as it got bigger. It turned out the market was very crowded (This page has a list of 17 competitors: [http://thomashunter.name/blog/shutting- down-and-open-sourcin...](http://thomashunter.name/blog/shutting-down-and- open-sourcing-neoinvoice/)).

Also, "piss or get off the pot". I spent a lot of time developing this but I didn't devote enough of my time to it for it to be successful.

<comment><USER19> Thank you very much for taking the time to reply!

Also I know you're getting a lot of stick in this thread for the code which I feel is unjustified, I just want to say I commend you for open sourcing it.

<comment><AUTHOR> Thanks for the encouragement! I get flack from everything I open, must be a sign.

<comment><USER20> It's a sign that people are interested in,and paying attention to your code. Take it as a compliment!

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> What would you do different based on what you know now?

<comment><AUTHOR> While I was at a startup recently, I did all of my frontend development in Backbone.js, this app would do a lot better in that framework.

Also, the CI framework isn't all that great, I would have certainly used a different framework. Perhaps even Node.js (which is what I'm doing a lot of my development in nowadays).

I also would have looked for a marketer and devoted more time to the project. The market for this kind of product is very crowded, but there is a lot of room for innovation.

<comment><USER22> I don't think anyone's ever subscribed to a SaaS product because it used X technology over Y. I also think you're way too focused on the tech and the list of features, instead of selling a solution.

You can say all you want about invoicing being an over saturated market, but I launched a very successful _project management_ product a few months ago. Focus on doing a few things very well, and you can do well in just about any "saturated" B2B space.

<comment><USER23> Spot on!

</comment></comment></comment></comment><comment><USER24> This looks like you put a lot of work into this. Thanks for open sourcing it.

</comment><comment><USER25> I can't believe you hardcoded this for MySQL instead of using PHP's excellent and versatile PDOs, and I can't believe the 10k line count. Gosh. Is "de- engineering" a suitable term here? Thumbs up for open sourcing your work, though.

<comment><USER25> No I'm serious here, renownedmedia. Don't disregard my rant with a silly downvote, but do instead indulge yourself in the PDO methods instead of painting yourself and your projects into corners: <http://php.net/manual/en/book.pdo.php>

<comment><USER26> What makes you think he was the one who downvoted you? You could easily have asked him about his technical decisions without being a jerk.

Besides, this was a personal project, probably created without the intention of eventually open sourcing it. If he only ever intended to use MySQL, and portability across RDBMS systems wasn't a goal, then it's fine as it is.

<comment><AUTHOR> You hit the nail on the head. I never knew I would open source this, I didn't even plan on it getting as feature-rich as it had become.</comment></comment></comment></comment>


Explore Hidden Networks with Double Pivoting - <AUTHOR> https://pentest.blog/explore-hidden-networks-with-double-pivoting/ <comment><USER2> > The SSH_enumusers auxiliary module allows user detection:

Gee, I naively assumed that ssh was designed to avoid leaking whether users were valid or not. Is this based on just timing or does the protocol really reveal whether or not it's a valid user?

<comment><USER3> Yes, it appears to be a timing attack where invalid users are denied more quickly than valid users.

[https://www.rapid7.com/db/modules/auxiliary/scanner/ssh/ssh_...](https://www.rapid7.com/db/modules/auxiliary/scanner/ssh/ssh_enumusers)

<comment><USER4> And to be clear, this is an issue that resurfaced in August or so of 2016, and is patched in supported OpenSSH daemons[0][1].

[0] [https://access.redhat.com/security/cve/cve-2016-6210](https://access.redhat.com/security/cve/cve-2016-6210)

[1] [https://www.ubuntu.com/usn/usn-3061-1/](https://www.ubuntu.com/usn/usn-3061-1/)</comment></comment></comment>