Hard drive hack provides root access, even after reinstall - <AUTHOR> http://spritesmods.com/?art=hddhack <comment><USER2> This was a great read. One of the things we've done in the past is to modify the firmware of the drive to be able to give errors on command. The purpose was for testing RAID systems in real life scenarios. One can include a 'unit test' drive in a RAID array which will run through a series of known bad disk behaviours. From the simple like returning read failure, to the more complex like returning the wrong block or returning a block that has been silently corrupted (both things NetApp observed in the wild on 'real' drives), and my personal favourite acknowledging a write but not actually writing the data (nearly killed the Cisco relationship they had at the time)

<comment><USER3> I especially like the idea of cannibalizing old HDDs (with bad spindles but good controllers) to become microcontrollers in new projects.

<comment><USER4> Not a bad idea, but also nearly everything we interact with, technology-wise, has microcontrollers of some form or another. The AVRs so adored by the arduino community actually exist in large volumes in automobiles, and even crappy USB keyboards and mice which we might throw out have microcontrollers in them.

So I'm all for scavenging compute bits for future projects, but it is by no means unique to HDDs.

<comment><USER2> The key is tools, and OpenOCD is one of them, which let you "talk" to these systems. I picked up a Black Magic probe [1] and am building cables for it to talk to one of my ARM boards. That kind of stuff makes the spelunking possible.

[1] [http://www.blacksphere.co.nz/main/blackmagic](http://www.blacksphere.co.nz/main/blackmagic)

</comment></comment></comment></comment><comment><USER5> If you liked this, then you might like Travis Goodspeed's really cool talk about "Writing a Thumbdrive from Scratch" (for antiforensics) [1] at the 29th Chaos Communication Congress [29c3].

[1] [http://www.youtube.com/watch?v=D8Im0_KUEf8](http://www.youtube.com/watch?v=D8Im0_KUEf8)

<comment><USER6> At some point, computer systems will be more like biologic systems - they will just carry a more or less permanent "flora" of parasites, that will have to be tolerated unless they become explicitly hostile.

Any sufficiently complex system will exhibit this trait sooner or later.

<comment><USER7> That's an interesting way of looking at "parasitic" programs. Maybe we could even get those parasites to work for us, like trapping them as the house pen- tester. You could employ the constant barrage of attempted ssh logins as remote connectivity check or something.

</comment></comment></comment><comment><USER8> The thing that interests me, though, is the idea of modifying your hard drive firmware for better performance.

My understanding is that the effective width of the write head is 10x the width of the read head... E.g. with the right firmware, it should be possible, if you are okay with a write-once medium, to write the outermost track, move the write head in 1/10th what you'd normally move it, then write the next track, etc... and get 10x the space out of the drive you normally would. In theory, the read head wouldn't have trouble. (of course, this would be write once storage, as the effective width of your write head is still pretty huge; but for a bunch of things? I can totally work with that... if more than X% of a drive was garbage data, I copy the good data to a new drive and reformat the old one. Done.)

I hear rumors that both the major drive manufacturers are actually shipping drives with this technology, but are only selling those drives to really big players, for some reason.

Here's a reasonable reference to the 'shingle' technology, and he roadmap for the rest of us:

[http://www.theregister.co.uk/2013/06/25/wd_shingles_hamr_roa...](http://www.theregister.co.uk/2013/06/25/wd_shingles_hamr_roadmap/)

but that's the thing, with the datasheets (and, well, a lot more skill than I personally have) we should be able to setup something like shingling on the cheap disks we have today.

Of course, from reading the article, I'm not sure I'm any closer to that particular dream.

<comment><USER9> Shingled writes require a special asymmetrical write head, you can't do it with current drives. Actual shingled write drives are not yet shipping AFAIK.

<comment><USER8> I'm just using shingled writes as one example. Your kernel could, for example, more efficiently reorder reads and writes with more information about the physical drive layout. Hell, just removing the bad-sector remapping (and moving it up to the kernel or the like) would help solve the performance degradation that remapped sectors cause during apparently sequential reads/writes.

<comment><USER10> I'm sure the people who make the drives are trying to get as much performance as possible from the firmware. They're also working with information you won't have.

<comment><USER8> >I'm sure the people who make the drives are trying to get as much performance as possible from the firmware.

Huh. I think it's fairly common that companies engage in price discrimination by producing a lot of the same hardware, then crippling the hardware sold to the lower-end. Note, my example of hard drive manufactures doing this has to do with the next bit of your quote:

>They're also working with information you won't have.

So the 'crippling' I whine the most about is the difference between 'consumer' and 'enterprise' hard drives.

If you aren't running a hard drive in a raid, if it's just one drive in a desktop, generally speaking, if there's a problem? you want the thing to keep retrying, if there is any chance at all that it might be able to resolve the problem.

If it's just one drive in a desktop, it's almost always best to do something that will make the drive go slower than to cause the drive to fail.

My situation? where drives are sitting in a RAID? almost the exact opposite.

So yeah; me? I spend twice as much money to get "enterprise" drives that are almost identical, mechanically, but come with slightly better firmware. Firmware that just fails, rather than waking me up in the middle of the night.

(A friend of mine has been telling me: "Luke, a hung drive is just a special case of a slow drive; You need to monitor read/write latency and proactively fail slowish drives. check out blocktrace" \- and he's probably right.)

Note, WD has TLER, which they say you can change with WDTLER.exe. In my experience? works on about half the drives you try, and even then those drives are far more likely to get slow (but not completely hang) than an 'enterprise' drive.

Now... let's talk about bad sectors. Filesystems have been handling bad sectors, well, for most of my life now. they can do it fairly well.

The problem with letting the firmware handle bad sectors is that the OS doing read/write reordering assumes that if you write sector 559 560 561, those are physically sequential. Once the hardware firmware remaps sector 560 off into the fucking boonies, my nice sequential read is now completely fucking random... and way slower. My point is that something like ZFS can handle bad sectors way better than the drive firmware, because it's got a lot more information. A lot more information in the case of read errors... all the firmware can do is hang you up retrying; the RAID layer could actively grab that block from another drive.

So yeah, they have information I don't have... and my computer would go dramatically faster if I could have that information. My pager

<comment><USER11> From what I know when a drive "reallocates a sector" it actually reallocates a track or something very close to that. So that at least for the rotational sequencing the performance will not change that much. Ofcourse, the track that used to be just one track seek away now became further off.

There are also several places along the way where reallocations go to and the drive tries to find the closest one to the reallocated tracks to avoid too large seeks.

</comment></comment></comment></comment></comment></comment><comment><USER12> My knee-jerk reaction was, why didn't WD sign the code and use on-chip fuses and a secure boot path to verify the code before transferring control to anything outside their boot ROM? (Many ARM-based systems-on-a-chip are capable of doing this).

Adds cost, for one thing. But you can arrange for the unit to never run a byte of code (even one loaded from the platter) that didn't come from WD.

<comment><USER13> The knee jerk reaction to secure boot-anything from the technical community has been generally "No!", "It's a trap" etc.

<comment><USER14> The knee jerk reaction is not to secure boot but to who has the ability to set the keys. The technical community likes to be in control of that.

<comment><USER4> That is closely tied to "who gets to audit the source".

E.g. the FOSS community wasn't a fan of only-trusted-secure-boot when it was microsoft holding the keys and the source and releasing neither.

</comment></comment></comment></comment><comment><USER15> something I hadn't really considered about hard disk encryption, before reading this, is how it could protect against compromised disk controllers. if the OS encrypts the data stored on the disk, it would be a lot harder (perhaps, with the right composition, impossible) for a malicious disk controller to insert/change/modify important data (like code, or password files) stored on the computer.

we think of the system as a holistic entity, but turned on its head, you can see how the inside of a computer is just a network...

<comment><USER16> Maybe I misunderstood, but didn't the harddrive have direct memory access (DMA)?

<comment><USER17> The DMA mentioned in the article was internal to the drive, between the hardware interfaces and it's internal cache. The drive did not have DMA access to _system_ memory.

<comment><USER18> Even though it wasn't discussed in the article, I think firewire and thunderbolt external drives DO have direct DMA access to system memory. Google for SBP-2 and DMA, and a bunch of articles about protecting against firewire attacks against full-disk-encryption (among other things) appear.

<comment><USER17> I know you're right on FW. I believe DMA was designed in because they recognized that the CPUs of the time weren't powerful enough to move uncompressed full-resolution video from around. I don't know about Thunderbolt, but I'd expect you're right.

<comment><USER19> Thunderbolt is just pci-express in new clothes, so yes, it does.

<comment><USER17> Good point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Could this attack compromisse dedicated/rent servers? If so, the attacker could rent, install the exploit on the hardware and terminate the contract. What about cloud servers? Sure there are virtualization layers, but can't those be breached? If so that would pose imense danger given the distributed nature the hardware exploit could render the entire farm vulnerable

<comment><USER21> The attack could compromise other servers yes. I think the scenario you describe is a possibility, although there are some technical feats that would make wide-scale exploitation difficult - you need to know what you want to modify ahead of time which would be difficult.

Virtualised environments that don't pass the vendor specific commands should be immune to the attack though. As others have said, encryption would probably allow tampered pages to be detected. I'd be interested to see if the modified firmware could ignore new firmware...

<comment><USER22> > encryption would probably allow tampered pages to be detected

Careful!

It _can_ , but doesn't always. For example, eCryptfs currently doesn't protect against tampering; it uses Cipher Block Chaining (CBC) mode without a HMAC or other signature.

(I'm working with some colleagues to add Galois/Counter Mode (GCM) support to eCryptfs, which does provide some form of tamper-detection.)

</comment></comment></comment><comment><USER23> Installing linux on a hard drive never sounded impressive before.

<comment> cupcake-unicorn Well, to be fair, it's a bit of a pain with UEFI.

But this is really amazing. I'd love to see how it could be extended to other OSes, if possible?

<comment><USER24> I'm not sure about the other controllers, but if this one has a Cortex M3, then anything that runs on an M3 could hypothetically be ported.

One of the SE sites assembled a list. Shockingly, the question isn't closed yet!

[http://electronics.stackexchange.com/questions/27594/what- op...](http://electronics.stackexchange.com/questions/27594/what-operating- systems-have-been-ported-to-cortex-m3)

<comment><USER18> The Feroceon CPUs are pretty hefty too. They're powering the Marvell Kirkwood platform which is used in things like the Sheevaplug and some of the QNAP TS-* NAS devices. Debian runs great on those. (2.0ghz CPU, 512mb ram). Probably the biggest trouble here is the lack of an MMU (?) .

<comment><USER25> uclinux can run on mmu-less systems, so I do suspect you can run Linux on this hard drive.

</comment></comment></comment></comment></comment><comment><USER26> The first hack read on hacker new I have seen for a long time.

<comment><USER10> What? You don't consider "growth hacking" real hacking?

<comment><USER27> That depends if you're just buying the pills from the spams or going to the hardware store and building your own pumps etc.

</comment></comment></comment><comment><USER28> A fascinating read, and an excellent piece of work.

It reminds me of a similar proof-of-concept hack on a common network card firmware: [http://esec-lab.sogeti.com/post/2010/11/21/Presentation- at-H...](http://esec-lab.sogeti.com/post/2010/11/21/Presentation-at- Hack.lu-:-Reversing-the-Broacom-NetExtreme-s-firmware) (the slides linked from that page have a good more technical overview that the blog post).

</comment><comment><USER29> I think some hard drives like some Seagates has a serial console in the firmware that provides low level access that data recovery companies for example use.

<comment><USER18> I'd love to read more info about this!

<comment><USER29> [http://www.msfn.org/board/topic/128807-the-solution-for- seag...](http://www.msfn.org/board/topic/128807-the-solution-for- seagate-720011-hdds/)

[http://elabz.com/forums/electronics-repairs/list-of- seagate-...](http://elabz.com/forums/electronics-repairs/list-of-seagate- firmware-terminal-commands/)

<comment><USER18> Thanks for the links :)

<comment><USER30> While I haven't written it up anywhere, it's also fun to point out that I've had success talking to a Seagate drive by wiring the debug port directly to the TTL serial pins on the debug header of a Linksys WRT54G router.

</comment></comment></comment></comment></comment><comment><USER31> Does a jellybean part just mean its very common?

<comment><USER32> Yes, it means that you can buy them like jellybeans (and they're about the same size, and black, which is either the best or worst flavor.)

</comment></comment><comment><USER33> > Because Linux caches the shadow file (like all files recently accessed), I > have to generate a lot of disk activity for the file to be 'pushed out' of > the cache

[http://linux-mm.org/Drop_Caches](http://linux-mm.org/Drop_Caches)

$ echo 3 > /proc/sys/vm/drop_caches

or as non-root

$ echo 3 | sudo tee /proc/sys/vm/drop_caches

<comment><USER34> I do not believe that using _sudo_ exactly counts as "non-root".

<comment><USER35> They meant "when not root".

</comment></comment></comment><comment><USER36> Great article. But what I came away from it thinking was about how much money is spent by state security institutions to prevent this sort of thing, and yet secrecy breeches at scale are the Walkers, Mannings, and Snowdens using USB sticks and DVD's and copiers.

</comment><comment><USER37> This is some hard core hacking! Love it! First, as others mentioned, this is why you should always encrypt your os drives. Second, it also got me thinking, how many other devices are open to this kind of attack. Like a network switch, perhaps? Say you buy 100 network switches, alter the firmware to call home and maybe even load a Linux instance, and then resell them on amazon, eBay, or even better, give a "good" cash deal to some local IT company. Then you just seat back and wait for your 100 bots to call home for their new business class Internet homes.

</comment><comment><USER18> This is incredibly scary. Will HD vendors start implementing firmware code signing anytime soon? Or will some enterprising hackers start working on an open source firmware implementation?

</comment><comment><USER38> That's a whole world of spying opportunities. A government could make secret deals with hard drive manufacturers. Perhaps not US government, but Taiwan government, if it makes you happier... (I'm from neither country)

<comment><USER39> Could? How do you know they didn't do it already?

</comment></comment><comment><USER40> This is very cool. I have a pile of dead and old hard drives. I should see if my local hackerspace has something that can connect to JTAG, and if so, see what secrets the old drives contain.

</comment><comment><USER41> I remember Dejan Kalijevik from them nokia s/w. Is he talking of the same Dejan?

</comment><comment><USER42> what is that cortex-M3 chip doing? Did the NSA put it there?</comment>


I Want a Better Keyboard - <AUTHOR> http://miker.org/i-want-a-better-keyboard/

<comment><USER2> I'm someone else for whom the the CODE keyboard doesn't approach anything like an improvement over the status quo ante. For me, start with a Kinesis -- the layout is what I'm used to after a decade, and the hand position is the best I've ever tried -- built in a hardwood case custom sized to my (large) hands. I'm sick like unto death of ugly plastic crap; even as I've been using my Kinesis for a decade, it looks disposable and junky.

I want backlit keycaps. I want it to be 100% re-mappable on the keyboard itself, and I want a bunch of "blank" keys for extra modifiers (super/hyper) and macros. I haven't figured out where to put them on the modified Kinesis layout, but there's space in there, particularly if I can replace the useless PgUp/Down et al with something I actually use.

I don't particularly care about the keyswitches, but because I want to have a single keyboard for the duration, I'll need to be able to replace them as they fail. So let's make that nice and simple.

Connecting to the host should be simple, so a single cable would be good. Of course, I hate USB, and the HID in particular, so we'll need a better connector and a less warty driver interface.

And of course, there won't even _be_ a caps-lock key. Attempting to add this feature will cause the keyboard to explode.</comment>


Ask HN: Where do I go to sell a break-even business with 50% margin and great SEO? - <AUTHOR>

<comment><USER2> From a patio11 comment: [https://news.ycombinator.com/item?id=8314849](https://news.ycombinator.com/item?id=8314849)

> _People pay for their future revenues, not your sunk costs. In the world of > small website acquisitions, you 'll be valued at something like 1X your > previously proven annual revenue, not at a linear projection from what spike > day looked like. If that number is -- let me pick a representative example > -- $100, then you have a $100 site, not a $60,000 site, even if $60k is a > reasonable approximation of the cost of duplicating it using market labor._

<comment><AUTHOR> Great point, yes makes sense.</comment></comment>


Post Startup Founder Feeling Lost, Career Advice Appreciated - <AUTHOR>

Hey HN,
I am hoping to get some career advice, because to be completely honest I am stumped and don't know what to do next.
My own background is I am self taught in it, have worked as a Linux sysadmin for a few years at an ISP, worked at a comp security company for a while doing protect evals, support on products, pen testing, then I did my own start up, I bootstrapped a SaaS antispam service as a single founder/sole employee company based around open source with a custom frontend written in PHP/MySQL. It had ~2000 companies using the system when I sold it. But I didn't have many direct clients, it was almost all through a network of resellers I built up to insulate me from having support issues from users kill all of my time. On top of that I did freelance web dev work in PHP/MySQL. I sold that business a few years back and went back to college to do study law. I became a father while completing my studies and so I decided to take more time out to hang out with my son while I could afford it.
Now I have wound down the funds from my old business, I want to get back working and be a part of something.
The problem is that I'm not really good with the things that are current. Everything now is virtualization, ruby, node. I haven't been exposed much to these things, even things like Nagios, I didn't use that in my business, I just wrote scripts which sent me an SMS based on certain criteria.
One recruiter told me that's no good, their client wants Nagios experience. Even my PHP ability isn't the best, I write everything as functions, and job descriptions want OOP.
Any job I see is looking for people who are specialists, I'm not a specialist, in the guy who is too stubborn to give up and eventually figures the thing out.
I have also found out that HR have blocked applications I have made because of the gap in my work/employment history, I sold my business in late 2008, so I can see how late 2008 to early 2012 would be an issue from a HR perspective.
I am thinking of doing the RHCE as a way to verify to perspective employers that I do currently have an ability to manage Linux systems, I figure some sort of third party validation would help hiring managers get over the career break.
Should I take a junior position and work my way back up the career path? Do I just keep applying for jobs with experience and work on explaining the employment gap? I think me being rusty is also an issue after such a break, which negates slightly against me getting jobs with experience, at least so far that seems to be the case. Do I start learning Ruby and write something to release as open source to show I can write Ruby code? Maybe just giving up on getting hired and trying to bootstrap a business again from scratch is the way to go?
Has anybody else found themselves in a similar position after selling a start up? If so, what did you do at this point?
Apologies if this post comes across as complaining, that really isn't my intention. I'm just a little frustrated and not sure what direction I should take. <comment><USER2> > Has anybody else found themselves in a similar position after selling a > start up? If so, what did you do at this point?

Yes. I did a lot of research. I talked to HR people I knew, people who had owned businesses and sold them (online and in person), and hiring agents (recruiters). I probably revised my resume ~50 times before I had something that I was comfortable with.

You need to explain your lapse somehow. The reality is that companies don't want to hire people that might leave. Being that you've got a four year gap in your employment history AND you were self-employed, they take you for somewhat of a one night stand. You need to write a good cover letter to explain what you got out of your entrepreneurial phase and what you're looking for now.

Finally, if your skills are out of date your skills are out of date. I don't want to be harsh, but in 2012 it's inexcusable to not know OOP PHP (or even OOP Perl!). Your skill set seems to fit the role of crufty systems administrator very well. Is that what you're looking for?

My final piece of advice would be to find an amazing recruiter (easy, right). I was placed within six weeks of starting to look (after only a two year lapse, though) because my recruiter was incredibly honest with me about my skill set and what other companies were looking for.

</comment><comment> hippee-lee Never sold a start up but I left a career in biotechnology for web programming. Have bounced around some small agencies with saas apps and code bases I would describe as corner case hack on top of corner case hack.

After the last one ended badly I started my own thing and am reaching out directly to find some customers who don't care about changing the world, they just need some solid web help but not a full time web person. I'll be honest, I'm not sure where it's going to go.

I did identify with some of your comments thugh. All the contract/fte job descriptions I see theses days are looking for experts in a wide range of technologies (frontend ninjas and backend rock stars ...) for jr to mid level positions. I just don't get it. When I was in the lab, even the sr research associates took several months before they had learned enough bout the way the group operated to take projects over in full. I started out of college, had a great mentor in the lab and it still took a year to learn stuff you can only learn on the job. Is programming different somehow? I dont think so but I didn't start dabbling in computers until later on in my twenties.

( note - anocedotal evidence of one) There is a weird dichotomy in tech. It seems that there are two perceptions I see. The first is that it is really hard and complicated (it is but no more so than analytical chemistry and LC- ms/ms) and the second is that everyone from jr level up should be figuring it out on their own from day one. I find this odd but I may not have worked for the most skilled companies in software development. What's frustrating is that no one else would call me back so I think for now, I'm going to go to focus on what I can do well and reach out to businesses in my area and see what they need done.

If you want to talk, my email is I my profile I don't know if I can help or answer your questions but I am happy to listen.

</comment><comment><USER3> Ralph, it is really difficult when you head back to job after running your startup and searching for job. The unfortunate part of running a startup or business is that you know everything and we somehow miss being best in one thing.

You can keep searching for job, but if you can run one more startup that would be great. However startup is all about energy...if you are feeling you are not in any position to run one more startup...then completely focus on searching job and don't take any job…as it will again make your resume weak.

There is no need to start small and re-build everything. I know there is a gap in your career...but you did something in that period, right? Show it in resume and show one skill which you can do properly. Don't show everything which you can do...if you are good in coding, show that, in sales…show that. But show only one thing.

Re-revise your resume.

Finally; if you still have enthusiasm and energy from inside...run one more startup, if not...come back again. But take a job first now, without any second thought. More doubts will drain more energy.

I would suggest you plan a new startup and execute it as early as possible...and at the same time look out for job. If you get a good job…that's fine or else at least you are building something. But focus more on getting a job and show a proper skill in your resume.

If you are not good with the current technologies…see if you can be a business analyst or project co-coordinator position or something where you can show your functional side. Learning a new technology will be a waste of time now and will drain your energy more.

See what is the one best thing you can do and shape your resume accordingly…don't make your resume as per your experience 4 years back and what is running in market.

</comment><comment><USER4> It's really hard. You can tell that job adds are written by people that don't know WTF they are talking about. The number of people that are specialists in more than 1 or 2 areas are rare. And expert? What does that really mean.

The problem is, in order for recruiters to justify their 30k+ fee, they have to ensure that their recruits are worth it...and the perfect person for the job. Which is to be expected when you are selling yourself to a non-technical startup CEO. But really, there isn't a single engineer that will pass on the right talent b/c of zero tolerance for a learning curve.

These days, having an exit under your belt is a big deal. Get back into the startup community, if that's where you want to be. I do think you should pick one new technology and crack it open. However, don't be afraid to learn on your prior works.

You should start some side projects, or if you worked on a few things over the years, say so.

But, use linkedin. Reach out to CEOs / higher-ups at the companies you'd like to work for. Talk to them. They'll appreciate your history. Just get out there and flaunt it.

BTW, there is very little new under the sun, the same is true in tech. There are new packaged, frameworks and the like, but if you learned it once, you can again...and faster the second time.

<comment><USER5> I agree with your conclusions regarding recruiters.

Most all of them will tell you they are shackled by their clients; and I don't blame them for being treated like that since they are charging large amounts of money.

</comment></comment><comment><USER6> Spend some time working through this if you want to learn Rails.

[http://ruby.railstutorial.org/ruby-on-rails-tutorial- book?ve...](http://ruby.railstutorial.org/ruby-on-rails-tutorial- book?version=3.2)

Also, bugger recruiters, what do they know? Talking to a recruiter usually means there are at least two people between you and anyone actually on the product team. Real experience in the trenches really getting things done is valuable. You can always learn another language, framework, library, whatever you need.</comment>


Treating the Bay Area as like working in the mines - <AUTHOR> https://pedestrianobservations.com/2018/09/24/the-mines/ <comment><USER2> I'd say it's more like conventional factory towns from a couple centuries ago.

I grew up in the Boston area, and on a recent trip back home, took my wife to see Lowell National Historic Park, birthplace of the industrial revolution in America. It struck me how similar the stories of the young women who went to work in the mills were to the young people who now flock to the Bay Area. Like today's workers, they were fleeing political instability & violence (for immigrants) or economic stagnation and lack of opportunity (for domestic migrants). Like in the Bay, they were thrust into a melting pot of cultures that sometimes stirred conflict but usually ended up broadening their horizons. Like in SF, they lived in small tenements or boardinghouses, often 2/room. Like at tech startups, they worked long hours in often alienating conditions to make capital owners rich.

The interesting thing about it was that despite all the hardship, it was very often the right choice financially for them. Many of the women who worked in the mills would "retire" in their mid-late 20s or early 30s, having saved up the majority of their wages. They were then free to do things like become a pastor (the 1840s equivalent of living a life of spiritual enlightenment), or get an education (nearly unheard of for women in those days), or marry above their previous station and have a family, or return to their hometowns and buy up large swaths of farmland that would've been out of their reach had they stayed on the farm they grew up on.

The people who really got screwed by the industrial revolution were those who _didn 't_ take the factory jobs in poor conditions - the small homesteading farmers, the artisans and craftspeople, the local merchants. They were largely wiped out as the new means of production spread throughout the world, bankrupt dinosaurs who eventually had to sell what was left of their homesteads when the dust bowl hit almost a century later. Most of them ended up catching the _next_ wave, though, migrating to California or the Great Lakes and getting jobs in the new aerospace, defense, and automotive industries.

<comment><USER3> > Many of the women who worked in the mills would "retire" in their mid-late > 20s or early 30s, having saved up the majority of their wages.

Thanks for sharing. I was under the impression that this was a relatively new phenomenon with the advent of sky high compensation in tech roles.

Do you happen to know how common it was for them to be making, say, $300k in inflation adjusted terms by, say, age 26?

I'd love to read more about this if you have any links. All the stuff I remember reading in school was about how horrible it was.

<comment><USER4> My guess was that standards of living were drastically lower back then, so the accumulated factory wages could make a difference. Back then, people lived in crappy little houses with no electricity, no water/sewage, obviously had no cars etc. There was relatively little stuff in their lives, so, as long as the land provided you with food, you didn't need much money. My grandma used to live like this in rural Poland - they occasionally bought something with money, like salt or matches, both mostly were self-sufficient.

<comment><USER5> Isn't that likely to be the same as what people 90 years in the future will say about us, though?

<comment><USER6> In most of the developed world, literally all of our necessities (housing, healthcare, even food) require interaction with the money economy, which is the opposite of what is described here, so probably not. Even the Amish have to interact enough with the "English" economy to buy things like nails, and to pay their property taxes. Possibly we can operate this way again, with nano- factories turning homegrown soybeans into jeans and iPads or something, and a self-healing infrastructure, but that's far future sci-fi, not current reality.

</comment></comment></comment></comment></comment><comment><USER7> After 5 years there, my conclusion was that the Bay Area runs on human souls. It might not be like the black lung, dirt-faced dangerous mines of old, but if you end up working 10 or 12 hours a day, are caged, distracted, annoyed (but fed!) at work, go home to a meager existence, have zero friends, zero romance, and your mind is hijacked to the point where you literally cannot think about anything else and _relax_ , then your soul is being pretty much sucked dry.

Get out if you can.

<comment> EZ-E > It might not be like the black lung, dirt-faced dangerous mines of old, but > if you end up working 10 or 12 hours a day, are caged, distracted, annoyed > (but fed!) at work, go home to a meager existence, have zero friends, zero > romance, and your mind is hijacked to the point where you literally cannot > think about anything else and relax, then your soul is being pretty much > sucked dry.

I would get my soul sucked dry for a few years for 100k$+ a year - for few years

<comment><USER8> 100k$ won't create much savings in the Bay Area. At least aim for 200k$ there if you want to sell your life for years.

<comment><USER9> 100k in most of European big cities are not going to send you to pension at 40 either, 200k is the 6figures salary of the 90s

<comment><USER8> True, in Europe high taxes take an additional toll, also the salary situation is so that it's basically impossible to get 200k in Europe if you're an employee.

</comment></comment></comment></comment></comment><comment><USER10> Its a harsh but fair analogy. The region has lost its soul.

People moving there have little intention of setting down roots and staying long term. People who have lived there long term are just waiting to cash out on their house and move far away and just hoping the local tech ecosystem doesn't implode first. Employees think they're playing the companies by taking big pay then getting out and going elsewhere. Companies think they're playing employees by having a seemingly never ending supply of "miners" looking to live and work under conditions most "normal" people would laugh at. Yes, it's a mess.

<comment><USER11> I grew up here, and have always wanted to stay, but the affordability bar for that has been constantly going up. I switched into software engineering in the hope that I could afford to keep up with rising housing prices. I'm just hoping all the people planning to get out do so soon in the next recession. Because god knows the NIMBYs aren't going to allow enough housing for everyone in the meantime.

</comment></comment><comment><USER12> If you don't have kids, and don't plan to, the Bay Area could be a fun ride. And if it turns out not to be, well, you can just lick your wounds and leave.

If you have kids, or think you might, you're doing them a grave disservice by moving to the Bay Area, given the alternatives currently available in America.

</comment><comment><USER13> There's really no way to intellectualize it - people coming to the Bay Area in 2018 are suckers, plain and simple.

You missed the boat - by years. Not only will you never afford a home here, you will piss away so much money on rent and other aspects of the absurdly inflated cost-of-living adjustment that you won't be able to leave and buy anywhere else either. If you're coming up on forty and still renting your primary residence, you are in real danger of financially screwing yourself for life. Traditional models of retirement have people paying off their homes in full by around fifty so they can start building their retirement funds.

Forget about catching a break when the "bubble bursts"...the "bubble bursting" means most people reading Hacker News will be out of work or feeling very nervous about their jobs.

<comment><USER14> What the article is saying is, If you are young and have no family, you can rent a room really cheaply say 1400$ for a 1 bedroom, or bunk up with a mate for 700$ (2 people renting 1 room), and save most of your income for about 10 years - durring that time you can save about 500K. Then after that, get out and go anywhere but CA. In the rest of the US, you can buy a house for 300K and have a nice life.

The trick is, to not settle down. Don't get a wife or girlfriend or friends. If you that, you'll be able to walk away from it all very easily.

<comment><USER15> > The trick is, to not settle down. Don't get a wife or girlfriend or friends. > If you that, you'll be able to walk away from it all very easily.

10 years without friends and partners (to use a gender neutral term) would literally be hell. Its not that hard to find a healthy mix and not bust your bank in the process.

</comment></comment></comment><comment><USER16> I'm looking to relocate to the Bay next year, and I'm exploring renting a one bedroom with my partner. Our plan is to rent as cheaply as we reasonable can, even if we can afford more (that is what we are doing right now).

I think the analogy to the mines is spot on. At the same time it seems like the most rational approach for most tech workers. Even if I wanted to stay in California, as a foreigner in a L1 visa, my future will be too unpredictable to commit myself. Even after getting a green card, another recession would most likely force me to leave the area, if not the country altogether.

Having worked through 2008 I know the current situation won't last forever. In the meanwhile, I rather work in the mines and extract as many resources as I can from the ground. Once the mine dries up and we are forced to move I'll have time to reevaluate my position in life and priorities.

<comment><USER15> Mine are similar and I just moved. Its as demanding as I was warned it would be but oddly I feel great. I've never had as much responsibility and yet have to work on tough engineering problems at the same time before. Maybe this is the best way to learn for me; I feel like I've learned a lot from being around very very effective and driven engineers. Its increased my confidence in my craft. And I think those intangibles are worth a lot more down the line.

Of course, I'm able to work as hard because I kinda really like programming and learning about how Computers/Algorithms work. If I didn't have that inclination, then this would be hell.

</comment></comment><comment><USER17> At $5,500 per month is that to rent or buy?

I currently spend about 25% of my after-tax salary on rent and I consider it too much for me.

$66,000 => $264,000 after-tax. Californian marginal income tax bracket for $52k - $268k is 9.3% So $264,000 after-tax => $291,000 pre-tax (I know that's not how tax brackets work but I'm just estimating)

And that must be base salary since you can't pay rent or buy food with stock options.

On Glassdoor a SENIOR developer at Google in SF shows as only $170,000.

So can someone either tell me where can I get a $300k job as a MID LEVEL developer or tell me how on earth the author considers $5,500 per month an affordable housing cost?

Side note: My marginal income tax rate in Australia is 37%... I feel absolutely robbed looking at these California tax rates

<comment><USER18> Here are real numbers.

Background: Average of 10 programmers who range ages 22-25 and are 2-3 years out of college.

Base: 140k Bonus: 30k Equity: ~60k Total: $230k year pretax.

Taxes: \- 33% federal bracket \- 10% state bracket \- 7% FICA+Medicaid. (50% total)

Brackets listed are marginal rates, actual rates are noted here: [https://smartasset.com/taxes/california-tax- calculator#p9c7Y...](https://smartasset.com/taxes/california-tax- calculator#p9c7YRLmHn)

Let's run the math \- $230k comp - $83k taxes = $147k/year \- assuming no other expenses, no retirement savings and no other income, that's 147/12 = $12.2k/mo, post tax. At this point $5,500/rent is easy.

Realistically, the breakdown is more like this: $147k post tax income \- $20k retirement \- $18k food/drinks ($1500/mo in SF is reasonable) \- $10k car payments \- $10k insurance/misc = $89k/year

$89k / 12 = $7,400/mo post tax and expenses. A $5,500 rent is still doable, but again extremely stupid because you aren't saving.

<comment><USER19> 20% bonus is not what mid engineers get.

60k equity is probaly over 4 years not 1. 60k over 4 years is actually close to average equity comp for 140k comp bracket.

You are off by 50k.

Signon bonuses can bring total comp to 200-210k.

Background: I write eng offers and know comp brackets.

<comment><USER18> I do not doubt your work experience, but I would like to respectfully point out that the data I have for those ~10 engineers does indeed match to the numbers I have presented.

Either way, with $200k salary the rent mentioned in the article is doable.

</comment></comment></comment></comment><comment><USER20> The author seems pretty confused about the geography of the bay area, and comes to odd conclusions because of it. First of all:

> Google programmers living two to three to a bedroom in Bernal Heights, not > even that close to BART.

Why would Google employees care about living close to BART? They take the Google shuttle to work, and Bernal has great highway access, making it a shorter commute than other parts of SF.

Besides that, the people I know who have tons of roommates in SF do it because they want the experience of living in SF (culture, nightlife, food, socializing). If they just wanted to make money and save as much as possible, they'd live on the peninsula or in the east bay and have a more comfortable, and also cheaper, housing situation.

Even for people working in SF (SOMA), commuting on BART from Oakland is often faster than many parts of SF, and almost certainly cheaper. If you choose to live in SF anyway, it's because you want to be there specifically.

</comment><comment><USER21> what's wrong with working in the mines? everyone is afraid of working hard? my parents spent every ounce of their being working hard so their children could have a better life.

you think this is something difficult try on a true "work is life" existence like the people that made your phone and laptop.

and, no one is being marched here. no one claims it is better than a slow and steady and more well rounded life. i mean besides the incessant drone of pop culture.

just a couple of counterpoints to the developing arguments.

i do like how the article itself isn't judgemental about t. it's a fair piece.</comment>


Confession of a C0dez Kid (2001) - <AUTHOR> http://readtext.org/history/confession-of-codez-kid/ <comment> vezzy-fnord This is cDc #395 and it actually dates to 2004: [http://www.cultdeadcow.com/cDc_files/cDc-0395.html](http://www.cultdeadcow.com/cDc_files/cDc-0395.html)

It is indeed one of their best.

<comment><AUTHOR> Looking at original text file form [http://textfiles.com/history/c0dez.txt](http://textfiles.com/history/c0dez.txt)

       From: Dark Sorcerer
       Date: Tue, 20 Feb 2001 17:35:57 -0000
       Subject: Confessions of a C0dez Kid

Looking at [http://textfiles.com/history/](http://textfiles.com/history/)

       c0dez.txt ... 63056 ... (February 20, 2001)

Now looking at curl head "curl -I [http://www.cultdeadcow.com/cDc_files/cDc-0395.html"](http://www.cultdeadcow.com/cDc_files/cDc-0395.html")

       Last-Modified: Mon, 09 Aug 2004 07:20:54 GMT

So unless original author can verify, the publish date is February 20th, 2001 :-)

\- Thank you HN-Mods for fixing the titles.

</comment></comment><comment><USER2> Nice read. I being somewhat younger than the author, didn't get into the scene (such as it was) until after the dust settled from Operation Sun Devil. There was a lot of what he describes, excepting less emphasis on long-distance codes (understandable in our 5ESS LATA) and greater emphasis on hacking nearby universities to get onto the somewhat nascent Internet, as well as the occasional Tymnet/X.25 NUI. Almost none of us 'carded', although there was an epidemic of nice modems being stuffed down pants at the local Comp-USA. But for a few years, if it was connected to a local phone line or was on the Internet with a security vulnerability, one (or more) of us had root access.

I did get receive modest interest from local law enforcement, but I owe a sincere debt of gratitude to university staff (who I hope recognized something of a kindred, non-malicious spirit) who begged district attorneys not to proceed with my prosecution. Between that scare and somehow raising modest capital to start a local ISP with a Sprintlink T1 line, I eventually graduated from 'the scene' and found myself a straight-laced system admin (later software developer).

I like to think 'the scene' didn't disappear; Most people can buy fast Internet access somewhat cheaply (or hack a wireless network) and install Linux for free. For a couple nickels more, you can operate your own IN-WATS PBX with help from Twilio or a cut-rate SIP provider. In short, much of what was forbidden to us became easily and/or cheaply within reach. Welcome to utopia.

</comment><comment><USER3> Really interesting story. I wonder if I myself might have gotten into trouble were it not for the fact that I couldn't make that many phone calls. I seem to recall that there was no such thing as unlimited calling - even for local numbers. Not to mention I wasn't allowed to hog our one phone line. Calling a long-distance number for 30 minutes probably would have resulted in at least a $10 phone bill - which was totally out of the question.

I was resigned to call one local BBS and do a direct 1-to-1 modem connection with my only other friend who had a modem!

<comment><USER4> Local calls were unlimited in the 1970s and 1980s, like the are now. I think that this was true everywhere in the US but with different RBOCs perhaps some had different rules.

<comment><USER5> Yeah, but there was the concept of intraLATA toll calls. Or "local-toll" calls. These weren't long-distance, but they weren't free, either.

I remember calling my grandparents in Arizona cost 5¢ a minute, but calling relatives in the next city over—about 10 miles away—cost something crazy like 29¢ a minute.

This was in California. I'm sure the rate structures varied from state to state.

<comment><USER3> That's how I remember it too. Most local calls perhaps were included with the service, but a call to the other side of town might be considered long- distance. I do remember that the rates varied wildly. My parents would occasionally question me or my sister about a specific call on the bill that cost a lot.

</comment></comment></comment></comment><comment><USER6> I got the Internet in 2006. I feel like I missed out on so much :(

Invest anti-establishmentarianism and experiment with psuhing your own boundaries, and get rewarded with access to this totally new new _thing_ \- technology - that was everywhere, powering the world, and Important(TM)...

I can totally understand how that would be quite attractive :)

That said, this author seems to have had a bit of a lucky break with the authorities, and I can't say I (or my family) would be particularly enthusiastic to have to deal with this side of things.

But I guess the fact that it was a two-sided coin added to the attractiveness in a way.</comment>


For every AT&T Android user there are 15 iPhone: What will it be at Verizon? - <AUTHOR> http://www.asymco.com/2011/01/11/for-every-att-android-user-there-are-15-iphone-users-what-will-be-the-ratio-at-verizon/ <comment><USER2> A more interesting question is what will the AT&T ratio drop to as iPhone users switch carrier now that they have that option, and AT&T starts pushing high-end Android exclusives like the CES-wowing Motorola Atrix. A possibility which seems to have been overlooked in this curiously one-sided "analysis".

A serious answer is that the rate will probably be somewhere around 1:1, the current US install base ratio across all carriers. To get even 2:1, given their current Android install base they'd have to get every current iPhone user in the US to switch, or generate a similar number from new users or RIMM and Android defectors (with Android defectors counting twice since they reduce the Android count too, so they "only" need the same number as half the US installed base of iPhone to switch from Android).</comment>


Ask HN: Who is todays inspirational tech kids, like Bill Gates when he started? - <AUTHOR>

In the early days of computers it seemed that even kids had the chance to create amazing things.
Are there kids around today doing amazing things?
Any what are they building? <comment><USER2> There's a Facebook group full of people like that: [https://www.facebook.com/groups/PennAppsHS/](https://www.facebook.com/groups/PennAppsHS/)

Many members of the group are now founders of venture-funded startups, Thiel Fellows, etc, so odds are that the next big tech personality is very likely to be in the group

</comment><comment><USER3> There are plenty of teen programmers around (self included), but I haven't seen or heard of one who does something "amazing" \- although I'm sure there must be.

</comment><comment> liviu- This guy is pretty impressive: [http://raghavsood.com/](http://raghavsood.com/)

</comment><comment><USER4> You can't do that these days on modern devices and platforms. You can't run your own software. You can't run unsigned software.

<comment><USER5> You can on a number of platforms - but you have to make a choice to run those platforms. If you chose to run a locked down platform you only have yourself to blame for that outcome.</comment></comment>


Bunnie Huang and Edward Snowden's Malware-Detecting Smartphone Case - <AUTHOR> https://www.pubpub.org/pub/direct-radio-introspection/ <comment><USER2> I'm glad this title mentioned Bunnie, when the smartphone case was first announced most news outlets reported it as "a smartphone case that prevents spying by Edward Snowden and some hacker"

<comment><USER3> agreed. quite skeptical that snowden is anything other than a PR stunt for an otherwise interesting/useful project that requires hardware development expertise

<comment><USER4> Well, to be honest both of them are quite good at promoting themselves. Just in different circles...

</comment></comment></comment><comment><USER5> I don't understand what kind of malware this is supposed to detect? This only seems relevant when you're using airplane mode, and why wouldn't malware just wait until you went back online before transmitting the data?

<comment><USER6> Let's say you're a journalist meeting with a source.

Let's say a certain three letter agency would like to listen to that conversation in real-time if they could.

Let's say the journalist thinks that by setting his phone to flight mode, the radio is off and he can't be maliciously tracked.

Let's say the three letter agency has various means to connect and listen in on phones in real time if it chooses.

This new smartphone case would then be able to confirm to the journalist that the phone is not sending/receiving radio signals.

Now, that might sound like a far-fetched scenario, but bear in mind that Snowden asked reporters meeting with him to put their phones in his fridge to prevent exactly that scenario from playing out.

It is therefore not surprising that he might play a part in developing a case like this.

<comment><USER7> So we assume that an adversary has dropped some malware that can silently enable the radio, activate the microphone, encode the audio stream and transmit it in real-time - and they want to avoid detection by this case.

Well, all they need to do is modify the malware to record the audio to a file and transmit it when the radio is next switched on, perhaps interleaving it with normal radio activity.

As a malware detector, this case is useless.

<comment><USER8> Not useless. Just less useful.

It pushes the capacity for your adversary to operate into (slightly) slimmer confines, which is a marginal improvement.

Otherwise, your adversary can behave in an unrestrained manner. No?

<comment><USER9> One might also argue that giving a violent prisoner left-handed scissors will slow them down and is therefore a marginal improvement.

<comment><USER10> I can't argue with that: if I had to choose between the two, I'd rather be stabbed by the non-dominant hand. Obviously not being stabbed at all is a much better choice (when available).

</comment></comment></comment></comment></comment></comment><comment><USER11> "For the iPhone, there are four different radio interfaces that could potentially be used for malicious purposes: the cellular modem, Wi-Fi, GPS, and NFC"

Well, GPS only receives... so how is it going to detect that?

<comment><USER12> When the GPS antenna is on, it gives off RF interference? Just a guess. GPS draws quite a bit of power when turned on.

<comment><USER13> Probably not from the antenna, but the downconversion and signal processing chain definitely will. They are shielded, but I'm sure some gets through.

</comment></comment></comment><comment><USER14> Articles like this make me wonder how journalists were able to do their jobs before the ubiquity of cellphones.

Here's an analogy to what's happening:

Since you're a high value journalist, a state actor has helpfully assigned an FBI-type agent as your minder. And now you're debating whether you should put a blindfold and earplugs on your minder before attending an important meeting with him in tow. Or, alternately, you're debating on whether you should add a gag to him to keep him from reporting back to his superiors.

But, the minder is resourceful. He has trained for the possibility of a blindfold. So he might remove it at opportune times and take a peek at what's happening. Or, when gagged, he is prepared to report back by tapping out a message with his fingers, using Morse code.

In short, I think it's a Sisyphean struggle to try to keep the minder from reporting back. Instead, just leave the minder elsewhere, far away from important discussions.

There is no way a few amateurs with soldering irons will be able to successfully and continually thwart state actors. Don't play their game!

<comment><USER15> Do play their game. Raise the costs of your opponent.

<comment><USER9> What happens when the NSA's costs are doubled? Do they track half as many targets or do they spend twice as much money?

<comment><USER16> They likely do a bit of both, and do it all less well.

</comment></comment></comment></comment><comment><USER17> Journalist enters country, has bags searched. Customs officer: "This smartphone case is not allowed in the country."

Oh well, we tried.

<comment><USER18> Iridium handheld phones are already recognized by certain countries' customs for a similar purpose, they don't want journalists to have phone call and SMS access outside of the country using a system/network entirely outside of their domestic telecoms' control. For example when reporting on internal crackdowns on dissent, political opposition, etc.

<comment><USER19> Wonder how long it will take SDRs to be recognized as similar tools.

</comment></comment></comment><comment><USER7> Better hope that the factory manufacturing this device, and the technicians installing it within the phone, are trustworthy enough not to leave their own backdoors.

A supposedly trusted device that taps into the hardware buses by design is an excellent target for malfeasance.

</comment><comment><USER20> So it's a sort of hardware-based Little Snitch without the ability to block connections. Neat. Perhaps a useful tool for the security-minded but not a true safeguard. Remote code execution exploits are very real. All an attacker needs to do is modify your network configuration (DNS, proxy, hosts file, etc.) to disguise network traffic over a specific address that looks real enough so as to not warrant suspicion. This exploit could also be designed to sit idly while the device is in airplane mode, avoiding the case's primary detection feature.

<comment><USER21> > This exploit could also be designed to sit idly while the device is in > airplane mode

This seems like a rather universal feature :)

</comment></comment><comment><USER22> Much better link straight to the source: [https://www.pubpub.org/pub/direct- radio-introspection/](https://www.pubpub.org/pub/direct-radio-introspection/)

<comment><USER23> Ok, we changed the URL to that from [http://www.allaboutcircuits.com/news/edward-snowden-and- bunn...](http://www.allaboutcircuits.com/news/edward-snowden-and-bunnie- huangs-malware-detecting-smartphone-case/). We've kept the latter article's title, although it's a bit baity; "Countering Lawful Abuses of Digital Surveillance" kinda undersells it.

Edit: but we reordered the authors' names in the title to match the order they used in the article.</comment></comment>


Haystack wrongly accused of Plagiarism - <AUTHOR> http://blog.geekybusiness.com/post/37268953203/haystack-wrongly-accused-of-plagiarism

<comment><USER2> The concept of using the social graph to create a better dating app is certainly not extremely groundbreaking, but I'm curious about the naming. The claim that "Haystack is an extremely likely name for a dating app" is a weak one - the fact is that no one thought about it up until a few month ago. On the other hand - I doubt someone would just steal the name of a potential competitor. My theory is "unconscious plagiarism". Someone on that bus heard something about the original app, didn't really remember it, but when the guys brainstormed about the name - haystack popped up.</comment>


Show HN: We built an appliance with Raspberry Pi that backs up from the cloud - <AUTHOR>

http://picirus.com
For Startup Weekend Tulsa, we created a small low-power appliance (built on Raspberry Pi) that you connect to your different cloud accounts -- Facebook, Flickr, Dropbox, etc. -- and it downloads a copy of all your stuff every night.
I was thinking about all the people I love who share directly to the cloud, without a lot of planning for the case where their Facebook account gets hacked, their Dropbox account has a glitch, or one of these services they love goes out of business suddenly some day.
We had a ton of fun building Picirus during Startup Weekend. I highly recommend -- if you haven't been to a SW in your area -- consider being a part next year... there is a definite quantifiable boost in your productivity to sit down with other engineers, focus your efforts, and get something built. <comment><USER2> Clickable: <http://picirus.com/>

</comment><comment><USER3> Very cool. What's the software stack if you don't mind me asking?

<comment><AUTHOR> No problem! I talked about it at our local TulsaWebDevs meeting (though unfortunately there is no recording of it)... here is a list:

<https://gist.github.com/4109183></comment></comment>


Want to migrate from Freshdesk to Zendesk? - <AUTHOR> https://www.help-desk-migration.com/help-desk/freshdesk-to-zendesk-migration/ <comment><USER2> Very cool! We've thought about migrating before but was a non starter because of the LOE in moving the knowledge base.

Bookmarked for later.

</comment><comment><USER3> Used it for Kayako migration

</comment><comment><AUTHOR> Great service</comment>


Adblock Plus for Android device [NO ROOT REQUIRED] - <AUTHOR> https://play.google.com/store/apps/details?id=org.adblockplus.android

<comment><USER2> I'm slightly concerned by this release. The mobile platform was the only one left where users could not block ads easily. Plus it has a great CTR.</comment>


Show HN: Gosms – Your own local SMS gateway powered by Golang - <AUTHOR> http://haxpax.github.io/gosms/ <comment><AUTHOR> A simple SMS gateway that uses GSM Modems to send SMS, can be deployed locally, supports multiple devices and provides API over HTTP just like internet based messaging gateways.

// we both are full stack developers looking for full time jobs : [https://github.com/omie](https://github.com/omie), [https://github.com/madhurjain](https://github.com/madhurjain)

<comment><USER2> Very cool. I'm an existing twilio customer, wondering how cheaply I can implement something like this. What are some recommended GSM modems to use?

<comment><USER3> Any generic 2G/3G USB Data Card from Hauwei or ZTE or Netgear or DLink which shouldn't cost more than 30$ - 40$ Check this link [http://www.flipkart.com/computers/network-components/data- ca...](http://www.flipkart.com/computers/network-components/data- cards/pr?sid=6bo%2C70k%2Co47&ref=8f1d55de-0c3d-4c7a-af50-02c787b1ef00)

<comment><USER4> Thanks for the info! How much would the cell phone plan cost that allows unlimited sms messaging?

Is there any reason to use twilio over something like this? Twilio costs 0.0075 / message

<comment><AUTHOR> Choosing between twilio or this definitely depends on your use case. Gosms is handy when you have no internet connection, you require total control over the infrastructure and such. Use twilio when you don't want to worry about anything and just send messages. There could be more scenarios too.

Twilio's pricing schemes change per country, for us in India (where 1 Rupee = 100 Paisa and USD 1 = ~62 Rupees), twilio charges 60 paisa per message. At the same time, some tel-com providers have plans that cost only 5 paisa per message. India has other limits and regulations but for personal/in-house use they hardly matter.

<comment><USER3> To add to this, If you want to send fast worldwide SMS reliably and without much hassle, use twilio or plivo or other such web sms gateways. If you want to send SMS locally, for cheap and willing to hack your way around, give GoSMS a shot. Given the time a modem takes to send an SMS, with a single modem connected, the rate of sending SMS is low (~1 message / 5 second).

</comment></comment></comment></comment></comment></comment><comment><USER5> Nice. The next problem is finding an SMS service provider with good pricing. Most mainstream cell providers will try to sell you some data/voice/SMS plan at upwards of $40 a month. There are SMS-only services for which you can buy SIM cards, but they're either in the price range of regular cell service[1] or kind of sketchy.[2] Twilio may be more cost-effective. If you have a big volume of SMS, Twilio or its competitors have more bandwidth (they're tied directly to the SS7 network) than a single GSM modem.

SMS tends to be an expensive way to send data. There are lots of devices that send and receive SMS. They're generally things like industrial air conditioners reporting their status to a maintenance service every hour or so. The data volume is thus low. If you need to send more than tiny amounts of data, it's probably better to get a device that gives you an Internet connection.

[1] [http://www.embeddedworks.net/m2m-data.html](http://www.embeddedworks.net/m2m-data.html) [2] [http://www.mrsimcard.com/s-textsim.html](http://www.mrsimcard.com/s-textsim.html)

</comment><comment><USER6> It' so cool to see something like this in GO.

Few years back I tried to implement a prototype very similar to this in C#.

My startup was for sharing routes through out sms, however my tel-com company was very cringe-y about the idea, so I decided to write one of my own.

Good job folks.

<comment><AUTHOR> we too were fed up of tel-com companies over here, limitations like no more 200 messages per sim per day to prevent spam! but we really needed something for internal uses, just built it. Multiple devices support takes care of per sim limiataion :)

</comment></comment><comment><USER7> It's nice to have another alternative SMS implementation. The existing ones (last I looked anyway) were a bit long in the tooth.

(I've been using pushover recently, but have been looking for a good local (modern) sms gateway).

</comment><comment><USER8> Since golang can be compiled for android, have you considered wrapping this up as an android app, which runs as a background api service? Technically you can use the android provided SMS calls.

(or is there already such an app?).

<comment><AUTHOR> golang support on android is very limited. in fact net package is still not there, so won't be able to run on android as is for now. we thought of adding android phones support in other way. simply expose the queue over http endpoint and write an android app that will fetch-send-repeat when its started. Just short on time, and contributions are welcome :)

</comment></comment><comment><USER9> I'm not 100% sure how most people could use this service. While in Lithuania I could get unlimited text messages (to send inside the country) for less than 5 euros (that's probably like $6), I doubt it would go for long since the text messages would be one-way and they would block me.

Surely, all providers with cheapish text messaging plans would have clauses for commercial uses?

<comment><AUTHOR> \- This is not another messaging service, this is a software that powers such services. \- People could host this on their own and use it for their applications instead of opting for other such services if it suits their use cases

<comment><USER9> Thanks for the reply!

I do understand it - you stick your own SIM card to a GSM modem and use this application to send messages via it.

I'm just contemplating that most providers would not allow endless one-way text messaging. Unless you have some sort of a business plan that allows this sort of thing.

Just looking at some use cases where this could replace Twilio/Nexmo but it seems like you would just get blocked by the carrier if you tried to send quite a handful of text messages.

P.S. I have nothing against the app and I think it's wonderful and I just MIGHT use it sometime if I'll need to send messages inside my own country. And I'll probably get blocked but it might just be worth it as I could just swap SIM cards as I could get 3000SMS for about 2.5 euros. But that's some black stuff happening in my mind now!

</comment></comment></comment><comment><USER10> I've tried and failed to get gammu wammu to work. Tried both an old usb stick and and old mobile phone.

Can you recommend any usb stick that works with your program that cost less then $100 and can be ordered from the EU ? It has to support micro sim and both send and receive SMS.

<comment><USER3> @z3t4 data cards from phone providers are carrier locked and don't allow third party softwares to access modem via AT commands. We've tried with some generic data cards from Huawei and ZTE and they work great

For example [http://www.amazon.co.uk/HUAWEI-E3256s-Wireless-Mobile- Broadb...](http://www.amazon.co.uk/HUAWEI-E3256s-Wireless-Mobile- Broadband/dp/B00Q2L6WDK/) or [http://www.amazon.co.uk/computers/dp/B004VU09BU/](http://www.amazon.co.uk/computers/dp/B004VU09BU/)

You'll have to check for micro SIM support though. I haven't come across a stick which supports micro SIM yet.

</comment></comment><comment><USER4> So to set something up that can send thousands of sms (not spam, part of an app) a day, all I would need is a modem, a server, and this app? Would I need a cell phone plan or something?

<comment><AUTHOR> yup! the GSM Modem you use will need a SIM card which needs an active plan

</comment></comment><comment><USER11> Nice, but what could I use this for? Try to put this information in your website.

<comment><AUTHOR> Can be used to send SMS, where you don't have access to internet or cannot use web sms gateways or want to save some money per SMS, or have minimal requirements for personal/internal use and such. thanks though, will push to readme

<comment><USER12> Can you expand some more - does this software connect to a modem to send SMS's to nearby phones? Is this software similar to a stingray device, or am I misunderstanding this?

<comment><USER3> By modem we mean any GSM Modem device. Like a USB Data Card used for internet access, or a mobile phone connected via USB. You can send SMS anywhere. Software just allows you to use your phone / usb data card to send messages.

</comment></comment></comment></comment><comment><USER13> that's really nice that you already have support for multiple devices. really awesome project.</comment>


The Slave Ship That Ran from Kerala to New Orleans - <AUTHOR> https://in.news.yahoo.com/the-slave-ship-that-ran-from-kerala-to-new-orleans-085329807.html <comment><USER2> I have had the great pleasure of helping represent a group of these workers (not the folks who just recently went to trial, but another related case in the Eastern District of Louisiana). One of the most gratifying experiences I've had as an attorney. Really glad to see this story getting attention here.

If you are interested in the topic, I'd highly recommend taking a look at some of the SPLC's work on the issues surrounding the H2B program generally: [http://www.splcenter.org/get-informed/publications/close- to-...](http://www.splcenter.org/get-informed/publications/close-to-slavery- guestworker-programs-in-the-united-states)

<comment><USER3> One of the greatest things I have come to appreciate in the US is that for all its warts, it has great institutions to provide relief against injustice to those who will otherwise be marginalized or helpless.

I have been a supporter of the ACLU and now that I am aware of the work that the SPLC does, I am a supporter.

I love to see the 'corrective' nature of the general elections and also understand that sometimes the outcome is not the desirable ones.

Whenever I see people thumping the Constitution or the Bible to support their twisted heartless positions, I am also in awe of the Founding Fathers of this country, who were able to craft a document, that actually protects the people from their basest instincts and the institutions necessary for affording those protections.

Thank you Mr. Walker for being a part of that corrective process.

<comment><USER4> Indeed, and thankfully, this unlike the Arab countries in Middle east, where it's more-or-less routine.

I think it is made worse by the fact that no one gives a shit for the people who don't speak English in India.

</comment></comment></comment><comment><USER5> The executives and "immigration attorney" in this case showed willful disregard for the law and the individuals they were defrauding, and in my opinion should be subject to criminal charges. Sadly, many of the times things like this happen instead - [http://www.law360.com/articles/632144/signal-says- bankruptcy...](http://www.law360.com/articles/632144/signal-says-bankruptcy- likely-before-next-trafficking-trial).

TLDR, Signal is claiming they don't have the resources to pay, trying to declare bankruptcy, and leave the wronged to walk away with nothing (from them at least). But rest assured, the Signal executives would be fine, financially, in that outcome.

Even if they are not charged criminally, piecing the corporate veil in the case of willful and malicious activity is well established, and this is exactly the type of case where that action should be taken.

</comment><comment><USER6> This is disturbing but hardly surprising. US is dotted with slave labor camps from meat-packing towns in mid-west to underground garment factories in Los Angeles. This is where the perpetrators use the immigration law as a tool of their exploitation and enforcement, even if the worker involved or should I say, especially when the worker involved is legally here. On the other hand, the complete absence of Indian Consular services or the myriad of Indian cultural organizations in the story is appalling.

<comment><USER7> > the complete absence of Indian Consular services or the myriad of Indian > cultural organizations in the story is appalling.

Amazing considering how many Indians pour millions into temples and such in the US.

<comment><USER8> Compare the silence here with the fuss made in the Devyani Khorbhade case.

<comment><USER9> _Crows always defend fellow crows._

If you have ever seen that in action, you'll totally understand. It's a fact of nature. Same for cops etc.

</comment></comment></comment></comment><comment><USER10> Not sure how this actually shows "America's broken visa system" as the author claims. It shows a bad company. They broke the rules. They were punished and now paying 5 men almost 3 million each. (though yes they may weasel out of it)

<comment><USER11> The fact they can weasel out of it shows that at least part of the system is broken.

<comment><USER10> That seems more a general failure of legal system not the visa system.

<comment><USER11> It is, yes, but if the checks-and-balances that the visa system relies on and are implemented by the legal system can be sidestepped so easily, then abuses are far more likely, wouldn't you agree?

</comment></comment></comment></comment><comment><USER3> For anyone interested, Kerala is a small state in the southern tip of India. It has a huge historical importance to Western Civilization. You could almost say (I may be exaggerating a little bit) that the America's were discovered by the Europeans in its effort to find a cheaper route to the produce and wealth of the Indies. Kerala is home to the Malabar Hills or what is commonly called the Spice Coast of India.

Kerala is where most of the spices such as Pepper, Cardamom, Cinnamon, Cloves etc have been grown for centuries. The ports of Kerala, Calicut (Kozhikode) has been the main gateway of trade all the way back to the Phoenicians.

BTW, as HN visitors, you may be interested in the fact that Kerala is now also home to a vibrant Startup culture. Just in the last few months, Menlo Park and Kochi (the city mentioned in the article) has announced that they are going to be sister cities.

[http://www.thehindu.com/news/cities/Kochi/kochi-to-sign- sist...](http://www.thehindu.com/news/cities/Kochi/kochi-to-sign-sister-city- pact-with-menlo-park/article6870633.ece)

[http://articles.economictimes.indiatimes.com/2015-02-10/news...](http://articles.economictimes.indiatimes.com/2015-02-10/news/59005375_1_kerala- government-student-start-ups-technology-business-incubator)

Now back to the article being discussed. Some of the factors that made this case possible are the fact that the key players who were being exploited are from Kerala. This may seem strange but let me explain.

Kerala, along with West Bengal, can be considered as two of the most intellectually forward states of India. By that I mean, very high literacy (almost 100%) and as a result of that a very keen awareness of when they are exploited and have a fierce willingness to fight all forms of injustice. Communism is a very bad word in America, but it has helped these two states rise up from the feudal system that was prevalent in these states and is still prevalent in most of the poorest states in India. The downsides of a Communist approach (militant labor) is very evident in these States also, as being the worst states to create a labor based business in. The day after you start a business there, you can be guaranteed that labor will start an agitation and bring the business to its knees.

The article also mentions the attempted suicide, which is also one of of the disturbing aspects of life in Kerala. The state is very affluent compared to other states, but there is huge social pressure (perceived or otherwise) that forces people to take extreme measures to avoid failure. Whole family suicides are not unheard of if something bad happens.

Thanks to the effort of the tragic few who were willing to stand up to the exploiters and risk everything to bring this to court. Their efforts will have an impact far beyond their own.

This is one of the reasons that I try and contribute to organizations like the ACLU whenever I can. Henceforth I shall do the same for the SPLC.

"Quis custodiet ipsos custodes?" (Who will guard the guards themselves).

<comment><USER12> > You could almost say (I may be exaggerating a little bit) that the America's > were discovered by the Europeans in its effort to find a cheaper route to > the produce and wealth of the Indies.

Isn't that what is normally taught in schools?

<comment><USER13> This strange history is poetically recalled by Salman Rushdie in the first pages of _The Moor 's Last Sigh_:

I repeat: the pepper, if you please; for if it had not been for peppercorns, then what is ending now in East and West might never have begun. Pepper it was that brought Vasco de Gama's tall ships across the ocean, from Lisbon's Tower of Belém to the Malabar Coast: first to Calicut and later, for its lagoon harbor, to Cochin.

English and French sailed in the wake of that first-arrived Portugee, so that in the period called Discovery-of-India -- but how could we be discovered when we were not covered before? -- we were 'not so much sub-continent as sub- condiment', as my distinguished mother had it. 'From the beginning, what the world wanted from bloody mother India was daylight-clear,' she'd say. 'They came for the hot stuff, just like any man calling on a tart.'

</comment></comment></comment><comment><USER14> Well I don't know the composition of the management panel of this business. It is quite likely to be homogeneous and dictatorial.

This is the cost of a lack of diversity in a team and how stereotypes can come to bite one in the foot. As illustrated by the emails expecting the workers to be happy with their living conditions given they were assumed to be "pooping in ditches".

I would wager with better diversity someone is most likely to have challenged some of these views a lot earlier and helped the company from its blunders.

</comment><comment><USER15> The scary part is that if not for the support of the local church/parish and the lawyers, this may well have been yet another case decided in favor of the company.

</comment><comment><USER16> man thats horrible... never really hear much about Kerala in the news, its obscure in comparison to the rest of India. Thats where my parents came from so I was happy to see Kerala come up on HN, not happy at all after reading the article. Damn

<comment><USER17> The last big piece of Kerala-related news that I remember coming up in America media was about the Annie George case.

<comment><USER16> That Anthony Bourdain no reservations episode was pretty good, not really news, but worth mentioning because I still haven't saved anything over it on my dvr.

</comment></comment></comment><comment><USER18> Stop all restrictions on immigration in the developed world! Not out of kindness, or even basic human decency, but because these restrictions don't work any more.

Look at the US: 18 billion dollars are spent each year for enforcing immigration laws. The result? anywhere between 7 and 30 Million illegal immigrants, which are essential to the country's economy, but unable to work, seek the best medical attention or raise their socioeconomic status.

In Germany, we have a new kind of "dynamic". Our constitution grants a right to asylum. Because of that right, every application has to be reviewed, even though two thirds of them are rejected. The first problem is that the bureaucracy is completely overwhelmed by the applications. Second problem is that even the rejected Applicants can't be deported, for sheer impracticality of scaling the "deportation" machinery by several magnitudes.

Of course, this state of affairs has drawn the attention of even more people smugglers and potential immigrants, raising the burden on our immigration enforcement. It didn't have to be Germany, who was stuck in that cycle first. It could have been France. Italy and Greece aren't stuck because they essentially tell the immigrants to go to Germany or risk being mistreated.

In Germany, these asylum seekers are not allowed to work ever. Which means they have to be paid some form of social support. In my belief, paying social support is cheaper than dealing with the consequences of about a million human beings prohibited from earning a living in a legal way. But even cheaper would be to allow them to work, like they actually want to do.

But alas, the majority of citizens in the developed countries have fear of immigrants, so they will have to learn what I just described the hard way.

<comment><USER19> >The result? anywhere between 7 and 30 Million illegal >immigrants, which are essential to the country's economy, >but unable to work, seek the best medical attention or raise >their socioeconomic status.

The reason is because the gov't doesn't enforce the law. If they did punish employers for hiring illegal immigrants then there would be a lot less. The employers skirt the law to increase the bottom line while pushing the cost off on the taxpayer. Cut of the work then a lot less will come. Wages will rise for the lowest earning Americans.

You think anyone in the world should be able to come to Germany? Get ready for a couple million people in the first 6 months. People who don't speak German and may not share your values.

<comment><USER18> This is exactly the flawed reasoning I am criticizing. Of course, if you "cut off the labor", they wouldn't come. But experience has shown, that this is impossible. Especially not since a large proportion of the US economy absolutely depends on these workers. And a large part of the $18 billion dollars every year is spent on trying to police immigrant laborers. And no, wages will not rise, because wide-scale disruptions would lead to the worst recession since the 1930s. But that's hard to speculate because, to reiterate, "cutting off" the labor in any reasonable timescale is completely infeasible.

What I envision for the future is stopping immigration controls in the entire developed world. Preferably happening all at once. The burden for Germany would likely even decrease. Because just as it is, Germany has been selected for the first breaking point, and the situation is such that pretty much anybody can immigrate to Germany already and not be deported anyway...

</comment></comment></comment><comment><USER20> Here's a random question for the Indians on HN:

> Andrews Isaac Padavettiyil

 _Most_ Indian names I see tend not to mix in bits and pieces that look western. Is something like this just random chance, or are there some groups or cultures where this is a done thing?

<comment><USER3> As mavelikara, above replied, Kerala has a unique mixture of three religions, Hinduism, Islam and Christianity. The Christians in Kerala are also of different denominations, Catholics (Syrian), Catholics (Latin), Orthodox Christians (Syrian), Orthodox Christians (Malankara), Protestants of all denominations etc.

In general, if you are Christian, your name has three parts to it, <First Name> <Middle Name> <Last Name> where the <First Name > is your given name, <Middle Name> is your father's given name and <Last Name> 'may' be a family name. The first and middle names are generally of Biblical origin and will be recognizable by Westerners, the family name will be a local name in Malayalam, which denotes many families of the same family tree so to speak.

The names of Malayalis (people of Kerala who speak the native tongue, Malayalam) are a source of confusion for Westerners. I am often asked is that you real name?

BTW, the Orthodox Christians of Kerala are 'believed' to be descendants of the first families, converted by St. Thomas (one of the 12 apostles of Christ) who is believed to have settled in Kerala (around 50 AD) in a place called Cranganore, and later is believed to have died/martyred in the neighboring state of Tamil Nadu. They are also called St. Thomas Christians. I leave it to more knowledgeable people to argue about authenticity of these beliefs.

<comment><USER14> This..

My family belongs somewhere in this group. A few Australians have been confused by my last name which is biblical. Occasionally I remind them that India has more Christians than the Australian population and most of us have biblical names mixed in.

As an aside, I suspect the case was also driven by the fact that Keralite people are generally more aware of their rights given their high levels of education, knowledge of worker rights and socilaist exposure( the world first elected communist govt was here).

Most keralites migrate out to escape the socialist pressure that kills jobs there. Quite ironical that they get out and put up with such cr@p for so long but understandable given the obligations they get into.

</comment></comment></comment><comment><USER19> The problem is this visa should not exist for this type of work. Benefits of ending this visa:

1\. Americans workers have jobs and see an increase in pay

2\. Less likely to be abused workers

3\. Less money given to bureaucracy

4\. Less money to lawyers

5\. No exploited foreigners

6\. Money earned by workers stays in US instead of leaving the US economy and being sent overseas.

7\. Churches have more time to help local population.

This is work that has to be done in the US. This isn't the same as a visa for a high tech worker creating a company.

There is no reason to have this visa for this type of work. It only helps rich business owners at the expense of American workers.

<comment><USER21> To play devil's advocate - so where would the workers come from to help after disasters like Katrina? If I understand correctly - those people were hired to keep rebuilding everything, since American workers were too busy taking care of their own homes and families, so it was hard to find anyone to do the actual job. If these workers were hired to do one specific job, got paid fair wage for it, and got out, then I wouldn't have a single problem with this visa type.

<comment><USER19> Just pay market rates. This company did not want to do that. They want to pay cheaper workers who then send that money out of the country. The company would not make the reported 700k per worker though. Not as good for upper management but better for America.

</comment></comment></comment><comment><USER22> This is why I sometimes wished that rather than have the largest democracy in the world <applause> India were ruled by something similar to the Chinese technocrats who challenged the america-euro global world order. So much of the brightest Indians is the reason why america is a tech giant. India could have similar wealth like the Chinese if it wasn't for this brain-drain. And to make it even worse the american system didn't distribute that generated wealth fairly among its citizen but made a powerful class even more powerful and made average americans and indians poorer.

<comment><USER23> It is not enough just to produce talent, it is also necessary to have structure in place to utilize/absorb the talent. India was far from that position before, it is somewhat better but still far from ideal.

To turn the point on its head, if you have the infrastructure and environment for talent to be used and valued, they would come, and they did, to USA. However given the strong anti immigrant rhetoric that is becoming popular in USA I am interested to see how this is going to play out.

<comment><USER22> China also didn't have the infrastructure. In fact India has a lot more infrastructure than china did due to 200 years of British Rule. The difference is China forced their brightest citizen to stay and build whatever infrastructure was needed and also didn't so easily give in to pressure to open up to trade that didn't benefit them in the guise of "globalization".

<comment><USER19> Not everyone in China is Han Chinese but it is not as diverse as India. Should the Indian Gov't suppress all the different religions in India? Crush ethnic tensions with brute force?</comment></comment></comment></comment>