What's happening in the Palestinian tech startups sector - <AUTHOR> http://ramigbtech.blogspot.com/2013/11/the-idiots-guide-to-whats-happening-in.html

<comment><USER2> No point in doing something if it isn't authentic to who you are and isn't bringing you closer to the life you want to lead.

The Silicon Valley way isn't the only way. If you're interested in a more community oriented brand of business, take a close look at the Mondragon model that has worked well in Spain. There's a great documentary here that will explain a lot of it: [http://youtu.be/-obHJfTaQvw](http://youtu.be/-obHJfTaQvw)

</comment><comment><USER3> I sympathize and I see your frustration. What do you think people should be working on? Why aren't you working on it? Do you think that startups are able to deal with the occupation at all?

<comment><AUTHOR> People should be working more on startups that have a balance between expected revenues and value to the society specially in a country like Palestine where we truly should criticize our selves side by side with criticizing the occupation, we are no angels, and that doesn't mean we are devils, i think if more entrepreneurs felt how much the society need ideas to improve it'll be amazing, some examples would be sites to give free courses online in Arabic about programming and even about life matters, give education to those who can't attend universities specially the mothers at homes and those who can't afford it, internet is relatively cheap in Palestine though no where near how much it should cost it should be much cheaper, some great ideas would be to encourage people to do more community work and activities, another would be to help people sell their home made products ... the list is too long but no one investor would invest in such things! and sadly, our "authority" and the occupation government work hand in hand to prevent employing the right person in the right position so those who are supposed to direct donors money toward useful projects just steal them or steal a great portion of them, if not, then put them in meaningless projects such as Musical projects that even Palestinians won't listen to!!!.

and as for me I actually quit everything -though i am looking for a part time job/freelancing to support my self as no investor would invest in my idea- to work on my current project which is a project that will empower small business owners in the area and get them online, no fancy e-commerce solution, just a simple strong community driven classifieds system that connects the buyer and the seller, not inventing any technologies here, just making the best use of current tools, hopefully i'll be posting about it as i am going.

Finally the startups will eventually hit the occupation wall, there is a physical actual wall outside and inside our cities there is no wonder a virtual one would be wrapped around our dreams and projects, but it's no time to fear such things, i rather see Palestine educated and occupied rather than illiterate and free.

Edit : fixed some spelling mistakes and added some more details.

<comment><USER4> I feel you. It's a messed situation. If you need any help, contact info is in my profile.</comment></comment></comment>


Show HN: An API to find and extract text from images - <AUTHOR> https://imgregex.com <comment><USER2> So, I get only what I am looking for, in return I lost the whole bunch of other text which other OCR services offer.

What if the characters are incorrectly identified? like "Owl" as (O/0)(w/v)(l/i/I/1); i just missed everything and left with no chance of fuzzy finding things.

</comment><comment><USER3> Neat idea, and very aesthetically pleasing design. Nice work!

</comment><comment><USER4> Cool idea - are you using Firebase/Google or _something_else_?</comment>


Goldman to Offer Facebook Shares Only to Non-U.S. Clients - <AUTHOR> http://online.wsj.com/article/SB10001424052748703396604576087941210274036.html <comment><USER2> Two companies with questionable moral and business practices that certainly deserve each other.

<comment><USER3> I agree with you, but that comment just isn't constructive.

<comment><USER4> the comment explains symmetry breaking in the virtual space of companies under the action of ethical force field. How that is not constructive?

<comment><USER3> Huh? What's the point?

I hate to break it to you, but the world of human affairs is not governed by such simple dynamics.

</comment></comment></comment></comment><comment><USER5> Amusing. I'm sure barring U.S. investors from participating in Facebook's curious financial maneuvering will reduce the "intense media attention".

This feels like part of a grander marketing scheme designed to whip future investors into a froth...

<comment><USER6> Or perhaps a methodology to enable Goldman to fly a bunch of business through a loophole in the law.

</comment></comment><comment><USER7> Welcome to the next financial outlet after sub-prime mortgages.

There seems to be an entrepreneurial spirit to this, however: find a regulated niche, weasel around it to provide clients with a high-growth and unsafe market. If the SEC doesn't clamp down on this, I can see this sort of dark trading becoming popular enough to destabilize the economy once it fails.

<comment><USER8> > _find a regulated niche, weasel around it to provide clients ..._

Regulators can't regulate the demand away. They can only push it underground, beyond the light of day. Whether this is a desirable social outcome or not I leave as an exercise to the reader.

It's not clear to me why regulators want to prevent mutually agreeable transactions from taking place. Surely when GS is on the other side of the table, you are aware that you are swimming in the deep end with the big boys...

<comment><USER9> > It's not clear to me why regulators want to prevent mutually agreeable > transactions from taking place.

In general, because the regulatory functions are aware of information asymmetries that could lead to large numbers of people transferring a significant amount of wealth to smaller number of other people.

Wealth concentration is expensive for society, because those who lose out do NOT give up their right to vote replacement money into their pockets. The more of them there are, the more likely they are to get society to cover some of their losses.

<comment><USER8> > _In general, because the regulatory functions are aware of information > asymmetries that could lead to large numbers of people transferring a > significant amount of wealth to smaller number of other people._

I doubt this is the actual principle upheld. You have just described the role of insurance, as provided over the last 300 years or so, as something regulators want to prevent. You have asymmetrical information and a massive pool of people transferring premiums to a smaller group (the insurance companies themselves). Then, when there is a payout, you have the smaller group transferring massive amounts to yet smaller individuals (the ones who experienced catastrophic loss).

</comment></comment></comment></comment><comment><USER10> What a weird world we live in which a uniquely American venture can not offer its stock to American investors because of investment rules, regulations and the unspecified 'media attention' (does that mean they're scared that if the price drops after the offering they'll be sued? Are they expecting it to drop?)

<comment><USER11> To be fair, they can offer their stock to anyone they want if they follow the rules like thousands of other companies do. Trying to dodge those rules is what got them the media attention. You can argue over the usefulness of those rules, but Facebook (with the help of GS) is pretty clearly trying to subvert them.

I think it's a case of trying to be a tad too clever. It reminds me of Google's more successful attempts at an unconventional IPO.

<comment><USER12> How is it a subversion to dodge US trading regulations by not trading in the US?

<comment><USER11> The sole purpose of the entity they created was to allow more investors to participate than the SEC individually allows. When doing so attracts world- wide media attention, there is little difference between that and publicly selling the stock of a private company, which is not allowed.

They were doing this in the US before everyone said "WTF? Isn't that illegal?" It was a fine line GS was was walking (surely they expected and were counting on some hype), and it appears that it worked a little too well.

Edit: clarified.

</comment></comment></comment></comment><comment><USER13> anyone interested in buying this knows how to set up shells outside the US. This is probably just to help them get around rules that the US govt is trying to impose on them. I'm sure GS will happily assist their clients in setting up the shells as well.

</comment><comment><USER14> Goldman is expert at following the letter of the law while violating the spirit of the law. They have enough expertise and talent at their disposal to know exactly where the line is and take advantage of it's placement.

</comment><comment><USER15> I'm no financial regulation expert, but does this mean that by offering FB shares only to non-US clients, GS can prevent Facebook from having to disclose its financial results to the public? Does the disclose-your-finance-if- over-499-investors rule only apply to US investors? ([http://finance.fortune.cnn.com/2011/01/03/what-does- goldmans...](http://finance.fortune.cnn.com/2011/01/03/what-does-goldmans- investment-in-facebook-mean/))

</comment><comment><USER16> Haven't we seen this recently from Goldman Sachs?

This tells me that Goldman Sachs is going to hedge the stupid foreigners with their US clients... Again.

Like they hedged the stupid poor homeowners.

I would stay far away from these creeps if I was a foreign investor.

</comment><comment><USER17> Sounds like pretty arbitrary regulation. Does anybody know in particular what laws Goldman would be violating by offering to US investors?

</comment><comment><USER18> Is GS a US-based company, or not? How do they get to pretend they are outside the SEC's jurisdiction?

<comment><USER19> > How do they get to pretend they are outside the SEC's jurisdiction?

The SEC only has jurisdiction over US securities activities. GS is capable of doing securities activities outside the US.

This sort of thing is not unique to securities.

Consider pharmacuticals. Certain drugs may only be dispensed in Japan under prescription while others are complete banned. Some of the former are over- the-counter in the US while some of the latter are prescription-only in the US. A Japanese pharmacutical company is bound by Japanese law wrt production in/export from Japan but is not bound by Japanese law wrt distributing drugs in the US, even if they were made in Japan.

<comment><USER18> The SEC has continued to expand on what it considers its jurisdiction to be.

For example, see this article (section on "extra territorial jurisdiction"): [http://www.mondaq.com/unitedstates/article.asp?articleid=107...](http://www.mondaq.com/unitedstates/article.asp?articleid=107216&email_access=on)

</comment></comment></comment><comment><USER20> The entire facebook share thing is starting to look like a big ponzi scheme.

<comment><USER21> Is face-ville a ponzi scheme ? well i doubt they have 500 M verified accounts. Just my GF created about 10 acounts for exchanging farmville items between each other.

And other persons are creating accounts for their pets !

Ponzi it the Man of the Century, he enabled the service "industry".</comment></comment>


It will be much harder to call findings 'significant' if a team gets its way - <AUTHOR> http://www.sciencemag.org/news/2017/07/it-will-be-much-harder-call-new-findings-significant-if-team-gets-its-way <comment><USER2> There are two legitimate ways to get lower p-values: You can have a larger effect size, or you can have a larger number of samples[0]. Of course, you can't change the effect size, so this would lead to larger necessary samples sizes to study smaller effects.

I think in general though, at least in biology, people are waking up to the fact that p-values aren't magical, and that having a really small p-value isn't a goal in and of itself. It is, however, necessary to do some statistics on your data to get it published, but the p-value is just checking a box more than being used as a tool for discovery.

Yesterday a cool dataset was released from Jeff Leek which has over 3.6 million p-values from scientific literature[1]. The distribution is fun to look at by discipline[2].

[0] [http://rpsychologist.com/d3/NHST/](http://rpsychologist.com/d3/NHST/)

[1] [https://github.com/jtleek/tidypvals](https://github.com/jtleek/tidypvals)

[2] [https://twitter.com/drob/status/890260541876338690](https://twitter.com/drob/status/890260541876338690)

<comment><USER3> >There are two legitimate ways to get lower p-values: You can have a larger effect size, or you can have a larger number of samples[0]. Of course, you can't change the effect size, so this would lead to larger necessary samples sizes to study smaller effects.

Be careful with this. Larger sample sizes are more likely to give you a significant result even if one doesn't exist.

Say my null hypothesis is that X=100. The alternative hypothesis is X>100.

What if in reality X is really 100.5? Depending on the problem domain, this may well be the same as the null hypothesis. But a larger sample size is much more likely to give a significant result.

There are ways to fix this, but one should just be aware, though.

<comment><USER4> > Say my null hypothesis is that X=100. The alternative hypothesis is X>100.

> What if in reality X is really 100.5?

Then the alternative hypothesis is true and the null is false. (Though normally if the tested hypothesis was X > 100, the null would be X ≤ 100.)

> Depending on the problem domain, this may well be the same as the null > hypothesis.

No, X = 100.5 is not the same as X = 100, irrespective of problem domain, so long as the mathematical symbols have their usual definitions.

> But a larger sample size is much more likely to give a significant result.

Yes, if something is only _just barely_ true, it is more likely to take a large sample size to distinguish it from the case where it is false. But since in this case, the alternative hypothesis actually _is_ true, it's not a problem that a bigger sample is more likely to reject the null hypothesis.

<comment><USER3> >Then the alternative hypothesis is true and the null is false. (Though normally if the tested hypothesis was X > 100, the null would be X ≤ 100.)

Mathematically, yes. Practically, not always.

In many real world effects, we're not 100% accurate on what the null hypothesis is. We may think the existing process suggests a the temperature increase of 1C, and so we set that as the null hypothesis.

But in that problem domain, we may have difficulty being more precise. Suppose that 1C in the existing process came from the mean of measuring a sample of 100, so the current belief is that the expected value of the increase should be 1C. Suppose in reality it is 1.02C. Now we're proposing a new process and claim it is better than the existing one. This time we take a much larger sample, and see the number hovering at 1.02C - we can then claim the new process is better than the existing process and have a p value to demonstrate it.

The math will be correct, and the conclusion will be wrong.

<comment><USER5> > Mathematically, yes. Practically, not always.

P values measure statistic significance, not practical significance. If you are extrapolating practical significance from statistical significance, then you have a problem that is unrelated to sample size.

<comment><USER3> >P values measure statistic significance, not practical significance. If you are extrapolating practical significance from statistical significance, then you have a problem that is unrelated to sample size

If you never extrapolate practical significance from statistical significance, then you have a problem. p values exist for the purpose of doing that. The problem in in research isn't the use of p values per se, but the _misuse_ and _misunderstanding_ of them.

An argument to do away with p-values demonstrates a basic misunderstanding of them.

</comment></comment></comment></comment></comment></comment><comment><USER6> I think that a very stringent threshold for p values (it's going to be a _lot_ harder to get to p < 0.005 than p < 0.05 and it's going to encourage a lot more gaming of the system) is not the solution. At best, it will lead to smaller numbers of much bigger studies with more authors and fewer interesting results.

I'd suggest that a better, broader, and more practical solution is to provide a public clearing house for studies and associated data -- let's assume it's a website.

a) When you start a study you must describe your study, methodology, and hypothesis, and publish these things on the site. It should be possible to find the study the same way you find any paper that results from it.

b) All data must be stored in the same place (but not made public) as it becomes available, and this must be demonstrable. This data should be available to anyone trying to replicate, review, etc.

c) Final data sets and analyses must also be also be available, ideally with the code used to do the analyses.

All of this should be prerequisite for review and publication, but also for anyone working in the field should no papers result.

This solves a lot of problems, including making it easier to conduct meta- analyses when looking for effects that aren't significant in smaller studies, and also address the lack of availability of negative results, and even help combat theft of methodology (e.g. where someone sees work in progress and is able to publish using the methodology). It would make meta-analysis easier, and allow researchers to better take advantage of existing, unpublished results (e.g. to hone their study methods, etc.)

<comment><USER7> If we were designing things from scratch, I'd even want t odisaggregate two career tracks for scientists:

The first, theorists, design interesting studies with open ended questions, explain how the study would provide useful scientific results, or theorize about the implications of existing published results.

The second, practitioners, are hired to actually run the studies according to the specifications provided. The practitioners would publish null results of course. Practitioners would also have to acknowledge how many of their results are significant, so it'd be transparent if they were just confirming everything.

A bit like barristers and solicitors in many common law countries, a distinction that isn't strictly necessary for the system to work, but prevents some conflicts of interest.

<comment><USER6> Yes, and indeed with this system a theorist can look for interesting data out there and publish with attribution, while experimenters can look for interesting failures and home methodology.

</comment></comment></comment><comment><USER8> Totally agree with Timothy Bates here:

> _[Bates] called the proposal "a risky distraction"... [It] wouldn't address > many other practices linked to irreproducible results: poor study design, a > bias toward publishing positive results, and the practice of "p-value > hacking"—fishing for significant-looking results from a huge number of > hypotheses._

Since the reproducibilty crisis started getting attention, I've noticed that these problems are really ubiquitous. Tweaking study designs and modifying hypotheses after collecting data are very commonplace and much more subtly dangerous than a potential lack of statistical power. Gelman says "Valid p-values cannot be drawn without knowing, not just what was done with the existing data, but what the choices in data coding, exclusion,and analysis would have been, had the data been different." [1]

This proposal also says nothing about effect sizes, which also should play a role in how we interpret scientific results. We should probably draw different conclusions given a tiny effect at p=0.05 versus a large, obvious effect at p=0.05.

[1][http://www.stat.columbia.edu/~gelman/research/published/asa_...](http://www.stat.columbia.edu/~gelman/research/published/asa_pvalues.pdf)

<comment><USER9> > We should probably draw different conclusions given a tiny effect at p=0.05 > versus a large, obvious effect at p=0.05

I'm not sure that "large, obvious effect" and "p=0.05" are compatible, though.

<comment><USER8> Sure it is, of course depending on your domain-dependent definition of "large, obvious". You can have different effect sizes at any given p-value.

</comment></comment></comment><comment><USER10> The term "significant" is itself part of the problem. In statistics it is often used to describe an arbitrary threshold where a difference between datasets is assumed to be real. In common parlance this term implies "important" or "meaningful", but the statistical tests are not designed to draw such forward-looking conclusions.

It would be far easier, and more honest, to simply report the P-value obtained by performing a statistical test without adding the term "significant".

<comment><USER11> I'd be interested in a compound metric composed of the likelihood ratio and the p-value.

Essentially the more likely your hypothesis, the higher your P value can be, and conversely unlikely hypotheses require stronger evidence.

I don't think this solves the problem but maybe it makes that assumption about the hypothesis likelihood more specific.

</comment></comment><comment><USER12> Fishing for findings is a problem, but also overly stringent multiple comparison correction requirements. Those who preach Bonferroni should consider a life-long proposal.

Let us propose that correction for multiple comparisons be a life long endeavor. At the start of a scientist's career as principle investigator, p<.10 is fine. But by their career's 10th comparison, they have to meet at Bonferroni p<.01, and at their career's 100th comparison, now they have to meet at Bonferroni p<.001. When they are old and gray, or doing genomics, at their 1000th comparison they have to meet at p<0.0001.

<comment><USER13> Genomics generally uses 5e-8 (p<0.00000005) as its significance threshold. That aside, your point is clever. How to handle coauthors of different ages is left as an exercise to the reader.

<comment><USER12> I figured it as the p-value rate goes with the PI, the funded investigator.

</comment></comment></comment><comment><AUTHOR> Imagine if p <= 1.0 was considered "significant", wouldn't this cut down on publication bias? Shouldn't every study worth funding be worth publishing? They should all be considered significant results. So I think this proposal is:

1) Not really addressing the issues behind the replication crisis

2) Doing the exact opposite of what should be done ( _raise_ the significance level)

<comment><USER14> What's the point of fitting arbitrary functions to noise? Because that's what high p-values would lead to.

Undue emphasis on p-values is bad, but what you're suggesting is bonkers.

<comment><AUTHOR> Stop funding people to fit arbitrary functions to noise?

<comment><USER14> Don't be disingenuous. That would require someone to actually read their papers, which would already be a net loss and a massive waste of time for everyone involved. Not to mention the amount of department politics which could be involved in this issue.

Look, not every paper is worth publishing. There are many ways to write noise that can pass for signal given the reader's level of understanding (e.g. crack pottery and "fashionable nonsense"). The usage of p-values implements self- filtering to some degree, and makes everyone better off by increasing the likelihood that at least some papers aren't complete nonsense. And that's good.

The only issue is that it is a much weaker constraint on publishing than it was previously thought.

<comment><USER15> > Look, not every paper is worth publishing.

Many more _results_ should be documented than currently are, though, including negative results.

But I agree that changing p-value thresholds is unrelated to _that_.

<comment><USER14> I agree, publication bias is a thing. There's no questioning that.

</comment></comment></comment></comment></comment></comment><comment><USER16> >You won't believe what this team did to the word significant!

>10 significant things that WILL shock you, #7 is this team

>THIS crazy trick that will make significant much harder [teams hate him!!]

>This finding prank gone significant [gone sexual!?]

Sorry, it was such a click-baity title for no reason.

</comment><comment><USER3> This is just silly.

 _Any_ golden value for p is bad. If I go back to my statistics text book (and I assume all of them say something to this effect): The appropriate value of p depends on the particular topic of study.

Not on the whole discipline.

And definitely not across all studies and across all disciplines.

You cannot pick a value of p and say "this is good". Pick too low and you'll likely not be able to reproduce many legitimate results.

</comment><comment><USER17> if i were the King of All Science and were feeling despotic, I would do the opposite, I think -- put a moratorium for a few years on any publication of a p-value.

Scientists would still be free to make use of hypothesis testing to guide their research. In publications, one could use Bayesian methods and report a full posterior. One could also just give enough information about the null hypothesis and whatever distributions are involved to allow the computation of a p-value.

However, any attempt to explicitly publish the p-value itself would result in creative and embarrassing punishments.

<comment><USER3> >In publications, one could use Bayesian methods and report a full posterior.

I fail to see how this is superior.

I'd never advocate banning a legitimate tool just because of abuse.

<comment><USER17> I mean, it was a "modest proposal" type of suggestion.

There are a lot of researchers who have a limited knowledge of statistics and who basically treat the p-value as a magic number.

I don't have any sort of philosophical problem with p-values or the tools of hypothesis testing, but I think it would be good for science if the magic number were less salient, if that makes sense.

</comment></comment></comment><comment><USER12> What is funny asbout p<.05 is that while we frequently have a specific hypothesis in mind (e.g. Mean1<Mean2), convention still dictates that we should use a two-sided t-test instead of a 1-sided t-test. If I am asked to go to .001, then I will use 1-sided t-tests when I have apriori one-sided hypotheses.

</comment><comment><USER18> [https://www.youtube.com/watch?v=8qrfSh07rT0](https://www.youtube.com/watch?v=8qrfSh07rT0) \-- Taleb on p-values, technical, but pretty interesting.

</comment><comment><USER19> sounds expensive. 0.01 may be more reasonable.

<comment><USER20> Choosing the correct value is a social problem.

Eg. The Journal of Wacky Speculation publishes "The Moon is Made of Green Cheese". Using a highly sophisticated cheese detector, the authors measure results consistent with this hypothesis. They calculate it would happen only 4% of the time if the moon were not in fact made of green cheese, and therefore the result is significant. The cheese detector works perfectly, the calculations were accurate, but this does not mean the moon is made of green cheese! We've been there, and we're very certain that it's made of rock. Because the prior probability of the hypothesis was so low, the "significant" result was most likely a fluke. The Journal of Wacky Speculation specializes in this type of hypothesis, so they should use a much lower threshold for p.

Meanwhile, the Sensible and Boring Society publishes a study showing that round wheels roll better on ordinary roads than square wheels. We already had good reason to believe this, so p<0.05 shows it's most likely true. The Sensible and Boring Society publishes tests of hypotheses with higher prior probably, so they can use a higher p threshold.</comment></comment>


Putin Goes to War in Crimea - <AUTHOR> http://www.newyorker.com/online/blogs/newsdesk/2014/03/putin-goes-to-war-in-crimea.html <comment><USER2> Isn't there some legitimacy to Russia's claims that the new ruling government is made up of fascists, anti-semites, and russophobes?

NPR recently had a speaker that denied this calling it Russian propaganda and I bought that but today I saw that the guardian mentions in the article at [http://www.theguardian.com/world/2014/feb/28/ukraine- genuine...](http://www.theguardian.com/world/2014/feb/28/ukraine-genuine- revolution-tackle-corruption) , that there does seem to be a very strong ultra rightest component to it in the Svodoba party [https://en.wikipedia.org/wiki/Svoboda_(political_party)](https://en.wikipedia.org/wiki/Svoboda_\(political_party\)) .

So far, members of the Svodoba are "deputy prime minister for EU integration, interior, justice, energy, infrastructure, defense, culture, social issues,". According to wikipedia, these guys were initially inspired by the Nazis. So apparently, literally fascists.

The protesters fought against corruption and cronyism, but was their fight hijacked by these Svodobans?

</comment><comment><USER3> I'm confused about one thing. All news outlet are reporting this as "occupation of Crimea" as if Crimea was not politically a part of Ukraine proper, as if Russian army in Crimea is not the same as Russian army in the Ukraine even though Crimea is part of the Ukraine. Why is that? Is it because the majority of Crimea's population is ethnically Russian? Or is Crimea a disputed territory, like Abkhazia?

<comment><USER4> It was part of Russia till 1954 when it was transferred to Ukraine. Even after fall of Soviet Union naval bases are still used by the Russian navy. So basically historically population is pro-russian and military personnel was already there before the crisis.

<comment><USER3> Yes, I've read the wiki. It's still a part of the Ukraine. Similarly, Kaliningrad was part of Germany (Prussia) until end of WW2. Yet if Germany invaded Kaliningrad today, it would still be perceived as declaration of war.

</comment></comment></comment><comment><USER5> Incorrect. They are not going to war yet. Putin just got senat permission to make this desition, but the desition is not made yet.

I still can't believe RF will go to war in Ukrain. I hope they won't.

<comment><USER6> Except that Crimea is already taken over by Russian soldiers. So the senate rubber-stamp is just that.

</comment></comment><comment><USER7> I am speculating. What could Putin really hope to accomplish? And at what expense?

I am looking at Wikipedia:

[http://en.wikipedia.org/wiki/Ukraine](http://en.wikipedia.org/wiki/Ukraine)

Ethnic groups (2001)

77.8% Ukrainians

17.3% Russians

4.9% others / unspecified

The Russians are concentrated in the eastern-most provinces, and also in the Crimea.

Russia has 145 million people, the Ukraine has 46 million people, so in terms of the ratio of people, Russia invading the Ukraine would be a bit like the USA invading Mexico.

Russia also has a large per-capita GDP advantage relative to the Ukraine, sort of like the USA advantage over Mexico:

Russia:

GDP (nominal) Per capita $15,717

Ukraine:

GDP (nominal) Per capita $3,862

I'm using the nominal GDP, not the PPP numbers, because when it comes to war it is the nominal numbers that matter (PPP is focused on quality of life, and the fact that your rent might be cheap, or that you can get a haircut for cheap, influences your personal standard of living, but does not effect the outcome of a war).

The USA wasted over $1 trillion in Iraq. If the USA tried to conquer Mexico the war would drag on for many years and very nearly bankrupt the USA. Likewise, I suspect a full invasion of the Ukraine would bankrupt Russia. Chechnya is much smaller, yet still caused Russia considerable pain. And also, Chechnya was isolated from Western help. The Ukraine has a border with a country that is a member of the EU. It is true that the Poles dislike the fact that famous Polish cities such as Lwów were stolen and given to the Ukraine, but if it came to war with Russia, it strikes me as likely Poland allow its border to become porous, in the sense that the border would become a way of getting supplies to the Ukraine. It seems to me likely that the West would be largely united in wanting to help the Ukraine.

The substantial expense makes me think that Putin would not want to try to conquer the whole country. If that is what he wants, then he has gone insane. What seems to me more likely is that he wants to seize those provinces that are majority-Russian. This would be a grievous violation of the sovereignty of the Ukraine, and would probably be regarded as a dangerous precedent. Also, if Putin can get away with it, then there are obvious parallels to Hitler's 1938 occupation of the Sudetenland (which was majority-German). Also remember that Neville Chamberlain's reputation was destroyed when he argued that this one concession to Hitler would lead to peace, when in fact it lead to world war. No Western politician would want to be cast as a modern day Chamberlain, so I suspect many politicians in the West would be inclined to take a strong stand against the partial annexation of the Ukraine to Russia.

I'm trying to think of any major powers that would be willing to support Russia. It has some minor friends: the Serbs, the Syrian government, Cuba, maybe Hungary, etc. But what major power would be willing to support this? Does China have any reason to support Russia in this invasion? I suspect many oil-producing Middle Eastern nations would love to see an economic blockade of Russia, as that would jack up the price of oil.

Finally, there is Putin's use of language, in particular his desire to describe this as an effort to protect the Russians living in the Ukraine. There a parallel to be drawn to the language that Mussolini used when he decided to invade Greece:

"These troops do not come as enemies of the Greek people and the Italian Government does not in any way intend that the temporary occupation of several strategic points, dictated by special necessities of a purely defensive character, should compromise Greek sovereignty and independence."

[http://delong.typepad.com/sdj/2010/10/liveblogging-world- war...](http://delong.typepad.com/sdj/2010/10/liveblogging-world-war-ii- october-28-1940.html)

<comment><USER8> You're misleading. We're talking about Crimea here. Ethnic breakdown in Crimea:

58.2% Russians 27.5% Ukrainians Rest are mixed.

<comment><USER9> Crimean Tartars are a substantial group in Crimea as well, and they (for historical reasons) are very sceptical of the Russians.. [http://en.wikipedia.org/wiki/File:Crimean_Tatar_2001-num.svg](http://en.wikipedia.org/wiki/File:Crimean_Tatar_2001-num.svg)

<comment><USER8> Updated figures:

58.32% Russians

24.32% Ukrainians

12.03% Tarters

[http://en.wikipedia.org/wiki/Crimea#Ethnic_groups](http://en.wikipedia.org/wiki/Crimea#Ethnic_groups)

</comment></comment></comment></comment><comment><USER10> I would suggest to invite UN troops to control the peace in this region until Crimea holds the referendum on March 30. Not Russians nor Ukraine military should interrupt this process.

</comment><comment><USER11> thought this was good - [http://www.newrepublic.com/article/116810/putin- declares-war...](http://www.newrepublic.com/article/116810/putin-declares-war- ukraine-and-us-or-nato-wont-do-much)

</comment><comment><USER5> Actually, HN is not a political forum, so this thread is offtopic here.

</comment><comment><USER12> Demons run when a good man goes to war</comment>


IPFS Meetup – San Francisco May 9th - <AUTHOR> https://www.meetup.com/San-Francisco-IPFS/events/261077320 <comment><USER2> Folks going to the meetup, or anyone who knows: why did IPFS.io select a logo that is so strikingly similar to the one used by IPFS.com?

<comment><AUTHOR> Gonna bet it's a user acquisition tactic so we can get the commercial premium financing people confused and involved with the decentralized web.</comment></comment>


Show HN: look – take a picture, text the link, peek at photos that disappear - <AUTHOR> https://itunes.apple.com/us/app/look-take-picture-share-link/id867393020?ls=1&mt=8

<comment><USER2> interesting idea. 1.) Can anyone with a link view the image? How does that prevent someone from viewing it multiple times? 2.) Wont the fact of being able to view only a small area take away from the experience of viewing the image? What case do you see this is more fun than viewing the whole image?

<comment><AUTHOR> Thanks for checking it out!

1\. It depends, you're able to toggle whether the image can be viewed once or multiple times.

2\. We think viewing a portion of the image makes it interesting. You can treat an image as a scavenger hunt, and hide clues within it. It also discourages screenshots!</comment></comment>


Why PayPal Rushed A New Logo To Market - rkuykendall-com http://readwrite.com/2014/04/30/paypal-new-logo-redesign-david-marcus

<comment> rkuykendall-com The new logo is nice, but brand isn't just about visuals. The PayPal brand has become toxic online, and anytime it's mentioned all I hear about is people who had their accounts frozen with no explanation and no recourse. As a developer, when I think about implementing easy payments I think Stripe. The impression I get online is that implementing PayPal is just asking to be screwed over. It doesn't even matter if that's true or not, it's about what the brand makes people think about.</comment>


Free Courses to Learn Docker in 2019 - <AUTHOR> https://dev.to/javinpaul/10-free-courses-to-learn-docker-in-2019-56n0 <comment><USER2> I recommend taking a look at [http://container.training](http://container.training) \- it has a nice long self-paced intro to containers&docker that is quite thorough.

</comment><comment><USER3> A couple of them are via Pluralsight, which is only free via a temporary trial (10 days).

The others that I checked are available via Udemy, 2 of which are not free but heavily discounted, as most Udemy courses typically are.</comment>


Show HN: Our travelling hand-sewn puppet - <AUTHOR> http://sneef.warbl.net

<comment><AUTHOR> The website was created more than two years ago... today I'd do things differently. But that's on the TODO list for when I have too much time ;)</comment>


On Immigration, Engineers Simply Don't Trust VCs - <AUTHOR> http://techcrunch.com/2014/12/27/on-immigration-engineers-simply-dont-trust-vcs/ <comment><USER3> Just on the subject of programmer salaries, I was talking with someone who had much more experience in the computing industry than myself and he pointed out something I'd never known. He said that programmer salaries from pre-bubble days was six-figures, and that we're still in that range, and not higher is proof that salaries have been kept low. Six-figures today is not what six- figures was worth in 1998. Inflation alone from $100,000 1998 to 2014 is $144,877.91 using [http://www.usinflationcalculator.com](http://www.usinflationcalculator.com)

And yes, I don't trust anyone who cries foul about a shortage of workers and then offers 40% under market wages, anecdote of course.

<comment><USER4> In principle, I agree with most commentators on HN that if there were actually a shortage we'd expect to see salaries rising.

Yet, in practice, it does seem that there's simply an absolute shortage of experienced developers. I've been hiring developers at my job for most of the past year, yet we have _never_ had an offer turned down. Rather, we see only a trickle of applicants, very few of whom are event remotely qualified. If we actually saw a great developer, I'm sure we could put together a fantastic compensation package (despite being an early-stage startup, we pay _above_ market for NYC). Yet all we see are mediocre developers, and few of those. It's hard not to call this a labor shortage when my colleagues hiring for other positions (marketing, writing, etc.) see 100x the number of applicants with 1/10 as much outreach/advertising.

Given that it's impossible to produce more senior developers in a 1-2 year timeframe, what alternatives do people suggest to immigration?

<comment><USER5> > Given that it's impossible to produce more senior developers in a 1-2 year > timeframe, what alternatives do people suggest to immigration?

Why do we operate under the assumption that these companies are entitled to as many unicorns as they want? Why shouldn't they just go out of business?

After the whole collusion ordeal when it became abundantly clear that on one side there are VCs, founders, and C-levels who work to suppress our wages -- and on the other side, us, I actually want to see them lose and get hurt after all the terrible things they did to us.

<comment><USER4> The world isn't nearly as binary as that.

I'm not a VC or founder. I'm a developer just like you, trying to deliver cool products—but doing so requires more developers.

If my company was trying to suppress wages, or refused to pay above market, then I'd agree with you that we have no right to ask for more talent. But we're perfectly willing to pay for talent—we just can't find any.

I wouldn't be surprised if the number of senior developers on the market was less than 10% of the number of open positions.

<comment><USER6> So the thing is, I share your general opinion -- there is a legit shortage of talented developers, and it's hard to find them.

BUT: I guarantee you that there is in fact a wage and benefits package you can offer that would get you more good applicants. Maybe it's more money (sure, "above market" is nice, but I'm not going to leave a job for $5K more than my "market" rate -- but for $50K more, well, let's talk). Maybe it's perks and benefits (the Google package, for instance).

Whatever it is, there is absolutely money you can spend that would end up getting you noticeably more applicants one way or the other. That the company doesn't WANT to spend that money is exactly what bothers people.

And yes, yes, it's all well and good to say that developers are paid and treated well -- they are -- but if their talent and skill is really that rare and that in-demand, maybe they should be paid and treated even better.

<comment><USER4> Okay, let's assume we were willing to offer substantially higher salaries than the market (though the practicalities of our funding certainly limits that to some degree).

How would we communicate said information in a way that doesn't actively distort the hiring process? When was the last time you saw a job ad with salary listed?

<comment><USER6> Put it in the ad. It's not common, but it's not super-rare, either. And the main reason you don't do it is that you don't want to eliminate your chance at hiring someone at a below-market rate (or of alerting your below-market-rate current employees that they're being screwed and should be getting big raises). If you're committed to paying the rates you'd need to pay to get good talent, then put that upfront.

<comment><USER4> See above: [https://news.ycombinator.com/item?id=8805687](https://news.ycombinator.com/item?id=8805687)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> On one of the previous threads about this topic, someone suggested that accepting H1-B applicants in order from higher to lower salaries instead of based on a lottery would clear up a lot of the lottery spots that currently go to the below-market-wage-indentured-servant type shops to be used for more deserving companies and applicants.

Seems like a solid change to me, without an obvious downside. (But I am not an expert and haven't done any detailed analysis, so maybe this would have negative consequences I'm not anticipating.)

Another change that might be a big improvement, it seems to me, is to let H1-B visa holders more easily change jobs once they're here, without so much risk or paperwork hoops to jump through. If it were easier for H1-B workers to switch jobs, then abusive employers would have less leverage to exploit them (forced overtime, below-market wages, etc.).

<comment><USER8> As much as it may sometimes seem like it is, the H1-B isn't a programming or IT visa. It's applicable to a wide range of specialty occupations, across the entire nation. The suggested change would block out virtually all applicants from many other professions.

<comment><USER9> Regardless of the industry, if the H-1B is designed to allow employers to hire specialists they can't find locally, then a salary-sorted approval process should still be desirable.

Machine shops fighting over top-1% welders with deep materials science knowledge should be no different to software shops fighting over top-1% developers with deep computer science knowledge.

<comment><USER8> That'd be fine if the applicant pool was first sorted by profession and geography and like compared against like. But how do you decide the distribution of visas across those sub-groups?

<comment><USER10> For that matter, who picks the number of "how many H1B visas should we have", based on what criteria? Is there research backing up this number? Statistics?

I'd be much more willing to let people decide on their own:

[http://johnhcochrane.blogspot.it/2014/06/the-optimal- number-...](http://johnhcochrane.blogspot.it/2014/06/the-optimal-number-of- immigrants.html)

<comment><USER11> I'm fairly sure that is the US congress and their criteria is how many minority votes they think they can get during an election year.

<comment><USER10> Because H1B's are about 'minorities'? Doesn't make much sense to me.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> This whole immigration thing sounds like an excellent opportunity for someone to put together a better way to work remotely. We're all supposed to be internet savvy, why can't we come up with something better than skype and github? Is something better even required? Why the emphasis on getting people into the country? We're selling virtual presence solutions to industry and telepresence to doctors and we're trying for surgeons. IT is the easiest job to do from a remote location. I work with people every other day that I've never even met in person and I have never visited the co-location of a large chunk of the server hardware that I've worked with over the last couple of years.

Why the accent on physical presence?

<comment><USER13> Tele-presence has a long way to go, and the network infrastructure too, but it will obviously, eventually, get to the point where it's indistinguishable from being in the same room, minus the physical contact. But to your point, it's not even a given that would help much.

Even with that, you still suffer mostly from time zones. You're just not going to collaborate the same ways with someone on the other side of the planet. That just means barriers to entry and more opportunity for those brave enough to try and ultimately get a system that works for them.

I think there's a remote-work bias which isn't fully born out from the evidence. It helps if you can somehow start with perfectly trustworthy peers, because I think a large part of hiring local is keeping tabs and keeping control. If you already know people who happen to be remote, versus trying to hire someone you've never met before remotely, the former can work perfectly fine, the later is [currently] nearly impossible.

There's probably legal and tax issues to deal with too, but I'm going to hand wave assume they do not negate the potential benefits and could just as easily work out in favor of the foreign independent contractor vs. local salaried employee.

<comment><USER14> The time zone issue can be solved easily.find a south american country that is immigration friendly and open an office their ,recruiting from all over the world.

<comment><USER15> Why not Canada?

<comment><USER16> A lot of companies do that already

However, it's not as simple as it seems, you think "let's send everybody to Canada and then grow our offices there with all the foreigners we want" but that doesn't happen and you wonder why.

Maybe they don't want to outgrow their main offices, or maybe it's got to do with Canadian work culture

I've seen people being "parked" in Ireland before applying for their H1B

<comment><USER17> It seems to be quite common with movie visual effects companies. And the Toronto or Vancouver offices are often bigger than the LA staffs.

Of course, that industry is being priced down to survival levels.

<comment><USER12> That's partly related to the non CGI parts of movies often being shot in Canada because of cost advantages. In Toronto you couldn't walk two blocks without tripping over a film crew.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I think one way to fix the trust issue outlined here would be not tying the H1B visa to a specific job, but instead giving it for a defined period of time, eg 5 years, and not making it dependent on the employer.

I know at least a few people on H1B visas who celebrated getting a green card with 2 weeks notice and a nice $20k/year raise to do the exact same job at a competitor.

</comment><comment><USER19> A fundamental question not being answered is: _Who gets to come to America_?

Right now, our system massively favors immediate relatives and refugees, and only lets in a trickle of everyone else. If you are a person who wishes to move to the US, don't have relatives here, and are not a refugee -- then good luck, because you'll have a really hard time getting in.

Stories of people who literally sell everything to get a chance to live here, like that of Claudia Mendoza, bring tears to ones' eyes: [http://app.fwd.us/stories/429](http://app.fwd.us/stories/429) Now her husband was probably not among the 1% in his field. But he was hard-working person, valued by his colleagues, who added and contributed to our society. He and his family were kicked out of the country, for not winning the H-1B lottery.

So to people who oppose skilled worker immigration, I have a question: Should only refugees and people with family relations be admitted? Should everyone else be completely blocked off? People who oppose skilled worker immigration are essentially advocating this.

<comment><USER20> I favor much-more-open borders for people who want to immigrate and become citizens. Any kind of guest-worker program, including the H1B system, I'm more skeptical about. It's understandable for capital to work to carve out selected holes in the fence to benefit themselves the most -- changing the laws isn't easy or cheap -- but that's not the change I'm excited to get behind. (I don't know what specific changes are being pushed right now, if any.)

<comment><USER21> This is my position, as well. Worker visas are effectively a modern indentured servitude. Foreign workers are much less likely to be a fluid commodity on the job market as US citizens can be, because they have their visa to worry about. I oppose borders, generally speaking, but I have a hard time swallowing the massive corporate empowerment represented by the worker visa process (bootstrapped startups also cannot effectively participate, either).

</comment></comment></comment><comment><USER22> I was working a minimum wage factory job in an area where it is very easy to get a job not that long ago, (it took 4 days from the phone call) and I asked my line manager if they had problems hiring. 'Yes', I was told, hiring was a major problem and keeping staff on was really difficult. I asked why they though that was. Apparently they think it is because state benefits are too high.

edit - I'm still working it, I am rubbish with cash.

They are not bad people, but they honestly cannot see that they may actually save money by paying slightly more. I am planning to point this out in the next week or two, but luckily I have nearly sorted my cash-flow issue, so I can afford the license.

<comment><USER23> I'm curious about the town you are talking about. I've seen the finances of people who rely on state benefits, and in the Bay Area--unless you have a bunch of kids(afdc) and were lucky enough to find section 8 housing; the state benefits are not enough to keep a room--you can eat though. I know too many homeless people who tried to get state benefits, and the help they recieved was tiny, and had a time limit. My best friend who passed away was on SSDI. He knew he was lucky he qualified for SSDI, but he was always broke. I saw his checks and it was just enough to get through the month. People used to rib him about buying a cup of coffee at Starbucks, at the expense of The Federal Government, but they had no idea just how little money he was receiving.

<comment><USER22> Am in the south west of the UK. 2 to 3 days a week of crap work covers my rent and most of my food and gives me loads of free time for pissing about on my own stuff. I avoid benefits, not through any particular ideology but more because I find them more trouble than they are worth. I sometimes earn decent money, but I find I get stressed as hell in offices and I don't get motivated enough by money to make up for it, so I am avoiding those kind of jobs for a bit.

</comment></comment></comment><comment><USER24> Yes, if the best engineers really have x100 or x1000 productivity, why aren't employers offering higher salaries?

There's been high-profile high-tech anti-poach collusion, and Ed Catmull (pixar) even claimed it's for the best. But without that, there would be implicit collusion anyway. It's obvious to employers that an arms-race to attract talent is not going to benefit anyone (who is an employer).

But what would happen if wages did rise to their natural level? First, it would attract people to the profession. Second, the most-profitable companies would end up with the best engineers because only they could afford to outbid everyone else (and resources end up in the hands of those most able to utilize them).

Startups, being poor, will find it difficult to attract excellent salaried, non-equity talent ("inequitable"?)

Thirdly and sadly, it would also mean less development work would occur (because it costs so much, and employers have limited money). But I have a feeling you'd end up with even more open source projects; and more people working on startups (to fill the gaps).

</comment><comment><USER25> Training is a big problem in tech. When I graduated college two years ago I couldn't find an entry level job anywhere. Every company wanted at least 1 year of experience. I finally found a place that would give me a shot but also massively underpaid me. Two years later and I am a dev lead on a major project and they are begging me to stay (although they refuse to give me more money). I'm actually getting calls from big valley companies that turned down my new grad app like nothing.

Why don't tech companies (or any company really) invest in their workers and help them attain new skills and career advancement?

<comment><USER26> > Why don't tech companies (or any company really) invest in their workers and > help them attain new skills and career advancement?

Because they don't actually want the "skill shortage" solved. There actually is no skill shortage.

Companies create the "skill shortage" by making the job requirements so impossible that no one applies:

"speaks Mandarin, programs in Java 7.1 and .Net 6.5, is able to travel 80% of the time, is a Backbone.js guru...."

Just look at the laundry list of "must-haves" in a job posting now a days to really get the true picture.

If companies really wanted to solve their "skill shortage" they would look for talent that could be trained to the exact technology rather than demanding that every possible candidate already know the tech stack.

</comment></comment><comment><USER27> There's a huge "purple squirrel" problem. Employers expect to be able to hire someone who knows Drupal, PHP, and Ubuntu. They don't want to retrain someone who knows Methode, Java, and Red Hat, even those do the same job.

Few employers have the capability to train any more. Whenever you encounter an employer whining about this, ask them "How many people do you have in offsite training right now?" If the answer is zero, tell them you've found their problem.

<comment><USER4> I don't know how you can realistically expect startups to invest in employee training.

<comment><USER28> we're a startup and we've sent multiple people to offsite training. in general it only costs a couple thousand bucks per class per employee including room and board.

<comment><USER4> Interesting. Were they otherwise experienced developers who you just needed to train in your particular toolchain, or have you hired inexperienced developers and trained them to be more experienced?

<comment><USER29> There's training expenses regardless of who you hire. There's training in the work flow and the software stack you use (which you haven't mentioned at all on any of the job posts you mentioned elsewhere). It's never "slot right in and be 100% productive from minute one."

</comment></comment></comment></comment></comment><comment><USER30> Instead of a 'shortage of workers', the situation should be more adeptly described as a 'shortage of skilled workers'. I do think there are tech workers floating around, but the really good ones are hard to come by. Extending immigration helps, but does not solve it, as only a bunch of the pool are actually good talent.

Maybe immigration needs to be tweaked to help filter down the pool even more, for example, raising the minimum H1B wage for its skill levels. A disparity in the minimum wage only enables companies to bring in workers that are 'meh' and only pay the minimum cause it's cheap labor, albeit not top talent.

Question for the anti-immigration folks is, if immigration was reduced or stopped entirely, would that necessarily result in higher wages for everyone else? Are talented engineers really not being able to find a job that wants to pay what they want? Are the decent, run-of-the-mill engineers not able to find a job that pays market or slightly below market? Would companies then outsource even more anyway?

<comment><USER31>
      >> would that necessarily result in higher wages for everyone else?

Unless companies like Google relocate ( to where? ) then yes, wages would absolutely rise, because _they don 't allow WFH_ [1], ergo _the only engineers available_ would be those in the Bay Area, NYC, etc. No, they wouldn't outsource critical infrastructure to places like India or China, who hacked them. I also don't see them picking up and leaving and going to e.g. Vancouver.

I think the only way to address this "great engineer" thing without American engineers crying foul is to _gasp_ introduce standardized testing that all the American tech companies -- who can't get the amazing talent -- agree upon and then select the 99th percentile of the candidates that pass it and pay them in the 99th percentile of wages for the bay area. This would be an objective measure and Americans wouldn't be suspicious of whatever criteria VCs/founders use to measure "great programming ability". Make the interviews and the criteria public, bring it to the light, then people would be more inclined to believe them. Right now I simply hear a bunch of hand-wavey math and see a bunch of rich people whining about how they don't have engineers to build _their things_. Yes, I know there are flaws with standardized tests, but it's the best of bad things.

[1] Most companies. Yahoo notoriously, but most companies aren't in favor of allowing WFH.

<comment><USER32> A lot of west coast companies are in Vancouver. It's not their headquarters but having a Vancouver office gives them access to large pools of foreign talent that they can't easily bring into the US. It's also conveniently located in the same time zone as California and Washington which reduces the difficulties of having remote workers.

Any standardized test will be gamed. Just look at all of the books and other resources you can find for how to solve the types of problems that get asked in coding interviews.

</comment></comment></comment><comment><USER33> There's something interesting missing from this discussion -- do the most- skilled international developers _want_ to move to the US? The US's reputation is at a low ebb.

I mean, I like visiting, and I would love to work on some of the projects that are only available in the US, but the idea of actually living there? That's a really tough sell.

<comment><USER18> Enough do. For example, the line for people from India with a master's degree (separate lines for bachelors or phd) to get a green card is more than 11 years long. That's the time from when they qualify to get a greencard to when they actually receive it and not counting the years it takes to qualify for a greencard. During that time they have to stay on h1b visas, which can apparently be renewed indefinitely if the holdup is the backlog in the line for greencards.

</comment></comment><comment><USER34> The whole premise of this "crisis" is that folks want to have their cake and eat it too.

Feels to me like this is more about convenience for financiers. It's easier to do due diligence when everything you do goes through the same funnel a few minutes away from your office. Much easier than flying to Denver, New York or Chicago.

Instead of importing more workers into the overcrowded and expensive valley, maybe export the jobs to one of the other cities in the US with skilled workers. At this point, New York City is practically a cheap market.

</comment><comment><USER35> I don't read a lot of techcrunch to be honest, so maybe this is their standard fare and isn't worth the time I'll take to write this. On the other hand, I dislike that this man just painted my entire industry as xenophobes, without so much as a quote from the party in question. Is this acceptable now? I certainly reject the idea of a world in which psuedo-journalistic conjecture is taken at face value, without so much as an anonymous source.

<comment><USER36> It's usually better to not go TC et al. I just wanted to see how to write an article from an HN threads a few hours earlier.

</comment></comment><comment><USER37> "We don't have exceptional programmers and hence we may be fucked" sounds like an excuse to me. A successful manager or leader is supposed to make an average team do great things. If a manager starts moaning for lack of great talent, I would suspect he is looking for excuses. Perhaps some introspection is needed.

</comment><comment><USER38> What the article neglects to mention is that if the US doesn't capture workers (and SF doesn't work to lower living costs) its inertia for the tech industry (which admittedly currently seems unstoppable) will wane and other countries will pick up the slack.

</comment><comment><USER39> A call for immigration reform is almost always an attempt to reduce wages and to avoid having to train people, instead of a real shortage.

The likely result of open borders would be something like London startup salaries, which are extremely low (measured by what the amount of money buys you in London) for people that aren't on the upper end of the skill range with years of experience.

Entry level salaries will barely get you by and you'll have to live in a shared apartment for 5 years or so until you can afford to rent a place on your own (if you're smart enough to up your skill-set in that time).

This is due to a small startup ecosystem and the ability for most Europeans to access the UK's job market.

</comment><comment><USER40> One part of the immigration problem that is keeping wages is high is the fact that spouses/dependents cannot work. Want to bring in an ace programmer? You'll have to pay double (or just "more") because her husband cannot work in the "land of the free" ... If they're from a country with free healthcare, education or any other benefit, you'll have to pay for that because it was part of their "compensation" before .

I've posted before about the cost of coming to the bay area: [https://news.ycombinator.com/item?id=8533781](https://news.ycombinator.com/item?id=8533781)

</comment><comment><USER41> The fact is that investors want a free market for labor, but will not accept a free market for capital.

Otherwise anyone could invest in any company without silly "accredited investor" rules, which serve only to keep the cost of capital high enough to generate desired returns from the money changers.

</comment><comment><USER42> No, no, no, no, no, no, no to more immigration as a solution to a perceived lack of workers.

[https://t.co/pCv7JgF7mF](https://t.co/pCv7JgF7mF)

</comment><comment><USER43> This whole set of lies really makes me angry. Ever notice how it's only the most powerful of powerful who complain about "talent shortage"? Those who have the most to gain from reducing technology salaries? Sure, you might hear about it being a competitive market with high salaries and all, but that's what it's supposed to be! Engineering talent is in high demand and salaries are supposed to go up!

If anything, they aren't going up enough. Programer's salaries as a whole have stayed nearly even since 1992 [1]. Furthermore, profit margins in the technology sector are remarkably high with very little spent on HR compared to another highly profitable sector: banking. Highly skilled STEM graduates frequently choose to go into finance because they can make more over a longer career without a cap on their income. The ratio of revenue to HR costs at tech companies and finance companies is way out of whack.

If tech wants the best workers, there are plenty of willing and capable Americans ready to pick up the work. Just fucking pay for it. Stop lying through your teeth that this is about talent. It isn't. It's about your stockholders. That's why you only hear the most powerful bitching about it since they are the only ones who would benefit.

[1] [http://www-tc.pbs.org/prod- media/newshour/photos/2013/07/18/...](http://www-tc.pbs.org/prod- media/newshour/photos/2013/07/18/IT_average_salaries- unemployment_chart_business_desk.jpg)

<comment><USER44> Would be nice if someone extrapolated how the wages would look like today if the H1-B program wasn't put into place. Would programmers be making WallStreet salaries? How would that have impacted the start-up ecosystem? Also, numerous H1-Bs are the core of companies like Google, Microsoft, Facebook etc. How would things have looked without any of them?

<comment><USER45> And where would wages be if the biggest tech employers had not been blatantly colluding to depress wages, using illegal anti-competitive tactics?

Paul Graham advocates for free trade when it will increase the value of his portfolio and the wealth of his friends. He doesn't say a word about how free trade has been undermined by the illegal collusion of Facebook, Google, and Apple.

<comment><USER46> I would just like to point out Facebook was not among the companies indicted for collusion.

Think what you will about Facebook, but it is on the high horse in this occasion.

<comment><USER45> You're right. I would edit it but the comment is now too old to edit. My sincere apologies to Facebook.

Here is a partial list of guilty companies:

Apple

Google

Microsoft

IBM

Adobe

Oracle

Sun

Intel

Earthlink

Virgin

Genentech

eBay / Paypal

Pixar

Intuit

Lucasfilm

Dreamworks

Dell

Comcast

Clear Channel

WPP

AOL

AskJeeves

Lycos

Oglivy

Illumita

DoubleClick

</comment></comment></comment></comment></comment><comment><USER47> This is my perspective as a much-maligned foreign worker. I lost the lottery of birth, and was born to lower middle class parents in a third world country. But I worked hard in school, and got a scholarship at a respected private university in the US. I worked hard in college, and got a decent offer from a big tech company. When I start next year right after graduating, I will earn more in one year than my father earns in five. Even with cost of living differences, I calculated that I will have a far better standard of living than I was used to.

Perhaps my university gave me the scholarship to boost its diversity figures. Perhaps my company is paying less than it would have to in some imaginary world in which foreign workers with H1Bs were not allowed -- then again, if that were the case, I would never get that job (I'm smart, but not "extraordinary" enough to get an O-1 visa). But it doesn't matter. Whatever the reasons, I stand to win, living a much better life than back home. So for those of you with inflated senses of self-worth complaining about people like me, why don't you go cry to your mommy about how you should have taken a Wall Street job instead, so that you could have earned a lot more money while fucking over the world economy. Because fuck the rest of the world, right?

<comment><USER48> >" _So for those of you with inflated senses of self-worth complaining about people like me, why don 't you go cry to your mommy about how you should have taken a Wall Street job instead, so that you could have earned a lot more money while fucking over the world economy. Because fuck the rest of the world, right?_"

You're more than welcome to cut your upcoming now-1st-world salary that you boast about and give most of it to a third-world charity or something. Because otherwise, you're also saying "fuck the rest of the world". When you understand why you won't do that, then you'll understand why others won't as well. No, seriously, you can't just ask _others_ to do good, you have to do good yourself as well. Until then, all you're saying is that you expect _others_ to take a hit in their advantage so that _your_ opinions on what matters are satisfied. Without even considering that maybe they're doing what they think matters already, and all you're really complaining about is that it's not the same as yours.

Edit. I'd like to add something about your "birth-lottery" comment.

>" _I lost the lottery of birth, and was born to lower middle class parents in a third world country._ "

I don't agree at all. If anything, you _WON_ the "lottery" over probably billions of other people, ones that are born into families that do not support their offspring as much as it sounds like yours did to you. You may not be lucky enough to be born in a fancy 1st world country, but that's just entirely besides the point because you're succeeding, despite your claim that you lost some imaginary lottery.

<comment><USER47> You're right, I'm luckier than several billions of people in the world. But my point is simply this: the fact that I wasn't born in the US was not in my control. If I want to move here, some people want me here, and it is in my control to do so, I just feel that I have the right to do so.

As far as the last few lines in my comment go: I was expressing bitterness at the fact that we foreign workers are being dismissed as worthless talent-less job-stealers. In my comment I wanted to be dismissive of those who are dismissive of me. I am not really so in real life, as I know that the ones being so vile here are not like that in person, because everyone is more complicated than that.

<comment><USER26> We are not expressing bitterness at foreign workers - we are expressing the reality of 30+ years of US jobs being exported. Good paying manufacturing jobs in the Midwest. Many, many towns are now empty poor shells inhabited by once middle class families who are now poor because their jobs were exported to foreign countries.

And now Americans are supposed to be willing to give up their jobs even within the U.S.?

Maybe if the 1%ers hadn't been so busy destroying the American middle class, you would be welcomed more generously.

</comment></comment></comment></comment><comment><USER49> I wonder how long time this will live on the frontpage of HN before it gets "censored" to back as the discussion of PG's piece did?

With the all internet's "direct communication" and "netizens democracy" it is funny how we cannot have a non-bullshit discussion about a subject like this.

<comment><USER50> There are 339 points and 636 (!) comments on that story. How anyone can call that "censored" is beyond me.

No moderator touched that post at all.

</comment></comment><comment><USER51> "VCs" aren't responsible at all, as far as I can tell, for the Google/Apple/et-al wage-fixing that cost the trust of engineers. That shouldn't be pinned on them, and it certainly shouldn't be pinned on Paul Graham.

What VCs do that is wrong is that they've created a culture of co-funding and collusion-- a feudal reputation economy-- which thwarts independence in decision making and generates a small set of big winners before startups can start hiring and get to the market. Comparing notes on who they like and who they don't is sleazy and creates an in-crowd that is mostly incompetent, but it's not illegal, and it's a subtle-enough offense that average engineers (who probably have little interest in being founders, anyway) dislike them.

As for why they do this, it comes from the fact that building a good portfolio, though technically their job, is a game at which feedback cycles are slow. You might have a strategy that is going to make 40% annual returns (on average) each year, but if macroeconomic events take you down over 3 years, you don't get to prove yourself. So, the VCs have (justifiably) learned that their career benefit is maximized not by building the best portfolio, but by having association (even if the percentage they end up with is tiny) with the very-rare "home runs" that happen every 5 years or so. That requires them to spread information around and create the culture of co-funding, much like an academic department where 20 names get on a paper when 2 researchers did most of the work.

It's not that we "don't trust" the technology elite. We know what their economic interests are and we trust them to pursue them. And that's fine, if this pursuit involves openly advocating what is best for them and what they believe is best for us and for the country. What's _not_ morally OK is lying to the government about a "talent shortage". If they want to come out and say, "our economic interests favor <X>, and here's why we think our interests are aligned with yours", I'd be fine with that. Just don't fucking lie. Immigration is a complex topic and there's no simple answer. "Talent shortage" is a lie, and the ethical status of claiming one exists actually is black-and- white: it's fucking wrong. There's no talent shortage when it's this hard for women, or minorities, or people over 40, or people who spent their careers outside of California, to get themselves taken seriously in tech.

The problem with FWD.us is that they're using their wealth to get access to government officials, and then lying to them, with the intention of bringing economic changes that may or may not harm us, but we've been left out of the discussion.

<comment><USER52> You really shouldn't use any opportunity to bring on your usual thesis - <USER2> collude to fund only startups created by "connected" founders - when it is so out of topic.

</comment></comment><comment><USER17> It would be helpful to have some concrete examples of companies who are hurting from this shortage.

What projects, specifically, are they not getting done?

What specific requirements are they not able to find in potential employees?

Why, specifically, is training not an option?

How, specifically, is inability to get this project going hurting them?

What specific compensation are they offering?

If you want some trust, you're going to need to be forthcoming with specifics, not vague talk about top 5% coders and "We need 30 more great programmers".

<comment><USER45> Training is seen as competitive suicide, because while you bear the costs of training, your competitors can then poach your trained employees by offering a salary that is less than your total cost for that employee but more than the salary you pay that employee.

X = cost to train employee

Y = salary of employee

Competitor pays Z such that Y < Z < Y+X and puts you out of business.

The second factor is that if you raise wages for one person, then the rest of your workforce expects those wages. So a 10% salary increase for one person quickly becomes an across the board 10% bump on your personnel costs.

Bribing, lobbying, paying PR firms, pulling the wool over people's eyes is all judged to be a smaller expense and a worthwhile cost-saving measure.

The economically viable solution is to have schools do the training, but universities are likely not the best model for getting good tech workers.

<comment><USER5> > because while you bear the costs of training, your competitors can then > poach your trained employees by offering a salary that is less than your > total cost for that employee but more than the salary you pay that employee

I tell everyone that in this day and age, the company is not loyal to you -- they will get rid of you very easily if they need to, and so you should not be loyal to them. However, if the company starts investing in you, training you, then you should be loyal to that company. I would't go to a competitor that pays higher in this case (if they pay higher than 2(X + Y), consider it :)).</comment></comment></comment>


Is Edward Snowden a spy? - <AUTHOR> http://mobile.nytimes.com/2017/01/09/books/review/is-edward-snowden-a-spy-a-new-book-calls-him-one.html <comment><USER2> This is disappointing... because an Obama cabinet member finds it impossible to accept that the Snowden releases were what they were claimed to be, notification of the public as to the depth of illegal domestic spying by the US Govt, an entire book is made on the premise?

The fact is, it's most likely as presented by Snowden, that he felt uneasy with the relative ease that privacy is being invaded. He's spoken out against similar programs internationally as well. He didn't intend to stay in Russia, the US Govt ensured that. The limitations of what was released, and some timing to uncover denials by govt agents/agencies etc.

If he were a spy, the disclosures would have been much more thorough, and the information taken would have been far more reaching.

</comment><comment><USER3> Betteridge's law of headlines: "Any headline that ends in a question mark can be answered by the word no."

[https://en.wikipedia.org/wiki/Betteridge's_law_of_headlines](https://en.wikipedia.org/wiki/Betteridge's_law_of_headlines)</comment>


TrueCrypt Master Key Extraction And Volume Identification - <AUTHOR> http://volatility-labs.blogspot.com/2014/01/truecrypt-master-key-extraction-and.html <comment><USER2> A naive person googling about TrueCrypt and stumbling on this article (well written with an authoritative tone) will think that TrueCrypt is completely cracked, and not bother to use it.

This research is interesting and useful, but do we really want to scare off people from using TrueCrypt?

Couldn't you add a paragraph at the top or to the side that says, for example:

"If TrueCrypt is used in the intended way, i.e., you finish your work with TrueCrypt, dismount the TrueCrypt volume, and then shut down your computer, then the data protected by TrueCrypt is secure if your computer is lost, stolen, or copied at that point."

I understand your intended audience (I'm one of them). But TrueCrypt is the best protection we've got (in terms of price (free), quality, license terms, multi-platform support, algorithm choice, etc.). I presume the author likes it and uses it himself too.

We want more people to use it, right? So let's at least make it clear that it isn't cracked or broken when used in the intended manner.

<comment><USER3> We want more people to use it intelligently. If they're not capable of understanding the implications of this research, are they really going to be able to use this software effectively? How much hand holding do we need to do, here?

<comment><USER4> > How much hand holding do we need to do, here?

A lot more than is currently the standard.

Security is a horribly complex subject, and the people that need it most often don't have the time or knowledge to judge tools and sort out implementation details.

</comment></comment></comment><comment><USER5> In this blog post, forensic experts realize TrueCrypt uses headers.

But theres still a valuable lesson: a half-encrypted system is a not encrypted system, and it will leak information. Theres a paper on this from 2008 I think, before TrueCrypt implemented full operating system encryption:

[https://www.schneier.com/paper-truecrypt- dfs.html](https://www.schneier.com/paper-truecrypt-dfs.html)

</comment><comment><USER6> The new era of encryption will be marked not by making existing encryption solutions more secure, but by concealing the very act of existence of encrypted data.

"Here's my data but you cannot read it" \- does not runs so well with courts, high stakes competitors and deep pocketed enemies.

Once it is known "what to crack" the "how to" solution will be found. "Rubber hose cryptography" is one of these :)

If you're not possessing anything to crack (or so "they" think), you're safe :)

<comment><USER7> Interestingly, this is something Julian Assange worked on several year before starting Wikileaks:

        Starting around 1997, he co-invented the Rubberhose deniable encryption
        system, a cryptographic concept made into a software package for the Linux
        operating system designed to provide plausible deniability against
        rubber-hose cryptanalysis;[68] he originally intended the system to be used
        "as a tool for human rights workers who needed to protect sensitive data in
        the field."

[http://en.wikipedia.org/wiki/Julian_Assange#Computer_program...](http://en.wikipedia.org/wiki/Julian_Assange#Computer_programming_and_other_employment)

<comment><USER8> [https://web.archive.org/web/20110709154812/http://iq.org/~pr...](https://web.archive.org/web/20110709154812/http://iq.org/~proff/rubberhose.org/)

</comment></comment></comment><comment><USER9> Interesting writeup and cool that Mr. Ligh has provided these plugins / tools. On the whole though, doesn't appear to contain much novel information.

Of course, partition-only encryption has weaknesses in that the OS may store data in another partition (i.e. you've encrypted the "D:" drive but Windows just dumps a cached file to "C:", let alone the whole pagefile challenge). So you need to trust your OS to not write the masterkey to disk, which is widely acknowledged. I personally run with no page file, so memory ought not to be written to disk by the OS itself (barring a malicious adversary), although this solution isn't the best for someone on 1GB RAM.

Full-disk encryption would block this attack, i.e. encrypted swap on Linux (crypttab makes this quite easy) or system-drive on Truecrypt. Even if it's dumped to disk, you can't get it, again barring online access to the system. Online access this is all null and void regardless as they could just issue commands to dump memory to disk no matter what you've done!

<comment><USER10> One important thing this analysis points out: using a truecrypt volume (ie: a USB stick) on a non-truecrypt system is dangerous.

<comment><USER9> Right.

This would emphasize the need to always be cautious in your use of cryptosystems, since you cannot simply claim "oh my data is Truecrypt'd". That will not save you from everything by itself. But if you look into the documentation, Truecrypt itself warns you about using it, and the threat model is very careful in defining what steps you need to take to adequately protect your data with Truecrypt.

It's one of those things where for most people, just a file-volume (the simplest kind where it's just a file that can be mounted as a block device), will do fine. The write-to-disk wouldn't happen very often, and to lose your data to a thief would require both the unlikely "OS dumped the memory to disk" (meaning the OS doesn't respect the flags TC puts on that memory), AND on top of that "a thief stole your laptop/desktop/external". If your adversary is organized crime, a law enforcement agency, or some other state-like actor with heavy-duty resources and specifically wants y-o-u... Then you'll need to be very careful and use a full disk encryption solution, or rather just not use a computer.

Know your tools. Know your adversary. Sleep a little easier knowing both. Or turn paranoid.

</comment></comment></comment><comment><USER11>
        An advantage you gain right off the bat is that patterns
        in AES keys can be distinguished from other seemingly
        random blocks of data. This is how tools like aeskeyfind
        and bulk_extractor locate the keys in memory dumps, packet
        captures, etc. In most cases, extracting the keys from RAM
        is as easy as this:

        $ ./aeskeyfind Win8SP0x86.raw

Shouldn't it be possible to store an AES key in a way that's indistinguishable from random data?

<comment><USER12> At PrivateCore, we keep key material (and the entire Linux stack) pinned in the CPU cache, then encrypt main memory. This would thwart physical memory extraction attacks, like cold booting, Fireware, Thunderbolt, NV-DIMMs, bus analyzers, malicious RAM, etc.

Note, that doesn't help if someone compromises the software stack and extracts memory contents logically. A compromised kernel running in cache can just decrypt memory contents.

<comment><USER13> I was not aware pinning memory in the CPU cache was even possible. Is this done via some Linux interface? Or directly by using some hardware feature of the CPU?

In any case, it sounds like a very interesting way of maintaining greater protection for secrets.

</comment></comment></comment><comment><USER14> I thought that this issue was already well known? Paging of virtual memory causes keys to be written to disk...

But this article. Wow: "This is a risk that suspects have to live with, and one that law enforcement and government investigators can capitalize on"

I love it. Only criminals use TC so let's call all TC users 'suspects'.

What about people who have portable devices and want to store sensitive financial or medical information? What about people who want to backup this information into a cloud?

<comment><USER15> Its a forensic science post about how law enforcement can compromise TC. I'd be very worried if the people they were targeting weren't suspects.

</comment></comment><comment><USER16> How does secure virtual memory work with this? If data in ram, or at least is encrypted when written to disk, wouldn't that stop this? Do I know what I'm talking about?

</comment><comment><USER17> What does this mean for me? I have all my interal + external hard drives encrypted as well as my system drive.

<comment><USER18> This article is just an analysis of one of the inherent and well-documented weaknesses in truecrypt: the fact that the encryption key must stay in RAM the entire time you are using an encrypted volume. So, as has always been the case, treat the contents of your RAM as precious when a truecrypt volume is mounted.

<comment><USER19> How would you treat your RAM contents as precious? Just making sure you're on a pristine machine, and nothing else is running? Can other unrelated processes access the key from RAM?

<comment><USER20> Well, in theory, let's say you've got a laptop encrypted with Truecrypt. You put it in sleep mode instead of switching it completely off or hibernating,because you are just nipping out for a coffee. An attacker could then steal it, lower its temperature(let's say they put it in a freezer for a while), and then extract - literally take out - the RAM from that machine and plug it into a specially prepared station which would then be used to extract the contents of that memory. In low temperatures, RAM data retention is measured in minutes, so all data you had in your system would be preserved, including the encryption key.

Unlikely? Quite, unless someone like NSA or FBI want your data. Possible? Yes, with the right resources.

<comment><USER21> Cold boot attacks don't work on DDR3

<comment><USER22> Why? Do you have any reference?

<comment><USER23> Here's a paper on the subject [http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb...](http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldboot.pdf)

<comment><USER22> Note the comment at the end of the paper. The authors had not been able to do it successfully with their relatively simple methodology. Sure it is harder than DDR2 but this doesn't mean it is impossible. As pointed out by the authors, the failure can simply be due to the memory controller implementation (or DDR3 protocol itself) on their test setup. If this is the case, then all it takes is a custom memory controller that is optimized for this type of extraction.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> Forgive a fool. But are the volatility plugins used (truecryptmaster and truecryptsummary) only provided to students of the official volatility training or is it released somewhere? Can't find it on their Google code page.

<comment><USER25> right now we are only using them in the class, but in the next Volatility release (2.4) they will be in SVN like all our other ones.

</comment></comment><comment><USER26> Would it help to store a long string of data in memory, say 10mb. Then place the key somewhere in the middle of it? The placement could be based on the password. Just an idea..

<comment><USER25> It would not help. Volatility is not doing any searching, instead it is reading TC's data structures in memory to find the key. Basically replicating TC's algos offline.

</comment></comment><comment><USER27> I wonder, wouldn't it be useful to hide keys to encrypted container in some other type of memory, say videocard memory or processor caches?

</comment><comment><USER28> Are there any 'better' (knowing it's all relative) alternatives for what TrueCrypt provides?

<comment><USER29> Nothing remotely as peer-reviewed and time-tested and open-source.

<comment><USER30> [http://istruecryptauditedyet.com/](http://istruecryptauditedyet.com/)

This suggests that e.g. dm-crypt is definitely more "open-source", and may in fact be better audited. I guess TC is still more "time-tested".

</comment></comment></comment><comment><USER19> So not safe?

<comment><USER31> Nothing's 100% safe - if data exists and can be read by its owner, de facto it _can_ be read by someone else. The only "safe" data is that which never leaves your brain.

<comment><USER32> Until brain scanners become a thing. Then we can all get potentially charged for thought crimes.</comment></comment></comment>


The importance of network effects to Facebook's strategy  - <AUTHOR> http://www.wired.co.uk/news/archive/2012-05/18/the-facebook-strategy

<comment><USER2> <http://cnp-keythai.com></comment>