My Most Important Project Was a Bytecode Interpreter - <AUTHOR> http://gpfault.net/posts/most-important-project.txt.html <comment><USER3> One of the moments where I really started to feel like I was starting to 'see the matrix' was when I was working on a regex engine to try to make my compiler faster (it didn't, but that's another story). The asymptotically fast way to approach regex processing actually involves writing a parser to process the regex, so in order to write a fast compiler, you need to write another fast compiler to process the regexes that will process the actual programs that you write. But, if your regexes get complex, you should really write a parser to parse the regexes that will parse the actual program. This is where you realize that it's parsers all the way down.

When you think more about regexes this way, you realize that a regex is just a tiny description of a virtual machine (or emulator) that can process the simplest of instructions (check for 'a', accept '0-9', etc.). Each step in the regex is just a piece of bytecode that can execute, and if you turn a regex on its side you can visualize it as just a simple assembly program.

<comment><USER4> I mean, the whole point of regexes (not to be confused with PCREs) is that any given regex is isomorphic to some canonical finite state machine. It is, specifically speaking, a tiny description of an FSM over the alphabet of ASCII characters (or whatever charset you're using).

Interestingly, regexes/FSMs are (IIRC) the most powerful class of machines for which equivalence is decidable. So if you give me any two regexes, I can tell you if they match on all the same strings, but this is not true for any more powerful grammar.

<comment><USER5> Isn't it possible to decide the equivalence of deterministic pushdown automata? Wouldn't DPDAs be considered more powerful than FSMs due to the addition of a stack?

Wikipedia [1] shows there's a paper called "The equivalence problem for deterministic pushdown automata is decidable" that won the Gödel Prize is 2002. I haven't read the paper nor do I currently have access to it though.

[1] [https://en.wikipedia.org/wiki/Deterministic_pushdown_automat...](https://en.wikipedia.org/wiki/Deterministic_pushdown_automaton#Equivalence_problem)

<comment><USER6> Here you go!

[http://link.springer.com.sci- hub.cc/chapter/10.1007/3-540-63...](http://link.springer.com.sci- hub.cc/chapter/10.1007/3-540-63165-8_221)

It was initially published in 1997.

</comment></comment></comment></comment><comment><USER7> Also: a software rasterizer.

Most people refuse to write one because it's so easy not to. Why bother?

It will make you a better coder for the rest of your life.

Let's make a list of "power projects" like this. A bytecode interpreter, a software rasterizer... What else?

<comment><USER8> Tracks I've done and suggested to friends and colleagues as learning experiences:

* Compression (lossless, lossy, image, audio, texture, video)

* Languages (bytecode interpreter, AST interpreter, parser/lexer for a simple language, simple JIT, understanding instruction scheduling)

* DSP programming (writing programs for fast, branchless math)

* Comfort with binary and binary formats (start with packfiles .zip/.tar, move onto reverse engineering simple formats for e.g. games)

* Understanding the difference between RAM and address spaces (e.g. understanding virtual memory, mmap, memory-mapped IO, dynamic linking, the VDSO, page faulting, shared memory)

* Device drivers (easier on Linux, understanding userspace/kernel interaction, ioctls, how hardware and registers work, how to read spec sheets and hardware manuals)

* Graphics (modern software rasterizer that's not scanline-based, understanding 3D and projective transforms, GPU programming and shaders, basic lighting (reflection and illumination) models, what "GPU memory" is, what scanout is, how full scenes are accumulated all along the stack)

I could go heavily into depth for any one of these. Ask me questions if you're interested! They're all fun and I always have more to learn.

Also, the longer you get into any given track, the more you realize they all connect in the end.

<comment><USER9> Concerning last point, do you know nice example of non-scanline-based 2D renderers ?

<comment><USER10> A very informative tutorial on high performance edge-function based rasterization:

[https://fgiesen.wordpress.com/2013/02/17/optimizing-sw- occlu...](https://fgiesen.wordpress.com/2013/02/17/optimizing-sw-occlusion- culling-index/)

(articles 6, 7, 8, others are not closely related)

As far as I know modern hardware has been non-scanline-based for ages btw.

<comment><USER9> Thanks, looks very interesting. But it seems more 3D-oriented than 2D oriented.

</comment></comment></comment></comment></comment><comment><USER11> I love the author's meta-idea of refusing to accept that unfamiliar things are black boxes full of magic that can't be touched.

A great example of this mindset is the guy who bought a mainframe. [1]

Refuse to be placed in a silo. Work your way up and down the stack and you'll be much better placed to solve problems and learn from the patterns that repeat at all levels.

[1] [https://news.ycombinator.com/item?id=11376711](https://news.ycombinator.com/item?id=11376711)

<comment><USER12> Everything is made from smaller components. Understand each of those components better and you'll understand the entire system better.

Sometimes, you can use end-errors to tell which component has the issue. For instance, if a web site gives a 502 error, the problem is likely with the load balancer or lower network stack on the web server. 404 would often be a file system level issue on the web server. 500 is frequently a network issue between web server and database server. 400 is a problem with the site presentation code, or maybe database malforming addresses.

<comment><USER13> _> Everything is made from smaller components. Understand each of those components better and you'll understand the entire system better._

This. No matter how specialised you are (or want to be) always strive to have at least a basic understanding of the full stack and everything else that your work touches through a couple of levels of indirection (including the wetware such as, in commercial contexts, having a good understanding of your client's business even if you aren't even close to being client-facing) because it will help you produce much more useful/optimal output and can be a lot more helpful when your colleagues/compatriots/partners/what-ever his a technical problem. Heck, at the logical extreme a little cross discipline understanding could even lead you to discovering a better method of doing _X_ that strips out the need for _Y_ altogether, revolutionising how we do _Z_.

Of course don't go overboard unless you are truly a genius... Trying to keep up with everything _in detail_ is a sure-fire route to mental burn-out!

</comment></comment></comment><comment><USER14> Two approaches are severely underused in the software world:

1) Domain-specific languages (DSLs)

2) Virtual machines (or just explicit state machines more generally)

What I mean is, alot of problems could be solved cleanly, elegantly, more safely, and more powerfully by using one (or both) of the above. The problem is that when people think DSL or VM, they think big (Scheme or JVM) instead of thinking small (printf). A DSL or VM doesn't need to be complex; it could be incredibly simple but still be immensely more powerful than coding a solution directly in an existing language using its constructs and APIs.

Case in point: the BSD hexdump(1) utility. POSIX defines the od(1) utility for formatting binary data as text, and it takes a long list of complex command- line arguments. The hexdump utility, by contrast, uses a simple DSL to specify how to format output. hexdump can implement almost every conceivable output format of od and then some using its DSL. The DSL is basically printf format specifiers combined with looping declarations.

I got bored one day and decided to implement hexdump as a library (i.e. "one hexdump to rule them all"), with a thin command-line wrapper that emulates the BSD utility version. Unlike BSD hexdump(1) or POSIX od(1), which implement everything in C in the typical manner, I decided to translate the hexdump DSL into bytecode for a simple virtual machine.

      http://25thandclement.com/~william/projects/hexdump.c.html

The end result was that my implementation was about the same size as either of those, but 1) could built as a shared library, command-line utility, or Lua module, 2) is more performant (formats almost 30% faster for the common outputs, thanks to a couple of obvious, easy, single-line optimizations the approach opened up) than either of the others, and 3) is arguably easier to read and hack on.

Granted, my little hexdump utility doesn't have much value. I still tend to rewrite a simple dumper in a couple dozen lines of code for different projects (I'm big on avoiding dependencies), and not many other people use it. But I really liked the experience and the end result. I've used simple DSLs, VMs, and especially explicit state machines many times before and after, but this one was one of the largest and most satisfying.

The only more complex VM I've written was for an asynchronous I/O SPF C library, but that one is more difficult to explain and justify, though I will if pressed.

<comment><USER15> Yes, absolutely agree. In LISP its obvious.

1\. Every function is a tiny VM already. Every macro is a layer on top of a "compiler" to let you redesign a language. LISP gives much more power, precisely because every program is its own DSL, and all power of the language within that DSL is available. [http://www.paulgraham.com/avg.html](http://www.paulgraham.com/avg.html)

2\. In SICP they show how to build anything from LISP constructs. The elegant thing is that LISP actually only needs very few machine primitives. [https://mitpress.mit.edu/sicp/full-text/book/book- Z-H-30.htm...](https://mitpress.mit.edu/sicp/full-text/book/book- Z-H-30.html#%_chap_5)

The most powerful constructs I've seen is a combination of these 2: Clojure/async is a macro which transforms any program to state machines. I think that kind of power gives you 20-30x advantage in business type applications. In fact I've seen C++ programmers spending a decade on discovering similar things by themselves. I strongly believe everyone should know at least a little about LISP.

<comment><USER14> I whole-heartedly agree with your points. The ability to transform programs programmatically is extremely powerful. But, FWIW, I tend to see that as a form of generic programming.

When I think DSL I think regular expressions (especially PCREs) or SQL, where the syntax is tailored-designed for the specific task at hand.

The problem with in-program transformations is that you're still largely bound to the syntax of the host language. That's particularly the case with s-expression. That binding has amazing benefits (e.g. when auto-transforming programs into resumable state machines) but also puts constraints on the language syntax you can employ. That's not a problem when you're dealing with experienced engineers and devising technical solutions, but people tend to stay away from DSLs generally because they fear the burden imposed on others (including their future selves) having to learn a new language, how to use it, and how it integrates within a larger framework. You minimize that burden and make DSLs more cost-effective by maximizing the expressiveness of the DSL in the context of its purpose, and minimize switching costs by making the delineation between the host language and the DSL clear and obvious.

So, for example, in concrete terms you'd generally implement arithmetic expressions using infix notation. You can sorta implement infix notation in LISP, but you still have the s-expression baggage (such as it is; it's obviously not baggage from the expert's standpoint), which among other things makes it difficult to know where the host language ends and the DSL begins.

Lua had a head start on most popular languages with its LPeg PEG parser, which makes it trivial to parse custom DSLs into ASTs. For all the limitations of PEGs[1], they're just amazingly powerful. But to drive home my previous point, while expert LPeg users use the Snowball-inspired pattern where you instantiate PEG terms as Lua objects and build grammars using Lua's arithmetic operators (with operator overloading "a * b" means concatenation instead of multiplication, and "a^1" means repeat 1 or more times), newbies tends to prefer the specialized syntax which uses a notation similar to the original PEG paper and to typical regular expression syntax. (LPeg includes a small module to parse and compile that notation.)

Converting the AST into useable code is another matter, and that's an area where LISP shines for sure. And now that I think about it, the best of both worlds might be a PEG parser in LISP. But I'm completely ashamed to say I haven't use LISP or LISP derivatives.

[1] Yes, implementing left-recursion can be taxing using a PEG. But the syntax is so intuitive and powerful that the alternatives just can't replace it. Regular expressions are limited, too, but they'll never replace PEGs (or anything more sophisticated) because their expressiveness is just too powerful and cost-effective within certain domains. Instead we supplement regular expressions rather than replace them; and if PEGs continue catching on I expect PEGs to be supplemented rather than replaced.

</comment></comment></comment><comment><USER16> The project that affected my thinking the most was a bytecode interpreter[1].

I've had use for that knowledge, nearly fifteen years later - most of the interesting learnings about building one has been about the inner loop.

The way you build a good interpreter is upside-down in tech - the system which is simpler often works faster than anything more complicated.

Because of working on that, then writing my final paper about the JVM, contributing to Perl6/Parrot and then moving onto working on the PHP bytecode with APC, my career went down a particular funnel (still with the JVM now, but a logical level above it).

Building interpreters makes you an under-techtitect, if that's a word. It creates systems from the inner loop outwards rather than leaving the innards of the system for someone else to build - it produces a sort of double-vision between the details and the actual goals of the user.

[1] - "Design of the Portable.net interpreter"

<comment><USER17> Interesting. One thing that I still haven't solved yet is the "break" and "continue" statement inside loops. For a break statement, it seems like it would just be the same a JMP with an address as the operand, but there would need to be some sort of registration of "The VM is in the loop now, and the break address is X", and continue would also be a JMP with an address to the top of the code for the loop.

I haven't implemented those in my system yet, and also have no idea how Python or PHP does it.

Is PHP's VM a stack based one? I do read the Zend/ directory of PHP's source, but it is really hard to follow and there is virtually no documentation on the VM

<comment><USER14> You can implement those as part of a linking phase during bytecode generation: emit a placeholder value (e.g. 0) for the jump address and when you've finished compiling the block go back and fill-in the placeholder with the correct address/offset.

That's relatively easy when implementing an assembler for your opcodes. Just keep track of symbolic labels and their associated jump points (as a simple array or linked list) and process (i.e. finalize or "link") the jump points when the label address becomes known. My "assemblers" often have constructs like:

      L0
      ...
      J1
      ...
      J0
      ...
      L1

where L? registers a symbolic jump destination (i.e. x.label[0].offset = label_offset) and J? emits an unconditional jump and registers a link request (i.e. push(x.label[1].from, jump_opcode_offset)). When a block is finished all the offsets are known; you just process things like

      for (i = 0; i < x.nlabel; i++) {
        for (j = 0; j < x.label[i].nfrom; j++) {
          patch_in_offset(x.label[i].from[j], x.label[i].offset)
        }
      }

Knowing when to emit symbolic label and jump instructions from the AST is a little more involved, but no more than analyzing the AST for anything else.

Supporting computed gotos would require much more bookkeeping, I'd imagine, and I'm not surprised few languages support that construct. Or maybe not... I haven't really thought it through.

One cool thing about this whole exercise is that it helps to demonstrate why generating some intermediate representation can be easier (conceptually and mechanically) than directly generating runnable code in a single pass. It seems more complex but it really makes things easier.

<comment><USER18> Computed gotos defer the search for the label from compile time to run-time. So you need to hash the targets, and then jump to it.

It all depends how your interpreter PC (program counter) works. Some have just opcode offsets (like a real PC, as %eip, e.g. lua, ruby, ..) some have opcode addresses (perl, lisp, ...).

With offsets you can encode jumps relative, which is a huge advantage. With addresses you have to remain absolute, which means the data needs a full pointer (cache), and you cannot move the code around for optimizations afterwards. With offsets you have a cache-friendly op-array, with addresses you have a fullblown tree (AST) or linked list, with its cache-unfriendly pointer chasing overhead.

But with full addresses you can avoid the big switch loop overhead in an interpreter, you just pass around the next pointer instead if incrementing the PC. But then it gets interesting how to keep the state of the stack depth.

</comment></comment></comment></comment><comment><USER17> I saw the matrix after I first implemented a virtual machine. I recommend everyone does it because it will teach you a lot about how code is executed and transformed from the syntax to the actual assembly/bytecode. A stack based virtual machine is so simple it takes a lot of thinking to understand how they work. (or maybe I'm just not that smart).

It's interesting that he implemented function calls via a jump. In my VM a function is just mapped to a name (variable), so functions are first class. When the VM gets to a CALL instruction, it loads the bytecode from the hash table (via a lookup of the name).

Since this is a procedural language where statements can be executed outside of a function, implementing the functions as a jump would be difficult because there would need to be multiple jumps between the function definition and statements that aren't in a function.

I really wish my CS program had a compilers class, but unfortunately they don't, so I had to learn everything on my own.

<comment><USER19> A CS education is incomplete without a semester on writing a simple compiler, and a corresponding emulator for the output for said compiler.

<comment><USER20> I think I agree. I really wish that I'd been walked through The Right Way (or just A Right Way) to write a compiler and bytecode interpreter by a professor. Oh well, it's fun to learn on my own!

</comment></comment></comment><comment><USER21> Nice post! I really enjoy playing around with things like this. It's amazing how little is needed to make a language/interpreter capable of doing virtually anything, even if not elegantly or safely. As long as you can perform calculations, jump around, and implement some kind of stack your language can do just about anything.

I recently threw something together sort of like this, just for fun (I like your interpreter's name better though): [https://github.com/briansteffens/bemu](https://github.com/briansteffens/bemu)

It's crazy how much these little projects can clarify your understanding of concepts that seem more complicated or magical than they really are.

</comment><comment><USER22> This is a required hw assignment for a freshmen class @ cmu. [https://www.cs.cmu.edu/~fp/courses/15122-s11/lectures/23-c0v...](https://www.cs.cmu.edu/~fp/courses/15122-s11/lectures/23-c0vm.pdf)

Given it has some parts already written in the interest of time...

<comment><USER23> What's even cooler, is that after building this VM (for the C0 language) as a freshman, you can come back as a junior/senior and write a compiler for that language in 15-411. It's a very cool way of going full circle.

</comment></comment><comment><USER24> Nice read! Reminds me of nand2tetris that was posted not too long ago [https://news.ycombinator.com/item?id=12333508](https://news.ycombinator.com/item?id=12333508)

(You basically implement every layer starting with the CPU and finishing with a working Tetris game)

</comment><comment><USER25> This reminds me a little bit of my computer architecture class. We started at logic gates in a simulator[1], and worked our way up from there to flip-flops and adders, memory chips, a simple ALU, and eventually a whole 8-bit CPU in the simulator. I want to think that we were even writing assembly for it, loading the programs into the simulated memory, and executing it. It was a great way to get a sense of how everything works, and I think it's when C-style pointers really clicked for me.

[1] this one, IIRC [https://sourceforge.net/projects/circuit/](https://sourceforge.net/projects/circuit/)

</comment><comment><USER26> I've done something similar 21 years ago: a C interpreter targeting a virtual machine. The runtime had a dynamic equivalent of libffi to call into native code and use existing native libraries. I added extensions to run code blocks in threads so that the dinning philosopher problem solution was very elegant. Back in the days, not having libffi meant generating assembly on the fly for Sparc, MIPS, PA-Risc, i386. Fun times. That C interpreter was used to extend a CAD package.

</comment><comment><USER27> I wrote a VM for the 6502 for fun and it was one of most interesting and satisfying projects I've ever made in my free time.

It is very close to a bytecode interpreter, only that it comes with a specification that is actually the opcode list for the MOS 6502 (and few details you need to take into account when implementing that CPU).

Besides there are cross-compilers that allows you to generate 6502 code from C for your specific VM (see cc65).

</comment><comment><USER28> I did this in C#. It was a lunch time project at work a couple of years ago. It was fun. I still want to do a V2 and remove all of the shortcuts I put in because I didn't want to write code for the stack and stuff like that. At the end of the day, my solution was spookily similar to this - the 32bit instructions - well, yeah, I was the same! It was just simpler. I did have a few general purpose registers (V1, V2 and V3 I think) and I did have routines to handle bytes, words and such like. So stuff like this (as a random example I pulled from the source):

ORG START

START: ST_B 10

LOOP: ST_B 10

ADD_B ;;value will go back on stack

LD_B V1

SM_B V1 ;;value we use next loop

SM_B V1 ;;value we compare

SM_B V1 ;;value we echo to console

TRP 21 ;;writes to the console

ST_S '',13,10,$

TRP 21 ;;writes to the console

CMP_B 50 ;;compares stack to the constant

JNE LOOP

ST_S 'The End',13,10,$

TRP 21 ;;writes to the console

END

</comment><comment><USER29> I'm thinking a lot of the complexity of writing a compiler stems from the usage of inappropriate tools. I.e. I would rather kill myself than write a lexer in C (without yacc / bison), but using parser combinators it's a rather trivial task.

Similarly, annotating, transforming, folding, pattern matching on, CPS transforming etc. the produced AST is pretty trivial in a language that supports these constructs. And again, a nightmare in C.

That leaves codegen, but using the right abstractions it turns into a very manageable task as well.

Here's a compiler written in Haskell for LLVM [0].

[0] [http://www.stephendiehl.com/llvm](http://www.stephendiehl.com/llvm)

<comment><USER30> > I would rather kill myself than write a lexer in C

I've written several lexers in C-like languages, it's not that painful. I wouldn't dare write a parser though.

</comment></comment><comment><USER31> Parsers made easy and pretty much interactive:

[http://www.lukas-renggli.ch/blog/petitparser-1](http://www.lukas- renggli.ch/blog/petitparser-1)

[http://www.themoosebook.org/book/internals/petit- parser](http://www.themoosebook.org/book/internals/petit-parser)

This include the dynamic generation of blocks and arrows style things...

</comment><comment><USER31> Soulmate of yours here: [https://clementbera.wordpress.com](https://clementbera.wordpress.com)

Lots of optimizations going on for OpenVM.

[https://github.com/OpenSmalltalk/opensmalltalk- vm](https://github.com/OpenSmalltalk/opensmalltalk-vm)

Interesting bit: VM is written in Slang and transformed into C then compiled.

So you can livecode your VM. In the VM simulator.

</comment><comment><USER32> I did something similar in the distant past, that is I wrote subset of C compiler (functions, standard types, pointers) to imaginary assembler and then bytecode interpreter. It was awesome fun, but also I got so into it my - <USER2> - girlfriend started to question my commitment to the relationship. So be careful, this is really interesting thing to do :)

</comment><comment><USER33> In this same vein, I recommend coding an emulator! It can be an excellent experience.

[http://www.multigesture.net/articles/how-to-write-an- emulato...](http://www.multigesture.net/articles/how-to-write-an-emulator- chip-8-interpreter/)

</comment><comment><USER34> Yes I wrote a parser/compiler and interpreter for a custom domain specific language and it had a similar effect on my career. Lots of fun!

Okay I guess technically I used a parser generator that I then modified to build an AST and convert it into assembly-like code that fed the interpreter.

</comment><comment><USER35> Bill gates also started with an interpreter (basic interpreter). Many parts of early windows applications were developed in p-code and visual basic is an important part of Microsoft success.

</comment><comment><USER36> I like implementing emulators, because the toolchain and architecture specification are all there already. You get to implement what is basically a little embedded CPU.

</comment><comment><USER37> I'd add a driver for a non trivial binary protocol - I ended up implementing a JVM driver for Cassandra a few years ago, and it was a blast.

<comment><USER38> Working with data as binary is a good test of a high level language skills. When I was playing around with DNS, I wrote terrible code like [https://github.com/voltagex/junkcode/blob/master/CSharp/DNS/...](https://github.com/voltagex/junkcode/blob/master/CSharp/DNS/BaxterWorks.DNS.Parsers/Query.cs). A better way to do it is [https://github.com/kapetan/dns/blob/master/DNS/Protocol/Head...](https://github.com/kapetan/dns/blob/master/DNS/Protocol/Header.cs) \- structs, of course.

I'd add reading and implementing a protocol from RFC - it's a great way to start thinking about design, especially if you read the original RFCs and work forward through the revisions and see what was kept vs deprecated.</comment></comment>


Stealing Bearer Tokens with an Angular Expression Injection - <AUTHOR> http://codesploit.com/angular-expression-injection-walkthrough/ <comment><USER2> It looks like this is only possible when we are mixing server side / client side templates? Enter an expression into input, a user hard refreshes and the expression is rendered into our angular template. Are there any good approaches to always scrubbing expression input on the server side (or just avoid the client side / server side template mix?)

<comment><AUTHOR> That is the most common occurrence of this issue. It can also happen with directives that use transclude or if the app is explicitly call Angular's $interpolate function on a user's input.

You should definitely avoid mixing server side and client side templates, but if that's too much work, scrubbing would work. You would need to strip the expression stand and end symbols. Default symbols are '{{' and '}}', but some apps use different symbols to avoid collisions with other template engines that use the double curly brace.

</comment></comment><comment><USER3> I bet there are a lot more production angular apps out there than people think that have this vulnerability right now.

<comment><AUTHOR> From the research I have done, this is a true statement. The reason being is people are adding Angular into their web apps that were initially built with an MVC framework of some sort.

The problem ends up being that they mix server side templates with client side templates. If user input is rendered in a server side template and ends up in an element that is part of the Angular scope, the expression will evaluate. So attaching an angular controller to your body tag and then including server side templates within the body, is bad...

</comment></comment><comment><USER4> Crazy, now to go double check all my angular code

</comment><comment><USER5> This is a legitimate comment.</comment>


Getting a job in San Francisco - <AUTHOR> http://blog.penso.info/2013/05/25/getting-a-job-in-san-francisco/ <comment><USER2> To be honest, this makes me want to get a job in Paris.

The way Fabien describes SF as a Mecca evokes the sense of wonder Woody Allen had about the City of Love:

 _You know, I sometimes think, how is anyone ever gonna come up with a book, or a painting, or a symphony, or a sculpture that can compete with a great city. You can't. Because you look around and every street, every boulevard, is its own special art form and when you think that in the cold, violent, meaningless universe that Paris exists, these lights, I mean come on, there's nothing happening on Jupiter or Neptune, but from way out in space you can see these lights, the cafés, people drinking and singing. For all we know, Paris is the hottest spot in the universe._

There's something nice about being in a city where everyone is one the same wavelength, but I think there's something more romantic about being holed up in a Parisian apartment that's stood the trial of centuries, committing to GitHub with the Eiffel Tower in the window (physical or otherwise) and such tremendous history all around you.

<comment><USER3> ... in a 18 sq.m. "apartment".

<comment><USER4> To be sure, apartments tend to be smaller when and where more activity occurs outside in common spaces.

</comment></comment></comment><comment><USER5> _> When rejecting candidates for my own company I wanted to tell them why I rejected them, and how to improve, but I have been told not to do it, for legal reason._

When the laws prevent you from giving actionable feedback to the person you didn't hire, you know it has gone too far.

The government should have no business in your selection or rejection of new hires, and the firing of them if needed.

 _> I believe the US way to be better_

I don't. It may be less backward bent than France, but there is certainly a lot of room for improvement - like being able to give proper feedback.

<comment><USER6> The government doesn't prevent you from giving actionable feedback to the person you didn't hire, it just gives the person you didn't hire the ability to sue you should you not hire them based on some criteria (race, sex, religion, or whatever their lawyer can argue).

<comment><USER7> I thought the real reason was that if you have a candidate that is, say, Black, and you tell him that you didn't hire him because you "felt that he didn't have enough knowledge of Ruby", he would be able to sue you if he found out you hired someone who supposedly has the same level of knowledge of ruby as him.

<comment><USER8> > "felt that he didn't have enough knowledge of Ruby", he would be able to sue > you if he found out you hired someone who supposedly has the same level of > knowledge of ruby as him.

Except that you felt it because the other candidate interviewed and sold himself better.

The way it is being presented here you could always sue if you're black and the person they hired wasn't. It doesn't really work that way. They do have to provide proof of their claim of racism/sexism or whatnot. They didn't hire me isn't proof.

<comment><USER9> That's right. The rejected candidate can always sue. S/he might not _win_ , but s/he can sue.

And for the employer, win or lose, it's a huge headache, risk and cost, with big PR downside to boot. The employer has no incentive to increase this risk by saying more than is absolutely necessary.

</comment></comment></comment></comment></comment><comment><USER10> I am not from SF and hard for me to believe that a company like Twitter cares about your look more than your technical expertise.

      I will add than Twitter had a specific atmosphere compared
      to other so called startups. The employees seem to be hired
      on more than skills, everyone at their office is very much
      hipster like, beautiful looking, feeling super confident
      and ready to kick it. Walking around Twitter sometimes
      almost feels like walking within a TV show.

<comment><USER11> >cares about your look more than your technical expertise.

In all fairness that's not what he said. Some companies - like google - have a very objective hiring process based almost entirely on technical skill. But many other companies include "fit" as a part of the hiring decision. I haven't interviewed at twitter but I could believe they are like that.

I've thumbed down candidates who did well on the technical part of the interview because I felt I wouldn't get along with them day to day. Not as extreme as "beautiful" people who are "ready to kick it", but more like arrogance or social awkwardness.

<comment><USER12> Has the tech sector really come to the point where coders/geeks can't even be socially awkward anymore?

I thought coding was one profession where socially awkward geeks could make an honest living.

<comment><USER11> Maybe "bad communication skills" is the more precise way of putting it. I work in a very collaborative team that frequently has to communicate with both technical and non-technical people, so being social and at least somewhat friendly is pretty important. Most tech people are a little socially awkward so getting rejected for it really says something.

I think people with poor social skills can thrive in tech, but in a more internally facing position like pure development or testing.

</comment></comment></comment></comment><comment><USER13> Excellent post, thanks for writing it. The viewpoint of a French developer probably resonates with anyone from Europe.

> _You'll see an immense amazing positive atmosphere everywhere, people > working day time for a normal job and coding on evenings in coffee places, > trying to work on their latest idea. They might even raise a few millions > dollars on it, really._

I completely appreciate this - it's an amazing cultural difference.

</comment><comment><USER14> I don't buy this. For me, the biggest problem in SF is that it is in US. Ever when I'm in that country I feel like I'm home. The politics, the crooked police, the expensive life... I don't want to be part of it. I really love Europe. This is my home continent with different countries and different people. I love to write code and I can get a pretty decent life also in Berlin. The weather is not so nice, but the city atmosphere really feels welcoming. And not all interesting challenges are in SF, believe me.

<comment><USER15> Know that feel. I am from Canada (which is probably closer to US culturally than Europe) and having been here for 5 years, I am really really home sick...

</comment></comment><comment><USER16> Interesting read. Does anyone have recent experience in obtaining a Green Card? I'd be interested to know how long it takes on average, transitioning from an H1-B visa.

> _Mecca for Software Engineers, the only place in the World where the guy in > front at Starbucks has big chance to be Software developer._

I'm a iOS developer and I love software, but this was one of my main reasons for leaving SF.

<comment><USER17> Depending on your educational background and working experience, you go into one or another category. Most people here will fit in EB-3, EB-2 and EB-1. If you are in EB-1 you can get it in about a year; in EB-2 you can get it in two years unless you're from China or India; in EB-3 you can probably get it in seven years, unless you're from India.

</comment></comment><comment><USER18> > But being rejected by a team because you're not a fit doesn't mean you can't > try another within the same company, if the company is big enough (Apple, > Google, etc).

Google's teams don't hire; Google hires (teams aren't even able to influence the process, by design) -- then you get placed on a team.

<comment><USER19> > Google's teams don't hire; Google hires (teams aren't even able to influence > the process, by design)

Not quite.

While the generic SWE / new grad process is close to what you describe, individual teams and managers regularly exert a non-zero amount of influence: in screening and routing candidates, recommending the interview slate, getting the packet to hiring committee, and bidding on a candidate once an offer is made.

It's also common for more specialized groups (such as Platforms) to have their own HC.

</comment></comment><comment><USER20> This is a very well written piece with lots of good advice. Thanks a lot for writing this.

<comment><USER21> > This is a very well written

It may contain some interesting points, but it is obviously written by an ESL writer.

<comment><USER22> That's international English (lingua franca).

I find it fun when native speaker complain about ESL speakers, since in the end it is likely that international English will win.

I live in a non-English speaking country, the common language in the office is international English (there are 60+ nationalities, and less than 20% are native english speaker). It would be fun to track over time if the native speakers start speaking international english :)

</comment></comment></comment><comment><USER23> As a junior web developer currently looking for my first full-time job programming in San Francisco, this all rings very true, and is a great summary of the job-hunting experience in the city. In my experience, referrals helped more than in the original poster's experience. Usually a referral skips me ahead to step 3 in the process (as laid out in the post).

</comment><comment><USER24> What is the most important thing and what the article pointed out greatly is the need for the green card, without it, your life becomes incredibly dependent on your employer (unless you remain flexible).

I'm going to college in the US, but am from Germany, and what makes me reluctant to plan a future in the US, is the requirement for me to bind myself to a company for in worst case 10+ years to have the certainty that I can stay in the US, should I chose not wanting to be employed.

Aiming to be a freelancer or entrepreneur becomes next to impossible if you want to stay in the US without a green card. At least to my knowledge, I'd be happy to be wrong in this case.

</comment><comment><USER25> _"French will note US companies don't pay much tax on salaries like they do in France, what could make you think is a lot of money isn't. Your French salary costs 40% extra to your company, but not in San Francisco."_

Not really the case. Taxes + benefits can easily add up to that much. General rule is it costs 150% of a salary to employ someone in the US. Much of what might be lumped into taxes in other countries is just paid for separately (such as healthcare), but the overall cost of the employee sounds like its about equal.

</comment><comment><USER26> Would love to also see a follow-up piece about getting a job in Paris

<comment><AUTHOR> Well there is a huge difference. As a Software Engineer you want to work in San Francisco because it's where your job happens.

In Paris, nothing happens on that level. If you do want to come to Paris it's because of the amazing food, lifestyle, public transportation system, and certainly not because of the amazing startups we should have.

<comment><USER27> Not to mention working in Paris is like working part time here. 35 hour weeks!!! Mandated by law too. Of course this might also be why there isn't a vibrant startup culture.

<comment><USER28> Companies can easily workaround the 35 hours week with the "cadre" status that basically nullify the regulated hours constraint, and they do.

I don't know any developer in Paris that do a 35 hours week. Actually it's even the contrary, French managers have a strong culture of evaluating employees performance based on presence. So you see a lot of peoples doing 10-12 hours a day, or coming back to the office on saturday.

<comment><USER29> This. I don't know any french developer not being on a day rate instead of an hour rate. An awful lot of people on an hour rate have a number of extra hours factored in their salary by default.

It's still better than the US, "cadre" status (but not top management) is officially around 180-190 day of work per year (depending on the unions).

</comment></comment></comment></comment></comment><comment><USER30> Although this is written for French developers looking to come to the US, I found it interesting as a window into what things are like in France. Thanks for writing it!

<comment><USER3> AFAIK salaries are rather low there, but cost of living is quite expensive.

<comment><USER31> That is not only in France, it's in all Europe. Salaries in Germany, The Netherlands, UK and so on are much much lower than in SF or NY. Developer jobs that pay more than 60k euro are few and far between. A 50k+ job is already above average and upgrading is not going to be easy.

<comment><AUTHOR> The difference is, Europe see developers as commodities. They don't care, they don't need them as much as they do in San Francisco.

San Francisco see developers as the only way to achieve their project they just raised 10 millions for. You're gold to them, they accept to pay a higher price.

In Europe most young developers want to be Product Manager (or any Manager positions), most developers in SF don't care about this, they want to have fun. The reason could be you get paid super well in SF, and not in Europe :)

<comment><USER32> Exactly This. MBA's aren't a joke in EU. They are actually taken seriously..

<comment><USER31> They aren't a joke in the US or the rest of the world either. It's only in certain circles that they're not valued. There's plenty of companies where an MBA from a well-known university is a passport stamp (and prerequisite) to a high paying job.

</comment></comment></comment></comment></comment></comment><comment><USER33> I read this blog post with a french accent in my head.

</comment><comment><USER34> Where do these salary numbers come from?

<comment><USER35> I have to agree, 150k for senior engineer? I would say 100-120k for senior engineer, 75-100k for engineer, 50-60k for intern.

<comment><USER36> For the Bay Area these days, those numbers seem about right. Big companies pay 100k to new grads

<comment><USER37> Seconded. Engineering salaries have jumped significantly recently. With 2 years experience out of college I've seen people getting offers of 120k - 140k.

</comment></comment></comment></comment><comment><USER38> What's wrong with Parisians?

<comment><USER29> Basically, they were hipsters before it was cool.</comment></comment>


NSA leaker Edward Snowden 'accepts asylum in Venezuela'? - <AUTHOR> http://www.news.com.au/technology/nsa-leaker-edward-snowden-accepts-asylum-in-venezuela/story-e6frfro0-1226676844160

<comment><USER2> As a European, I'm utterly and totally ashamed that _nobody_ here actually offered him asylum. None.

This lack of action speaks so very clearly that whatever nasty the US is doing now, entire Europe is in on it already. Sans the actual European people under total surveillance ofcourse.

It seriously makes you wonder what's going on behind closed doors in European governments and EU offices. It can't be good, and it needs to be rooted out pronto.

<comment><USER3> Europe is no longer an independent entity, it's more and more becoming the colonies of the US. We have very real facts that make this obvious:

1\. the President's plane incident

2\. the absence of honest outrage on the part of EU politicians regarding all the recent news

3\. the direct surveillance collaboration with the NSA

4\. the fact that the NSA is allowed to build multi-billion surveillance centers in Germany

5\. refusal of help to Edward Snowden

Please add your observations to this list.

<comment><USER4> Europe has not been an independent entity since the end of WW2 and the beginning of the cold war.

Unless you think that is normal for a country to have permanent military bases of a foreign power in its own territory.

I'm not judging or complaining, it's just the way it is. At some point in history, decisions were made about Europe's own place in the world that put it under US sphere of influence, and these decisions have important consequences to this day.

It can be argued that European countries traded part of their own sovereignity in exchange for security, protection and economic progress.

<comment><USER3> > Unless you think that is normal for a country to have permanent military > bases of a foreign power in its own territory.

Correct, that and the NSA infrastructure on European soil has to vanish.

<comment><USER5> > Correct, that and the NSA infrastructure on European soil has to vanish.

The odds of either of those things occurring are perilously near zero

<comment><USER3> Don't take this personally (you're in good company...):

We need to STOP saying:

1\. "I'm so not surprised"

2\. "That has zero chance of happening"

What we NEED to do is:

1\. Think about things we CAN do

2\. Find others to EXECUTE these things

3\. TALK about this action

Anything else is just demotivating people. And that will only make things worse.

EDIT: To the downvoters - that's exactly what I'm talking about.

<comment><USER5> OK, we can widely adopt encryption and use alternets whenever possible, and attempt to affect technological activism. That is feasible and should be done as swiftly and as widely as possible. Evangelize these measures to the less technically inclined people in your life.

But as far as "removing" US military and intelligence presence from Europe - that will literally never happen, as all of Europe is entirely complicit in our presence and information gathering activities.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> At this point, Snowden is a pawn in an international strategy game. None of these countries are offering Snowden asylum because they believe in his cause. They are offering him asylum because it is something that they can use against the United States (for unrelated contentions) and use as a political trophy within their own countries.

As such, Snowden has to worry about many scenarios. Will his "host" country use him to extract concessions out of the United States in exchange for his extradition? When the regime changes in the country he ends up in, will he wear out his welcome? Can the country he ends up in even protect him from extraordinary rendition? Even if the country fully intends on assisting Snowden, would it be able to weather whatever sanctions were levied on it by the United States in the form of trade restrictions? Ecuador didn't seem to think so.

Then there is the question of whether he can even get to the country he is going to. France and Spain (indirectly) forced down the jet of the president of Bolivia on the rumor that Snowden was on the plane. There is no reason to expect that they and other European countries won't do so again. Routes from Russia to Cuba (assuming he has to use Havana as a stop) also typically fly over the United States. The United States is free to, if not directly force the plane down in the United States, not grant it permission to fly in U.S. airspace, effectively forcing it to land in a U.S. friendly country (Canada). And Cuba might simply hand him over to improve U.S. relations. My understanding is that small private jets simply do not have the range to go directly from Moscow to any of the countries listed (perhaps Venezuela would be just within reach).

At this point, though, I don't really see what option Snowden has but to take Venezuela's asylum offer and hope for the best. He is on a small boat on the ocean in a raging storm. His fate is not in his own hands.

<comment><USER7> _When the regime changes in the country he ends up in, will he wear out his welcome?_

This is a reasonable question, but not sure the word 'regime' is warranted. If you're talking about Venezuela then that's a democratically elected government.

<comment><USER6> I didn't mean for the word to have a negative connotation. The word "regime" is a useful as it covers both the current administration and the system itself. So it would cover both a change in the elected leadership and, say, a new form of government installed by a coup or revolution.

<comment><USER8> would you have used the same word in reference to the USA?

<comment><USER6> I would not because I (and any reasonable person would) consider the odds of a change of the form of government itself in the United States to be so remote to not be worth mentioning. In the case of Venezuela, their constitution is only 13 years old, Nicaragua's is 26 years old, and Bolivia's is only 4 years old. The systems in these countries frequently change and are likely to do so again within Snowden's lifetime.

<comment><USER8> And Spain's constitution is not even 40, yet nobody called our government a regime - not even in the 80s. It carries a connotation you're probably not willing to admit.

</comment></comment></comment></comment></comment></comment><comment><USER9> I'm just gonna post a previous comment I made on another story regarding this:

\</comment><comment></comment><comment></comment><comment>----

I wonder why in the Venezuelan government's eyes it's OK for them to constantly monitor and record every call, email,etc made by their political opponents.

I wonder what would happen to an officer of the SEBIN (venezuelan inteligence agency)if they came out with details about how they record every political opponent movement. I wouldn't be surprised if they ended up being just another statistic in the homicide rates.

They even had a late night TV show (La Hojilla) where a guy would play back cell phone recordings and emails of the opposition politicians.Live. On TV. He had carte blanche to insult,record anyone he wanted live on TV. Chavez would often call in to the show to congratulate him.

They even had a Congress session where they played recordings of the cell phone calls of the most prominent opposition members and their family. And that was live on TV again!

Hipocrysy at it's best.

\</comment><comment>---

These governments are not "fighting for freedom" or for the privacy rights of the people of the world. Many of these governments would sell their mothers to have a PRISM-like system. Venezuela included.

EDIT: when I talk about hipocrisy, I'm talking about the venezuelan govt, not Snowden.

<comment> grey-area _These governments are not "fighting for freedom" or for the privacy rights of the people of the world._

Given his published views on surveillance I'm sure Snowden would agree. I highly doubt Venezuela is his first choice for asylum, or anywhere close to it. He doesn't have a lot of choice at this point if he wants to stay out of the reach of the CIA. I doubt he'll stay there long, even if he wants to, but it might be a useful step on the way to another country.

I wouldn't be surprised if he eventually volunteers to come back to the US for trial, but he might be waiting until there have been enough disclosures of government wrongdoing, and enough public outrage, that the Obama administration wouldn't dare trying to sequester him and prevent an open trial.

Why is fighting for freedom in quotes here?

[EDIT] To add a couple of minor points:

hipocrysy -> hypocrisy

Is this the story you mean?

[http://boingboing.net/2013/07/08/snowden-and-venezuela-my- bi...](http://boingboing.net/2013/07/08/snowden-and-venezuela-my-biza.html)

It's a good read, and covers in detail the kind of abuse of surveillance they have in Venezuela - what's interesting about this is that it cuts both ways. While you might say it shows Snowden to be hypocritical (though I'd argue he has no good choices here), it is also a perfect illustration of the dangers of pervasive surveillance, and the way it undermines our everyday democracy. It would be so easy to use surveillance to investigate and harass political opponents, and in the US or UK we wouldn't even know it is happening, we'd just read about the embarrassment of a politician over an affair or similar peccadillo, without knowing how the press came to be informed.

<comment><USER9> Thanks for that article it's a very interesting read, and I wasn't aware of that case.

There are many, many cases like this. And they don't even try to hide it or pass it as leaks. Even recently there was a recording presented by the Information Minister himself, which was taken in somebody's home. This means they had to break in to the house and place bugs.

When I say hypocrisy ( thanks for the correction) I mean the Venezuelan government, not Snowden. I support what he did and right now he cannot be picky as to where he goes to be safe.

That's the reason why I put "fighting for freedom" in quotes. The Venezuelan govt keeps making statements saying that it's our duty to protect Snowden for the freedom of the world. It's just that in their eyes, those that oppose them don't have right to that freedom.

</comment></comment></comment><comment><USER10> OT: But I'm curious why the article has to define the countries who offered asylum as leftist:

> "...the leftist governments of Venezuela, Bolivia and Nicaragua...."

This implies the asylum was extended because they are leftist as appose to other reasons, such as these countries felt rebuffed by US for forcing down the flight of the Bolivian president, or purely on humanitarian or other reasons.

<comment><USER11> To me "leftist" has certain idealogical connotations, as in trying out a particular system of government that emphasizes strong and omni-present governmental control (like the USSR, for example).

In my opinion the countries listed are not leftist, they are simply very, very corrupt with very poor law and order and poor government accountability and democratic in name only.

I don't think they are "leftist"; they are just very corrupt and the majority of people are powerless to change it because criminal and military elements are opposing them.

<comment><USER12> Your definition of 'left' and 'right' in politics is quite simply just wrong. Both left and right can descend into state control just as easily. Fascism, for example, is a far-right ideology.

I also don't know why you think Venezuela is less democratic then many other N Hemispheric countries. But having no comparison with which to judge I don't know how corrupt a country needs to be in order to register as 'very, very corrupt' on your radar.

<comment><USER4> To his credit, he did not say that all ideologies where heavy government presence is prominent are left-inspired.

He said that the word "leftist" implies certain characteristics, among them heavy government presence.

I struggle to think of a real-life example where this is not the case.

<comment><USER13> A few anarchist communes existed in real life, at least for a while.

</comment></comment></comment></comment></comment><comment><USER14> That's quite a bait-and-switch of a news article. The headline claims something, and then the article body says that, actually, they have no idea if their headline is correct or not, and their only sources were a deleted tweet and another tweet making vague reference to an apparently nonexistent newspaper article.

<comment><USER15> Well, the deleted tweet was from someone who ought to know, it claimed to reference a report on a Russian 24 hour news channel, not in an article, but it's still suspicious that this isn't on their website. OTOH, Snowden accepting asylum in Venezuela, wouldn't be particularly surprising, since that's where he was originally headed.

</comment></comment><comment><USER16> If the Venezuelan government really wanted to be nasty, they could arrange for Snowden to be assassinated in a manner that implicates the US government.

<comment><USER17> No way.

Much better for the GoV to keep Snowden alive and "WikiLeak"-ing.

I think the damage these leaks do to the US is generally underestimated. Not just in terms of security, but also politically and economically. It's VERY likely that a great deal of damage will be done economically over the long term.

Frankly, I wouldn't even be surprised to see a lot of these Latin American nations begin capitalize on that economic damage over the long term.

This whole NSA Affair will prove to be bad business all the way around.

<comment><USER18> That is a lovely theory except for the fact that virtually every government is doing the same.

</comment></comment></comment><comment><USER19> Snowden's future is clear. He will be forgotten like ... Bradley Manning. The latter is currently on trial. Nobody cares any more.

</comment><comment><USER20> So now he has to get there...?

Maybe they could have a frigate on a "far northing training excerise". He could then fly by helicoper to the ship. Interdicting a home bound passenger jet is one thing (esp. as they need fuel). Interdicting frigate in international waters is a another ball game. But yeah, I'm probably far into the realm a fantasy here:

[https://en.wikipedia.org/wiki/File:ARV_General_Sal%C3%B3m_%2...](https://en.wikipedia.org/wiki/File:ARV_General_Sal%C3%B3m_%28F-25%29_y_ARV_Mariscal_Sucre_%28F-21%29_-_1987-09855.jpg)

<comment><USER21> "Moscow - Barents Sea - Windward Islands - Caracas" interesting article in Spiegel Online today. They have a map of the potential route and other suggestions. For example: He could travel as diplomatic baggage. Sounds crazy, but there are at least two cases where this has been tried. Both cases were unsuccessful but if they were we probably wouldn't know about them.

Original (in German):

[http://www.spiegel.de/politik/ausland/asylgesuch-von- snowden...](http://www.spiegel.de/politik/ausland/asylgesuch-von-snowden-in- venezuela-moegliche-reiseroute-a-910213.html)

Translate:

[http://translate.google.com/translate?sl=auto&tl=en&js=n&pre...](http://translate.google.com/translate?sl=auto&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.spiegel.de%2Fpolitik%2Fausland%2Fasylgesuch- von-snowden-in-venezuela-moegliche-reiseroute-a-910213.html)

</comment></comment><comment><USER22> This starts to sound a bit like John McAfee's story. Better make sure any journalists don't forget to remove geotags from photos!

</comment><comment><USER23> Pardon me if I'm being ignorant, but what was the american people response to the whole "government is spying on us" thing?

I thought there would be huge protests and pressure for a response from the president, and promise to cut back on... spying on people.

</comment><comment><USER24> Is it absolutely certain he's even in Russia? Couldn't he have left Hong Kong on a freighter bound for South America weeks ago? It would explain why nobody has seen him since he disappeared in HK.

</comment><comment><AUTHOR> Tweeted by the Chairman of the Foreign Affairs Committee of the State Duma: [https://twitter.com/Alexey_Pushkov](https://twitter.com/Alexey_Pushkov)

<comment><USER25> Google Translate gives me: " _According to News 24, with reference to Maduro, Snowden accepted his offer of asylum. If so, it is found that the safest option_ "

So who is News 24?

<comment><USER26> It's "Vesti.ru", [http://www.vesti.ru/doc.html?id=1102569](http://www.vesti.ru/doc.html?id=1102569)</comment></comment></comment>


A fifth of adults have forgotten how to do fractions or percentages - <AUTHOR> http://www.theguardian.com/education/2016/mar/07/a-fifth-of-uk-adults-have-forgotten-how-to-do-fractions-or-percentages-mathematics-english-science <comment><USER2> Recently talking to a student of Electrical engineering in Australia I was dumbfounded when he failed to answer simple divisions like 95/2 or 80/3.

It is saddening that the newer generation is relying on calculators and phone. I remember back at my school in India I used to spend time calculating tremendously complex problems in mind. I always argued that it takes more time to fetch the calculator then come to an answer.

I have seen this everywhere petrol stations, McDonald, labour jobs where people are now relying on machines to tell them my change.</comment>


Seattle's Idiotic Tax on Amazon - <AUTHOR> https://reason.com/archives/2018/05/17/the-seattle-head-tax-is-idiotic <comment><USER2> Wow, a bunch of angry people but no reasoning behind calling it idiotic.</comment>


Why we decided to accept BitCoins on our site and you should too - <AUTHOR> http://myapptemplates.com/why-we-decided-to-accept-bitcoins-on-our-site-and-you-should-too/

<comment><USER2> As pro-cryptocurrency as I am, this still reads like a poorly disguised advertisement written by someone on fiverr.</comment>


Firefox enables deprecated Fido U2F Support for Google Accounts - coffee-- https://groups.google.com/d/msg/mozilla.dev.platform/q5cj38hGTEA/lC834665BQAJ <comment><AUTHOR> Damn shame to see the internet move backwards because Google refuses to use the standardized APIs.

Edit: Usually HN is so angry about Google not following web standards but everyone in this thread seems to be in favor of Google trampling the WebAuthn standard. Weird.

<comment><USER2> What sites could you sign into with a cryptographic second factor before Google launched U2F? All that was out there were easily-phishable TOTP tokens. Now you can register a security key and use it as a second factor on desktops and phones. It's pretty impressive, though unfortunate that ultimately the industry picked a similar-but-different standard.

What sites currently let me authenticate with WebAuthn? (Github still uses U2F, it seems.)

<comment><USER3> Dropbox uses WebAuthn. They are, as far as I can tell, the most significant site using it currently.

<comment><USER4> Microsoft also supports passwordless login, the "novelty" of FIDO2. I just found it out yesterday reading this article [1], page 3 (it's in German).

Disclaimer: I make the Solo key that's mentioned in the article.

[1] [https://www.golem.de/news/fido-sticks-im-test-endlich- schlec...](https://www.golem.de/news/fido-sticks-im-test-endlich-schlechte- passwoerter-1903-139953-3.html)

</comment></comment></comment></comment><comment><USER5> Would be nice. Even with the experimental settings turned on in about:config, I could only _read_ input from my Yubikey, I couldn't add one. I had to install Chromium just so I could add my Yubikey to my Google account.

<comment><USER6> This is mentioned as a side note in the first comment of the Firefox issue: they were explicitly whitelisting the "Sign" operation so that registration didn't work.

</comment></comment><comment><USER7> This is good. It's been working with FastMail for months so I'm not sure what the problem was.

<comment><USER8> From what I understand:

* FastMail has implemented WebAuth, the newer standard, which Firefox supports

* Google hasn't implemented WebAuth because they have to(?) wait for the end-of-life of old Android devices.

* Firefox is going to put an override so that you can use the old standard on Google accounts, which Google does support.

It sounds like Google's slowness to enable WebAuth is a somewhat legitimate issue of backwards compatibility for old devices, though I haven't personally evaluated it.

<comment><USER9> FastMail is still using the old FIDO U2F API; we've been planning on migrating to WebAuthn since it was finalised, but investigation revealed that the migration would not be entirely straightforward (especially if tokens registered with WebAuthn needed to still work with U2F, which at the time was important but could probably now be skipped), so we deferred it, since the U2F support is adequate for most users. I expect this is the experience with many small teams that support the FIDO U2F API. Documentation on migration is difficult to come by; I think [https://www.imperialviolet.org/2018/03/27/webauthn.html](https://www.imperialviolet.org/2018/03/27/webauthn.html) is the main source I've encountered.

<comment><USER8> Thanks for the clarification.

</comment></comment></comment></comment><comment><USER10> Not a web dev. Is there a way to force U2F with firefox for google accounts? The lack of (obvious) U2F support in FF for Google accounts is one of the things holding me back from switching back to FF from Chrome.

<comment><USER4> Note that if you enable 2fa with Chrome, then you can log in with Firefox. Just adding/removing keys (in Google) doesn't work.

<comment><USER11> Yep, I've just been through this process on both personal and work Gsuite.

They've changed the message in Firefox to make it a little clearer this is how to do it.

</comment></comment></comment><comment><USER12> Does this mean I can finally use my Yubikey in Firefox on Linux as my second factor authentication with my Google accounts?

<comment><USER4> Pretty sure you can already use it. You can't _register_ it currently.

<comment><USER13> I can confirm this.

I'm also curious if anyone in this topic has advice for how to make U2F a habit. I posted [https://news.ycombinator.com/item?id=19316509](https://news.ycombinator.com/item?id=19316509), but didn't get anything. :(

</comment></comment></comment><comment><USER14> For all the hooks Google has into nearly every Android device through Google Play, I would've thought the one party burned in ROMs wouldn't be a problem for would be Google.

</comment><comment><USER15> If you're on Linux, you'll want u2f-hideaway-policy installed to avoid permission issues.

[https://github.com/amluto/u2f-hidraw- policy](https://github.com/amluto/u2f-hidraw-policy)

<comment><USER13> Is this necessary for newer installs? Pretty sure the titan keys and the yubikey I have worked without any special setup on the latest ubuntu.

<comment><USER15> AFAICT Ubuntu uses a big hack that maintains a list of known U2F tokens rather than detecting whether the device speaks the U2F protocol. u2f-hidraw-policy does the latter, so it's forward compatible.

I should get it into upstream systemd.

</comment></comment></comment><comment><USER16> Does this make Ledger Nanos work on Firefox now?</comment>


GORILLA.BAS - <AUTHOR> http://hem.passagen.se/hedsen/prg/games/gorilla.bas

<comment><USER2> Yes! I played this as a kid. Until then, I didn't realize such things were possible with QBasic. From that point, I wanted to make my own game. I remember looking at the source code and thinking I'd never be able to figure out how a program that long works.

It's funny how trivial it looks now.

<comment><USER3> Did you know Ken Silverman actually prototyped algorithms for the Build engine in QBasic before porting them over to C? He must have found it easier to work in.

</comment></comment><comment><USER4> Hmm. Nibbles.bas and gorillas.bas are probably the main reason why I'm a programmer today.

<comment><USER5> Some of my fondest middle school memories are of hacking NIBBLES.BAS to add support for dropping mines. Nothing like the addition of weapons to spice up a game.

<comment><USER6> Me too. I added a 3rd snake that was black and controlled by the computer. Also made it so the levels wrapped so if you went off one edge you appeared on the other side. The unintended consequence was you could get into the scoreboard and eat your own score numbers!

</comment></comment></comment><comment><USER7> Related: A fun story about DONKEY.BAS [1] told by Andy Hertzfeld exists where he reminisces about comparing an 8088 with the Macintosh project and how they were disappointed at the lack of ingenuity.

[1] <http://www.folklore.org/StoryView.py?story=Donkey.txt>

</comment><comment><USER8> Wonder how many people here got interested in development because of spending time poring over GORILLA.BAS and NIBBLES.BAS? I know it was my first exposure to source code, and the ability to create your own game.

Sad that MacOS/Windows no longer includes any simple source code for curious explorers to discover.

</comment><comment><USER9> Gorilla.bas is okay, but if you're going to load up nibbles.bas please fix the bug where the number permanently disappears if the Pause dialog covers it. Thanks.

(Also, the block-drawing character tricks in Nibbles were rather neat little affairs.)

<comment><USER10> You might like Steve Hanov's qb.js, complete with Nibbles pre-loaded!

<http://stevehanov.ca/blog/index.php?id=92>

<comment><USER11> Atwood law in full swing!!!' awesome

</comment></comment></comment><comment><USER12> If you just want to go ahead and play it, Gorilla is re-implemented in flash ready to run in the browser at:

<http://www.kongregate.com/games/Moly/gorillas-bas>

<comment><USER3> If there was ever a game that needed an HTML5 recreation...

<comment><USER13> I think QBasic.exe is smaller than adobe.com's favicon

</comment></comment></comment><comment><USER14> I didn't remember that you could do graceful degradation with qbasic :p

        'This is a clever way to pick the best graphics mode available
        ON ERROR GOTO ScreenModeError
        Mode = 9
        SCREEN Mode

</comment><comment><USER15> Does anyone have a copy of the original QBASIC NIBBLES.BAS source?

<comment><USER16> Here <http://ge.tt/9aOwYN9?c>

</comment></comment><comment><USER17> Oh this brings back memories of my 386!

Probably one of the first open source programs I used , before I even knew what open source meant.

</comment><comment><USER14> Unfortunately, it does not work on qbasic emulator at <http://repl.it/>

</comment><comment><USER3> Upvoted the moment I saw the title :)

</comment><comment><USER18> Genuinely curious about the reason why this is oh HN's front page. It's a gorilla.bas, how is this news? Or am I missing some detail here?

<comment><USER19> nostalgia?</comment></comment>


Living the lonely solopreneur life? Why not try co-working? - <AUTHOR> https://medium.com/im-a-freelancer/25ba8109839b <comment><USER3> Is it me, or is there absolutely no "depth" in these medium articles?

This content isn't any more thought provoking than the content you find in any mainstream magazine at an airport kiosk.

<comment><USER4> That stupid, unrelated supermodel picture on top was the first signal, and to be honest I stopped reading about halfway through. Reminds me of this piece:

 _The Problem With Medium: A Shiny Content Farm is Still a Content Farm_

[https://medium.com/writers-on- writing/336300490cbb](https://medium.com/writers-on-writing/336300490cbb)

</comment></comment><comment><USER5> I would, if'n all of the places in my area were more interested in helping people in the long run rather than extracting every last dollar out of them in the short run. I can't really justify taking on the equivalent of an _expensive car_ payment, when I'm in need of taking on an _actual_ car payment.

ME: "How do you justify these rates, for packing 50 people in this space, when I could just get 5 of my friends together to split the rent on the same size of place for this much?"

THEM: "Well, we plan on eventually offering billing and front-desk phone services."

ME: "So you don't offer them now?"

THEM: "No."

ME: "And yet you're still charging for it?"

THEM: "No, it would be free."

ME: "TANSTAAFL".

Note that I actually am in the processing of getting said 5 friends together to split a place. I'm just going to make a community "workshop" style place, let people use it as they see fit, charge a nominal fee to keep the bills paid, and have myself an office in the process.

<comment><USER6> I'm considering a similar thing. Do you know of any resources on do's and don'ts when setting something like that up?

<comment><USER7> Do's: forget about it. Don't: actually go through with it.

Running a co-working office is not just leasing an apartment, giving 5 people a key to it and ping them once a month to deposit 200$ in your account or the cookie jar on the kitchen table. I've watched this happen from fairly close twice now, and here is a selection of what is involved:

\- Internet/telephony. One residential internet point with a wireless router isn't that big a deal, granted, especially when the people working there are tech-savvy. But you very quickly get to the point where somebody needs a fax (government contracts yay!), a reliable line to Skype while that other guy is pulling in a new Redhat iso ('DD-WRT can do that!' sure, if your time is free), needs a way to have phone calls go to an answering machine, or if you need to decide on a system who will answer whose phone when people have varying work schedules. Everybody cell phone only, no-guarantee internet - <USER2> probably works in some circumstances, sure, but you hit the limit sooner than you think.

\- Rent is not the only cost - you need to divide electricity, water, municipal taxes, garbage costs. Can easily add a double-digit percentage to the base rent.

\- Who's going to do the cleaning? Put out the garbage? Call the land lord when the toilet is clogged? Answer the door for that client that you thought was coming at 9h30 but came at 9h (happened to me this morning)? You can pay somebody for all of this, but it'll add to the cost. Some people will want to do it themselves, others will want to pay somebody - now what? Resentment creeps in easily.

\- One person decides to get a regular job, or to go on holidays for 3 months, or doesn't make enough to pay rent. Now you have to scramble to fill that spot, or jack up the price of the rest. If you're connected enough that sending out one email will provide you with enough reliable candidates, great - otherwise enjoy spending an afternoon posting ads online, showing people around, interviewing them to at least have the impression that they won't rob you or leave you high and dry with the bill after 3 months.

\- Or somebody wants to hire a secretary or other staff. Now what? Labor law rules, higher and more insurance, parking issues, and no more 'I can just leave my wallet and 2000$ laptop here cause I know and trust everybody', that's what.

All in all, what you can save over a commercial co-working arrangement (which, yes, are expensive) is in using hobby-level equipment (no Cisco switches and IP phones, only the cheapest from Newegg, and Ikea over Aeron); and the profit they make. That profit isn't all that huge, although in a small team you do have the advantage of being at full capacity as long as you have tight arrangements. Co-working spaces go bust all the time, not because they're so expensive, but because doing enough business for economies of scale to kick in is hard in a space that doesn't require much except capital to get into. So in my experience, you can bring the cost down from 500-700/month to 300-400/month plus depreciation of the chair and desk.

<comment><USER5> This is true if you make it a business. If you make it a cooperative non- profit, I think it makes a lot more sense. The rule of the land should be "for the members, by the members". I, being one of the members, want it for office space to do other things. It's important to still do those other things and not let management of the space take over.

Standing something up is always going to be hard, but given my experiences with cooperative workshops, it's worth the effort on its own.

</comment></comment></comment></comment><comment><USER8> > As a freelancer, it is possible that you could stay cooped in your bedroom > for days in your pajamas, staring at your laptop screen, trying to finish > that oh-so-important project for your irate client. You could go for days > without meeting a human soul or even talking to anyone.

> A life of such isolation is detrimental to mental health and well-being, and > eventually leads to serious health problems like depression and anxiety.

As an employee, it is possible that you could stay cooped in the office until 11:00 pm every night, staring at your laptop screen, trying to get everything done for that oh-so-important release. You could go for days without meaningful interaction with a human soul or even talking about something other than code.

A life of such isolation would be detrimental to mental health and well- being...if it wasn't for the fully-stocked fridge, ping pong table and knowledge that your stock options will one day be worth millions.

</comment><comment><USER9> We're a self-funded, boot-strapping startup, so conserving cash is pretty important to us. I could pay to use a co-working space, but the value just doesn't seem to be there for me. When I want to be around other people, I go work at the cafe at Barnes & Noble near my apartment, or at SplatSpace (hackerspace in Durham), or Beyu Cafe (a popular restaurant in Durham, which is popular with the startup set here), or something of that nature.

When co-working space would be valuable to me, would be when we start needing a private space for meetings (ie, a conference room) on a relatively frequent basis. And even then, I'm not sure we couldn't come up with a better arrangement. Depends on how much the local co-working place is charging and what kinds of models/plans they have in place.

</comment><comment><USER10> I dealt with the loneliness by holding my own mini-incubator inside a co- working space. It ran for one month as an experiment and I have mixed feelings about it. Post about the experience here:

[http://edu.mkrecny.com/thoughts/not-having-a-real- job](http://edu.mkrecny.com/thoughts/not-having-a-real-job)

</comment><comment><USER11> Co-working spaces don't solve this on their own, as its just as easy to be lonely when you're in an office and everyone around you is caught up in running their own business. Its more about how the space can facilitate conversations between people.

</comment><comment><USER12> Solopreneur? I remember 'entre' from French class, but most have slept through the session in which they covered the preposition 'solo'. Or is it a solocism?</comment>


Google killer-robots.txt - <AUTHOR> http://www.google.com/killer-robots.txt <comment><USER2> I find Google's techie Easter-eggs like this delightful.

My favorite, by far is: [http://www.google.com/#q=recursion](http://www.google.com/#q=recursion)

<comment><USER3> I enjoy their [http://www.google.com/humans.txt](http://www.google.com/humans.txt)

</comment></comment><comment><USER4> Maybe a little less funny after acquiring Boston Dynamics.

[https://www.youtube.com/watch?v=tFrjrgBV8K0](https://www.youtube.com/watch?v=tFrjrgBV8K0)

[http://www.bostondynamics.com/img/Atlas-x3c.lr.jpg](http://www.bostondynamics.com/img/Atlas-x3c.lr.jpg)

<comment><USER5> I don't think this is a coincidence, exactly. There was a protester shouting over the recent I/O keynote that Google is "a totalitarian company that builds robots that kill people" in reference to Boston Dynamics. Folks who think that the accusation is overblown have been joking about Google's "killer robot" program, so this easter egg is likely Google poking fun at the allegation.

<comment><USER6> It's an odd allegation, given that robots built by Unit Handling Systems have killed more people than Boston Dynamics.

</comment></comment></comment><comment><USER7> What about Schmidt? He can fight T-1000 and T-800 by himself?

</comment><comment><USER8> Apparently Google is not the only one on the internet fighting against killer robots. I found this a few years back...

[http://developer.appcelerator.com/robots.txt](http://developer.appcelerator.com/robots.txt)

<comment><USER9> Well, technically this one is protecting killer robots, isn't it?

</comment></comment><comment><USER10> Webfusion's always amused me: [http://mirrors.webfusion.com/robots.txt](http://mirrors.webfusion.com/robots.txt)

</comment><comment><USER11> I guess the other models (T-850, T-101, etc) are free to go after Larry & Sergey?

Great example of whitelists vs blacklists. :)

</comment><comment><USER12> 啥意思?谁能用中文翻一下

</comment><comment><USER13> What does killer-robots.txt mean. And what do /+LarryPage links point to? (His google plus profile?)

<comment><USER14> This is a joke: the robots.txt is a file on websites used to give instructions about their site to web crawlers.

Disallow: tells the robot that it should not visit those particular pages on a site. Or in this case, terminate those individuals.

</comment></comment><comment><USER15> Is this a joke?

<comment><USER16> No, it's deadly serious.

<comment><USER17> For now.</comment></comment></comment>


Google, Bing & Yahoo Unite To Standardize Structured Search Data - <AUTHOR> http://searchengineland.com/schema-org-google-bing-yahoo-unite-79554

<comment><USER2> This is somewhat off topic and a completely non-technical response but am I the only one who gets a small dose of 'warm fuzzies' when large competitors join forces on something like this? Everything we read is always competition, lawsuits, accusations... and to me it gets tiring. Occasionally seeing something like this warms the cockles of my cold jaded IT heart. Nuff said, let the technical merit debate begin.

<comment><USER3> Forget the technical merit, I want to discuss your point. I'm pretty sure one of the signs of the apocalypse starts with the phrase "Google, Bing and Yahoo unite...". When I see that phrase my spidey sense tingles in a decidedly non 'warm fuzzy' fashion! One of the three will probably try to sabotage this. Likely, one will contribute something to the standard without informing the others that it is patent encumbered, then submarine them.

Others my feel free to weigh in on my paranoia.

<comment><USER4> Maybe you'll feel better, and 51Cards will feel worse, if you think of it as "companies who have invested in search engines unite to give themselves more competitive advantage over companies who have not invested in search engines, such as Apple" =)

</comment></comment></comment><comment><USER5> Is anybody seeing how much extra work this is going to put on the front end developer. We already have to support multiple browsers, multiple display sizes, ARIA roles, and more. I don't mind the extra work for the handicap (ARIA), but looking up and adding all this new meta information merely for search engines is going be a pain. In the end, this extra work makes it easier for the search engine by requiring the developer to do more work. I would prefer the reverse, otherwise maybe I need to get into the search business. They are creating a standard that will make it incredibly easy for future search engines.

<comment><USER6> I think that in particular the web page schema should be, at least optionally, read from the natural html. In other words, you should be able to give

      <div id="WPFooter">

and the search engine should know that this is the footer. In fact, the same could be asked of the rest of the itemtypes so that we can link them with CSS and don't have to repeat ourselves.

</comment></comment><comment><USER7> On one hand I think a common semantic framework is inevitable. On the other it just looks like the search providers further encouraging the manipulation of search engine algorithms - another round in the SEO arms race in which consumer oriented interests are increasingly drowning out non-commercial speech on the web - e.g. Googling "weather" in the US returns forecasts from commercial sites but not NOAA's local forcast.

</comment><comment><USER8> Microdata, why? Compared to RDFa (or even Microformats), I don't see a single compelling reason to use microdata.

At least RDFa has a well documented way to define and extend your own schemas...

<comment><USER9> Because most web pages are not valid HTML, let alone valid XHTML and you really need XHTML to make the most of those schemas. In other words "RDFa is hard, let's use Wordpress".

</comment></comment><comment><USER10> So far the schema listed don't look very subtle. Extracting this type of information from unstructured text should really be something that machine learning algorithms can do pretty well.

</comment><comment><USER11> I am curious: Given all of the trouble with scraped content on the web, why would data publishers want to make their data _more_ machine-readable?

<comment><USER12> Given all what trouble? You mean those few print publishers who don't understand the internet and are very vocal about it?

There has been very little actual trouble. Most business roll with new technology and use it to get an edge on their competitors that don't get it.

You've been listening to people who refuse to innovate and thinking they are the majority, or somehow a backbone of our society. They aren't either.

<comment><USER13> Maybe there is a refusal to innovate, but maybe we now have a structural problem wherein we simply don't need as many people to work on these things as a result of automation, and even information work jobs are going to diminish.

How do you tell these two scenarios apart?</comment></comment></comment>


Will Vue.js Become a Giant Like Angular or React? - <AUTHOR> https://10clouds.com/blog/vuejs-angular-react/ <comment><USER2> No, like all hotshot frameworks it's already burning out; except in China, they are about that vue life.

<comment><USER3> Laravel's endorsement of VueJS will most likely prevent burnout.

<comment><USER2> Are you implying that anyone takes laravel seriously?</comment></comment></comment>


NASA proposes a magnetic shield to protect Mars' atmosphere (2017) - <AUTHOR> https://phys.org/news/2017-03-nasa-magnetic-shield-mars-atmosphere.html <comment> java-man I wonder if it makes sense also to deorbit Phobos (instead of exploding a thermonuclear device on the surface per Elon Musk suggestion). The resulting series of collisions might release enough CO2 to create a denser atmosphere.

<comment><AUTHOR> I think the magnetic shield would still be needed, though, since the solar wind would otherwise just strip away the new atmosphere.

<comment> java-man Do both! I think the magnetic shield is an excellent idea.

<comment><AUTHOR> If we ever end of doing the deorbit, I really want to see a video of the impact. That would be intense.

</comment></comment></comment></comment><comment><USER2> If we can't fix our own planet from our (so far) relatively minor degradations, we have no hope whatsoever that we can expect to completely change another planet without our copious earthly resources around to help us.

It's a bit like the announcements "Wow! We've found a planet that we could live on easily!". The only problem being that planet is 'only' 200 light years away. Two hundred light years. It's going to take the Voyager space craft _thousands of years_ to reach an equivalent distance of the nearest star which is but a mere FOUR light years away.

Whistling in the wind.

<comment><USER3> I would argue that the manipulation of the interactions of geological & solar radiation systems is orders of magnitude less unpredictable than manipulating intentionally manipulating living systems on a living planet.</comment></comment>


Ask HN: Hoverboards This time for real? - <AUTHOR>

http://youtu.be/A4vE_vpkr90<p>It's hard to believe + scenes look hardly mocked-up. What's your thoughts on this? <comment><USER2> Fake: [https://news.ycombinator.com/item?id=7341539](https://news.ycombinator.com/item?id=7341539)</comment>


Startups: You Should Value Software More - <AUTHOR> http://wadefoster.net/post/49775946303/startups-you-should-value-software-more

<comment><USER2> HA! If you make pricing decisions for one of these companies please ignore the next paragraph!

This is one of the reasons enterprises will pay good money for software (even bad software) - because 30,000 users saving 5 minutes per month (1 hr per year) @ $20 an hour is still $600,000 savings per year.

Save them 1 hour per month = $7,200,000 Save them 1 hour per day = $30,000,000

<comment><USER3> Though this depends on what kind of time is saved. If I go from thinking while shuffling papers to thinking while sitting at my desk, my company isn't saving money.

This obviously isn't to say that I want to spend more time shuffling papers, and of course having to deal with a task means a context switch (which can sometimes be more expensive than the task itself), my point is simply that the analysis needs to run a bit deeper than "how much time is this saving?"

<comment><USER2> 100% agree, but on repetitive tasks that can be automated it can mean massive time savings.

Think scanning a pallet with 1,000 units via RFID vs manually (just an example I realize there is hardware & software in the example).

<comment><USER3> For sure. I didn't mean to imply that there weren't cases where automation is a big win.</comment></comment></comment></comment>


Deep Voice: Real-Time Neural Text-To-Speech (2017) - <AUTHOR> https://arxiv.org/abs/1702.07825 <comment><USER2> We had a discussion about this [http://research.baidu.com/deep-voice- production-quality-text...](http://research.baidu.com/deep-voice-production- quality-text-speech-system-constructed-entirely-deep-neural-networks/) six days ago, with demos.

This post links the arxiv paper instead.

Old discussion at [https://news.ycombinator.com/item?id=13756489](https://news.ycombinator.com/item?id=13756489)

</comment><comment><USER3> This is really cool, and something I've been keeping an eye out for, as current text to speech engines are for the most part sub par. I didn't read the paper, just the extract, but I hope its open sourced.</comment>