We have a sur­prise for you to­day: Raspberry Pi 4 is now on sale, start­ing at $35. This is a com­pre­hen­sive up­grade, touch­ing al­most every el­e­ment of the plat­form. For the first time we pro­vide a PC-like level of per­for­mance for most users, while re­tain­ing the in­ter­fac­ing ca­pa­bil­i­ties and hack­a­bil­ity of the clas­sic Raspberry Pi line.

Get your Raspberry Pi 4 now: http://​rpf.io/​ytrasp­ber­rypi4 #RaspberryPi4 Subscribe to our YouTube chan­nel: http://​rpf.io/​yt­sub Help us reach a wider au­di­ence by trans­lat­ing our video con­tent: http://​rpf.io/​yt­trans­late Buy a Raspberry Pi from one of our Approved Resellers: http://​rpf.io/​yt­prod­ucts Find out more about the #RaspberryPi Foundation: Raspberry Pi http://​rpf.io/​ytrpi Code Club UK http://​rpf.io/​ytc­cuk Code Club International http://​rpf.io/​ytcci CoderDojo http://​rpf.io/​ytcd Check out our free on­line train­ing courses: http://​rpf.io/​ytfl Find your lo­cal Raspberry Jam event: http://​rpf.io/​yt­jam Work through our free on­line pro­jects: http://​rpf.io/​yt­pro­jects Do you have a ques­tion about your Raspberry Pi?

Get yours to­day from our Approved Resellers, or from the Raspberry Pi Store in Cambridge, open to­day 8am–8pm!

Here are the high­lights:

* Two USB 3.0 and two USB 2.0 ports

* Dual mon­i­tor sup­port, at res­o­lu­tions up to 4K

And here it is in the flesh:

This is the first time we’re of­fer­ing a choice of mem­ory ca­pac­i­ties. We’ve gone for the fol­low­ing price struc­ture, re­tain­ing our sig­na­ture $35 price for the en­try-level model:

As al­ways these prices ex­clude sales tax, im­port duty (where ap­pro­pri­ate), and ship­ping. All three vari­ants are launch­ing to­day: we have ini­tially built more of the 2GB vari­ant than of the oth­ers, and will ad­just the mix over time as we dis­cover which one is most pop­u­lar.

At first glance, the Raspberry Pi 4 board looks very sim­i­lar to our pre­vi­ous $35 prod­ucts, all the way back to 2014’s Raspberry Pi 1B+. James worked hard to keep it this way, but for the first time he has made a small num­ber of es­sen­tial tweaks to the form fac­tor to ac­com­mo­date new fea­tures.

We’ve moved from USB mi­cro-B to USB-C for our power con­nec­tor. This sup­ports an ex­tra 500mA of cur­rent, en­sur­ing we have a full 1.2A for down­stream USB de­vices, even un­der heavy CPU load.

To ac­com­mo­date dual dis­play out­put within the ex­ist­ing board foot­print, we’ve re­placed the type-A (full-size) HDMI con­nec­tor with a pair of type-D (micro) HDMI con­nec­tors.

Our Gigabit Ethernet mag­jack has moved to the top right of the board, from the bot­tom right, greatly sim­pli­fy­ing PCB rout­ing. The 4-pin Power-over-Ethernet (PoE) con­nec­tor re­mains in the same lo­ca­tion, so Raspberry Pi 4 re­mains com­pat­i­ble with the PoE HAT.

The Ethernet con­troller on the main SoC is con­nected to an ex­ter­nal Broadcom PHY over a ded­i­cated RGMII link, pro­vid­ing full through­put. USB is pro­vided via an ex­ter­nal VLI con­troller, con­nected over a sin­gle PCI Express Gen 2 lane, and pro­vid­ing a to­tal of 4Gbps of band­width, shared be­tween the four ports.

All three con­nec­tors on the right-hand side of the board over­hang the edge by an ad­di­tional mil­lime­tre, with the aim of sim­pli­fy­ing case de­sign. In all other re­spects, the con­nec­tor and mount­ing hole lay­out re­mains the same, en­sur­ing com­pat­i­bil­ity with ex­ist­ing HATs and other ac­ces­sories.

To sup­port Raspberry Pi 4, we are ship­ping a rad­i­cally over­hauled op­er­at­ing sys­tem, based on the forth­com­ing Debian 10 Buster re­lease. This brings nu­mer­ous be­hind-the-scenes tech­ni­cal im­prove­ments, along with an ex­ten­sively mod­ernised user in­ter­face, and up­dated ap­pli­ca­tions in­clud­ing the Chromium 74 web browser. Simon will take an in-depth look at the changes in to­mor­row’s blog post, but for now, here’s a screen­shot of it in ac­tion.

Some ad­vice for those who are keen to get go­ing with Raspbian Buster right away: we strongly rec­om­mend you down­load a new im­age, rather than up­grad­ing an ex­ist­ing card. This en­sures that you’re start­ing with a clean, work­ing Buster sys­tem. If you re­ally, re­ally want to try up­grad­ing, make a backup first.

One no­table step for­ward is that for Raspberry Pi 4, we are re­tir­ing the legacy graph­ics dri­ver stack used on pre­vi­ous mod­els. Instead, we’re us­ing the Mesa “V3D” dri­ver de­vel­oped by Eric Anholt at Broadcom over the last five years. This of­fers many ben­e­fits, in­clud­ing OpenGL-accelerated web brows­ing and desk­top com­po­si­tion, and the abil­ity to run 3D ap­pli­ca­tions in a win­dow un­der X. It also elim­i­nates roughly half of the lines of closed-source code in the plat­form.

Connector and form-fac­tor changes bring with them a re­quire­ment for new ac­ces­sories. We’re sen­si­tive to the fact that we’re re­quir­ing peo­ple to buy these: Mike and Austin have worked hard to source good-qual­ity, cost-ef­fec­tive prod­ucts for our re­seller and li­censee part­ners, and to find low-cost al­ter­na­tives where pos­si­ble.

Gordon has been work­ing with our de­sign part­ners Kinneir Dufort and man­u­fac­tur­ers T-Zero to de­velop an all-new two-part case, priced at $5.

We’re very pleased with how this has turned out, but if you’d like to re-use one of our ex­ist­ing cases, you can sim­ply cut away the plas­tic fins on the right-hand side and omit one of the side pan­els as shown be­low.

Good, low-cost USB-C power sup­plies (and USB-C ca­bles) are sur­pris­ingly hard to find, as we dis­cov­ered when send­ing out pro­to­type units to al­pha testers. So we worked with Ktec to de­velop a suit­able 5V/3A power sup­ply; this is priced at $8, and is avail­able in UK (type G), European (type C), North American (type A) and Australian (type I) plug for­mats.

If you’d like to re-use a Raspberry Pi 3 Official Power Supply, our re­sellers are of­fer­ing a $1 adapter which con­verts from USB mi­cro-B to USB-C. The thick wires and good load-step re­sponse of the old of­fi­cial sup­ply make this a sur­pris­ingly com­pet­i­tive so­lu­tion if you don’t need a full 3 amps.

Again, low-cost mi­cro HDMI ca­bles which re­li­ably sup­port the 6Gbps data rate needed for 4Kp60 video can be hard to find. We like the Amazon Basics ca­ble, but we’ve also sourced a 1m ca­ble, which will be avail­able from our re­sellers for $5.

At the end of last year, Raspberry Pi Press re­leased the Official Raspberry Pi Beginner’s Guide. Gareth Halfacree has pro­duced an up­dated ver­sion, cov­er­ing the new fea­tures of Raspberry Pi 4 and our up­dated op­er­at­ing sys­tem.

Bringing all of this to­gether, we’re of­fer­ing a com­plete Desktop Kit. This is priced at $120, and com­prises:

* An of­fi­cial mouse and key­board

This is the first prod­uct launch fol­low­ing the open­ing of our store in Cambridge, UK. For the first time, you can come and buy Raspberry Pi 4 di­rectly from us, to­day. We’ll be open from 8am to 8pm, with units set up for you to play with and a cou­ple of thou­sand on hand for you to buy. We even have some ex­clu­sive launch-day swag.

If you’re in the bot­tom right-hand cor­ner of the UK, come on over and check it out!

Since we launched the orig­i­nal Raspberry Pi in 2012, all our prod­ucts have been based on 40nm sil­i­con, with per­for­mance im­prove­ments de­liv­ered by adding pro­gres­sively larger in-or­der cores (Cortex-A7, Cortex-A53) to the orig­i­nal ARM11-based BCM2835 de­sign. With BCM2837B0 for Raspberry Pi 3B+ we reached the end of that par­tic­u­lar road: we could no longer af­ford to tog­gle more tran­sis­tors within our power bud­get.

Raspberry Pi 4 is built around BCM2711, a com­plete re-im­ple­men­ta­tion of BCM283X on 28nm. The power sav­ings de­liv­ered by the smaller process geom­e­try have al­lowed us to re­place Cortex-A53 with the much more pow­er­ful, out-of-or­der, Cortex-A72 core; this can ex­e­cute more in­struc­tions per clock, yield­ing per­for­mance in­creases over Raspberry Pi 3B+ of be­tween two and four times, de­pend­ing on the bench­mark.

We’ve taken ad­van­tage of the process change to over­haul many other el­e­ments of the de­sign. We moved to a more mod­ern mem­ory tech­nol­ogy, LPDDR4, tripling avail­able band­width; we up­graded the en­tire dis­play pipeline, in­clud­ing video de­code, 3D graph­ics and dis­play out­put to sup­port 4Kp60 (or dual 4Kp30) through­put; and we ad­dressed the non-mul­ti­me­dia I/O lim­i­ta­tions of pre­vi­ous de­vices by adding on-board Gigabit Ethernet and PCI Express con­trollers.

We’ll keep up­dat­ing this list over the next cou­ple of days, but here are a few to get you started.

Wait, is it 2020 yet?

In the past, we’ve in­di­cated 2020 as a likely in­tro­duc­tion date for Raspberry Pi 4. We bud­geted time for four sil­i­con re­vi­sions of BCM2711 (A0, B0, C0, and C1); in com­par­i­son, we ship BCM2835C2 (the fifth re­vi­sion of that de­sign) on Raspberry Pi 1 and Zero.

Fortunately, 2711B0 has turned out to be pro­duc­tion-ready, which has taken roughly 9–12 months out of the sched­ule.

No. We have a lot of in­dus­trial cus­tomers who will want to stick with the ex­ist­ing prod­ucts for the time be­ing. We’ll keep build­ing these mod­els for as long as there’s de­mand. Raspberry Pi 1B+, 2B, 3B, and 3B+ will con­tinue to sell for $25, $35, $35, and $35 re­spec­tively.

Historically, we’ve pro­duced cut-down, lower-cost, ver­sions of some of our $35 prod­ucts, in­clud­ing Model 1A+ in 2014, and Model 3A+ at the end of last year. At pre­sent we haven’t iden­ti­fied a sen­si­ble set of changes to al­low us to do a “Model 4A” prod­uct at sig­nif­i­cantly less than $35. We’ll keep look­ing though.

What about the Compute Module?

CM1, CM3, and CM3+ will con­tinue to be avail­able. We are eval­u­at­ing op­tions for pro­duc­ing a Compute Module prod­uct based on the Raspberry Pi 4 chipset.

Are you still us­ing VideoCore?

Yes. VideoCore 3D is the only pub­licly doc­u­mented 3D graph­ics core for ARM‑based SoCs, and we want to make Raspberry Pi more open over time, not less.

A pro­ject like Raspberry Pi 4 is the work of many hun­dreds of peo­ple, and we al­ways try to ac­knowl­edge some of those peo­ple here.

This time round, par­tic­u­lar credit is due to James Adams, who de­signed the board it­self (you’ll find his sig­na­ture un­der the USB 3.0 socket); to Mike Buffham, who ran the com­mer­cial op­er­a­tion, work­ing with sup­pli­ers, li­censees, and re­sellers to bring our most com­pli­cated prod­uct yet to mar­ket; and to all those at Raspberry Pi and Broadcom who have worked tire­lessly to make this prod­uct a re­al­ity over the last few years.

A par­tial list of oth­ers who made ma­jor di­rect con­tri­bu­tions to the BCM2711 chip pro­gram, CYW43455, VL805, and MxL7704 in­te­gra­tions, DRAM qual­i­fi­ca­tion, and Raspberry Pi 4 it­self fol­lows:

If you’re not on this list and think you should be, please let me know, and ac­cept my apolo­gies.

First, he served in the Coast Guard, where he rose to the rank of lieu­tenant com­man­der. He mar­ried, had a fam­ily, and de­voted him­self ut­terly to his two lit­tle girls. After he got out of the mil­i­tary, he worked as a mod­er­a­tor for Facebook, where he purged the so­cial net­work of the worst stuff that its users post on a daily ba­sis: the hate speech, the mur­ders, the child pornog­ra­phy.

Utley worked the overnight shift at a Facebook con­tent mod­er­a­tion site in Tampa, FL, op­er­ated by a pro­fes­sional ser­vices ven­dor named Cognizant. The 800 or so work­ers there face re­lent­less pres­sure from their bosses to bet­ter en­force the so­cial net­work’s com­mu­nity stan­dards, which re­ceive near-daily up­dates that leave its con­trac­tor work­force in a per­pet­ual state of un­cer­tainty. The Tampa site has rou­tinely failed to meet the 98 per­cent “accuracy” tar­get set by Facebook. In fact, with a score that has been hov­er­ing around 92, it is Facebook’s worst-per­form­ing site in North America.

The stress of the job weighed on Utley, ac­cord­ing to his for­mer co-work­ers, who, like all Facebook con­trac­tors at the Tampa site, must sign a 14-page nondis­clo­sure agree­ment.

“The stress they put on him — it’s un­worldly,” one of Utley’s man­agers told me. “I did a lot of coach­ing. I spent some time talk­ing with him about things he was hav­ing is­sues see­ing. And he was al­ways wor­ried about get­ting fired.”

On the night of March 9th, 2018, Utley slumped over at his desk. Co-workers no­ticed that he was in dis­tress when he be­gan slid­ing out of his chair. Two of them be­gan to per­form CPR, but no de­fib­ril­la­tor was avail­able in the build­ing. A man­ager called for an am­bu­lance.

The Cognizant site in Tampa is set back from the main road in an of­fice park, and be­tween the dim night­time light­ing and dis­creet ex­te­rior sig­nage, the am­bu­lance ap­pears to have had trou­ble find­ing the build­ing. Paramedics ar­rived 13 min­utes af­ter the first call, one worker told me, and when they did, Utley had al­ready be­gun to turn blue.

Paramedics raced Utley to a hos­pi­tal. At Cognizant, some em­ploy­ees were dis­traught — one per­son told me he passed by one of the site’s des­ig­nated “tranquility rooms” and found one of his co-work­ers, a part-time preacher, pray­ing loudly in tongues. Others ig­nored the com­mo­tion en­tirely, and con­tin­ued to mod­er­ate Facebook posts as the para­medics worked.

Utley was pro­nounced dead a short while later at the hos­pi­tal, the vic­tim of a heart at­tack. Further in­for­ma­tion about his health his­tory, or the cir­cum­stances of his death, could not be learned. He left be­hind a wife, Joni, and two young daugh­ters. He was 42 years old.

On Monday morn­ing, work­ers on the day shift were in­formed that there had been an in­ci­dent, and they be­gan col­lect­ing money to buy a card and send flow­ers. But some site lead­ers did not ini­tially tell work­ers that Utley had died, and in­structed man­agers not to dis­cuss his death, cur­rent and for­mer em­ploy­ees told me.

“Everyone at lead­er­ship was telling peo­ple he was fine — ‘oh, he’ll be okay,’” one co-worker re­called. “They wanted to play it down. I think they were wor­ried about peo­ple quit­ting with the emo­tional im­pact it would have.”

But the il­lu­sion shat­tered later that day, when Utley’s fa­ther, Ralph, came to the site to gather his be­long­ings. He walked into the build­ing and, ac­cord­ing to a co-worker I spoke to, said: “My son died here.”

In February, I wrote about the se­cret lives of Facebook con­trac­tors in America. Since 2016, when the com­pany came un­der heavy crit­i­cism for fail­ing to pre­vent var­i­ous abuses of its plat­form, Facebook has ex­panded its work­force of peo­ple work­ing on safety and se­cu­rity around the world to 30,000. About half of those are con­tent mod­er­a­tors, and the vast ma­jor­ity are con­trac­tors hired through a hand­ful of large pro­fes­sional ser­vices firms. In 2017, Facebook be­gan open­ing con­tent mod­er­a­tion sites in American cities in­clud­ing Phoenix, Austin, and Tampa. The goal was to im­prove the ac­cu­racy of mod­er­a­tion de­ci­sions by en­trust­ing them to peo­ple more fa­mil­iar with American cul­ture and slang.

Cognizant re­ceived a two-year, $200 mil­lion con­tract from Facebook to do the work, ac­cord­ing to a for­mer em­ployee fa­mil­iar with the mat­ter. But in re­turn for polic­ing the bound­aries of free ex­pres­sion on one of the in­ter­net’s largest plat­forms, in­di­vid­ual con­trac­tors in North America make as lit­tle as $28,800 a year. They re­ceive two 15-minute breaks and a 30-minute lunch each day, along with nine min­utes per day of “wellness” time that they can use when they feel over­whelmed by the emo­tional toll of the job. After reg­u­lar ex­po­sure to graphic vi­o­lence and child ex­ploita­tion, many work­ers are sub­se­quently di­ag­nosed with post-trau­matic stress dis­or­der and re­lated con­di­tions.

My ini­tial re­port fo­cused on Phoenix, where work­ers told me that they had be­gun to em­brace fringe views af­ter con­tin­u­ously be­ing ex­posed to con­spir­acy the­o­ries at work. One brought a gun to work to pro­tect him­self against the pos­si­bil­ity of a fired em­ployee re­turn­ing to the of­fice seek­ing vengeance. Others told me they are haunted by vi­sions of the im­ages and videos they saw dur­ing their time on the job.

Conditions at the Phoenix site have not im­proved sig­nif­i­cantly since I vis­ited. Last week, some em­ploy­ees were sent home af­ter an in­fes­ta­tion of bed bugs was dis­cov­ered in the of­fice — the sec­ond time bed bugs have been found there this year. Employees who con­tacted me wor­ried that the in­fes­ta­tion would spread to their own homes, and said man­agers told them Cognizant would not pay to clean their homes.

“Bed bugs can be found vir­tu­ally every place peo­ple tend to gather, in­clud­ing the work­place,” Cognizant said in a state­ment. “No as­so­ci­ate at this fa­cil­ity has for­mally asked the com­pany to treat an in­fes­ta­tion in their home. If some­one did make such a re­quest, man­age­ment would work with them to find a so­lu­tion.”

Facebook ex­ec­u­tives have main­tained that the work­ing con­di­tions de­scribed to me by dozens of con­trac­tors do not ac­cu­rately re­flect the daily lives of the ma­jor­ity of its work­ers. But af­ter pub­lish­ing my story about Phoenix, I re­ceived dozens of mes­sages from other con­trac­tors around the world, many of whom re­ported hav­ing sim­i­lar ex­pe­ri­ences. The largest sin­gle group of mes­sages I re­ceived came from cur­rent and for­mer Facebook con­trac­tors in Tampa. Many of them have worked closely with em­ploy­ees at the Phoenix site, and be­lieve work­ing con­di­tions in Florida are even more grim.

In May, I trav­eled to Florida to meet with these Facebook con­trac­tors. This ar­ti­cle is based on in­ter­views with 12 cur­rent and for­mer mod­er­a­tors and man­agers at the Tampa site. In most cases, I agreed to use pseu­do­nyms to pro­tect the em­ploy­ees from po­ten­tial re­tal­i­a­tion from Facebook and Cognizant. But for the first time, three for­mer mod­er­a­tors for Facebook in North America agreed to break their nondis­clo­sure agree­ments and dis­cuss work­ing con­di­tions at the site on the record.

Employees told me that pres­sure from man­agers to im­prove its per­for­mance has taken a toll on the work­force. Cognizant’s con­tract with Facebook is com­ing up for re­newal, and with the en­tire com­pany strug­gling to hit the 98 per­cent ac­cu­racy tar­get, there are wide­spread con­cerns in­ter­nally that Cognizant will lose Facebook’s busi­ness.

Contractors told me that Cognizant had lured them away from less de­mand­ing jobs by promis­ing reg­u­lar sched­ules, bonuses, and ca­reer de­vel­op­ment, only to re­nege on all three.

They de­scribed a filthy work­place in which they reg­u­larly find pu­bic hair and other bod­ily waste at their work­sta­tions. Employees said man­agers laugh off or ig­nore sex­ual ha­rass­ment and threats of vi­o­lence. Two dis­crim­i­na­tion cases have been filed with the Equal Employment Opportunity Commission since April.

They said mar­i­juana use is so preva­lent that the site man­ager jok­ingly com­plained at an all-hands meet­ing that he had got­ten a con­tact high walk­ing in the door.

More than any­thing else, the con­trac­tors de­scribed an en­vi­ron­ment in which they are never al­lowed to for­get how quickly they can be re­placed. It is a place where even Keith Utley, who died work­ing along­side them, would re­ceive no work­place memo­r­ial — only a pass­ing men­tion dur­ing team hud­dles in the days af­ter he passed. “There is no in­di­ca­tion that this med­ical con­di­tion was work re­lated,” Cognizant told me in a state­ment. “Our as­so­ci­ate’s col­leagues, man­agers and our client were all sad­dened by this tragic event.” (The client is Facebook.)

Utley’s fam­ily could not be reached for com­ment. Employees who be­gan work­ing af­ter he died told me they had never heard his name.

“We were bod­ies in seats,” one for­mer mod­er­a­tor told me. “We were noth­ing to them — at all.”

Shawn Speagle was 23 and em­ployed at an on­line ed­u­ca­tion com­pany work­ing with English lan­guage learn­ers when he vis­ited a Cognizant job fair. A re­cruiter there de­scribed to him a role in which Speagle would pri­mar­ily help busi­nesses an­a­lyze en­gage­ment on their Facebook pages. He might have to do some con­tent mod­er­a­tion, the re­cruiter said, but Speagle en­tered the in­ter­view be­liev­ing he was about to em­bark on a new ca­reer in high tech­nol­ogy — one that he hoped would even­tu­ally lead to a full-time role at Facebook.

Cognizant of­fered Speagle $15 an hour to do the job full time — a marked im­prove­ment over his pre­vi­ous job, which was sea­sonal. Only af­ter he be­gan train­ing did he re­al­ize that the job would not, in fact, in­volve help­ing busi­nesses with Facebook mar­ket­ing. Instead, two weeks af­ter Speagle was put onto the pro­duc­tion floor, a man­ager told him he and a col­league would be re­view­ing graphic vi­o­lence and hate speech full time.

“For our as­so­ci­ates who opt to work in con­tent mod­er­a­tion, we are trans­par­ent about the work they will per­form,” a Cognizant spokesman said in re­sponse. “They are made aware of the na­ture of the role be­fore and dur­ing the hir­ing process, and then given ex­ten­sive and spe­cific train­ing be­fore work­ing on pro­jects.”

But had his man­agers asked, they would have learned that Speagle had a his­tory of anx­i­ety and de­pres­sion, and that he might not be suited well for the role. No one did.

“They just said me and [my col­league] were very metic­u­lous and had a lot of promise to move up to the SME po­si­tion,” Speagle said, re­fer­ring to the sub­ject mat­ter ex­perts who make $1 more per hour in ex­change for an­swer­ing mod­er­a­tors’ ques­tions about Facebook pol­icy. “They said Facebook is ba­si­cally shov­ing all of their graphic vi­o­lence con­tent to us, that they did­n’t want it any­more. So they had to move more peo­ple to cover it. And that’s all that we saw, every sin­gle day.”

Speagle vividly re­calls the first video he saw in his new as­sign­ment. Two teenagers spot an iguana on the ground, and one picks it up by the tail. A third teenager films what hap­pens next: the teen hold­ing the iguana be­gins smash­ing it onto the street. “They beat the liv­ing shit out of this thing,” Speagle told me, as tears welled up in his eyes. “The iguana was scream­ing and cry­ing. And they did­n’t stop un­til the thing was a bloody pulp.”

Under the pol­icy, the video was al­lowed to re­main on Facebook. A man­ager told him that by leav­ing the video on­line, au­thor­i­ties would be able to catch the per­pe­tra­tors. But as the weeks went on, the video con­tin­ued to reap­pear in his queue, and Speagle re­al­ized that po­lice were un­likely to look into the case.

Speagle had vol­un­teered at an­i­mal shel­ters in the past, and watch­ing the iguana die on a reg­u­lar ba­sis rat­tled him. “They kept re­post­ing it again and again and again,” he said, pound­ing the table as he spoke. “It made me so an­gry. I had to lis­ten to its screams all day.”

Cognizant’s Tampa fa­cil­ity opened in a maze-like of­fice park in the sum­mer of 2017, about two months af­ter the Phoenix fa­cil­ity came on­line. It op­er­ates out of a sin­gle-story build­ing next to a pond fed by two storm drains. On most days, an al­li­ga­tor emerges from one of the drains to bask in the sun.

Before the of­fice opened, the com­pany be­gan ad­ver­tis­ing work on Indeed and other job sites, us­ing opaque ti­tles such as “social me­dia an­a­lyst.” Initially, ap­pli­cants are not told they will be work­ing for Facebook — only a “large so­cial me­dia com­pany.”

Cognizant was not al­ways straight­for­ward with ap­pli­cants about the na­ture of the work in Tampa. Marcus*, who worked in man­age­ment, told me that a re­cruiter had per­suaded him to leave a more nor­mal job with the promise of a reg­u­lar sched­ule, per­for­mance bonuses, and a good work-life bal­ance. Once he joined, though, he was made to work nights, and the bonuses never ma­te­ri­al­ized.

Marcus was made to mod­er­ate Facebook con­tent — an ad­di­tional re­spon­si­bil­ity he says he was not pre­pared for. A mil­i­tary vet­eran, he had be­come de­sen­si­tized to see­ing vi­o­lence against peo­ple, he told me. But on his sec­ond day of mod­er­a­tion duty, he had to watch a video of a man slaugh­ter­ing pup­pies with a base­ball bat. Marcus went home on his lunch break, held his dog in his arms, and cried. I should quit, he thought to him­self, but I know there’s peo­ple at the site that need me. He ul­ti­mately stayed for a lit­tle over a year.

Cognizant calls the part of the build­ing where con­trac­tors do their work “the pro­duc­tion floor,” and it quickly filled with em­ploy­ees. The min­i­mum wage in Florida is $8.46, and at $15 an hour, the job pays bet­ter than most call cen­ter work in the area. For many con­tent mod­er­a­tors — Cognizant refers to them by the enig­matic ti­tle of “process ex­ec­u­tive” — it was their first real job.

In its haste to fill the work­place, Cognizant made some odd staffing de­ci­sions. Early on, the com­pany hired Gignesh Movalia, a for­mer in­vest­ment ad­vi­sor, as a mod­er­a­tor. Cognizant con­ducts back­ground checks on new hires, but ap­par­ently failed even to run a ba­sic web search on Movalia. Had they done so, they would have learned that in 2015 he was sen­tenced to 18 months in prison for his in­volve­ment in a $9 mil­lion in­vest­ment fraud scheme. According to the FBI, Movalia had falsely claimed to have ac­cess to shares of a fast-grow­ing tech­nol­ogy startup about to be­gin trad­ing on the pub­lic mar­ket.

Movalia was even­tu­ally fired, but em­ploy­ees I spoke with be­lieved his tenure ex­em­pli­fied Cognizant’s ap­proach to hir­ing mod­er­a­tors: find bod­ies wher­ever you can, ask as few ques­tions as pos­si­ble, and get them into a seat on the pro­duc­tion floor where they can start work­ing.

The re­sult is a rau­cous work­place where man­agers send reg­u­lar emails to the staff com­plain­ing about their be­hav­ior on the site. Nearly every per­son I in­ter­viewed in­de­pen­dently com­pared the Tampa of­fice to a high school. Loud al­ter­ca­tions, of­ten over work­place ro­mances, reg­u­larly take place be­tween co-work­ers. Verbal and phys­i­cal fights break out on a monthly ba­sis, em­ploy­ees told me. A dress code was in­sti­tuted to dis­cour­age em­ploy­ees from wear­ing provoca­tive cloth­ing to work — “This is not a night club,” read an email to all em­ploy­ees ob­tained by The Verge. Another email warned em­ploy­ees that there had been “numerous in­ci­dents of theft” on the prop­erty, in­clud­ing stolen food from the of­fice re­frig­er­a­tor, food from vend­ing ma­chines, and em­ploy­ees’ per­sonal items.

Michelle Bennetti and Melynda Johnson both be­gan work­ing at the Tampa site in June 2018. They told me that the daily dif­fi­culty of mod­er­at­ing con­tent, com­bined with a chaotic of­fice en­vi­ron­ment, made life mis­er­able.

“At first it did­n’t bother me — but af­ter a while, it started tak­ing a toll,” Bennetti told me. “I got to feel, like, a cloud — a dark­ness — over me. I started be­ing de­pressed. I’m a very happy, out­go­ing per­son, and I was [becoming] with­drawn. My anx­i­ety went up. It was hard to get through it every day. It started af­fect­ing my home life.”

Johnson was par­tic­u­larly dis­turbed by the site’s sole bath­room, which she reg­u­larly found in a state of dis­re­pair. (The com­pany says it has jan­i­tors avail­able every shift in Tampa.) In the stalls, signs posted in re­sponse to em­ployee mis­be­hav­ior pro­lif­er­ated. Do not use your feet to flush the toi­let. Do not flush more than five toi­let seat cov­ers at one time. Do not put any sub­stances, nat­ural or un­nat­ural, on the walls.

“And ob­vi­ously the signs are there for a rea­son, be­cause peo­ple are do­ing this,” said Johnson, who worked at the site un­til March. “Every bit of that build­ing was ab­solutely dis­gust­ing. You’d go in the bath­room and there would be pe­riod blood and poop all over the place. It smelled hor­ren­dous all the time.”

The work day in Tampa is di­vided into five shifts, and desks are shared be­tween em­ploy­ees. Contractors I spoke with said they would fre­quently come to work and find their work­sta­tion for the day in dire con­di­tion — en­coun­ter­ing boogers, fin­ger­nails, and pu­bic hairs, among other items. The desks would be cleaned when­ever Facebook made one of its reg­u­lar planned vis­its to the site. At other times, em­ploy­ees told me, the of­fice was filthy.

Florida law does not re­quire em­ploy­ers to of­fer sick leave, and so Cognizant work­ers who feel ill must in­stead use per­sonal leave time. (They are granted five hours of per­sonal leave per pay pe­riod.) Missing work is one of the few rea­sons Cognizant reg­u­larly fires its con­trac­tors. And so to avoid re­ceiv­ing an “occurrence,” as the com­pany calls un­ap­proved ab­sences, con­trac­tors who have ex­hausted their break time come to work sick — and oc­ca­sion­ally vomit in trash cans on the pro­duc­tion floor.

A worker named Lola* told me that health prob­lems had re­sulted in her re­ceiv­ing so many oc­cur­rences she was at risk of be­ing fired. She be­gan go­ing into work even when she felt ill to the point of throw­ing up. Facebook con­trac­tors are re­quired to use a browser ex­ten­sion to re­port every time they use the re­stroom, but dur­ing a re­cent ill­ness, Lola quickly took all her al­lot­ted breaks. She had pre­vi­ously been writ­ten up for go­ing to the bath­room too many times, she said, and so she felt afraid to get up from her desk. A man­ager saw that she was not feel­ing well, and brought a trash can to her desk so she could vomit in it. So she did.

“Then I was cry­ing at my desk,” Lola said. “I was like, ‘I can’t go on.’ My co-work­ers said, ‘Just go home.’ I said ‘I can’t, be­cause I’m go­ing to get an oc­cur­rence.’” She stayed at her desk and cried.

Employees told me about other dis­turb­ing in­ci­dents at the Tampa site. Among them:

* An em­ployee who used a colostomy bag had it rup­ture while she was at work, spilling some waste onto the floor. Senior man­agers were over­heard mock­ing her. She even­tu­ally quit.

* An em­ployee who threat­ened to “shoot up the build­ing” in a group chat was placed on paid leave and al­lowed to re­turn. He was fired af­ter mak­ing an­other sim­i­lar threat. (A Cognizant spokesper­son said the com­pany has se­cu­rity per­son­nel on site at all hours. “Our goal is to en­sure that our em­ploy­ees feel as­sured that they work in a safe en­vi­ron­ment,” he said.)

* Another em­ployee broad­cast him­self on Facebook Live talk­ing about want­ing to bash a man­ager’s head in. Another man­ager de­ter­mined that he was mak­ing a joke, and he was not dis­ci­plined.

In April, two women who work at the Tampa site filed com­plaints with the US Equal Employment Opportunity Commission al­leg­ing that they had been sex­u­ally ha­rassed by two of their male co-work­ers. According to the com­plaint, the men reg­u­larly dis­cussed anal sex in the of­fice. When the women were not re­cep­tive to the dis­cus­sion, one of the men said he “was go­ing to start a YouTube chan­nel and record him­self shoot­ing up the place,” ac­cord­ing to the com­plaint. On April 3rd, the Hillsborough County Sheriff’s Office came to the site to in­ter­view the women. According to the of­fi­cer’s re­port, one of the men had been pho­tographed fol­low­ing one of the women home.

A Cognizant spokesman told me that the em­ployee has been sus­pended while the claims are be­ing in­ves­ti­gated. But some work­ers say they are still con­cerned.

“Every time I get an email or a phone call from my clients, I worry that there’s been a shoot­ing — and I know that’s their worry as well,” said KC Hopkinson, an at­tor­ney who rep­re­sents sev­eral cur­rent and for­mer Cognizant em­ploy­ees in Tampa. “They go in there every morn­ing ask­ing, ‘what am I go­ing to see to­day? And am I go­ing to make it home tonight?’”

Hopkinson told me that her clients who have re­ported in­ci­dents to hu­man re­sources are gen­er­ally ei­ther ig­nored or re­tal­i­ated against, a claim that was echoed to me by sev­eral other em­ploy­ees there. In some cases, the site’s hu­man re­sources staff has fol­lowed work­ers who filed com­plaints to the bath­room, and ques­tioned them about what they were do­ing for the few min­utes they were in­side. (“We take al­le­ga­tions such as this very se­ri­ously,” a com­pany spokesman told me. “Cognizant strives to cre­ate a safe and em­pow­er­ing work­place.”)

“I would­n’t want my worst en­emy to work there,” Hopkinson said. “It’s a ter­ri­ble, ter­ri­ble en­vi­ron­ment.”

For the six months af­ter he was hired, Speagle would mod­er­ate 100 to 200 posts a day. He watched peo­ple throw pup­pies into a rag­ing river, and put lit fire­works in dogs’ mouths. He watched peo­ple mu­ti­late the gen­i­tals of a live mouse, and chop off a cat’s face with a hatchet. He watched videos of peo­ple play­ing with hu­man fe­tuses, and says he learned that they are al­lowed on Facebook “as long as the skin is translu­cent.” He found that he could no longer sleep for more than two or three hours a night. He would fre­quently wake up in a cold sweat, cry­ing.

Early on, Speagle came across a video of two women in North Carolina en­cour­ag­ing tod­dlers to smoke mar­i­juana, and helped to no­tify the au­thor­i­ties. (Moderator tools have a mech­a­nism for es­ca­lat­ing is­sues to law en­force­ment, and the women were even­tu­ally con­victed of mis­de­meanor child abuse.) To Speagle’s knowl­edge, though, the crimes he saw every day never re­sulted in le­gal ac­tion be­ing taken against the per­pe­tra­tors. The work came to feel point­less, never more so than when he had to watch footage of a mur­der or child pornog­ra­phy case that he had al­ready re­moved from Facebook.

In June 2018, a month into his job, Facebook be­gan see­ing a rash of videos that pur­port­edly de­picted or­gans be­ing har­vested from chil­dren. (It did not.) So many graphic videos were re­ported that they could not be con­tained in Speagle’s queue.

“I was get­ting the brunt of it, but it was leak­ing into every­thing else,” Speagle said. “It was mass panic. All the SMEs had to rush in there and try to help peo­ple. They were freak­ing out — they could­n’t han­dle it. People were cry­ing, break­ing down, throw­ing up. It was like one of those hor­ror movies. Nobody’s pre­pared to see a lit­tle girl have her or­gans taken out while she’s still alive and scream­ing.” Moderators were told they had to watch at least 15 to 30 sec­onds of each video.

Speagle helps to take care of his par­ents, who have health prob­lems, and was afraid to quit Cognizant. “It was tough to find a job down here in this mar­ket,” he said. To cope with the stress, he be­gan binge-eat­ing pas­tries from the vend­ing ma­chines, and even­tu­ally put on a sig­nif­i­cant amount of weight. He sought out the on-site coun­selor for sup­port, but found him un­help­ful.

“He just flat-out told me: ‘I don’t re­ally know how to help you guys,’” Speagle said. The coun­selor he spoke with had been sub­sti­tut­ing for the reg­u­lar coun­selor, who had more train­ing. Cognizant also of­fers a 24/7 hot­line, full health­care ben­e­fits, and other well­ness pro­grams. But the ex­pe­ri­ence soured Speagle on the site’s men­tal health re­sources. Other times, when he was hav­ing a par­tic­u­larly bleak day in the queue, a man­ager would hand him a bucket of Legos and en­cour­age him to play with them to re­lieve the stress as he worked. Speagle built a house and a space­ship, but it did­n’t make him feel bet­ter.

By last fall, Speagle told me, he was sleep­ing only an hour or two each night. The lack of sleep, cou­pled with de­pres­sion, made it dif­fi­cult for him to ex­er­cise. He be­gan lash­ing out at his par­ents. Meanwhile, at work, he felt mi­cro­man­aged by his team lead­ers, who pres­sured him to mod­er­ate more posts.

“I felt like I was trapped in­side my own body,” he said. “I could­n’t, for the life of me, get up from my desk, or I would be yelled at to stay in my desk. So I was trapped at my desk and in my body. I was so scared.”

Cognizant pe­ri­od­i­cally purges large num­bers of staff mem­bers in what have come to be known as “red bag days” for the red bags that man­agers give to the newly fired to col­lect their be­long­ings. Sometimes the dis­missals are re­lated to job per­for­mance, and some­times em­ploy­ees aren’t given any ex­pla­na­tion at all. Speagle was laid off as part of a red bag day last October.

In February, he went to a psy­chi­a­trist, who di­ag­nosed him with PTSD. He is cur­rently in treat­ment. Meanwhile, he has gone back to school to get his teach­ing cer­tifi­cate. Seeing so many chil­dren harmed on Facebook made him want to make a pos­i­tive con­tri­bu­tion to the lives of young peo­ple, he said.

“I re­ally wanted to make a dif­fer­ence,” Speagle told me of his time work­ing for Facebook. “I thought this would be the ul­ti­mate dif­fer­ence-mak­ing thing. Because it’s Facebook. But there’s no dif­fer­ence be­ing made.”

I asked him what he thought needed to change.

“I think Facebook needs to shut down,” he said.

Last week, I vis­ited the Tampa site with a pho­tog­ra­pher. It had re­ceived a deep clean­ing the night be­fore I vis­ited, ac­cord­ing to two em­ploy­ees I spoke with, and the bath­room sparkled. As I walked the floor with the site man­ager and a Facebook spokes­woman, I noted that most rooms smelled of clean­ing prod­ucts.

Work stopped while we were there to en­sure we did not see any Facebook user’s per­sonal in­for­ma­tion. Moderators, mostly in their 20s and 30s, chat­ted at their desks, or shot bas­kets in one of the minia­ture hoops around the build­ing. The site’s se­nior man­agers, who em­ploy­ees say are nor­mally clois­tered in their of­fices, made a show of walk­ing the pro­duc­tion floor and chat­ting with their sub­or­di­nates.

Every few feet, a wall de­cal or poster of­fered an in­spi­ra­tional plat­i­tude. Exhortations to al­ways try your hard­est and main­tain a pos­i­tive at­ti­tude were punc­tu­ated with other signs that came across as slightly more sin­is­ter. “No news is good news,” read one. “Our rep­u­ta­tion de­pends on you,” read an­other.

We saw an ac­tiv­ity room where work­ers are in­vited to par­tic­i­pate in yoga ses­sions, and a break room presided over by a small Buddha hold­ing an elec­tric can­dle. Across the room from the Buddha, col­or­ing books were fanned out on a table be­side win­dows over­look­ing the al­li­ga­tor pond.

The tour ended about an hour af­ter we ar­rived.

“That was a dog-and-pony show,” an em­ployee named Bob told me over the phone the next day. “That was com­pletely staged. We’re out there play­ing games, and the se­nior man­age­ment are out there in­ter­act­ing with peo­ple — it’s all a fa­cade.”

Facebook sees a sim­i­lar fa­cade when it vis­its the site, he said.

The per­son re­spon­si­ble for man­ag­ing Facebook’s grow­ing con­trac­tor work­force is Arun Chandra, whose ti­tle is vice pres­i­dent of scaled sup­port. Chandra ar­rived at Facebook last November af­ter a long ca­reer at HP, where he helped to over­see the com­pa­ny’s global sup­ply chain. In his new role, he told me, he hopes to grad­u­ally im­prove con­trac­tors’ stan­dard of liv­ing while also work­ing to en­sure they be­come more ef­fec­tive at their jobs.

“I’m try­ing to ad­dress the macro pic­ture, and move the big­ger things for­ward in the right way,” said Chandra, who struck me as en­er­getic and deeply sin­cere. “We’ll never solve 100 per­cent, but I’m try­ing to show I can solve 80 to 90 per­cent of the larger prob­lems.”

Chandra has vis­ited more than a dozen of the com­pa­ny’s far-flung part­ner sites in the United States and abroad, and has plans to visit them all. When he ar­rives, he likes to pull rank-and-file con­trac­tors into rooms and ask them about work­ing con­di­tions with­out their man­agers around. He told me that in the Philippines, con­tent mod­er­a­tion has be­come an at­trac­tive ca­reer track, and that every­where he goes, he meets mod­er­a­tors who take great pride in their work. “The level of en­thu­si­asm peo­ple have is amaz­ing,” he said.

This spring, Chandra or­ga­nized a sum­mit of around 200 lead­ers from con­tent mod­er­a­tion sites around the world — an event he plans to hold twice a year, with an­other com­ing this fall. Up un­til now, ven­dors have had dif­fer­ent poli­cies and pro­grams for pro­mot­ing work­ers’ men­tal health. At the sum­mit, they agreed to share in­for­ma­tion about their ap­proaches — ef­fec­tively agree­ing to stop com­pet­ing on the ba­sis of who does a bet­ter job tak­ing care of work­ers.

“We have to run a very large-scale plat­form. We have to take care of the com­mu­nity. And that means we have to get a whole lot of work done,” Chandra said. “But that is not at the ex­pense of [contractors’] well-be­ing.”

Chandra plans to launch a new au­dit pro­gram later this year to pro­mote bet­ter work­ing con­di­tions. That will in­clude more sur­prise vis­its — an ef­fort to get around the dog-and-pony-show phe­nom­e­non I ob­served last week. He also plans to stop eval­u­at­ing part­ners on the sole ba­sis of whether ven­dors achieve a 98 per­cent ac­cu­racy rate — in­stead, he said, Facebook will de­velop a bal­anced “scorecard” ap­proach to mea­sur­ing ven­dors’ per­for­mance. Chandra in­tends for worker well-be­ing to be part of that score, though Facebook has not yet de­ter­mined how it will be mea­sured.

In May, Facebook an­nounced that it will raise con­trac­tor wages by $3 an hour, make on-site coun­selors avail­able dur­ing all hours of op­er­a­tion, and de­velop fur­ther pro­grams for its con­trac­tor work­force. But the pay raises are not due to take ef­fect un­til the mid­dle of 2020, by which time many, if not most, of the cur­rent Tampa work­force will no longer work there. Turnover sta­tis­tics could not be ob­tained. But few mod­er­a­tors I have spo­ken with make it to two years on the job — they ei­ther are fired for low ac­cu­racy scores, or quit over the work­ing con­di­tions. And so while the raises will be a boon to a fu­ture work­force, the con­trac­tors I spoke to are un­likely to ben­e­fit.

Nor will the many con­trac­tors who have al­ready left the job. As in Phoenix, for­mer em­ploy­ees of the Tampa site de­scribed last­ing emo­tional dis­tur­bances from their work — one for which nei­ther Facebook nor Cognizant of­fers any sup­port.

I asked Chandra whether Facebook should hire more con­tent mod­er­a­tors in house, rather than re­ly­ing on big staffing com­pa­nies. He told me that Facebook’s busi­ness changes so quickly that it might not be pos­si­ble. But he did not rule it out.

“I com­pletely get the de­bate,” he said. “If any­thing I’m very em­pa­thetic to the en­tire con­ver­sa­tion, hav­ing spent a lot of time with these peo­ple. I don’t think we have a bet­ter an­swer right now.”

In the mean­time, Facebook is build­ing a “global re­siliency team” tasked with im­prov­ing the well-be­ing of both full-time em­ploy­ees and con­trac­tors. Chris Harrison, who leads the team, told me that he as­pires to build a well­ness pro­gram that be­gins at the point of hir­ing. He wants to screen em­ploy­ees to gauge their psy­cho­log­i­cal fit­ness — a move that might pre­vent some­one like Shawn Speagle from be­ing as­signed to a queue filled with graphic vi­o­lence — but says Facebook is still work­ing to un­der­stand whether this is pos­si­ble un­der em­ploy­ment law.

Harrison plans to make “resiliency” — the art of bounc­ing back af­ter see­ing some­thing aw­ful — a key part of con­trac­tor train­ing. He helped to de­velop new tools for mod­er­a­tors that can au­to­mat­i­cally blur out faces in dis­turb­ing videos, turn them grayscale, or mute the au­dio — all things that can re­duce the psy­cho­log­i­cal harm to the mod­er­a­tor view­ing them.

Eventually, Harrison hopes Facebook will of­fer post-em­ploy­ment coun­sel­ing to mod­er­a­tors who suf­fered psy­cho­log­i­cal harm on the job. “Of course we should do that,” he said. But the idea is still in the ear­li­est dis­cus­sion stages, he said. “There’s just so many lay­ers of com­plex­ity glob­ally. It’s re­ally, re­ally hard to pull it off in a legally com­pli­ant way.”

I asked Harrison, a li­censed clin­i­cal psy­chol­o­gist, whether Facebook would ever seek to place a limit on the amount of dis­turb­ing con­tent a mod­er­a­tor is given in a day. How much is safe?

“I think that’s an open ques­tion,” he said. “Is there such thing as too much? The con­ven­tional an­swer to that would be, of course, there can be too much of any­thing. Scientifically, do we know how much is too much? Do we know what those thresh­olds are? The an­swer is no, we don’t. Do we need to know? Yeah, for sure.”

“If there’s some­thing that were to keep me up at night, just pon­der­ing and think­ing, it’s that ques­tion,” Harrison con­tin­ued. “How much is too much?”

If you be­lieve mod­er­a­tion is a high-skilled, high-stakes job that pre­sents unique psy­cho­log­i­cal risks to your work­force, you might hire all of those work­ers as full-time em­ploy­ees. But if you be­lieve that it is a low-skill job that will some­day be done pri­mar­ily by al­go­rithms, you prob­a­bly would not.

Instead, you would do what Facebook, Google, YouTube, and Twitter have done, and hire com­pa­nies like Accenture, Genpact, and Cognizant to do the work for you. Leave to them the messy work of find­ing and train­ing hu­man be­ings, and of lay­ing them all off when the con­tract ends. Ask the ven­dors to hit some just-out-of-reach met­ric, and let them fig­ure out how to get there.

At Google, con­trac­tors like these al­ready rep­re­sent a ma­jor­ity of its work­force. The sys­tem al­lows tech gi­ants to save bil­lions of dol­lars a year, while re­port­ing record prof­its each quar­ter. Some ven­dors may turn out to mis­treat their work­ers, threat­en­ing the rep­u­ta­tion of the tech gi­ant that hired them. But count­less more sto­ries will re­main hid­den be­hind nondis­clo­sure agree­ments.

In the mean­time, tens of thou­sands of peo­ple around the world go to work each day at an of­fice where tak­ing care of the in­di­vid­ual per­son is al­ways some­one else’s job. Where at the high­est lev­els, hu­man con­tent mod­er­a­tors are viewed as a speed bump on the way to an AI-powered fu­ture.

In such a sys­tem, of­fices can still look beau­ti­ful. They can have col­or­ful mu­rals and serene med­i­ta­tion rooms. They can of­fer ping pong ta­bles and in­door putting greens and minia­ture bas­ket­ball hoops em­bla­zoned with the slo­gan: “You mat­ter.” But the mod­er­a­tors who work in these of­fices are not chil­dren, and they know when they are be­ing con­de­scended to. They see the com­pany roll an over­sized Connect 4 game into the of­fice, as it did in Tampa this spring, and they won­der: When is this place go­ing to get a de­fib­ril­la­tor?

I be­lieve Chandra and his team will work dili­gently to im­prove this sys­tem as best as they can. By mak­ing ven­dors like Cognizant ac­count­able for the men­tal health of their work­ers for the first time, and of­fer­ing psy­cho­log­i­cal sup­port to mod­er­a­tors af­ter they leave the com­pany, Facebook can im­prove the stan­dard of liv­ing for con­trac­tors across the in­dus­try.

I’ve been tin­ker­ing with dif­fer­ent startup ideas and needed a good check­list to think through them. There are great tem­plates for this al­ready: The YC ap­pli­ca­tion, Amazon’s in­ter­nal press re­lease, and Sequoia’s Writing a Business Plan. I found my­self mix­ing and tweak­ing these tem­plates be­cause they don’t ex­actly match my model of the world, so I wrote up my own list.

I use this list both to de­velop ideas and fil­ter them. If you adopt it, be care­ful about us­ing it as a fil­ter. Remember that in the early stages, good ideas are very easy to kill.

Who are the users?

What is the essence of their dis­sat­is­fac­tion? If they read this

an­swer, would they say “thanks, I wish I’d thought of putting it

that way”?

@benedictevans : “The iTunes Store

solved a user prob­lem. So did the App Store. And so did Spotify and

Apple Music, and in­deed Apple News. But what user prob­lem is solved

by Apple’s com­mis­sion­ing TV shows?”

What are you build­ing for them?

Peter Drucker : Is the prod­uct

be­ing de­signed the cus­tomer, or the cus­tomer?

Write a tweet from a hy­po­thet­i­cal cus­tomer ex­plain­ing the prod­uct

and how it elim­i­nates their dis­sat­is­fac­tion.

@BrianNorgard : No one cares

about your prod­uct. Who built it, its fea­tures, the ori­gin story —

it’s all su­per­flu­ous. People only find value in what your prod­uct

can do for them right now. Save peo­ple time. Save peo­ple money.

Give peo­ple an es­cape. The self­ish hand will al­ways gov­ern.

Peter Drucker : Are you

do­ing the best you can to help the cus­tomer?

Write a blog post ti­tle for your prod­uct launch. Is it

sur­pris­ing? Is it new? Will your tar­get cus­tomers want to click on

it? Will they want to share the link? Will they still share it the

next day?

Write the first para­graph of your prod­uct an­nounce­ment blog post.

Include the prod­uct name, an ex­pla­na­tion of what the prod­uct is,

the tar­get mar­ket, the main ben­e­fit, and the call to ac­tion.

What “metrics of good­ness” do your tar­get cus­tomers care about?

Does your prod­uct dom­i­nate every avail­able al­ter­na­tive on these

met­rics?

The Rise of Worse is Better The Rise of Worse is Better ,

Worse is worse

Fill in the bot­tom-up mar­ket size equa­tion: NUM_USERS * ACV =

MARKET_SIZE. Are your num­bers cred­i­ble? Find a good ref­er­ence

class if you’re build­ing some­thing com­pletely new.

Which sub­set of your tar­get cus­tomers are so con­strained by the

sta­tus quo, they’ll wel­come a buggy prod­uct?

List your first ten cus­tomers.

Which play­book will you use to get cus­tomers af­ter the first ten?

What would need to be true in 18 months for you to get es­sen­tially

un­lim­ited cheap cap­i­tal? How will you achieve that?

Why now? What’s true about the world that no­body else fig­ured out

yet?

What is the most am­bi­tious achiev­able mile­stone for your com­pany

within a 25 year time hori­zon?

Is your prod­uct a cred­i­ble ad­vance to­ward this mile­stone?

What’s the next cred­i­ble ad­vance to­ward this mile­stone? The one

af­ter that? The one af­ter that?

How will you build a moat?

What would reach­ing your 25 year mile­stone mean for the world? Is

this fu­ture re­ally ex­cit­ing? How many years of your life would you

give up to tele­port there? If you found your­self in this

coun­ter­fac­tual world, would you want to go back?

If an­other com­pany was work­ing on this idea and not you, what would

you think about it? Would you join them?

Imagine your­self stand­ing in front of your team, in­vestors, fam­ily,

and friends. You’ve failed, and they’re wait­ing for you to speak.

What will you say? Are you will­ing to work on this prob­lem given

that fail­ure is the de­fault?

What’s your com­pa­ny’s stock ticker sym­bol?

@sama: “it’s easy/​fun to say every new startup you hear about is bad. you will usu­ally be right. you will never be suc­cess­ful.”

Is it likely to be the most im­por­tant com­pany started this year?

George Orwell: “Whoever is win­ning at the mo­ment will al­ways seem to be in­vin­ci­ble.”

Thanks to Darryl Ramm for feed­back on this post.

Greenhouse keeps home in the 60’s, even when it’s freez­ing out­side; al­lows fam­ily to grow Mediterranean fruit in Sweden

Marie Granmar and Charles Sacilotto lit­er­ally live in a bub­ble, in­su­lated from the cold and the harsh­ness of the el­e­ments, while tak­ing in the best of what na­ture has to of­fer.

Their house is built in­side of a green­house, pro­vid­ing them free heat and free food in the win­ter.

In Stockholm, Sweden, where win­ter lasts 9 months out of the year, that’s a huge as­set.

The av­er­age tem­per­a­ture in Stockholm in January is be­low freez­ing. But step into Marie and Charles’ bub­bled-in “backyard,” and you’ll be much warmer.

“For ex­am­ple at the end of January it can be 28°F out­side and it can be 68°F up­stairs,”  says in the video be­low:

A nor­mal fam­ily in Stockholm switches on their heater on some­time around mid-Sep­tem­ber, and does­n’t turn it off again un­til mid-May or so, Marie says.

The green­house al­lows them to re­duce the num­ber of months they need to heat their home from 9 to 6 months per year, and re­duces the amount of en­ergy they use do­ing so. Any sup­ple­men­tal heat they need, that is not pro­vided by the sun, is pro­vided by a wood-burn­ing stove.

Marie says she is more or less im­mune to the win­ter blues many of her friends ex­pe­ri­ence dur­ing cold weather. Rain or snow, she can sit out on her bal­cony or her roof-top ter­race and gaze at the stars, or any glimpses of sun she can catch.

Then, dur­ing the warmest parts of the sum­mer, her glass roof au­to­mat­i­cally opens up when it hits a cer­tain tem­per­a­ture, to let the heat out so it does­n’t get too hot.

“It can get warm a few days in the sum­mer,” she says, “but that’s not re­ally a prob­lem be­cause we open the win­dows and we en­joy the heat. We like the sun!”

The fam­i­ly’s fa­vorite hang­out is the rooftop deck. Since they built a glass ceil­ing, they no longer needed a roof, so they re­moved it to cre­ate a large space for sun­bathing, read­ing, gar­den­ing or play­ing with their son on swings and bikes.

In ad­di­tion to keep­ing their bod­ies warmer, the green­house also keeps their plants warmer.

The foot­print of the green­house is nearly dou­ble that of the home, leav­ing plenty of room for a wrap-around gar­den. And since they’ve cre­ated a Mediterranean cli­mate for them­selves, the cou­ple grows pro­duce that typ­i­cally is­n’t grown in Sweden, like figs, grapes, toma­toes, cu­cum­bers and herbs. Outside the glass they have cherry and ap­ple trees.

“Growing things here is not easy,” Marie says in the video. “We need all the ex­tra en­ergy we can get.”

On top of free heat, the cou­ple has also in­stalled a rain­wa­ter col­lec­tion sys­tem for free wa­ter, and a com­post­ing toi­let sys­tem that pro­vides free fer­til­izer for their plants. Also, the plants that thrive in their home re­turn the fa­vor by clean­ing the air and pro­vid­ing more oxy­gen.

It starts with a urine-sep­a­rat­ing toi­let and uses cen­trifuges, cis­terns, ponds and gar­den beds to fil­ter waste wa­ter and com­post the re­mains.

For the fu­ture, the cou­ple is work­ing on de­sign­ing a sys­tem to cap­ture ex­cess so­lar en­ergy dur­ing the sum­mer and store it for the win­ter.

“If you want to be self suf­fi­cient, and not de­pen­dent on big­ger sys­tems, you can have this and live any­where you like,” Marie said.

“It’s all a phi­los­o­phy of life, to use na­ture, sun and wa­ter to live in a an­other world,” Charles said.

Charles and Marie weren’t the first ones to build a house-in­side-a-green­house. Their idea was in­spired by Swedish ar­chi­tect Bengt Warne who built the first “Naturhus” (Nature House) in Stockholm in 1974:

Since then a hand­ful of oth­ers have been built in Sweden and Germany.

Today at 10:30UTC, the Internet had a small heart at­tack. A small com­pany in Northern Pennsylvania be­came a pre­ferred path of many Internet routes through Verizon (AS701), a ma­jor Internet tran­sit provider. This was the equiv­a­lent of Waze rout­ing an en­tire free­way down a neigh­bor­hood street — re­sult­ing in many web­sites on Cloudflare, and many other providers, to be un­avail­able from large parts of the Internet. This should never have hap­pened be­cause Verizon should never have for­warded those routes to the rest of the Internet. To un­der­stand why, read on.

We have blogged about these un­for­tu­nate events in the past, as they are not un­com­mon. This time, the dam­age was seen world­wide. What ex­ac­er­bated the prob­lem to­day was the in­volve­ment of a “BGP Optimizer” prod­uct from Noction. This prod­uct has a fea­ture that splits up re­ceived IP pre­fixes into smaller, con­tribut­ing parts (called more-specifics). For ex­am­ple, our own IPv4 route 104.20.0.0/20 was turned into 104.20.0.0/21 and 104.20.8.0/21. It’s as if the road sign di­rect­ing traf­fic to “Pennsylvania” was re­placed by two road signs, one for “Pittsburgh, PA” and one for “Philadelphia, PA”. By split­ting these ma­jor IP blocks into smaller parts, a net­work has a mech­a­nism to steer traf­fic within their net­work but that split should never have been an­nounced to the world at large. When it was it caused to­day’s out­age.

To ex­plain what hap­pened next, here’s a quick sum­mary of how the un­der­ly­ing “map” of the Internet works. “Internet” lit­er­ally means a net­work of net­works and it is made up of net­works called Autonomous Systems (AS), and each of these net­works has a unique iden­ti­fier, its AS num­ber. All of these net­works are in­ter­con­nected us­ing a pro­to­col called Border Gateway Protocol (BGP). BGP joins these net­works to­gether and builds the Internet “map” that en­ables traf­fic to travel from, say, your ISP to a pop­u­lar web­site on the other side of the globe.

Using BGP, net­works ex­change route in­for­ma­tion: how to get to them from wher­ever you are. These routes can ei­ther be spe­cific, sim­i­lar to find­ing a spe­cific city on your GPS, or very gen­eral, like point­ing your GPS to a state. This is where things went wrong to­day.

An Internet Service Provider in Pennsylvania  (AS33154 - DQE Communications) was us­ing a BGP op­ti­mizer in their net­work, which meant there were a lot of more spe­cific routes in their net­work. Specific routes over­ride more gen­eral routes (in the Waze anal­ogy a route to, say, Buckingham Palace is more spe­cific than a route to London).

DQE an­nounced these spe­cific routes to their cus­tomer (AS396531 - Allegheny Technologies Inc). All of this rout­ing in­for­ma­tion was then sent to their other tran­sit provider (AS701 - Verizon), who pro­ceeded to tell the en­tire Internet about these “better” routes. These routes were sup­pos­edly “better” be­cause they were more gran­u­lar, more spe­cific.

The leak should have stopped at Verizon. However, against nu­mer­ous best prac­tices out­lined be­low, Verizon’s lack of fil­ter­ing turned this into a ma­jor in­ci­dent that af­fected many Internet ser­vices such as Amazon,  Linode and Cloudflare.

What this means is that sud­denly Verizon, Allegheny, and DQE had to deal with a stam­pede of Internet users try­ing to ac­cess those ser­vices through their net­work. None of these net­works were suit­ably equipped to deal with this dras­tic in­crease in traf­fic, caus­ing dis­rup­tion in ser­vice. Even if they had suf­fi­cient ca­pac­ity DQE, Allegheny and Verizon were not al­lowed to say they had the best route to Cloudflare, Amazon, Linode, etc…

During the in­ci­dent, we ob­served a loss, at the worst of the in­ci­dent, of about 15% of our global traf­fic.

There are mul­ti­ple ways this leak could have been avoided:

A BGP ses­sion can be con­fig­ured with a hard limit of pre­fixes to be re­ceived. This means a router can de­cide to shut down a ses­sion if the num­ber of pre­fixes goes above the thresh­old. Had Verizon had such a pre­fix limit in place, this would not have oc­curred. It is a best prac­tice to have such lim­its in place. It does­n’t cost a provider like Verizon any­thing to have such lim­its in place. And there’s no good rea­son, other than slop­pi­ness or lazi­ness, that they would­n’t have such lim­its in place.

A dif­fer­ent way net­work op­er­a­tors can pre­vent leaks like this one is by im­ple­ment­ing IRR-based fil­ter­ing. IRR is the Internet Routing Registry, and net­works can add en­tries to these dis­trib­uted data­bases. Other net­work op­er­a­tors can then use these IRR records to gen­er­ate spe­cific pre­fix lists for the BGP ses­sions with their peers. If IRR fil­ter­ing had been used, none of the net­works in­volved would have ac­cepted the faulty more-specifics. What’s quite shock­ing is that it ap­pears that Verizon did­n’t im­ple­ment any of this fil­ter­ing in their BGP ses­sion with Allegheny Technologies, even though IRR fil­ter­ing has been around (and well doc­u­mented) for over 24 years. IRR fil­ter­ing would not have in­creased Verizon’s costs or lim­ited their ser­vice in any way. Again, the only ex­pla­na­tion we can con­ceive of why it was­n’t in place is slop­pi­ness or lazi­ness.

The RPKI frame­work that we im­ple­mented and de­ployed glob­ally last year is de­signed to pre­vent this type of leak. It en­ables fil­ter­ing on ori­gin net­work and pre­fix size. The pre­fixes Cloudflare an­nounces are signed for a max­i­mum size of 20. RPKI then in­di­cates any more-spe­cific pre­fix should not be ac­cepted, no mat­ter what the path is. In or­der for this mech­a­nism to take ac­tion, a net­work needs to en­able BGP Origin Validation. Many providers like AT&T have al­ready en­abled it suc­cess­fully in their net­work.

If Verizon had used RPKI, they would have seen that the ad­ver­tised routes were not valid, and the routes could have been au­to­mat­i­cally dropped by the router.

Cloudflare en­cour­ages all net­work op­er­a­tors to de­ploy RPKI now!

All of the above sug­ges­tions are nicely con­densed into MANRS (Mutually Agreed Norms for Routing Security)

The net­work team at Cloudflare reached out to the net­works in­volved, AS33154 (DQE Communications) and AS701 (Verizon). We had dif­fi­cul­ties reach­ing ei­ther net­work, this may have been due to the time of the in­ci­dent as it was still early on the East Coast of the US when the route leak started.

One of our net­work en­gi­neers made con­tact with DQE Communications quickly and af­ter a lit­tle de­lay they were able to put us in con­tact with some­one who could fix the prob­lem. DQE worked with us on the phone to stop ad­ver­tis­ing these “optimized” routes to Allegheny Technologies Inc. We’re grate­ful for their help. Once this was done, the Internet sta­bi­lized, and things went back to nor­mal.

It is un­for­tu­nate that while we tried both e-mail and phone calls to reach out to Verizon, at the time of writ­ing this ar­ti­cle (over 8 hours af­ter the in­ci­dent), we have not heard back from them, nor are we aware of them tak­ing ac­tion to re­solve the is­sue.

At Cloudflare, we wish that events like this never take place, but un­for­tu­nately the cur­rent state of the Internet does very lit­tle to pre­vent in­ci­dents such as this one from oc­cur­ring. It’s time for the in­dus­try to adopt bet­ter rout­ing se­cu­rity through sys­tems like RPKI. We hope that ma­jor providers will fol­low the lead of Cloudflare, Amazon, and AT&T and start val­i­dat­ing routes. And, in par­tic­u­lar, we’re look­ing at you Verizon — and still wait­ing on your re­ply.

Despite this be­ing caused by events out­side our con­trol, we’re sorry for the dis­rup­tion. Our team cares deeply about our ser­vice and we had en­gi­neers in the US, UK, Australia, and Singapore on­line min­utes af­ter this prob­lem was iden­ti­fied.

This is a cyn­i­cal, clin­i­cal col­lec­tion of things I learnt in 30 years work­ing with soft­ware de­vel­op­ment.

Again, some things are re­ally cyn­i­cal, oth­ers are long ob­ser­va­tions on dif­fer­ent jobs.

If you don’t know what you’re try­ing to solve, you don’t know what to code.

Write some­thing spec­i­fy­ing how the ap­pli­ca­tion works be­fore writ­ing any code.

“Without re­quire­ments or de­sign, pro­gram­ming is the art of adding bugs to an empty text file.” — Louis Srygley

Sometimes, even an “elevator pitch” — up to two para­graphs that de­scribe what the ap­pli­ca­tion does — is enough.

The times I stood longer look­ing at my own code won­der­ing what to do next were when we did­n’t have the next step de­fined. It is a good sign that it’s time to stop and dis­cuss it with your cowork­ers — or maybe re­think the so­lu­tion.

If you have no idea how to start, de­scribe the flow of the ap­pli­ca­tion in high level, pure English/your lan­guage first. Then fill the spaces be­tween com­ments with the code.

Better yet: think of every com­ment as a func­tion, then write the func­tion that does ex­actly that.

Gherkin is your friend to un­der­stand ex­pec­ta­tions

Gherkin is a test de­scrip­tion for­mat which points “Given that the sys­tem is in a cer­tain state, When some­thing hap­pens, then this is ex­pected”. Even if you don’t use any test­ing tool that reads Gherkin, it will give you a good un­der­stand­ing of what it is ex­pected from the app.

On my cur­rent job, we do test mod­ules and classes only (for ex­am­ple, we write tests for the view layer only, then tests for the con­troller layer only, and so on). It gives us some idea if things are go­ing right or not, but they lack a view of how the whole is go­ing on — a thing in­te­gra­tion tests, which tests how the sys­tem as a whole be­haves — do bet­ter.

We code in lay­ers: There is the stor­age layer, which should make our data per­ma­nent; there is a pro­cess­ing layer, which should do some trans­for­ma­tion on the data stored; there is a view layer, which has in­for­ma­tion on how the data must be pre­sent; and so on.

As I men­tioned, in­te­gra­tion tests feel bet­ter, but test­ing lay­ers by them­selves can give you a bet­ter view on how their API looks like. Then you can have a bet­ter look on how to call things: Is the API too com­plex? Do you have to keep to much data around to be able to make a sin­gle call?

Make tests that you know how to run on the com­mand line

Not that com­mand lines are im­por­tant for any pro­jects, but when you know the com­mand to run the tests, you know how to au­to­mate the ex­e­cu­tion of the tests, which you then can use in a con­tin­u­ous in­te­gra­tion tool.

Be ready to throw your code away

A lot of peo­ple, when they start with TDD, get an­noyed when you say that you may have to rewrite a lot of stuff, in­clud­ing what­ever your al­ready wrote.

TDD was de­signed to throw code away: The more you learn about your prob­lem, the more you un­der­stand that, what­ever you wrote, won’t solve the prob­lem in the long run.

You should­n’t worry about this. Your code is not a wall: if you have to throw it al­ways, it is not wasted ma­te­r­ial. Surely it means your time writ­ing code was lost, but you got a bet­ter un­der­stand­ing about the prob­lem now.

You can be sure that if a lan­guage brings a test­ing frame­work — even min­i­mal — in its stan­dard li­brary, the ecosys­tem around it will have bet­ter tests than a lan­guage that does­n’t carry a test­ing frame­work, no mat­ter how good the ex­ter­nal test­ing frame­works for the lan­guage are.

When de­vel­op­ers try to solve a prob­lem, they some­times try to find a way that will solve all the prob­lems, in­clud­ing the ones that may ap­pear in the fu­ture.

But here is the thing: The prob­lems from the fu­ture will never come and you’ll end up ei­ther hav­ing to main­tain a huge be­he­moth of code that will never be fully used or you’ll end up rewrit­ing the whole thing ’cause there is a shit­ton of un­used stuff.

Solve the prob­lem you have right now. Then solve the next one. And the next one. At one point, you’ll re­al­ize there is a pat­tern emerg­ing from those so­lu­tions and then you’ll find your “solve every­thing”.

Documentation is a love let­ter to your fu­ture self

We all know writ­ing the damn docs for func­tions and classes and mod­ules is a pain in the back­side. But re­al­iz­ing what you were think­ing when you wrote the func­tion will save your butt in the fu­ture.

The func­tion doc­u­men­ta­tion is its con­tract

When you start the code by writ­ing the doc­u­men­ta­tion, you’re ac­tu­ally mak­ing a con­tract (probably with your fu­ture self): I’m say­ing this func­tion does this

and this is what it does.

If later you find out that the code does­n’t match the doc­u­men­ta­tion, you have a code prob­lem, not a doc­u­men­ta­tion prob­lem.

If a func­tion de­scrip­tion in­cludes an “and”, it’s wrong

Functions should do one thing and one thing only. When you’re writ­ing the func­tion doc­u­men­ta­tion and find that you added an “and”, it means the func­tion is do­ing more than one thing. Break that func­tion into two and re­move the “and”.

When you’re de­sign­ing a func­tion, you may be tempted to add a flag. Don’t do this.

Here, let me show you an ex­am­ple: Suppose you have a mes­sag­ing sys­tem and you have a func­tion that re­turns all the mes­sages to an user, called

ge­tUser­Mes­sages. But there is a case where you need to re­turn a sum­mary of each mes­sage (say, the first para­graph) or the full mes­sage. So you add a flag/​Boolean pa­ra­me­ter called re­trieve­FullMes­sage.

Again, don’t do that.

’Cause any­one read­ing your code will see ge­tUser­Mes­sage(userId, true) and won­der what the heck that true means.

You can ei­ther re­name the func­tion to ge­tUser­Mes­sage­Sum­maries and have an­other ge­tUser­Mes­sages­Full or some­thing around those lines, but each func­tion just call the orig­i­nal ge­tUser­Mes­sage with true or false — but the in­ter­face to the out­side of your class/​mod­ule will still be clear.

But don’t add flags/​Boolean pa­ra­me­ters to your func­tions.

In the point above, I men­tioned about re­nam­ing the func­tion. If you con­trol the whole source where the func­tion is used, that’s not is­sue, it’s just a mat­ter of search and re­place.

But if that func­tion is ac­tu­ally ex­posed by a li­brary, you should­n’t change func­tion names in a whim. That will break a lot of other ap­pli­ca­tions be­yond your con­trol and make a lot of other peo­ple un­happy.

You can cre­ate the new func­tions and mark the cur­rent one as dep­re­cated, ei­ther by doc­u­men­ta­tion or by some code fea­ture. Then, af­ter a few re­leased, you can fi­nally kill the orig­i­nal func­tion.

If the lan­guage comes with its own way of doc­u­ment­ing func­tions/​classes/​mod­ules/​what­ever and it comes even with the sim­plest doc gen­er­a­tor, you can be sure that all the lan­guage func­tions/​classes/​mod­ules/​li­braries/​frame­works will have a good doc­u­men­ta­tion (not great, but at least good).

Languages that do not have in­te­grated doc­u­men­ta­tion will, most of the time, have a bad doc­u­men­ta­tion.

A lan­guage is much more than a lan­guage

A pro­gram­ming lan­guage is that thing that you write and make things “go”. But it has much more be­yond spe­cial words: It has a build sys­tem, it has a de­pen­dency con­trol sys­tem, it has a way of mak­ing tools/​li­braries/​frame­works in­ter­act, it has a com­mu­nity, it has a way of deal­ing with peo­ple.

Don’t pick lan­guages just ’cause they eas­ier to use. Always re­mem­ber that you may ap­prove the syn­tax of a lan­guage for be­ing that easy, but you’re also en­abling the way main­tain­ers deal with the com­mu­nity by choos­ing that lan­guage.

Sometimes, it’s bet­ter to let the ap­pli­ca­tion crash than do noth­ing

Although that sounds weird, it’s bet­ter to not add any er­ror han­dling than silently cap­tur­ing er­rors and do­ing noth­ing.

This does noth­ing to deal with the ex­cep­tion — be­sides print­ing it, that is.

If you don’t know how to han­dle it, let it hap­pen,so you can fig­ure out when

it will hap­pen.

If you know how to han­dle the is­sue, han­dle it

Counter-point to the pre­vi­ous point: If you know when some­thing will raise an ex­cep­tion/​er­ror/​re­sult and you know how to han­dle it, han­dle it. Show an er­ror mes­sage, try to save the data some­where else, cap­ture the user in­put in a log file to later pro­cess­ing, but han­dle it.

Types say what you data is

Memory is just a se­quence of bytes; bytes are just num­bers from 0 to 255; what those num­bers mean is de­scribed on the lan­guage type sys­tem.

For ex­am­ple, in C, a char type of value 65 is most prob­a­bly the let­ter “A”, which an int of value is 65 is the num­ber 65.

Remember this when deal­ing with your data.

This is what most peo­ple get wrong about adding booleans to check the num­ber of True val­ues. Here, let me show you an ex­am­ple of JavaScript that I saw re­cently:

If your data has a schema, use a struc­ture to keep it

You may be tempted to use a list (or tu­ple, if your lan­guage al­lows) to keep your data if it’s sim­ple — like, say, only 2 fields.

But if you data has a schema — it has a fixed for­mat — you should al­ways

use some struc­ture to keep it, but it a struct or a class.

Understand and stay way of cargo cult

“Cargo cult” is the idea that, if some­one else did, so can we. Most of the time, cargo cult is sim­ply an “easy way out” of a prob­lem: Why would we think about how to prop­erly store our users if X did that?

“If BigCompany stores data like this, so can we”.

“If BigCompany is be­hind this, this is good.”

“Right tool for the job” is just to push an agenda

“Right tool for the job” should be an ex­pres­sion that meant that there is a right and a wrong tool to do some­thing — e.g., us­ing a cer­tain lan­guage/​frame­work in­stead of the cur­rent lan­guage/​frame­work.

But every time I heard some­one men­tion it, they were try­ing to push their favourite lan­guage/​frame­work in­stead of, say, the right lan­guage/​frame­work.

“The right tool” is more ob­vi­ous than you think

Maybe you’re in a pro­ject that needs to process some text. Maybe you’re tempted to say “Let’s use Perl” ’cause you know that Perl is very strong in pro­cess­ing text.

What you’re miss­ing: You’re work­ing on a C shop. Everybody knows C, not Perl.

Sure, if it is a small, “on the cor­ner” kind of pro­ject, it’s fine to be in Perl; if it is im­por­tant for the com­pany, it’s bet­ter that if it is a C pro­ject.

PS: Your hero pro­ject (more about it later in this doc) may fail due this.

Don’t mess with things out­side your pro­ject

Sometimes peo­ple are tempted to, in­stead of us­ing the proper ex­ten­sion tools, change ex­ter­nal li­braries/​frame­works — for ex­am­ple, mak­ing changes di­rectly into WordPress or Django.

This is an easy way to make the pro­ject un­main­tain­able re­ally re­ally fast. As soon as a new ver­sion is re­leased, you’ll have to keep up your changes in sync with the main pro­ject and, pretty soon, you’ll find that the changes don’t ap­ply any­more and you’ll leave the ex­ter­nal pro­ject in an old ver­sion, full of se­cu­rity bugs.

(This is per­sonal opin­ion) When you un­der­stand how the data must flow in your code, you’ll end up with bet­ter code than if you ap­plied a bunch of de­sign pat­terns.

Design pat­terns are used to de­scribe so­lu­tions, not to find them

(Again, per­sonal opin­ion) Most of the time I saw de­sign pat­terns be­ing ap­plied, they were ap­plied as a way to find a so­lu­tion, so you end up twist­ing a so­lu­tion — and, some­times, the prob­lem it self — to fit the pat­tern.

First, solve your prob­lem; find a good so­lu­tion; then you can check the pat­terns to know how you name that so­lu­tion.

I saw this hap­pens a lot: We have this prob­lem; a de­sign pat­tern gets close to the proper so­lu­tion; let’s use the de­sign pat­tern; now we need to add a lot of things around the proper so­lu­tion to make it fit the pat­tern.

You don’t need to go deep into “what is a monad” and “is this a func­tor”. But re­mem­ber to not keep chang­ing your data all the time, cre­ate a new el­e­ment with the new val­ues (treat your data as im­mutable) and make func­tions/​classes that don’t keep some in­ter­nal state (pure func­tions/​classes) if pos­si­ble.

“Cognitive dis­so­nance” is a fancy way of say­ing “I need to re­mem­ber two (or more) dif­fer­ent things at the same time to un­der­stand this.” Keeping those dif­fer­ent things in your head cre­ates a cost and it keeps ac­cu­mu­lat­ing the more in­di­rect the things are (’cause you’ll have to keep all those in your head).

For ex­am­ple, adding booleans to count the num­ber of True val­ues is a mild cog­ni­tive dis­so­nance; if you’re read­ing a piece of code and see a sum()

func­tion, which you know makes the sum of all num­bers in a list, you’d ex­pect the list to be com­posed of num­bers, but I’ve seen peo­ple us­ing sum() to count num­ber of True val­ues in a list of booleans, which is con­fus­ing as heck.

The Magical Number Seven, Plus or Minus Two

“The mag­i­cal num­ber” is a psy­chol­ogy ar­ti­cle about the num­ber of things one can keep in their mind at the same time.

If you have a func­tion, that calls a func­tion, that calls a func­tion, that calls a func­tion, that calls a func­tion, that calls func­tion, you may be sure it will be a hell to read later.

Think more about: I’ll get the re­sult of this func­tion, then pass it to the sec­ond func­tion, get its re­sult, pass to the third an so on.

Today, psy­chol­o­gists talk more about the mag­i­cal num­ber FOUR, not seven.

Think func­tion com­po­si­tion (as in “I’ll call that func­tion, then that

func­tion, then that func­tion…“), not func­tion call­ing (as in “That

func­tion will call that func­tion, that will call that func­tion…“).

Shortcuts are nice, but only in the short run

A lot of lan­guages/​li­braries/​frame­works add a way to make things shorter, re­duc­ing the num­ber of things you need to type.

But, later, that will bite you and you’ll have to re­move the short­cut and do the long things.

So learn what the short­cut does be­fore us­ing it.

You don’t need to write things the hard way first and then clean up us­ing the short­cuts: All you need to do is what the short­cut does in the back­ground, so you at least have knowl­edge of what can go wrong us­ing it, or how to re­place it with the non-short­cut ver­sion.

On an early morn­ing in the late 1980s, a group of the high­est-pow­ered ex­ec­u­tives at Frito-Lay — the CEO, CMO, and a pla­toon of VPs — gath­ered in a California con­fer­ence room to hear what Richard Montañez had to say.

Montañez did­n’t share their pedi­gree. He was­n’t an ex­ec­u­tive. He had no fancy de­gree. He had a 4th-grade-level ed­u­ca­tion, and could­n’t read or write.

Montañez was a jan­i­tor. But he was a jan­i­tor with an idea — an idea that would make the com­pany bil­lions of dol­lars and be­come one of his­to­ry’s most cel­e­brated and iconic snack foods: Flamin’ Hot Cheetos.

But first, he had to con­vince the world to hear him out.

Montañez grew up in the 1960s in Guasti, California, a tiny un­in­cor­po­rated farm­ing town 40 miles east of Los Angeles.

Under the swel­ter­ing Cucamonga Valley sun, his fam­ily — mother, fa­ther, grand­fa­ther, and 11 chil­dren — scraped to­gether a mea­ger liv­ing pick­ing grapes, and slept to­gether in a one-room cin­derblock abode at the la­bor camp.

As a first-gen­er­a­tion Mexican im­mi­grant at an all-white school, Montañez had ac­cess to few re­sources and strug­gled to un­der­stand his teach­ers. “I re­mem­ber my mom get­ting me ready for school and I was cry­ing,” he later told Lowrider mag­a­zine. “I could­n’t speak English.”

One day in class, the teacher went around the room ask­ing each kid to name his or her dream job: Doctor… as­tro­naut… vet­eri­nar­ian. When she called on Montañez, he froze.

“I re­al­ized I did­n’t have a dream,” he says. “There was no dream where I came from.”

Montañez soon stopped get­ting on the school bus and be­gan board­ing the work truck with his fa­ther and grand­fa­ther.

After drop­ping out of school, he worked the fields in 110°F heat and took on odd jobs slaugh­ter­ing chick­ens at a poul­try fac­tory, wash­ing cars, and pick­ing weeds. With a 4th-grade-level ed­u­ca­tion and few eco­nomic op­por­tu­ni­ties, Montañez saw no path out of poverty.

Then, in 1976, a neigh­bor told him about a job open­ing that would change his life.

Down the road, in Rancho Cucamonga, the Frito-Lay plant was look­ing for a jan­i­tor.

At $4 per hour ($18 in 2019 dol­lars), the job paid many mul­ti­ples of what Montañez made in the fields. It rep­re­sented a bet­ter life — in­sur­ance, ben­e­fits, so­cial mo­bil­ity.

Unable to read or write, the 18-year-old re­cruited his wife to help fill out an ap­pli­ca­tion. He jour­neyed down a dusty road, met with the hir­ing man­ager, and got the job.

When he broke the news to his fam­ily, his grand­fa­ther im­parted a piece of ad­vice that would al­ways stick with him: “Make sure that floor shines,” the man told his grand­son. “And let them know that a Montañez mopped it.”

Montañez de­cided he was go­ing to be the “best jan­i­tor Frito-Lay had ever seen” — and he quickly made his pres­ence known.

“Every time some­one walked into a room, it would smell fresh,” he says. “I re­al­ized there’s no such thing as ‘just a jan­i­tor’ when you be­lieve you’re go­ing to be the best.”

Montañez also de­vel­oped the phi­los­o­phy that “it’s not about who you know — it’s about who knows you.”

In be­tween shifts, he set out to make him­self seen, learn­ing as much as he could about the com­pa­ny’s prod­ucts, spend­ing time in the ware­house, and watch­ing the ma­chines churn out crunchy snacks in the lonely mid­night hours.

And even­tu­ally, his in­sa­tiable cu­rios­ity would pay off.

By the mid-1980s, Frito-Lay had fallen on tough times. As a way to boost morale, then-CEO Roger Enrico recorded a video mes­sage and dis­sem­i­nated it to the com­pa­ny’s 300k em­ploy­ees.

In the video, Enrico en­cour­aged every worker at the com­pany to “act like an owner.” Most em­ploy­ees brushed it off as a man­age­ment cliché; Montañez took it to heart.

“Here’s my in­vi­ta­tion… here’s the CEO telling me, the jan­i­tor, that I can act like an owner,” he later re­called. “I did­n’t know what I was go­ing to do. Didn’t need to. But I knew I was go­ing to act like an owner.”

After nearly a decade mop­ping floors, Montañez gath­ered the courage to ask one of the Frito-Lay sales­men if he could tag along and learn more about the process.

They went to a con­ve­nience store in a Latino neigh­bor­hood — and while the sales­man re­stocked in­ven­tory, Montañez made a for­tu­itous ob­ser­va­tion: “I saw our prod­ucts on the shelves and they were all plain: Lay’s, Fritos, Ruffles,” he re­calls. “And right next to these chips hap­pened to be a shelf of Mexican spices.”

In that mo­ment, he re­al­ized that Frito-Lay had “nothing spicy or hot.”

A few weeks later, Montañez stopped at a lo­cal ven­dor to get some elote, a Mexican “street corn” doused in chili pow­der, salt, cotija, lime juice, and crema fresca. Cob in hand, a “revelation” struck: What if I put chili on a Cheeto?

Introduced to the world in 1948, Cheetos — crunchy corn-based nuggets coated in cheese-fla­vored pow­der — were a flag­ship prod­uct of Frito-Lay. And while they were pop­u­lar among California’s grow­ing base of Latino con­sumers, the com­pany had yet to con­sider re-tai­lor­ing the pro­duc­t’s taste pro­file.

“Nobody had given any thought to the Latino mar­ket,” re­calls Montañez. “But every­where I looked, I saw it ready to ex­plode.”

So, Montañez heeded the CEO’s words and “acted like an owner.”

Working late one night at the pro­duc­tion fa­cil­ity, he scooped up some Cheetos that had­n’t yet been dusted in cheese. He took them home and, with the help of his wife, cov­ered them in his own con­coc­tion of chili pow­der and other “secret” spices.

When he handed them out to fam­ily mem­bers and friends, the snacks were met with uni­ver­sal en­thu­si­asm. He just needed a big­ger au­di­ence…

“I was naive,” Montañez later said. “I did­n’t know you weren’t sup­posed to call the CEO… I did­n’t know the rules.”

Finding Roger Enrico’s phone num­ber was easy enough: It was listed in a com­pany di­rec­tory. He rang the line, and was put through to the chief’s ex­ec­u­tive as­sis­tant.

“Oh, so you’re the VP of op­er­a­tions?”

The as­sis­tant paused for what seemed like an eter­nity. “One mo­ment.”

Then, a voice on the other line: “Hello, this is Roger.”

Montañez told the CEO he’d heeded the call to ac­tion. He’d stud­ied the com­pa­ny’s prod­ucts, iden­ti­fied a de­mand in the mar­ket, and even crafted his own rudi­men­tary snacks in his kitchen.

Enrico loved the in­ge­nu­ity: He told the jan­i­tor he’d be at the plant in 2 weeks and asked him to pre­pare a pre­sen­ta­tion.

Moments af­ter Montañez hung up the phone, the plant man­ager stormed up to him. “He said, ‘Who do you think you are? Who let the jan­i­tor call the CEO?’” re­calls Montañez. “Then he said, ‘YOU’RE do­ing this pre­sen­ta­tion!’”

Montañez was 26 years old. In his words, he could­n’t read or write very well and had no knowl­edge about how to for­mu­late a busi­ness pro­posal.

But he was­n’t about to give up.

Accompanied by his wife, he went to the li­brary, found a book on mar­ket­ing strate­gies, and copied the first 5 para­graphs word for word onto trans­paren­cies. At home, he filled 100 plas­tic bag­gies with his home­made treats, sealed them with a cloth­ing iron, and man­u­ally drew a logo and de­sign on each pack­age.

On the day of the pre­sen­ta­tion, he bought a $3 tie — black with blue and red stripes — and had his neigh­bor knot it for him. As he gath­ered the bags, his wife stopped him near the door: “Don’t for­get who you are.”

Montañez stepped into the board­room. “Here I was,” he says, “a jan­i­tor pre­sent­ing to some of the most highly qual­i­fied ex­ec­u­tives in America.”

At one point dur­ing the pre­sen­ta­tion, an ex­ec­u­tive in the room in­ter­jected: “How much mar­ket share do you think you can get?”

“It hit me that I had no idea what he was talk­ing about, or what I was do­ing,” Montañez re­called. “I was shak­ing, and I damn near wanted to pass out…[but] I opened my arms and I said, ‘This much mar­ket share!’ I did­n’t even know how ridicu­lous that looked.”

The room went silent as the CEO stood up and smiled. “Ladies and gen­tle­men, do you re­al­ize we have an op­por­tu­nity to go af­ter this much mar­ket share?” he said, stretch­ing out his arms.

He turned to Montañez. “Put that mop away, you’re com­ing with us.”

Six months later, with Montañez’s help, Frito-Lay be­gan test­ing Flamin’ Hot Cheetos in small Latino mar­kets in East Los Angeles.

If it per­formed well, the com­pany would move for­ward with the prod­uct; if it did­n’t, they’d scratch it — and Montañez would likely re­turn to jan­i­to­r­ial du­ties. This was his one shot, and some folks did­n’t want things to work out for him.

“It seemed there was a group of [executives] who wanted it to fail,” he later told the pod­cast, The Passionate Few. “They thought I got lucky. They were paid big bucks to come up with these ideas… they did­n’t want some jan­i­tor to do it.”

So Montañez as­sem­bled a small team of fam­ily mem­bers and friends, went to the test mar­kets, and bought every bag of Hot Cheetos he could find.

“I’d tell the owner, ‘Man, these are great,’” he re­called. “Next week, I’d come back and there’d be a whole rack.”

In 1992, Flamin’ Hot Cheetos were green­lit for a na­tional re­lease. And in short or­der, the snack be­came one of the most suc­cess­ful prod­uct launches in Frito-Lay his­tory.

Today, Flamin’ Hot Cheetos are one of Frito-Lay’s hottest-sell­ing com­modi­ties — a multi-bil­lion-dol­lar snack cel­e­brated by every­one from Katy Perry to mid­dle-school­ers on meal vouch­ers. There’s even a rap song about them.

And Montañez is no longer sweep­ing floors: Over a 35-year ca­reer, the for­mer jan­i­tor rose through the cor­po­rate ranks and is now the vice pres­i­dent of mul­ti­cul­tural sales for PepsiCo America (the hold­ing com­pany of Frito-Lay).

Before Montañez joined the ex­ec­u­tive team, Frito-Lay had only 3 Cheeto prod­ucts; since then, the com­pany has launched more than 20, each worth $300m+.

Recognized by Newsweek and Fortune as one of the most in­flu­en­tial Hispanic lead­ers in America, Montañez is a gifted speaker who of­ten tours the coun­try giv­ing keynotes. And soon, his story will hit the sil­ver screen: Fox Searchlight Pictures is cur­rently work­ing on a biopic about his life, ap­pro­pri­ately ti­tled “Flamin’ Hot.”

He still lives in Rancho Cucamonga, where he gives back to his com­mu­nity through a non­profit he launched and teaches MBA classes at a nearby col­lege.

Recently, a stu­dent asked him how he was teach­ing with­out a Ph. D.

“I do have a Ph. D.,” he re­sponded. “I’ve been poor, hun­gry and de­ter­mined.”

Did you like this ar­ti­cle? Each week we pro­duce in-depth, re­search-dri­ven re­ports that show the in­sights into var­i­ous mar­kets and how to pounce on them. It’s call Trends.

You see, we’re a team of an­a­lysts and en­tre­pre­neurs that ob­ses­sively track emerg­ing in­dus­tries. Each week we show you the white space in the mar­ket and how you can cap­i­tal­ize on it. We work to dis­cover mar­ket gaps so you can suc­ceed.

So, want more case stud­ies that de­con­struct suc­cess com­pa­nies? Or re­search that looks at grow­ing mar­kets? Check out our new pre­mium pub­li­ca­tion: Trends.

We live in the era of browser mo­nop­oly. Google oc­cu­pied the whole web by its Chrome. Chrome has more than 50% of users:

Safari is on the sec­ond place just be­cause of ma­cOS pop­u­lar­ity.

Now, most of the de­vel­op­ers choose be­tween Chrome and Firefox. And in 2017 Mozilla re­leased their up­dated ver­sion of Firefox — Firefox Quantum with new cus­tomiza­tion set­tings, bet­ter ex­ten­sions sup­port, pri­vacy and what’s more im­por­tant — speed. 2x faster than old Firefox and faster than Chrome.

Firefox us­ing their own new en­gine with new Quantum CSS and Quantum DOM ren­der­ing. A lot of ex­pla­na­tions here. And Chrome uses a lot of mem­ory, Firefox — less.

Also, Firefox has a lot of use­ful fea­tures like show­ing use­less CSS rules and sup­ports prefers-color-scheme: dark me­dia rules, that Chrome sup­ports only in beta now.

Do you scare about ex­ten­sions? Now, most de­vel­op­ers write their ex­ten­sions for both Chrome and Firefox.

And the fi­nal rea­son — stop the mo­nop­oly. Give a chance to other com­pa­nies that smaller and you can see how fron­tend de­vel­ops.

Move all your book­marks in Firefox for one week and try.

Kelsea Weber is apolo­getic for be­ing hard to get ahold of. “We were all busy tear­ing down the iPhone XS,” she says.

A few min­utes’ con­ver­sa­tion with Kelsea is enough to con­vince you that she would be tak­ing apart brand new Apple gear no mat­ter what, but she does it pro­fes­sion­ally. Weber works for iFixit.com, a web­site you may have heard of once or twice. It pro­vides re­pair videos, man­u­als, and tool kits to more than a hun­dred mil­lion vis­i­tors a year.

Or, to put it bluntly: iFixit.com is es­sen­tially a clear­ing­house for in­for­ma­tion that some of the big names in con­sumer elec­tron­ics would just as soon keep to them­selves.

In the US, man­u­fac­tur­ers in every­thing from con­sumer tech­nol­ogy to farm­ing and agri­cul­ture have long con­structed sys­tems that limit where cus­tomers can go for re­pairs—re­mem­ber the old “warranty void if bro­ken” stick­ers found on game con­soles or TVs? Today if you have a bro­ken iPhone screen, for in­stance, Apple runs Genius Bars across the coun­try where users must go for per­mit­ted fixes. Other com­pa­nies par­cel work out to a net­work of au­tho­rized ven­dors. Manufacturers gen­er­ally ar­gue these con­straints are nec­es­sary to pro­tect pro­pri­etary in­for­ma­tion that gives their prod­uct a leg up in the over­all mar­ket­place.

Slowly but surely, though, con­sumers and third par­ties out­side of ven­dor-sanc­tioned cir­cles have been push­ing to change this through so-called “right to re­pair” laws. These pieces of pro­posed leg­is­la­tion take dif­fer­ent forms—19 states in­tro­duced some form of right to re­pair leg­is­la­tion in 2018, up from 12 in 2017—but gen­er­ally they at­tempt to re­quire com­pa­nies, whether they are in the tech sec­tor or not, to make their ser­vice man­u­als, di­ag­nos­tic tools, and parts avail­able to con­sumers and re­pair shops—not just se­lect sup­pli­ers.

It’s dif­fi­cult to imag­ine a more con­vinc­ing case for the no­tion that pol­i­tics make strange bed­fel­lows. Farmers, doc­tors, hos­pi­tal ad­min­is­tra­tors, hack­ers, and cell­phone and tablet re­pair shops are aligned on one side of the right to re­pair ar­gu­ment, and op­po­site them are the biggest names in con­sumer tech­nol­ogy, ag equip­ment and med­ical equip­ment. And given its promi­nence in the con­sumer tech­nol­ogy re­pair space, IFixit.com has found it­self at the fore­front of the mod­ern right to re­pair move­ment.

“The prob­lem is that there are only two types of trans­ac­tion in the United States: pur­chases and li­censes,” says Gay Gordon-Byrne, the ex­ec­u­tive di­rec­tor of the Repair Association, a right to re­pair ad­vo­cacy group part­ner­ing with iFixit to fur­ther the move­ment. “You don’t own some­thing if it’s cov­ered by an end-user li­cense agree­ment. All you have is a right to use it ac­cord­ing to the man­u­fac­tur­er’s terms.”

Initially part of the per­sonal com­puter rev­o­lu­tion, end-user li­cense agree­ments came into their own in the 1980s. Copyright laws that had worked rea­son­ably well when it came to books and movies did­n’t work as well when it came to soft­ware. Copyright laws ap­ply only to soft­ware code. They don’t ap­ply to the fea­tures and func­tion­al­ity of a pro­gram. So be­fore li­cense agree­ments, a soft­ware pur­chaser could re­verse-en­gi­neer soft­ware and cre­ate a pro­gram with sub­stan­tially the same func­tion­al­ity, leav­ing it to the courts to de­ter­mine if there had been any in­fringe­ment—a costly and time-con­sum­ing process.

End user li­cense agree­ments were seen as an ef­fec­tive way to solve those prob­lems in a sim­ple and straight­for­ward man­ner. For al­most all soft­ware users, the switch from own­ing soft­ware to just hav­ing a li­cense to use it was quite pain­less. Nothing changed in prac­tice: the soft­ware still came in a box with man­u­als and disks, and there was just this ex­tra bit of le­gal fine print that set lim­its on what could be done with the pro­gram, lim­its that most users had no dif­fi­culty abid­ing by. Expressly for­bid­den ac­tions of­ten in­cluded things like re­verse-en­gi­neer­ing the soft­ware or adding fea­tures to it and re­selling it. Some com­pa­nies even sought to re­strict the right to re­sell the li­cense. FTC: Warranty-voiding lan­guage like Nintendo’s and Sony’s is il­le­gal

But in the 1980s and 1990s and well into the first decade of the 21th cen­tury, there was a pretty clear dis­tinc­tion be­tween soft­ware, which was sub­ject to end-user li­cense agree­ments (EULAs), and hard­ware, which was sim­ply sold the way most things al­ways had been. This line started to get blurry as em­bed­ded soft­ware in elec­tronic de­vices be­came more and more so­phis­ti­cated.

From a cer­tain stand­point, all mod­ern elec­tronic de­vices have soft­ware of some sort em­bed­ded in them. An elec­tronic de­vice is, af­ter all, a de­vice that uses elec­tric­ity to ex­e­cute a se­quence of log­i­cal steps, and that se­quence—even if it’s hard­wired into the de­vice—can be con­sid­ered a pro­gram or a piece of soft­ware.

However, as elec­tronic de­vices have be­come more so­phis­ti­cated and more ver­sa­tile, hard­wired pro­grams have been re­placed by pro­grams that are writ­ten in a pro­gram­ming lan­guage and then com­piled and down­loaded onto the de­vice, of­ten along with a sim­pli­fied op­er­at­ing sys­tem, mak­ing these de­vices anal­o­gous to desk­top PCs or lap­tops.

Today’s soft­ware is much more eas­ily ac­cessed and mod­i­fied than the hard­wired logic cir­cuits of ear­lier de­vices, and with in­no­va­tions in elec­tron­ics in­creas­ingly due to the soft­ware pre­loaded on the de­vice, man­u­fac­tur­ers of all stripes sud­denly found them­selves look­ing for pro­tec­tions for this soft­ware.

Their so­lu­tion was bor­rowed di­rectly from the PC en­vi­ron­ment: the end-user li­cense agree­ment. And buried in al­most all end-user li­cense agree­ments is a clause that gives a man­u­fac­turer the right to al­ter the terms of the agree­ment uni­lat­er­ally, typ­i­cally with min­i­mal ad­vance no­tice.