Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack - <AUTHOR> https://github.com/JoshData/mailinabox <comment><USER5> It remains a constant frustration to me that Postfix, Exim, Cyrus, Dovecot and the like still feel as if they belong very much in the "here be dragons" territories of the Unix world. Configuring these systems is an exercise in constant frustration and bafflement.

They're such a pain to use that since becoming the sysadmin in charge of our work email servers, I gave up running personal ones as well and just pay FastMail to deal with it for me - ain't nobody got time for that.

I often dream of taking a sabbatical and writing modern, user-friendly SMPT and IMAP[0] servers. If only so I could use them at work on my return and save myself a lot of time and stress.

[0] Possibly even with Exchange ActiveSync support - Microsoft licenses the protocol, but I've no idea what it costs [http://www.microsoft.com/en- us/legal/intellectualproperty/IP...](http://www.microsoft.com/en- us/legal/intellectualproperty/IPLicensing/Programs/exchangeactivesyncprotocol.aspx)

<comment><USER6> It is very much "here be dragons" but a lot of that is because of legacy compatibility issues from when mail was delivered directly to local users.

If you don't care about local access (IMAP & POP is good enough, no mutt to the mail spool for you) Dovecot is a huge improvement on everything else. You configure it to listen directly for LMTP and use MySQL for user information and Maildir for data it's almost as easy as running a random php+mysql webapp. Even serverside filtering with sieve "just works".

The inbound SMTP/Spam filtering stack is still a PITA but that's because of security issues (spam).

DBmail (dbmail.org) is one rework that seemed sane but stores all messages in a RDBMS and I didn't want to deal with scaling it at work (little ISP, ~10k mail users, ~1.5 million messages per day including spam) but it was fine for personal use.

I've been playing with homegrown POP & SMTP servers that use a s3 compatible datastore as the backend but that's a side project. People go crazy over email so I really want a simple to operate, sane, zero point of failure mail system...

<comment> mike-cardwell Re "zero point of failure mail system": I also use Dovecot, and I learnt about DSync recently, although haven't played with it yet. It provides two way synchronisation of mailboxes between two Dovecot servers, so you can store the same mail on two boxes, in completely different locations.

The clever thing is, it can recover from a split brain scenario completely, safely, and without any losses. If your two servers can't see each other for a few hours and you make conflicting changes on both of them, then it apparently is able to recover completely and entirely automatically when the connection comes back up.

[http://wiki2.dovecot.org/Tools/Dsync](http://wiki2.dovecot.org/Tools/Dsync)

You could have one remote server in a DC, and the other locally in your office. Point your mail clients at the one in the DC, but then configure your office router to intercept connections to the DC server and re-route them to the local office server. When you're in the office, you hit the local office server. When you're outside of the office, you hit the DC server.

[edit] Any chance your can elaborate on your S3 test setup? I've considered something similar. I would be interested if there was any mail server software that already does this. The alternative would be to use an S3 based filesystem as your store, but this doesn't seem very efficient. You'd definitely want local caching of messages in this setup.

<comment><USER6> So, for S3, I cheat and have my own Riak CS cluster so storage is fairly quick and cheap. I should probably use Riak unless the message is too big and then put the body in CS but I was thinking that straight-up S3 is a good lowest common denominator for storing things.

Basically when I started out learning Go I saw a presentation by bradfitz where he made a POP3 server that used twitter for the backend and thought hey, access S3 instead. He had a smtp library on github so I hacked up something that accepts all mail and stores it in a S3 bucket too. I haven't hacked in things like user auth so it's all very proof of concept/useless at this point.

I'll have to take another look at DSync. The SSH batch job per user scared me off last time. I might be able to use it for HA/Failover.

</comment></comment></comment></comment><comment><USER7> With every solution that comes along to solve the "host your own email" problem, and every guide that takes you step-by-step, I always find myself just wanting a huge wiki-style site with all the topology of a good, secure email/groupware server explained in plain English rather than a package that purports to do it all for me. Something with breakdowns/discussion about the different options that exist for the different pieces that make up the whole.

It's one thing to easily obtain my own personal mail server, it's another entirely to understand and be able to maintain/improve it.

<comment><USER8> I found this series of articles very helpful, if a bit verbose - [http://arstechnica.com/information-technology/2014/02/how- to...](http://arstechnica.com/information-technology/2014/02/how-to-run-your- own-e-mail-server-with-your-own-domain-part-1/)

</comment></comment><comment><USER9> Very nice. Comes with Roundcube so you've got a webmail client available.

      - DKIM signing on outgoing messages (opendkim).
      - The machine acts as its own DNS server and is automatically configured for SPF and DKIM (nsd).

I remember many people running their own SMTP server used to have massive issues with their outgoing mail being silently or non-silently ignored or sent to the spam folder. Does this take care of this? "Mostly" really isn't good enough.

<comment><USER10> > I remember many people running their own SMTP server used to have massive > issues with their outgoing mail being silently or non-silently ignored or > sent to the spam folder. Does this take care of this? "Mostly" really isn't > good enough.

Frankly I've had mixed results over several years of hosting my own personal email server, even with a valid PTR, SPF, and DKIM. Most SMB and personal email systems I interact with are fine, as aside from Bayesian filtering those tend to rely heavily on blacklists which I am responsible enough to keep myself off of—easy given that I'm the server's only user. And I've never had an issue sending to Gmail users.

Microsoft is the real f-up in this regard, originally with Hotmail and now with the updated Outlook.com. Even though I'm on no blacklists and pass both their SPF and DKIM checks:

        Authentication-Results: hotmail.com; spf=pass (sender IP is XXX.XXX.XXX.XXX) email@example.com; dkim=pass header.d=example.com; x-hmca=pass firstname.lastname@example.com
        X-SID-PRA: email@example.com
        X-AUTH-Result: PASS
        X-SID-Result: PASS

my messages still end up in the Junk folder.

If you visit their support page you're recommended to join their partner Return Path's Sender Score Certified Email program to stop junk filtering of your legitimate messages. That's great, if you're a medium-sized organization that doesn't mind paying their certification fee; but Return Path won't even allow an individual to register (I've tried). I'm familiar with Hanlon's razor, "never attribute to malice that which is adequately explained by stupidity", but this at least _feels_ like a racket.

Unfortunately I don't know what else to do, other than continue to advise everyone I know not to use Outlook.com and friends.

And to finally answer your question, if this VM runs its own DNS then it probably takes care of SPF and DKIM adequately, but you'll likely have to contact your hosting provider for the PTR record, which is at least as important. But even following those best practices you can still have delivery issues such as I have described above, leading to the unfortunate reality that if you _really_ need a message to be delivered you're probably better off sending it through Gmail.

<comment> mike-cardwell I was suffering the same problem about 7 years ago on my own personal mail server. I discovered that if I padded out the message headers with a load of junk headers to push the message size up beyond about 50KB, then the otherwise exact same message would arrive in the Inbox at Hotmail rather than being blackholed.

[https://lists.exim.org/lurker/message/20070614.130838.42d1bd...](https://lists.exim.org/lurker/message/20070614.130838.42d1bd79.en.html)

I haven't done this for many years though as it was such a terrible hack. I do wonder if it still works, or if the threshold has changed though.

<comment><USER11> I am going to try this out and see if it still works. If it does I will be sacrificing a goat in your honour when the next full moon comes around :)

<comment> mike-cardwell If it still works, please prod me via the contact details in my profile. Would love to find out it still does :)

<comment><USER11> I will. One thing I can add is Microsoft hates the word PayPal - <USER2> paypay in your email and it gets killed, take out that one word and it goes straight through.

</comment></comment></comment></comment></comment></comment><comment><USER12> Please, _please_ do not release this sort of thing for Ubuntu; target Debian instead. It's far easier to build Ubuntu support upon a Debian base than vice- versa.

</comment><comment><USER13> Be aware: Rackspace (and surely many other cloud server providers) intentionally submit their IP blocks to DNS blacklists to dissuade spammers from using their hosts to send/relay mail. I'm not sure if the other big players do this but it wouldn't surprise me. Same goes for most consumer-class cable modem ISPs.

<comment> mike-cardwell Do you have any evidence for this? It seems unlikely to me...

<comment><USER14> He's talking about something called the PBL (policy blocklist). The idea is it contains IP ranges that aren't "supposed" to send mail, like consumer ADSL ranges. People who want to send mail from home directly are supposed to do so via their ISPs SMTP servers, which may be configured to relay but only from IPs the ISP controls.

<comment><USER15> There is no reason you can't set up your SMTP server to use your ISP, or other SMTP service like gmail, as a smart relay.

Personally I have a VPS that I relay mail through.

<comment><USER16> One downside with ISP outbound relaying is SPF; if you want to use it you need to figure out how mail exits the ISP and keep the SPF records up to date; and even if you do, suddenly all the other customers of that ISP can fake mail from you while passing SPF.

Another downside is you lose logs of and insight in the mailq and the recipient smtp server responses.

</comment></comment></comment></comment></comment><comment><USER17> This is typical, I have just done the whole process myself a few weeks ago from scratch (fresh CentOS install) and now this comes up.

However I do not regret it at all. I had Linux experience and it took me one day and a half work to get it all working very nicely.

I am happy with my config: Postifx, Dovecot, RoundCube, SpamAssassin, ClamAV

Server supports unlimited domains and user accounts - SSL is required for all connections, I only allow IMAP and I have configured it with two valid free StartSSL certificates:

        One under mail.domain.com (for email clients)
        One under webmail.domain.com (for the webmail)

And both of course do not show warnings and green padlock is always nice.

The thing that scared me the most was outgoing emails being dropped - <USER3> to date I have delivered fine to all main email provider - followed a few simple rules:

        Ensure you have both SPF and TXT correct DNS records
        Ensure you have IPv6 configured properly (Google was  rejecting due to this)
        Set your reverse DNS
        Set your machine hostname etc. in postfix

<comment> dav- You seem to have learned a lot in the process. Can you point to any good resources that helped you, specifically with security concerns and outgoing mail reliability? I've already got a mailserver running with a similar setup as you, but I haven't invested much effort into security or making sure mail providers accept my emails (Gmail sometimes marks them as spam and AOL rejects them all together).

</comment></comment><comment><USER18> This project is up for Knight Foundation funding. If you want to see it funded, speak up here: [https://www.newschallenge.org/challenge/2014/submissions/mai...](https://www.newschallenge.org/challenge/2014/submissions/mail- in-a-box)

The guy behind it, Josh Tauberer, also wrote GovTrack, which was (and still is) important for anyone who builds things with Federal government data.

</comment><comment><USER19> Please put a strong rate limit on the dns server to prevent it from being used for ddos attacks.

The last thing the internet needs is more clueless users with dns servers.

<comment><USER20> Hi,

Mail-in-a-Box uses 'nsd', which is a non-recursive DNS server. I don't think it can be used to relay DNS queries in a DDOS attack. But if you meant something else, please let me know and/or file a ticket (I don't think I'll be looking here for replies).

[https://github.com/JoshData/mailinabox/issues](https://github.com/JoshData/mailinabox/issues)

</comment></comment><comment><USER21> Even better is to host your personal email on a server at your home. SMTP will retry sending mail if your server goes down for a period, so uptime isn't critical.

I've been doing this for several months with no issues, and it's pleasant getting out of google's targeted profiles.

<comment><USER22> I wish more protocols were built with such robustness and decenteralization in mind. If you try to host a web site at home and it gains some attention among netizens, you might have a bad day. Not because your connection is dog slow, but because all those people will complain about the way you host.

The internet is too darn centeralized, people can't just put services out there.

<comment><USER21> I often feel the same about how centralized the 'net has become. Two issues that seem to make it worse:

1\. ISPs providing asymmetric service (and it's been getting worse, it used to be 10:1 dl:ul, but when I upgraded speed last year it grew to 20:1).

2\. Why do we have a plethora of centralized services, when ideally a smart firmware in your home router can handle pages like about.me or simple blogs.

</comment></comment></comment><comment><USER23> Setting up your own mail server is a thorny problem. I've been setting up my (family's) own mail server, and despite having lots of experience, it has taken a month already. Even when encryption, authentication, spam and sieve filtering, IMAP and webmail work, there's still no SMTP backup or alternative server in case you accidentally end up being blacklisted somewhere. I'm not sure investing money and effort is really worth it for just a few people's mailboxes.

The whole process keeps getting more complicated as the internet grows more hostile and end-user requirements increase.

This project sounds interesting and much necessary, but the real problem to me is the economy of scale. If 10 Unix guys sit together and set up 2 servers for 20-30 personal mailboxes, the time and money might be worth it. Setting up all those services, filtering and redundancy by yourself for just yourself – and monitoring them continuously – is wasteful and painful, even if you like to tinker with Unix systems.

There used to be a few geek-oriented ISPs around that offered SMTP/DNS backup, spam filtering and similar services so you could off-load some effort, but I guess they've fallen prey to low-margin virtual server business.

</comment><comment><USER24> It does greylisting by default. Greylisting is awesome at cutting down spam, but we recently noticed that it was preventing a major mail provider from getting through, among others, because it seems that this major provider doesn't use the same IP twice (at least sometimes).

If ignoring email coming from a major provider isn't an option (it isn't.), then what are your options?

<comment><USER15> You can whitelist from GMail while still greylisting from everyone else. Simply query DNS for their SPF records and use that for the whitelist, Google is good about keeping that up to date.

GMail sends from a farm, it's random where the exit ends up being.

I only have that problem from GMail, Hotmail and Yahoo don't seem to have this problem.

</comment></comment><comment><USER25> This is neat. I've been running my own email forever and appreciate the difficulty involved.

I do have a question:

Does hosting your own email truly isolate you from government surveillance?

If a million people use this to host their own email on AWS, what's to keep the NSA from ordering Amazon to tap into your data?

You almost have to host it on your own hardware in the garage in order to add a significant layer of isolation. Even with that in place there are ways to access your communications through your ISP. Harder, not impossible.

What's reality?

<comment><USER26> _> Does hosting your own email truly isolate you from government surveillance?_

Not by itself, no; the government can still get to you by getting access to the machine you host it on, or the switch the mail flows through on its way in and out from the outside world. Hosting your own just reduces the number of third parties the government can try to shake down to get access to your data.

<comment><USER25> I guess my point is that unless you have the machine in your home nothing really changes: They shake down the hosting provider and they are in.

In other words, what's the difference between buying email service from GoDaddy and renting a VPS from them to host it yourself?

Not being critical at all, just trying to understand if there's something fundamentally different about Mail in a Box that makes it more government- secure than other approaches. The description seems to list privacy from government snooping as the primary motivator. Is it truly effective at that? If so, why and how?

As I understand things the very idea of being secure from snooping is an illusion so long as your email is on a machine that you don't physically control in your home or office. And, even then, the best you can do is encrypt all traffic to make it more difficult --not impossible-- to capture your data.

Am I wrong?

<comment><USER27> What's wrong with installing Mail-in-a-Box on a machine that you physically control in your home or office, then?

</comment></comment></comment></comment><comment><USER28> Are you serious? I just spent all weekend building myself almost the exact same setup from scratch. It was a royal pain. I wish I'd seen this a week ago. Nice work.

</comment><comment><USER29> A Docker image would be brilliant.

<comment><USER30> Sounds like its a little more than running the setup script, as you need to choose a hostname and then setup Reverse DNS. That could make a docker instance harder to create if there's customization needed.

The irony of Docker IMHO so far is that it almost makes installation that needs configuring with user-specific values harder, unless they know how to build docker instances themselves.

<comment><USER31> Can't say I agree, for example Discourse's Docker setup is pretty easy and installing a Discourse forum does involve specifying a number of variables.

[https://github.com/discourse/discourse_docker](https://github.com/discourse/discourse_docker)

</comment></comment></comment><comment><USER32> Although I do run at the moment my own email server with postfix, dovecot and the rest, I'm thinking for some time to replace that with Kolab [0] - <USER4> similar package of "everything email hosting related in a box" solution with an extra advantage of supporting active sync which I find very valuable.

[0] [http://kolab.org/](http://kolab.org/)

</comment><comment><USER33> I used to run my own mail server. I stopped because of two reasons:

1) You have to be your own 24-hour support, or accept that you will lose or bounce mail. You can be stuck with realising that it's failed while you're on holiday.

2) You have to be your own antispam. I've had my own email domain for fifteen years; it's on basically every spam list out there. Gmail is very good at this. At the moment I rely on my hosting provider who filters out most but not all of it.

3) You can have tedious issues delivering outbound mail, even if you're not using SPF.

In my opinion the right level to run email is "small cooperative" (10-100 users), where cooperatives share software, experience and maybe even staff but are administratively and physically separate.

</comment><comment><USER34> It would be nice if this could be ported to something like Ansible so that we could add more host targets easily (ie: Fedora, CentOS, Arch, etc).

Great job. Mail configuration is pretty hard in the number of steps and amount of configuration that needs to be done to get it right.

<comment><USER7> [https://github.com/al3x/sovereign](https://github.com/al3x/sovereign) is linked to in the repo. sounds like what you're looking for.

</comment></comment><comment><USER35> This is cool, but it doesn't actually help you with mass surveillance unless the _other_ side of your conversation is doing that too. What point running your own email server if your friend is on hotmail?

Also, even if you both run your own MTAs STARTTLS does not help much except to reduce the scope of the passive-only surveillance dragnet, because the configuration does not require signed certificates.

Finally, if both parties are technical enough to run their own email servers, um, why not just use GPG?

From a technical point of view, I put this squarely in "fun, but a boondoggle" territory.

<comment> mike-cardwell > Also, even if you both run your own MTAs STARTTLS does not help much except > to reduce the scope of the passive-only surveillance dragnet, because the > configuration does not require signed certificates.

Exim and Postfix (and hopefully others to come) are both working on adding DNSSEC and DANE support right now. Which means in the not too distant future it will be possible to publish cryptographically signed data in the DNS that your MX has TLS support, and what the fingerprints are.

> Finally, if both parties are technical enough to run their own email > servers, um, why not just use GPG?

OpenPGP encrypted email leaks all sorts of information/meta data.

<comment><USER35> The metadata problem is so hard that if you actually solve it you are not using email anymore. This is why I'm saying it's a boondoggle. Even in the best case where my mother and I are running our own STARTTLS secured MTAs, oh wait, timing and message size.

GPG gives you actual privacy but minimal resistance against traffic analysis. All this other stuff gives you NO end to end privacy, AND minimal resistance against traffic analysis.

Messaging is a weird special case and GPG is behind the times (because people are coming to realise that repudiability and FS are important), but it's still a heck of a lot better than even _working_ TLS slapped on SMTP (which doesn't even currently exist).

<comment> mike-cardwell The security of email will never be perfect; that is obvious. But there is still legitimate and real value gained from making small incremental improvements to it. If you can hide the To/From/Subject of a message from a passive or even active MITM (because of DANE), then that's a good thing.

</comment></comment></comment></comment><comment><USER36> > It is a mail server in a box aimed to be deployed securely into any cloud > infrastructure. It provides no user interface to send or check one's mail > but implements all of the underlying protocols that other applications (mail > clients), such as Google K-9 for mobile devices, Mailpile, and Mozilla > Thunderbird, can interoperate with.

The combination of Mail-in-a-box and Mailpile seems pretty exciting.

Since running your own mail server is opening a new vector for attack, I'd be curious how Mail-in-a-box is going to handle security updates.

<comment><USER20> Don't know yet, but if you have thoughts please open an issue!

[https://github.com/JoshData/mailinabox/issues](https://github.com/JoshData/mailinabox/issues)

</comment></comment><comment><USER37> Rather interesting. I still like building the whole thing with postfix + dovecot by hand myself. Perhaps I'm wrong in the head.

One thing to watch out for: Yahoo is a complete bastard to deliver to. One day they'll decide to block you (if they don't immediately) and the only way out is to fill in a web form which either allows you 6 months of delivery if you're lucky or blocks you with no hope of resolution for 6 months.

Total assholes they are.

</comment><comment><USER38> Oh wow. This sounds awesome! About a year and a half ago I tried to set up my own mail server on a cheap VPS, but could not get it to work for the life of me. It's sort of a stressful thing to set up as well - failure is both high- consequence and invisible, and I'm never quite sure if what I'm doing is secure or correct. Count me as a fan of the idea - I'll try setting this up later!

</comment><comment><USER39> If you need email, but also web/ftp/git/mysql/dns, try Virtualmin - [http://www.webmin.com/virtualmin.html](http://www.webmin.com/virtualmin.html) \- you can easily run this on a $5 digital ocean server.

You basically follow a web installation wizard, create a domain and then you can use Roundcube (included) or any IMAP client. Couldn't be easier.

<comment><USER40> A +1 for Virtualmin. Does all that th OP's server does (I think) plus can do it for multiple domains and has a simple web ui. Free, and their support forum is helpful.

</comment></comment><comment><USER41> Why has nobody just made a Docker image that anyone can download and use for free? Or even just a Dockerfile. That way it's a text file and people can contribute and improve the setup.

Just my two cents.

Edit: Looks like my idea is far from original<[https://news.ycombinator.com/item?id=7634677](https://news.ycombinator.com/item?id=7634677) >

<comment><USER42> > Why has nobody just made a Docker image that anyone can download and use for > free?

Because you haven't done it yet. :)

<comment><USER41> Touche :)

Hours in the day, unfortunately.

</comment></comment></comment><comment><USER43> After toying with the idea for a while, I've settled on using a service like Mailgun or Sendgrid is the best decision when it comes to setting up email. Otherwise, it's just too much work for little in gain (as far as I'm aware). I'm curious to hear what others think.

<comment><USER44> I love Mailgun and use it for every project that needs to send out email, but you have to admit it doesn't address the OP's purpose: To decentralize and own your own email

<comment><USER45> CTRL + F `mailgun` yayy...oh..nm

</comment></comment></comment><comment><USER46> The part that bothers me is that is's all shell scripts... Why not use a modern provisioning tool now-a-days?

This looks way more interesting to me: [https://github.com/al3x/sovereign](https://github.com/al3x/sovereign)

</comment><comment><USER47> I'm going to have to try this out - I tried setting up a mail server once and failed because it was too difficult. Now I'm paying $30/year for service from NameCheap.

<comment><USER48> I set up my own by hand and it worked great for about a year. Then emails started to not get sent and incoming ones were vanishing too. Then it all went to hell and just completely stopped working.

I gave up and went to fastmail. Setting it all up wasn't a problem. Maintaining it was a nightmare.

</comment></comment><comment><USER49> Huge advantage to hosting your own mail due to third party doctrine, so this is awesome, even if it is hard. Mail might be the one service I would be most reluctant to outsource.

</comment><comment> dale-cooper Does anyone have a cheap VPS provider to recommend for this? I usually use digital ocean but from what i hear, most of their ip space is blocked everywhere due to spam issues.

</comment><comment><USER50> I for one, am still sticking with qMail, qMail-toaster to be precise. Over the years it is proven to be very reliable even when it takes beatings like no other.

</comment><comment><USER51> After being conquered by the difficulty of sendmail configuration, this is a breath of fresh air.

+1 to what codexon said about the rate limit, but this seems absolutely amazing

</comment><comment><USER52> Mail server setup is certainly a common problem that needs fixing.

Good luck with your project. I know I will use it.

</comment><comment><USER53> what about Citadel, the UI looks stone aged but it works as the in-a-box thing just fine.

</comment><comment><USER54> File-system encryption with something like encfs would be a great addition.

</comment><comment><USER55> Thanks for doing this. setting up mail is so hard, most people give up.

</comment><comment><USER56> Noone here backed Mailpile on kickstarter then?

[https://www.mailpile.is/](https://www.mailpile.is/)

</comment><comment><USER57> how does this differ from iRedMail?

</comment><comment><USER58> This is nice if your main goal is to take privacy back. For me, Gmail is not only free, but provides great mobile apps and email innovation like filtering, search, and a tabbed inbox.

In short, Gmail provides more value to me than being a simple SMTP server, so I'm willing to pay with my advertising eyes.

<comment><USER59> Unfortunately, you are also paying with my privacy (assuming I were to send you an email).</comment></comment>


Security Notification and Linode Manager Password Reset - <AUTHOR> https://blog.linode.com/2016/01/05/security-notification-and-linode-manager-password-reset/ <comment><USER5> I'm fairly confident that Linode has been compromised since July, if not earlier. PagerDuty moved off of Linode after an incident in July. We've been under strict gag orders from legal about that incident until today when Linode finally announced their compromise. Really, the only way I can see that this attacker could have gotten in the way they did (they logged into our Linode Manager account on the first try using a username that wasn't used anywhere but in Linode Manager, using valid 2fa and valid password) was if they had access to the Linode Manager database. I'm pretty sure that the recent WP Engine compromise was achieved through the same attack vector, too

<comment><USER6> If the Linode Manager database only stores the hash, how would they know the password?

How did you find out about the illicit login?

<comment><USER7> > If the Linode Manager database only stores the hash, how would they know the > password?

Hashes can be turned back into plain text, it is just computationally expensive to do so. Hashing only slows down an attack (and or increases the cost), it doesn't not mitigate one. In particular if the hashes aren't salted then a rainbow table is an extremely effective way of breaking all of the hashes concurrently.

The main method of doing so: Generate the hash for every combination of typable characters up to a given length (e.g. MD5() A-Za-z0-9 & specials up to 8x characters).

This can be mitigated using a more computationally expensive hashing routine (or increasing the work factor on a less computationally expensive one) and salts.

But given enough time OR computing power, all hashes will be broken. AWS makes breaking hashes a lot cheaper as you can bid on spare capacity and perform the operations relatively cheaply.

<comment><USER8> This only works if the input password has low entropy. You would think that people using Linode are savvy enough to be using long, randomly generated passwords.

<comment><USER7> > This only works if the input password has low entropy.

If you're generating every single possible password up to e.g. 8 characters the password's quality doesn't matter, only the length does.

<comment><USER9> A good secure password hash should be generated with a salt to slow down the process, in addition to using strong (slow) KDF function like scrypt. State actor like NSA could have store all possible 8 character combination today in a massive storage facility. God knows. But the size of such rainbow table is only effective if there is no salt, as with salt the hash is now different despite the underlying password is the same, thus there will never be enough storage if salt is present.

But the most effective "rainbow table"-like table is a look-up table with the followings:

* leaked password in plaintext, associate with email and any ID (forum username??)

* hash all of those passwords without salt

* hashes (with salt) of known leaked passwords (you try pas$w0rd and found a match for some hash with salt) - this only works if your attack succeed.

If you do a quick count you won't be surprise most passwords are fairly short and simple. If two complex passwords appear to be very similar, you can assume with a good probability they are used by the same person. You can learn some private data from just looking at password (e.g. birthday, pet's name, door number, company they worked for, sport team they root for, which many turn out to be the crucial hint or actual answer to security questions.)

I have never opened or downloaded any leaked data and don't know if it legal for use at all, but the black market probably has over petabyte volume of such data available.

It would be very interesting to see the whole world attack couple hashes per day. Imagine you go to a website, it gives you some plaintext, and you run a couple quick scrypt with random salt, and return the response. Now with a billion online users, run this every day once, you may end up finding one successful match of "this password == this hash with this salt" once in a while. But hey, that's what botnet can do...and then bitcoin!

<comment><USER10> If we presume the attackers had access to the system handling authorization, then the attackers introducing code to ship passwords offsite as users log in isn't really a stretch of the imagination.

<comment><USER9> That's true and great point. Let's play devil. You can't really be sure if Google engineer is sloppy and logging username and password on entry and then the SRE reading the log sees everything. I am not sure if their build system has plugin to detect such big red flag. Stacktrace is another place with potential leak of credentials. All of these are reasons when someone claims software is open source and auditable but they run the service themselves, it's really important to note you can't audit the actual server. They can log your username and password behind the scene while the client side appears to be 100% the same as the one on the server side.

What you describe is not rare, can be done with cross-site scripting. How it happens depends on the injection method (perhaps SQL injection).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> This is at least the fifth time I can count that linode has been hacked, really? Maybe it's time to ditch that coldfusion stack?

Edit:

1.The bitcoin hacks, March 2012

2.HTP hack, April 15, 2013 (CF exploit)

3.Second HTP hack April 16, 2013 (Another CF exploit)

4.MySQL server that allowed anonymous logins (?!?!) January 19, 2014

5.This hack

I'm not counting their domain name and various other parts of their infrastructure provided by third parties being compromised, but if I was the list would be significantly longer.

<comment><USER12> I was just thinking the same thing. I've been a customer for >10 years but this is getting ridiculous.

First 2013 attack was apparently exacerbated by cleartext password storage for LISH (their management shell) and API tokens [https://marco.org/2013/04/16/linode- hacked](https://marco.org/2013/04/16/linode-hacked)

The 2012 Bitcoin attack involved a breach of Linode's customer service portal [http://arstechnica.com/business/2012/03/bitcoins- worth-22800...](http://arstechnica.com/business/2012/03/bitcoins- worth-228000-stolen-from-customers-of-hacked-webhost/)

Today's attack is some kind of unspecified or unknown breach involving Linode manager.

I guess the obvious commonality here is that all the attacks target the "soft" Linode layers AROUND managing deploys of Linux and Xen/KVM/UML rather than the "hard" targets of those widely used systems. This also happens to be the layer where Linode should be adding value (as opposed to the cheaper VPS providers out there) and I think it's increasingly troublesome that they continue to have such severe security issues.

Is this company (CEO - Christopher Aker) not investing in security staff, security training, best practices etc, or are they investing tons and just getting breached because they host so many sites? Unclear. But it's easy to imagine it's the former, from the outside, given all these incidents.

<comment><USER11> Actually the 2013 hack was caused by linode running blatantly misconfigured CF installations, like doing stuff that the manual has big warnings about.

<comment> throway-not-909 A customer warned Linode team about the exposed CF folder. CEO aggressively shrugged it off. "That doesn't matter, it's nothing, that's a non issue." Dev who was a bit of a suck up parroted the same telling support to shut up about it. This was six months before HTP happened.

<comment><USER11> We were aware of it for probably an year before anyone bothered to spend 10 minutes looking at coldfusion source. That's all the time it took.

<comment><USER12> V interesting. Do any of the other VPS providers strike you as more secure alternatives?

<comment><USER11> I'd avoid VPS providers in general, but AWS is on a whole different level than linode. They actually understand what they're doing well enough to do live xen patching etc.

But yeah, people get hacked through their hosts all the time. Best approach is colo with minimum access for the dc staff.

<comment><USER13> That's been my recommend for a long time. Plus, I liked obfuscating with unusual CPU choices and network guards (esp for protocol layers). Worked _wonders_ with about no effort outside setting up guards. Opponents throw so much x86 shellcode at your Alpha, etc boxes while never quite getting stuff to run.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> The page was slashdotted for me, here's a copy:

"Effective immediately, Linode Manager passwords have been expired. You will be prompted to set a new password on your next login. We regret this inconvenience, however this is a necessary precaution.

"A security investigation into the unauthorized login of three accounts has led us to the discovery of two Linode.com user credentials on an external machine. This implies user credentials could have been read from our database, either offline or on, at some point. The user table contains usernames, email addresses, securely hashed passwords and encrypted two-factor seeds. The resetting of your password will invalidate the old credentials.

"This may have contributed to the unauthorized access of the three Linode customer accounts mentioned above, which were logged into via manager.linode.com. The affected customers were notified immediately. We have found no other evidence of access to Linode infrastructure, including host machines and virtual machine data.

"The entire Linode team has been working around the clock to address both this issue and the ongoing DDoS attacks. We've retained a well-known third-party security firm to aid in our investigation. Multiple Federal law enforcement authorities are also investigating and have cases open for both issues. When the thorough investigation is complete, we will share an update on the findings.

"You may be wondering if the same person or group is behind these malicious acts. We are wondering the same thing. At this point we have no information about who is behind either issue. We have not been contacted by anyone taking accountability or making demands. The acts may be related and they may not be.

"The security of your data, the functionality of your servers, and your confidence in Linode are extremely important to all of us. While we feel victimized ourselves, we understand it is our responsibility, and our privilege as your host, to provide the best possible security and service. You can help further enhance the security of your account by always using strong passwords, enabling two-factor authentication, and never using the same password at multiple services.

"We sincerely apologize for the recent disruptions in your Linode service. Thank you for your patience, understanding and ongoing trust in Linode."

<comment><USER15> Sadly I trust them as far as I can throw them, and we moved everything important from them to AWS a few years back. We had left a few static sites there but after the shenanigans over the holidays, we're moving our remaining stuff.

Sad. We spent >$10k/month with them for a while, before their shit started falling apart. They didn't appear to care at all when we left, so I suppose they have an awful lot of large customers who just don't mind their stack disintegrating beneath them every sixty days at most.

<comment><USER16> So, what happened during the AWS outage this past Fall? Or did you restructure to provide failover beyond just moving platforms?

<comment><USER15> Well, at linode you can't have a structure that is immune to failover, as they have single points of failure within _their_ infrastructure, apart from anything else - all their London kit for instance lives in Telehouse East, in a few adjacent racks.

Once we'd done the initial up sticks and move to AWS, our first priority was to use their redundancy and failover to the fullest (six months of sleepless nights due to linode made this rather front and foremost in our minds) - <USER2> nothing that's happened at AWS has ever been anything more than an inconvenience - we've managed five nines since the move - before, we managed _one_.

<comment><USER17> Only one 9? Even through this crap during the holidays I've managed 3 9's on my service hosted on several servers in Linode Dallas (the most hard-hit region in this DDoS attack). I would have moved to AWS by now if Linode didn't have such cheaper bandwidth.

<comment><USER15> Yeah... our issues mostly arose from the fact that at the time, they were advertising 1Gbps node interconnect - which actually turned out to be 1Gbps _HOST_ interconnect, with the nodes actually throttled down to 50Mbps. We use memcached extensively, and this was absolutely crippling for performance. It didn't help that they furiously denied that they were throttling until we demonstrated it beyond all doubt.

They did obligingly increase these caps when we begged them to do so, but at that point the writing was on the wall, and we kept on bumping into other weird and wonderful limitations and issues, such as the fact that someone running an intense job on the same host could bring our VPS's to an absolute crawl.

It really is a shame, as we desperately wanted to make it work, as we liked Chris's hands on approach (very much like ours), but ultimately our confidence in them was so eroded by the point that things started going genuinely wrong on their end that we had no choice but to leave.

As I said, we kept random small single-server stuff (wordpress sites mostly) there, as if you're not dealing with their networking, performance is generally OK - but the network limitations were an absolute clincher for us, and it was at one point literally _every day_ that we'd find that one of their switches had broken, or we couldn't ARP IP's for no apparent reason, etc. etc.

</comment></comment></comment></comment></comment></comment><comment><USER18> Looks like the reason their blog is down is because... it's now being targeted by a DoS:

[http://status.linode.com/incidents/kldhjpjnfnkj](http://status.linode.com/incidents/kldhjpjnfnkj)

Attacking a blog talking about the hack? It sure seems that someone has a grudge against Linode. :-/

<comment><USER19> At this point I'm starting to wonder whether this isn't a competitor putting their investors money to work. It's otherwise utterly bizzare that someone would be so obsessive in damaging Linode. I really hope they make the details of the investigation public...

<comment><USER7> It makes more sense than you might imagine...

Linode, Github, Stackoverflow, Imgur, they've all been targeted. But what do they have in common? In a word: popularity. The core reason these sites are targeted is because it is impressive to others.

The source of this is typically two fold:

\- For the lolz. Someone with a botnet just wants to show off, taking down something known gives them more notoriety.

\- For a sales pitch. Someone has botnet capacity that they want to sell, and "I took down Linode" is a great way of demoing that to potential buyers.

The first one is more common when someone finds a new method of traffic multiplication and just wants to show it off (i.e. they trick a third party into DoS/DDoSing a target). The second one is legitimate criminal enterprises.

<comment><USER20> Github was also targeted by China to try to get them to delete certain repos that were unfriendly to China. Some people also saw it as showing off their power.

</comment></comment></comment></comment><comment><USER21> For those not keeping track, that's the third major breach I've heard of where user data was exposed.

Previous Incidents:

April, 2013: [https://blog.linode.com/2013/04/16/security-incident- update/](https://blog.linode.com/2013/04/16/security-incident-update/)

January 2014: [https://blog.linode.com/2014/01/19/an-old-system-and-a- swat-...](https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-team/) (they mention the breach almost in passing...the swatting is unrelated)

I really want Linode to do well, but this may be it for me.

</comment><comment><USER22> Sure wish they had sent out an email notification to users instead of a slashdotted blog post. Now the question is how long can Linode stand in the face of these sorts of hacks and network attacks in the face of stiff VPS competition.

<comment><USER23> (Linode Employee) Already got it covered, we are sending out an email to everyone in batches, but pushed out the blog first since it can be seen by everyone right away.

<comment><USER24> I'm still waiting for mine (6 hours since this was posted to HN).

<comment><USER25> I'm still waiting on an email too.

</comment></comment></comment></comment><comment><USER26> Comments from Linode employees, Linode customers who were hacked, and a guy who hacked Linode (different incident)

I love HN.

</comment><comment><USER27> Not to throw fuel on the fire but grumbling ex-employees aren't surprised. I've heard a few stories about not investing in infrastructure or even bug fixes. "They wont even look at bug fixes with major support costs." I know it's hard to triage what to do when running a company but when employees are proud of their product a breach like this isn't surprising.

</comment><comment><USER28> I'm glad to see that this information has now been publicly disclosed. In July 2015, we suffered a compromise at PagerDuty via the Linode Manager. I hope that we can provide a bit more of an official in-depth post-mortem of our compromise, but I'd be happy to disclose some of the details here.

Using the access gained within the Linode Manager, the attacker reset the root password on a few systems, and used Lish to gain root access. We were alerted to this activity and fully revoked the attacker's access within 60 minutes of the first node being compromised. Working with Linode support, we discovered which user account was being used and completely deactivated the user. We also isolated the VMs, and performed forensics on read-only copies of their disk images.

In our situation the attacker knew one of our user's passwords and MFA secret. This allowed them to provide valid authentication credentials for an account in the Linode Manager. It's worth noting that all of our active user accounts had two-factor authentication enabled. An interesting data point was that the user who had their account compromised was no longer in possession of the MFA secret themselves. Their cell phone had been reset (thus deleting all data) 8 months prior. The user could not log in to the Linode Manager if they wanted, so it was our determination that the key could not have been obtained from the user and was more likely on Linode's side.

We also have evidence from access logs provided by Linode that the attackers tried to authenticate as an ex-employee, whose username ONLY existed in the Linode database. It was absolutely unique and was not used elsewhere by the employee making the username an accidental honeypot. This was another piece of data supporting that Linode was the source of our compromise.

We immediately reached out to them not only to inform them of their compromise, but to assist them in investigating it. We were confident that the Linode database had been breached, and that the secret key used to encrypt information in the database had been compromised as well.

In addition to reaching out to Linode, we also worked with a third-party security firm to audit our work done during the incident. Likewise, around the same time we reached out to law enforcement to assist in investigating the attack. I believe our public disclosure includes this information[1]. This was in the middle of July 2015.

We did not get confirmation in July that there was a breach of the Linode Manager or any associated credentials.

In the end, we migrated away from Linode because of this breach (even before it was publicly disclosed) in Aug 2015. We also never were able to confidently disclose that Linode was the vector due to lack of confirmation from their end. While all of us who responded to the incident were confident they were the source, we now thankfully have the data to confirm it.

[1] [https://www.pagerduty.com/blog/july-2015-security- announceme...](https://www.pagerduty.com/blog/july-2015-security- announcement/)

<comment><USER29> Saw your tweet ([https://twitter.com/theckman/status/684484772316360705](https://twitter.com/theckman/status/684484772316360705)) that linked to this post. Did a quick search to get your technical background and your LinkedIn profile states you used to work for Linode? I think it's important to share that info when you're telling your side of the incident. Your past relationship, if you left on bad terms, could play a role in your motivation to post.

<comment><USER28> I can absolutely understand your concern. I originally had it in my post, but removed it because I was worried it would detract from the details of our compromise at PagerDuty.

I worked at Linode for just under three years, and worked on quite a few different things there. I started on support and moved on to a development role (including writing ColdFusion). I left Linode on good terms. California is much more enticing than NJ, so I wanted to relocate. Plus I was interested in doing more of an Ops role, instead of working including customer-facing web applications. I'm still enjoying it. :)

I think there are lessons that can be learned whenever a company has some sort of security incident. This is especially true if they are willing to publicly disclose details of the incident. We've wanted to provide what limited information we had, but wanted to wait until we had confirmation that Linode was the vector.

While there is some relief in finally determining what we believe to be the vector of our attack, it's very unfortunate that Linode engineers are dealing with the fallout right now.

<comment><USER30> so you're saying you wrote the code that was responsible for the breach(es)? It also sounds like you knew about these issues before you left Linode but didn't point them out while you were there?

<comment><USER31> Where are you reading this? When he says he was writing ColdFusion, he's referring to the framework/programming language. He's not saying he wrote every single line of Linode's management interface.

</comment></comment></comment></comment></comment><comment><USER32> I enabled two factor on my Linode account recently and saw this worrying copy:

> If you lose your token and get locked out of the Linode Manager, email > email@example.com to regain access to your account.

> Should you need us to disable your Two-Factor Authentication, the following > information is required:

> An image of the front and back of the payment card on file, which clearly > shows both the last 6 digits and owner of the card. > An image of the front > and back of the matching government-issued photo ID.

There doesn't seem to be a way to say "I have my big boy pants on, don't let anyone in under any circumstances". This is the first 2FA setup I've seen that still allows bypass by contacting support.

EDIT: I also find it odd that you have to manually generate a scratch code, and they don't automatically generate it for you. Again, all of the other 2FA setups I've gone through have done this.

<comment><USER31> > There doesn't seem to be a way to say "I have my big boy pants on, don't let > anyone in under any circumstances". This is the first 2FA setup I've seen > that still allows bypass by contacting support.

Sadly, this is quite common, especially with organizations that provide phone support[1].

[1]: [http://krebsonsecurity.com/2015/12/2016-reality-lazy- authent...](http://krebsonsecurity.com/2015/12/2016-reality-lazy- authentication-still-the-norm/)

</comment></comment><comment><USER33> Why the hell have they not emailed their customers about this!

This is not the kind of thing I want to learn from HN.

<comment><USER34> They're doing so as we speak. It takes a while to send 400,000 mails if you actually want them to be delivered to inboxes.

<comment><USER35> 400k emails isn't that many though. :(

<comment><USER36> I haven't received any email. It's over 12 hours since the notice went up on status.linode.com and the Twitter account.

</comment></comment></comment></comment><comment><USER37> Not the first time they poorly handled a security issue: [https://blog.linode.com/2014/01/19/an-old-system-and-a- swat-...](https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-team/)

<comment><USER38> There are also a number of reviews on Glassdoor where supposed Linode employees say they were asked by management to lie to customers about security breaches.

<comment> throway-not-909 We were.

</comment></comment></comment><comment><USER39> That's it. I'm done with Linode. I will be keeping one server on Linode, but my new startup where I need several load balancers, Web servers, DB replication will be hosted elsewhere.

Do you guys know any good providers? Not AWS.

<comment><USER40> Can I ask why not AWS?

<comment><USER39> I just don't think the performance is good enough for pure web hosting. Much slower/$ than Linode and DO.

Their uptime and infrastructure is great, but you're totally on your own (e.g. if you're getting DDoS'ed). Also their traffic cost is not as easy to predict than DO/Linode/Vultr.

</comment></comment></comment><comment><USER41> Don't use Linode.

<comment><USER42> Don't lecture me.

</comment></comment><comment><AUTHOR> Blog is down. Maybe they should host it on WPEngine. (:

This sort of thing almost became background noise when I worked there. I can say that things improved somewhat after the HTP compromise, at least for awhile.

</comment><comment><USER43> Wow, these guys can't get a break.

<comment><USER44> They've been using a CF stack that is fundamentally broken from the foundation up for years and was aware of it.

Its part of why they hired someone in July to rebuild it in python.

<comment><USER42> You signed an NDA and have done a full analysis of their code? Cool.

<comment><USER11> You don't really need to sign NDAs to read through java classes.

</comment></comment></comment></comment><comment><USER45> With Linode's extended DDoS I have not been able to get into the Manager for a couple weeks. I'd really like to cancel my account with them (and they do keep billing) but I don't appear to have any tools short of a chargeback. Anyone else in the same boat?

<comment><USER46> You don't mention contacting support. Shouldn't that be your second avenue after trying to access the account dashboard?

<comment><USER45> I have always contacted support by opening a ticket in the Manager. The main website is also down. Is there an out-of-band way to reach them?

<comment><USER47> Phone? 855-454-6633 (+1-609-380-7100)

</comment></comment></comment></comment><comment><USER48> So, outside of the major cloud providers, what are the good alternatives?

<comment><USER21> VPS providers that are typically pitched as Linode Alternatives. Not 1:1 equivalents, but may work depending on your needs.

Vultr, Ramnode, Wable, iWStack

Or, depending on the number of VPS's you have, you might like:

\- Aliyun, the cloud service from Alibaba

\- A dedicated server from OVH, or their mid-tier brand, SoYouStart. This is my personal favorite. They have real DDOS protection, Data centers in North America and Europe, reasonable web interfaces, lots of available IPV4 space, and DIRT CHEAP prices. Run proxmox as the distro, and you get a decent interface to create and manage VPS instances.

The most important piece would be to try and split instances across at least two of these providers so that you have some fast recourse if something goes wrong. For the things I'm running, doing a nightly rsync of the data from one provider to another suffices as reasonable insurance.

</comment></comment><comment><USER49> This is a perfect poster child for decentralized authentication. Centralized stores of passwords and secrets are just asking for trouble. When will we learn?

<comment><USER50> so... I completely agree that shared secret authentication is a bad idea, and I use public key authentication wherever I can (password auth is disabled for ssh on every server I control; I do everything with ssh public keys.)

However, I've yet to set a public key authentication scheme that users would find acceptable for web applications. Do you really expect all users to setup x.509 auth in the browser?

What is your public key solution to authenticate the web-applications that customers demand?

</comment></comment><comment><USER51> Glad they posted it. I just logged into one of my linode boxes that I don't use for very much but keep around, and it was rooted... doh.

<comment><USER52> Could be just a coincidence if you keep SSH open on standard port. SSH bots don't sleep.

<comment><USER51> The host was only accessible via private key or Linode's LISH shell. That's what seems most suspicious.

There is some minor evidence remaining in the .bash_history that is curious.

<comment><USER53> I'd be interested in a write-up about anything you find in that .bash_history or logs, would you consider writing one?

<comment><USER51> Here's the main bulk of the obviously bad things:

        3  ls
        4  ls -al
        5  chown syslog auth.log
        6  ls -al
        7  chown syslog kern.log
        8  ls -al
        9  chown syslog syslog
       10  ls -al
       11  echo -n '' > /media/xvda/root/.bash_history
       12  echo -n '' > /root/.bash_history
       13  echo -n '' > /root/.viminfo
       14  L=$(find /var/log -type f); for F in $L; do echo -n '' > $F; done
       15  rm -rf /etc/ssh/*_key* #remove host keys
       16  rm -rf /var/lib/dhcp/* # dhcp leases
       17  echo "echo 'options rotate' >> /etc/resolv.conf" > /etc/dhcp/dhclient-exit-hooks.d/rotate
       18  ls
       19  ls -al /var/log
       20  ls
       21  ls -al /var/log
       22  exit
       23  ls
       24  ls -al /var/log
       27  adduser in
       28  su - <USER4>
       29  vi /etc/sudoers
       30  vi /etc/gro
       31  vi /etc/group
       32  groupadd --help
       33  groups
       34  groupmod
       35  groupadd --help
       36  vi /etc/group
       37  su - <USER4>

</comment></comment></comment></comment></comment><comment><USER54> and now getting server errors & timeouts when I try to get to the manager to change my passwords.

this has been a hellaciously thorough attack.

</comment><comment><USER24> And of course there's the ongoing ddos attack that is preventing me from reaching manager.linode.com...

</comment><comment><USER55> The actual answer is much more sinister than that.

Which is kind of hilarious.

<comment><USER56> That crosses into personal attack, which is not ok, even if it's just insinuated.

We detached this subthread from [https://news.ycombinator.com/item?id=10847715](https://news.ycombinator.com/item?id=10847715) and marked it off-topic.

<comment><USER55> It's not a personal attack, it's something that ryanlol publicly claims in ##security on freenode FFS.

If it wasn't, I wouldn't have referenced it

From what I gather, he thinks law enforcement is hilarious.

<comment><USER56> OK, I believe you, though I don't know any of the details. It's an important misunderstanding to prevent, though. In this case, including enough of the details to make the comment substantive would probably have been enough to clarify your intent as well.

you could have made the comment more substantive in a way that was clearly not a personal attack, and that would have solved the problem.

</comment></comment></comment></comment><comment><USER57> This is Yet Another Reminder to use unique, unguessable, unmemorable passwords for all online services. It's a question of when, not if, any particular password database will be compromised. While 'password1' and 'this is my long unguessable password' and 'm4r1g0ld' and 'false lemur capacitor paperclip' will all eventually be guessed, 'sF0PSQMwK85fe9xanqJRm9nty9cJGHJsVmti' will never, ever be.

<comment><USER57> Why was this downvoted? It's _true_. The example password is 36 characters; a mixed-case-and-numbers alphabet has just over 6 bit per character; the example password is thus 217 bits. It's not going to be guessed.</comment></comment>


Your Coffee Shop Doesn't Use Two-Phase Commit [pdf] - <AUTHOR> http://www.enterpriseintegrationpatterns.com/docs/IEEE_Software_Design_2PC.pdf <comment><USER2> author works at thought-works, all you need to know about the article.

<comment><USER3> Not sure what your statement means.

<comment><USER4> It's a spiteful ad-hominen, that's all you need to know about the parent comment.

As for the article, it's an internet classic on a quite basic concept, and was included in Joel Spolsky's best "software writing" collection.</comment></comment></comment>


Ask HN: Which git commands do you use most? (counting command included) - <AUTHOR> Here is command that counts them:
// Updated. HN filters changed the line, so see the code via Gist: https://gist.github.com/anonymous/9053693
Here are my results:

     49 git status -s
     15 git commit -am
     12 git push
     11 git checkout
     10 git add
      7 git branch
      5 git rm
      5 git mv
      5 git diff
      3 git rm --cached
      3 git rebase
      3 git commit -m
      3 git checkout -b
      2 git rm -r --cached
      2 git clone
      2 git branch -v
      1 git status -ss
      1 git status
      1 git satus -s
      1 git rm --chached
      1 git reset --soft
      1 git reset --hard
      1 git reflog
      1 git rebase --skip
      1 git rebase --continue
      1 git push --set
      1 git log
      1 git diff --cached
      1 git branch --remote
      1 git branch -d
      1 git barnch
      1 git add -u
      1 git add --all
 What are yours? <comment><USER2>
         $ history -w /dev/stdout | grep -o "^git [a-Z]*\( -\{1,2\}\([a-Z]\)*\)*" | sort | uniq -c | sort -rg
         39 git status
         26 git checkout
         24 git diff
         23 git log -
         11 git stash
         10 git add
          9 git cherry
          7 git reset
          7 git merge
          7 git commit
          6 git commit -m
          4 git help
          4 git grep
          3 git show
          3 git reset --hard
          3 git remote
          3 git rebase -i
          3 git diff --cached
          3 git checkout -b
          2 git log
          2 git checkout --
          2 git branch
          2 git add -p
          1 git stash --list
          1 git rebase -p --onto
          1 git rebase --continue
          1 git rebase --abort
          1 git rebase
          1 git push
          1 git diff --sta
          1 git diff -p -n
          1 git diff -p -l -n
          1 git diff -p -l -e
          1 git diff -ple
          1 git commit --amend
          1 git commit -am
          1 git clone --recursive
          1 git clone
          1 git blame
          1 git add --interactive

Some of this is quite amusing to me ("git help", "git rebase --abort", me trying to get a readable diff near the bottom) -- I'm a git novice. Btw, "git log -" near the top means git log -2, -3, -8, for example.

</comment><comment><USER3> I am new to git and using it for my humble projects.

         79 git add
         66 git commit -a -m
         58 git push
         32 git pull
          6 git remote
          6 git init
          6 git clone
          4 git reset
          3 git push -u
          2 git pull --force
          2 git merge
          2 git commit -a
          1 git status
          1 git rm
          1 git rebase
          1 git fetch
          1 git comit -a -m
          1 git

</comment><comment><USER4>
      79 git pull
      74 git checkout
      61 git status
      50 git log
      38 git push
      26 git diff
      20 git show -p
      15 git commit --amend
      14 git add -A
      13 git show
      13 git commit -am
      12 git checkout -b
      11 git branch -D
       7 git cherry -v
       7 git blame
       5 git cp
       4 git stash
       4 git reset --hard
       4 git commit -m
       3 git rebase
       3 git merge
       3 git checkout --
       3 git branch -d
       3 git branch --set
       3 git add -u
       2 git tag
       2 git rebase --continue
       2 git cherry
       2 git add -a
       2 git add
       1 git staus
       1 git statu
       1 git rebase -i
       1 git commit -a
       1 git commit --ammend
       1 git branch -set
       1 git

cp is a git alias I have for cherry-pick. Pretty sure the 'git branch -set' is supposed to be 'git branch -set-upstream-to'

I use different terminal tabs for each repo, so this is just one of the repos I use at work.

</comment><comment><USER5> This command doesn't work on my ubuntu 12.04 system, but I'm not quite familiar enough with bash regular expressions to see exactly where it's getting off track. The following expression starts to work for me:

        history | grep -o "git [a-Z]" | sort | uniq -c

I get:

          42 git a
          9 git b
        236 git c
          8 git d
          2 git l
         13 git m
         82 git p
          3 git r
        244 git s

If I try

        history | grep -o "git [a-Z]{3}" | sort | uniq -c

I would expect to get all of my 'git add' entries, but I get nothing. Can you see what's going wrong?

<comment><USER6> Try egrep (or grep -e)

The author probably has grep aliased to egrep

<comment><AUTHOR> Here is the right command: [https://gist.github.com/anonymous/9053693](https://gist.github.com/anonymous/9053693)

<comment><USER6> Pretty good, except it misinterprets 'git patch -M -C -C -1' as -M -C -C -

        205 git status
        163 git log
         92 git diff
         82 git push
         74 git pull
         66 git branch
         51 git commit -av
         46 git checkout
         37 git add
         24 git branch -a
         23 git remote
         23 git checkout -b
         22 git log -u
         21 git commit -v
         21 git clone
         13 git rebase -i
         12 git add -p
         10 git rm
          8 git branch -d
          7 git fetch
          5 git stash
          5 git push --set
          5 git branch -D
          4 git reset --hard
          4 git rebase --continue
          4 git format
          3 git init
          3 git diff --cached
          3 git config --global
          2 git rebase --abort
          2 git rebase
          2 git log --pretty
          2 git commit --amend -av
          2 git commit --amend
          2 git commit --allow
          1 git urb
          1 git rm --cached
          1 git reset
          1 git patch -M -C -C -
          1 git log -u -w
          1 git log -u -
          1 git log -a
          1 git lo
          1 git feth
          1 git diff -u --
          1 git diff --help
          1 git diff --
          1 git config
          1 git commit -va
          1 git commit --amend -a
          1 git commit
          1 git checkout --help
          1 git apply

</comment></comment></comment></comment><comment><USER7> If you're using OS X, instead of using [a-Z], try [a-zA-Z].

<comment><USER8> Hmm. Is \w still an extension, not universally supported?

</comment></comment><comment><USER9> git commit -a git push git diff

I usually work by myself, so rarely use git pull :)</comment>


Show HN: SMRZr – Summarize YouTube Videos - <AUTHOR> http://smrzr.com

<comment><USER2> Love it! Very useful, bookmarked (bkmrkt?)

Slightly offtopic, but what's with startups and one-off projects just taking a word and removing all the vowels? Seems edgy I guess. Or agile, like _we write fast and break words_.

<comment><AUTHOR> Thanks! I wanted a short domain name for sharing -- so I just summarized the word "summarizer"!

</comment></comment><comment><USER3> <irony>Yahoo! will be contacting you in a while, they love the summarisation stuff</irony></comment>


Offst v0.1.1 - <AUTHOR> https://www.freedomlayer.org/offst/version-0-1-1/ <comment><USER2> A related Show HN was [https://news.ycombinator.com/item?id=19756353](https://news.ycombinator.com/item?id=19756353).

</comment><comment><USER3> Very cool! How is the ledger maintained?

<comment><AUTHOR> Hi, thanks for the interest! Actually, there is no ledger (:

Every two nodes that setup mutual credit maintain the balance between them. This turns out to be enough to be able to send funds across a chain of nodes in a secure manner.

Some of the general idea can be found here: [https://offst.readthedocs.io/en/latest/theory/](https://offst.readthedocs.io/en/latest/theory/) It is a bit outdated given the modifications of the last few months, but I think it is still relevant enough to give you a better view of how things work.</comment></comment>


Can I run Gentto Linux on this Thinkpad? - <AUTHOR> http://www.tigerdirect.ca/applications/searchtools/item-details.asp?EdpNo=9691411&SRCCODE=CANWGOOCAPLA&csid=_63&utm_source=google&utm_medium=paid_search&utm_campaign=paid_search_google_pla&scid=scplp2787594&gclid=CP7smLyGysYCFQataQod0y4DfQ&gclsrc=aw.ds

<comment><USER2> I have a T530, albeit with an i7 and 1080p screen. Linux (openSUSE right now) runs flawlessly, down to the function keys, volume keys and automatic suspend/resume.

</comment><comment><AUTHOR> In general is this a good think pad to get? Is the specs good? I want to be able to install Gentoo or Kali Linux on it. Any information is helpful. Thanks in advance

<comment><USER3> Googling brings up a ton of hits for "linux + T430" and these two pages seem to indicate that it should mostly work:

[http://www.linlap.com/lenovo_thinkpad_t430](http://www.linlap.com/lenovo_thinkpad_t430) [http://blog.burntsushi.net/lenovo- thinkpad-t430-archlinux/](http://blog.burntsushi.net/lenovo- thinkpad-t430-archlinux/)

<comment><AUTHOR> Thanks! 1 more thing, Which laptop would you prefer/which one is better: Lenovo Thinkpad T430 or the X1 Carbon?

<comment><USER3> I am not familiar enough with the models to recommend one over the other.

<comment><AUTHOR> Oh, Okay its fine. Thanks though!</comment></comment></comment></comment></comment>


Reverse Job Search: I will pay to work at your company - NYC-dev I am a coding bootcamp graduate who is having a hard time finding my first dev job.
PROBLEM: Most internships want students who are in college (I'm not) and most junior positions want people with at least 2 years of experience. I'm looking for my first front-end development job.
ABOUT ME: - I changed careers from the medical field. - I'm African-American. - I live in NYC. - I graduated from a good coding bootcamp, so I know basic HTML, CSS, and JS.
- I briefly helped a friend with a React / Redux app, so I know the fundamentals of React.
Because I've had a hard time finding my first job, I was thinking about going back to take more web development classes to build up my portfolio. The school I was looking into is about $10K and it lasts 7 months.
So instead of that, I wanted to see if there are any companies out there that I can pay who is willing to let me learn on the job. I know it's a rather crazy idea, but you never know, right?
JOB REQUIREMENTS: - I want to be treated like any other dev in the company (work with PMs, designers, other devs, and be assigned tasks). - I'm interested in front-end development particularly. - Since I have started learning React, I would prefer to work on a React app. - I would like to work with someone who is patient and is good at mentoring beginners. - The company should be located in NYC ideally (but open to remote if you think it can work). - The job should last full-time, 7 months at least (ideally). - Since I'm paying and the whole point is to learn on the job, I'd expect the interview process to be more lenient.
PAYMENT / "TUITION": - Up to $10K
Message below if there's an opportunity out there for me! I'm hopeful. <comment><AUTHOR> Hi there,

I completely disagree with these other developers. I made it the hard way doing what they are suggesting - taught myself how to program, what SQL was, then JS, php, java, finally rails and ruby, scrounged for work, struggled on my own for years to figure out how to actually build robust software. And now a decade later, I'm an expert, confident and finally doing what I want to do all the time.

So sure there are some benefits that come with that approach - but if I had to do it over again, and had the funds to do so, I would have just done what you are wanting to do. Find a good senior developer/mentor, in an area that I'm really interested in, pay them to train me and give me the work to build an excellent portfolio and get the necessary real world work experience to land the exact job I want to do. Heck 10k for 7 months isn't bad at all, that's a great deal for you. You learn the whole development process, gain the work experience and will get a job making bank in less than a year - that's a nice ROI, much better than most CS degrees.

Also the superhuman discipline it requires to teach yourself everything from scratch while building an extensive portfolio is tough.

Anyway, If you'd like I'd be glad to talk to you and help you out with anything you need, so just reach out my email is in my profile.

<comment><USER2> I've helped a few friends learn web development while in their 20s, a few of whom were highly intelligent MIT grads. I agree that the discipline and motivation are the biggest roadblocks, followed by discovering an efficient lesson plan (lots of places online will teach you the specifics without giving you the greater picture).

The fact of the matter is that when you have a lot of free time, you will likely end up frittering much of it away. If you _absolutely adore_ programming and working on projects, then sure, you may spend those months productively, but not everyone can count on that. So it very much helps to have some external pressure — in the form of a job or a mentor — to help you push beyond limits that you might not choose to cross on your own.

</comment></comment><comment><USER3> Hi there. I am unfortunately based in Helsinki and so cannot offer you any opportunities - but I would like to offer some advice. You are (in my opinion) crazy to spend more money, especially to work for someone else - if you have 10K and 7 months and want to go full time.. take your laptop to a coffee shop, and build yourself an app.. start dirt simple, iterate... make yourself a website, put up sample pieces... even try to build a real MVP of some product... go to meetup.com or similar events for other IT dudes and see what they are working on. Volunteer to help. Get your hands dirty that way? Good luck!

<comment><USER3> To continue: you are thinking of yourself as in a weak position (and I can both understand and sympathize having been in a couple rough patches myself before), but ask yourself which you think sounds better, to a future employer: "I spent my own money to work for someone else" vs "I spent 7 months working on an MVP for this little idea I had... you know, it never turned out as a big success, but I had fun and I learned a lot as I worked with x,y, z other people that I found in similar community...".

</comment></comment><comment><USER4> What you're looking for isn't legal AFAIK, so you're probably not going to find any real business that would agree to it.

If a business treats someone like an employee, then they are an employee, regardless of what labels you each use or what agreements you may make. If you want to be treated like any other dev in the company, have tasks assigned to you, etc, then you are an employee. Unpaid interns, for example, can't have tasks that primarily benefit the employer assigned to them; they can't do employee work or they will be treated as an employee in the eyes of the law.

Employees have to be put on a regular payroll schedule, paid at least minimum wage, have payroll taxes filed and paid, be provided with health insurance if they're not exempt, etc. Failing to do so would be a violation of federal and state labor laws, regardless of whether you're OK with it or not.

In NYC specifically, if someone agreed to have you work at their business as a developer, and collected your "tuition" without putting you on payroll, they would end up owing at least $10,000 in fines plus 2x minimum wage for every hour you worked (actual plus liquidated damages), plus back taxes and interest, should anyone tip off the state or IRS about it.

</comment><comment><USER5> I agree with other people in this thread - this is an incredibly inefficient way to spend this time and money.

Spend these 7 months and $10k learning more and building a portfolio, you'll get much more out of it than you could from a job.

Go to udemy, pickup a few good node/react courses(google a coupon to get them for $10-$15), and you will have expert engineers, who are also expert teachers, spending hundreds of hours guiding you through the process of building projects for your portfolio.

What can you possibly get out of "real work experience" that would be more valuable than that?

Build a kickass portfolio, have a github account you can use to showoff your code. It will make you way more hireable than "work experience".

Here are my recommendations on where to start:

[https://startuplab.io/post/fullstack-web-development- roadmap](https://startuplab.io/post/fullstack-web-development-roadmap)

Specifically, I highly recommend courses by Stephen Grider and Andrew Mead. They are absolutely incredible in quality, will teach you everything you need, and are based on real practical projects.

</comment><comment><USER6> On one hand, it's a sign of a dysfunctional job market and that's sad.

On the other hand, you dude may be taking the right approach here. Warren Buffett famously did pretty much the same - he offered to work for free for Ben Graham, his mentor cause experience and insight were much more valuable to him that money. Funnily enough, Graham turned him down initially, saying he was still too expensive :)

So good luck to you !

</comment><comment><USER7> If you're having issues getting hired, lack of skills is not your problem. Anyone that takes you up on this offer is exploiting you and don't expect to be respected when co workers find out your arrangement.

</comment><comment><USER8> \- Buy a ticket to Nigeria $1.5k

\- Buy $5k worth of raspberry pi's

\- Spend a month there teaching everyone the basics of what you learned

\- Blog and video blog about it.

Come back to NY and get hired right away.

Does anyone see a flaw in any of this?

ps - what's your race got to do with anything?

<comment><USER9> My partner and I have a small training school which will open in a few weeks. Anyone willing to go down this route with us ? We aren't rich by any means, but we'll cover some major expenses. It'll be fun! Contact in bio.

</comment></comment><comment><USER10> I have perhaps a controversial opinion:

If you want a position where you will be working on real things and want lots of input from a senior person, then that probably means them spending at least 1 hour per day working with you directly. That's about 140 hours over 7 months. At a company cost of $200/hour (minimum in NYC) for a senior developer, this translates to $28,000 of company cost.

Why would a company agree to $18000 out of pocket cost in your scenario vs $28000 in an unpaid intern position? I posit that, perhaps, the type of company that would cover $18k cost but not $28k may not be the type of company you want to intern with.

Personally I wouldn't want to hire someone in this way. I'd rather real internship or no internship because I'd be concerned about mixed messages.

Have you considered a change of location and finding a real internship?

Also remember all this is free internet advice. You have no obligation to agree with any of it.

</comment><comment><USER11> Please do not do this. Here is my reasoning:

You reasonably would want, for your 10k, to work at / learn from a respectable, successful company. But my guess is that 10k for any such company would not represent a huge amount of money, and they'd be unlikely to take you up on your offer.

On the other hand, there will be plenty of less respectable, less successful companies who would bite your hand off. But from your point of view this would not be a good return on investment.

Of course there will be exceptions, but in general I'd be suspicious of any company who would take your 10k. And since 10k is a large amount of money (to me at least!) I'd personally not want to gamble on finding one of the exceptions.

There is other advice in this thread on what to do instead - I'd think more along those lines. Just my 2c.

</comment><comment><USER12> Work on the front end for OpenEMR, especially as you have a medical background. It's a open source project and the lead devs posted on HN last month asking specifically for help modernizing their front end with react. They said explicitly that any experience levels are welcome

OpenEMR is in my opinion a much needed project. They have a good amount of users esp in the developing world, so your work would be used to help many people in need. The us healthcare system also needs an open emr

Learn a marketable tech you're interested in, work on an impactful open source project, and save your $10k :)

</comment><comment><USER13> I think you're far better off taking the classes. I was basically in your position 4 years ago, I had some coding skills but not enough to get my foot in the door anywhere. I chose to take a 2 year course (with a 6 months guaranteed internship) and it was invaluable for my career. You'll make connections to people who will soon also be working in the industry, you'll have time to develop your skills and build projects. I don't know how it works in the US, I know you don't get paid to study but maybe there's some free colleges/courses. You could look at alternatives to keep costs down and live on the money you have for a few months while you're focused on studying and networking.

If you don't want to go to school, get an internship but you should definitely not be paying since you're going to do valuable work even while learning on the job. Because the reality is that no devs actually have time to hold your hand, you will get a task and have to figure it out. They'll be able to point you in the right direction but don't expect much more than that.

<comment><USER13> I found some free courses/schools here:

[http://www.npower.org/](http://www.npower.org/) "Non-profit Npower offers this free program to young adults ages 18 to 25. The program hosts two class cycles per year, beginning in January and July, with each running a total of 22 weeks, including 15 weeks of class-based training and _7 weeks of paid internship_. The courses are based at Npower's HQ in Downtown Brooklyn and in Harlem."

[https://flatironschool.com/programs/nyc-mobile-dev- corps](https://flatironschool.com/programs/nyc-mobile-dev-corps) "Mobile Dev Corps is a new, four month long course run by The Flatiron School and fully funded by the city. Starting in January students will learn to build iOS apps over a 16 week course. To be eligible you must be an NYC resident, earn less than $50,000 per annum and have no prior programming experience."

They also offer scholarships you can try to apply for if the above course doesn't meet your criteria. [https://flatironschool.com/programs/online-web- developer-car...](https://flatironschool.com/programs/online-web-developer- career-course/#tuition-financing-scholarships)

[https://www.c4q.nyc/accesscode/](https://www.c4q.nyc/accesscode/) "Over the course of 10-months, expect to spend over eighty hours each week learning to code. From collaborating in hackathons to launching products at Demo Day, Access Code is fully immersive, and designed to train industry ready developers."

Forgive my formatting, I'm new to HN....

</comment></comment><comment><USER14> Why don't you use that $10,000 to start your own company. You can then give all those HR people the finger, like they deserve.

<comment> NYC-dev My coding skills is not at that level yet where I can be my own CTO.

<comment><USER15> Markus Frind started PlentyOfFish to learn and implement ASP.NET himself. You start with a narrow scope & slowly start building. No one is a born CTO, you live you learn.

I will be more than happy to help you if you need some mentoring (I live in NYC). I've been a developer for over a decade.

</comment></comment></comment><comment><USER16> If you're interested in trying your hand at short-term projects, I may have some work for you in the coming months.

I am a software freelancer and so my work is project based. I also teach web development workshops at the local college.

The way I see this working is to section off chunks of work for you from my contracts. You would perform the work and pay me for mentorship and code review. Of course, your code would then be incorporated into the project so you could claim the experience on your resume.

I wouldn't be able to promise full-time work as mentorship is quite time intensive and I will have to balance it with my own work. Likewise I tend to have some downtime between projects so there isn't always work that needs to be done.

If this is something that interests you, let me know. My email is firstname.lastname@example.com

At the moment, I am on hiatus until February so unfortunately I don't have anything to offer until at least then.

</comment><comment><USER17> If you're considering another bootcamp, don't bother. You don't mention if you have a degree or not (even one in an unrelated field is valuable), but if you're considering further education/training, I'd suggest doing so at an accredited institution and earning a degree for your efforts.

Otherwise, leverage your free time to work on your skills/portfolio. Structure your time; get disciplined. Read: [http://calnewport.com/blog/2015/09/29/deep- habits-three-rece...](http://calnewport.com/blog/2015/09/29/deep-habits-three- recent-daily-plans/)

And as others have said: do not to work for free under any circumstances. Don't sell yourself short.

Best of luck.

</comment><comment><USER18> FYI: There are several entry-level web dev positions in NYC via Google Jobs > [https://www.google.com/search?q=jobs+%2B+entry+level+web+dev...](https://www.google.com/search?q=jobs+%2B+entry+level+web+developer+new+york&rlz=1C1CHBF_enUS752US752&oq=jobs+%2B+entry+level+web+developer+new+york&aqs=chrome..69i57j0l2j69i60l2.20603j0j8&sourceid=chrome&ie=UTF-8&ibp=htl;jobs&sa=X&ved=0ahUKEwiT6p6g4MHYAhXrx4MKHUIDAvIQiYsCCFsoAQ#fpstate=tldetail&htidocid=GLvN9GqOeOT7T-pGAAAAAA%3D%3D&htivrt=jobs)

</comment><comment><USER19> I'm a CTO of a cryptocurrency business.

Due to the nature of what we do we require access to blockchains for various currencies. We have a mechanism in place for this but I'm thinking of splitting it off into another company.

i.e. Crypto curreny blockchain API service for wallets, exchanges etc.

So here's what I'm offering.

* You will be CTO and sole developer of a new Startup and your 10K would be seed capital.

* I will show you what is required and how to go about it.

* We will be your first customer.

* We will take a 50% stake.

Technologies

* Ruby on Rails

* node.js

* Kotlin (possibly)

* Elm

If this is intesting to you let me know.

Your worst case scenario is the business doesn't take off but you learn a shit load of skills including how to run a crypto business.

</comment><comment><USER20> Sure you got a ton of offers but check me out.

As a side project I'm building a thing to help devs like you get some experience and make it easier to find jobs later. I'm rewriting everything in react as an open source project.

If you want we can pair a couple hours a week or so and I'll help you get better at react. I don't need or want your money but is more valuable to me your feedback and meeting more people in your position to better understand what I'm doing

Hit me up at david(at)codecorgi.com

</comment><comment><USER21> Have you contacted any recruiters? There are a ton of entry level jobs in NYC through a good recruiter. Ad agencies are always looking for new coders, try that if you want.

<comment><USER22> I wouldn't trust recruiters if you're still starting out. Went through the process! Ad Agencies dunno ?

</comment></comment><comment><USER23> Under no circumstances should you pay to work. You'll be taken advantage of. No company that has anything positive to give you would consider such an arrangement.

</comment><comment><USER24> You shouldn't have to pay. Have you tried for volunteering? Perhaps working for free for a short term rather than paying to work? That sounds quite extreme.

<comment> NYC-dev The free opportunities I found don't have the structure and leadership of a real company. I want to learn from more senior devs instead of having me be the only dev.

<comment><USER24> What I mean is seek to volunteer work at real companies rather than paying them. You may be learning but it sounds like you have some knowledge so you should still be providing them with some value.

<comment><AUTHOR> I disagree completely. He is doing the right thing. Be upfront, pay the company, this sets the right expectations. The seniors devs have an obligation to mentor him and do it well, not just delegate him internship crap work. It would definitely be worth it for both parties.

<comment><USER13> And what will probably happen is that some scummy company will happily take his money and he will still be delegated the internship crap work. What you're describing is a school, but a school doesn't ship production code to clients and has teachers at the ready to mentor anyone who needs help. An internship is just a way to get the foot in the door with some light mentoring which usually consists of a senior pointing you in the right direction, not actually teaching you the stuff.

<comment><USER25> OP's post is disheartening to read.

This will probably less of a problem if more companies offered internships to inexperienced graduates instead of just undergraduates. The idea that you must be a student to qualify for an internship is an outmoded one, especially in a field of work where there are lots of autodidacts.

</comment></comment></comment></comment></comment></comment><comment><USER26> We as a society rely too heavily on resume / CV signals. Social media amplifies our dependence on this reliance.

The real innovators, the people who changed the world, were almost never optimizing for their resume.

</comment><comment><USER3> Coincidentally, a few pages back, some just offered to teach people react: [https://assim.me/init_blog/](https://assim.me/init_blog/)

</comment><comment><USER27> Go door to door to small businesses to build them a webpage for free.

</comment><comment><USER28> >> I can pay who is willing to let me learn on the job.

Nope, please do not do that, as other say.

You have 10K and 7 months.

\- Find some part time gig (may be teach HTML, CSS) at local community college - 2, 3 hours: pays you something and you are not completely using up your funds. You have some knowledge and we always underestimate our knowledge to be poor and useless to the rest of all. Ironical in that, we go try and find a job with the same knowledge! So be confident that you can make some income with what knowledge you have right know.

\- Write 6 apps in 6 months, extremely scoped, solving simple problems, I will offer one example:

       -- Write an app, that teaches 2000 most commonly used English words. There is a photo for that word, the spelling and sound. The user is shown the photo, he picks the correct word. If app shows the word, pick the right photo. The user starts a session, selects number of words to learn/review, show the words randomly. Next upgrade: you can talk about expanding this to use Retention algorithms in the interview.
       -- Rinse, lather, repeat 5 more apps

\- Once your 1st app is ready, go to meet ups, local groups etc where you can do some self marketing with your portfolio, every month 1 more app is getting added to your portfolio. Upload your resume and portfolio on job boards, keep applying.

With some thoughtful planning of a part time gig, 6 portfolio apps, self marketing should keep you busy. Yes, don't forget to sleep, eat correct and exercise.

Hope this helps, this is just what I would probably do. Best.

</comment><comment><USER29> Send me an email! moura at oko dot ai

We use React+Redux on the front-end and nodejs+Python on the back end. I think you will be a great fit.

</comment><comment><USER30> CTO of an edtech startup here. I'd love to talk to you! Shoot me an email at jaydev at mathbrix dot com

</comment><comment><USER31> I don't think it's wise to pay a company to let you work for them. I'm a rather skeptical person, and I'd be leary of anyone taking my money in such a scenario. Seems like a good way to lose $10K and wind up in the same place a few months later.

You haven't said what you've done to try to get a job. You should talk about that before people can give you advice. I have nothing to go on there, so take this with a grain of salt.

Did your bootcamp give you a promise of any assistance in finding a job? Have you kept in touch with any of your cohort? Reach out to them for help (explain the problem, ask if they have ideas that could help). These are two things that I'd try, right off the bat.

As someone else mentioned, talk to several recruiters. Present your resume and see what kind of feedback you get. If they tell you that they will be unable to place you, ask them if they think you don't have enough experience, and what they think you are missing. Recruiters are not your friend, but they are in the business of making money by placing people in jobs. If they think that they can make money by putting you in a job, they will try to do so.

Next: NYC has a smorgasbord of tech meetups with free or low-fee entry costs. Go to as many as you can. Most such meetups have an initial 30-minute period when you can stand around and talk to people about their jobs. Take notes, then go home and use the Internet to find out more about the parts of these discussions that you didn't understand. This should help to make you more technically competent.

Next, you want to do some "informational interviews": [https://en.wikipedia.org/wiki/Informational_interview](https://en.wikipedia.org/wiki/Informational_interview) If you have friends, friends-of-friends, relatives, etc. who are working in an area that interests you, tell them you'd like to spend 30 minutes or an hour to ask about what they do at their jobs. Keep in mind you're not going to ask them for a job. You're just asking for information. Take good notes, bring them home, and again research the parts that confuse you. You can do phone informational interviews if needed, too.

The informational interviews and tech meetups are intended to help you build a network of people who know you, know that you are looking for a job, and may be able to refer you to an open position. They will also be a goldmine for learning more about the field that you want to break into.

It may help to build a small side project, and have some code samples in github. I can't speak to that, since those things never helped me.

Good luck!</comment>


Key Features, MakerBot's text adventure - <AUTHOR> http://www.makerbot.com/secrets/key_features/

<comment><USER2> This is so awesome.</comment>


Highcharts 6 released - <AUTHOR> https://www.highcharts.com/blog/news/announcing-highcharts-6/ <comment><AUTHOR> I had some complex JS plotting to do as part of a client project, with axis navigation, color changes, discontinuous lines on time-axis scatter plots, custom markers, and custom gridlines. I scrapped my initial approach and switched to Highcharts, saving a lot of time compared to building the plot directly in D3.

By default you get a great plot, and with a well-documented API you can customize literally every aspect. Congratulations to the team on the launch of the new version!</comment>