News for hackers. Stuff that matters.

ThrowAway123543

Re:Intelligent Tracking Prevention on Thursday June 08, 2017 @03:55PM (#14516732)
...which can be stymied by using first-party cookies for lead attribution, which is exactly what webkit is recommending that sites switch to. Voila!
Have you done many interviews? The solution to "people lie sometimes" is not to rely on correlation-to-a-correlation Ouija board bullshit, it's to delve and ask for more detail until you're satisfied the person isn't bullshitting. I want to know if candidates are smart and hard-working; I don't ask them "Are you smart and hard-working", and I don't ask them what their spouse does for a living based on some cockamamie theory about how that relates to anything. I ask them to describe a project they worked on and their role in it and how it went, and I keep asking supporting questions and follow-ups until I'm pretty sure I know whether I want to hire them or not.

Candidates need to do the same thing: delve, ask for details, and keep going until they're satisfied that they know whether this is a job they want. I think those questions I posted are a good way to do that. If OP asks those questions, and then asks follow-ups, until she's pretty well convinced that this is/isn't someone she wants to work for, my suspicion is she'll very likely be right.

This seems like terrible advice to me. "Men with daughters are less sexist" and "Men whose wives work are more sympathetic to working mothers" are extremely vague, only loosely correlated to what you want to know, and pure anecdata. Someone could make up an equally plausible counter-argument (say, "men with young daughters are more likely to infantilize female coworkers"), but it would still just be story-telling.

If you want to know how your possible-future boss treats the women he works with, how about, "Have you had any women report to you? How'd that work out? Were there conflicts, and if so, how did you resolve them? Do you think they'd be happy to work for you again?" I'd be happy to answer those questions. Asking what my wife does for a living will get you a very awkward, "Er, let's get back to the interview."

I'm presuming you want a candid, honest response as opposed to a look-how-inclusive-I-am one, hence the throwaway, so here's what I think you should be asking:

1. How frequently and for what reasons do people there work unpaid overtime? Does management plan it formally (e.g. "crunch time") or is it limited to emergencies like hacking attempts or vendor outages? Does this company think that asking people to put in 'extra effort' is a failure of management, or a regrettable but necessary part of doing business?

2. What's the policy on conferences? If they say they support them and send people, ask if at least half the team has been to one (with travel and lodging paid) in the last year or two.

3. How do they support professional development? You're not looking for little stuff like "we pay for Pluralsight!", you're looking for things like hackathons, paid time for professional development, a formal mentorship program, a developer book club, or other evidence of a genuine culture of improvement within the dev teams.

4. How much freedom do the dev teams have to choose their own stack and tools? If they currently use React, did a Director choose it or did the devs who had to build the UI choose it? If a dev team wanted to experiment with something (e.g. TDD, or pairing/mobbing, or switching from sprints to scrumban), could they just do it and see how it goes? Or would they need their boss's boss's signature first?

You may notice there's nothing on that list about gender, race, diversity, etc. I put it to you that:

a) Diversity is no indicator that you will not be underpaid, mistreated, lied to, etc

b) Few teams will be able to give satisfactory answers to all of those questions

c) Of those teams that can give good answers to all four questions, the proportion that suffer from a miasma of gender/race/etc toxicity will be approximately zero

That said, "good team culture" is extremely subjective, and people here can't tell you how to find a company you'll like any more than we can tell you how to find a bar you'll like. You should figure out what you value (e.g. interuption-free focus time vs. frequent informal collaboration, remote distributed team vs. everyone-is-in-the-same-room, "bust ass to get rich" startup vs "eveyone leaves at 5pm" established company, etc) and treat those as just as important as the four questions I listed.

Best of luck in your search.

Only tangentially related, but some of you may be amused to learn that one legal standard for whether something infringes a trademark is the "Moron in a hurry" test: meaning, would a moron in a hurry confuse the thing at question with the thing claiming infringement?

https://en.wikipedia.org/wiki/A_moron_in_a_hurry

Re:The Right to Attention in an Age of Distraction on Friday May 26, 2017 @03:16PM (#14426465)
Dopamine seems to be an API that automates and optimizes the display of "rewards" (positive messages or images) in an app to increase usage, right? And there's ML to optimize timing of the rewards, but it's basically exploiting the same effect seen with randomized rewards, i.e. the thing that makes gambling addictive, right? Is that a fair summary? That doesn't seem like it's giving "an individual autonomy over attention". It seems like the exact opposite.

I don't understand what the other thing, Space, does. Does it just interrupt social media apps periodically? It seems more like an attempt at viral marketing for Dopamine than something that's intended for real people to use, but I can't tell what it does and I'm not on iOS.

Re:Urbit and the Not-So-Dark Future of the Internet [pdf] on Thursday May 18, 2017 @06:56PM (#14371740)
It won't take off until there are useful apps to run on it, and once there are, people will get it for those apps, not for it itself. Only to CS majors is it interesting in itself - to everyone else, it will (or won't) be interesting purely on the strength of what you can do there that you can't do elsewhere.
Re:Ask HN: Urbit Sale – will you be buying? on Thursday May 18, 2017 @06:47PM (#14371707)
> people definitely do choose their linux distributions based on ideology

Sure, sorry, I meant that it's not the norm, not that it never happens ever. My post was unnecessarily argumentative in tone, due to frustration with some past urbit discussions here.

> A network designed and organized based on a particular principle can impose that principle on the way that people on the network act

This is a very abstract point, which may be true in the general sense, but I was talking about Urbit in particular. Consider two assertions:

1. Urbit is so amazing and useful and wonderful that it's reasonable to imagine people all over the world using it every day for decades to come 2. The guy who wrote Urbit is racist/authoritarian/something else, as proven from a close textual analysis of his old blog posts

The point I was ranting about is that it seems like the truth or falsity of those two statements is completely separate, and that the former ought to be a lot more interesting than the latter. I don't think that's proven to be the case.

Re:Ask HN: Urbit Sale – will you be buying? on Thursday May 18, 2017 @06:18PM (#14371564)
It was sale.urbit.org but you needed a ticket. Submit your email address to get on the list for future notifications, including tickets to future sales, although they say the next one will be a public auction. What you get when you buy is a number which can be submitted to urbit in exchange for the key that proves ownership of a certain star, meaning you would be able to sign messages that other planets/stars would trust as having come from the owner of that star. Stars are identical to planets except that they are also able to issue tickets for planets. So the point of owning a star is that you can give away or (in some future scenario where anyone wants to buy them) sell planets. For now, you can get a planet just by emailing the devs and asking for one.

People have complained about the documentation forever, but I think it's just hard to explain what it is, because it is pretty novel. If you chew through some of the available stuff and have further questions, reply to me, I'm as likely to give a useful answer as anyone.

Re:Ask HN: Urbit Sale – will you be buying? on Wednesday May 17, 2017 @07:23PM (#14363665)
Urbit is the most brazenly audacious computer science project on Earth, it's entirely open source, and yet, every time it gets mentioned on the world's most popular forum for programmers, virtually all of the discussion is non-technical.

Who cares about the ideology behind it? Does anyone pick their linux distro based on the maintainer's political blog? "Oh, one of the devs said something in 2007 about immigrants I didn't like, and..." uh huh. What about the insanely ambitious attempt to replace unix, any comments on that?

Re:Raining Frogs on Thursday March 02, 2017 @07:18PM (#13779682)
Could you please make a throwaway account for this shit? How can you be smart enough to write your own OS and yet dumb enough to not realize that the #1 impediment to Urbit's adoption is your political blogging?

I say this as a supporter, a star owner, someone who wants urbit to succeed: please stop giving ammunition to those whose job it is to farm pageviews by identifying right-wing bogeymen for the internet to hate. Honestly, I have nothing against you or your politics. (Nothing for them, either.) We've emailed, I think you're perfectly decent and that the slanders against you are slanderous. In a just world, people (especially HN commenters) would judge you by the product, not your blog. But in this world, shit like this post makes me think Urbit's best chance for widespread adoption is for some rando with a decent CS pedigree and blandly-inoffensive politics to hard-fork it.

/rant

Re:Urbit in 2017 on Thursday February 09, 2017 @07:31PM (#13612342)
Dude, it's an os, a container, a thing you write and run apps in. You want it to select a hosting plan for you and help you if you forget the password to the box it runs on?

Look, if you're a hacker, and you've got some time to kill, just download it and run it and spend an evening with the "Getting started" doc and writing a little bit of hoon. You'll figure out what it is and what it might be a lot faster than by asking questions on a forum. And if you're not, ignore it, it is nowhere near being useful for end users yet.

Re:Urbit in 2017 on Wednesday February 08, 2017 @07:13PM (#13603482)
> Wordpress has pretty high adoption, but there are very few companies which support wordpress integration, and if they do, it is at a much higher price (bluehost: $3/mo regular hosting, $20/mo wordpress hosting)

What's stopping you from getting the $3/mo package and installing wordpress yourself? The pain of learning how to administer and secure and update it, right? Urbit is (or claims to be) painless enough that you would install it yourself and not need to do any maintenance afterward.

> This blackhole mechanism is very much like spam problem, so it has all the usual questions: Is it going to be managed by someone? Does identity get un-blackholed after some time with no spam? Can you pay $$$ to make this process faster? Can someone blackhole whole galaxy? What if your computer gets malware which spams other users on your behalf?

This is all up to apps and users to handle. If you did write an app that defaulted to "accept messages from anyone" then you'd need to include some sort of "report spam" feature in it I suppose, but I think it's assumed that most apps would just ignore unsolicited messages. You could also do more nuanced rules, like "Ignore messages from accounts that are less than a week old; if the account is older than that, you can show me one message, but ignore any subsequent ones unless I respond to the first one." Up to the developer of the app.

> Looks like in this situation, your only hope is that your hosting provider kept your backups, and this is not guaranteed at all. So basically not much better than existing self-hosting systems.

"Your hosting provider might not do a good job of managing backups" is a) well outside of urbit's purview, and b) something I thought was pretty much a non-issue these days.

> Are you sure that every user will have different urbit credentials and admin credentials to the hosting provider?

At the end of th day, urbit is just an executable. You log in to your shell, you run ./urbit, and you tell it what to do. Anyone who can log in to your shell can run your urbit and tell it to do something you don't like. So of course you need to keep your login and password safe, and the host OS needs to be secure, and so forth.

But, if the claims of the people who made it are true, it should be impossible for J. Random Cracker to send a message to an urbit over the network that makes it do something bad. Not "we think we found all the buffer overflows" impossible, I mean "mathematically proven to be impossible" impossible. That's why they rewrote the thing from the ground up in such a hokey way. Whether they succeeded in, or whether that claim is laughably deluded, is something I'm hoping someone much smarter than me will definitively determine someday...

Re:Urbit in 2017 on Wednesday February 08, 2017 @06:25PM (#13603197)
Interesting thoughts. I'll just weigh in on the ones I feel confident answering:

> I have absolutely no idea why they've invented a custom p2p network/addressing system.

Part of what Urbit does is make it easy to identify people and exchange messages with them, so it has to have a built-in idea of what identity means and how to tell who someone is. If it didn't have its own identities, each application would have to do that itself, which is where we are today.

> I have absolutely no idea how this has anything to do with social media.

It's just a use case that everyone's familiar with which illustrates something that urbit makes easy to do. But I think the hope is that "Hosting continuously available cryptographically identified server apps is easy now, what shall we do with that?" would spawn genuinely new niches, in the same way that mobile phones have.

> Even if we assume that all of Urbit's ideas pan out: interacting with Twitter seems to completely undermine all of it!

I think the idea is that you'd have some app on urbit that sits between you and your social media. So, when you take a picture of your kid and want to share it, you'd use an app within urbit that would (say) post it to twitter, put it on facebook but only for "family", and store a copy in the "backed up monthly by the hosting provider" folder. As social media apps come and go, you could use them while they're useful and abandon them when you tire of them, without having to export or import things.

Re:Urbit in 2017 on Wednesday February 08, 2017 @05:47PM (#13602945)
> Why would they each cost a dollar when they're running out? How could you possibly defeat economics like that? Scarce things are expensive.

The "urbit is land" analogy is, like any analogy, only so useful; don't carry it so far that it breaks. Urbit addresses are numbers, and numbers aren't scarce. They're only limited by convention, and conventions can change.

I think the devs like to trot out that "land" analogy for BTC users, to help illustrate that urbit addresses aren't fungible, but it only holds if you imagine that land in this scenario can be created out of thin air by the king when he feels like the kingdom is getting crowded, and if polluting your land makes other landowners pretend your land doesn't exist, and if used land on the secondary market is all presumed to be polluted.

Re:Urbit in 2017 on Wednesday February 08, 2017 @05:04PM (#13602604)
shrug As you like. If whoever wrote Jira revealed that the reason "stories" and "bugs" and "epics" all have the same default fields was because he thinks capitalism is better than socialism or what have you, I would entirely ignore it, and I don't think I'd be any poorer for it.

I would also wish for more projects in this vein. If something came down the pike with similar aims but minus the spooky political baggage and the eccentric syntax, believe me, I'd subscribe to their newsletter. But AFAIK there is nothing in the offing even remotely similar to urbit other than urbit.

Re:Urbit in 2017 on Wednesday February 08, 2017 @12:26PM (#13600112)
> why would a developer prefer to write Self-Hosted!Instagram instead of just Instagram?

Because urbit is designed to make that an easy thing to do. Say you've got a webserver, and you want to put a picture of your kid on it, but you only want the server to serve that picture to your Mom. On unix, that's really complicated, you need to do a lot of things to make that happen - not just implement a web app that includes authentication and give your Mom a new login and password to memorize, but also configure the web server properly and make sure your server is locked down and stuff like that.

On Urbit, that would be really easy, the equivalent of "mkdir mom; chmod +r mom; mv pic.png mom", because it abstracts away things like cryptographically verifying identities in the same way that unix abstracts away sending a file to a printer.

Re:Urbit in 2017 on Wednesday February 08, 2017 @12:13PM (#13599969)
That's a fair point, I was complaining about past Urbit threads, which sometimes spend a lot more time on the founder's weird-but-irrelevant politics than on the technical merits of the project. I expect and welcome flaming about why it's built the way it's built! I would so love a big deep thread between the urbit devs and some really smart people who have deep misgivings about its architecture, because the outcome of that would help me decide whether it's worth investing time learning hoon.
Re:Urbit in 2017 on Wednesday February 08, 2017 @01:52AM (#13596353)
I shouldn't have said "planets". I think only the top 256 "galaxies" (owned by the founders and investors) really get a vote. Maybe? That might not be right, I don't remember the details.

But there are two other misconceptions to clarify.

First, the defense against "What if the people who run urbit turn out to be jerks?" is not to have democratic voting. And it's not Bitcoin-style "51% of us agree" forks either, urbit is a top-down hierarchy. The defense is that Urbit is open source, and anyone could go out and start their own Urbit network and ask people to join it.

Second, planets have (theoretical) value, but they're not fungible, they're identities. A good analogy is: imagine if Reddit were designed to only have 2^32 handles, and they each cost a dollar. In that scenario, if Reddit said, "Hey, we've sold all our handles, hooray! Now we're going to issue an update that makes some more available", would existing Redditors lose anything?

Re:Urbit in 2017 on Wednesday February 08, 2017 @12:13AM (#13595943)
I think the answer, the unmet need Urbit is trying to meet, is "I wish I could install apps on a server as easy as I do on my phone." On your phone, the security comes from a crack team of engineers paid by Google or Apple or MS to make sure no bad apps get in, and on Urbit it would come from Urbit's architecture.

But to be clear, none of those apps exist yet; at this point it's just barely functional enough to start developing real apps.

Re:Urbit in 2017 on Tuesday February 07, 2017 @11:58PM (#13595878)
I agree on the dissonance, that rankled me too. What does "as usable as any widely used app" mean, in the context of a hobbyist OS for hackers who have already committed to learning a weird new functional programming language?

I interpreted that whole bit to mean "We tried to make a commandline-free UI frontend for it and failed." But I am glad they're trying to make it more usable! Last time I installed it, using the commandline from the web interface was really clunky, you pretty much had to be at a shell.

Re:Urbit in 2017 on Tuesday February 07, 2017 @11:22PM (#13595730)
Thanks for responding! Sadly the signal:noise ratio on HN really plummets when urbit gets mentioned. Zaphar's response is good but I'll go in to more detail (as I see it):

- bandwidth : there's nothing in Urbit itself to address this, but one presumes that if you host an urbit on EC2, you'd also be putting cloudflare in front of its webserver. More generally, if Urbit got even moderate adoption, the hosted-server companies would fall over themselves supporting it, because it's a new customer base for them.

- mail : Agreed, I would never want to run a mail server, on urbit or anywhere else, due to how convoluted it is. However, Urbit uses a federated addressing system that would make spam unprofitable. Read their page on identities if you want details, but the short version is that full-fledged identities on the Urbit network cost a couple of bucks, and it is assumed that anyone who spammed from one would get blackholed before they recouped the investment.

- social : From a user's perspective, I think the big difference between Diaspora and the-yet-to-be-made-facebook-clone-on-urbit is that the latter is not the only thing you can put on an urbit. It's unlikely that Urbitbook would be so popular that anyone would run out to host an EC2 just to join it. But Urbit is supposed to be useful in and of itself. And if it does take off on its own merits, it seems very likely that a self-hosted social media clone would be one of the popular apps.

- viruses : Urbit is designed to be essentially impervious to malware. (Which is not the same as saying it is impervious - kind of depends on whether the people who architected it are as good as they think they are. I'm not qualified to weigh in on that.) In a worst-case scenario (say, your whole urbit got bitlocker'd), recovering would require you to a) get your hosting provider to restore from a backup, and b) notify your "galaxy" (your parent in the distributed network architecture) that you have lost continuity, and convince them that you are your urbit's rightful owner. That last bit would be nontrivial (because this is exactly how someone would go about stealing your identity) so it is assumed that the most galaxies would have stringent requirements, or if Urbit is as stable and unhackable as its supposed to be, not allow it at all.

Re:Urbit in 2017 on Tuesday February 07, 2017 @09:14PM (#13595107)
This is just grousing; If urbit got so popular that addresses were sparse, a big if, planet owners would just vote to add more.
Re:Urbit in 2017 on Tuesday February 07, 2017 @09:08PM (#13595077)
It has a webserver and networking and it can access the filesystem and it can send messages to other users securely. There's also an ntalk kind of app and a simple threaded discussion things but they're more like demo apps than things you'd use intrinsically.

I think it's fair to say the only reason to run this is to develop for it right now, it's not something end users have a use for.

Re:Urbit in 2017 on Tuesday February 07, 2017 @08:42PM (#13594945)
A couple thoughts from an early backer who really, really wants Urbit to succeed (and fears it won't):

1. What is Urbit?

I'm not involved with it and don't speak for the devs, but this always comes up, so I'll just explain in plain terms what I think Urbit is, or what I hope it will grow up to be. Urbit is the server-app-container thing that would make my non-techy Mom want to pay $5/mo for a hosted server instance.

Imagine if every man, woman and child had their own server. Nothing fancy, just a cheap ECC instance or DigitalOcean droplet or something. What would they do with them? Well, host a webserver I suppose, maybe a mail server, maybe a Minecraft server, stuff like that, right? But, these would have to be accessible to non-sysadmin types, so all of these server applications would have to be easy-as-an-iphone to set up and administer. Right now, such apps don't exist, because there's no market for them. But if the market were there, millions of people with hosted servers just sitting around, you can imagine how quickly they'd get made.

What about a social media? At a high level, every social media app is essentially the same app - they let you upload a file to the cloud and they let your friends access it and they show you ads. The differences between Twitter and FB and Instagram and Snapchat are nothing more than differences in how those three features are implemented. So why do they all use the cloud? Because there aren't a million people with server space just sitting around on which to host their IG pictures and FB arguments and Twitter profundities. But if there were, a good self-hosted social media app would make a lot of sense to build.

Urbit is intended to shortcut this chicken-and-egg problem by making a container in which it is easy to build those things. My Mom can afford a hosted server, but she has nothing to run there. If there were great things to run there, like a Facebook with no ads and a webserver with no hassles, she might rent one. Urbit is intended to be the thing in which those great apps are easy to build.

2. Why I want it

Those are all abstract reasons why something like urbit might succeed. As we all know, the mark of a good startup is not whether you can explain why it might succeed, it's whether there are users who want to use it right now. Well, I do want to use it, but it's hard to explain why. I'll take a stab at it.

If you're over 40, you may remember getting your first shell account. Wasn't that the shit? You want to host some files for colleagues? Just make a directory, chmod it to world-readable. You want to run a web server? Go ahead, and don't worry about security, the only people that can see this are inside your college/company. Want to see what Bill Smith is up to? finger bsmith. Want to argue about politics? talk.politics. God, how simple things were! Playing with Urbit feels like those days to me. It makes a handful of things, like identifying users and sharing files between them, trivial. You could probably write a Twitter clone in less than 1K LOC.

Or at least you could, if Urbit does everything it says it does. That's a big if. Which brings me to...

3. Isn't it really weird and fucked up?

Yes. Oh yes. It is incredibly eclectic, the fevered result of an insane genius toiling away in obscurity on his dream project when he wasn't busy writing interminable political screeds. It is an attempt to combine a bunch of things (a ground-up OS, two new languages, and a novel networking architecture) that might be too much for such a small team. The Hoon language is weirder than you've heard. Some people swear it's great once you get used to it, but the docs are sparse and I haven't invested the effort. And if you do invest the effort, it could well be that it has non-obvious architectural flaws that will doom it to be a buggy mess for all eternity. And on top of that, the founder is primarily known for political rantings that are... well, not racist per se, but close enough to get Urbit boycotted by the sorts of people who boycott obscure open source projects due to things in the founder's blog.

But if it fails, I really hope someone builds something less weird that accomplishes the same thing, because at the end of the day, I want it. I want a cheapo server with a cheapo self-hosted Twitter clone and a cheapo self-hosted FB clone, and I want to share pictures of my kids with my Mom without running them through some enormous corporation's billion-dollar machine-learning advertising algorithm, and I want to host my own website and server apps without taking on "sysadmin" as a night job. And it seems like, right now, Urbit is the fastest way from here to there.