Hacker News new | past | comments | ask | show | jobs | submit | andyg_blog's comments login

100%. Consider a scenario where someone with too much money accidentally is forced into buying out your company and then they decide to cut 75% of the workforce. At that point it's all metrics, good or not, that decides who stays and who goes.

>Are these tools measuring the “right” thing? It doesn’t matter!


My experience has been a little different. Usually you have regular one-on-ones with your manager where you discuss career things, including what you've been working on lately. From being in the manager shoes myself, I do this so that you and I are more ready to advocate for you when it comes to actual performance review time.

I think I did realize that. However, if you as a homeowner say "I really super duper don't want any scale buildup OR the minerals to be dissolved in whatever comes out the faucet" then suddenly the proposal is actually reasonable.

Metaphors only go so far. Try to see what I'm really saying here: quality has a cost. Don't shoot yourself in the foot by preemptively reducing quality on account of some ill-conceived notion about how the relationship between product owners and engineering works.


If this article is to be believed, they are storing user passwords in plaintext.


nah, it's hashed and salted. otherwise just === not bcrypt compare

import { compare } from "bcrypt";


Yes, exactly hashed and salted by bcrypt.

If I wanted harden this setup, my next consideration would be either having a separate microservice that's purely responsible for auth, or using 3rd party provider like Cognito.


Tldr; they lost


What a black and white viewpoint to have, I feel bad for you. Should we also execute (on the spot, no less) jaywalkers, children with unlicensed lemonade stands, and people who ask for water cups but then get a fountain drink? Consider a little empathy once in a while. Do you think you might be willing to break a law of you were in fear for your life? Illegal immigration, like many "large-scale" issues in society, is a multifaceted social phenomenon that there is no silver bullet for, pun intended.


Well, a secure border is what defines a country (or at least a country where it is by some weird quick unconstitutional to check papers within it, and anyone born inside is automatically a citizen). A country is a body of people that is able to pick who to include into the club and who not. If it is unable to, or refuses to do so and allows anyone to join, it ceases to exist.


What's interesting is that this was created by Max Howell, creator of Homebrew who made waves a little while back for getting rejected by Google despite Homebrew's success. He talks about that here: https://www.quora.com/Whats-the-logic-behind-Google-rejectin...


To his credit, he didn’t let being rejected by the largest advertising surveillance company stop him from shipping surveillance software to millions of end-user workstations anyway, in the form of the nonconsensual spyware built into Homebrew.


It seems like youve mentioned this before, but googling about this only brings up your other comments. Can you elaborate on what the spyware is?


He’s talking about analytics. https://docs.brew.sh/Analytics


It's an euphemism, just like "telemetry" and "metrics".


Do you really feel like what they’re collecting is “spying on you” though?

They’re collecting errors and statistics to make the product better. It’s all anonymous and you can turn it off.

If it were Facebook ads, I’d be more sympathetic. But it’s automated bug reporting…


It’s not anonymous, it includes the client IP address as well as a permanent supercookie unique identifier. Coupled along with client IP geolocation, this leaks your travel history to the server. It does so silently when you install packages, just like any other spyware.

The problem is an ethical one: just because they made software does not entitle them to the information about what does or does not happen on a machine that they do not own without the informed consent of the owner or operator of that machine. Assuming consent and opting the user in automatically is the issue.

Anything other than advance, informed consent is just spying.

Debian has figured it out. Why do other open source projects have such a hard time understanding consent?


Homebrew says they ask before sending telemetry and you can say no…

And you’re sending your IP address all over the internet. Is Hacker News violating your privacy because they have a log an incoming requests?

It’s not like Homebrew is identifying YOU by name or cross referencing the UUID on your machine to advertise to you…

I just think it’s hard to appreciate how much work it takes to build quality software. And automated reporting really helps!

Living in a “trustless” world is a myth.


They don’t ask before, it happens without consent. The problem is claiming it’s anonymous when it’s not. Loading hacker news is also not anonymous. Calling something anonymous when it transmits your IP address is factually incorrect.


I just think it’s hard to appreciate how much work it takes to build quality software. And automated reporting really helps!

It sounds like Homebrew has its own reality distortion field, to be able to produce such pure unadulterated self-congratulatory BS like that.

As someone who had the unfortunate experience of having to try it once and interact with the "community", I am not surprised to see that it's still a bubble of delusion lead by someone trying to emulate Apple's cult.


I'm a fan of lihaoyi's response to similar tracking accusations.

> It's on by default. If you don't like that, turn it off. Or stop using Ammonite if you want to make a philosophical statement. I don't make any money off any of you, so I won't be particularly sad to see anyone go.

https://www.reddit.com/r/scala/comments/6irnix/about_ammonit...


And by supercookie, do you mean this UUID? https://github.com/Homebrew/brew/commit/57844530a94d5686029c...


Yes, he does and, as you noted: it was removed.

We also always requested for Google to never store the IP address and now we run our own analytics infrastructure we definitely do not store it at all.

sneak just has a grudge against Homebrew because we blocked them for going on and on about this so they resort to ranting on Hacker News instead every time Homebrew is mentioned.


You are confused, despite my having explained many times. Your misrepresentation seems like bad faith. The Upton Sinclair quote comes to mind.

My issue is with all people who ship spyware; it is unethical. It’s nothing specific to Homebrew (sadly) and it’s not a grudge.

Lots of people would turn it off if they realized it was spying on them. The problem is people who assume consent and co-opt computers that do not belong to them to spy on users and exfiltrate data that isn’t theirs. They think that being volunteers or making f/oss entitles them to act unethically.

Opt-in consent is fine. These authors don’t use it because they secretly know that if they asked outright, most people would say no.

Seriously, it’s not any personal grudge against your project (and didn’t know until this moment that you had blocked me): Mattermost, VSCode, NetData, CapRover, and a thousand others also behave in such an unethical manner. It’s shameful, and it should be illegal.

Many people don’t know about it (as evidenced by sibling comments in this thread) and obviously should. This is a failure of the project that spreading public awareness about helps.

I would love to see the f/oss community abandon projects that are run in such an unethical manner. Nixpkgs on macOS, for example, doesn’t spy on you. (Neither do the package managers in the Linuxen you can replace macOS with.)


You're hijacking the term "ethical" to present yourself as morally superior. Many people don't think they're behaving unethically, and I think you're of the minority opinion.

> Many people don’t know about it and obviously should.

If people did know, what would be the consequence? What tangible difference would it make in anyone's life?


Morals are subjective, ethics are not. The fact that they are behaving unethically is not an opinion.


Sometimes it takes an existential event in our lives to really drive home what actually matters. On your death bed you won't wish that you spent more time delivering value to a company (even a great one) than spending time nurturing relationships with loved ones.

On another note, your value as a human is not the same as the economic value you produce, and it's too easy to conflate the two


> On your death bed you won't wish that you spent more time delivering value to a company (even a great one) than spending time nurturing relationships with loved ones.

To some extend. But I spend a lot of time with my loved ones. I would regret losing that the most, but I can totally imagine myself also feeling sad about that feature or project I never got to finish.


Unfortunately you have to project substantial economic value to live a life of dignity (esp with a family) and so there’s no getting away from it with the current state of affairs

You can’t just “live a nourishing life”, you have to do both


What a ridiculous statement, are you saying that lower income families don't live a life of dignity because they can't project "substantial economic" value?

If your argument is about providing enough to have a roof over your head, then that doesn't equate to "substantial economic value".

I find such obsession with wealth very unhealthy.


Roofs aren’t getting any cheaper. Neither are healthcare or education. If you really want to experience indignity, try obtaining all that on a low income.


You do get all of roof, healthcare and education on a low income.


I can tell you don’t make a bunch of money and play videos games in your spare time.

I have a family and IMO you sir are correct.


As you get older, you might run out of loved ones, at least in the strict sense. That is when your last sentence becomes important and you have to find value in yourself and your daily life.


> your value as a human is not the same as the economic value you produce

Unfortunately that is how we are seen and thusly treated by the government and by corporations


This comes across as a little racist.


Based on his IRL name he appears to be Hindu. Fwiw artagnon has a good track record as a tech blogger.

https://news.ycombinator.com/from?site=artagnon.com

https://news.ycombinator.com/submitted?id=artagnon



The next few sentences describe his birth and birth name. Which are not Chinese.


It’s certainly one experience in the Bay Area. But doesn’t match mine. Hard to reconcile my experiences outdoors with no recreational activities.


How so?


It's like a modern cannonball. They say a 20kg "solid sphere" traveling at 4x the speed of sound could disable a tank by exerting forces on bolts that connect the pieces together, but otherwise leaving the tank with the appearance of being mostly unharmed.


For comparison, modern anti-tank sabot impactors are roughly 1/5th the mass (and kinetic energy) and travel at similar velocities.

So if they've shown you can bludgeon a tank rather than puncture it, I'm not sure how useful that information will be when it involves ~5x the propellant and a correspondingly bigger round/barrel/etc.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: