Ask HN: Moving on from web development - <AUTHOR> I'm a computer science student who has been working mostly on JavaScript(node and front end). I want to change paths as I feel too confined in the web dev space. I want to switch to something entirely unrelated to creating CRUD apps(including mobile apps).
I have tried to read the code of and contribute to Open Source projects like LLVM and MongoDB but its very tedious to get into. For almost the whole past year I haven't learnt anything new or atleast worthwhile. I tried getting into Machine learning but the Math was overwhelming.
What should I learn so that I can become competent for jobs other than web development?
EDIT: GitHub: https://github.com/ayushgp <comment><USER2> I am a technical lead for a frontend dev team.

Looking for a senior developer to work with, I would prefer someone with a breadth of knowledge over someone who just focuses exclusively on one thing. For example, it is no fun to explain basic Unix concepts to someone who you expect would have that knowledge. Of course, I would want good knowledge of web development, UI design etc., but things don't stop there.

Some things that look good to me:

1\. Some knowledge of compilers, parser generators 2\. Relatively decent Unix/Linux knowledge 3\. Big Software engineering ideas and how to apply them 4\. Big ideas in different programming paradigms and how to apply them 5\. Low-level stuff: write some C code, tinker with assembly, learn about computer organization (you might be doing that already) 6\. spin up a server and maintain it ... like an actual, bare metal server. deal with its problems. 7\. Research and understand the pieces around enterprise systems ... a fun challenge is a trading system.

Even if you end up focusing on web development, coming in and saying something interesting about your breadth of knowledge and to utilize the ideas is always a good thing.

</comment><comment><USER3> Learn C++ and low level programming, it's a good path! Fairly easy to get into when you already know JS and you can gradually begin to work on more complex systems.

If you want help getting started with some open-source C++ projects, maybe include a link to your github or something in your profile so maybe someone will reach out.

</comment><comment><USER4> You're a student still, there's nothing to move on from. Apply for jobs and internships you're interested in. As far as any employer is concerned, you're a blank canvas.

<comment><AUTHOR> I've been creating web based apps for a long time now(that too nothing meaningful). Honestly, I'm tired of reading the same articles that promote a JS frameworks, list a thousand reasons for how React is better than Angular, why I should be learning webpack, how my life is ruined if I don't know ES6, etc. Also there is no standard way of doing things. IMO, the web dev scene is pretty messed up right now.

As far as any employer is concerned, I should have at least something unrelated to web development to show for if I don't want to be hired as a web developer.

PS: I already have an internship in hand for the summer.

<comment><USER4> If you are tired of it, then don't do it. It's as simple as that.

I work in Web Dev now. Know how much I knew when I got my first job? Nothing. I have a friend who works in Aerospace. Know how much they knew? Nothing. I have another friend who started at an interior design firm that builds custom CAD software. Know how much they knew? Nothing.

Just follow your interests and don't stress about it. No reasonable employer is going to expect you to be a wiz in their specific field as a junior developer.

<comment><USER5> Well, the hard part is to switch niches after you're experienced (and bored) in one niche... i.e. you work in web dev now, but will you be able to get a job in Aerospace or custom CAD software building?

<comment><USER4> Exactly, but the OP doesn't have this problem because they are just starting out.

<comment><AUTHOR> OP here.

I think if a company is coming to my college for offering jobs, it's highly likely that I'll only be offered web development positions. Unless I do something else to prove that I can do well in other fields as well.

</comment></comment></comment></comment></comment></comment><comment><USER6> I've been building things for the web since 1995. I feel you-I started rolling my eyes about 5-6 years ago with all the JS fatique (I love js but the community has become tiresome when you've been in it long enough) I left frontend (as much as I could) and moved into the back. At first still basically building crud apps. I've moved into and out of GIS a couple times and found it an actually interesting problem area. You might consider taking your dev skill set into GIS. My only warning is that GIS is an enterprise ecosystem so it definitely feels like sand in my crotch given my personal preference for simple/oss.

<comment><USER6> That said, like the other comments suggest, you're crazy early in your path. Adjust expectations and reality accordingly.

</comment></comment><comment><USER7> Pick any technology or tool you know and dig deeper.

You know node, great! Now how the V8 engine works, why it works like that? What tradeoff the designer did? Why?

You have used databases, great! How a database works? Why?

You know what is a web browser, great! ...

You know what is a compiler...

You can always go deeper and learn more.

Clearly being able to modify the V8 engine is way more valuable than being able to use V8 with node... Or at least if you can modify the engine it is a safe assumption that you can also use it...

</comment><comment><USER8> The answer to your question all depends on exactly _what kind of jobs_ you are even remotely interested in?

In general it's best to compound your current skills and not go in a completely perpendicular direction to where you are going now.

Given that: \- you are good in JavaScript \- you haven't provided much filter of criteria \- you mentioned a curiosity in machine learning \- you care about job prospects and want a skill that will stay relevant

Have you considered data visualization? If you become a master at that, you can break into the higher level parts of machine learning/data science that require visualizing results to end-users/interested stakeholders. I'm good enough with D3.js to understand examples and create my own modified graphs, but I wish I had the skills to recreate all of the cool visuals you can see in their gallery.

<comment><AUTHOR> I think now is the time I can afford to go in a completely unrelated direction.

Also last summer I interned as a front end developer at an analytics startup. My work there was to build prototypes of visualizations that were to be included in the product in the future. So yeah I have played around with visualizations as well. It's a pretty good field to get into as well.

</comment></comment><comment><USER9> > _What should I learn so that I can become competent for jobs other than web > development?_

Your question is meaningless without specifying what sort of job you'd prefer or what your interests are. There is no single set of things (other than "everything") you could study that would qualify you for all non-webdev jobs.

</comment><comment><USER10> Before you move on, fix your website :)

GET [http://ayushgp.me/](http://ayushgp.me/) net::ERR_CONNECTION_TIMED_OUT

<comment><AUTHOR> Didn't pay for hosting. It was not good anyways. Neither am I planning on building it again in near future.

</comment></comment><comment><USER11> Try building a few example CRUD apps and you'll be forced to learn everything you need to know along the way.

<comment><AUTHOR> I have been doing just that for past 2 years as a student. Almost all projects I've created have been CRUD apps with little to no other logic than that.

<comment><USER11> Ah, sorry. I misread your question and thought you wanted to switch from JS/node -> CRUD.

</comment></comment></comment><comment><USER12> How programming works: -i want to do X because i have Y needing. How programming doesn't work: -i want to program X because its popular.

btw, machine learning is not about math.

<comment><USER13> Machine learning is about math.

</comment></comment><comment> castle-bravo With heavy mathematical topics (ML, category theory, quadratic programming, graph grammars), I find that it takes me multiple attempts spaced over months before I can say that I understand the basic math. Math is a really broad, really deep, and really challenging subject, but extremely rewarding to pursue.

Echoing the commenter who suggested you learn C++, look at Haskell too. Of all the languages that I've worked in so far, Haskell is my absolute favourite. This free course got me over the initial hump in the learning curve: <[http://www.seas.upenn.edu/~cis194/fall16/>](http://www.seas.upenn.edu/~cis194/fall16/>)</comment>


Yoourlink - <AUTHOR> https://yoourlink.com <comment><USER2> There is _no_ information about what this do in the page. Does it submit the link to a lot of aggregators? Does it just spam them?</comment>


Bitcoin ASIC Miner from BFL, finally - <AUTHOR> http://codinginmysleep.com/bfl-jalapeno-unboxing-and-demo/ <comment><USER2> The more people get excited about faster ways to hoard bitcoins and eventually make a nice profit (presumably in USD in the end) the dramatically more cynical I become about its future. When the bitcoin discussion was mainly around its use as a currency for things like silkroad, VPNs etc I actually thought it seemed to have a promising future. I really hope I'm wrong, but I have a feeling in 2023 the bitcoin discussion will be relegated to nostalgic jokes about how crazy we used to be.

<comment><USER3> > _The more people get excited about faster ways to hoard bitcoins_

People seem to be oblivious to the fact that a currency must be available in order to be useful. There is a reason that Gresham's Law has achieved "Law" status.

Oddly, the right thing to do for currency acceptance would be to shutdown all of the ASICs.

<comment><USER4> I think people are more oblivious to the fact that a "deflationary currency" is inherently flawed because it by definition results in hoarding, which is not what you want people to do with your currency. Why would you bother loaning or investing it if you can make more money just sitting on it?

<comment><USER5> If USD was limited to currency in circulation then it would not be nearly as inflationary as it is.

Once an established lending system based on bitcoins is established it will have the same problems as our current currencies. It wasn't printing money that caused the real estate bubble, it was the way to banking system has the power to expand credit and the systemic risk that expansion of credit causes.

Once there are fractional reserve bitcoin banks it will no longer be a deflationary currency.

<comment><USER6> Will people want to borrow in defalationary biased currency though? Better to borrow in Bernanke Bucks where there is an unstoppable torrent being emitted monthly.

IMHO the Real estate bubble was from the Fed bailing the prior tech bubble by suppressing interest rates - which encourages borrowing. When loans are paid back, the currency created by taking the loan is extinguished but they have been juicing the system by continually suppressing rates via QE/bond purchases and not letting the real market decide the risk (ie: price of bonds). Now that interest rates have hit the floor - the next bubble to pop is the USD itself.

<comment><USER5> If the USD pops then BTC may be less deflationary. The bubble did not pop because mortgages were paid back.

Loans are generally repaid in currency, paying back a loan creates even more currency as the additional currency created by the interest becomes an asset against which loans can be issued.

<comment><USER7> The idea the USD is going to collapse is farcical. It would be a global catastrophe of a scale not yet seen, but also not threatened.

Meanwhile, BTC gains and loses 50 - 80% of its value in a single day. _I wonder which is more stable_.

<comment><USER8> > It would be a global catastrophe of a scale not yet seen, but also not > threatened

It would have been in the 70s -- which is why USD support has remained despite the Nixon shock for a few more decades. By now, most central banks and governments are increasingly, dare I say "prepared" or slowly preparing for the possibility without it impacting their economies or trade too badly. Nobody wants to see the USD fail or die --- but day-to-day economic / monetary policies on US soil should become less and less of a rest-of-the-world economic worry, concern or impact compared to previously.

Now, the last remaining problem is savings of millions tied up in USD promises worldwide. Still a big problem, and rest assured the USD will continue to get "support" to the proportion that these savings haven't "migrated" over to "something else" yet.

Anyway, one day all these notes the US has been "exporting" globally for many years will come home one way or the other. Hope the new cash supplies won't, ahem, "overwhelm" a struggling domestic economy at that time, shall we?

<comment><USER7> "One day". It will be a gradual process - it has to be - because anyone stupid enough to try and cash-out mass USD in bulk will not get there money's worth back in it.

But more importantly, is there any real sign that that time is soon? Global financial crisis...and the world's investors are literally paying the US to take their money with the current returns on US treasuries.

But it's hardly the USD "collapsing" - it's a gradual process over time, which crucially doesn't effect the buying power of individuals over meaningful timespans to them (decades, not days - unlike BTC).

And, probably more importantly, whatever replacement reserve currency comes to the fore (and what would it be, exactly?), it won't be something like BTC.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I doubted that these ASIC rigs would ship any time soon. Wouldn't it be more profitable for the vendors to simply to delay/cancel orders and run the rigs 24/7 themselves?

<comment><USER10> Totally agree.

Why would anyone wants to sell the goose who lays golden eggs while gold cost more than the goose?

They'll pile up cash from "preorders", mine bitcoins and when time is right - will dump outdated devices to customers.

<comment><USER11> The profitability of ASICs is going to decrease at a rapid rate once they start shipping to consumers. Additionally, in a few months the market is going to be flooded with cheap ASICs.

From BFL's perspective if they don't release first they're dead in the water. They don't know where their competitors are compared to them but they recognize it's a winner take all situation. The natural thing to do would be to take pre-orders to fund the manufacturing and start realizing profits now. Also, if your competitors are offering pre-orders you should be too.

<comment><USER12> This waxing and waning of mining devices is certainly going to become the norm.

* Buy up $10K worth of devices

* Make your money while flooding the market with fast and easy BTC

* Sell off all your hardware after the profit margins have cratered

* Wait for new hardware and rinse and repeat

Personally I will be extremely glad when the first wave hits as the hoarders will start feeling the pinch of inflation.

<comment><USER13> bitcoin does not work that way. Inflation decreases at a set rate.

<comment><USER14> Difficulty adjusts week-to-week. Being the only guy with an ASIC is like a license to print money. Being the 10,000th person with an ASIC will be like trying to mine with a netbook today.

</comment></comment></comment></comment></comment></comment><comment><USER15> I work this out to be about 180 Mhash/J, which is 80-100x more energy efficient than any GPU mining.

Also, for anyone wondering: At current difficulty and rate of exchange this will cost you <$0.10 a day to run and generate $40 of Bitcoin.

<comment><USER16> $40 per day?

<comment><USER17> I estimate it'd produce around 0.25 BTC/day, mining in a pool. That's about $30/day USD at today's price.

As ASICs come online, the difficulty is going to go up, which will reduce the daily generation rate for any given miner. I've been trying to decide whether or not to order a device now based on my profitability prediction for months from now when I might actually get it. I'm guessing by the time I get one I might be able to produce at least 0.05 BTC/day. Assuming that's $6/day, the $274 device will take about six weeks to pay for itself. Not too bad, but I don't know if keeping tabs on it afterwards is worth it for $6/day. It'd only be worth it if I think BTC are going to be worth a lot more in the future... getting back to hoarding coins as an investment rather than using them as currency.

<comment><USER18> >getting back to hoarding coins as an investment rather than using them as currency

But then, may be it's better just to hoard BTC directly right now by reallocating thousands of dollars required for device? Can't decide for myself.

</comment></comment></comment></comment><comment><USER19> selling shovels and pick-axes to miners was always much more lucrative than being a prospector - plus ca change

<comment><USER20> Well, there were surely a few prospectors who made out like bandits- but on the whole, yes.

</comment></comment><comment><USER20> The heat is of course a byproduct of the higher wattage, but I wonder what on earth happened to make them miss the wattage target by 6-7x?

<comment><USER21> They probably missed the clock-rate by a factor of 2x, or decided to use half the number of chips and overclock them to save money. It may also have been their backup plan because people are willing to pay 8x as much for power, but they're less willing to get 1/2 the hashrate.

If you run a CPU at the same voltage, but at half the speed, it uses 1/2 the power because CMOS circuits only really use power as the transistors change state. However you're also able to run at about 1/2 the voltage without getting errors. Because V=IR, 1/2 the voltage at the same resistance is 1/2 the amperage, and since P=IV, that's 1/4 the power for normal circuits. Of course CMOS circuits already run at 1/2 the power. In the real world there's also leakage and such, but in a perfect world doubling the clockrate takes 8 times the power.

Transmeta's Crusoe was the first processor to really take advantage of this, by varying the voltage and running slower to save battery life. Before this time (2000), laptops would use a duty cycle to save power. Soon all the major chip manufacturers started copying them.

</comment></comment><comment> w-ll I ordered the 60gh/s SC Single the night preorderes opened like a year ago. I think there are maybe ~7 orders before me. I hope I get it soon. I paid 220 firstname.lastname@example.com usd for it, let's see if its worth it.

<comment><USER22> I ordered a Jalepeno almost immediately. I chose to pay by wire, and the email i received included "Your order position won't be penalized for any time it takes to send you this payment information. Please send me an email with a copy of the wire confirmation form. Once payment has been received, I'll respond with final confirmation of your order."

I still haven't paid and am going to now. I wonder if they will honor it or not.

<comment><USER23> "time it takes to send you this payment information. "

I don't see where it says you won't be penalized for the time it takes for you to make a payment. With that said - I'm curious, did people pay in advance of shipping?

<comment><USER22> oh no! i read that wrong everytime. In my said it said "it takes you to send this payment".

but yes, they have been taking pre-orders for like 9 months and people have been paying.

</comment></comment></comment></comment><comment><USER24> Arrived just after the peak too.

<comment><USER25> appreciate the thorough burn-in test

</comment></comment><comment><USER26> I'm sure with enough digging around I could find this out for myself, but could someone familiar with things comment on how the performance of these boxes compares to a standard ATI card miner?

<comment><USER27> High-end ATI cards will do < 1GH/s, with most midrange cards below 500MH/s. This does 5GH/s, while using an essentially an order of magnitude less power than a PC-based rig will use.

<https://en.bitcoin.it/wiki/Mining_hardware_comparison>

</comment></comment><comment><USER28> More discussion on this article at Bitcoin Talk: <https://bitcointalk.org/index.php?topic=181849.0;all>

</comment><comment><USER29> That is the current expected bitcoin per gigahash earning rate?

</comment><comment> daniel-cussen I thought they had been ripped off by their suppliers and they just never got wise to it.</comment>


German Court finds Apple's 'slide to unlock' patent invalid - <AUTHOR> http://www.tuaw.com/2013/04/05/german-court-finds-apples-slide-to-unlock-patent-invalid <comment><USER2> >Mueller also points out a fundamental difference between patent law in the US and patent law in Europe. Put simply, the patent requirements in Europe are more stringent to the extent that they are granted for technical solutions to technical problems.

So... the patent laws here are sane? Well that's a relief.

<comment><USER3> Just saner. Not sane.

<comment><USER2> Well, sanity is always relative.

</comment></comment></comment><comment><USER4> Reminder: patents are per-country.

A finding in one country doesn't necessarily affect other countries.

<comment><USER5> I think USPTO has been taking steps to invalidate the same patent for a while now, too. Also patents are now unitary across all Europe, although I think it only applies to the new ones.

<comment><USER6> There is no such thing as a _Unitary Patent_ in the EU, let alone "Europe". The _Agreement on a Unified Patent Court_ has not been ratified by any country and there are substantial legal challenges mounted by two EU members, Spain and Italy.

Even the most optimistic believers in the new system are planning for post mid-2014 issuance at the earliest.

And yes, the new system exists in parallel with the existing one, so does not apply to existing patents.

<comment><USER7> And even if we get a Unified Patent Court, it will necessarily help. Perhaps the one good thing about EU patent law is that it is hard to enforce :/</comment></comment></comment></comment>


Material Design Components for Elm - <AUTHOR> https://debois.github.io/elm-mdl/ <comment><AUTHOR> elm-mdl 7.0.0. This release marks a substantial achievement of elm-mdl: we have now ported every component of Google's Material Design Lite!

This maybe the single biggest (by loc) Elm-lang open source project.</comment>


Pre–Big Bang Physics: What Existed Before the Big Bang? - <AUTHOR> https://en.wikipedia.org/wiki/Pre%E2%80%93Big_Bang_physics <comment><AUTHOR> A Simple/Short Introduction to Pre-Big-Bang Physics/Cosmology ([https://arxiv.org/abs/hep-th/9802057](https://arxiv.org/abs/hep-th/9802057))</comment>


Ask HN: What's the job market look like during Covid? - <AUTHOR> Senior dev (~5yrs), deeply unhappy at current job. I keep thinking about just quitting without lining something else up first. Yes, I know that strategically a job search has a better outcome if you're currently employed.<p>How bad is it right now? Has anyone landed a gig during shelter-in-place? How was this job search compared to previous? <comment><USER2> Related "Ask HN: Has the market for software engineers diminished at all?" [https://news.ycombinator.com/item?id=23721268](https://news.ycombinator.com/item?id=23721268) makes a good point that the H1B change might mean less candidates for jobs</comment>


Ditching a Language - <AUTHOR> http://blogs.perl.org/users/ovid/2014/01/ditching-a-language.html <comment><USER2> A rewrite is very hard, specially from a ancient, spaguetti monster. Keep it in the same language or not is not the biggest issue, IMHO, except if we are talking about a key library not available elsewhere or a niche where that language is just the BEST.

I have done severals. Changin languages, database engines, architecture, styles... even do the same thing several times in the same project!

And each time, I see a lot of code reduction. Specially, if I can change the language!. In one of them, I reduce by the butloads some badly C# project to python. I meant, close to 1000 files to few dozens. Yep, if we are talking about _spaguetti_ , then that could compresse that well ;)

In fact, I think the action of change language (or move to the _most_ recent versions with the most modern libraries/dependencies possible) is the SIMPLEST way to reduce the load of the job.

I do this all the time. Each time obj-c give some new trick that cut code, I apply it as fast as possible, across all my codebase. I learn to do that after the most insane upgrade/rewrite from .NET 1 to 1.1 then 2.0 that kill us because the boss wait to much.

The BEST way is obviously not bring (again) the same mistake that create that monster in first place. THAT is what make hard/impossible the task in the average corporation, because are the cultural problems that cause the biggest mess.

Also, is necesary to keep old project alive, and (this is something that bite me once) truly have the most hyper-perfect data upgrade/syncronization possible to minimize downtime and have real data from the start... real but clean! This way I create a 3-tier version in visual foxpro+sql server of a fox/dos app that was deployed in +2000 places with non-tech people before the internet, sucesfully (bar the first couple of tries ;)).

</comment><comment><USER3> It's coincidental that this should be on the front page of HN the night before my team and I release a big migration that has taken the best part of a year.

The codebase he describes is an eerily accurate representation of where we started, with the added complication that it was built by a sole developer than wasn't using any version control at all.

There are roughly 600k lines of Perl code in the back-end alone, but because there was a lot of duplication in lieu of version control, I have no way of knowing how much of this was actually in use. I suspect roughly 100-150k.

Our approach was pulling the platform apart into distinct (Ruby) services and putting HTTP interfaces around some of the legacy services where possible. We've ended up with < 15k of Ruby, including the front-ends. It's not perfect but there haven't been many major issues in our pilot release, and the team is happy. Fingers crossed.

<comment><USER4> The obvious question is: how large was your team?

While a lot of the commenters here seem somehow outraged at the computations, 5.5 man years seemed like a very aggressive schedule for rewriting a 1MLOC system, even if the end result were a 100KLOC one. My initial guess would have been 10 man years, and a cost in the millions.

So here you have what was probably a 150KLOC original system. How many man- years would you guess the rewrite took?

<comment><USER3> Three, plus a part-time contractor. One of the team is front-end so had little to do with replacing the Perl part.

The truth of it is, in our case it isn't (yet) a full rewrite, and there is still a lot of functionality tied up in the existing codebase. So it's not easy to answer the question about man years, but I would guess around 1.5.

The biggest wins for us in terms of lines of code were not the language (we did consider sticking with Perl), but re-assessing the business logic, ridding the codebase of legacy junk and using existing libraries instead of hand- rolled solutions.

<comment><USER5> The way you did it seems to be the most logical (and obvious) approach, which the article completely neglects to mention

</comment></comment></comment></comment><comment><USER6> This blog post seems like a case of being stuck between a "second system syndrome" and a sunk cost fallacy.

It would seem like the obvious answer would be to not sit down and rewrite the whole thing from scratch, but start replacing pieces (with whatever language they think they'll be successful at).

The idea that they should somehow just be stuck forever with a shitty mess of a perl application seems incredibly defeatist.

<comment><USER7> Protecting sunk costs is only a fallacy if the money was entirely wasted.

If you spent money on something and that something isn't worth what you put into it but still is worth a lot, you want to protect that investment.

As far as incremental improvements go, rewriting some part in another language seem pretty bad. I mean, if you are being incremental, then you have to make changes that might interrupted in the middle and then you'd be saddling the system with two different languages.

You could just easily rewrite the worst parts to conform whatever existing or new standard you have. I'm not fan of Perl but I'm pretty sure you could at least create a subset that would conform standard object-oriented practices and not have the problem of now having a system written in two different languages.

<comment><USER6> I have a hard time considering this large application as an "investment". Presumably, it provides some business function, and has been hopefully generating more revenue in its lifetime than was spent creating it.

I don't think the software has any intrinsic value; it wasn't constructed from precious metals, which could be re-smelted and sold for scrap. If continuing to develop it/maintain it is costing them money (either in real terms because of development costs, or by lost opportunity costs), than they should look at how that's trending. At what point does the thing cost more than it's worth to them? (Maybe it never does, I've had banking customers who spend millions of dollars a year keeping a thirty year old, p.o.s. Cobol application running because it's the backbone of their operations).

And I didn't mean to imply that they should rewrite parts of it in another language, just that they should start decomplecting pieces of it so that they can replace those pieces with better-designed ones. If they want to stick with Perl, because that's what their expertise is, than I think they should do that. I would agree that it's probably counterproductive to take on both rebuilding the application while at the same time switching to a new language.

But unless the entire application is passing around internal Perl data structures, it seems crazy that they can't identify edges to the application functionality, and start to peel those edges away and encapsulate that functionality in a better way.

</comment></comment></comment><comment><USER8> You can write a million lines of code that do arbitrarily little, particularly if you're following poor development practices. I've seen a million-line codebase that could have been replaced with 10k lines of python. Depending on what functionality they actually need and how much they need the developers, Acme could well be making the right decision.

<comment><USER9> I think this is the key. I have this big honking system that nobody really understands. We need a system to do X. please implement X is way easier than the whole, rewrite a million lines problem.

<comment><USER10> What is also key is understanding that this is almost never the way that happens.

It goes more like this:

We have this big honking system that nobody really understands. We need a system that does X (where X is the list of features we _think_ the other system does that are critical. X is subject to change as we discover other features to add and features that actually weren't necessary.) Please implement X this way.

And that can easily become an exercise in extreme frustration.

</comment></comment></comment><comment> guard-of-terra Whoa I once got a 150kLOC code base in my possession and got it to 37kLOC in maybe two years.

I cut a lot of stupid boilerplate and was willing to cut features nobody needed. I added a lot of new, good features (not so good, too).

It was still not perfect, these days I would be much more fierce at shaking old stuff.

Still, you just delete and fix and delete and fix. That's how you make a turbo plasma rifle out of Singer sewing machine.

<comment><USER11> > was willing to cut features nobody needed

Ah. And then a week later you hear that Janice in the accounting office in New Zealand depended on one of those features. That's when you learn there is a Janice in accounting. And that your company has an office in New Zealand.

<comment> guard-of-terra Well, then you fix it. It's better to try than coding around code of unknown origin, likely defunct.

</comment></comment></comment><comment><USER12> So... what is the solution?

There are times where a legacy technology has limitations that ultimately prevent progress and create maintenance nightmares. A good example is some of the older database technologies where a 1TB database machine could cost 100k (example: Sybase).

You could try to maintain a series of expensive databases, but between replication backups, dev boxes, team of DBAs etc suddenly your costs to keep the old technology are really high. And if these are databases storing expensive financial data, well, maybe the risk of hitting your 1TB limit is an expensive risk to have on your plate.

And it might take 10MM to migrate to a new technology, but in this case it would probably be worth a switch.

When technology is a commodity, and working poorly is still working, then maybe it's hard to justify a switch. But if your old technology starts to limit your performance and introduce risks or problems that detract from your competitive advantage, then you might not have a choice.

</comment><comment><USER13> Minor point, but I don't like the citation of Netscape as a failed rewrite.

It's worth remembering that the Mozilla project ended up being a success in that it dealt the blow that finally dislodged IE from dominance. The original Netscape codebase could not do this because at the time IE4 was already way ahead in terms of CSS support and Netscape was hitting an architectural dead- end. Maybe they could have piled on some more hacks to get NS5 out quicker, but even if it had feature parity to IE5 they had to contend with Microsoft's bundling which was Netscape's real undoing.

</comment><comment><USER14> TL;DR Straw men and fuzzy math.

Lots of absurd assumptions in here. Many of them were acknowledged, but the author seems to think that this `millions of lines of spaghetti code` with `little use of existing libraries` will be rewritten as millions of lines of spaghetti code with little use of existing libraries. The rewrite should decrease the workload to a fraction of what the author used for his fuzzy math.

<comment><USER15> you are not allow to dissect an article and make fuzy math and strawmen claims with TL;DR!!!!!

<comment><USER14> You're right. That was snide and disingenuous. Unfortunately, I've lost my edit link or I'd remove it. Sorry.

</comment></comment></comment><comment><USER16> Changing the language isn't a big deal. You can always go SOA. In fact, even if you stick with the same language and are doing a rewrite, SOA is probably the right answer.

If the original system is THAT bad, the language isn't the problem, it's the architecture, and you should probably refactor it into multiple components which could potentially be multiple different languages.

<comment><USER17> That's my thoughts. Get away from app and more into portal. What still befuddles programmers on large projects is that they still think from the whole front to the whole back and vice versa. MVC hasn't helped this one bit.

<comment><USER18> Is this train of thought meant to be specific to server-side apps? An example of a large rewrite was the classic Netscape browser engine (to Gecko), and I'm having trouble picturing how a browser engine could use a SOA.

<comment><USER17> That's an interesting example because existence of a thick client allows for SOA on everything else. The browser is the last thick application.

</comment></comment></comment></comment><comment><USER19> The scary thing for me in ditching the old code base has been those undocumented corner cases. You generally find them by saying "We don't need that" to some piece of code and later find out it was a bug fix 5 years ago. It always seems worse with stored procedures when moving databases.

If the only spec is the old code base, then you are probably doomed.

<comment><USER5> version control would help with that

<comment><USER19> I haven't worked on a big project without version control, and I don't see it as a substitute for an actual specification. I have also not see complete explanations of patches be explained in detail enough to substitute for a spec.

</comment></comment></comment><comment><USER20> What really surprises me is that I got to the end and no one mentioned what seems obvious to me: if they are doing a rewrite (in any language) of a horrible code base _they_ made, what reason do they have to believe this time will be different? Yes, we can assume some learning, hopefully some improvement, but as the saying goes, you can write FORTRAN in any language. Switching languages won't magically fix things. Training up your dev team and getting them to start refactoring, OTOH, is a much more interesting proposition.

</comment><comment><USER21> "fired the dev team that had been working for one and a half years to develop a complicated project in part because an outsourcing company in India promised they could replicate it in two months" \- when will they learn?

<comment><USER22> More appalling (or hilarious) is the footnote: "Except for an insurance company who decided to switch their accounting software from COBOL to C++. They gave their COBOL devs a two week training course in C++ and told 'em to rewrite the system. I don't need to tell you how that turned out."

</comment></comment><comment><USER23> I can't possibly imagine that the 1000000 lines of code couldn't be replaced piecemeal (in giant blocks). Then again, I've never seen 1000000 lines of code.

</comment><comment><USER24> As some previous commenters have noted, there is a spectrum here between full- bore rewrite and don't-touch-a-thing. Parts of the code could be factored out, modularized, rewritten in another language, and all that without huge impacts on the existing functionality. Joel Spolsky wrote an article a long time ago about the value of software that has already been written and put through its paces (though I don't agree with /never/ rewriting, it should be done only as last resort):

[http://www.joelonsoftware.com/articles/fog0000000069.html](http://www.joelonsoftware.com/articles/fog0000000069.html)

The most important part:

"The idea that new code is better than old is patently absurd. Old code has been used. It has been tested. Lots of bugs have been found, and they've been fixed. "

There's value baked into that old code: lessons learned, bugs fixed, workaround put into place. These things can be lost during a rewrite (and sure, there are other times you don't need them in the new version because the original problem has a better solution/doesn't happen in the new language/whatever), and potentially losing/missing should be considered carefully.

</comment><comment><USER25> This is a pretty terrible analysis. It completely ignores that things might, just MIGHT actually be built correctly this time. Ignores that the developers redoing the code might know the problem domain better. Ignores improvements in the quality of the development teams. Ignores far too much and then advocates staying with a bad solution out of fear that it might not go well.

</comment><comment><USER26> I think this is a good, well reasoned writeup. One thing I'd take exception with is the idea that they have to rewrite a million lines of code.

> Very little use of existing libraries ("not invented here" syndrome)

The senior dev and PM could sit down over a few weeks and do a assessment of other languages that had good library coverage for lots of the existing system without writing a line of code.

I'd bet the project size would shrink considerably.

At an old startup I worked in, we had a legacy codebase of about 600k lines with 15 years of cruft in an ancient dialect of C++ with lots of not invented here syndrome.

By that point the system was so old and fragile that it simply _had_ to be rewritten. The few libraries that we did use and didn't write were no longer supported, modern OSs wouldn't run the software correctly, vendors had simply gone out of business and so on.

A good 70% of the system functionality was rewritten in C# by just a couple guys part-time over the course of a year basically just gluing together existing libraries.

</comment><comment><USER27> Can you name any widely used piece of Software that has not been rewritten at least once?

Rewrites: Firefox, IE, Word, Windows, MacOS, ...

Many of these have been rewritten multiple times and they are all orders of magnitude more complex than some random million-line hunk of perl.

Rewriting is hard and may absolutely or just take a long time, but failure to rewrite is pretty much guaranteed to fail.

</comment><comment><USER28> OK, I'll bite. Why the hell would _anyone_ want to go _back_ to Perl? That is one disgusting mashup of a language.

I'm horrified by it daily when I have to use scripts written by older bioinformaticians. The best benefits I've heard are string processing speed (<3 you Ruby) and package management (hello Python, Ruby, R).

<comment><USER29> Sometimes Perl works really well. For example, just the other day I wrote a tokenizer in Perl after attempting to do the same in other languages, doesn't it look pretty?

      sub tokenize {
        while ($_[0] =~ m!
          (?<whitespace>  [\x20\x09]+                   ) |
          (?<lf>          [\x0a]                        ) |
          (?<cr>          [\x0d]                        ) |
          (?<ident>       [A-Za-z_]+[A-Za-z0-9_]*       ) |
          (?<float>       [0-9]*\.[0-9]+                ) |
          (?<float>       [0-9]+\.[0-9]*                ) |
          (?<int>         [0-9]+                        ) |
          # ...
          (?<unknown>     .                             )
        !gsx) {
          my ($k, $v) = each %+;
          # $k: token, $v: data
          # pos($_[0]): current offset
          # ...
        }
      }

<comment><USER28> nice... it looks _quite_ pretty, but would be much prettier (but very similar) in Ruby :P

</comment></comment></comment><comment><USER30> May need to expand. Saw several posts about shrinking but sometimes the best way to go is expand then start replacing little parts. So A, B, C both feed into magic box that produces X, Y, Z respectively. Well, make two (or more) magic boxes and rather than trying to write a (ABC) -> (XYZ) converter all at once, write a A to X converter, then a B to Y converter... Given wildly different languages, they may no longer belong in the same function anyway...

</comment><comment><USER31> The only way to pull off something like this is to do it slowly, carefully, and in pieces. You aren't going to rewrite a system that large all in one go.

Of course, rewriting something just so you can say it's in a different language is silly anyway. Whoever set that goal is being overly simplistic. They need to step back and re-examine their _actual_ needs and _real_ problems.

<comment><USER32> A special pig like that, you don't eat all at once.

</comment></comment><comment><USER33> PayPal's Node.js experiences are totally different than what the blog is describing. Besides, the "number of lines" calculation is useless, and even though the blog says so, t still runs with it. Besides, a Perl blog post is not a very neutral source on the cost of rewriting Perl to something else.

</comment><comment><USER29> Very misleading post. It's obviously not that expensive to start slowly replacing pieces and have some people work on new features isolated from the main code base.

But I understand Ovid's frustration with so many people successfully switching from Perl to things like Go and being happy about it in their blogs ;)

</comment><comment><USER34> Could this be booking.com?

</comment><comment><USER35> We're still in the dark ages when it comes to software development, and I don't believe it's because we're using Java instead of Haskell.

I believe we need much more powerful tools that help us in understanding large code bases. Tools that can help us visualize what's going on. Tools that can do testing for us. Tools that can rewrite code for us (think Resharper or other Jetbrains refactoring tools), but an order of magnitude better.

<comment><USER13> Why don't you think Haskell will help with this? If Java can't prevent a NullPointerException I don't see how static analysis can take the tooling where you want it to go.

<comment><USER35> It's zero-sum if the tooling around Haskell is antiquated compared to Java's. But the idea that a language is going to make us "that" much more productive has to go. We need much, much better tools.

</comment></comment></comment><comment><USER36> > That's roughly 5.5 person years of effort to rewrite to rewrite the code > base, but that assumes you're working seven days a week, 365 days a year. In > reality US workers typically work roughly 2,000 hours per year, or about 250 > days out of the year. That means it would take eight person years of effort > to replicate the above code base (over ten years for the average hourly > hours here in France).

If he's from France, why not just stick to talking about the French working hours? Or just _one_ of the two countries. Bringing up two countries like that was weird to read, but maybe that's just me.</comment>


Was this Google Executive deeply misinformed or lying in the New York Times? - <AUTHOR> https://www.fast.ai/2019/05/28/google-nyt-mohan/ <comment><USER2> For someone so pissed off about what they perceive as misinformation, there are simple facts here that are just false.

"As background, Mohan first began working in the internet ad industry in 1997 at DoubleClick, which was aquired by Google for $3.1 billion in 2008. Mohan then served as SVP of display and video ads for Google for 7 years, before switching into the role of Chief Product Officer for Google's YouTube."

Err when Google closed DoubleClick, he was " Product Management Director for Ad Serving, reporting to Susan Wojcicki, VP of Product Management." Not a senior exec, not "SVP of display and video ads".

He was promoted to VP in 2009, and SVP in late 2015. I'm too lazy to look up when the other job titles switched.

Seriously, this stuff is just not hard to get right, and if you are going to take someone else to task for misinformation, why are you not doing everything in your power to get it right (especially since this person seems to believe it's so easy).

My best guess is she grabbed this stuff off a linkedin profile or something without bothering to actually try to verify it (which you should, since lots of people only list the job title they left with, not what they had).

I haven't bothered to fact check the rest of the claims, and the article is otherwise interesting, but seriously.

If you are going to try to run someone down, can you at least bother to get the data right?

Is this really the best we can do?

<comment><USER3> Really disappointed in this comment. Based on some nitpicking which isn't even correct [1], you're dismissing the entire article. Google's role in spreading conspiracy and hate is serious stuff, and given you're a googler, fairly prominent on HN, and from my past interactions and opinions of you, I expected much better than this.

[1] Not to get into the semantics of this, but when you say "when Google closed DoubleClick, he was " Product Management Director for Ad Serving, reporting to Susan Wojcicki, VP of Product Management."", that does not contradict text you quoted from the article. So the only claim you have is that the article called him an SVP for time when he was a VP.

<comment><USER2> It's not nitpicking. I spent a little time after I wrote this fact checking more, and i didn't edit to include the other clearly wrong facts in this article as a way of being nice to the author. Also, because i won't have a lot of time to be on HN today, and people take no response as a sign of "no good argument" instead of "not gonna spend all my time on a forum".

There are _plenty_ of issues here to go around here. Go, try to verify facts yourself.

[1] This is wrong. "Mohan then served as SVP of display and video ads for Google for 7 years, " _Then_ , as in, the 7 years after the doubleclick acquisition. That is wrong. He was not a VP, SVP, or in charge of display and video ads. He was in charge of one thing for a while, got promoted, and 7 years later, ended up SVP as both.

This shit matters. You are trying to argue essentially they could have just deleted this paragraph. Which I doubt. They are trying to make the point that this person has been a super senior person who has been doing this role a long time who should know better, and they simply haven't been.

If they want to make a correct and weaker argument, awesome, they are welcome to do that.

You don't get to just gloss over it.

Especially when taking other people to task for not apparently knowing something.

<comment><USER4> I'm going to quote the facts you provided earlier:

When Google closed DoubleClick, he was " Product Management Director for Ad Serving, reporting to Susan Wojcicki, VP of Product Management." She made no claims about what position he had at DoubleClick. She just said "Mohan first began working in the internet ad industry in 1997 at DoubleClick." This is not an error.

Then, you said: "He was promoted to VP in 2009, and SVP in late 2015. I'm too lazy to look up when the other job titles switched." Meaning, that you correctly point out she should have said "Mohan first served as VP, then SVP of display and video ads for Google for 7 years." Instead, she said "Mohan then served as SVP of display and video ads for Google for 7 years"

So, that is 1 minor, incorrect detail in the article that you've identified - an extra "S" onto "VP". What are some of the other "clearly wrong facts" that we should just trust (appeal to authority?) you spotted? If you have no time and are "too lazy," as you say, why choose to spend your time attacking the most minor detail instead of the most egregious and appalling incorrect fact?

Seems to me like you couldn't find much else wrong with the article.

</comment></comment></comment></comment><comment><USER5> Except... Have it been shown that Google _did_ take action to change their algorithms to describe misinformation, at the cost of a stock market hit in January when they showed it decreased watch time?

I can't figure out what the author is complaining about. They obviously are doing _something_ , enough for it to hurt their own bottom line.

<comment><USER6> There's probably a wee bit of presumption in connecting the dots like this, but its an interesting set of dots to consider, and I wouldn't mind any supporting links you have on this, opinion pieces or otherwise.

</comment></comment><comment><USER7> Furthermore, why didn't NYT do more research into whether the executive's statements were actually truthful? They've extensively investigated other tech companies, but I've found their reporting on Google to be lackluster by comparison.

</comment><comment><USER8> Is there some specific factual claim that the author believes was false, or does "lying" just refer to framing the issue differently than she'd prefer?

<comment><USER4> Claim is pretty straightforward. Mohan blames viewers and takes no accountability for any extremism on YouTube, repeatedly failing to acknowledge the role of autoplay. This paragraph summarizes it nicely:

"Even the reporter interviewing Mohan seemed surprised, at one point interrrupting him to clarify, "Sorry, can I just interrupt you there for a second? Just let me be clear: You're saying that there is no rabbit hole effect on YouTube?" (The "rabbit hole effect" is when the recommendation system gradually recommends videos that are more and more extreme). In response, Mohan blamed users and still failed to give a straightforward answer."

<comment><USER9> I'm not sure how it is not a problem of the users. The up next recommendation is a product of your past behaviour and aggregate behaviour from other users. If you keep on watching 'wrong think' content then yt is going to keep serving it to you. They basically want yt to censor wrong think from their platform even if this content is engaging with their userbase.

<comment><USER10> The claim is that conspiracy content is more sticky than other content, and since the algorithm is optimized for stickiness, it's naturally inclined to skew in that direction.

In other words, starting from any random keyword... the algorithm is naturally inclined to skew towards conspiracy videos in its recommendations.

At least that's what the article (and the sources it cites) are alleging.

</comment></comment></comment></comment><comment><USER11> I love how quick we are to blame the problem on an algorithm or poor moderation when it is clearly a systemic issue, where by, the demand for such content is driving its popularity which in turn increases the likelihood of suggestion. As a society it's as though we look at youtube through a chicken and egg style of viewing. Did YouTube radicalize society or was society always radicalized but less visible? Either way there clearly has to be some action beyond hiding the problem which can actually address the underlying issue.

</comment><comment><USER12> The way Youtube suggests videos has been borked in favor of sensationalism and popularity for a while now. It used to be if you were watching "Cooking Steak Part 2" the first suggested video was "Cooking Steak part 3" and the second suggested video was "Cooking Steak Part 1" and the third suggestion was "Cooking Chicken Part 1". Now it's a dead guarantee that not only will the suggested videos not be the next one in the sequence, it won't have anything to do with what I'm currently watching. It's utterly worthless.

<comment><USER13> Good to know I'm not the only person that has to leave youtube and go to duckduckgo to find the next video of a clearly marked series _on youtube._

Or failing that, go to the user page, try to stop the autoplay on time, go to the uploads page, and scroll around until I see it.

I will never cease to wonder what all of the talented programmers at google are actually doing all day.

<comment><USER14> Working on ways to copyright strike everything.

</comment></comment></comment><comment><USER13> Gamers with a taste for multi-hour reactionary rants over still images leave them playing while they game with the sound off. If you're trying to maximize time spent watching, the current situation is an inevitability.

</comment><comment><USER15> I just found this recommended video on my YouTube app homepage: [https://youtu.be/WpMRV0r08CI](https://youtu.be/WpMRV0r08CI)

Uploading channel has 2667 subscribers (I'm not one of them), has only ever uploaded 5 videos, starting about a month ago. All videos are of the same topic. 4 of the videos have views in the low thousands. The recommended one has 2 million.

Content wise, the video is 2:27 long, unedited fixed cam footage. It is true to the title and delivers on its promise.

I have nothing further to add.

</comment><comment><USER16> does the author just have a problem with "autoplay" vs the user clicking on the videos?

i had to read over halfway just to find out what the google exec said. here is the quote of contention, i think

""I'm not saying that a user couldn't click on one of those videos that are quote-unquote more extreme, consume that and then get another set of recommendations and sort of keep moving in one path or the other. All I'm saying is that it's not inevitable.""

</comment><comment><USER17> > More recently, YouTube has been aggressively promoting content from Russia > Today (RT), a Russian state-owned propaganda outlet.

The author is a moron.

<comment><USER18> Please don't post unsubstantive comments or personal attacks here, regardless of how uninformed anyone else is.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment><comment><USER19> > YouTube is using machine learning to pump pollution into society. From my > TEDx talk.

Ok, but I can't take TED-related content seriously either. At least YT has some redeeming content.

</comment><comment><USER20> I find it funny how worried the author is about YouTube is promoting "distrust of mainstream media". Not excusing all the crap YouTube will put in one's sidebar, but when we have mainstream outlets like Politico posting egregious and inexcusably racist hitpieces like this ([https://www.politico.com/magazine/story/2019/05/24/bernie- sa...](https://www.politico.com/magazine/story/2019/05/24/bernie-sanders- millionaires-226982), also that title was changed from "Bernie Sanders might still be cheap, but he's not poor" \-- I'd have never found out if it weren't for YouTube recommending me the fabulous Jimmy Dore Show who pointed this out), I don't know how you can continue to visit _any_ website deemed mainstream anymore.</comment>


Show HN: Elem-mint, a lightweight library for creating DOM elements - <AUTHOR> https://www.npmjs.com/package/elem-mint <comment><USER2> This is useful, but it will be way too difficult for someone needing this kind of library (i.e., anyone not using a framework or jQuery) to find it and use it.</comment>


Full-time Startup: Skribit Week 12 (Scaling) - <AUTHOR> http://paulstamatiou.com/2009/04/01/full-time-startup-skribit-week-12-scaling <comment><USER2> dear twampss, i don't know what you're doing but I clicked publish on my blog 15 seconds ago and this was already posted here... it's kind of annoying. this has been the case for every single blog post of mine in recent past. sounds like you're using some RSS auto-posting script..

<comment><USER3> What's more interesting is that there is really no benefit of doing so other than karma-whoring.. I wonder what his agenda is if he's using an auto-posting script.

On the flip side, I got to read your article and commented on it!</comment></comment>


Gmail exposes personal email addresses. - <AUTHOR>

Earlier this month I posted on the Who's Hiring thread on HN and today I was setting up a phone interview with a candidate for next Monday. During the process I have used my work email address exclusively which is hosted on our own internal Exchange server.
As a courtesy, I sent a meeting invite to the parties here at my company, as well as to the applicant, whom is using a Gmail account. The problem is that when the applicant responded to the meeting invite (initiated from my work email) it sent the response to my personal Gmail account, marking that account as the meeting organizer.
I confirmed with the applicant that he sees my personal Gmail account as well and this concerns me. I have no expectations of Google not knowing who I am and linking those accounts together on their side - it does bother me that they would simply switch the email address out for my personal one. In this case I don't really care if the applicant has my personal email address, but at the same time, what if I did?
TL;DR Google exposes personal Gmail addresses when meeting invites are sent from Outlook on accounts it knows are linked together.
(Edit: Changed title to be less tongue in cheek and more to the point) <comment><USER2> (I don't think this is the exact problem you have, but a related 'exposing other email addresses' issue with gmail)

There is a long-standing gmail bug that Google refuses to act on: [http://www.google.com/support/forum/p/gmail/thread?tid=2cb03...](http://www.google.com/support/forum/p/gmail/thread?tid=2cb03772f39c2d61)

Basically, you've always been able to import and send via other email addresses from your gmail account. Either another gmail account or firstname.lastname@example.com

A while ago they added settings to send through your own SMTP servers when using an @example.com custom email through gmail. This removes all traces of your gmail account from the email header.

But for some reason they inexplicably _don't_ allow this option for imported gmail accounts! So even though they control all the gmail mail servers, you're still forced to send "on behalf of" your main gmail account.

This is a really annoying exposure of your main email address. No longer can you have a main/professional personal account, and then an anonymous linked email to use otherwise. Every time you use the anonymous account it lists your main account as well in the mail header.

To make matters worse, Outlook often replies to and highlights the "on behalf of" account rather than the account you sent with. Major annoyance when dealing with companies using Outlook. The root issue is gmail's fault though.

</comment><comment><USER3> I had one experience where I was sending a new project (YouTubeAdBlock.com) to EVERYONE in my contact list.

Somehow, gmail had found my instructors personal email, added it to my contact list. For some reason my instructor was really mad about me sending him it...

</comment><comment><USER4> Can you replicate it, or provide steps so others can try?

<comment><AUTHOR> Easily - we replicated it here a few times now with some of my co-workers email accounts.

I simply use Outlook to schedule a meeting. I add an invite to anyone using a gmail.com account. That request goes to the intended recipient and they see my personal gmail account as well as my Outlook based account.

Couple of notes:

1) Outlook does not know anything about my Gmail account. It's not added in there etc.

2) Google DOES know about my work account. It's under my personal settings on my Google profile, because I use it for various Google Group mailing lists.

Even if Google knows that the two accounts are the same person, it's a major privacy issue IMHO to expose any of the linked accounts like that. I have submitted this to Google with all the information I am aware of.

(Edit for formatting)

<comment><USER4> Thanks for the detail. I completely agree, exposing linked accounts is a serious privacy issue (assuming you didn't click a box that says "we will link your accounts whenever you invite someone to a meeting" ;-) ).

</comment></comment></comment><comment><USER5> when did email addresses become like social security numbers? so someone finds out your email? block them, problem solved. yes they can find your FB account, but that shouldn't be public anyway...

<comment><AUTHOR> I don't care if anyone has my email address, Facebook or Twitter. It's one of the reasons I use my full name to post on HN - I personally want to be found. The problem is that not everyone is of that mentality, and that while this might seem like a minor info leak, it can still be damaging.

I wouldn't want one of our producers, assistants, whatevers to schedule a meeting with an important client, only for it to reveal some AOL style username contain at least the numbers 69 and some reference to a body part. I also wouldn't want some of our more intense clients to have one of their personal email addresses and either email them there, or look up any of their Facebooks etc.

The bottom line is that it is an information leak that according to their privacy policy is guarded against.

</comment></comment><comment><USER6> Yeah, I've noticed this too and it sucks.</comment>


Why We're Sharing 3M Russian Troll Tweets - <AUTHOR> https://fivethirtyeight.com/features/why-were-sharing-3-million-russian-troll-tweets/amp/ <comment><USER2> Here's the Clemson paper the article references:

[http://pwarren.people.clemson.edu/Linvill_Warren_TrollFactor...](http://pwarren.people.clemson.edu/Linvill_Warren_TrollFactory.pdf)

Pay attention to this line from the abstract:

> We identified five handle categories: right troll, left troll, news feed, > hashtag gamer, and fearmonger

Now try something interesting for yourself: get on Twitter, then look for any legitimate political news article from a mainstream publication or politician, and look at the responses. Look how quickly you will find what matches those "handle categories" identified in that paper. Look for the absurd statements. Look for the ready-made memes. Look for the ridiculous and incendiary hashtags. Look at the accounts engaging in it all, many of which mold to a generic formula and post 24/7/365 as if its automated or a full time job. Sometimes you can even do a reverse image search on the profiles to find they're stock photos or were pulled from some random biography page on the web and never matching up to the name used in the profile.

It makes you wonder just how much social media activity is an organized campaign of nonsense or agitprop.</comment>


What Truths Can You Divine from Instagram Paintings? - <AUTHOR> https://www.thenation.com/article/culture/painting-instagram-essay/ <comment><USER2> You can certainly get a view into the mind of the artists. A saying I learned 30 years ago when I first got into photography is "the lens looks both ways" meaning the viewer sees into the mind of the photographer, what they find interesting, as much as the photographer is looking out onto the world. As painting and photography are both forms of visual art an apt adaptation could be "the canvas looks both ways." Aside from that, truth in art is always highly subjective.

</comment><comment><USER3> A working sculptor once told me he appreciated my pieces because they needed to be experienced in the round. He would have liked to be able to compose in that style, but as his potential purchasers all worked off photographs, it meant that while he sculpted in 3D, his work had a preferred viewing direction, from which it was composed as in high relief.</comment>


Ask HN: Why can't I "favorite" a recent post? - <AUTHOR> The "favorite" link is misbehaving.
Expected: Navigate to "favorites" page, with the just-favorited post pushed to the top.
Actual: Navigate to "favorites" page, with no change to the (previously-favorited) list.
Thinking I might have hit some limit, I deleted one of my 403 favorites, to no avail.
Is it just me?
Or maybe a transient HN issue that's failing silently?
Ironically, the post I was trying to favorite is about Polar, a personal knowledge-base tool -- which is likely a better way to save interesting things than relying on HN favorites in the 1st place! Hmm, could be an interesting feature to integrate into Polar.... <comment><USER2> Could you please try again from a fresh page? A likely possibility is that you had a page with stale auth parameters after an application server restart. You can reach us at firstname.lastname@example.com to troubleshoot further.

<comment><AUTHOR> Thanks; the issue went away after a few hours.

</comment></comment><comment><USER3> Well, I for one have somewhat over 500 favorite posts and I can still see the "favorite" flag under your post, so maybe try contacting the admins.

</comment><comment><USER4> Almost reads like viral marketing for a personal-knowledge-base tool.</comment>


Bad Designs: Stuck between two doors - <AUTHOR> http://www.baddesigns.com/doors.html

<comment><USER2> What really amazes me is how hard it is to explain to people that this is poor design. The users getting trapped aren't the ones being stupid, it is the designer.</comment>


Uber to offer UK drivers sickness cover in return for £2-a-week fee - <AUTHOR> https://www.theguardian.com/technology/2017/apr/27/uber-to-offer-uk-drivers-sickness-cover-in-return-for-2-a-week-fee <comment><AUTHOR> As someone who works in traditional employment, the idea of paying a weekly £2 premium for the privilege of time off when sick, grieving, etc feels weird and almost wrong to me. Although, the concept is intriguing, especially when viewed from a traditional business's perspective; I wonder how much it would reduce feigned sick leave?</comment>


Silicon Valley and Spy Agency Bound by Strengthening Web - <AUTHOR> http://www.nytimes.com/2013/06/20/technology/silicon-valley-and-spy-agency-bound-by-strengthening-web.html?ref=technology&_r=0&pagewanted=all <comment><USER2> > The only difference is that the N.S.A. does it for intelligence, and Silicon > Valley does it to make money.

A government agency can use force against you. Facebook can block you from posting pictures of your lunch. Big difference.</comment>


Gord Downie, Tragically Hip Canadian Rock Legend Dies 53 - <AUTHOR> https://www.nytimes.com/2017/10/18/arts/music/gord-downie-tragically-hip-dead-final-album.html <comment><USER2> The inside baseball Canadian comedy television series 'Made in Canada' used a Tragically hip song [1] as the intro. [2] The series made fun of 'The Industry' which was how PBS carried the series for American audiences.

It is a shame this is not available other than a dvd for season one.

[1] [https://en.wikipedia.org/wiki/Blow_at_High_Dough](https://en.wikipedia.org/wiki/Blow_at_High_Dough) [2] [https://youtu.be/tmVu1auFWd0](https://youtu.be/tmVu1auFWd0)</comment>


Ask HN: Do people need direct file sharing or they go cloud? - <AUTHOR>

I've started file sharing service (Web and Android for now) where all the files go directly to the addressee (no server storage):
http://fppr.co
What do you think? Do the people need that kinde of service or they will prefare use clouds to share files? <comment><USER2> I have a similar project that attacks this problem from a different angle: <http://deployanything.com>

I find direct transfer really convenient and preferable to dropbox for certain things (like large files that you only need to send once and to one person). I could see something like you're doing being helped by being built into a chrome plug-in or something so people can automatically receive. The angle of my project is being in the background and automatic, but giving the receivers full control over what types of things they want to accept.

<comment><AUTHOR> Yes, it easily can be chrome plugin, or Java app. It is designed to be accessible from any modern device or browser, and I hope it is only question of time.

</comment></comment><comment><USER3> * I'm not sure what you mean when you say "no server storage". It seems like it temporarily does have to be stored on your server to facilitate transfer. Please correct me if I'm mistaken or update your site to explain how your site works.

* People that care about privacy are probably a target market for you if your service is able to deliver.

* The name of your site is "fppr". Pronounced quickly, that sounds like "Fapper". Please tell me that this is intentional because that's amusing.

<comment><USER4> My best guess is that it uses WebRTC for P2P transfer. It may also use WebSockets to connect to a private room (which only one source-client and one destination-client may join) and streams it.

EDIT: It would appear that it is the latter, in that it uses Socket.IO to stream it to the server and down to the recipient. The server could copy it as it is streamed, and I didn't really delve into the source of the webpage to know if it has any encryption or anything.

<comment><AUTHOR> Yes, it is Socket.IO. And there is no encryption yet, just some tricks to prevent multiple download.</comment></comment></comment>


Top publishers sue Audible for copyright infringement - <AUTHOR> https://apnews.com/e2078e81c5ca42a9bcde6aeea678b129 <comment><USER2> Once again big media companies are just making up new rights for themselves. The idea that the properly licensed spoken word version of a published work does not intrinsically include the text is laughable. What's next? Kindle books are infringing on copyright because they reformat the text of the book into a version that fits the user's screen size and preferred font? I mean why not?

And I suppose YouTube is infringing on copyrighted videos when it adds machine-translated CCs, right?

Modern copyright is indistinguishable from rent-seeking.

</comment><comment><USER3> I don't understand why publishers are against Audible Captions. That feature makes audiobooks less pirate-able, and it also won't lead to more pirating of ebooks, since it's better to share a cracked ePub rather than ill-formatted captions. The only revenue loss I can see is from customers who would otherwise buy both the Kindle and the Audible version, but that must be a small fraction.

<comment><USER4> My guess is that they just want to be paid more for them.

(i.e. They sold the rights to sell the audiobook alone; if audible wants to also include a text version of the book, they want more money).

<comment><USER5> At the expense of accessibility.

<comment><USER6> Audiobooks accessible to the deaf and hard of hearing.

</comment></comment></comment></comment><comment><USER7> Well, technically it's a derivative work, they have every right to sue.

<comment><USER8> If the translation is performed on device then Audible would not be liable, considering non-infringing use (see: VCR).</comment></comment>


Why can't a gecko sell me health insurance? - <AUTHOR> http://capitalismprosperityspirit.blogspot.com/2014/06/why-cant-gecko-sell-me-health-insurance.html

<comment><USER2> Spot on, but I disagree with one point: "We would absolutely have to abolish most mandatory coverage."

This will lead to the same situation as now: one unforeseen accident (or discovering your true sexual identity later in life!) and you're financially fucked.</comment>


Rescue Forensics (YC W15) Helps Law Enforcement Find Victims of Sex Trafficking - <AUTHOR> http://techcrunch.com/2015/02/20/software-eats-sex-trafficking-ycs-rescue-forensics-aids-law-enforcement-in-finding-victims/ <comment><USER2> What so few people realize about the NSA spying debates is that the issues will extend into everything.

This private company is building a mass surveillance database to track people. They're scraping and archiving what used to be considered anonymous postings. Their current goal is to go after sex trafficking, but they could easily expand into spying on people for any reason.

They're not the government, so I think they have a strong right to do this, but don't let cause of "the children" confuse the issue. This is a new kind of spying, unlike anything that has existed in the history of American society.

Just imagine how much crime we could stop if local police had full access email, phone, and social networking data. There's no question that we could save thousands of children per year. You would have to be a monster or a terrorist not to consent to having your data searched.

<comment><AUTHOR> I think we can distinguish ourselves from spies because we only collect open source intelligence - meaning publicly available records. Technology is like a knife. It can be used to create or destroy, can be used by a surgeon for good or for a killer for evil. The same is true for big data technologies. They can be used for mass surveillance and violation of civil liberties or for recovery of trafficked children. We're not violating anyone's civil liberties or right to privacy.

<comment><USER3> Let's look through some of the things you claim, shall we?

 _Images can be cross referenced against other ads to detect hidden relationships._

 _Evidence artifacts can be collected and introduced during criminal proceedings._

 _Rescue Forensics collects millions of records for anti-trafficking investigations and prosecution._

 _Search by phone number, text, or images, and filter by location, age, and date ranges._

 _Hidden phone numbers are unmasked so human traffickers can't hide their victims online._

 _Intelligence from across the world can be searched in one central location._

 _Images can be cross-referenced against the rest of the web to find profiles and social media accounts._

 _Our intuitive interface allows you to target the intelligence you need on all your devices._

Yeah. So, you're straight-up building a massive blackmail ledger, without a stated business model other than "We're helping the police save the children!".

One of my favorites, also from your front page:

 _STOP SENDING SUBPOENAS

Our database contains millions of records of classified advertisements representing up to two years of historical data. Stop waiting days or weeks to get a subpoena response from a hosting site that may only offer a few months of records. Find all the targeted intelligence you need right now._

Yeah, man, that whole due-process thing is a pain in the ass, isn't it? Better to do the work for the .gov instead of making them follow their own laws.

~

I don't think it is a surprise to anyone who's been watching the trends lately with regards to law enforcement in the US and the trends with data mining that you are not receiving an unconditional pat on the back.

Frankly, companies like yours are part of the problem--even if you do offer help in the small picture.

EDIT:

Bahahahahahaha, I love this one:

 _The user-generated information archived by Rescue Forensics is completely unmodified and retrieval of this information is an automated process. We only redact copyrighted material, such as company logos or other intellectual property._

Yes, so, you've got protection for companies, but nothing against, say, a deliberate smear campaign. Your platform looks like it doesn't do anything to prevent, say, a bunch of jerks deliberately scattering fake evidence, and you'll hoover it up all the same, I'm betting?

<comment><USER4> >We only redact copyrighted material, such as company logos or other intellectual property.

>Yes, so, you've got protection for companies

No, this protection is in the other direction - of their own lower back _from_ the companies. They don't care about smaller fish which can't bite.

Anyway, all this bro-hah-hah piled upon them is pointless. They are just one of many Palantir wannabes. There is no way they or others can be stopped. You can't stop the wave. A new kind of society is upon us where everybody would be able to know everything about everybody and thus information assymmetry power (be it of corporations, governments or whomever) will be no more.

<comment><USER5> That seems like an enormous leap, from corporations knowing everything about everyone, to all people knowing everything about everyone.

<comment><USER4> that is what was done by open source movement in software, and i hope the same "open information" thing will happen too.

</comment></comment></comment></comment></comment></comment><comment><USER6> I love the idealism, I really do, but I have to wonder under what criteria this company was accepted into YC? Certainly there's money in law enforcement tools, but there isn't much incentive for LE to pursue trafficked or underage sex workers, nor are they hard to find.

The most common reason I've seen for my friends to be trapped in agencies or abusive pimps has been immigration status, by far. And nobody is doing them any favours by taking them in. LE hates the paperwork so much that a decent way to get out of a pickup is to feign being an illegal alien.

Underage workers are similarly avoided. If you're 16-17 with no fixed address, it's going to be a nightmare of social services for everyone involved before you're spat back out onto the street. (I was arrested twice when underage. Both times they let me go when they saw I was 17 and a ward of the state.)

I don't doubt that there's revenue here though, because LE just loves to do stings. Mostly they're single moms or otherwise trapped by circumstance and trying to make ends meet with a side gig. They're the ones who go quietly, who plead out, who pump arrest records, etc.

Sex trafficking is an immigration/social services problem __far __more than it is a law enforcement concern. Giving LE more tools to track us is going to make things worse.

I supported myself with sex work when I was a self-sufficient and independent from 15-19. Now I'm a software developer in my late 20's, but that's still my community. I realy wonder if these founders ever actually asked any of us what we thought about this idea before charging ahead?

Note: Throwaway acct. (And I mean throwaway. I'm in an incognito window I'm about to close, with a /dev/random -generated password, and won't be watching for replies. Please leave me alone.)

<comment><AUTHOR> There actually is a good deal of money in law enforcement for this kind of tool. Anti-trafficking efforts are becoming more and more of a priority at the federal, state, and local levels. There is also a lot of demand for this solution as demonstrated by our user base.

Federal grants are increasingly common, local and state multi-disicplinary task forces are being established more and more frequently, and they need solutions for dealing with these kind of problems.

Sex trafficking is rarely an immigration problem. According to the DOJ, 83% of their cases deal with victims of sex trafficking who are U.S. citizens and trafficked by U.S. citizens. The remaining 17% are foreign nationals. This is a homegrown problem, generally.

<comment><USER7> Do those sex trafficking numbers include consensual adults? What % of cases are on actual trafficking? (Honest question, no snide intended.)

<comment><AUTHOR> No, these cases only include instances where an adult is involved who is forced, defrauded, or coerced into the commercial sex trade, or a child is involved in a commercial sex act. It does not include prostitution prosecutions.

<comment><USER7> OK, my apologies.

</comment></comment></comment></comment></comment><comment><USER8> "The company itself doesn't make any judgments about what might constitute illegal trafficking behavior. That's up to investigators to determine, as there are adult women who want to do sex work and aren't being trafficked."

I'm glad to see this at least get mentioned; there are people in bad situations who need help, but too often well-meaning people are unfortunately reluctant to listen to the people they think they're trying to help.

<comment><USER9> Yeah, I went and read their FAQ, and I'm struggling to see how this tool isn't equally useful to target sex workers.

I'm perfectly willing (in my ignorance) to believe that sex trafficking is a problem worth tackling (in scale, in urgency, etc). But I also (already) believe that anti-sex-work laws act to oppress and victimize already- marginalized women, with dubious benefit (without taking a side on whether this effect is deliberate).

For example, in my jurisdiction (IANAL), although I understand that prostitution itself is not illegal as such, the following things are illegal:

        * posting/negotiating prices openly
        * operating a place of business for prostitution (a "bawdy house")
        * living "off the avails"

This last law is supposed to allow the prosecution of pimps (yay!), but it also means that sex workers cannot hire bodyguards or accountants. The second law is presumably supposed to keep "decent" neighbourhoods "decent", but it also results in more streetwalkers, and more liaisons in minimum-price hotels, and so lowers safety.

It seems sort of obvious that the right direction is to have better laws, and then enforce them. I'm not holding my breath.

And, to return to TFA, in the mean time, what stops LEAs from using Rescue Forensics to pad their docket by harassing already-oppressed sex workers who are not victims of trafficking, merely victims of being poor and desperate.

PS: I salute and hugely respect people tackling social justice problems, and I want to emphasize that I'm not _condemning_ Rescue Forensics, I'm expressing a _concern_.

<comment><AUTHOR> Hey, thanks for the concern. We take this very seriously. We also didn't build this in an echo chamber. I've worked for five years in this space and am very familiar with concerns about sex workers, poverty, desparation, and exploitation.

I can say with confidence that law enforcement, particularly human trafficking investigators, are also sensitive to these distinctions, generally. This used to not be the case, but a lot is changing and very quickly.

An example: An investigator I spoke to the other day said they used to be called a "VICE" unit, but they changed their name to the "counter-exploitation unit". This is similar to many agencies across the US and Canada.

We reserve the right to revoke a user's license if they are using our platform to harass persons, but so far this has not been a problem. In fact, just the opposite.

<comment><USER7> Probably changed their name because "vice" obviously sounds like enforcing a questionable moral code (while having fun), whereas "counter-exploitation unit" sounds more important and serious.

Underage sex work and human trafficking was already illegal in Canada, but they recently shut a lot legitimate sex workers down.

How are you actually auditing LE to make sure they're only targeting trafficking/minors or other real offenses?

Edit: To be clear, how do we know this isn't a sham like drug laws? No drug user I've ever known, even the ones that OD'd and died, ever benefitted at all from drug laws. Quite the opposite in fact. So forgive us for being skeptical about another morality law enforcement system that might have a similar damage ratio.

Even the first question that comes to me: Is the sex market so bad that buyers are interested in coerced workers? Sure, some people might be into underaged (regardless of the cutoff), and I suppose some people might be into abusive stuff they couldn't buy from willing participants. But does that make up the majority even? Or is it really just a lot of bored, or ugly, or busy, or curious, etc. etc. buyers?

More pointedly, where are your morals? Are you pushing for better laws, despite that they might hurt business?

<comment><USER10> >Are you pushing for better laws, despite that they might hurt business?

Come on now, they founded a for-profit startup and are raising money from the VCs. The conflict of interest is obnoxiously obvious.

</comment></comment></comment></comment></comment><comment> xkcd-sucks A hooker-tracking database, which will be used to Save Exploited Children-- just like the NSA's products are used to to catch Bad Foreigners.

</comment><comment><USER7> The more I thought about this, the more bothering it potentially seems. Their Twitter feed chats with a religious group, which may appear biased. Does the company press for reform laws?

How would such a company be treated if it was looking for drug buyers and sellers? Especially if such a company didn't encourage legalization but appeared to stand with Christian groups? What steps are they taking to ensure innocent people are _not_ being prosecuted with their tools? Going by current laws is no moral compass.

Finally, if they or the anti trafficking groups want to be taken seriously, provide real stats. This is from their Twitter account:

"39,000 escort ads were posted on the #Louisiana Backpage since July. How many are sex trafficking victims?"

Well, I don't know, why don't you tell us? They've got big data and LE, but they post leading questions like that with apparently no followup.

It's like saying X number of people OD on heroin. For any X we should figure out A: if current legislation is helping or hurting that number, B: is infringing on the rights and potentially destroying people's lives worth the cost? I'm sure it feels great to save 100 people from OD'ing. Does that mean it's OK to imprison millions?

I know this probably comes off making me look terrible. And I don't know anything except this article and reading the company's Twitter account. But it feels slightly off, as if I'm being convinced of a problem without seeing all the numbers. Where're the calls for legalization and regulation? Maybe I'm just too cynical.

</comment><comment><USER7> Didn't Craigslist throw a wrench in things by totally closing off "adult" ads, to which LE had backdoor access?

And isn't the illegality in the states (like the "seizure" of RedBook) just causing all sex work to go more underground?

<comment><USER11> The biggest player is BackPage now. lots of shady stuff goes on there.

<comment><USER7> How much of it is shady due to unreasonable laws? Does LE have a backdoor to view Backpage information? Does Backpage refuse to respond to subpoenas?

Are sex buyers just gonna say "darn, I googled but didn't find anyone, oh well"? Especially the ones that are looking to find underaged workers?

</comment></comment></comment><comment><USER12> I don't mind the "software eats things" meme, but I think they probably should have rethought this title........ (shrug)

</comment><comment><USER13> I logged in just to say that you don't have to feel so disconnected from the startups in SF. Although I don't go to many parties, if I met you at one, I would consider it my good fortune and anything but a buzzkill. Most of my friends probably share that opinion.

Are you guys a nonprofit or a company? I am not a big angel investor (I have made one investment so far), but this sounds like something I would like to invest in / donate to.

My email is aj at ridelabs dot com if you're interested.

<comment><AUTHOR> Hey, when I made that comment I was being playful. She made it sound way more serious than I made it. It is tough to talk about sex trafficking at a party though!

<comment><USER13> Alright! Hope to see you at alumni demo day. I think your company will be better off if you stay in the bay area instead of returning to Tennessee. I am from Atlanta, started my company there, and miss it a lot, so I do identify with your feelings.

</comment></comment></comment><comment><USER14> Gosh, there is no reason to be embarrassed about your mission. Your mission is more inspiring than any other I've seen in the startup world. While all the other 'cool' startups are doing things like "enabling people to watch other people play video games all day", you guys are literally saving and changing lives. And if it works you'll be doing it at scale. It's inspiring, it matters, and you should be damn proud.

<comment><AUTHOR> Hah Im not embarassed at all, I just am sensitive to bringing up such a dark topic at social settings. Im happy to talk to anyone about our work anytime. The comment I made was being playful - came out a bit more serious in the article. Thanks so much for the encouragement.

</comment></comment><comment><USER15> Web sites can put a robots.txt that prohibits crawlers. Are violations of the robots.txt a violation of the computer fraud and abuse act, which would knowing operating a bit in violatoin a felony?

The content and images posted could also be copyrighted or such that they are only for viewing in a browser and any other purpose would be a copyright violation or at a minimum a violation of the terms and conditions of using the site.

Companies don't like their content being made available elsewhere, and would probably fight vigorously.

How much bandwidth would polling and copying the site take? Wouldn't the companies notice it? Wouldn't they stop it?

Wouldn't most of these sites would want to work with the police to ensure that there were no underage people offering sex for money or anybody of any age being forced to work? Wouldn't most of these sites have an alert link for each posting? People can probably ignore consensual adults making an illegal business transaction, but probably not underage or forced prostitution.

If the software can recognize under age workers or people being forced to work, wouldn't the sites welcome the software alerting them of such listing? Would they be willing to pay for it?

</comment><comment><USER16> Related feature on Memex, a military-originated tool that does broad=spectrum searches, metadata integration and so on. [http://www.wsj.com/articles/sleuthing-search-engine-even- bet...](http://www.wsj.com/articles/sleuthing-search-engine-even-better-than- google-1423703464)

</comment><comment><USER17> I am not sure TechCrunch understands what "eats" means in the context of "software eats _____."

</comment><comment><USER10> I wonder, what is going to happen when there is a 10x/100x revenue opportunity in providing LE in US and other countries with data on other criminals, including sex workers? Illegal aliens, drug users, vandalism? Will they become fair game for Rescue Forensics? It is a for-profit company after all.

</comment><comment><USER18> The sad part is how "everyone's buzz gets killed" when he mentions the true mission of his company. Here he is, making an attempt at solving a real problem in the real world but he has to feel ashamed because somehow it's less sexy than web intelligence.

</comment><comment><USER19> >The company itself doesn't make any judgments about what might constitute illegal trafficking behavior. That's up to investigators to determine, as there are adult women who want to do sex work and aren't being trafficked.

Pretty weaselly.

</comment><comment><USER20> How's this different from what palantir is doing?

</comment><comment><USER21> Big fan. Email me if you're interested in connecting with the folks at Thorn - they do a lot of work with DHS on child sex trafficking.

</comment><comment><USER22> This is inspiring. I hope to one day do work that matters in this kind of way.

<comment><USER23> There are lots of ways to do work that "matters." For example, I work for a 50 year old company that makes medical devices. Those devices save lives. I'm only a small cog, but I'm working on something that, if it didn't exist, would probably mean some number of people would die or suffer. I'm very grateful to be working on something like that, and it's not a sexy new startup, it's a smallish BigCo.

Look around, find something that interests or matters to you, and consciously move in that direction. Start now.

</comment></comment><comment><USER24> Any startup based on scraping Craigslist will probably get shutdown.

</comment><comment><USER25> Why is YC funding this?

</comment><comment><USER17> SaaS for Pimps?

</comment><comment><USER26> That's awesome. I have a friend who's really passionate about this stuff and has some development experience in the area--are you guys hiring?</comment>


Is Telegram Secure? - <AUTHOR> http://security.stackexchange.com/questions/49782/is-telegram-securehttp://security.stackexchange.com/questions/49782/is-telegram-secure

<comment><USER2> I assume this link should be:

[http://security.stackexchange.com/questions/49782/is- telegra...](http://security.stackexchange.com/questions/49782/is-telegram- secure)</comment>


Chinese hacking attempt/Secure your Servers - <AUTHOR>

I just have reinstalled Debian 7 on my VPS. Logged in for the first time with "root" and on port 22..then I didn't locked down anything and within an hour I can see the below root password breaking attempt in /var/log/auth.log file .. WHOIS shows its an Chinese IP. God knows when these people will get rid of Script kiddies. Now I have locked down my VPS... does anybody else have similar story and what best steps you took to Secure your Servers .??<p>Jan 24 02:28:30 Sputnik sshd[1566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.108.40.206  user=root Jan 24 02:28:32 Sputnik sshd[1566]: Failed password for root from 126.96.36.199 port 1616 ssh2 Jan 24 02:28:35 Sputnik sshd[1566]: Failed password for root from 188.8.131.52 port 1616 ssh2 Jan 24 02:28:37 Sputnik sshd[1566]: Failed password for root from 220.127.116.11 port 1616 ssh2 Jan 24 02:28:39 Sputnik sshd[1566]: Failed password for root from 22.214.171.124 port 1616 ssh2 Jan 24 02:28:41 Sputnik sshd[1566]: Failed password for root from 126.96.36.199 port 1616 ssh2 Jan 24 02:28:43 Sputnik sshd[1566]: Failed password for root from 126.96.36.199 port 1616 ssh2 Jan 24 02:28:43 Sputnik sshd[1566]: Disconnecting: Too many authentication failures for root [preauth] Jan 24 02:28:43 Sputnik sshd[1566]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.108.40.206  user=root Jan 24 02:28:43 Sputnik sshd[1566]: PAM service(sshd) ignoring max retries; 6 > 3 <comment><USER2> Hackers will attempt brute force attacks on unprotected SSH servers. News at 11.

<comment><USER3> What exactly does "unprotected" mean in this context? I mean ssh means secure shell, so shouldn't the ssh be secure from the start? Or, a better question, what would you need to do to secure your server and why aren't these steps "on" by default?

I mean, even any new WiFi router you set up comes with WPA enabled by default. Wasn't always this way. I still remember setting up routers where the password protection was an afterthought.

But ssh isn't really _that_ new is it? Should these security measures be default at least by now?

<comment><AUTHOR> Few basic things which can be done is like .. install Fail2ban , change the default SSH port to something else, and use PermitRootlogin as No in sshd_config file</comment></comment></comment>