Compliance is not security, but "security" is too nebulous of a term to actually implement effectively, so companies use the specific regulations and standards to have a measurable target to strive for.
In my company, we have additional security measures and guardrails on top of the bare minimum legally required, but most companies indeed see security as a cost center and decide not to invest until it's too late.
E-mail is totally intercompatible, but the experience for anything apart from "the equivalent of letters" is simply horrendous. Delta Chat tries to make e-mail more like a chat app, but it isn't perfect, because e-mail wasn't designed to be a chat application.
XMPP has other massive usability flaws. So does IRC, Matrix, and others.
None of Matrix’s typical usability problems are the protocol’s fault - they are the clients’ fault. The fact is that on the Matrix side we invested much more time on the protocol, spec process and even server implementations in the early days.
Meanwhile the clients Element built to bootstrap the protocol have been stuck paying off huge amounts of product debt, and are finally at the point now of surpassing mainstream apps - eg https://element.io/blog/element-x-ignition/ - but it took years longer than it should have to get there. Again, it’s not the protocol’s fault though, other than the extent to which building a protocol draws energy from building killer apps.
While this is commendable, the problem with this is that you're also refusing to interact with people who use those platforms.
For example, you can refuse to use Google Chrome, and instead choose Firefox or Vivaldi. Your web experience will be slightly different, but the most important parts will remain the same: You type an address, you wait for it to load, and you access the content.
On the other hand, refusing things like WhatsApp means there's a non-insignificant amount of people that use WhatsApp to communicate exclusively. This may not have impacts for you, personally (although I would be hesitant to believe that), but it definitely leaves out billions of people who communicate exclusively via WhatsApp.
A similar thing happens, for example, if you refuse to use YouTube, which is the largest Internet video platform on the planet: You will have to refuse to watch any content that is only uploaded to YouTube, or put up with frontends that use YouTube in the background, or perhaps even be forced to pirate videos, neither of those three options is good for different reasons.
> the problem with this is that you're also refusing to interact with people who use those platforms.
That's not a problem for me at all, honestly. I interact with my friends and family through other channels. Nobody I know uses these services exclusively.
> it definitely leaves out billions of people who communicate exclusively via WhatsApp.
I don't want or need to communicate with billions of people. I want and need to communicate with the people I know and care about.
Don't get me wrong -- I'd use an IM app for the convenience if there was one that served my needs. But as long as each IM app is it's own island, then none of them serve my needs at all. I'd have to have a half dozen of them, and that's unmanageable and ridiculous.
Like some other people point out: Invitation-only means trolls are less likely to show up. But the higher end of quality is not significantly better than HN.
If anything, it might be worse.
My experience with the moderation there is that some people post clear self-promotion articles, but when I attempted to post my things, I get told that this content is not welcome on the site. Why my content is not welcome and other people's self-promotional articles are I don't quite understand, but it is obvious they don't need me on the website.
I've been lurking on Lobsters for a while, and have definitely noticed that the self-promotion rule is selectively enforced. Just pivot into exclusively writing content about an impractical docker alternative, and you should be golden.
Snark aside, they could codify exactly what frequency of self-posting is allowed, and let the existing voting system dictate what rises to the top. I'm not sure Lobsters sees any issues with how they self-moderate though. Personally, I have always felt that invite-only communities have weird vibes to them. Still find it worth lurking for more esoteric content though.
In bits and pieces. The advice and some things that trend diverge significantly from HN. I prefer to think of Lobsters discourse as sort of an Inverse Cramer Index, but for software development.
That's interesting. My personal advice is to look at trends here as evidence of who's the public, but be very skeptical of their usefulness. What's good for faang or for a money-burning-a-series startup will kill you.
Boring tech like RDBMS, Unix servers and native clients mixed with simple web apps are better solutions for most other companies. Or even Lisp if you are in a startup and need to move fast.
But if you look at trends, you might think that you absolutely need some cloud rusty golang key-value store, with a scrum functional serverless proof-of-work nft SPA :)
Absolutely. HN is more representative of what is popular amongst software developers, but software developers have a nasty tendency to chase shiny things. Lobsters trends on the other hand feel consistently contrarian, and being contrarian tends to be highly impractical. They have been right about the return to server rendering HTML though. It's a place to find different perspectives, for better or worse.
The tone of the comments have evolved over time. When I first found this site, it had a high percentage of entrepreneurs trying to build startups. Refreshing compared to Slashdot that was getting a little more cultish by the day.
Later the founders got diluted, I guess by the influx of employees of said startups, big tech or consultancies, like myself, then anyone from the outskirts. The vibes changed dramatically, until it was unhospitable for the original population. Many of them vanished. Even pg doesn't write here anymore and when some of his essays are posted the reception is outright hostile.
I'm not talking about politics, not only. A lot of comments are on the opposite extreme from the original curiousity and build mindset. People saying that any idea presented won't work, is useless, is nothing new. People talking about what should be, but in denial about what is and of course never doing anything.
There are many perfectly reasonable things you can't say here.
So we have like... the Internet, more civil than average and with a lot of interesting links. Also there are some fellow commenters that I love to read.
When I first found HN in 2008 it was a refreshing community that actually understands business. Which is a very rare thing on the internet. Because the site is geared towards startup and entrepreneurs, they had to understand business one way or another. And hence this somewhat pro-business stands earned its early reputation as an alt-right site.
Now that is mostly gone. The business side of the discussions has completely vanished.
> Later the founders got diluted, I guess by the influx of employees of said startups, big tech or consultancies, like myself, then anyone from the outskirts.
I am one of the new users who contributed to dilute entrepreneurial founder. I didn't worked for a startup when I joined. What made me join and stick around is that NH hosts the best stream of tech-related submissions, and discussions tend to attract knowledgeable people who know what they are talking about, and some of which are even the leading expert on the topic.
I am also an ex slashdot lurker. That place used to serve that itch, but nowadays it reads like their comment section attracts mostly the 4chan crowd. Quite the fall from grace.
The general quality of discussion is ridiculously low on anything not strictly CS-related. Software engineers tend to be quite cocky, self-confident also regarding unrelated stuff to their expertise, and it shows very much.
With that said, the occasional gem of some well-known expert of the field chiming in is worth digging through some bullshit comments, I just dislike that CS-topics are quite rare compared to just general news.
Just try being critical of the American military-industrial complex. You will get stomped by members whose livelihood depends on the perpetuation of the phony moral authority that is necessary to continue that heinous state of affairs ..
It exists because the American people have been lulled into the false narrative that their nation protects the world .. when in fact the absolute opposite is true - the worlds safety is constantly under pressure from the 1000 torture sites the American people pay for every single year - the ruling elite of the rest of the world knows this and responds accordingly, thus feeding the loop which justifies yet more actual repression from the USA, with regards to its military ..
Our world is unjust and replete with suffering. The question is what are you going to do about it?
There's a lot of things you can do to improve your life and the life of people around you. Discussing world problems in an online forum is not one of those things.
These up and down arrows near the comments give us the illusion that we can vote for the solution of everything.
One most certainly can be an individual example of change. For example, I refuse to make excuses for the war crimes, crimes against humanity and massive violations of human rights, committed in my name, by my nation.
Discussing it online is perfectly acceptable. Nobody is expecting the criminal Joint Chiefs of Staff to be reading HN, have an epiphany and frog-march themselves in chains into The Hague - but we certainly can put the idea into our fellow citizens minds that this would be a just action and perfectly acceptable way to re-gain control over our society ..
This is a common failure mode that's seen in some reddit subs.
In reddit, the moderators of that sub get a particular idea of how their sub should look, which oddly enough includes the idea that what they do is always right. Any sub that can have physical products backing it, such as makeup, will commonly fall in this trap.
Mods: "You cannot promote products here... (unless you're one of my friends or giving me kickbacks".
Now with Reddit, you have a very large usebase to keep the sub alive. But small sites will commonly strangle themselves by doing this.
Those are hot-buttons that have ruined other communities, so whatever the specifics for that sub, my guess is Political Controversy. Anyone on here know anything for sure?
I don't think those are the specific topics that ruined this subreddit. The moderators killed this subreddit: if you express a slightly different opinion than liberal left wing, you will be banned for being "not welcoming and create a bad mood". And you will be banned also to express any polite kind of criticism to all the minorities, except one: the catholics. For them, every insults is accepted.
>you have a very large usebase to keep the sub alive.
I don't know about that. You have a large userbase of upvoters sure, but commenter were declining in quantity long before the June API changes on a number of subs that were more discussion based than meme or article upvotes.
https://subredditstats.com/r/conspiracy Conspiracy is a good example of a discussion sub, no comment on the actual discussions, driven by upvotes and were did all the commenters go before June's API disruption while the subscribers kept climbing?
Like the other poster said. Conspiracy is less about the api and more (waaaaaaayyyyy more) about fringe politics becoming mainstream. It was one of the first subs to rot during the 2016 and then died during the 2020 American presidential elections.
Well then where did all the politicers go? https://subredditstats.com/r/politics
has a similar Subscribers to Commenters ratio decline that Conspiracy had.
> when I attempted to post my things, I get told that this content is not welcome on the site. Why my content is not welcome and other people's self-promotional articles are I don't quite understand, but it is obvious they don't need me on the website.
I feel the same. I spent a fair bit of time on the site, including posting ~600 articles and commenting. Some of my posts got a fair bit of upvotes. I got a couple of warnings when I posted my own content, even though it was 5-10% of my posts. Super frustrating, so I told the moderator I wasn't going to participate any more. And I haven't. Their site, their rules, but I don't have to spend my time there.
Weird because primarily submitting one's own stuff seems to be pretty common there. Random example from a user currently on the front page: https://lobste.rs/~rednafi/stories
And that is not the only one on the front page right now that's submitting mostly their own stuff.
To nitpick: that's not a comment from a mod. Posts speaking from a position of mod will have [sysop] next to the title. It's part of a "hats system", which more generally allows people to speak as representative of something. IE if /u/johncheng was a Rust core dev, they can post whatever they want as John Cheng, but also write posts as [core dev] to say they're speaking as part of the core team.
It's a neat system but doesn't see much use in practice, aside from the occasional [sysop] warning.
Personally I don't see a problem with someone posting their own content, especially with voting based ranking. As long as it's not spam and is on-topic for the site, the origin shouldn't really matter. Compared with someone who posts only New York Times articles, I'd rather see someone post their blog entries.
I had a similar experience. I simply deleted my account and left the site. If my contributions weren't welcome then that's the choice of the moderators, but I had no desire to try to participate in a forum where simply linking to relevant non-promotional content that happens to be posted on your own website will get you accused of being a spammer.
I remember once I mentioned something about lobste.rs in Twitter (trying to actually be positive for the community) and the creator went all crazy against me . shrug Thanks but no thanks
I wrote "What Punch Cards Teach Us About AI Risk", and I was really surprised -- and frankly, disappointed -- that they pulled it. It was the #1 story on Lobsters when they pulled it, with plenty of comments (and some good discussion!). It was also shocking to me that their moderation involves scrubbing it from the site entirely; at least on HN, the story can get modded down, but if people still wish to discuss the topic, they can. (And in fact, I have seen some discussions that were too hot cool down and become reasonable when the stories themselves have been modded down.)
The whole thing left me with a very sour taste (and not for the first time!) about Lobsters. I will continue to check in there from time to time, but I will hesitate to submit stories or participate in discussion: the moderators are simply too capricious for my tastes -- and we clearly disagree about what is on topic and what is off topic for technologists. Conversely: Lobsters has reminded me how much I appreciate HN; thank you dang and other HN mods for everything you do!
"What are you working on this week?" is a weekly thread since forever where people often talk about computing anyways.
I don't see why moderating posts should be fair. Better to remove a few good stories by accident than to leave up trash. You'll never have enough time to read all good ones anyways. They're very careful with banning though.
yeah, the problem with invite only is that it removes the best and the worst users. it self-selects for the sort of terminally-online people willing to put up with an invite process. people like me.
the best content on sites like this is the random comment that appears from somebody who's the absolute undisputed expect on some subject, and doesn't normally leave comments, but sees an opportunity to share their knowledge and does so because it's low enough friction.
There's a little button on the submit form that adds a tag to say you're the author. If you forget it and it comes out, people tend to assume it's on purpose.
One small note I'd add is that the Lobsters software has had at least one very unfortunate bug that led to pushcx claiming that I had "disowned all my comments"[1] when I left Lobsters. I had, in fact, not done so.[2] The bug was later fixed[3], but even today, over 2 years later, my comments remain disowned. They were never recovered. Textually, they're still on the site, but no longer associated with my account, which makes them very difficult to find. I'm still a little salty about that because I contributed a sizeable body of comments to Lobsters that would be at least nice to link occasionally.
Anyway, my point is, when pushcx says, "all banned users get an email notifying them of a ban with the Reply-To header set to my email," that's only true if at least the Lobsters software is behaving as it is intended to behave. It may not be.
This is interesting, but I'm having trouble connecting it to the comment I just wrote, and I'm wondering if I'm missing a connection that would be more obvious if I paid more attention to Lobsters.
I'm just saying that you can't necessarily trust that an email was sent to banned users. It's a small point. I honestly don't know what to make of the situation as a whole. It is strange.
Oh. I perceived the parent commenter to simply be saying they were surprised at why they were banned. But 'pushcx explained what happened in detail, and if that explanation is correct (I have no insight into it, other than generally liking 'pushcx, who is not a friend or anything) it's hard to see how they would be confused about what happened.
But I'm just overexplaining myself now. What happened with you and Lobsters is also very interesting (and also yikes, and sorry that happened; I'd be pretty upset if all my HN comments got disowned).
You are assuming the moderators are not lying. Unfortunately, mods on some sites do lie and do claim innocent posters violated rules. I myself was temporarily banned on one site because I argued that the Epic game store was good for competition and would help bring down prices for both consumers and game developers.
The stated reason for the banning was something like “trolling”. Not much to say other than some mods are good but some abuse their power.
Lobste.rs has an open moderation log: you can see what was done by who. It's one of the few places where I think it's possible to actually trust the moderators are treating things fairly.
I will handily take the mods side of the story, it’s quite clear from the effort put in the respective comments, and the underlying incentives (what would a mod win from making up such a complicated story, vs that of the offender party?)
Lobsters doesn't have any contact information (I later learned they have an IRC channel) so I didn't get to hear an explanation from the Lobsters moderator until the topic came up here and ended up getting mediated in a Hacker News thread. The moderator was very clear that I was not only spamming myself, but I was encouraging my friends to spam too. For example, one thing I got specifically called out for was I invited my friend from the University of Tokyo to Lobsters so he could share his https://conwaylife.com/wiki/Lisp_in_Life project. This turned out to be very bad per Lobsters cultural norms.
The Lobsters moderator wants new people to earn their place in the community before doing anything that serves their personal interests. It matters not if your self-interests are aligned with giving the Lobsters community what they want. The moderator said they're a smaller platform where it's not difficult to influence the algorithm, and as a result he's very protective of that. You can't just play the upvote game. You have to make sure the mod knows you and likes you before doing that. Another thing I did was I used a loophole to help my friend share his project. In my culture, figuring out how to work around the rules without breaking them is considered a highly prized skill. When the Lobsters algorithm said his account was too new to post a link, I thought I was vouching for and reviewing his project link by posting it myself. But the Lobsters moderator took it as a personal insult and challenge to his authority.
> When the Lobsters algorithm said his account was too new to post a link, I thought I was vouching for and reviewing his project link by posting it myself.
I'm pretty sure this would be considered a normal vouching & introduction of a member to the site, if those members did not then repeatedly follow up your introduction with repeated self-promotion (including bonus violation of the spirit of the unseen domain policy). As someone inviting others to Lobsters, you were trusted with a small duty to introduce them to the site properly. For most of those you invited, you were both the person initially posting the invitee's relevant unseen domain and the inviter for that invitee. It's respectful there to warn new users of site policy that you don't expect them to know.
When I invited a friend to Lobsters a few months ago so they could post their cool new project there, I made sure to educate them about the self-promotion policy so that both they could continue to use the site and so that I didn't become a problem for the site.
I thought I was. It's just no one told me about the Lobsters policy. I consistently violated the Lobsters policy for several years and no one warned me. I'm just someone who quit her job at Google Brain to build open source code all day in service to the commons. The thought never occurred to me there's people out there who view what I do as spamming and self-promotion. Before I got banned, I'd never heard the word spam used that way, which is why I was so confused. I wish I'd known beforehand that I wouldn't be welcome there, since then I wouldn't have engaged. Honestly I think the real victims here are the Lobsters community members. My work still gets promoted on Lobsters, even though I'm banned. When I publish something new or end up in the news, there's usually a Lobsters thread about it. The only difference is that now I'm not allowed to make myself personally available to my fans, answering their questions, and fixing the bugs they encounter. So I feel like I'm gaining publicity unfairly since Lobsters denies me the ability to fulfill my moral obligation to serve the people whose respect I'm earning.
> I always felt like the Lobsters crowd is the kinds of people who'll tell you what they really think
I genuinely would not have guessed that this would ever be a problem on the internet.
I fully support the notion that OpenAI should be more "open" than "closed". I agree that OpenAI controlling one of the most massive and powerful LLMs right now is a huge risk. Especially for a company that's not particularly geographically distributed, as this puts the USA in a position of extreme leverage.
I also understand that OpenAI may possibly be supplying unrestricted OpenAI ChatGPT models without any ethical or moral boundaries. For example, I wouldn't be surprised if the military had been training on ChatGPT for years already, on creating more effective ways of killing more people, faster, with a much lower cost.
Granted, if you ask ChatGPT "What's the easiest way to kill the maximum amount of people with the minimum investment", ChatGPT will decline to answer. And I think that's good. What's not so good is the fact that these ethical boundaries are completely artificial and not built into the model. OpenAI can possibly activate or deactivate these boundaries at will. And it would not be surprising this is the case for governments or militaries.
The great issue with this all, is that, while we can agree killing people is bad, there's other things that aren't so clear. For example: hacking. ChatGPT has actually declined to write a script that wasn't going to be used for malicious purposes involving the scanning of my own home network. And, like with everything, there's ways to break those boundaries, with so-called "jailbreaking" ChatGPT.
Indeed, like many point out in the comments, a fully open-source ChatGPT may be desirable (it certainly is for me), but, with this, the likelihood of bad actors gaining control of it, disabling safety features (if there are any), and using it to do evil simply grows exponentially.
In my opinion, the way forward is extreme regulation, Universal Basic Income, and other measures.
Automation was supposed to allow humans to focus on more interesting work, and remove manual toil and back-breaking labour. That was the case for a while.
Now automation is threatening to replace even highly skilled professionals like engineers, and/or make them become extensions of the "machine" by just giving it prompts (Prompt Engineering), or performing actions that AI models can't do like reading captchas.
Documentation has always been part of the product.
Documentation has always been part of the coding, not an afterthought, not an optional thing, not a second-class citizen. This is how I was taught in university. I'm still baffled to see how many developers believe the key to professional success is writing a lot of computer code, as fast and as efficiently as possible. Then you go to their GitHub repos for their personal projects and they're completely unusable because you don't even get installation instructions. Best case scenario you will get an auto-install script that works on Debian 9 and has been unmaintained for years, but at least you can read what it's doing and adapt it to your distribution of choice.
I had a classmate who got hit with this issue from the opposite direction. In our first semester CS course, 70% of our grade was based on our documentation. My classmate wrote beautiful, comprehensive documentation of the solution program to each solution set. They also didn't write a single line of code the entire semester, passing the class entirely on the strength of how they documented software that wouldn't even compile.
By the time that they reached the more advanced courses, where producing a working program was a requirement, they were so far behind that continuing in the program was hopeless (e.g. being asked to write a database when they'd never even attempted "Hello, World").
If the department counsellors had been on the ball, my classmate would have made an amazing technical writer, but I believe they wound up switching to electrical engineering.
> I'm still baffled to see how many developers believe the key to professional success is writing a lot of computer code, as fast and as efficiently as possible.
I wonder if developers tend to believe this, or if leadership incentivizes it, either explicitly[1] or implicitly.
> Rezaei tried to rally the troops, telling engineers to focus on shipping code as quickly as possible:
> "So if you ask what should I do now: do good engineering work. Write code. Fix bugs, keep the site up. I know the criteria for being at Twitter is that. It’s not working on a fancy project for Elon. The good culture change is, it’s shipping and delivering. I encourage you to rotate more on coding and shipping, and less on documentation, planning, strategy etc. If you want to be in a “special” group this week, code and ship 5x as [much as] before. ..."
As a restaurant owner, would you prevent an expert cook employee from using their favourite brand of knives? Or even knives they bring from home? Probably not.
What if your insurance only covered certain brands and explicitly excluded the ones your cook used? That would probably make the cook less happy and less effective. Yes, happiness is important. Your employees perform their best when they use their favourite tools. This can either be Vim, their own ergonomic keyboard or even Linux instead of Windows.
Every restriction you add increases friction and decreases output.
No, it's not about installing Bonzi Buddy, it's about giving your people the best tools (the tools they like) to perform their best. Sometimes this incurs risks like unpatched vulnerabilities, like any software, but to go and paint this as some sort of entitled attitude developers have is plain ridiculous, honestly.
I think that Mastodon's problems are less than 10% technical.
That's not to say ActivityPub isn't a pretty trash protocol, insecure by default (no E2EE), wide open to abuse, and very wasteful (because posts have to be replicated in every server, making unnecessary copies of a post that aren't then distributed via P2P).
But the social issues of pretty big Mastodon instances blocking other smaller instances with complete impunity, means the Fediverse as a community (not a protocol) encourages bullying and isolation. I find this extremely troublesome in the wake of the Capitol attack, fake news campaigns, State-sponsored disinformation campaigns and everything else that is wrong with social media today.
You will get your server banned from other servers if your server doesn't ban the servers these servers ban (second-grade sanctions). You can get banned for not moderating enough, or for incompatible code of conducts. You can get banned for an instance that is too small, as other admins believe you are using it for ban evasion.
The worst part is the user can't know if the posts they make will be seen in other servers. They can't know if sending messages to other user will work. They can't opt out of these admin-imposed forceful defederations.
And even worse: it is absurdly simple to push illegal content like child pornography into other servers, making these servers store illegal content in their hard disk. And the only way to avoid this is to have server administrators manually see the offending post and possibly block the offending domain. Perhaps with the help of users reporting this post.
If Mastodon is the best Twitter alternative, I think nothing can replace Twitter as it is today.
That is a pretty disgusting statement. What ""the science"" are you talking about?
The vast majority of doctors and scientists strongly recommend taking the vaccine. It is not about stopping 100% of illnesses and infections, but it is 100% about significantly reducing the chance of hospitalisation and death.
What are you talking about? Sounds like the time to reflect is all yours.
In my company, we have additional security measures and guardrails on top of the bare minimum legally required, but most companies indeed see security as a cost center and decide not to invest until it's too late.