Why do UI/UX designers not help without charging? - <AUTHOR>

I qualify as senior tech management and have held that role in several companies - large and small. Yet, whenever there was a startup (hell, someone randomly writing in from the internet) I have always spent an inordinate amount of time helping them out - even fixing bugs.
I have taken a lot of help myself - from other engineers, hackers, etc. People here take it for granted that you can ask people to help you with their code and they will not ask for money. Hell, I have lawyer friends who help out for free.
Yet, that is missing from the whole UI/UX design community - we are a small startup and needed some design help. Yet, all the designers that I seek even a bit of help from, take it as a personal affront that I am not paying. Somehow the inability to pay has morphed to a feeling of unwillingness to pay. There seems to be a general defensiveness because (and I'm guessing here) that design was a second class citizen at some point in technology's evolution.
Am I doing something wrong by expecting help for free as a friendly gesture ? this is a genuine question and I'm truly flummoxed. <comment><USER3> Just out of curiosity, are you coming to the table with anything to barter, or just asking for a hand-out?

I don't think it's useful to pretend that all us engineers are completely altruistic. Some are, sure...but a lot of us are self-interested "rational actors".

When I help another engineer, or when they help me, there's sort of an implied quid-pro-quo. If you helped me out, I'm definitely going to take your call when you need me, etc. I'll gladly help you out without even knowing if I'll ever need your advice, because, as people who do the same work, it's very likely that you'll be useful to me in the future.

If a designer, or a CEO, or an attorney approached me and asked for advice, would I be so open and available? Probably not. When you're reaching out to someone of a completely different skill-set, it might be harder for that person to conceptualize how it would be worth their time to help you.

Back to your situation: When you reach out to a designer, ask yourself: Am I at-all useful to this person? Will they ever need my advice? If not, you're going to need to work extra hard off-the-bat to make sure they understand your value (and why helping you will pay dividends).

<comment><AUTHOR> excellent point - thanks. That makes absolute sense - I'm still wondering how to overcome that though.

</comment></comment><comment><USER4> Historically, those in creative professions will be asked to do things for free for exposure - graphic designers still see this quite a bit today, and it is quite common amongst musicians. When they are paid, it usually isn't at a level that properly values their time and service either.

I do some UI/UX work for free, but only for a hobbyist community of musicians I am a part of since it is a community centered around a love of particular content. I also offer some help for free on IRC on solving simple problems. Otherwise, I charge for my services since my time is valuable.

</comment><comment><USER5> Time costs money. And you want free time from other people. That little piece of advice you really really need might take a half an hour for an UI designer to write or talk about. And that half an hour can easily be charged to someone else who is willing to pay for it.

It's just supply vs demand. UI/UX design is in very high demand. Every startup and entrepreneur wants a logo, graphic design or a website. Why waste time helping someone out for free when you can charge for it?

</comment><comment><USER6> Why would you expect anyone to work for free? That's great you have some friends who are willing to, but expecting it from anyone is very bizarre.

</comment><comment><USER7> i dont think its quite that -- you can tons of great ui/fonts/layouts/everything else for free on sites like deviant art/dribbble or freebbbble/themeforest etc, and also weve gotten bootstrap fontawesome etc. were definitely in a better place than 10 yrs ago; theres also more than a few people who give away ui design art by request on reddit devart and twitch.tv.

</comment><comment><USER8> Hi, UX designer here.

First, when you say UI/UX, that's a red flag to me that you don't understand the kind of design you need. There isn't a "UI/UX design community." They're two different specialties, with a handful of subspecialties in each. If you don't understand your problem, and you're asking a stranger for help, I can completely understand that stranger wanting to make sure you're prepared to be taught all the things you don't know so you can understand your actual problem, and that means they have to invest time in you, which means they want to be paid for that.

Second, I don't work for free. That typically means anything resembling facilitation or a deliverable: a wireframe, a color scheme, conducting research. I'll talk all day long, though, if you're exerting all the effort.

Third, I help people out a lot for free, but I also do it within very narrow guidelines. I see it as a professional obligation, to build a positive understanding of design, to grow the ultimate market for my services.

I help out companies, startups and non-profits mostly by doing pro bono design office hours. I'll do them casually, if someone is referred to me. I'll also do them formally twice a year, helping dozens of startups in a single day, through IxDA Austin and Austin Startup Week. Perhaps there are similar events in your area. Try checking with co-working spaces and startup incubators, for example.

I'll also give pretty much anyone an hour of time on the off chance it turns into an interesting bit of contract work. I'll roll the cost of that hour (or whatever) into the contract, if one happens. It rarely does, however, because, there are very few times where the design question you think you have is the design problem you actually have. I've had people walk out of meetings because I'm asking them questions they don't have answers to. They thought they had one "UI/UX" problem, and I helpfully point out all the other problems they have, and they just weren't prepared to hear that.

I'm guessing when you ask for help with your code, you're not expecting someone to develop an entire application for you, for free. There's a very narrow problem you need help with, and, as engineers both, you and the person you ask can speak at the same level and come to a solution in short order.

It's not typically so with design.

You might "just" want to know what the "best" color for a button should be, or get help with color palette for an entire page so it "pops" more.

If I give you a color for your button, you'll walk away happy, sure, and think I'm swell. And then you'll implement it and your conversion rates will drop 30%, because statistically, you probably don't get enough traffic to know for sure for months. Do you know that, or will you panic? Is it the button color's fault? Is it an anomaly? Am I a bad designer? Are all designers frauds and hacks? I made you happy in the moment but have zero control of your opinion of me and of the situation afterwards.

The best thing for you would be for me to sit down with you and go over the entire page, maybe even all of the marketing for your entire product, to understand where this page fits in. Maybe you don't need a different color button, but a different placement. Or different copy. Or different images. Or a different campaign. Or a different product.

I don't know.

And if you're asking me about a button color, there's a better than even chance you don't know, either.

What I do know is, I'm not helping either of us by giving you a color instead of trying to understand your problem. And the only way I can be sure that you're interested in actually solving a problem, is to see if you'll pay for it.

If I'm right, and you don't know what kind of design help you need, I'd be happy to get on Skype or a phone call with you this week and help you figure out the kind of design help you need so you can find the right sort of design community to ask help of.

But, I don't work for free, and I don't know anyone who does.

<comment><AUTHOR> in your very first line, you have just proven my point. I do understand what UI/UX is - and I'm not conflating them together, but talking about a common behavior inherent in both. Forgive me, but I see your reply as fairly vitriolic, whereas my question was anything but (I hope!). You are still thinking of me wanting to get a whole design for free. Where did I insinuate that ?

But I'm generally curious on why you bristle when I ask for design help - <USER2> think from your answer that you believe that I'm asking for an inordinate amount of help a.k.a a whole design for free. If that is indeed the case, then your answer is immediately very helpful because it helps me finetune my request for help !

I have another question for you - as developers, we are pretty comfortable with people asking us to look over code and share opinion. In a lot of ways Dribble is just that. Is it impolite to show someone an existing, badly designed MVP and ask for some open ended design help - whether it be in colors, typography or layout ?

Or do you fundamentally believe this cannot be done without engaging in a contractual discussion.

<comment><USER8> You didn't insinuate it, but you also aren't being specific about the kind of help you're asking for. You're making enormously broad statements about at least two different professions that solve different problems in different ways. I don't believe I am being unfairly critical of your phrasing.

I'm guessing you're reading into my statement, "I'm guessing when you ask for help with your code, you're not expecting someone to develop an entire application for you, for free." I'm not suggesting you are personally asking for an entire design for free (although you would not be the first if you were).

Rather, I'm saying that, if you don't understand your design problem well enough to ask a narrow-enough question of the right sort of designer (as you might with an engineer about a technical issue), then the person you're asking has to understand -- and potentially educate you about -- a much larger portion of your project. That sort of time investment only comes with payment.

I was a developer once, a long time ago, and I don't recall ever asking strangers or even friends to review my code. At least, not successfully. Are there actually places you can go and have random programmers look at your code? How do they run it? How do they build it? How do they understand your business logic? How are they able to duplicate your production environments? I feel as if your counterexample is a straw man. Code reviews amongst other people on your production team is not the same thing at all.

Dribbble is not a place for critique. It is a place for praise, specifically, between visual designers and artists. Only some of that overlaps with UI. Most people don't post in-progress work there, and Dribbble is not designed to facilitate critique of in-progress work when they do. So, that's not a great example.

Also, it's rare to actually be seeking "open-ended design help." If you have an MVP already, then you're already talking with a designer too late. There is a limited amount of change you will be willing to tolerate to your MVP, in very particular places, dealt with in very particular ways. It's the button color example from my first post again. Your MVP might not need a button color change. You might need to throw your whole MVP away. You are probably not prepared to do that.

I have talked with perhaps a hundred different startups through office hours in the past three years or so. Most startups want a pat on the head. They're not prepared to make any design-related changes at all, not to colors, not to copy, not to anything. Some startups are prepared to make superficial, cosmetic changes, but most designers aren't interested in helping you put lipstick on a pig. Designers do that all day long as their day job; they want a bigger impact if they're doing it for fun. Nearly no startups are interested in understanding how to figure out the real design problems in their product and how to solve them; that is, how to find product-market fit, and are willing to throw away all their existing work if necessary to do so. I could probably count those startups on one hand.

I have absolutely had people get up and walk out mid-sentence when I pointed out irredeemable problems with their idea, MVP, or launched application. That is not the kind of feedback most people are willing to hear "for free."

And if you _are_ prepared to throw your MVP away, then you're stuck, because if you ask anything else of the designer at that point, that's real work, and they're not going to do that for free.

I think good free help can be obtained if you can ask a narrow-enough question of the right sort of designer, absolutely.

In my experience, though, that question is hardly ever the right question you should be asking.

<comment><AUTHOR> I see. Thanks for taking the time to write this out - and the answer to your question is yes: there are many places for people to look and review your code (not limited to [http://codereview.stackexchange.com/](http://codereview.stackexchange.com/) and IRC).

From all your answer(s), I get the feeling that UI/UX designers tend not to spend time for free because of one of three reasons:

1\. a quick design help cannot be done and the alternative is too much effort to be justified

2\. if you have an MVP before you are taking design help - its already too late

3\. You really dont want design help - you want platitudes

Let's say, for argument's sake, that I dont fall in any of these categories - built a MVP, took it to market, started generating revenue already. But I think I understand design (but am unskilled at it) and I can take a complete trashing of my current work. However, for certain startup-survival reasons, I need to make something incrementally better (both UI _and_ UX). It's not the promised land, but just one teeny step towards it.

How can I frame my request for help to not piss you off, not waste too much of your time and still not kill my startup ?

<comment><USER8> Your second-to-last paragraph is a good framing, and your final question is a good question.

It's also a good example of why quick design help is hard, because there is no way for anyone _but you_ to know what would be incrementally better or not _for your users_. All an outside designer can do is suggest things that might be interesting to test. You still have to try them and measure the change over time. A given designer has no specific knowledge about your market, and something can be well-designed in general but still have a lot of potential for market optimization.

( In fact, a colleague runs a service that is just that: he'll try something new for you, every month. [https://draft.nu/revise/](https://draft.nu/revise/) )

Since only you have the data on your MVP, start there. Put together your customer lists. Make sure you understand their demographics and their usage patterns and why they purchased and what they were considering instead. Make sure you have ways to contact them for research interviews and if it's possible to go on-site to see them use your product live. Document how your competitors present and discuss their products.

Then, pick something. One small thing. A landing page. A particular form. A headline. Copy for a Google Adwords ad. Something you can measure your current performance on, and measure a change to afterwards. If you're not high-volume, this might be harder to find than you think, but go through the exercise of figuring out what you can collect enough data on now, and what can wait to change until you can measure it later (or what you don't care about measuring).

Then, you can take that one thing to a designer and say, "I'm looking to experiment with different changes to <X>. What are some things you think might be interesting to try? Anything goes."

You're not asking them to do any work. You're not asking them to stake their reputation on the line. Your language ("experiment," "different changes (plural)," "interesting," "try," "anything goes") all says you're willing to respect their time and level of engagement and also that you're prepared to handle their advice properly, that you're not looking for a silver bullet, you're looking for all of the lead bullets.

Say you ask for help with a landing page. A designer might suggest some copy or visual design tweaks for clarity (specific changes), but also suggest you test different headlines (without providing any), and also changing your format from short form to long form or vice versa (definitely without providing any content to you, but maybe they would be interested enough to sketch out some varied layouts). These are all great ideas. You should read up on A/B testing and test all of them in isolation, and also all together. You should test big dramatic changes even more frequently than you test small copy changes, because you don't want to be stuck looking for a local maximum. A UX person might also suggest ways to find out other things to test, research questions to ask, and suggest books or other resources so you can collect that data well.

A startup that came to office hours that well-prepared would basically almost not need design help at all.

<comment><AUTHOR> This was hyper useful. Thanks!</comment></comment></comment></comment></comment></comment>


OpenBSD 6.1 Released - <AUTHOR> https://www.openbsd.org/61.html <comment><USER2> Theo de Raadt's announcement already covered at [https://news.ycombinator.com/item?id=14087493](https://news.ycombinator.com/item?id=14087493) .</comment>


Poll: Software Engineering degree vs Computer Science - <AUTHOR>

For anyone with a computer science degree, if schools offered a legitimate Software Engineering degree as well as a Computer Science degree would you have chosen Software Engineering instead?<p>I don't have enough karma to make a real poll so I guess just say yes or no in the comments. <comment><USER2> I think my school has the best option--rather than a "Software Engineering" degree, we have an "Electrical Engineering and Computer Sciences" program. In practice, this means we end up taking the intro courses for both EE and CS and then we can mix and match however we like. Somebody could specialize entirely in theoretical CS or go for a more practical engineering education. You could also focus on EE almost exclusively, if that's what you want. This program provides significant freedom and versatility--I can basically do whatever I want once I'm done with the intro series--while ensuring that even the theoretically biased CS students understand how the computer works at a lower level and the EE students understand what people will be doing with their processors.

My impression is that most "Computer Engineering" programs--I suspect that "Software Engineering" is similar as well--are less flexible. With the EECS major you're free to basically do anything related to computers; "Computer Engineering" on the other hand is more about lower-level CS and some high- level EE. You could specialize in Human-Computer Interaction, AI or Machine Learning in EECS, which are all fields that (as far as I know) do not fall under "Computer Engineering".

However, my only real experience is with my university. I only have a vague idea of how exactly this all works at other universities, but they seem to split the subject area I'm covering into two or three different majors. If EECS is what you meant by "Software Engineering"--it is computer related, and it is in the college of Engineering--then I am taking it, and don't regret my choice at all.

</comment><comment><AUTHOR> Oh sorry I didn't realize my poll came out as trying to seek advice. I'm currently in a PhD program in CS and I'm happy with it. I'm not sure what I would have chosen when I was just entering college though, not knowing really anything about either field.

I talk to a lot of people currently in school and who have graduated from CS who complain that CS didn't prepare them for the real world and there are a lot of concepts they will never use from a CS degree anyway.

My thinking was that CS is to SE as Physics is to EE or something along those lines. That is, CS as its currently taught isn't theoretical enough in my opinion. I could see a pure CS degree dropping such courses as databases and operating systems in favor of more algorithms and statistics or more programming language classes.

I think CS can make a person a very strong programmer but I can see how many people just don't care for the more theoretical aspects.

</comment><comment><USER3> At my school, there are only a few classes that are different between Software Engineering and Computer Science majors. CSC students have a little more focus into theoretical computing and theory, whereas SE tends to be more practical with classes on things like the software development process.

I'm currently taking computer engineering and I really enjoy it. It is a mix of CSC and EE and unlike our CSC or SE majors, it requires taking higher level math and physics courses which are needed to analyze complicated circuits. I've grown to like developing software more, but it is valuable and interesting to learn about hardware as well.

Take whichever sounds more interesting to you, but in the long run, there isn't much of a difference. Also, you should be able to take some technical electives to learn specific skills.

</comment><comment><USER4> I took computer engineering instead of computer science because it provides a more in depth study of the field . The reverse was that it took longer to finish it and it was harder. So, the answer was yes.

<comment><USER5> He asked about Software Engineering vs CS. CE is CS + EE so CE is going to be very hard at a good school. CS is a math oriented view of our field while SE is more practices and Engineering approach. I would say that the CS degree is more valuable than the SE degree.

No.

<comment><USER4> Depends on which school you go, CS might be business oriented ,and have to take accounting and other crap

</comment></comment></comment><comment><USER6> Doesn't really matter. CS is more theory oriented than SE. But you probably get enough electives in either degree to take courses from the other that interest you. One negative thing about SE is that you are forced to take a whole bunch of courses like Chemistry for the sole purpose of getting the Engineering accreditation which gives you significantly less electives than CS.

</comment><comment><USER7> My alma mater, RIT, offered both CS and SE bachelors degrees: <http://www.cs.rit.edu/>, <http://www.se.rit.edu/> I studied CS but know many people who studied SE. Feel free to contact me if you are interested in the details.</comment>


Scratch is a Programming Language for Kids - <AUTHOR> http://mashable.com/2007/07/22/scratch/ <comment><USER2> It looks a lot like the language with the new Lego Mindstorms kits, which does allow for functions. I think robotics is just about the best way for kids to learn programming because it's so concrete.

<comment><USER3> It's not for robotics at all.

</comment></comment><comment><USER4> I don't understand why anyone would use scratch over Logo. The genius of Logo is that it has a certain logic and mathematical beauty which is actually made visible on the screen.

<comment><USER3> Your overlooking of the obvious here is probably due to the fact that you're not a kid. Logo is a programming language which allows you to accomplish a great number of things, so long as you know how to code.

Scratch, on the other hand, is more like an interaction environment with some coding constructs thrown in. Kids can get pictures display with animations and matching sound in minutes in scratch, which is way more fun than telling a 'turtle' to go forward 25 steps.

<comment><USER4> My school taught us all Logo in third grade, so I did actually learn it at a fairly young age. I enjoyed it at the time, although I admit I'm probably too old to give scratch a fair chance.</comment></comment></comment>


10 Startups managing images in the cloud – Part 6 - <AUTHOR> http://cloudinary.com/blog/10_startups_managing_images_in_the_cloud_part_6

<comment><AUTHOR> This blog post lists 10 cool startups that integrated with Cloudinary for uploading their images to the cloud, dynamically transforming them to match their graphic design and delivering the images optimized through a fast CDN. The listed startups are of different fields but ultimately share a very similar set of image-related requirements.</comment>


Details Emerge of China's 'Big Brother' Surveillance App Targeting Muslims - <AUTHOR> https://techcrunch.com/2019/05/02/china-surveillance-app/ <comment><USER2> The title states "Muslims" but the article refers to Xinjiang only. The title is therefore misleading.</comment>


Tell HN: Best part of the Big Ol' Python PyControvery is women saying "Dongle". - <AUTHOR>

Today I've read multiple female bloggers liberally using the word "dongle" and "big dongle".  This is the best controversy ever!<p>Dongle! Dongle! Dongle! <comment><AUTHOR> But on a more serious note... As the woman did not even work at the same company as the guys she complained about, she really had no recourse except to get up and move. That sounds very inconsiderate but it's actually the law. In a legal sense, anybody in a public place, whether it's a bar or a programming convention, has a constitutional right to say what they want.

Every employer is responsible for knowing various workplace regulations, including sexual harassment laws. There are only two types of sexual harassment, both of which require working with the alleged offender, "quid pro quo" and "hostile environment": [http://www.legalmatch.com/law- library/article/types-of-sexua...](http://www.legalmatch.com/law- library/article/types-of-sexual-harassment.html)

If the woman had worked for the same company as the allegedly offensive guys, she absolutely would have a claim based on them creating a hostile work environment. However, the woman at PyCon didn't work for the same company as the people she complained about. And therefore she had absolutely no claim. Her only right if she was bothered was to get up and move. The only legal claim that may exist now is a wrongful termination suit by the guys that got fired.

<comment><USER2> No, she had every right to complain to the conference organisers.

<comment><AUTHOR> I agree she had an absolute right to complain. My point is simply that she had no legal cause of action against either the guys or their employer. So what did she really have to gain through this controversy? And did those guys really deserve to lose their jobs over some childish comments?

</comment></comment></comment><comment><USER2> Your post is exactly the sort of ostensibly jokey comment that makes women feel unwelcome.</comment>


Thousands of computers now compromised with leaked NSA tools, researchers say - <AUTHOR> https://www.cyberscoop.com/fast-thousands-computers-now-compromised-leaked-nsa-tools-researchers-say/ <comment><USER2> Which is exactly what we _crazy cookoo conspiracy theorists_ have been warning about. It's the same slipperly slope we already went through in the 90's crypto wars, but SV gets amnesia when it gets lots of stupid company valuations and forgets all those lessons apparently.

Bottom line is this. If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively _weakened_ infrastructure, corporate, and government security... basically all the things important to national security in general. So while I don't disagree that triple letters need some cool tools to get shit done, I think this function needs some technocratic oversight specifically for this issue.

It's time for a new Church committee.

<comment><USER3> The antidote seems to be for the NSA to maintain a security report for each discovered zero day. If it ever leaks, they can send the target company the report, which explains both what the exploit is and how to fix it.

That seems fair enough. The NSA needs to exploit flaws, but they can be a bit less evil about it by being ready to fix them if necessary.

That doesn't solve the fact that NSA's competitors could find and exploit the same flaws, or that sometimes it's hard to tell whether any leaks have happened, but it's an improvement.

At the end of it, it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. But we can think of ways to reduce the impact without getting in the way of their job.

<comment><USER4> > it's hard to seriously argue that the NSA should stop exploiting computers. > It's their role. We need them, just like we need a military.

Would you say the same of Chinese government hackers and Syran military? If yes, OK. I understand you accept the need for competition in arms. If not, can you explain why?

<comment><USER5> > Would you say the same of Chinese government hackers and Syran military?

No, for the same reason why I'm okay with the US military having nukes but wouldn't be okay with Syria having them.

Obviously it'd be great if we could get by with no military powers having to possess zero-day exploits (or nukes), but so long as we can't be sure no other nations are benefiting from such exploits, it makes no sense strategically to forbid our own governments from doing the same.

<comment><USER4> So it equally makes no sense for China to forbid itself from using their own exploits? As long as they can't be sure America isn't benefiting from them, they'd better keep up with the arms race.

Or do you consider America to be special and that it deserves these powers more than other countries? Personally I don't think it's competent to hold them because it has an ongoing history of using its weapons to destroy other countries, property and lives. If I had to choose who wins the arms race, I would prefer a less hostile country like China or Germany to have them instead of America. But really, why not nobody? Exploits are offensive weapons, not defensive ones.

<comment><USER5> > So it equally makes no sense for China to forbid itself from using their own > exploits? As long as they can't be sure America isn't benefiting from them, > they'd better keep up with the arms race.

Correct. Same goes for any nation. Since there's no way to be sure that other nations aren't developing zero-day exploits, not developing exploits of your own does nothing more than put you at a disadvantage.

> Or do you consider America to be special and that it deserves these powers > more than other countries?

Yes. I know this seems to be a rather unpopular opinion with the HN crowd these days, but the US absolutely deserves to have better military capabilities than nations like Syria or China. (As for Germany, I'd also be mostly okay with them possessing exploits; as they're a democratic nation who I generally trust to act in the best interests of their citizens. I cannot say the same for Syria or China.)

> But really, why not nobody? Exploits are offensive weapons, not defensive > ones.

That'd be great, but unfortunately it's not a realistic option. So long as one nation possesses and benefits from zero-day exploits (even secretly) then it makes no strategic sense for any other nation to intentionally put themselves at a disadvantage by not developing exploits of their own.

</comment></comment></comment></comment></comment></comment><comment><USER6> Tech security has been an afterthought for too long. The core technologies we use are putting us at grave risk in ways we simply cannot imagine. As we now are starting to realize, that all of our digital lives are permanently centrally recorded carries currently unimaginable risks down the road. That we have centralized global social networks carries risks that the majority of people are not able to experience or understand. We're progressing too fast technologically, and there's way too much of a gap between morphing cultural norms and a system of government that will be, by default, always out of date with respect to these evolving norms.

That we connect directly to a worldwide network with minimum consideration for security is very troubling. In decades to come, we'll look back in humility and realize that the manners in which we used technology added grave risks to our health.

In 2017, we are not in the "wild wild west" age of technology. Rather, we are firmly in the dark ages. We're so far away from having an understanding regarding the lack of social maturity in our technological growth that we fail to properly consider the downside risks.

This is a tough nut to crack because technology is simply _too good_ for the majority, even the technically inclined majority. I recall efforts by very very talented folks to build decentralized technologies to help mitigate some of these long term risks, but such efforts will remain firmly at the fringes of intellectual superiority for a long time. Meanwhile, Goliath will simply grow stronger in time, unless there is some major cultural shift. Is there any such shift happening, beyond the fringe?

<comment><USER7> Poetic, but you shot yourself in the foot in the first paragraph.

 _" That we have centralized global social networks carries risks that the majority of people are not able to experience"_

If the majority of people do not experience the consequences of the risks of whatever-it-is-your-railing-against, if those risks are never realised by the majority, your argument evaporates.

<comment> wu-ikkyu Perhaps the reason most of us don't experience the risks is because the nature of cyber warfare is more subtle than any other form of warfare in history. Social engineers prefer to be undetectable, that means they're doing it right.

<comment><USER7> Then it's hard to tell where the line between (cyber) warfare and social engineering can be drawn.

Is what Facebook did[1] (does?) warfare? I sometimes like to dabble in hyperbolic alarmism, so I'm inclined to want to say yes.

Maybe it's a sign of progress that we now consider emotional manipulation "war". It's probably less harmful, by all accounts, than slaughtering each other.

1\. [https://www.theguardian.com/technology/2014/jun/29/facebook-...](https://www.theguardian.com/technology/2014/jun/29/facebook- users-emotions-news-feeds)

<comment> wu-ikkyu I agree on all accounts. Facebook testing emotional manipulation is corporate psyops weapons development.

Marshall McLuhan postulated back in the 1970 about the future of warfare:

>World War I a railway war of centralization and encirclement. World War II a radio war of decentralization concluded by the Bomb...

>World War III is a guerilla information war with no division between military and civilian participation

<comment><USER6> Cult-driven intellectual authorities believe that designing and firing rainbow glitter embedded bullets of absolute power at rebels is a justified path to social control. Tech such as FB's is misused accordingly.

</comment></comment></comment></comment></comment></comment><comment><USER8> It would be interesting (although I expect impossible) to figure out how many of those thousands were compromised by the NSA vs those compromised by people who got the tools through the leak. It was nice that Microsoft had already fixed a bunch of them (almost like they were told ahead of time they were coming).

It is also interesting to read the outrage about the tools and the presentations on how to use them. If you have ever read the user's manual for a cluster bomb which no doubt tells you in detail how to maximize the number of people it will kill, you get a sense of how destructive and outrageous war can be. Why should cyber war be any different? And how is it any different to use a zero day to compromise a system than it is to use an architectural feature of a building to bring it down on top of its occupants (other than the obvious loss of life). Exploiting defects in the deployed system to maximize the effectiveness of a munition, not a new thing at all. Just the reality of warfare.

We're pretty clearly already in a form of warfare and it is having visible effects on things like infrastructure and elections. So how do we make the battles visible to the common folks? How do convince Mom & Dad to patch their router so that they don't inadvertently aid the 'badguys' in their quest for dominance on the digital battlefield?

Definitely feels like Phase III of the Internet has begun to me.

<comment><USER9> > Why should cyber war be any different?

Because we aren't talking about bombs. We are talking about security.

We are concerned about "nuclear proliferation". Why aren't we concerned about the proliferation of these tools? It takes material to make nuclear weapons (obviously nuclear weapons are much more concerning, that isn't my point), but it only takes instructions to create and use security exploits. In this scenario, threats only have power for everyone who knows about them, and that is inherently dangerous. We should put all of our focus into _getting rid of_ security exploits, not _creating them_.

<comment><USER8> We are talking about both because they are the one and the same.

I was talking about aggression against an enemy. Bombs, sanctions, cyber war fare. All in service to making the 'other guy' pay the price. In the context of cyber warfare getting rid of your own security exploits and creating them for stuff the 'other guy' uses.

But that gets right to the essence of how this is different. The NSA sought to use a superior knowledge of exploits available in the software their enemies used against the enemy, even tho the same tools can be used on their friends. That is no different than picking up the weapon of an enemy soldier and using it against his own squad mates. Or having the enemy pick up your weapon and use it against your squad mates.

Computers and networks are now (and arguably always have been) weapons of war. Just as cars and the people walking into markets wearing vests full of semtex are. And that is a sad truth because it means becoming a casualty can happen anywhere without warning. And that seems to be what Phase III will be about.

</comment></comment></comment><comment><USER10> > "Shodan has currently indexed more than 2 million IPs running a public SMB > service on port 445. ..."

OK, I understand SMB on LAN. But SMB on the Internet? Is that likely accidental?

<comment><USER9> Or a stupid way to make your data available on the go.

<comment><USER10> I did Google for "remote SMB". And your point was made in most of the top forum threads. But sure, people like the easy fix.

</comment></comment></comment><comment><USER11> I have heard the NSA mission in this regard characterized as both defensive, and offensive. Defensive in that they protect our infrastructure (a counter- intel role), and offensive in that they attempt to exploit the infrastructure of our adversaries (and others) for sigint. They trick is finding the right balance, and I don't think there's much hope for agreement on that at the moment. I also find the debate a difficult one to engage in because there are large information asymmetries and much of what we're trying to discuss is obscured by secret courts, classified documents, etc. My impression is that even the people who are tasked with oversight don't get the full picture, so what do we hope to know about it. I've had experiences in industry that I can't talk about that maybe you (in the general sense) haven't had that also inform my views.

Personally, my view is that we should be putting the focus on the defensive side. Protect infrastructure, IP, etc. I believe the reputation of technology in general is harmed by the offensive mission, and US companies disproportionately so. There is now even greater incentives for our adversaries (and friends) to foster development of technologies that compete directly with US products in their own jurisdictions (where they can get a look under the hood).

</comment><comment><USER12> I like the idea of the agencies being allowed to use a zero-day with some asterisks. __

* The zero-day has to be powerful enough to allow the agency to gain full access & remotely patch the zero day -- i.e. if the zero-day gets out, and the agency didn't warn the manufacturer ahead of time and instead used it for its own purposes, it _must_ have the capability to "immediately" scan the internet for the vulnerability and patch it where accessible.

* If the above condition is not satisfied, or if the agency can't/won't dedicate the resources to develop a backup patch, it should be required to alert the manufacturer immediately.

Does this cost more? Yes. Does it limit some of the monitoring capabilities they will have? Yes. The second seems like a pro. The first one seems like a worthy compromise for questionable activity with high potential for collateral damage.

<comment><USER13> At some point, they'd make the patch, and discover they need access again for some reason. We'd be right back where we started.

</comment></comment><comment><USER14> "Once installed, DOUBLEPULSAR is a stealthy backdoor that's difficult to detect and continuously relays new information back to its controller."

Seems to contradict itself? If it's continuously relaying information, wouldn't that make it easy to detect?

<comment><USER15> I think what that means is that it's difficult to detect on the infected host machine. It's easy to detect at the network level, however.

<comment><USER16> Depending on the implementation of "continuously", it might not be easy there either. Most hosts have some reason to be on the internet. Therefore, with some cleverness, attack traffic can be hidden within normal, expected traffic.

</comment></comment></comment><comment><USER17> shower thought: have them been infected now, or now are known to be infected?

<comment><USER18> I was about to comment something similar , but then I saw your post. Btw I don't know why people are down voting it.

This is an important point. This research comes after 10 days of the leak. I have been following the leak closely, I've even compiled a list with all the analysis and resources on a gist.

Good guys, bad guys, kids, bored Blackhats, had enough time to practically follow the step by step instructions in order to implant the backdoor. It doesn't take more than 30-40 mins for the first read till a successful exploit.

The short answer is that we have no idea of knowing how many of those were backdoored by the NSA.

Also worth noting is that the leak happened 3-4 months ago. A lot of people had access to this privately.

<comment><USER19> I was thinking this created great plausible deniability for the NSA.

</comment></comment></comment><comment><USER20> I am worried about the firmware of Intel processors which I believe have had firmware since the mid-1990s or a bit later. Is this possible and are there tools "in the wild" that are capable of doing this? Does Intel do some sort of checksum to ensure that this cannot happen?

<comment><USER21> Not sure whether you're referring to CPU microcode or the OS in the management engine.

Microcode is remarkably tiny and heavily encrypted. I've never heard of anyone dropping hints as to what's in it, so if that's permeable at all I get the impression you'd probably have to have some rather nice friends to learn about it.

Regarding ME security, here's some interesting info I found a while ago: [https://news.ycombinator.com/item?id=13782508](https://news.ycombinator.com/item?id=13782508)

<comment><USER20> Thank you. I was thinking about CPU microcode, but the problem would apply to the ME, I'd guess.

Seems to me the CPU microcode could be hackable given NSA or Israeli govt resources.

</comment></comment></comment><comment><USER22> For more details on this and regular updated on the infection numbers check:[https://blog.binaryedge.io/2017/04/21/doublepulsar/](https://blog.binaryedge.io/2017/04/21/doublepulsar/)

</comment><comment><USER23> The zero-day NSA Pensionfund congratulates John & Jane Doe to his retirement and wishes him/her a nice golden autumn in his Florida beach villa.

</comment><comment><USER24> "The sheer number of computers infected with DOUBLEPULSAR is likely the work of amateurish hackers, experts said."

A huge assumption.

</comment><comment><USER25> Thanks Apple, for not caving to public pressure.

</comment><comment><USER26> Side topic: How can the free market/enterprise work properly if there are backdoors and zero days all over the place?

<comment><USER18> If your threat model includes 3 letter agencies, the short answer is that you cannot.

<comment><USER27> Problem is that the 3-letter agencies tools get leaked and then are open for script Kidd to use. So you're threat model has a dristributive connection to the 3-letters no matter what.

</comment></comment></comment><comment><USER28> At the very least, they should at least create some honeypots to know when those exploits are being used by others...

</comment><comment><USER9> Just thousands? I think that is a few orders of magnitude shy...

</comment><comment><USER29> Good, the will jolt national and global security standards.

</comment><comment><USER30> Are the added to a popular antivirus list?

</comment><comment><USER31> shocking news indeed, seems like you need researchers and studies about everything nowadays, otherwise you're called names

</comment><comment><USER32> "now"</comment>


Raspberry Pi releases new PCB version with USB-C power fix - <AUTHOR> https://hackaday.com/2020/02/23/raspberry-pi-slips-out-new-pcb-version-with-usb-c-power-fix/ <comment><USER2> Two questions that come to mind that the blog doesn't address:

1\. Is the change in this new revision easily identifiable via PCB silkscreen from its deprecated variant, or will consumers be 0402 resistor hunting?

2\. Are (US) authorized resellers shipping this revision yet? None of the 8 for the US appear to have any notice on their respective websites.

EDIT: The Register article[1] cited by the blog mentions the following almost- but-not-quite-relevant tidbits:

> _The update, Upton told us, had also moved "the WLCSP SD card voltage switch > to the top side" to protect it from damage, and also "silk screen tweaks to > reduce solder bridging in manufacture"._

> _We asked Upton this week if the fix was out and he confirmed the update had > indeed been rolled into a PCB Design for Manufacturing (DFM) process. He > added that he would have expected the update "to have reached end users by > now"._

[1] [https://www.theregister.co.uk/2020/02/21/pi_4_fixed/](https://www.theregister.co.uk/2020/02/21/pi_4_fixed/)

</comment><comment><USER3> I've always had this love/hate relationship with the PI where I love the amazing SW the community it putting out for it and I hate the closed source Broadcom hardware/drivers and the rookie design mistakes the RPi foundation keeps making over time giving me the feeling they don't test their designs at all before launching them out to market.

<comment><USER4> This seems like an overly dramatized comment. The issue would have been easy to avoid but on the other hand it's easy to work around so I would call it a minor issue and i can see how it was missed during testing. What other issues have you encountered?

<comment><USER5> Not OP, but the RasPi 2 resetting when exposed to bright light because they used a chip scale part in the power supply comes to mind.

In my opinion, the fact that the SOC is so sparsely documented (and in the Pi 4's case, almost entirely undocumented) is a way bigger deal than the occasional small power supply design issue though.

<comment><USER6> Your comment makes it seem like any bright light will reset a RPi2 which is not accurate. The RPi2 will only reset when exposed to specific high intensity long wave length light. Really it is only triggered by xenon camera flashes at close proximity and laser pointers targeted on the RPi2.

</comment></comment></comment></comment><comment><USER7> Great.

So, how do I make sure I'm purchasing one of the new & improved ones rather than one of the faulty ones?

<comment><USER8> Someone already figured out how to tell them apart: There's a small voltage regulator component that was originally near the edge of the board. In the new revision, it has been moved to the previously empty space above the word "micro" in "micro SD card" [1]

So now you just gotta find a reseller willing to check that they're sending you the correct version.

[1] [https://www.cnx-software.com/2020/02/24/raspberry- pi-4-rev-1...](https://www.cnx-software.com/2020/02/24/raspberry- pi-4-rev-1-2-fixes-usb-c-power-issues-improves-sd-card-resilience/)

<comment><USER9> And here you can find the "resistor hunting" which describes what has changed on the PCB :

[https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=2596...](https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=259629#p1583459)</comment></comment></comment>


Whole Foods employees reveal why stores are facing a crisis of food shortages - <AUTHOR> http://uk.businessinsider.com/whole-foods-employees-reveal-why-stores-are-facing-a-crisis-of-food-shortages-2018-1?r=US&IR=T <comment><USER2> > stores are suffering from food shortages because of a newly implemented > inventory-management system called order-to-shelf, or OTS.

And if thre is any delay, there is no food in place.</comment>


Ask HN: Healthcare Startups? - <AUTHOR>

Does anyone here have experience with healthcare IT startups?<p>It could be worst of both worlds (the bulk of enterprise and the bureaucracy of government) but the opportunities seem massive. Any thoughts appreciated. <comment><USER3> I'm a physician and also a hobby-hacker. I have a ton of ideas for productivity/efficiency boosts for a pretty broad spectrum of pain points across the daily grind of practicing medicine. There is a lot of opportunity. Unfortunately, the thing stopping me from pursuing most (nearly all) of them is the ten-ton monster called HIPAA. The second that you touch patient data you are opening yourself up to a potential beat down (US-centric obviously). There is not a startup-friendly route for handling patient data (ala PCI-DSS compliance workaround with PayPal or Braintree, etc).

</comment><comment><USER4> The existing electronic health records landscape is incredibly fragmented. I read a post somewhere recently that listed 400 different EHR businesses. The interoperability problems are the same ones that the internet experienced in the early days. Little standards, different platforms, siloed data. I think the interesting opportunities are in developing applications that help medical practices fulfill the "meaningful use" criteria. Each individual module can be fulfilled using specific technology, that doesnt necessarily need to be certified. For example, a practice can use one technology to fulfill their CPOE requirement while using a completely different vendor to do Clinical Decision support. You can be the go to player for a specific module.

</comment><comment><USER5> The place I work for makes medical software for administration type stuff at family practices etc. We can't even host our -own- apps, because of privacy concerns. We have to make it, and deploy it on their servers in a local environment.

Joe might have 3k in savings at the bank, and someone could hack in and take it. Okay, that's a bugger.

But if that hacker can hack in to Joe's medical files, and see he has Herpes, then he's going to be mad as a cow.

Yep, the opportunities are _MASSIVE_ \- especially here in New Zealand - <USER2> hardest will be getting people to trust you imo.

</comment><comment><USER6> Yes, I am the founder a funded healthcare (UK) startup. See <http://nhs.info> and <http://about.nhs.info>

</comment><comment><USER7> I am in the process of starting one.

There are a lot of issues around what you are offering; the barriers are varied and many.

But they are all surmountable - though you need to take a shotgun approach.

For example - if you went to Health 2.0 yo would have noted several things: 1) the founders of health 2.0 are money hungry and unscrupulous 2) everyone was focused on the silo of the PHR 3) The small practice iPad application space is really crowded 4) big EHRs are walled gardens - big monolithic gorillas with no interest in partnering or providing data via HL7 compliant channels

5) EVERYONE suffers because of this.

6) the secret killer in the space is Cisco.

Typical hospital IT organizations are either HUGE (kaiser) or outsourced and incompetent (Eclipsys / Perot) or in-house and understaffed (city/county like SF DPH/DPT)

What specifically are you interested in?</comment>


How SaaS Startups Should Be Using AdWords - <AUTHOR> http://www.wordstream.com/blog/ws/2016/06/15/adwords-for-saas-startups <comment><USER2> Senior digital media guy at a SaaS company.

A lot of this is spot on, but I think there's a big miss, particularly on the display side. Conversion tracking is everything, and unfortunately, display (and video as a subset of that) is about the toughest thing to measure out there from an ROI standpoint.

Odds are you won't see click conversions as the bulk will be view-throughs. That leads you to the question of "what's the value of a view-through conversion?" Well, for starters, without an ad server like DCM, you won't have any view-through revenue numbers (AdWords obviously has the data, they just don't expose it in the interface--no idea why not). That gets into a messy cross-channel attribution discussion. I'd love to see more written on valuing display for companies with a sales cycle of 30+ days with multiple touch points.

The other thing is being careful about last click attribution. AdWords just released some data-driven attribution models in AdWords which are cool, but only a partial picture because it is just AdWords data (not other channels like you'd find in GA Premium), and no display data. That said, it can still be useful to see if certain campaigns/terms are awareness generators that are having their conversions "cannabalized" by other campaigns or keywords on a last click tracking basis. If you are getting into things like RLSA targeting ("Retargeting Lists in Search Ads," so like display retargeting but on the search network), you might want to see if they are grabbing the last click credit away from the campaign that originated the initial interest.</comment>


Would you pay to be able to build your own trading bot (automated system)? - <AUTHOR> I'm curious as to how much you'd be willing to pay, if at all, for a platform that allows you to automate your trading process. <comment><USER2> No because there isn't much to automate.

I takes me about 40 hours to do proper DD on a company. It depends if I know the sector well, if not then even more. The actual trade is just hitting the sell/buy button.

That's once in a month.

I don't think I could ever automate the DD process.

You can come up with good AI and amazing algos but at the end of the day, a doctor knows more about the ill person just by looking at him/her for a few seconds, I feel like it's the same with trading/investing.

If I automate the valuation, I lose the connection to a company and its numbers. Another example would be insider transactions, there is a difference how you evaluate insider trading, it depends on the company and its market cap, the sector, and the management.

I don't even know how I could ever come up with good indicators for those issues.

Now there are also people who use TA, that's your clientele.

</comment><comment><USER3> Yes. I personally feel like the trading space is ripe for someone to come along and kick over everyone's cans. Etrade, Schwab, TD, they all work but -- they're all just so clunky, and early 2000's, and old, and just...just so not desirable. As a 25-year old professional who doesn't have the time to research stocks/options, and doesn't want to park his money in an index fund, I _desperately_ need a MODERN alternative. But sadly there is none (no, Robinhood is not an alternative, it's a casino in your pocket).

</comment><comment><USER4> Not much. I think there are open source kits out there. Since I would be risking my own cash anyway, and doing all the config work. Unless you can provide some proven edge or advantage

<comment><USER5> Yes if it included options. Most trading platforms are only stock, futures, or forex. Stocks and the like you have to be 100% directional, options on the other hand give you way more strategies that would be great to be able to automate from a trading platform. Especially if you had the ability to back test strategies and update your models over time, and adjust the option strategies. Or even the ability to combine options with another asset class like stock, futures, or pairs trading.

If someone created a platform like this with its own scripting language and REST api it would be like nothing available today.

<comment><USER6> Reasons why you would create a new scripting language that nobody is familiar with rather than using an existing language that at least some people would be familiar with?

<comment><USER5> I guess I went that direction because Thinkorswim and most other platforms all developed their own scripting language, but reflecting now I think something simple that everyone knows like Python or JavaScript lib/sdk would be a better approach.

</comment></comment></comment></comment><comment><USER7> Are you asking because you're doing market research? If so I would strongly urge you to reconsider. If you're not doing market research you can probably disregard most of this comment.

Here are the realities of trading algorithms and trading automation:

1\. Approximately no one trades competently - let alone _profitably_ \- outside of a trading firm. With very few exceptions the process of designing, implementing, testing, deploying, monitoring and improving trading algorithms is not a feasible job for a single person. This is aside from the problem of data acquisition, engineering and processing. There _are_ people who profitably trade on their own, but they're typically veterans of a trading firm looking to grab a larger piece of the PnL on their own book. I don't know why there is this persistent belief that a lone individual is going to be automating trading competently - in the past I've compared this to thinking you could singlehandedly develop and/or maintain half of DuckDuckGo.

2\. The firms which automate most of their trading - and this is increasingly the default - know how to do it and know how to acquire the talent requisite for maintaining that core competency. They like to keep things in-house where possible. They are extraordinarily secretive and don't like depending on third party infrastructure or tooling unless it's absolutely necessary. You are probably not going to develop an ultra-sticky product like Bloomberg, Nanex or kdb. A third party dependency that inserts itself into the risk management, analysis or execution pipeline is a liability. Moreover the intense secrecy means you will have difficulty talking to, or hearing from, employees of actual firms.

3\. This is an incredibly crowded space to try and enter. Many companies have popped up which market products to firms looking to automate some or all of their process. They're typically not very successful in this effort for two reasons. The first is what I already mentioned about secrecy among firms. But just as importantly it's very difficult to develop a reliable trading process by hand, let alone to automate it. The customers you want to work with are savvy and most of the existing products are crap, so you'd need to have a very strong product and a very compelling case for why yours is different and useful.

To put this all together for you: by asking this question on Hacker News you're strongly selecting for answers from people who almost certainly do not trade professionally. If they believe they are competently and effectively trading on their own without professional experience, it is most likely because they have vast unknown unknowns and a limited definition of what "automated trading" means (for example, they might think they're doing automated trading because they use the Interactive Brokers API instead of manually placing orders). You _can_ target that kind of crowd, but if you do so you're entering the B2C cottage industry of (de facto) day trading education, not the B2B industry of trading itself. Unless you're attempting to build a fintech hypergrowth startup like Robinhood you _really_ don't want to do this in a B2C capacity; then you're optimizing for customers who have both limited money and limited experience they could use to get any _more_ money.

<comment><USER8> Anyone can make money in the market. I have 0 experience working at any financial firm, and I can beat any one of those systems. If you dedicate yourself to something you can do it.

<comment><USER7> Of course I wasn't talking about _you_. I'm sure _you_ can singlehandedly beat RenTec, DE Shaw, Two Sigma, Citadel, Bridgewater, PDT, Tower, TGS, Headlands, AQR and DWR; all without any professional experience in finance. And naturally it makes more sense for you to work with a vastly smaller amount of capital, on your own, instead of simply joining one of those firms. After all you routinely beat their archaic and inefficient systems. You're a walking argument for active trading instead of index investing! Buffett should check in with you.

But you have to admit your skill is extraordinary, and I'm not talking about people like _you_ in my earlier comment. I'm talking about most people, who cannot do the things that _you_ can do. They probably come easily to you but you're just gifted with exceptional talent and work ethic. Most people can't trade profitably even with all the resources of a firm behind them; that you can do it while making all those other firms look silly is astounding and remarkable. So please don't feel as though I was downplaying your impressive accomplishments.

<comment><USER8> Of course they should, tell them to contact me, I will teach them a thing or three. My info is in my profile. The issue is they wouldn't give me their capital because they are scared.

I have come across people who are almost as good as me as well. They don't work in finance, have no finance experience, but they beat the most of those brokerages and are self sufficient, and work from home without a boss.

Anyways, there are many people who are doing what I am doing, to think they are not is not well thought out. Everyone who claims only experts can win are just not doing themselves a favour and the person listening to them.

I.e. Ignore the noise and get to work. There is money to be made. Just open your eyes, there is money to be had.

Edit: deleted references to a throwaway account.

<comment><USER7> Take a look at my comment history. This is not a throwaway account :)

And for what it's worth, I don't doubt you at all. Like I said, I fully believe you are as incredible as you say. But not all of us can so easily obviate the work of entire firms staffed with hundreds of people employed to improve their trading results. You should count yourself lucky!

</comment></comment></comment></comment></comment><comment><USER9> No, not when I could build my own bot for free with a platform like quantopian.com.

I believe that if your algorithms perform well enough, you can actually lease them out to investors.

<comment><USER10> Quantopian is looking for algo's that compliment their fund. You may have a strategy that outperforms the market but is highly correlated to an algo quantopian is already backing.

Your algo is also tied to the quantopian API and data that they provide. I'm not sure what the effort would be like to port a Quantopian algo to a platform like Interactive Brokers.

</comment></comment><comment><USER11> Depends on the outcome. If the automation can ensure that we only sell when there is a profit even if small while we hold when not, then I may pay for it, sure.

<comment><USER12> Let me suggest that if they can do that, trolling for customers on internet boards isn't their path to profit.

</comment></comment><comment><USER13> I would pay for the learning process. The price would depend on topic depths. If you share the lessons titles I would have no problem in giving numbers.

</comment><comment><USER8> I have started looking down this path where I need something that can do a few things.

1) I have an account with Questrade, I need to enter the same trades on Interactive Brokers once I enter on Questrade. Also, I have customers who want to follow my trades, so if they can hook in and buy and sell at the same time I do, based on the same account balances, it can work for me.

2) I have a system where I enter if the stock price is > X. I use conditional orders for this now, so it doesn't really need to be automated, however it would be nice and would save me time.

3) The exiting is not automated because it's based on market sentiment, however, I wouldn't want to insert my data into any system that can leak the data. I could go for something where I put in supports, and instead of placing a stop order, it monitors the stock to fall under a price, and then stop me out using a market order. The reason I need this is because I would rather not have my stops advertised to brokerages.

4) Monitor my profile and alert me when a stock moves 5%,10% using beeps. This would be read-only. Something I am looking to do already.

The biggest drawback, what happens if the system fails? Are you going to reimburse me? If I write my own code, it's my own fault. Trusting someone else's code is hard to do. Also, if something breaks, how fast will it be fixed?

In the end, what I am doing now is conditional orders with a trailing stop that I adjust accordingly.

<comment><USER7> For those of you reading this and thinking this person has any idea what they're talking about, I'd like to direct your attention to their website: [http://marketgodfathers.com](http://marketgodfathers.com) (as listed in their profile).

In particular, note that this _titan of industry_ advertises a monthly subscription service for options trading 1) with absolutely no technical or nuanced financial terminology, 2) using words like "play" to refer to trading, and 3) with wealth-centric hype videos from _The Wolf of Wall Street_ and _American Gangster._

Run, don't walk, from this person's advice.

<comment><USER8> :) I didn't want to waste more words responding to you, but I had to add three more sentences. As I said, I am the best. My trolls disappear fast [1].

[1] [https://www.reddit.com/user/marketgodfather/comments/8vm9jt/...](https://www.reddit.com/user/marketgodfather/comments/8vm9jt/rmarketgodfathers/)</comment></comment></comment>


John Carmack .plan Archive (2014) - <AUTHOR> https://github.com/ESWAT/john-carmack-plan-archive <comment><USER3> "I probably had my personal "moment of truth" around the beginning of Doom 3's development, when it became clear that it is no longer possible to deeply understand every single part of a modern application. There is just too much. Nevertheless, I found that I could still enjoy my work when confined to a subset of the entire project, and I have thus remained committed to the high end. However, the appeal of smaller systems still lingers." [0]

I am very much having this moment with the current state of web/app development. Being a generalist, you end up primarily working to meet a product end, be it new user features or product milestones. All the time making many compromises along the way, as any good engineer should. Yet the depth of the web/mobile stack, the sprawl of libraries, and the abundance of computation for most tasks makes you operate at a very high level (30,000 ft) and only dive down to the bits when absolutely necessary. This has its own joys, primarily one of productivity, but it does starve a primordial part of most developers' brains that craves order/perfection/optimality/complete understanding.

I never understood why some people would play with a low level language like C or assembly outside of work in their free times. After 10 years of professional application coding, I get it.

[0] [https://raw.githubusercontent.com/ESWAT/john-carmack-plan- ar...](https://raw.githubusercontent.com/ESWAT/john-carmack-plan- archive/master/by_year/johnc_plan_2007.txt)

<comment><USER4> I feel this is especially true in a web/API world, where a lot of what isn't automated is usually rather similar between projects.

I deal with some daily major systems and some critical security architectures, but most of the time I feel like a digital janitor who is mainly making sure the SOA pipeline doesn't clog up.

</comment></comment><comment><USER5> I'll pass on the recommendation that previous HNers have to me: if you haven't read Masters of Doom yet, do it. Whether you're an entrepreneur or an engineer or both, it's a really inspirational and informative tale. It also talks about these .plan files.

<comment><USER6> There is also Making of Prince of Persia book, which is great read as well.

<comment><USER7> I enjoyed both Master of Doom and the two Mechner books (for Karateka and PoP). Can anyone suggest similar long-form blogs or books where a single developer talks about a programming journey they took? (Nat Friedman - <USER2> - had a great blog 2002-2006ish of this nature, but it has since gone down.)

<comment><USER8> You should definitely check out Bob Pape's book about the spectrum version of Rtype (and Rampage)

[http://bizzley.imbahost.com/download.html](http://bizzley.imbahost.com/download.html)

<comment><USER7> About half way through so far, thanks! :)

</comment></comment></comment></comment></comment><comment><USER9> This gets posted to HN roughly every few months or so. Or something similar, like when I posted the quakeworld post.

I don't mind. It totally deserves it.

</comment><comment><USER10> In current times people feel uncomfortable fingering someone.

<comment><USER11> It's unfortunate that this comment got down-voted. If you wanted to see someone's .plan file. You use the finger command. ie, finger firstname.lastname@example.com. Of course, very few people if any still run the finger service. The above post was a subtle humor that needs a history lesson.

</comment></comment><comment><USER12> Funny thing: finger and .plans were what you are doing.

Twitter is what you are doing.

I wonder if in some alternate universe 'finger' would have became mainstream.

<comment><USER13> Well, there's always something like this Finger-to-Twitter proxy:

[https://gist.github.com/mcroydon/519344](https://gist.github.com/mcroydon/519344)

<comment><USER14> but then i'd have to use node.js

<comment><USER13> True. So maybe it would be better to stick this one-liner in your inetd.conf.

        perl -MLWP::Simple -MCGI=escape -MHTML::Entities -MEncode -e '$u="";read(STDIN,$u,1,length($u)) while length($u)<128 and $u!~/\n/;$u=~s/^\/w//i;$u=~s/\s//g;if(!$u){print "This server cannot enumerate users.\r\n";exit}elsif(length($u)>128){exit}elsif($u=~/@/){print "Finger forwarding denied.\n";exit}foreach (split /\r?\n/,get("https://twitrss.me/twitter_user_to_rss/?user=".escape($u))) { if(/<title>([^<]+)/){$title=decode_entities($1)}elsif(/<dc:creator>.*\(@([^)<]+)\)/){$author=decode_entities($1)}elsif(/<\/item>/){print encode("utf8","$author: $title\r\n")}}'

On the bright side, Finger is a simple enough protocol you can implement a full-featured RFC1288-compliant server (except for some optional features) in under 600 characters. Remind me again why nobody uses it anymore?

<comment><USER14> That's one heck of a 1-liner! I like it.

>. Remind me again why nobody uses it (finger) anymore?

People wanted "shiny" for their things.

</comment></comment></comment></comment></comment><comment><USER15> Previous discussion: [https://news.ycombinator.com/item?id=3367230](https://news.ycombinator.com/item?id=3367230)

</comment><comment><USER16> Pff, 2014. I remember the good 'ol days when you read Carmack's plan on Blues News as he was discovering BSP tree's and firing Romero :)

<comment><USER17> Blues News? You mean you didn't finger his account directly from a shell prompt?

<comment><USER16> I was never much into fingering unfortunately

</comment></comment></comment><comment><USER18> For Kindle users like myself, I've bundled up the plan archive into a nice e-book format (one chapter per entry) to read through all of these:

[http://rtpg.co/files/carmack-plan.epub](http://rtpg.co/files/carmack- plan.epub)

For those interested in the script, here's that:

[https://gist.github.com/rtpg/4eb757c2c71ab20946bbd8156cd0533...](https://gist.github.com/rtpg/4eb757c2c71ab20946bbd8156cd05332)

</comment><comment><USER7> One of my favorite parts is when he talks about buying a gigantic $10,000 "portable" computer (an early Pentium, I believe) and just going to an out-of- state hotel and working for a few days with no contact with the outside world. On his return, he decides to repeat the exercise every few months. I've been considering the same (but with Internet access).

<comment><USER19> I was doing this every few weekends, while living/working in Toronto but getting a hotel for a weekend in one of the suburbs. I used this time to work on my own projects and long-term reflection, since I was working on the client work so much it was hard to detach enough to work on my own stuff in the same environments I worked on other people's work in.

</comment></comment><comment><USER20> Keeping an archive of .plan files and making it web accessible is why Ryan wrote IcculusFinger. A shame finger died out :-)

<comment><USER21> Finger is one of those ideas that worked only while the internet was a playground for the university labs.

After all, it requires that a port is exposed to the world for someone to read it.

<comment><USER22> The problem with finger is that it exposes information that is now considered sensitive while it provides very little benefit. And of course because it is an old protocol there were some security issues with the daemon.

It's a neat idea but if you want to share information about yourself, why not have a webpage?

</comment></comment></comment><comment><USER23> What do the * and + mean?

<comment><USER24> If I recall correctly, * means it was done that day and + that it was done at a later date.

<comment><USER23> If it was done later, how did it enter that file?

<comment><USER24> I think he just went back and changed the text file a few days later. I don't know how this works with the finger protocol (never used it), so it might just've been for himself.

</comment></comment></comment></comment><comment><USER25> Interesting tidbit about a music video his future wife, Katherine Anna Kang, animated that used the Quake engine in the Feb 7, 2003 plan.

In the Waiting Line - Zero 7: [https://www.youtube.com/watch?v=Cq336zk2cZk](https://www.youtube.com/watch?v=Cq336zk2cZk)

</comment><comment><USER26> I recall reading his and a lot of other companies' and developers' .plans over at [https://www.bluesnews.com](https://www.bluesnews.com)

</comment><comment><USER27> * John Carmack's .plan for Feb 24, 1996 ... * ______RELEASE QTEST1 __ __ __

It looks so brown and blocky and crude now, but it was huge at the time. Good memories.

</comment><comment><USER28> Lots of big news in August 1996.

</comment><comment><USER29> I keep my orgmode main file in ~/.plan

</comment><comment><USER30> I miss .plan and finger :(</comment>


Ask HN: Building an e-commerce site in 2016 - J-dawg A friend is starting a fashion business and has asked for advice about setting up an online store.<p>Do you recommend a particular framework (e.g. Magento)? Is it worth building something from scratch? <comment><AUTHOR> I would use everything but Magento. Actually, if i want something simple for someone who is not IT person themself i would probably use Shopify. For something personal, where i know i am going to hack some functionality into i really like Woocommerce because its so simple and comes with so many free plugins. Nice to get started.

<comment> J-dawg Thanks, this is helpful. I'm not sure yet how involved I want to be. Can you give an example of the kind of custom stuff you can do in Woocommerce that wouldn't be possible in Shopify?

<comment><AUTHOR> I am not 100% sure how strong the API of shopify is. But you depend on it. For woocommerce i can just write _bots_ that query the Database and create actions based on this. Next to the API, Monkey Patching, Plugins, Hooks and whatever else it ships with.

You always have more and better possibilities if you host yourself.

As concrete example. I am in the progress of automating a dropship business. Not sure how easy that would be with shopify.</comment></comment></comment>


Anonymous declares war on Islamic State - <AUTHOR> http://www.mirror.co.uk/news/world-news/anonymous-declares-war-islamic-state-6839030 <comment><USER2> What are they going to this time? Prank-order a hundred pizza's again?

</comment><comment><USER3> I thought they already declared war after the Charlie Hebdo attack.

</comment><comment><USER4> my favorite response to this was "What are they going to do, facebook poke them to death?"

</comment><comment><USER5> ...took them a while</comment>


WhatsApp bug crashes app and completely wipes out chats with a single message - <AUTHOR> https://www.independent.co.uk/life-style/gadgets-and-tech/news/whatsapp-crash-bug-update-latest-version-security-group-chat-a9249786.html <comment><USER2> This was published 4 months ago.

[https://www.reddit.com/user/Chensixin123/comments/cnz6em/wha...](https://www.reddit.com/user/Chensixin123/comments/cnz6em/whatsapp_has_revealed_a_major_security_breach/)

And reported as fixed: [https://www.wired.com/story/whatsapp-group-chat-crash- bug/](https://www.wired.com/story/whatsapp-group-chat-crash-bug/)

It would be nice to see these supposedly crash messages they claim, to me it looks like some advertising crap strategy.</comment>


First Virtual Health Festival in the Covid19 world - <AUTHOR> https://festihealth.com/ <comment><AUTHOR> StartX and FestiHealth are thrilled to announce a new Virtual Health startup competition with the support of the American Heart Association and the Stanford Lab for Mental Health Innovation.

We welcome early-stage startups with good ideas and great teams who are seeking funding, support, and visibility.

The best early-stage startups will win big prizes. More details will be announced at the upcoming FestiHealth event. Register now for free at [https://bit.ly/3cFH9Ew](https://bit.ly/3cFH9Ew)</comment>


Steve Jobs' Unfortunate Contribution to Product Development - <AUTHOR> http://blog.teamtreehouse.com/steve-jobs-unfortunate-contribution-to-product-development

<comment><USER2> At the risk of sounding lukewarm on the issue, I think that user-centered approaches to product development are appropriate for some cases, and creator- centric approaches are appropriate for others.

Apple probably worked on the iPhone a couple of years before releasing it. If they had done user testing they might have compromised their lead on the development of touch devices.

In response, Nokia used to be open about design & development, using a blog to communicate with their users and gauging their response to certain features. We all know where that ended up.

I agree most ideas should be validated before attempting them, but when you have deep knowledge about the industry you're in, you can pinpoint specific pain points without doing market validation.

The approach encouraged by Lean et al is a bit naive. Out of politeness, people will often say that your product is great. Others won't make any mental effort into trying your product, and will click aimlessly just to try to please you.

I don't advocate big methodological approaches but just sitting down for coffee and demo-ing your product to poorly chosen people does more harm than it helps.</comment>