Hacker Newsnew | past | comments | ask | show | jobs | submit | AndrewStephens's commentslogin

IBM was legendarily over-managed. This is second-hand but a guy I used to work with told a story of when he interned for a summer at IBM in London during the mid-90s doing what would now be called a QA engineering. At that time everyone wore suits to work but the culture was changing so the interns put in a request to be allowed casual Fridays. Bear in mind that they were locked in a back room somewhere without any customer interaction so they didn't think it was a big deal.

Months later, just before the end of the internship, they received a reply. Their manager had forwarded their request up the chain of command and the email had the full quoted history. Their request had been bumped up 4 successive layers in the London office, then across to the US headquarters where it continued its upwards trajectory, finally alighting on the desk of a VP who, after thanking them for bring the issue to his attention, rendered an carefully considered opinion.

The whole process had taken weeks, presumably as each person in the hierarchy debated whether they had the authority to tackle such a weighty issue.

The email had then been inexplicably bounced back DOWN the chain one link at a time, back across the Atlantic Ocean, and through the local office, down to the suit-bound interns, again weeks later, who by this stage only had days left at the internship.

The answer was no.


In the late 90s I moved from one country to another. As a part of a job hunt I applied to the local IBM office, because I had some OS/2 mileage. Then promptly got three offers from other places, accepted one and completely forgot about the IBM application.

Not 8 (eight) months later I got a call from their HR saying they'd like to interview me next Thursday. And then they got completely flabergasted when I said I was no longer interested. Don't know what they were smoking, but they were exceptionally full of themselves... while not even offering a good pay.


When I went to a grad jobs fair in 1998 or so IBM were offering at least 25% less than any other company I spoke to, and 40% less than the best paying roles.

The only company they were on par with was Arthur Andersen, who were offering around £15k for trainee accountant roles, but you know how fast those salaries go up once you’re qualified and start to progress.


My dad was am IBM lifer, when they said they could wear suits that weren't black he wore a blue suit and his boss asked him if he rode the bus to work.

Wait, I'm confused. Was that supposed to be an insult?!

This is a very legitimate question: In the US, where is it not?

Public buses aren't safe, clean, or timely. Where I am, it's 2.5 hours rather than a 26 minute commute by car. The only reason you ride one is usually if you are already in the proximity of your destination, especially if that destination is downtown. For all other cases, private or ride-share makes way more sense. We're talking buses here, not shuttles, light rails, monorails, etc.


In other countries most people use public transportation and small percentage uses car

Many in the US also use public transportation when they can but busses are generally thought of as a last resort. Unlike trains, teams, or subways their schedule is at the whim of traffic. So the general thinking is that if you are going to be stuck in traffic anyways you might as well be comfortable in your own car if you can afford one.

US is different, deal with it.

London buses are a pleasure in contrast.

I worked at IBM Research, totally unlike the rest of IBM in terms of how it was run, and being a non-US person it was quite natural for me to take the bus to work because either that or train is how you get to work. I never met any coworkers on there, although I did get to know the cafeteria staff, cleaners, and so on, who all caught the bus, quite well.

Interesting, IBM sales and consulting were infamous for sending in an army of blue suits in

That would have been in the 1980s.

I interned at an IBM R&D site in Winchester (UK) for a year in 1988-89 and none of us interns wore suits, or even ties. I don't recall many of the f/t IBMers doing so either. It was pretty informal really.

(Not disputing your story, just providing a different perspective.)


I work with a lot of government departments. The "policy" is not a thing that can enforce itself, and often barely exists at all. Rarely is it actually written down!

Mostly these things boil down to a vetocracy where all managers in some hierarch must say 'yes', otherwise a single 'no' is a final 'no'.

Hence, the trick is not to ask because the more people are involved the higher the chance that one of them will say 'no'.

The manager in that office you worked in most likely made a decision themselves and didn't punt it up the hierarchy, and hence nobody told him 'no'.

The corollary to that is a clever bureaucrat can kill a proposal simply by inviting many decision makers to a meeting.

PS: It's hilarious to see this effect play out as a consultant, because often I deal with different "randomly" selected subsets of the same organisation and the difference in their day-to-day can be stark. It just boils down to which managers take individual responsibility, and which regularly beg for permission to do their job. "No."


> The corollary to that is a clever bureaucrat can kill a proposal simply by inviting many decision makers to a meeting.

My version of this:

For my friends, everything; for my enemies, pull security in.


> The corollary to that is a clever bureaucrat can kill a proposal simply by inviting many decision makers to a meeting.

Not particularly clever. My experience is that low-level team/line managers typically already have the authority to say "no" to their own people; but they don't want to take the blame for saying "no" (they want their team to like them!), so by punting the decision up the chain, they're effectively punting the blame for saying no up the chain (under the expectation that anything so punted will get a "no" response.)

Some this backfires, though: everyone above them says yes, and so they have to be the one to say no. (They may end up lying if asked, vaguely saying "someone important" said no.)

Sometimes this backfires badly: not only does everyone above them say yes, but someone somewhere up the chain loves the idea, and turns it into an "initiative" — i.e. something the line-level manager is now locked into doing.


> Sometimes this backfires badly: not only does everyone above them say yes, but someone somewhere up the chain loves the idea, and turns it into an "initiative" — i.e. something the line-level manager is now locked into doing.

I've seen a variant of this (repeatedly!) where a sales person will suggest the bronze/silver/gold/platinum edition of some product to a manager, the decision goes up the chain (unnecessarily), and then someone near the top says: "Platinum sounds the best!". Nobody dares take responsibility for suggesting "anything less than the best", so it gets locked in.

Meanwhile, the platinum edition exists only to make the silver and gold pricing look reasonable, so now... now... the consultant has to implement a solution based on the "bells & whistles edition" which takes 10x as long and has a bunch of issues. E.g.: "clustered" versus simply "active-passive" or weird nonstandard high bandwidth ports instead of ordinary Ethernet, etc.


> Hence, the trick is not to ask because the more people are involved the higher the chance that one of them will say 'no'.

So in my case at IBM the trick to being able to keep a hand-and-a-half sword in your office is to just have it appear there one day. My boss did a bit of a double-take the first time he saw it but that was the only reaction I got.

They did have a "no firearms in the building" policy but that didn't extend to medieval edged weapons, although there may have been a change made after I left.


And I thought I was crazy for keeping a crowbar in the office...

(I work at a particle accelerator and we need to protect ourselves for interdimensional breaches)


Do you truky, in your heart of hearts, believe that?

It is obviously a joke, but I bought it after several visitors asked us if we didn't have a crowbar xD

Wouldn't you also want to keep a can of spray paint to draw the Elder Sign? You know, in case it was needed in a hurry.

Come to think of it, does an Elder Sign still work if you spray it onto a wall using a template? I think you need to investigate that the next time there's a breach... you've got plenty of interns right?


I need to ask me Warhammer colleague...

Mr. Show, "Change for a Dollar": https://www.youtube.com/watch?v=KyocQT4Vn2g


I love First City Wide. They really came through when I was heading out to go camping and knew I might need quarters for the showers.

I have a few of these.

I asked to be excepted from a contract condition giving IBM first pick on any IP I develop in my own time.

Keep in mind, I was working in one of their technical support call centres. I had no access to IBM proprietary information, I had no role in developing it, I was a complete non risk on this front. I had more access to customer systems, no access to RED or BLUE networks, just an IBM lotus notes account I could use to slowly download information from HR.

Everyone I could physically speak to looked at my request and went, hey that's a really reasonable request.

It took 6 weeks for the first no to come back, my direct manager, whose stats I was apparently holding in place, apparently tried to intercede, adding 2 further weeks for a review. The answer was still no. This had apparently gone up through one line of reporting across to the US, branched out into legal and came back down that path. It was crazy.

So I left, so I could work on a small software project with a friend without risking IBM having an interest in it.

Another one. The HR forms were all written in the early 80s and digitised sometime in the 00s. Our team, not being customer facing, was super diverse. I know there was an attempt to try and get the HR forms updated to recognise other gender/pronoun combinations. This took like 12 weeks to be reviewed, and I think the eventual no was based entirely on the fact that no one wanted to try and figure out whose job it was to update the forms. Our team was full of LGBT people, and retention of them appeared to be critical. Hard no.

Also, our sexual harrassment training came on tape (in the year of our lord two thousand and ten) and implied that it was the updated version, previously it might have been vinyl or something.


This sent me down a rabbit hole. In the US, the PIIA effectively is the law - your employer gets to decide whether your side project "relates to their business." In the EU (where I am) it's basically: not on a work laptop, not on work hours? Yours.

I'm fine here :)


i never want to work at IBM. it sounds like hell

A coworker of mine got his first job at IBM after graduating from what was effectively an early version of a tech trade school when tech trade schools were not common.

He showed up to work at an IBM hardware factory in the US and as soon as everyone walked in the door they was called into a meeting that day. IBM announced they were all laid off immediately. IBM having almost no experience with layoffs to that point and still styling itself as a company you go to work at for life seemed to be legitimately unsure what to do.

So they gave everyone minimum 1 years pay, benefits, IBM actually assigned HR people who were VERY involved in trying to place people other places and paid many to relocate them, and what amounted to a 4 year scholarship too if they wanted to use it.

Dude had been there less than an hour and decided to just go back to school for 4 years ...


Good story but in fairness the "no" decision was usable for the next set of interns.

Was? Is.

Aaronson know his stuff but I am not sure he hasn’t considered the fact that, in this current hype cycle, the quantum researchers breathlessly reporting to him on a breakthrough just around the corner are just lying to him and themselves.

I have been hearing about one more technical hurdle to solve before quantum algorithms become feasible since before I graduated. That was in 1996.


This is true, practical quantum computing is always "just a couple of years away".

At the same time, moving to more secure encryption really isn't difficult. How many times have algorithms been deprecated over the past 20 or so years? It's time to do it again.

Let's just make sure that the NSA hasn't worked in any backdoors. At latest since Snowdon, anything they work on is suspect.


There is no clear evidence that the risk of "a practical post quantum computer would arrive in the next 5 years" is greater than "post quantum scheme X is broken" for any scheme X. The only way to go is hybridation and it is quite hard from an engineering point apparently.

There is evidence of the opposite: graph singular isogeny mumbo jumbo algorithm was proven to be easily broken on an ordinary computer.

Hybrid encryption is as simple as running one encryption and then the other. Problem is mostly that post quantum keys are large.


Am I missing something fundamental here?

If Algo-A and Algo-B both rely on "factoring big numbers is hard!" then once the Quantumpocalypse occurs, breaking Algo-B(Algo-A(plaintext)) is no harder than asking ChatGPT 99.5 to add an extra step in your vibe coded cracking engine's frontend, such that it now does B_breaker < cyphertext | A_breaker >> plaintext.lol or whatever the equivalent is for the fashionable language of the that future day.


He was saying hybrid encryption as in use both a well established classical "factoring big numbers is hard!" algo and also a fancy new post quantum cryptography algo. That way if it turns out the fancy new algo can be broken by non-quantum computers at least you aren't in a worse position than you were in before because you are still protected by the well established classical algo.

You have to break both algorithms. One of them is quantum-safe if it's secure, but it could also be completely insecure like supersingular isogeny was.

I hard disagree with your assertion that moving to more secure encryption isn't difficult. It is insanely difficult, especially at global scale.

And in the process immediately convert huge numbers of devices into ewaste. Then check the excuse calendar again for tomorrow's reason to deprecate yet another batch of "legacy" ciphers from openSSL.

The sooner we start making devices ready for better encryption systems, the fewer devices will be wasted.

No, because there always are "better encryption systems", whether for good reasons or not that's another story.

It's not another story, the quality of the reasons for scrapping / upgrading devices is the most important thing here.

If the reasons are "the current devices are insecure or likely to become insecure" that's very different from "the new encryption system is a little bit better so there's not much point in upgrading".

If quantum computing never becomes a practical thing, the current hardware and software will stay secure. If it becomes practical, they won't. Seems simple enough.


It'll be a 90/10 rule: 90% of the upgrades will be straightforward. It's important the 10% that'll be hard early. For many it's probably already too late.

Are you saying this because it's an evergreen joke or because you really think there hasn't been meaningful progress in the field since 1996?

Duke Nukem Forever was release fifteen years ago. Some things never happen until they suddenly do.

The wolf really does eat the boy at the end of The Boy Who Cried Wolf.


But Duke Nukem was developed with visible progress.

We are still not factoring 21, let alone 35, let alone numbers with thousands of digits.


Quantum correction algorithms (that would allow factoring of thousands of digits) begin to work when the gate fidelity and other parameters are above certain threshold.

> gate fidelity and other parameters are above certain threshold

A threshold that might be beyond what the physical properties of our universe allow. It is still unclear.


This is what bugs me about both quantum computers and commercial fusion power. There's so much talk about how it's just inevitable and will happen soonish, but a lot of the evidence suggests, in some cases strongly, that it might not ever be possible.

I find it weird how bleeding edge research, at the very edges of both physics and engineering, is treated as though it's a market development about to drop. Possibly a consequence of pure R&D having all but died? Getting funded requires pretending there's a business plan for what you're working on?


There's no strong evidence of impossibility. For quantum computers to be impossible at scale we need new unknown physics. Fusion requires lots of engineering. And before those engineering efforts would show practical impossibility or impracticality, there can't be strong evidence.

By not ever be possible, I mean in a practical sense, including e.g. the economics of it, as well as reliability, checkability, etc.

Jassby's article about fusion (https://thebulletin.org/2017/04/fusion-reactors-not-what-the...) describes several well-understood issues that could prevent commercial fusion power from ever being practically possible.

For quantum computers, the situation is quite similar. Michel Dyakonov and several others have laid out the situation well.

At least we don't have anyone claiming that interstellar travel is just 10 years away, yet. Probably because it's more difficult to make an economic case for it. But the issues are quite similar. In principle, in terms of physics, nothing prevents an interstellar journey. In practice, it just isn't going to happen.


This possibility means discovery of new physics that has no indications of existence yet.

The Boy Who Cried Wolf is a story about a boy who have seen a wolf, successfully threatened the wolf away by causing a commotion in a disbelieving village. One day the disbelieving village refused to show up, boy was eaten and thus proven correct.

But as it happens in real life politics too, people who were just proven they were wrong continued to blame the boy.

The story is told from the point of view of a villagers trying to hide their culpability by blaming the victim.


That's one way to completely reframe the story to fit the narrative you want to push

> The Boy Who Cried Wolf is a story about a boy who have seen a wolf, successfully threatened the wolf away by causing a commotion in a disbelieving village

What happened before that in the story


quantum computers will flourish the same day that fusion does.

I have been trying for years to get good at 3D modeling with Blender and have also failed. But I didn’t let that stop me using Blender to produce illustrations for my sci-if epic interactive fiction game that ended up being nominated for a minor award for graphics (it didn’t win).

Let me introduce you to the last resort of the struggling artist - extreme stylization. Really good pixel art is a very difficult discipline but terrible pixel art can be just as appealing if you push a style you can call your own.

Be bold.


What terrible pixel art would you say is good?


A lot of the original 8bit games that pixel art tries to invoke have quite terrible art, even by the standards of the day.


Good point. It's really cool how new this artform is. I bet there's a good book on its evolution out there.


I haven’t had comments on my blog for over a decade now and I don’t miss them. For every useful and informative comment I got several spammy or rude reply. Anyone who wants to let me know something about my blog can message me on social media.

I’ve seen blogs that do not host comments themselves but instead automatically surface social media (usually mastodon) comments which I think is a useful technique.


I've had comments (open, anonymous, no screening) on my blog since it started in 2004. Back in the day when it was very popular, most of my blog posts were the result of reader tips/advice/heads-up/etc. I have to work MUCH harder now that comments have pretty much dried up.


Yes, unfortunately spam and rude replies come with comments. I also don't have comments on my blog. I instead have one of those email masking services that allows to people to email me (and I have found this effective).


> Anyone who wants to let me know something about my blog can message me on social media.

But, can they?


Well, probably. And if not there is always good old fashioned email.

Almost nobody actually contacts me but it is technically possible.


Isn't that that point of POSSE[1]? Host your blog, post a link to it on social sites like Mastodon, and let the conversation happen on Mastodon.

[1] https://indieweb.org/POSSE


I love this (and submitted my blog) - people bemoan the death of the Old Web™ but in reality there is still heaps of great content being created.


A well written piece on a sad state of affairs.


You are not alone.

I got criticism on my blog for using a serif font but those people are just … wrong. Serif fonts are just better for reading at all font sizes.


I wouldn't say they are wrong but complaining about a serif point seems very weird to me. Aren't there better things to complain about?


> I was put through the mill of getting higher level security clearances so I could be assigned to classified projects. Fortunately, I never was.

Sure was lucky you didn’t work on any of those classified projects - <wink>


The company had decided to move networking R&D to Colorado Springs, where they supported USAF facilities, and I didn't want to leave Silicon Valley for that.


Sure <wink>


I get the sentiment but micropayments just don’t work - the main problems are not technical but social. Even in the gaming sector, nobody really charges less than about a dollar for items - that is the smallest unit of money where putting up with fraud, complaints, and chargebacks becomes worthwhile.

Add to this the huge race to the bottom (they are charging 3 cents for their article, read my summary for 2 cents) and you quickly begin to see why micropayments have never taken off.

Finally, I wrote a blog post along these lines with more detail[0]. For those who disagree, ask yourselves; would you pay me 2 cents before you click that link.

[0] https://sheep.horse/2024/11/on_micropayments.html


The problems you describe are technical problems. How do you increase efficiency and avoid charge-backs due to fraud? Perhaps it is enabled by cryptocurrency (some systems like payment channels, RaiBlocks already exist for this). I would go into more detail about this but I think i've already debated you about this already.

The entire field of cryptography is about developing technical solutions to previously intractable social problems.

As I have described earlier, the race to the bottom is a feature, not a bug. It encourages other sites to mirror your content.

I would pay you 0.002 cents before clicking on that link. I already have to expend time and energy reading it, and I already pay for an internet connection to read it. If you put some sort of PoW firewall to deter AI scraping like many sites have been doing, I already have to expend money in the form of electricity to access the site.


> As I have described earlier, the race to the bottom is a feature, not a bug. It encourages other sites to mirror your content.

The problem is that bottom in this case is “free, with ads.” As soon as you post your well researched expensive to produce content, I will summarise it and offer 90% of the experience for free. That’s if Google doesn’t do it first with AI summaries.

There are plenty of crypto projects that tried to do micropayments. They failed mainly due to technical reasons but if they had worked they still would not have gained traction - nobody wants micropayments.


this is a good counterpoint, but I would say this in response:

1. Ad networks tend to benefit from having more data. There are economies of scale for sites like Youtube vs random pop-up video hosts that would want to mirror youtube videos, for example. The "bottom" may still be a micropayments system because they're easier to deploy.

2. It's possible that the entire ad economy is destroyed anyways through the use of adblockers, which is increasing. Hence google's push for WEI and the general industry push for TC and such. As long as none of these mechanisms of client authentication are able to take over the web, the profitability for ad networks will dry up.

Absent micropayments, there will be other attempts to introduce sybil resistance to the web, due to threats like AI scraping. Currently people are deploying PoW-based solutions, because they are the lowest effort (they can be implemented by polyfill). I imagine a hybrid PoW/micropayments system could emerge where PoW mining shares could be used interchangeably with micropayments. Basically each website acts as a cryptocurrency mining pool, so the website gets some reward in the mean.

I think the main failure of micropayments lies in the integration with the web browser, it needs some sort of plugin where HTTP 402 is effortless to interact with. It goes without saying that if you don't build it, they won't come.

There is not really a "killer app" yet. Some attempts in the bitcoin community like nostr and stacker.news are marginally used (but only to facilitate bitcoin dork-to-dork communication), and there have been some experiments in live-streaming and gaming. But nothing stands out. The barrier to entry of any app that requires putting money in, even a small amount, is naturally very high. A hybrid PoW/micropayment system is promising because it has the lowest barrier to entry.

On the technical side, you have tradeoffs between the complexity of using the app (especially with bitcoin payment channels) and decentralization. I don't regard it as an intractable problem.

The social problem is that most internet users are short-sighted and don't care about decentralization. They are just looking at some new company/service to throw their money into and escape their current service provider, which creates the problem they are running from. See: users fleeing twitter for bluesky, users fleeing streaming services after fleeing cable.

So pretty much any solution with a tradeoff between complexity and decentralization will suffer compared to a totally centralized and simple solution.

The decentralization of the new system needs to enable some new feature to get a foothold. Facilitating piracy is one such example, it could be the "killer app" for micropayments. Sites like Anna's archive already have some sort of cryptocurrency donation mechanism.


That just moves the fraud to the other direction by making it hard for legitimate chargebacks. Say someone steals your card info, then uses it to buy some news crypto.


Firstly, that appears to be a negative externality. It seems to affect people who use the conventional credit card system as opposed to the new cryptocurrency/micropayments system I propose. So it has the effect of strengthening the cryptocurrency/micropayments system against competition.

For example, I would say that the credit card system is essentially subsidized through other forms of payment via transaction fees/cashback (I can go into detail why I think this is the case, if you would like). This is a mechanism that benefits the credit card companies at the users of other payment mechanisms (cash, crypto, etc.). So this mechanism of the credit card payment system has the effect of strengthening it against competition.

Secondly, I am not even sure if it's a negative externality. It depends on how fraud is handled in the conventional banking system and who takes the blame. Let's say that the charge-back goes all the way to the exchange, so now the exchange that facilitated the transaction is down both X cryptocurrency and Y dollars. In order to be profitable, the exchange needs to charge more in fees and needs to spend more in surveillance to counteract fraud. So ultimately the users of the exchange would pay for fraud.

Lastly, it is important to differentiate the two sources of fraud. There is the fraud inside of the micropayments system, where I pay 0.01 cents to view a webpage and I don't receive what I want. That's a very low-risk fraud, and by gaining a fraction of a cent, they can lose like 100x that in potential business through micropayments.

Then there is the fraud that happens at the border of "hard" money (cash/precious metals/crypto) and "soft" chargeback-able money in the conventional credit card system. This is pretty much facilitated just by these hard forms of money existing and being exchangeable with soft money. I would argue the weakness lies in the insecurity of the soft money systems (specifically the outdated systems of authentication). But you could still apply some sort of limit to the amount of money a single bank account can exchange for crypto (say, $20 a day) without hurting the micropayments system, because the payments involved are so small. So the risk of fraud at the exchange could be much lower for this specific use-case of cryptocurrency.


Even in a fully crypto world there is still boundless fraud potential. Even more than traditional banking.

The most obvious one that comes to mind is someone gets a script to run on your browser that loads a ton of the attackers 1 cent paywall articles. Any legitimate financial tool needs a way to roll back fraudulent transactions.


I imagine that the micropayments system would be facilitated transparently through some popup in the browser, similar to how the browser asks for use of your webcam. I also imagine that some basic, configurable limits would be involved. It would look like "Give news.com ability to request up to 0.10 cents (0.01cents per page load)? Y/N". The first time you load the page.

This is an aside, but in an ideal world, such a mechanism would also be used to reduce fingerprinting! You would have to accept a popup for a page to use features like WebGL, for example.

>Any legitimate financial tool needs a way to roll back fraudulent transactions.

I strongly disagree. I would even say the opposite: the ability to bureaucratically roll-back transactions threatens the legitimacy of money. Specifically, it makes the money non-fungible.

In cryptocurrency, there are transparent multisignature-based escrow systems that allow you to have a defined window of time where the money is co-managed according to certain rules. But transactions need to be able reach a "finalized" state where they are irreversible. Otherwise you just can't ever have a truly secure method of payment between untrustworthy parties and micropayments become useless.

Also, it does not need to be cryptocurrency. Micropayments just need to be efficient, secure, and irreversible. There are other payment systems based on Chaumian cash, (GNU taler being one example) that this could be built on.


But how many people would really go to another site just to save 0.002? I can already go to the internet archive to read paywalled content. If needed and that option will still be available for the people that dont want to pay the 0.002.

Its a social problem and all it takes is one player breaking through. People have done this with far far worse things that people thought were unviable socially. Microbetting, microloans, gaming microtransactions, hardware subscriptions,


Your response is predicated on the fact that sites like archive.org already exist and don't charge. In a world with accessible micropayments, I think pretty much everyone would charge.

Sites like the internet archive are already funded by donations from viewers like you. I see the scheme as essentially spreading out the donations based on who uses the most bandwidth. It makes it easier for anyone to spin up a mirror of archive.org, and it makes it more secure for sites like archive.org to accept donations.

"Intermediate" micropayment solutions already exist. Anna's archive charges like $5 a month for a "donation" that puts you in a fast lane to download PDFs that you would otherwise have to get from some book site or a scientific journal. I bet they would prefer to charge per-download if they could feasibly do it.

I agree that some (most?) applications of micropayments are really gimmicky. But some applications are naturally suited to micropayments. The advantage of micropayments is that you can interact with ad-hoc vendors without setting up a pre-existing financial trust-relationship. For example, you could be at an bus terminal and have several pop-up vendors for wifi or electricity that charge per MB or per watt-hour. It enables competition.

The more gimmicky applications you mention like hardware subscriptions all involve some element of vendor-lock in that prohibits the advantage of micropayments systems in dealing with ad-hoc vendors. This is more analogous to those in-flight wifi services on airplanes: there is an established financial relationship with the airline and no competition, so there's little use for the low-risk micropayments.


I dont think everyone would charge. I think everyone who currently runs ads would charge but there would still be purists who host without ads and without micro transactions. It would still cost to implement the processing on your website and simple sites would not want to do this. It might lower the barrier to donation so sites funded by donation could receive more donations but still keep it optional.

Internet archive is not funded on donations from viewers. Its funded off government grants and corporate donations. individual donations make up a tiny %. Micropayments would make Internet archive less reliant on charity from government and corporations and it would not impact peoples ability to spin up a mirror. people can already spin up a mirror but its expensive and would remain expensive.

Anna's archive is whale pricing, a tiny % of people are willing to pay that $5 and the hope is that they subsize costs for the rest of users. I hate this type of monetization and will always oppose it as its highly risky and unfair.


> For those who disagree, ask yourselves; would you pay me 2 cents before you click that link.

A straw man. That's not the only way to do it. Asking this instead is helpful: "what might make this work?" and explore that in depth and try some experiments.* It might be a collective action problem or a first-mover problem or a culture problem. Such classes of problems are hard, sometimes even insanely hard for anyone lacking massive influence, but not categorically unworkable or impossible.

> I get the sentiment but micropayments just don’t work

I don't buy this generalization. Maybe micropayments don't "work" yet according to some (unstated, unfortunately) ideas of scope or degree. But smallish payments have worked (to some degree, for some periods of time) for music downloads and political contributions, just to mention a few things. There is something to smaller-than-usual payments, this seems pretty clear. (Yes, there is a sort of lower quantum based on the slice a payment processor takes, so creative bundling is often needed.)

Maybe micropayments according to some particular definition are unlikely to work for online content under current constraints. Still, the world is a big place, and the future (hopefully) leaves a lot of room for experimentation.

Aside: maybe a bigger problem is the status-quo idea of "news". Most of the "news" I real feels almost like junk food.

* I prefer to ask "what would make something work?" or "what is blocking something from working?" rather than claiming "X can (or can't) work". This is not because I'm naive or an optimist. I'm neither. But I'm genuinely curious about how and why things work, and the way one frames the question has a big effect on where your brain leads you.

P.S. WRT exaggeration or overconfidence: just say no. Let's make nuance the norm. It can start here, one comment at a time.

P.P.S. I'll say this again, and it _should_ make people uncomfortable: I'm getting more value out of interacting with a high quality LLM with a solid prompt than a typical comment on HN, and this does not bode well. I still hope that people can step it up, but we're not there yet, for various reasons.


This is great. I run a server for my blog and can confirm idiotic bots continually hammer port 22. Sometimes I check my SSH logs just to see what is going on but I’ve never detected anything cleverer than trying common username/pw combinations.

It seems a little pointless, surely every server actually accepting SSH passwords has been 0wned year ago.


Even on a random port (well I picked port ___22) I get random SSH attempts.

My solution is convoluted: On my NAS I have a PHP form that accepts a password, when it's correct, set a flag (in the form of touching a file), and every minute a cronjob runs a bash script to check for the existence of the file: if it exists, then run a python script to talk UPnP to my home router to tell it to forward port ___22 to my NAS' port 22.

Hmm, probably running a VPN server, like WireGuard, makes more sense..


I have gotten what looks like SSH, TLS, HTTP, and other things, on various ports.

Another possible way would be port knocking. (I had previously set up port knocking on my HTTP server, but there seems to be a bug in the kernel (or in some driver) that prevents it from working correctly, so now the HTTP is not available. Using port knocking to restrict access to HTTP is probably not common, and might prevent your solution from being used if the form uses HTTP.)


I just disable SSH passwords and force using a certificate, which should be immune to bots barring some horrible unknown flaw in the ssh daemon.

Running over a VPN service would have the much the same effect.


I know, at some level, it seems crazy that the bots are spending so much time on this. However, there are plenty of machines on the Internet, and presumably most of these bots' machines were captured using this same technique.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: