Bad Times in Tech? Not If You’re a Startup Serving Other Startups - SREinSF
https://www.nytimes.com/2019/08/02/technology/brex-start-up.html
======
nlh
I will say, for what it’s worth, that the customer experience of using Brex is
really quite outstanding (my current startup is a customer.)

They’ve figured out things that in hindsight just seem so obvious to a good
UX, and yet we’ve all been so trained to have low expectations from the
mediocre service traditional banks/corporate card providers offer that it
seems outstanding.

From limited experience - the fact that virtual cards are first-party
citizens, the helpful text messages you get (which include a warning the first
time you use a card physically, instant text records when you use a card
physically, the ability to photograph receipts and send them back to that same
text phone #, and and and.)

American Express (my only other corporate card comparison) of course _could_
offer this stuff, but it’s just not in their DNA because, well, they haven’t
had to innovate because they had what amounts to a monopoly on corporate
spending cards. And I should note - Amex ties the credit on those cards to the
founder (requiring a personal guarantee until the company reaches a certain -
large - size.)

Anyway, this is all to say I’m a fan and it doesn’t surprise me they’ve having
the success they are so far. Let’s hope they can do it profitably and keep it
up!

~~~
tempguy9999
I have a visa card. They introduced a verification check for online use a few
years ago. This involved giving the answer to a question or typing in a
passphrase or something (can't remember, I almost never use it).

When setting it up on the web I had to type in the answer/passphrase/whatever.
It was rejected. I read the form again, looked at the error msg, no indication
why, typed it in again, again rejected.

I called the bank, "oh, it's got to have a digit in it". It did not say on the
form a digit was needed, nor did the error message.

They could not even manage to tell the users the most trivial requirements
either directly or in the error message. It's beyond pathetic. It's literally
incomprehensibly incompetent to fail at such a low level.

~~~
PaulHoule
I remember "Verified By Visa" which would send you to a site that looked like
it was drawn by a crayon. It shocks me how financial institutions often make
web sites that look like a parody of a phishing site. For instance, my credit
union had an online banking service which used the name "myvaultsentry.com"
which just seemed liked something a high school hacker would think up.

It is strange because operationally Visa is good at what they do, and they put
a huge amount of effort and expense into developing a brand, but for legacy
organizations (academia too) the web seems to be made of kryptonite.

~~~
jackweirdy
MBNA, a credit card provider in the U.K., used to provide online services
under a completely different website than their main one, with a domain like
“bank card services dot co dot uk”* and a barely-styled website

I thought I was being phished until I confirmed it was real on the phone with
them.

(it may not have been that domain so don’t try in case that’s a sketchy site)

------
fizx
I ran a bootstrapped company with $150k/mo of well-documented, above-board
recurring revenue and Chase wouldn't give it a credit limit above $5k.

Entrusting my finances to another startup like Brex is scary, but damn is the
pitch compelling compared to mainstream banks.

~~~
opportune
I think you could easily buy an hq (or any other relatively liquid asset that
would also help the business in other ways) outright with that kind of money
and use that to collateralize a much larger credit limit

~~~
insulanus
What's an hq?

~~~
QuantumGood
Headquarters (real estate)

~~~
techslave
uh that’s not liquid

~~~
opportune
Real estate (especially smaller, less customized office space) is usually
liquid enough to use as collateral for a loan

------
rchaves
This Pedro Franceschi is the same kid that created iUsers to allow multi-users
in iPad and hacked Siri to understand portuguese years before Apple. I’m
really happy that their startup has a big potential and I hope it succeeds,
I’m a real fan

------
hn_throwaway_99
As this is Hacker News, Paul Graham's comments on Yahoo during the .com bubble
are particularly relevant:

By 1998, Yahoo was the beneficiary of a de facto Ponzi scheme. Investors were
excited about the Internet. One reason they were excited was Yahoo's revenue
growth. So they invested in new Internet startups. The startups then used the
money to buy ads on Yahoo to get traffic. Which caused yet more revenue growth
for Yahoo, and further convinced investors the Internet was worth investing
in. When I realized this one day, sitting in my cubicle, I jumped up like
Archimedes in his bathtub, except instead of "Eureka!" I was shouting "Sell!"

[http://www.paulgraham.com/yahoo.html](http://www.paulgraham.com/yahoo.html)

~~~
rolltiide
> except instead of "Eureka!" I was shouting "Sell!"

and then missing 2 more sustained years of jaw dropping prices

don't act clairvoyant.

~~~
hn_throwaway_99
You do realize that was a quote from the pg blog post I linked, correct?

~~~
rolltiide
Yes, I even read it to make sure he didn't call it closer to the crashes

------
drawnwren
Brex's PR firm certainly seems to be earning their keep. This is the third or
fourth article about Brex that 'wasn't about Brex' I've seen on HN in the last
couple of months.

------
meddlepal
Isn't this just a reformation of the idea there's only two business models?

Either you mine for gold yourself or you sell shovels to others who want to
mine for gold.

~~~
pkaye
Btw Google for the word "Bre-X" and you will read about a gold mining scandal
from the dotcom era.

------
b_tterc_p
Brex sounds like it’s headed for bankruptcy based on the article. They’re
unprofitable now, and have incredibly risky clients sitting in front of what
feels like a looming recession.

------
cryptica
It seems like it's doing well because things are bad in silicon valley, not in
spite of. It sounds like there are a lot of desperate startups getting loans
to 'simulate' growth by having negative profit margins (since they can't get
real growth otherwise), then they use that fake growth to get investors' money
which they use to service debt, then they keep raising money until they exit
or IPO. It doesn't seem sustainable. All these debts end up the hands of
corporate shareholders. There's a point where companies and the public will
stop buying useless startups (if that point hasn't already passed).

~~~
dehrmann
> things are bad in silicon valley

Really?

> there are a lot of desperate startups getting loans to 'simulate' growth by
> having negative profit margins (since they can't get real growth otherwise)

You're conflating a few things, here. The Amazon strategy of reinvestment
works as long as it's genuine growth and not overdone. Uber's more of an open
question: they've increased demand through subsidies, the question is what
will demand look like when prices reflect the true cost. Postmates is in the
same situation as Uber, but much worse because they offer a service people can
trivially do themselves.

> All these debts end up the hands of corporate shareholders.

Not usually. And startups don't usually use debt (except in ~2015/2016), they
sell equity. VC funds tend to have more pensions and sovereign wealth.

------
itschekkers
There's always a PG article --
[http://www.paulgraham.com/submarine.html](http://www.paulgraham.com/submarine.html)
[April 2005]

------
paxys
> for his Bernese mountain dog, Ruby, who is named after the coding language
> Ruby on Rails

/facepalm

~~~
rchaves
I remember Pedro giving talks on Rubyconf in Brazil with only 15 years old,
this kid grew with the help of Ruby community, so it makes sense he gives so
much importance to it

~~~
skrebbel
I think the facepalm was meant to be "OMG this finance journalist doesn't know
the difference between a framework and a language, what an idiot".

(Fwiw, the difference between the two is super nuanced and irrelevant to most
journalism about tech. They're both "tools to make software". If I were a
journalist, I'd also call Rails a programming language, because that's a term
much of the general public understands is "a thing people use to build
software with")

(so who knows, maybe the author actually knows, but decided to write for the
NYT audience and not pedants on HN)

~~~
dang
> I think the facepalm was meant to be

Reading it again, I'm sure you're right, but I totally missed that. Actually
the lines between language and library and framework are not so easy to pin
down. Maybe the finance journalists are on to something.

------
scarface74
It’s nothing more than the same Ponzi scheme we saw in 1999. If venture
funding dries up, for their customers, they are also toast. I hate that the
modern idea of a “successful” company is how much money they can raise and at
what evaluation.

~~~
dehrmann
It's very different. Look at how the public market is treating Uber. Its pre-
IPO valuation was rosy, but not out-of-line, and its price has been pretty
consistent since the first few weeks. It's not like every tech IPO is up
200%-500% on the first day, then keeps climbing by 1% per day.

> I hate that the modern idea of a “successful” company is how much money they
> can raise and at what evaluation.

So the value of the company? I agree that it doesn't capture value to society,
but it's better than "community-adjusted EBITDA."

~~~
scarface74
It’s always “different this time”. Uber still hasn’t proven it has a
sustainable business model. It’s marginal profit is still negative with no
signs of bring cash flow positive. During the dot com boom the first time, you
also had companies going public with no profitability and crazy valuations.

------
jonathanedwards
The scariest thing about this article is it didn't contain the word "bubble"

------
auvi
I think this is a good example of a "Submarine"[0] article

      [0] http://www.paulgraham.com/submarine.html

------
CPLX
For those that are familiar with the service are they really mostly/only
focused on companies that have outside investment?

From glancing at their literature it seemed like their gig was lending money
to companies that actually already had the money in the bank, like providing
company spending cards to a startup with a few million in VC money sitting
somewhere.

Is that correct or do they lend to companies with more traditional economics,
like a bootstrapped company with a million or two in annual revenue but
without major cash reserves or investment?

~~~
johns
They told me they basically only serve companies with VC investment. We were
declined despite meeting the stated balance requirements because we were self-
funded.

~~~
CPLX
That seems like a pretty lame business model. Like why bother?

Though I guess that question answers itself, it seems logical to the
predictably solipsistic VC community, who then throw money at it.

~~~
tylerhou
Less risky, because a VC does due diligence.

------
remote_phone
Startups serving other startups sounds exactly like the dot com boom/bust.
When the bust started, it spread across the entire Valley because exactly
this.

------
xivzgrev
I.e., when people are mining for gold, sell pick axes!

------
rjzotti
I don’t understand the economics of Brex. I used to work for a large,
analytics-savvy credit card company, and people would freak out if the
percentage of customers going bad (not paying their debt) exceeded something
like 3-5%. Given that VC-funded startups fail at a rate of 11/12, isn’t Brex
effectively throwing money down a massive black hole, assuming they’re
extending credit? And this is at the top of credit cycle, probably within a
few years of a recession, where a higher than normal percentage of good debt
will go bad too.

------
trhway
Bad times? Only lazy bums like me and poor H1s are still sitting at our old
BigCo (life work balance is amazing, plus there are too few of us left who is
doing the stuff so we are treated pretty soft and accurately :) . Anybody who
left during the last year and a half got minimum 300 (junior and/or really
incapable engineers) with the normal engineers getting 400-500K and that isn't
in a red hot AI and the likes. The money is just sloshing around. Granted
everything comes to an end, and we're definitely due for the one, yet it
definitely didn't happen yet.

~~~
rak00n
Who's paying 400-500K for normal engineers? Even FAANGs don't pay that much
for for Senior Software Engineers.

------
brexthrowaway
The Brex interview handed out real customer bank balance and transaction
history and suggested that that data was all they they used to build their
underwriting model.

------
zed88
How is it different than say, stripe issuing?

[https://stripe.com/nz/issuing](https://stripe.com/nz/issuing)

~~~
relyks
Brex is identical to what Stripe is offering, but Brex's cards offer credit.
From what I can see and correct me if I'm wrong, Stripe doesn't offer credit
lines

~~~
nekitamo
[https://stripe.com/partners/fundingcircle](https://stripe.com/partners/fundingcircle)

I’ve used it for my bootstrapped company, works great.

~~~
albertshin
I haven't touched base with these lenders in a while but I thought p2p lenders
like fundingcircle only offer term loans?...

Do they offer credit lines and revolvers now too? Curious how that works out
in the p2p space.

------
chiefalchemist
Is it official? The Startup Industrial Complex?

------
IgorPartola
During a gold rush the best way to make money is to sell shovels.

~~~
adventured
> During a gold rush the best way to make money is to sell shovels.

That's never actually true, it's just a nice saying. The most money is always
made in owning a super structure business - in tech, a platform - that has
very wide appeal, rather than concerning yourself with trying to compete to
sell shovels to a temporary gold rush.

Selling shovels is an opportunistic business, only good for a short-term run.
The real money is always made by focusing instead on larger, longer term
opportunities that are sustainable.

Some things persistently ignored about the shovel selling business during gold
rushes: most of the shovel sellers lose their hats in the bust, because they
don't see it coming and they carry inventory and speculate on demand
constantly. The history of gold rushes is that the shovel sellers frequently
miscalculate the duration of the rushes. They get hammered when it ends, most
of them go bankrupt (see: every oil boom in US history).

It's better to be Exxon or Chevron and own large reserves in the ground, not
the primary company selling little pieces of gear to Exxon. It's better to be
the majors in the Permian (gold rush) making money long-term off the reserves,
not the little shovel sellers that constantly boom and bust with each big blip
in the oil market.

It was far better to own refining and pipelines - chokepoint super structures
- during the oil boom in Standard Oil's time, than to be a shovel seller to
the oil industry or oil wildcatters.

It's better to be Rio Tinto, Newmont or BHP and own the mines & supply than to
be selling mining equipment. BHP is a $137b company, Rio Tinto is a $91b
company. The shovel sellers are comically tiny by comparison, borderline
irrelevant in size versus these juggernauts.

For the last century it has been better to be De Beers than to be selling
diamond industry equipment.

During the car boom in Henry Ford's time, it was better to be one of the
surviving majors than to be a shovel seller. This fundamental is always true.

During the mobile gold rush it's better to be Apple and Google than ARM,
Foxconn or Qualcomm (Samsung for their part covers all the bases). The super
structures - Apple & Google platforms in this case - usually by far make the
most money, the shovel sellers are typically much smaller and less profitable.

~~~
kev009
IBM is over 100 years old. I don't think most people in tech understand how
profound that is, between the obvious changes in leadership but more
astonishingly business-sinking technology shifts, industry tanking economic
phenomenon, etc.

There will not be another IBM coming out of San Francisco culture.

I only skimmed the article so I couldn't tell if it was loathsome or self-
paraody of what is going on in SF right now. But I hope they and readers
realize it is simply ouroboros.

~~~
adrianN
I don't know. Apple has something like 250 billion in their war chest. They
could stop selling stuff for a hundred years and still pay 20000 people $100k
a year.

~~~
kev009
Sure but neither a startup nor raised in the current SF startup culture. Apple
definitely has potential to transcend tech and leadership although we need to
see 1-2 more changes in leadership to know for sure.

------
segmondy
How do they monitor the bank account and balances?

------
jhayward
In a gold rush the miners go broke but the hardware store makes boatloads of
cash.

~~~
OldHand2018
In a tech boom the startups go broke but the property owners make boatloads in
rent.

~~~
gingabriska
Who are property owner if not executives at big companies and also people who
are contributor of VC funds?

------
wishrider
I offer small services other startups too
[https://launchpropeller.com/#/](https://launchpropeller.com/#/)


Obesity rising in American women - tatobug
http://jama.jamanetwork.com/article.aspx?articleid=2526639
======
cloudjacker
Speaking for all American men: we know.

~~~
ravenstine
Basically, yeah.

------
MollyR
Maybe the title should be changed to match the actual paper title "Trends in
Obesity Among Adults in the United States 2005 to 2014" ?

EDIT: as some people mentioned below that the title does match a sentence in
the conclusion. The study is still for women and men, and has interesting
cross-sectional data for both.

~~~
ravenstine
"For women, the prevalence of overall obesity and of class 3 obesity showed
significant linear trends for increase between 2005 and 2014; there were no
significant trends for men."


PHP Anthem - Uncle_Sam
http://shiflett.org/blog/2010/aug/php-anthem

======
jacquesm
> PHP finally has an anthem. This is what we’ve been lacking.

Right. I don't think that a song was the thing that PHP was lacking most.

------
missizii
And we wonder why there aren't more women in tech.


United Says It Won’t Use Police to Remove Paid Passengers - walterbell
https://www.wsj.com/articles/united-ceo-blames-system-failure-on-passenger-removal-incident-1492003424
======
coreyp_1
United: You're doing it wrong.

[https://www.xkcd.com/463/](https://www.xkcd.com/463/)


Show HN: I made my website/resume voice controlled - ddod
https://benwasser.com/

======
ar7hur
Very interesting Ben! Did you have a look at [https://wit.ai](https://wit.ai)
? It's an API that encapsulates both speech rec and semantic interpretation.

~~~
ddod
I hadn't seen this yet. It looks really cool and I'll have to devote some time
to learning what they're doing.

------
ddod
This was made using the Web Speech API and a matching system I came up with
that uses Levenshtein distances and tokenized string matching. I wrote up some
demo code here:
[https://github.com/benwasser/WebSpeechAPI](https://github.com/benwasser/WebSpeechAPI)

------
yoshokatana
This is brilliant! One feature request though: It'd be cool if the microphone
icon toggled the voice recognition, rather than simply enabling it. I couldn't
figure out if there was a way to disable it (besides closing the tab and
reopening it).

------
maccard
This is cool and all, but it's another Chrome only site. You might as well
have another desktop app that I have to download. Why isn't there support for
other major, Modern browsers such as FF, Opera and IE11?

~~~
ddod
Sorry about that! It uses the nascent Web Speech API which seems to rely on
external audio processing (i.e. how Siri works). Google has such capabilities
so that's why it currently works with Chrome (although I think it works in
Safari, as well).

------
brianbreslin
So it only lets me ask one question on chrome mac, then i have to reload the
page.

great idea btw. I wondered instantly if this could be turned into a service.

~~~
ddod
That's not the intended behavior. I developed it on Chrome for Mac, so it
should just listen continuously. If you have a second, could you let me know
what OS and browser versions you're on?

Also, I agree that it could be a cool service, but my wrapper is relatively
light compared to the work being done by Google, so I'm guessing you'll start
to see a lot of competition in this area.

------
onuryavuz
Cool, I like it. I'm not a native English speaker, but it worked for me better
than Siri :)

How many predefined answers do you have?

~~~
ddod
Glad you liked it. It uses Google's voice recognition servers, so Android's
voice recognition may prove better for you than Siri.

It currently has 64 predefined answers with multiple triggers linked to each
one.

------
gaitme
Best time of my life, saying 10 times "work" for nothing: wall, rock, west,
wall, welcome...

French power I guess


Need Help to Recall CSS in JavaScript – Dec*** - proyb
It was posted in HN and can't recall the name of the CSS framework in Javascript. What that call?
======
proyb
Finally, after hours of search, I would have never foud it if not for hnapp.
[http://hnapp.com/?q=score%3E50%20css%20javascript](http://hnapp.com/?q=score%3E50%20css%20javascript)

[https://descartes.io/](https://descartes.io/)


Show HN: HNBuzz – daily/weekly digests, full-text search and mobile awesomeness - leandot
http://hnbuzz.com

======
leandot
Initially I built HNBuzz in order to have a daily digest with the top stories
for myself. Then I added some more features and I believe someone else could
appreciate it as well. So looking forward to your feedback at hello@hnbuzz.com
or in the thread below

Currently HNBuzz has:

\- sections - All, Ask HN, Show HN, Hiring

\- time ranges - daily, weekly, monthly, yearly, any period you want

\- full text search within each section

\- mobile optimised

In the future I have plans to make HNBuzz personalised and categorise the
stories. Other ideas?

------
advance
Neat, clean, minimalist and easy to use, providing interesting tech feed from
multiple sources in one spot.

------
hack2good
nice website. I like the full text search for example to find python related
articles :)


Ask HN: DNS service with an api - bhurlow

What's a good DNS hosting solution that has a good, straightforward api. (I find route53 to be an api headache)
======
gamedna
I use <http://www.rackspace.com/cloud/dns/> Free RESTful API with language
bindings.

Api docs: [http://docs.rackspace.com/cdns/api/v1.0/cdns-
devguide/conten...](http://docs.rackspace.com/cdns/api/v1.0/cdns-
devguide/content/index.html)

Python examples:
[https://github.com/rackspace/pyrax/tree/master/samples/cloud...](https://github.com/rackspace/pyrax/tree/master/samples/cloud_dns)

------
benologist
www.dnsimple.com


Google Play Store warns Mastodon app – content “incites discrimination” - ColinWright
https://toot.fedilab.app/@fedilab/104765191594914330
======
raxxorrax
Having an opinion incites discrimination in today's time. I would not react to
Googles requirements. F-Droid is a good alternative.


Mitt Romney Calls Tesla a 'Loser' - rsingel
http://www.wired.com/threatlevel/2012/10/romney-tesla-loser/
======
kgermino
For Context, from [http://abcnews.go.com/Politics/OTUS/presidential-debate-
tran...](http://abcnews.go.com/Politics/OTUS/presidential-debate-transcript-
denver-colo-oct/story?id=17390260&singlePage=true#.UG0JJ03oR3A) :

(CROSSTALK)

ROMNEY: ... to oil, to tax breaks, then companies going overseas. So let's go
through them one by one.

First of all, the Department of Energy has said the tax break for oil
companies is $2.8 billion a year. And it's actually an accounting treatment,
as you know, that's been in place for a hundred years. Now...

OBAMA: It's time to end it.

ROMNEY: And in one year, you provided $90 billion in breaks to the green
energy world.

Now, I like green energy as well, but that's about 50 years' worth of what oil
and gas receives. And you say Exxon and Mobil. Actually, this $2.8 billion
goes largely to small companies, to drilling operators and so forth.

ROMNEY: But, you know, if we get that tax rate from 35 percent down to 25
percent, why that $2.8 billion is on the table. Of course it's on the table.
That's probably not going to survive you get that rate down to 25 percent.

But don't forget, you put $90 billion, like 50 years' worth of breaks, into --
into solar and wind, to _Solyndra and Fisker and Tester and Ener1. I mean, I
had a friend who said you don't just pick the winners and losers, you pick the
losers, all right?_ So this -- this is not -- this is not the kind of policy
you want to have if you want to get America energy secure.

The second topic, which is you said you get a deduction for taking a plant
overseas. Look, I've been in business for 25 years. I have no idea what you're
talking about. I maybe need to get a new accountant.

LEHRER: Let's...

ROMNEY: But -- but the idea that you get a break for shipping jobs overseas is
simply not the case.

(CROSSTALK)

Regardless, I won't comment on this myself since I can't imagine any thread on
this article staying clean...

~~~
protomyth
I figure given the speed of writing, it was a poorly written article to take a
soundbite and put it to a pre-existing opinion. It gets clicks and maybe a
quick scan without providing the actual context. This is just one example of
the next 24 hour news cycle from both side's news outlets. Job numbers hit
Friday, so I only expect a day of it.

~~~
sharkweek
Very much so -- watching it live, it really did not come across that harsh
(this coming from someone who will 99% certainly be voting for Obama).

~~~
001sky
Yes, the title: _Mitt Romney Calls Tesla a 'Loser'_ is just Factually
wrong.[1]

He may (or may not) have _implied_ it. But then again, this is in they eye of
the beholder.

Excluding the _may_ , _not_ , and _implied_ are material defects, for example.

_____

------
nwienert
This article is wrong. He wasn't calling them losers he was saying that
politicians in general don't have the ability to pick the winners, they can
only pick the losers through their policies. He was basically saying that
Obama was trying to pick the winners in green but that it wasn't working
because the market isn't ready (basically claiming he is failing because
government can't make an industry a winner through policy). He was also
probably implying that Obama was purposely choosing Oil as the loser.

~~~
rayiner
Not even close!

Romney's statement was in the context of his reference to someone's joke
making fun of Obama for picking losing companies. He was clearly calling Tesla
a loser.

~~~
anigbrowl
That's certainly consistent with conservative tech skeptics. I think the
grandparent post offers a worthwhile alternative interpretation, but I think
the majority of people would go with yours.

That said, the majority of people probably found both candidates too wonkish
and abstract in this debate for many minds to be changed. As a policy guy, I
enjoyed it, and I thought Romney did well for himself although I prefer Obama.
But the candidates talked past each other to a large extent, and both were
pulling their punches a little.

------
gavanwoolery
Not to pick one side or the other, but Tesla was made possible by artificial
means, not market demand. The time will come when batteries are cheap and
powerful enough that you could buy an electric car for $10k, but that time is
not now and the government should not be an investor - historically it has
both a bad record of managing budgets and delivering innovation per the
dollar...And don't start with arguments about the internet - it was actually
Xerox that largely made the internet possible:
[http://online.wsj.com/article/SB1000087239639044446430457753...](http://online.wsj.com/article/SB10000872396390444464304577539063008406518.html)

 __Edit: overall, I have to concede, it is kind of dumb to attribute the
internet to a single entity or person - it was a pretty natural progression of
technology - basically the digital evolution of phone lines. Could you imagine
trying to patent the internet?

If the government really wants to help out with energy, it should loosen
environmental restrictions. I am as much a supporter of green tech and
protecting the environment as the next guy, but there is something like 1000x
the volume of natural gas under our soil as all the oil in the world combined.
The sheer amount of wealth generated from tapping that resource could fund all
kinds of green tech, and lessening foreign dependence creates jobs here and
makes us stronger politically.

~~~
rayiner
> If the government really wants to help out with energy, it should loosen
> environmental restrictions. I am as much a supporter of green tech and
> protecting the environment...

It's not about protecting the environment in the abstract. It's about who
bears the costs of industrial activity. Loosening environmental reactions
doesn't reduce costs, it shifts costs from polluters to the general public,
particularly to the poorest people.

Polluting the air you breathe is no different than any other injury--if the
government has any function it is to protect your bodily integrity. It is a
failure of organized society when a company can profit by physically hurting
you, and it's economically inefficient to allow polluting industries to shift
the inherent costs of their activity onto other people. It causes companies to
pick the technologies that have the most costs that can be passed to other
people, not the technologies that are the most absolutely efficient.

The oil, coal, etc, industries were made possible by the intervention of
government. Did you know that in the 1600s in American law pollution was
basically illegal? E.g. if water ran through your property, it had to leave as
clean as it went in. Allowing people to pollute during the industrial
revolution was actually a tremendous government subsidy of industry.

~~~
gavanwoolery
It is actually not the government's job to decide this - it is the voters.
People vote with their mouths and dollars, and right now everyone just does
not care enough to boycott coal power or stop driving SUVs. I'd like solar
panels to become cheaper and electric vehicles to become more common, but the
government cannot realistically control free markets like energy generation.

That said our perception of air pollution may be a bit exaggerated.
Atmospheric aeroforming is a very difficult task -- even if we tried actively
for 500 years, I think we might have difficulty changing the composition of
the earth's atmosphere significantly. Before air pollution is even a _real_
threat, our technology will have probably progressed far enough naturally
(i.e. sans government investment) to handle any problems. Keep in mind there
are over 5,000,000,000,000,000,000 (5 Dectillion!) kilograms of atmosphere.
Humans produce 2,500,000,000,000 kilograms of CO2 year roughly (2.5 trillion).
_However_ , each tree (on average consumes 33 kilos of CO2, and (by NASA
estimate) there are roughly 400,000,000,000 trees on earth -- thus trees could
consume up to 13,200,000,000,000 (13.2 trillion kilos of CO2), and CO2 is
heavier than air so probably a fair amount of it reaches the ground. Even if
only 1/5 of the trees processed CO2, we would still be not generating any
significant amount of it. Anthropogenic global warming is mostly alarmist
theory until we prove humans have a significant effect on the atmosphere (as
one scientist pointed out, the earth has warmed and cooled dramatically before
human existence, and it will continue to during it, despite our actions).

~~~
rayiner
It is the governments job to protect you from other people physically injuring
you. That's the whole point--you don't get a choice. I can protect my daughter
from inhaling particulate matter from coal energy just by not using coal
power. It's literally the economic definition of negative externality--where
the costs of activity are borne by people not parties to any transaction.

Also your analysis of air pollution is shockingly bad and you should feel bad.
What on earth makes you think pollution mixes perfectly with the whole
atmosphere before anyone breathes it in? It's like saying 2+2=cat.

~~~
gavanwoolery
I do feel bad ;) - yes, I am aware that the thermodynamics of our atmosphere
are extremely complex, so complex that we can barely model them. This is
exactly why I advocate people to be wary of when any scientist claims "x is
going to happen in y years" -- we simply do not know how our atmosphere will
behave, no more than we know what the exact weather will be like in two
months. Right now, everything is basically a theory - we know that CO2 warms
the atmosphere, but we do not know how much CO2 will be in the atmosphere in 2
years (we do not even presently have an exact amount).

~~~
rayiner
We don't need to know exactly how much CO2 will warm the atmosphere. We have a
probability distribution. We can't quantify the economic damage of climate
change precisely, but we know enough to know it won't be $0, which is what the
"wait and see" point of view prices the cost as.

Also, climate change isn't even the big issue here. I'm talking about much
more mundane and also much more damaging air and water pollution from
factories, cars, etc. We have very solid empirical evidence about that. Did
you know that after the EPA's ban on leaded gasoline, blood lead levels in
children dropped by a factor of 3-5x in just one decade? See:
<http://www.epa.gov/ace/body_burdens/b1-graph.html>. This corresponds to a
multiple IQ-point impact from lead. What's the dollar value of a multiple IQ-
point impact on the nation's children (and future workforce)? It's a huge
number.

Did you know that a recent Harvard Medical School study concluded that the
true price of coal power factoring in the externalized environmental costs is
2-3x as much as the market price?
[http://www.boston.com/lifestyle/green/greenblog/2011/02/new_...](http://www.boston.com/lifestyle/green/greenblog/2011/02/new_harvard_study_looks_at_ful.html).
The same study found the total externalized costs of coal power to be
$200-$500 billion/year:
[http://onlinelibrary.wiley.com/doi/10.1111/j.1749-6632.2010....](http://onlinelibrary.wiley.com/doi/10.1111/j.1749-6632.2010.05890.x/full).
Here in Chicago we recently shut down two coal-fired power plants that were
causing $100 million in health damage per year and only creating 50-60 jobs
each.

The total cost of environmental damage being down every year, in terms of
quantifiable impact to people is probably into the trillion dollar per year
range. People tend to think of environmentalism as being about "soft values"
but that couldn't be further from the truth. Even if we assign zero value to
the environment itself, we can't avoid putting a dollar figure on the value of
the services the environment provides us. When New York manages to avoid
building a $6-$8 billion filtration facility by properly managing the
Catskills watershed, we can't avoid the inescapable economic conclusion that
damage to the Catskills and similar watersheds needs to be valued in the
billions of dollars range. We can't avoid the conclusion that when a company
dumps waste into those watersheds, it's an economic injury no different than
if tore up city streets or caused a bridge to collapse.

It's the government's job to protect us from all this, the same as it's the
government's job to protect us from people who steal your car or break into
our houses. It goes to the heart of why government exists.

------
rayiner
The larger "government shouldn't pick winners and losers" meme is idiotic in
the context of alternative energy and green tech. It's basic economics that
the market fails to pick efficient winners and losers in industries that
involve large negative externalities.

~~~
othermaciej
Most economists do not accept that direct government subsidy to businesses
leads to an economically efficient outcome, even in cases of negative
externalities. Many economists would say that Pigovian taxes or creation of
markets in the externality are likely to be more efficient. Bottom line:
market failure does not mean that government solutions are automatically
better. Government failure exists too!

~~~
rayiner
I think in the political discourse, pigovian taxes would be considered
"government picking winners and losers" (specifically losers).

Also, the question isn't whether direct subsidies are more efficient than
taxing externalities. The question is whether direct subsidies are more
efficient than doing nothing (which is the only politically feasible
alternative).

~~~
othermaciej
1) I read a lot of economics blogs and I see many economists who are against
"government picking winners and losers" in the form of subsidies; but favor,
e.g. revenue-neutral carbon taxes. There are strong economic reasons why the
two are not at all the same.

2) Direct government subsidies for favored corporations is likely less
economically efficient than doing nothing in cases. Subsidy decisions are not
guided at all by the info encoded in the price system, and are instead likely
to be based on rent-seeking by favored interests groups. See
<[http://en.wikipedia.org/wiki/Economic_calculation_problem...](http://en.wikipedia.org/wiki/Economic_calculation_problem>);

Your original comment cited "basic economics" and implied that the government
would be better than the market at "picking winners and losers" in the face of
negative externalities. But that is not a consensus view among economists.

~~~
rayiner
> Direct government subsidies for favored corporations is likely less
> economically efficient than doing nothing in cases.

In cases, yes. Given the sheer magnitude of thee externalities in
environmental situations, not likely. We're talking trillions of dollars of
implicit subsidies here.

~~~
othermaciej
I believe you are committing the "Yes Minister" fallacy:

"Politician's logic: We must do something. This is something. Therefore we
must do it."

Direct government subsidies create deadweight loss, and by hurting the
competitive position of companies and technologies that don't get the subsidy,
they can actually make the negative externality worse. You can't justify a bad
intervention just by pointing to the magnitude of the externality.

------
beatgammit
Meh. Tesla is still in debt (and had to renegotiate their loan at that), so
Romney's technically correct about that. The major benefit I see from the
Tesla project is it puts pressure on other companies to make better electric
cars.

I really hope they go mainstream, but it seems they're not targeting the
average Joe. If it's going to be an "energy" project, it needs to go
mainstream, like the Nissan Leaf or the Chevy Volt. I just don't see why the
government should be sponsoring a company that will probably only ever sell to
upper and upper-middle class customers.

Don't get me wrong, I love the Tesla company, but I think there were more
interesting points of the debate than this. To be fair, Romney didn't single
out Tesla; it was lumped in with other projects that haven't proven successful
yet.

~~~
tantalor
> Tesla is still in debt

Yes, they have debts, about $505M.[1] They also have $700M in assets.[2]
Calling them a "loser" implies bankruptcy or insolvency.

[1] <http://www.crunchbase.com/company/tesla-motors>

[2] <http://en.wikipedia.org/wiki/Tesla_Motors>

------
dr_
Interesting. Musks' political contributions are widespread, not to one single
party, but apparently none for Romney, allowing him to make such a comment:

[http://www.opensecrets.org/usearch/index.php?q=elon+musk&...](http://www.opensecrets.org/usearch/index.php?q=elon+musk&searchButt_clean.x=0&searchButt_clean.y=0&searchButt_clean=Submit&cx=010677907462955562473%3Anlldkv0jvam&cof=FORID%3A11)

------
tsahyt
Politics aside, Tesla is not the future either. At least not with their
current models or anything derivable. Sure, they're doing a great job building
battery powered electric cars but personally I don't see how they can work for
everyone in the same way that fossil fuel powered cars do today.

I'm driving a diesel (being european this isn't too odd) and I'm driving a lot
of long distances. The beauty about the fossil fuel powered car is, that I can
drive some 800km on a tank, stop for fuel which takes me about 5 minutes and
then carry on. Tesla claims a 3-3.5h charge time. Even if the range was the
same, which it isn't, this just isn't gonna work for anyone who drives across
a country rather than through cities. To this day I haven't heard of any
battery powered car that is charging in acceptable time compared to filling up
a fuel tank.

Don't get me wrong, in a way I like electric motors. The torque they produce
is amazing! What bothers me is the use of batteries. The technology I
personally saw most potential in was the use of hydrogen fuel cells. The tank
is filled with hydrogen, the fuel cell powers the electric motor. I'm not for
a second suggesting hydrogen is a good "fuel" in the sense that we can just
dig it up somewhere and get additional energy. What hydrogen is good at
though, is storing energy and because filling a tank with it happens in a
matter of minutes it's a whole lot better than carrying thousands of laptop
batteries in your car.

~~~
wutbrodo
I'd wager that most automobile use day-to-day doesn't come close to 800km
stretches. Would it not be interesting enough if electric cars managed to
replace all the fossil-fueled, city-driving cars? Even with that point aside,
I don't think one can write off Tesla based on a snapshot of charging
infrastructure at this instant. There are already concepts like Better Place
that involve swapping out batteries instead of waiting to charge the one in
your vehicle. A little less ambitiously, DC Fast charging stations (already
installed in places like Los Angeles, Wash. state and Oregon) charge EVs up to
roughly 80% of capacity in around 30 minutes. My point isn't that the system
is perfect, or that these concepts completely solve the range issue with EVs.
Comparing charging options now to even one or two years ago shows a
substantial difference in potential (heh), so it seems a little myopic to say
"I can't do this right now perfectly so it will never happen".

~~~
tsahyt
Good point on the city cars and yes you're right, predicting the future has
never gone well and I can't predict how the infrastructure is going to look
like in a decade or so. However, the hydrogen fuel cell technology is here
_now_ and it works well yet there's very little hype around it. Hybrids and
EVs on the other hand are hyped to hell and back while (for the time being)
they are just not good enough. Hybrids, yes, obviously. But they don't solve
the problem. Additionally those batteries weigh quite a bit. Unnecessary
weight == wasted energy.

~~~
wutbrodo
Thanks for the insight; I had heard about hydrogen fuel cells as far back as
2002, but only in a very theoretical sense (plus I was in middle school back
then...). They definitely do look promising; my guess regarding why there
hasn't been much hype around them is that (per Wikipedia) they've been
prohibitively expensive until rather recently (in 2002, hydrogen fuel cell
cars were estimated to cost $1mn, $300k in 2009, etc)[1]. That being said, it
does like it's approaching cost-effectiveness in the near future.

[1] <http://en.wikipedia.org/wiki/Hydrogen_vehicle#Fuel_cell_cost>

------
sudonim
Headlines like this always remind me of the term wikipedia taught me:
"Disambiguation". A simple Mitt Romney Calls Tesla Motors a 'Loser' would have
clarified in the headline whether the author meant Tesla (the person), or
Tesla (the car company). Leaving it vague probably gets more clicks.

~~~
wmf
Why would Romney have anything at all to say about Nikola Tesla?

~~~
SquareWheel
I have no idea but it was my first assumption. But then I also assumed it was
taken out of context.

------
michaelfeathers
Thank goodness he wasn't talking about Nikola. I was about to have a fit.

------
gaius
Flagged; flamebait.

------
nicolaus
When the government set up and fostered the development of the Internet, was
it picking winners and losers then, too?

~~~
anamax
> When the government set up and fostered the development of the Internet, was
> it picking winners and losers then, too?

The total expenditures then were a small fraction of what we're spending now.

Do you really think that the ROI today is as high as it was then?

Do you really think "govt spent money well once" implies "govt money spent now
is well spent"? (It's also false that "govt money was spent badly in the past"
implies "govt money spent now is badly spent".)

------
zeruch
The constant dissonance between "don't you dare touch all the subsidies we
give the petro" industries and the "dont you dare waste money on any
alternatives" is just dumbfounding. I mean, the stuff is orthogonal to
politics (or at least it should be).

------
grkovalev
i think, all this interest around for Tesla, grants and Obama associated with
election president program. I like Teslo but it is too early say about loosers
or winners Teslo.

------
temp1111
Is GM also a loser?

~~~
protomyth
From an American taxpayer point of view, yes they are. We aren't going to get
our money back anytime soon if at all.

~~~
gfodor
GM has paid back its loans and for the taxpayer to break even on the stock the
government owns (~30%) it currently needs to about double.

[http://www.forbes.com/sites/joannmuller/2012/08/29/automaker...](http://www.forbes.com/sites/joannmuller/2012/08/29/automakers-
report-card-who-still-owes-taxpayers-money-the-answer-might-surprise-you/2/)

~~~
anamax
You're "forgetting" the $15-20B in tax carry-forwards that are typically lost
in bankruptcy. And, by stiffing some public pension plans who owned GM bonds,
that bankruptcy increased the taxes that those jurisdictions will have to pay.
(That money went to the ordinarily unsecured pensions, Fiat, and a couple of
other places.)

GM and Chrysler's assets would have been bought and put to use.

~~~
gfodor
If you really think liquidating GM and Chrysler's assets would have resulted
in anything other than a net destruction of wealth for the U.S. I don't know
what to tell you. What good is a car factory if the entire supply chain has
broken down?

You can argue that the loans should not have been made on principle, and you
can argue that they were a poor investment vis a vis net return to taxpayer
dollars, but it's very hard to argue that they were a net loss on U.S. GDP
unless you assume a "controlled bankrupcy" for GM and Chrysler would not have
destroyed the U.S. (or global) auto industry. That's a big leap.

~~~
anamax
> If you really think liquidating GM and Chrysler's assets would have resulted
> in anything other than a net destruction of wealth for the U.S. I don't know
> what to tell you. What good is a car factory if the entire supply chain has
> broken down?

Why do you assume that the supply chain would have broken down?

> it's very hard to argue that they were a net loss on U.S. GDP unless you
> assume a "controlled bankrupcy" for GM and Chrysler would not have destroyed
> the U.S. (or global) auto industry. That's a big leap.

It's easy to assume that standard bankruptcy would not have destroyed the US
auto industry because there's no reason why it would have destroyed the US
auto industry.

Bankruptcy is basically about separating assets from liabilities.

If GM's assets are well-suited to profitably making cars, that's what they'd
have been used for post-bankruptcy. Why do you assume otherwise?

US airlines go bankrupt every so often. Their creditors take a loss but the
effect on the rest of us is that a few flights get cancelled and that's about
it.

~~~
gfodor
Comparing GM, Ford, and Chrysler all going bankrupt simultaneously in the
middle of credit crisis is not comparable to when individual airlines go
bankrupt due to poor management. The auto industry is highly concentrated in a
single geographic area and are all economically dependent upon one another due
to shared suppliers. It's very likely that if GM or Chrysler went bankrupt
Ford would too. Who would be left then to use these assets? Some unnamed US
automotive company? A Japanese automotive company? (imagine how that would go
over.) Just how long do you think it would have taken for Detroit to get back
to work? A month? 6 months? A year? A decade? Don't forget that if Detroit
went bankrupt and turned into a dust bowl, aside from the untold amounts of
human suffering it would drag down GDP and have wide-ranging effects on the
rest of the country.

~~~
anamax
> Comparing GM, Ford, and Chrysler all going bankrupt simultaneously

GM was the only problem because Ford wasn't in trouble and Chrysler was (and
still is) negligible.

> auto industry is highly concentrated in a single geographic area

Most "US made cars" are not made in Michigan.... "In 2011 , the Detroit Region
produced 1.56 million vehicles, accounting for nearly 82% of Michigan's motor
vehicle production, over 18% of the United State's motor vehicle production,
and nearly 12% of North America's motor vehicle production. Currently more
than 151,000 metro Detroiters work in the automotive and auto-related
industries."
[http://www.detroitchamber.com/component/content/article/14-a...](http://www.detroitchamber.com/component/content/article/14-about-
detroit/924-auto-industry)

US auto suppliers sell to all companies that make cars in the US.

> Who would be left then to use these assets? Some unnamed US automotive
> company?

Not necessarily - there are folks who could have afforded the assets. (Penske
is a minor player and they made a serious bid for Saturn.)

Note that GM was selling cars for more money than it cost to make them - the
problem was the legacy liabilities, liabilities which they'd have shed in
ordinary bankruptcy.

The "bailout" money was a political payoff. It mainly went to keep the UAW
pensions solvent and GM shut down Saturn as a sweetener. (The UAW always hated
Saturn, even after organizing it.)

------
benologist
Wired Panders To Reddit, HN, Etc

Fixed the title.


Carrier Hotels Are Sexy Again - 1SockChuck
https://datacenterfrontier.com/netrality-carrier-hotels/
======
aaronem
For those like me who'd never heard the term "carrier hotel", it's what is (in
the US perhaps much more commonly) also known as a colocation center.

~~~
chinathrow
More peering sites/IXes than colo in this case.

~~~
pyvpx
though in reality, today the difference is almost academic. One Wilshire is
known as _the_ carrier hotel in Los Angeles, if not all of the US. The 4th
floor meet-me room was widely known as the most expensive real estate on the
west coast, at one time.

While many large, international networks still setup inside One Wilshire at a
premium, if I just need cross connects, I can get them for exactly the same
price inside Wilshire Annex -- a more "colocation for server farms" oriented
building that is slightly cheaper and much larger (for individual spaces, not
in total conditioned square footage, iirc).

Why do large international carriers pay the premium for being in the "carrier
hotel" One Wilshire? Because they don't want to rely on CoreSite (the
buildings and associated interconnection infrastructure management company)
infrastructure. They want "home runs" to the other large international
carriers they interconnect with and sell to.

If you aren't ATT or AWS, there is little need to be inside One Wilshire --
except perhaps for the "prestige" factor.

~~~
skuhn
I think this is true in a lot of markets. 11 Great Oaks is the place to be in
Silicon Valley (with PAIX and MPT as distant second and third), but it's an
old, shitty building and you can't get any kind of reasonable power density.
Enter 9 Great Oaks, on the other side of the parking lot, which is a modern
building that has cross connects at the same price back to 11 Great Oaks.

I think there's a lot of money to be made in having modern buildings that are
situated close by the dominant carrier hotels. The crazy money is still made
from cross connects, but you can also charge a premium on space because it
still makes more sense than running a ton of fiber to the middle of nowhere.

------
bitwize
Hey, only one place for the FBI and NSA to strongarm into giving them
unfettered access, and then they can sniff many networks at once!

~~~
tjohns
Given that these are used for peering between different independent networks
-- pretty much the definition of the "public internet" \-- there shouldn't
really be much expectation of privacy. At least not if you're smart about it.

(Network taps aside, at that level traffic can often get redirected through
hostile networks via BGP spoofing.)

Hopefully any important information going through them is already encrypted.


Berry Blocks - your rack in your colors (Kickstarter) - smewpy
http://www.kickstarter.com/projects/asianops/berry-blocks-a-wine-and-glass-rack-that-fits-your/

======
smewpy
Hi HN, thanks for taking time to look at my project!


The Lynx Queue - jsnell
http://www-dyn.cl.cam.ac.uk/~tmj32/wordpress/the-lynx-queue/
======
pkhuong
Why do the authors report performance at O0 and O1?

AFAICT, the experiments are all single socket. There's an important difference
in coherency overhead for single VS multiple sockets; same for futzing with
page protection. It also looks like they only tested a single
producer/consumer pair. I expect page protection tricks don't scale as nicely
when you have 20+ pairs on two sockets: contention on the page table _and_ IPI
storms. The mprotect trick also seems to depend on using small (4K) pages,
unless you're OK with fairly stale data; probably not ideal for overall app
performance.

Also while they indirectly mention the batching trick of the disruptor (keep a
reader-local copy of the write index and vice versa), it's not tested… and
also not tested with a forced lag between the reader and the writer. If you
want to avoid the ping pong, you can let the reader keep a copy of the
writer's write pointer (and update the copy when the reader catches up), and
artificially make the reader lag behind the writer. That lag gives much
simpler code on the hotpath than the MCQueue they mention, which would be the
closest equivalent to a laggy disruptor (keeping in mind that the disruptor
pattern tends to be used in low latency settings, so that configuration is
unlikely to be benchmarked, except indirectly, with cacheline-sized queue
items).

It's interesting work, but as is too often the case, the benchmarks give me no
actionable information.

~~~
Jweb_Guru
I think the single socket assumption is justified because they are talking
about pairing each executing core with a checker core partner, right? So I
don't think the paper is misleading for that use case.

(I do agree that they aren't really fairly representing prior work in this
area, though, and that nobody optimizing for high performance on commodity
hardware is likely to be using 4kb pages).

------
eloff
It's an interesting technique that I haven't seen before in the context of a
queue.

It's not without drawbacks, relying on handling sigsegv is a pain to make
portable (libsigsegv helps!) HotSpot handles sigsegv, but I think it's
possible to install your own handler as well by setting it before loading the
JVM. When the JVM loads it will chain pre-existing signal handlers behind its
own, and they'll be invoked if the signal doesn't pertain to HotSpot.
LD_PRELOAD can be used to accomplish that. My information may only apply to an
older version of HotSpot though, I don't know if that's still the case.

The other thing is relying on the TLB here becomes trickier with huge pages.
It seems to me that the section and queue boundary trap pages are set just
once at queue init and then never changed - so one could do the same with 2mb
huge pages, without wasting memory, if the sections are sufficiently large.
The problem is that requires the producer and consumer to be at least 2mb of
queue apart, which is probably too much delay for many applications where
latency is important. But I really don't see the need for huge pages here. A
queue where both producer and consumer are repeatedly touching the same page
seems like the ideal use case for the TLB anyway.

Not all applications can tolerate a sectioned queue though, for example what
happens when the producer writes less than a full section of items to the
queue and then pauses for a long time? The consumer won't be able to access
that data until the producer finishes the section.

~~~
stcredzero
_relying on handling sigsegv is a pain to make portable_

Is there any effect due to virtualization?

------
gpvos
Google cache:
[http://webcache.googleusercontent.com/search?q=cache:ekFSEe6...](http://webcache.googleusercontent.com/search?q=cache:ekFSEe6ogcAJ:www-
dyn.cl.cam.ac.uk/~tmj32/wordpress/the-lynx-queue/+&cd=1&hl=nl&ct=clnk&gl=nl)

~~~
runeks
Remember to use the text-only version, or it will hang fetching other
resources:
[http://webcache.googleusercontent.com/search?q=cache:ekFSEe6...](http://webcache.googleusercontent.com/search?q=cache:ekFSEe6ogcAJ:www-
dyn.cl.cam.ac.uk/~tmj32/wordpress/the-lynx-
queue/&num=1&hl=nl&gl=nl&prmd=ivn&strip=1&vwsrc=0)

~~~
gpvos
Ah, sorry. My content blocker does that for me.

------
webaholic
The article is quite simplified I presume to make the reader understand the
technique. There are many more details in the paper. I like that the simpler
version is available, kind of like the simple version of an article in
wikipedia to quickly skim through before diving deep.


Ask HN: Are Facebook keeping data on deleted accounts? - jimnotgym
I deleted my Facebook account some time ago,  maybe 2 years. I did it with the service where you ask them to delete everything.  Recently I had a need to use Facebook again. From a new computer I attempted to register an account, to find I got an immediate ban! I really did need to join this group, so I used my work computer to create an account from a work email. It worked ok, so I added it to my phone app,  and I got an immediate ban. I certainly never had this phone when I was on Facebook before. I was on 4g at the time,  so it was nothing to do with IP addresses. I don't understand how this is possible unless Facebook withheld data about me after deletion. I also don't understand why they banned me, do they ban people who leave and rejoin? Has anyone else had this. I also note that 'due to Coronavirus' you can't appeal. This raises the issue of how Facebook can become a service that society relies on whilst arbitrarily denying access to certain users with no right of appeal?
======
poormystic
There's nothing wrong with your thinking... you've just discovered the real
world. Facebook can not be trusted and it will someday amaze you that you ever
thought otherwise. For me, first principles guarantee predatory behaviour in
most relationships... there are few who are motivated by anything other than
self-interest. If you want to find someone you can trust, look within
yourself.


Why Healthcare.gov was sunk by "Iceberg-style" delivery - rjmarvin
http://www.sdtimes.com/content/article.aspx?ArticleID=66402&page=2

======
sqqqrly
One of the less useful links on HN.


The 5 causes of failure as an entrepreneur - lewisa
https://www.swabbl.com/en/business-news/the-5-causes-of-failure-as-an-entrepreneur/
======
chrislyon
great and real, thanks :)


Ask HN: How to go from Idea to Product? - funwie
Starting from zero, how do you initiate projects to turn ideas into products or even prototypes?
From a thought about building something to design it, implementation, release, and maintenance without losing focus.
What do you think is the driving force that keeps you going
What advise will you give to people who just write down ideas, those who lack execution?
======
deepthought42
The best way to initiate a project and turn it from an idea into a prototype
is to start. It's literally that simple. Building a product is hard, but the
only way it's going to happen is if you start. Other than that, the steps are
the same as starting anything else. Determine what you think is a good first
step to take, then do it. Then pick the next step and do it. Keep doing that
until the product exists.


EA: Fired and lost Overtime pay compensation - kelvin0
http://translate.google.ca/translate?sl=fr&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&eotf=1&u=http%3A%2F%2Ftechno.lapresse.ca%2Fjeux-video%2F201302%2F27%2F01-4625810-jeu-video-les-heures-sup-sans-limite.php&act=url

======
kelvin0
The original article is in french, I submitted a link that translates to
english (google translate).


Hackers went undetected in Citrix’s internal network for six months - marcc
https://techcrunch.com/2019/04/30/citrix-internal-network-breach/
======
benmarks
> Citrix said in a later update on April 4 that the attack was likely a result
> of password spraying, which attackers use to breach accounts by brute-
> forcing from a list of commonly used passwords that aren’t protected with
> two-factor authentication.

How did Citrix not have 2FA in place?

~~~
SCHiM
Haven't read the article, don't know anything about their network. Assuming
they use a Windows domain for their corp infrastructure.

Lower level Windows authentication mechanisms can't be configured for 2FA. If
your active directory domain is functional at all then at the very least your
systems need to be able to talk via SMB and ldap to a domain controller. With
sufficient privileges you're able to execute code on other machines via either
protocol.

You only need an infected machine, not even user credentials, to be able to
perform password spraying or kerberoasting attacks.

~~~
sbr464
Not sure what you meant by lower level mechanisms, but you can protect console
logins and RDP with 2FA: [https://duo.com/docs/rdp](https://duo.com/docs/rdp)

[https://help.duo.com/s/article/1084?language=en_US](https://help.duo.com/s/article/1084?language=en_US)

~~~
w8rbt
net commands, kerberos tickets, etc. You can really only 2FA web interfaces,
VPNs, RDP and interactive console logons. You can 2FA LDAP, but it's a real
pain to do so (I've seen it done).

Just think of any backend protocol that the system uses. The vast majority of
those can't be 2FA'ed. This is not Windows specific either. The same is true
for most all protocols.

This is why most companies buy firewalls and VPNs and only 2FA the VPN. That
meets most compliance requirements and is simple to do. Is it secure? Probably
not, but it checks the box (makes audit happy), so buy compromise insurance
and move on.

~~~
ynniv
You can firewall the backend services and use 2fa to temporarily open them for
a specific workstation.

------
todd3834
I fully assume there are more hacks we don’t hear about that ones we do. Not
only because of cover ups but it can’t be that hard to cover your tracks if
you know what you are doing.

~~~
pandapower2
Its an interesting question. If someone unauthorized was on your network
exfiltrating data how would you know?

~~~
cmroanirgo
Even more interesting is how the FBI knew they'd been infiltrated before they
themselves did? (There's the obvious conspiracy style accusation in that they
were already in there poking around... but that doesn't seem to ring true in
this regard)

~~~
auiya
Same way any criminal investigator uncovers stolen goods.

------
m3nu
Security is hard. On the upside, every breach is a chance to learn for
everyone else. I hope they release more details on how it happened.

Is there any blog or news that summarizes such post-mortem lessons? Could be a
nice project to collect that.

~~~
h2odragon
There's always
[https://catless.ncl.ac.uk/Risks/](https://catless.ncl.ac.uk/Risks/)

~~~
m3nu
Subscribed. Also found [https://securereading.com/category/news/latest-
hacks/](https://securereading.com/category/news/latest-hacks/)

------
robbiet480
Has anyone gotten that kind of call from the FBI and can shed light on how the
process works? Would be fascinating for a outsider and provide a guide on what
next steps look like for those poor souls that receive the call in the future.

~~~
4s2A1tD5
I've been on this call (both sides of it) probably a dozen times by now. Gov
agencies are decent at doing research so it's pretty unlikely that the FBI
just called their 1800 number or whatever.

Most small start ups don't get to the level where anyone that "big" is looking
at them but in the event that something does get flagged the agency will go
find their CEO/CTO/counsel on LinkedIn and either message them there or email
them. I've never seen an actual vulnerability disclosed in email, if it's a
potential legal issue (hello SEC and fintech) they may ask that your lawyer
responds to them in writing but more often it's just "this is Agent XYZ with
ABC. I have information about your company, please call me immediately."

For someone bigger (like Citrix) the company is _hopefully_ big enough to have
a team that is connected to the agencies in someway. Either the agency knows
someone who knows them, or they have a designated Security and Compliance team
that can handle these inquires.

The real problems come when you're in the middle of sizes - too big to have
eyes on every email but too small to have a real security team.

About 5 years I was working for a SaaS company and one of our clients
accidentally discovered a pretty serious hole in another company's product.
This client wasn't overly tech savy and was basically like "hey is this how
this is supposed to work?" when it very much was not... so we killed the API
connection and told the client we'd take care of it. It's about 7pm ET by the
time we figure out what's going on so we call and email the other company but
couldn't find anyone. In the end we got the home phone number of their CTO and
had our CTO call him at around 10pm. He thought it was a prank call but once
our CTO convinced him this was a problem he was able to get their on call eng
to patch it within hours.

Nowadays almost any company involved in security work either has a direct line
to FBI/DHS or has a vendor who does. ie if I'm some medium consumer platform I
probably don't get to talk to the FBI directly, but if I called up Crowdstrike
or any security consulting firm they could do that. In the event that my
medium consumer platform was infiltrated by Fancy Bear (and the government
decided to tell me, sometimes they don't) an FBI agent would email/call the
most likely point of contact for the fastest resolution without causing panic.
Lots of time the damage is already done, two vs four hours on a response won't
make a big difference in the long term so no need to email info@ or anything.

Over the past 6-8 years the corporation on public/private cyber investigations
has definitely changed as red tape has decreased in sharing of info has
increased - even more the last 4ish years since the DNC email hacks. I've had
a clients get a casual "just a heads up, you should check this out" from the
government without no paperwork and no follow up, something that would have
been virtually unheard of 8 years ago.

DHS gets a lot of shit in the media (lots of which is deserved) but they've
done a pretty good job just opening basic lines of communication and training
other agencies that spending 20 minutes looking at a random tip, and following
up if needed, is actually a pretty good use of time.

~~~
robbiet480
Thanks for going to the trouble of creating a new account just to reply,
appreciate it!

------
rmason
If you'd like a full perspective of the Citrix hack three security people from
Detroit discussed it on a recent episode of their show, How they got hacked:

[https://www.youtube.com/watch?v=fMgdrq0xMLk](https://www.youtube.com/watch?v=fMgdrq0xMLk)

~~~
IncRnd
Did you watch that? They mentioned that they don't know any more than is
publicly disclosed how the attack occurred and that they were speculating.
That was literally their first sentence about the attack.

------
axaxs
Having worked with Citrix, I'm shocked. Shocked that they detected it at
all...

~~~
da_chicken
I was going to say the same thing, but it sounds like it was the FBI that
noticed it:

 _> [T]he hackers had “intermittent access” to its internal network from
October 13, 2018 until March 8, 2019, two days after the FBI alerted the
company to the breach._

~~~
lawnchair_larry
This is extremely common. 6 months is not that long, even among competent
companies that have good security. You usually hear about it from the FBI. I
think the FBI forwards tips from agencies like the NSA, but they don’t tend to
give much information.

~~~
axaxs
It may be common, but I'll disagree it's common for companies with "good
security." Password spraying doesn't work with good 2FA, nor sane login
limits. I set off a flag anytime logging in from a new IP, for example.

~~~
dub
2FA and login limits alone aren't likely to stand in the way of state-
sponsored hackers.

Lots of companies still haven't upgraded to zero trust / BeyondCorp AuthN, and
lots of companies don't have reproducible signed build artifacts from CI/CD
with automatic policy enforcement regarding the properties that those build
artifacts must have before they can be deployed.

High-profile companies that think VPNs and networking rules are a security
solution have probably already been hacked and just don't know it yet.

------
empath75
If you have anything of value, I absolutely guarantee you that there are
hackers in your network right now.

One thing that frustrates me more than anything else is people assuming that
their corporate network is safe. Your firewall and your vpc or whatever is a
speed bump at best. You have to assume that you have an attacker on the desk
right next to you, because you will eventually.

~~~
viraptor
That's a really defeatist attitude. There are different levels of "value" and
different levels of protection. Not everything is internet facing. Not
everything is managed like a corp where turnover requires lots of access
changes. Not everything allows you persistence in the network. And not all
access is "access".

I really wish we moved past the "everybody's owned" idea. Your defence should
be proportional to the value you can lose. You can monitor for the rest. And
you can't guarantee the are hackers in my network. (Unless you're saying
you're guilty of breaking in? ;-) )

~~~
hibikir
I don’t think the grandparent says that everyone is owned, but that if your
data is interesting enough, your threat model must include employees that are
willingly exhilarating data, sometimes for nation states. That your first
barriers are therefore assumed to be breached to those attackers.

This of course does not apply if you are not holding on to anything
interesting, but it’s very easy to become interesting at a certain size, or if
you have interesting customers. Still, not everybody.

~~~
mandevil
Your threat exposure is not just your network. It's all of your customers and
all of your vendors as well.

Recall that the Target POS hack back in 2014 happened because someone hacked
the largest refrigeration contractor in western Pennsylvania, then bounced
from there onto the Target Partners Online portal with legitimate credentials,
and then from there in unspecified ways got onto the POS system. Obviously
going from TPO to POS is a failure of Target's network security, but their
network perimeter was much larger than just Target computers.

------
ngcc_hk
You need network sniffer and pattern recognition. Otherwise basically you hope
some of the unusual activities will affect ids/ips (or touch internet).
However if it is normal account you need some sort of intelligence to
recognise and alert.

Not many software can do this.

~~~
6wKZhFkquv
Throwaway, worked at Citrix. The unfortunate thing about this comment is that
they sell Citrix Cloud as having the intelligence to detect anomalies exactly
like this in your network.

~~~
zild3d
Ouch. This page [0] hurts a little bit to read now. Feel free to grab their
free ebook though! You'll learn how advanced analytics can help IT identify
user behaviors, determine risk profiles, and assess and address potential
threats

[0] [https://www.citrix.com/analytics/prevent-security-
breaches.h...](https://www.citrix.com/analytics/prevent-security-
breaches.html)

------
markholmes
This might not be the right place for this, but where should one get started
with security research?

~~~
rando444
I feel like an answer to this would depend largely on your age, background,
and what you are looking to learn.

------
qaq
average is 206 days

~~~
Godel_unicode
According to whom? That's significantly above what fireeye says (71 until
internally discovered):

[https://content.fireeye.com/m-trends](https://content.fireeye.com/m-trends)

~~~
qaq
According to Google search snippet I am totally ready to trust that FireEye
estimate is much more accurate

------
inapis
>Citrix said in a later update on April 4 that the attack was likely a result
of password spraying, which attackers use to breach accounts by brute-forcing
from a list of commonly used passwords that aren’t protected with two-factor
authentication.

Wow. This simply reinforces the fact that humans cannot, and should not, be
trusted with actively maintaining security of a system especially if there
could be significant economic consequences.

Would a password manager help in this? I don't know.

Probably a hardware token which controls all and any access to a system.

*Removed some ambiguous sentences.

~~~
Godel_unicode
I was with you up until the last paragraph, but no. That's not 2fa, that's
switching one factor for another.

People should use a password manager with an rng to generate and store
passwords. IT departments should run password spraying attacks themselves as
well as blacklisting known-compromised passwords. There's really good tooling
for this (likely the same tooling this adversary used!)

Separately from this, people should use hardware 2fa tokens whose weakest link
isn't the cell phone company support.

Edited for clarity.

~~~
u801e
> People should use a password manager with an rng to generate and store
> passwords.

[...]

> Separately from this, people should use hardware 2fa tokens whose weakest
> link isn't the cell phone company support.

What would be better is to support certificate based authentication in
combination with a username and password. Then you have 2FA without having to
share the private key. You can even get 3FA if the private key requires a
passphrase to decrypt it.

Using SMS or email based 2FA is not secure (or is only as secure as the email
or cell phone account as you already pointed out). Using TOTP requires sharing
a secret between the device and the server.

~~~
IncRnd
A passphrase doesn't make it 3FA, since that is an already used factor class,
what you know. 3FA is one from each category of what you know, what you have,
and what you are. Depending on the implementation, what you describe may only
be 1.5 factor auth.

~~~
u801e
I believe we can agree that just using a username/password for authentication
is 1FA (single factor authentication). If we add a one-time token sent via SMS
or email, or generated via TOTP, that's generally considered 2FA (with the
username/password considered what you know and the one time token being what
you have, I believe).

What I proposed was using a client-side TLS certificate in combination with
the username/password for authentication. If the private key corresponding to
that certificate requires a passphrase to decrypt, then it should be more than
2FA. What you know is the username/password, what you have is the private key.
Whether the passphrase for that private key is considered what you know vs
what you are is debatable (since, unlike the username/password or one-time
token, the secret isn't shared by transmitting it over the network).

~~~
IncRnd
Many security people will discount everything that someone says once they see
that person misapply marketing-phrases to describe security technology.

2FA does not become 3FA when adding a new passphrase to a system that already
had a knowledge based entry.

A password for a private key is _never_ considered what you are. You are
severely misusing security terms and will mislead people to believe that a
proposed solution has greater strength than it really possesses.

~~~
u801e
> [You] will mislead people to believe that a proposed solution has greater
> strength than it really possesses.

Then explain how authentication via a username and password validated server
side, a client-side TLS certificate validated during the negotiation of a TLS
connection between the client and server, and a passphrase validated locally
on the client's device is not a better solution compared to typical 2FA
implementations using email, SMS, or TOTP.

~~~
Godel_unicode
Key-logger on the box your soft cert is on. Soft cert is comprised
immediately, fully, and permanently. And you might never know. With email/sms,
at least it's possible for you to realize they're compromised, and with TOTP
the underlying keymat is likely not on the device so the attacker has to
repeatedly win the race.

More importantly, this is also a false dichotomy, as the correct answer here
is hardware protection of the private key, e.g. yubikey.

~~~
u801e
> Key-logger on the box your soft cert is on. Soft cert is comprised
> immediately, fully, and permanently.

That essentially means the entire machine is compromised and logging into any
service would allow the adversary to access them. That would compromise the
email and SMS routes. If they have root access to my phone (or whatever I use
to store the TOTP secret), that would allow them to generate the correct one
time token to log into any service that I use TOTP 2FA with.

> With email/sms, at least it's possible for you to realize they're
> compromised

That's assuming I check carefully and often enough. If someone brute-forces my
password over IMAP, then they could read my messages without me ever knowing.
But I could always check the process list on my computer to determine if a
keylogger is installed.

> and with TOTP the underlying keymat is likely not on the device so the
> attacker has to repeatedly win the race.

It depends on the application. If someone got access to my phone, they could
easily get the TOTP secret out of my GAuth app.

> the correct answer here is hardware protection of the private key, e.g.
> yubikey.

Except that it's not universally supported. It's not going to work with my
email client nor will it work with my IRC client.