Ask HN: Papers you read in 2015? - <AUTHOR> Curious about scientific publications in your field that are worth sharing. <comment><USER2> I've been trying to read a paper a day since midsummer. These are a few of the interesting, for me personally, since then:

Generating Sequences With Recurrent Neural Networks - [http://arxiv.org/abs/1308.0850](http://arxiv.org/abs/1308.0850) Older one, but important to understand deeply since other recent ideas have come from this!

Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks - [http://arxiv.org/abs/1511.06434](http://arxiv.org/abs/1511.06434)

Unitary Evolution Recurrent Neural Networks - [http://arxiv.org/abs/1511.06464](http://arxiv.org/abs/1511.06464)

State of the Art Control of Atari Games Using Shallow Reinforcement Learning - [http://arxiv.org/abs/1512.01563](http://arxiv.org/abs/1512.01563) Interesting discussion in section 6.1 on the shortcomings/issues of DQN done by Deepmind

Spectral Representations for Convolutional Neural Networks - [http://arxiv.org/abs/1506.03767](http://arxiv.org/abs/1506.03767)

Deep Residual Learning for Image Recognition - [http://arxiv.org/abs/1512.03385](http://arxiv.org/abs/1512.03385)

Fast and Accurate Deep Network Learning by Exponential Linear Units (ELUs) - [http://arxiv.org/abs/1511.07289](http://arxiv.org/abs/1511.07289) I wish they did more comparisons between similar network architecture with only the units swapped out. Eg. Alexnet, Relu vs Alexnet, Elu.

On Learning to Think: Algorithmic Information Theory for Novel Combinations of Reinforcement Learning Controllers and Recurrent Neural World Models - [http://arxiv.org/abs/1511.09249](http://arxiv.org/abs/1511.09249)

Just a few from my list :)

<comment><USER3> Crumbs, it takes me about two weeks to get through a paper properly!

<comment><USER4> I can't speak for parent, but I believe people who read a paper a day, don't try to understand it deeply enough to be able to start implementing whatever the paper talks about. Rather it is read to get an idea of the approach and what kind of results it will give and what kind of problems it can solve.

<comment><USER5> For people actively working full-time in the field, some of the papers which have simple but powerful ideas, reading the paper for 2 hours (or glancing at the key diagram / formula) is enough to implement it.

For example:

Deep Residual Learning for Image Recognition

Fast and Accurate Deep Network Learning by Exponential Linear Units (ELUs)

</comment></comment></comment></comment><comment><USER6> Generating Sequences With Recurrent Neural Networks [http://arxiv.org/abs/1308.0850](http://arxiv.org/abs/1308.0850)

Generating Text with Recurrent Neural Networks [http://www.cs.utoronto.ca/~ilya/pubs/2011/LANG- RNN.pdf](http://www.cs.utoronto.ca/~ilya/pubs/2011/LANG-RNN.pdf)

Bitcoin whitepaper [https://bitcoin.org/bitcoin.pdf](https://bitcoin.org/bitcoin.pdf)

Ethereum paper [http://gavwood.com/Paper.pdf](http://gavwood.com/Paper.pdf)

</comment><comment><USER7> Not an academic paper, but I found the Roslyn (new C# compiler) whitepaper to be an interesting window into the future of programming languages: [http://www.microsoft.com/en- us/download/details.aspx?id=2774...](http://www.microsoft.com/en- us/download/details.aspx?id=27744)

"Tackling the Awkward Squad: monadic input/output, concurrency, exceptions, and foreign-language calls in Haskell" ([http://research.microsoft.com/en- us/um/people/simonpj/papers...](http://research.microsoft.com/en- us/um/people/simonpj/papers/marktoberdorf/mark.pdf)) finally made me understand monads. Or rather, why they have such an unreasonable draw on Haskell people. tl;dr: Monads are useful to thread data (state, side effects, ...) through a computation, without modifying all your function signatures (the functions can be lifted to work with the monad). But mostly, it turns out you NEED monads (or something like it) to sequence side-effects (since Haskell is lazy).

</comment><comment><USER8> Generalized LL Parsing - [http://dotat.at/tmp/gll.pdf](http://dotat.at/tmp/gll.pdf)

Parse ambiguous context-free grammars in worst-case cubic time and unambiguous grammars in linear time, with an intuitive recursive-descent-ish algorithm. GLL is the future of parsing IMO, more powerful than packrat/PEG parsers and comparatively easy to write by hand. It also handles ambiguities more elegantly than GLR, IMO.

Dependency-Based Word Embeddings - [https://levyomer.files.wordpress.com/2014/04/dependency- base...](https://levyomer.files.wordpress.com/2014/04/dependency-based-word- embeddings-acl-2014.pdf)

word2vec algorithm with context based on linguistic dependencies instead of a skip-gram approach. A quick explanation is skip-grams give words related to the embedding (ex: Hogwarts -> Dumbledore) and dependencies give words that can be used like the embedding (ex: Hogwards -> Sunnydale). It's not meant to replace skip-grams, but augment them; skip-gram contexts learn the domain and dependency-based contexts learn the semantic type.

<comment><USER9> Thanks for the first of these, I've put it on my "eventually if I ever get serious about writing this programming language" list.

<comment><USER8> Heh, that's where it is on mine too. :)

One of the things I find particularly nice about GLL is that it's much more friendly to parser combinators[1] than GLR. (LR-family parsers, and bottom-up parsing in general, is notoriously difficult to implement in a way such that parsers can be combined, and the result framework would be rather awkward to use.)

1: Indeed, it's already been done: [https://github.com/bawerd/gll.js](https://github.com/bawerd/gll.js) [https://github.com/epsil/gll](https://github.com/epsil/gll) [https://github.com/djspiewak/gll- combinators](https://github.com/djspiewak/gll-combinators)

</comment></comment></comment><comment><USER10> * Program design in the UNIX environment (1984): [http://harmful.cat-v.org/cat-v/unix_prog_design.pdf](http://harmful.cat-v.org/cat-v/unix_prog_design.pdf)

Glipse into unix essentials. Do one thing well on an example so you'll never forget it again. Doing less requires more care and attention to detail.

* From Frequency to Meaning (2010): [https://www.jair.org/media/2934/live-2934-4846-jair.pdf](https://www.jair.org/media/2934/live-2934-4846-jair.pdf)

A nice summary on vector space models along with three basic matrix layouts: term-document, word-context, pair-pattern and the resulting applications and algorithms.

* A Roadmap towards Machine Intelligence (2015): [http://arxiv.org/pdf/1511.08130v1.pdf](http://arxiv.org/pdf/1511.08130v1.pdf)

Emphasis on communication. I liked the fact, that the AI is pictured as a research assistant, since I would love to see a more dialog oriented interaction with machines.

* 50 years of Data Science (2015): [https://dl.dropboxusercontent.com/u/23421017/50YearsDataScie...](https://dl.dropboxusercontent.com/u/23421017/50YearsDataScience.pdf)

Great essay on how the past had a handle on todays data analysis landscape, just without the enormous computing power and data availability, that we have today.

</comment><comment><USER11> National Confidential Inquiry into Suicide and Homicide by People with Mental Illness (UK): [http://www.bbmh.manchester.ac.uk/cmhs/research/centreforsuic...](http://www.bbmh.manchester.ac.uk/cmhs/research/centreforsuicideprevention/nci/)

That paper tells us that pain medication is often used in completed suicide (paracetamol; paracetamol and opioids combined; and opioids; are three of the top five most commonly used meds)

So I have an interest in pain medication from the angle of suicide prevention, which is why these two are interesting.

Efficacy and safety of paracetamol for spinal pain and osteoarthritis: systematic review and meta-analysis of randomised placebo controlled trials: [http://www.bmj.com/content/350/bmj.h1225](http://www.bmj.com/content/350/bmj.h1225)

(Paracetamol probably doesn't help with long term musculo-skeletal pain, and increases risk of liver damage)

[http://www.thelancet.com/journals/lancet/article/PIIS0140-67...](http://www.thelancet.com/journals/lancet/article/PIIS0140-6736\(14\)60805-9/abstract)

(Paracetamol probably no better than placebo for long term back pain)

<comment><USER12> It's a bit confusing. For instance around page 80:

Table 5: Male suicide deaths and those aged 45-54 in the general population, by UK country vs Table 7: Patient suicide: male suicide deaths and those aged 45-54, by UK country.

Table 5 shows the rate. Table 7 shows the actual numbers. Why? Even the first key finding speculates about patient suicide increase due to higher numbers of patients. Do they not have this seemingly important statistic? A quick search says "a quarter" of the population will have a mental illness during the year. If true, then we'd expect around 25% of suicides to be from patients, right?

Why separate the APAP/opiod combination in light of suicide if the APAP wasn't a relevant cause? It seems like respiratory depression and liver poisoning aren't that synergistic are they? An opiate naive user with 10/325 oxy/apap would almost certainly hit opiate overdose before liver damage was a life- threatening issue.

The study recommends "safe prescribing" but then shows the majority of opiate suicide isn't with a prescription, and prescription overdose is skews heavily to older females with a "major physical illness". And no comparison on how rx abuse compares with non-mentally-ill patients. Edit: And rx rates, too. I'm guessing older patients generally get way more opiates prescribed than younger ones.

Interesting read though, thanks.

<comment><USER11> These are great questions. They're normally pretty good at responding if you want more information.

Here "patient" means "under the care of secondary MH services", so doesn't include people who are being treated by their GP rather than by eg a community MH team.

I think the opioid / APAP stuff is based on bots of history. Co-Proxamol was for years the most common med used in completed suicide. It was put on more restrictive prescribing, and use dropped. But then plain paracetamol use in completed suicide increased. (And also attempted suicide, for a while paracetamol overdose was 4% of UK liver transplants, (but 25% of the super- urgent transplants)). Rules about paracetamol tightened, so we've seen reductions in its use. So, from a public health POV, it's useful to see if plain paracetamol, or the combination, or plain opioids are being used more often, because that means they can look at what's driving sales or prescriptions.

About safe prescribing: one source of medication used in completed suicide is either from your own prescription, or from a relative's prescription. This is often a preventable cause of death, so it's useful to see if safe prescribing helps. It ties into things like "Triangle of Care" and also "Pills Project" (which I want to try to use outside care homes).

You're right about older people. They also often don't lock up the meds in a cupboard (they don't have children in the home anymore, they don't see a need) and tragically grand-children come to visit and accidentally overdose.

[https://www.carers.org/triangle-care](https://www.carers.org/triangle-care)

[http://www.health.org.uk/pills](http://www.health.org.uk/pills)

</comment></comment></comment><comment><USER13> A lot of NLP related papers. Here are a few of my favorites.

\- HMMs and Perceptrons for Part-of-Speech Tagging and Chunking - [http://www.aclweb.org/anthology/W02-1001](http://www.aclweb.org/anthology/W02-1001)

\- MaxEnt for Part-of-Speech Tagging - [http://www.aclweb.org/anthology/W96-0213](http://www.aclweb.org/anthology/W96-0213)

\- RNNs for Slot Filling - [http://www.iro.umontreal.ca/~lisa/pointeurs/RNNSpokenLanguag...](http://www.iro.umontreal.ca/~lisa/pointeurs/RNNSpokenLanguage2013.pdf)

Not related to NLP, but I really like the Facebook paper that covered delta of delta compression for time series data.

\- [http://www.vldb.org/pvldb/vol8/p1816-teller.pdf](http://www.vldb.org/pvldb/vol8/p1816-teller.pdf)

</comment><comment><AUTHOR> Deep Residual Learning for Image Recognition [http://arxiv.org/abs/1512.03385](http://arxiv.org/abs/1512.03385)

Batch Normalization [http://jmlr.org/proceedings/papers/v37/ioffe15.pdf](http://jmlr.org/proceedings/papers/v37/ioffe15.pdf)

Deep Neural Decision Forests [http://research.microsoft.com/pubs/255952/ICCV15_DeepNDF_mai...](http://research.microsoft.com/pubs/255952/ICCV15_DeepNDF_main.pdf)

Spatial Transformer Networks [https://papers.nips.cc/paper/5854-spatial- transformer-networ...](https://papers.nips.cc/paper/5854-spatial-transformer- networks)

</comment><comment><USER14> DagCoin : a bitcoin-like cryptocurrency with a "decentralized" blockchain based on directed acyclic graphs - [https://bitslog.files.wordpress.com/2015/09/dagcoin-v41.pdf](https://bitslog.files.wordpress.com/2015/09/dagcoin-v41.pdf)

Visual Search at Pinterest - [http://arxiv.org/pdf/1505.07647v1.pdf](http://arxiv.org/pdf/1505.07647v1.pdf)

Fast Search in Hamming Space with Multi-Index Hashing - [http://www.cs.toronto.edu/~norouzi/research/papers/multi_ind...](http://www.cs.toronto.edu/~norouzi/research/papers/multi_index_hashing.pdf)

</comment><comment><USER15> One weird trick for parallelizing ConvNets: [http://arxiv.org/abs/1404.5997](http://arxiv.org/abs/1404.5997)

Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks: [http://arxiv.org/abs/1511.06434](http://arxiv.org/abs/1511.06434)

A Neural Network of Artistic Style: [http://arxiv.org/abs/1508.06576](http://arxiv.org/abs/1508.06576)

</comment><comment><USER16> Surprised nobody mentioned The Morning Paper yet: [http://blog.acolyer.org/](http://blog.acolyer.org/)

</comment><comment><USER17> Comparison of Erlang Runtime System and Java Virtual Machine [http://ds.cs.ut.ee/courses/course- files/To303nis%20Pool%20.p...](http://ds.cs.ut.ee/courses/course- files/To303nis%20Pool%20.pdf)

</comment><comment><USER18> I've read two rather old papers on different cross-validation techniques:

A Study of CrossValidation and Bootstrap for Accuracy Estimation and Model Selection (1995) [http://robotics.stanford.edu/~ronnyk/accEst.pdf](http://robotics.stanford.edu/~ronnyk/accEst.pdf)

Improvements on Cross-Validation: The .632+ Bootstrap Method (1997) [http://www.stat.washington.edu/courses/stat527/s13/readings/...](http://www.stat.washington.edu/courses/stat527/s13/readings/EfronTibshirani_JASA_1997.pdf)

And one on MIMO techniques:

V-BLAST: An Architecture for Realizing Very High Data Rates Over the Rich- Scattering Wireless Channel (1998) [http://www.ee.columbia.edu/~jiantan/E6909/wolnianskyandfosch...](http://www.ee.columbia.edu/~jiantan/E6909/wolnianskyandfoschini.pdf)

I find it to be a good way to get concise and accessible introductions (with the associated results) to current practices.

</comment><comment><USER19> This year I read a some cool papers:

Big Ball of Mud

Brian Foote and Joseph Yoder

About the reasons why good software become ugly and complex.

[http://www.laputan.org/mud/](http://www.laputan.org/mud/)

\</comment><comment>----

The Inevitable Pain of Software Development

Daniel M. Berry

About changes of requirements for the software.

[https://cs.uwaterloo.ca/~dberry/FTP_SITE/reprints.journals.c...](https://cs.uwaterloo.ca/~dberry/FTP_SITE/reprints.journals.conferences/tcre.painpaper.pdf)

\</comment><comment>----

No Silver Bullet

Frederick P. Brooks, Jr.

The software developing is in essense very complex.

[http://www.cs.nott.ac.uk/~pszcah/G51ISS/Documents/NoSilverBu...](http://www.cs.nott.ac.uk/~pszcah/G51ISS/Documents/NoSilverBullet.html)

\</comment><comment>----

Notes On Structured Programming

Edsger W. Dijkstra

Why we don't have to use _goto_.

[https://www.cs.utexas.edu/users/EWD/ewd02xx/EWD249.PDF](https://www.cs.utexas.edu/users/EWD/ewd02xx/EWD249.PDF)

\</comment><comment>----

Watermarking, tamper-proofing, and obfuscation - tools for software protection

Collberg, C.S. ; Dept. of Comput. Sci., Arizona Univ., Tucson, AZ, USA ; Thomborson, C.

[http://dx.doi.org/10.1109/TSE.2002.1027797](http://dx.doi.org/10.1109/TSE.2002.1027797)

</comment><comment><USER20> "Unified-theory-of-reinforcement neural networks do not simulate the blocking effect"

Sci-hub link: [http://www.sciencedirect.com.sci- hub.io/science/article/pii/...](http://www.sciencedirect.com.sci- hub.io/science/article/pii/S0376635715300267)

</comment><comment><USER21> What is a good resource for someone who want to read good papers from time to time?

<comment><USER22> Follow some academics in the field you are interested in on Twitter.

<comment><USER21> would you suggest from whom to start?

<comment><USER22> Well what field are you interested in? I only know people in programming languages and systems really.

</comment></comment></comment></comment><comment><USER23> In search of an understandable consensus algorithm ([https://www.usenix.org/conference/atc14/technical- sessions/p...](https://www.usenix.org/conference/atc14/technical- sessions/presentation/ongaro))

SWIM: Scalable Weakly-consistent Infection-style Process Group Membership Protocol ([http://www.cs.cornell.edu/~asdas/research/dsn02-swim.pdf](http://www.cs.cornell.edu/~asdas/research/dsn02-swim.pdf))

</comment><comment><USER24> these "classics":

[http://blog.valbonne-consulting.com/2014/06/09/an- incomplete...](http://blog.valbonne-consulting.com/2014/06/09/an-incomplete- list-of-classic-papers-every-software-architect-should-read/)

</comment><comment><USER25> "Development and Validation of a Biomarker for Diarrhea-Predominant Irritable Bowel Syndrome in Human Subjects"

[http://journals.plos.org/plosone/article?id=10.1371/journal....](http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0126438)

Large cohort study done determining what the biological mechanism are of IBS (irritable bowel syndrome).

Defines a new test, IBSChek which can be used to determine if a patient has a subtype of IBS. Anyone can get this test done now.

</comment><comment><USER26> Elaine Levey, Thomas Rothvoss - A Lasserre-based (1+ε)-approximation for Pm∣pj=1,prec∣Cmax [http://arxiv.org/abs/1509.07808](http://arxiv.org/abs/1509.07808)

People are very excited about graph isomorphism being solvable in quasipolynomial time, but there are a few more problems from the seminal Garey, Johnson book that are still unknown to be in either P or NP-c or neither. One of them is computing the optimal schedule for three machines processing some tasks (jobs), when the tasks have all the same size, but there are dependencies among some of them and you have to do them in order.

This paper proves that there is a (1+ε)-approximation of this problem in "slightly more than quasipolynomial time" (I love this phrasing).

The technique they use is a Lasserre hierarchy which is a very exciting tool in theoretical computer science, although there still exist only a couple results where this hierarchy approach brings more to the table than other methods for designing efficient algorithms. This is one more to the list!

</comment><comment> bra-ket memory networks: [http://www.thespermwhale.com/jaseweston/ram/](http://www.thespermwhale.com/jaseweston/ram/)

<comment><USER27> Thanks for linking this! But I easily overlooked your post. It links to "Reasoning, Attention, Memory (RAM) NIPS Workshop 2015"

</comment></comment><comment><USER28> Using state lattices for motion planning was new to me but seems like an elegant approach:

[http://people.csail.mit.edu/rak/www/sites/default/files/pubs...](http://people.csail.mit.edu/rak/www/sites/default/files/pubs/PivKneKel09.pdf)

</comment><comment><USER29> Spotify – Large Scale, Low Latency, P2P Music-on-Demand Streaming [http://www3.cs.stonybrook.edu/~phillipa/CSE390/spotify-p2p10...](http://www3.cs.stonybrook.edu/~phillipa/CSE390/spotify-p2p10.pdf)

and many others but this is the one I liked the most

<comment><USER30> That Spotify paper was undated. When was it written?

<comment><USER31> Presented August 2010 at the IEEE Conference on Peer-to-Peer Computing (P2P)

</comment></comment></comment><comment><USER32> Here is an accessible algorithms paper. It's a cute puzzle problem. It was inspired by answers on cs.stackexchange.

Efficient Algorithms for Envy-Free Stick Division With Fewest Cuts [http://arxiv.org/abs/1502.04048](http://arxiv.org/abs/1502.04048)

</comment><comment><USER33> Benchmarking Smart Meter Data Analytics [http://openproceedings.org/2015/conf/edbt/paper-55.pdf](http://openproceedings.org/2015/conf/edbt/paper-55.pdf)

</comment><comment><USER34> A couple years behind the times but I got really into word2vec and plenty of associated works. On a mobile so not easy to post links, but if you haven't checked out w2v I highly recommend it.

</comment><comment><USER35> Not a specific list of papers, but I find Sigcomm to generally have very good papers in the field of networking and communications. Here's the link for this year's conference:

[http://conferences.sigcomm.org/sigcomm/2015/program.php](http://conferences.sigcomm.org/sigcomm/2015/program.php)

</comment><comment><USER36> It didn't get published this year but I though Robust De-Anonymization of Large Datasets - [http://arxiv.org/pdf/cs/0610105.pdf](http://arxiv.org/pdf/cs/0610105.pdf)

</comment><comment><USER37> Wow. Didn't realize how HOT deep learning was in 2015.</comment>


Bad times in corporate wireless networks - <AUTHOR> https://rachelbythebay.com/w/2020/05/01/owned/ <comment><USER2> FreeRADIUS is great, and I wouldn't use anything else.

But to increase the adoption of EAP, what would be better is a super simple daemon, you point it at LDAP or a file, and it sets itself up for PEAP or EAP- TTLS and you just have to point your APs at it. FreeRADIUS is far to complex for most use cases.

I note that many APs now come with nice web interfaces and can integrate with LDAP and Active Directory directly, which is a great step forward.

Ideally AD would support something like SRP directly so you wouldn't even need server certificates.

<comment><USER3> I want simple, non-enterprise wifi, but I want the "enterprise" feature of per-user credentials.

Sadly, setting up a RADIUS server is the only way I can see this is possible.. way to complicated, I'd sooner just put a static file on the router, but I'm not sure if this is possible.

<comment><USER4> Some of the small business gear has this feature. I use Ubiquiti access points, and through the Unifi interface I enabled the built-in RADIUS server and added some users to it. Now I have enterprise-style WiFi authentication.

</comment></comment></comment><comment><USER5> This is even easier, broadcast these SSIDs and you will be amazed how many devices auto connect.

\- attwifi

\- Google Starbucks

\- xfinitywifi

\- hhonors

The list goes on and on. Depending on what AP you are using you can easily do 16+ SSIDs

<comment><USER6> Broadcast, sslstrip (probably not valid) or provide a self-signed certificate and just log the traffic?

I was pissed when my Android phone connected to the McDonald's wifi without me telling it to do it.

<comment><USER7> My phone used to do that. Now I have to force it to connect manually whenever I need it, because it doesn't recognize the captive portal, and it only recognizes it as a network that doesn't have internet access.

</comment></comment></comment><comment><USER8> Edited to prefix:

Actually, on second thought, this doesn't really help Rachel's scenario. If the imposter knows our PSK then WPA3 does not defeat that. Huh.

[Also there ought to be a way to zap that +Karma on a comment that I now realise isn't helpful ]

Original post follows:

Note that WPA3 is intended to fix this, _but_...

* Your corp network probably doesn't talk WPA3 yet

* Even if it does it probably also allows WPA2 back compatibility for older devices

* Lots of devices can be fooled into accepting that just because the 'foocorp' AP it usually talks to is WPA3 maybe this 'foocorp' AP is WPA2-only and that's fine

* Cheap devices (maybe not your laptop or iPhone, but perhaps a cheaper phone and definitely other devices) are too constrained to safely run the secure algorithm.

WPA3 uses a PAKE here (it calls this "Simultaneous Authentication of Equals but it's just the Dragonfly PAKE) so the advantage is that devices don't tell anybody what the PSK is. But we're probably a decade from being able to tell people (especially conservative corp sites) to turn off WPA2 altogether.

If you already use a sane 802.1x setup instead of a PSK WPA3 doesn't meaningfully improve anything and you needn't rush to update, but of course random cheap consumer WiFi gizmos that expect a PSK won't work.

<comment><USER9> You might be thinking of Wi-Fi Easy-Connect or DPP where devices enrolled through it no longer learn the PSK:

[http://w1.fi/cgit/hostap/plain/wpa_supplicant/README- DPP](http://w1.fi/cgit/hostap/plain/wpa_supplicant/README-DPP)

</comment></comment><comment><USER10> This is why 802.1x and RADIUS are key. I used to maintain the RADIUS servers at an ISP and dealt with the craziness that were the initial implementations of 802.1x, and to this day I keep finding corporate networks that do crazy things like rotating standard WPA Wi-Fi passwords via policies instead of just setting up 802.1x properly.

Of course, vendors don't help here. Spending six digits on Cisco gear to get "out-of-the-box" end-to-end authentication (that then is weirdly inflexible in hooking up to your corporate AD) is certainly not on most small companies' radar, especially when they get cheap APs that "work".

For home use, I've bee looking for decent APs (_not_ proprietary fancy mesh setups) that support 802.1x and don't cost an arm and a leg, and I've been seriously considering ripping out my Airports (which are amazing Wi-Fi gear, and sadly discontinued) and going with a combination of OpenWRT gear and an embedded RADIUS server.

But I've been wondering if there are decent SOHO solutions out there for 6-12 APs and up to 50 users — it would be great for small companies/startups.

<comment><USER11> Look at MikroTik. 802.1x is supported in all products including SOHO ones. Also their wireless management solution (CAPsMAN) is decent.

<comment><USER12> about MikroTik I'd be extremely worried about security - not exactly a good track record:

 _MITRE /CVE's_: [https://cve.mitre.org/cgi- bin/cvekey.cgi?keyword=Mikrotik](https://cve.mitre.org/cgi- bin/cvekey.cgi?keyword=Mikrotik)

 _" Most MikroTik routers fail to get patched a month after severe security issues disclosed"_ [https://portswigger.net/daily-swig/most-mikrotik-routers- fai...](https://portswigger.net/daily-swig/most-mikrotik-routers-fail-to-get- patched-a-month-after-severe-security-issues-disclosed)

 _" Finding and exploiting CVE-2018–7445 (unauthenticated RCE in MikroTik's RouterOS SMB)"_ [https://movaxbx.ru/2020/01/29/finding-and-exploiting- cve-201...](https://movaxbx.ru/2020/01/29/finding-and-exploiting- cve-2018-7445-unauthenticated-rce-in-mikrotiks-routeros-smb/)

 _" Coinhive malware infects tens of thousands of MikroTik routers"_ [https://searchsecurity.techtarget.com/news/252446369/Coinhiv...](https://searchsecurity.techtarget.com/news/252446369/Coinhive- malware-infects-tens-of-thousands-of-MikroTik-routers)

<comment><USER13> > "Coinhive malware infects tens of thousands of MikroTik routers" > [https://searchsecurity.techtarget.com/news/252446369/Coinhiv...](https://searchsecurity.techtarget.com/news/252446369/Coinhiv..).

"Kenin said malicious actors were exploiting a vulnerability in the routers that MikroTik had patched in April -- just one day after the flaw was first discovered."

So an exploit was found (it happens) and patched within 24 hours.

From memory this was only vulnerable if you didn't block incoming winbox traffic on your wan port (which is of course good practice, and I believe the default configuration).

Upgrading a mikrotik router is a matter of running "system package update install". You could stick that in a scheduled script if you wanted.

Upgrading a cisco or juniper router requires things like support contracts, tac accounts, and other nonsense, then in many cases doing things like using tftp (!!) to copy a binary to the router, then ensuring you have a serial connection (!!) to the switch for when it breaks.

<comment><USER14> Upgrades on Mikrotiks are so simple. I used them for over 10 years and never once had a problem.

In my previous experience both from my ISP days and some time in a corporate IT "networks" department, almost nobody upgrades their "enterprise" (Cisco) routers or switches. It's too risky.

</comment></comment></comment></comment></comment><comment><USER15> Corporate WiFi networks should be untrusted. Once a device is connected to the WiFi users should then be required to connect via VPN before internal network access is granted.

<comment><USER16> That sounds like a usability problem.

<comment><USER17> We use the described setup at our company and the VPN software (Viscosity) auto connects so seamlessly that you never really need to do anything manually. Works really well.

<comment><USER18> Basically every big corp uses always on VPNs and it works fine. You can even do stuff over group policy on Windows to get the VPN configured and auto join enabled.

<comment><USER19> Really? I've worked at a couple large bay area companies this wasn't true.

</comment></comment></comment></comment></comment><comment><USER20> Unfortunately the proposed solution WPA Enterprise has its own set of pitfalls. Unless one opts for EAP-TLS, which is quite secure, some fun can be had with certain other EAP methods if implemented insecurely. It is especially inadvisable to use AD credentials and skip certificate validation or make it optional. For further research: [https://github.com/opensecurityresearch/hostapd- wpe](https://github.com/opensecurityresearch/hostapd-wpe)

<comment><USER9> This comment is not nearly as dramatic as the situation is in practice. Here is how to connect to Cornell WiFi as a student:

[https://it.cornell.edu/wifi/connect-eduroam- android](https://it.cornell.edu/wifi/connect-eduroam-android)

Notice this does not setup certificate validation (and therefore does not authenticate the AP is actually from Cornell). It also tells you to use the completely broken MSCHAPV2 and login with credentials that allow access to a number of other university services. So in this setup, not only can you still trivially impersonate a Cornell AP, all clients also give you their specific login credentials in a way that allows you to recover their passphrase.

<comment><USER8> It's true that it doesn't (and can't) authenticate that the AP is "actually from Cornell" and indeed that's the point of EduROAM.

But it _will_ be talking to Cornell to authenticate you and so no you can't "recover their passphrase".

EduROAM is a global federation. So what's happening goes like this:

Let's say I'm a Cornell student

1\. I follow these instructions, probably while on campus to make my, let's say, iPhone work with WiFi. My "NetID" is tialaramex for this example.

2a. Probably my phone automatically concludes that network- access.it.cornell.edu is really network-access.it.cornell.edu because it has a Web PKI cert that says so, just like on an HTTPS website.

2b. But if not I have a step where I tell the phone this certificate looks OK. This is effectively TOFU (Trust On First Use) because I'm a naive user which isn't great but it'll protect against many attacks later.

3\. I go to the University of Sydney, in Australia, as an example.

4\. My device sees an AP named "eduroam" because I'm at a university in a developed country and the Network Effect means it makes sense for all universities to join eduroam.

5\. My device says "Hi I'm email@example.com † let me in"

6\. Sydney's AP talks to an Australian server which talks to Cornell, which agrees to talk to my device about this, over TLS

7\. My device confirms that this TLS connection matches the certificate we saw earlier, or has a trusted certificate for network-access.it.cornell.edu

8\. Using the risible MSCHAPv2 protocol (but happily inside TLS) my device proves I am really email@example.com

9\. Cornell tells Sydney that yup, I am an authorised Cornell network user, let me in.

10\. I get the same privileges as a local Sydney student/ professor in terms of network access. If there's any problem (maybe I use 40GB in one day from PornHub) Sydney know which Cornell user I am and they can take it up with Cornell. In extremis they can "blacklist" me.

† It is possible to arrange that the local institution does not find out your "real" username at your home institution, since they don't need to know that in order to connect to the right authentication service. But mostly nobody cares.

</comment></comment></comment><comment><USER21> Ah yes, the evil twin attack.

[https://en.wikipedia.org/wiki/Evil_twin_(wireless_networks)](https://en.wikipedia.org/wiki/Evil_twin_\(wireless_networks\))

</comment><comment><USER22> You could imagine a system where you configure your laptop with a public-key hash of the wireless network, maybe using ssh-style TOFU (trust on first use), to defeat this kind of attack. You could even use the OPIE or BIP39 or bubblebabble wordlists, or randomart images, to confirm that first use. There's really no reason the Wi-Fi standards, developed decades after ssh was, need to be less secure.

</comment><comment><USER23> The finance company I worked for simply didn't use wifi at all. Everything was done over ethernet.

</comment><comment><USER24> Once I had to reconfigure some Airtame devices out in the field. They couldn't connect to the cloud, but I made a hotspot with the same SSID and credential settings as one of our guest networks at work. The devices were able to connect to it, and I successfully reconfigured them. Some time later at work my phone was feeling warm. I was surprized to see I was subsidizing random office internet traffic with my cellular data plan.

Access protection is usually done more diligently for important networks, but the simplicity of a MITM attack makes it apparent that all corporate networks need RADIUS or similar protection.

</comment><comment><USER25> It's interesting to see a website that just copy and paste content from other sources without any sort of credit or referencing having this attraction (usually in the HN top ranks).

In fact the way it's presented it even seems that was 'authored by rachel, the anonymous valley dev'.

Harmless attitude when it's just someone trying to land a hotsite and earn some extra bucks/attention. But later don't complain when the same attitude is in place by big companies/VCs draining your career.

Tech scene really reached a new low these days: "put the minimum effort; try to extract and profit the most" \-- while trying to be 'smart/efficient' people lost the self perception of predatory behavior.

Maybe could be renamed to Grasshopper By the Bay. :P

</comment><comment><USER26> This threat vector is interesting, but is it really a huge deal? I don't think many company devices restrict the networks you can connect to (certainly not ones you bring on Caltrain) so why even target a corporate pre-shared-key network and instead host xfinitywifi or another popular public SSID?

<comment><USER27> Because the people working for the target of your attack might never connect to an xfinity wifi network, but they are pretty likely to connect to the wifi at their office.

<comment><USER28> Exactly, this would likely work fairly well for a targeted attack. Yes, shared Wi-Fi names _might_ work for some employees, but using the employee's work's Wi-Fi SSID/psk is virtually guaranteed to work (if they use WPA PSK anyway).

</comment></comment></comment><comment><USER29> Some great stuff happened when I was moonlighting as IT at a company. One time someone randomly plugged in a cat5 cable and created a loop in the network, causing an ARP packet storm.

The company also had 2 different networks, one for data and one for VOIP. They had wall plates in the conference rooms that had a data RJ45 and a VOIP RJ45. Someone decided to plug a cable from the VOIP port into the conference phone (which had a pass through), and plug a cable from the pass through on the phone into the data port, causing all kinds of weird chaos. That was a fun one to track down.

<comment><USER30> Spanning Tree is under-rated :) Although I read a twitter thread earlier where someone did this and they had spanning tree which in theory prevents this but the switch had some kind of bug causing it to crash and reboot right after disabling the port with spanning tree.

<comment><USER29> It was a long time ago and most of the equipment was either hubs or dumb switches with no budget to overhaul. That's a really great bug to have in your equipment out in the wild

</comment></comment></comment><comment><USER31> Wait you already have the wpa preshared key? Why would you go the trouble of creating a clone network when you can already join the actual network and arpspoof at will?

<comment><USER32> One might choose to do this because the admins thought they were "smart" and said, "Oh, I know, we will only allow 'known' MAC addresses to connect to the network! That will fix it."

And it does, kinda. Except it doesn't stop you from capturing clients on your "fake" network, and the goal isn't necessarily to be on the "real" network, the goal might be to just man-in-the-middle a juicy site or two, with is on the big Internet (say, the company's bank)

Capture the controller's login into the bank and win "free money"

<comment><USER31> Mac address restriction provide zero access control. It's trivial to sniff and spoof them.

<comment><USER32> Not disagreeing with you here, I am wondering however if you have ever surveyed or even had casual conversation with people who self identify as "an IT person at company <X>."

In my discussions with such people[1], I have found that a preponderance of them believe that a MAC address filter is a strong protection against unauthorized equipment on their wireless network.

[1] I have had many occasions in my career where I have hired people in the IT/Ops role and during the interview process I have often probed their understanding of the plumbing of IT beyond the parameters necessary to enter on a screen in order to get something "up." My admittedly non-scientific sampling suggests that "knowing the plumbing" is not a valued skill for many of these people.

</comment></comment></comment></comment><comment><USER33> I still don't get who Rachel means with the "beekeepers" analogy linked to in the post. Can someone enlighten me?

<comment><USER34> Uber and Lift?

</comment></comment><comment><USER35> Interesting idea, but im pretty unconvinced its a threat in practise. People will connect to any free wifi they can find, you don't need to trick them into it. Use HSTS if you need security. (The author of course says its easy to forget on some obscure part...well yes. Security is hard for a reason)

<comment><USER36> You are thinking about a coffee shop scenario, when the article is about an office environment. They are talking about spoofing the office SSID that devices already connect to automatically, not people manually connecting to open networks.

<comment><USER35> They were talking about people autoconnecting to an office ssid on the bus. If you use your office phone on the bus, you probably use it at the coffee shop too.

</comment></comment></comment><comment><USER37> Is it possible to use Web PKI to prove that an AP is under the control of a domain? Basically protect against evil twin APs without deploying certs.

<comment><USER8> It _would_ have been trivially possible to use the Web PKI here if APs advertised an FQDN instead of a short text string as their visible name.

If you were signing into "Starbucks.com" then logically we can arrange that the AP needs to prove it has a certificate for starbucks.com or some-wifi- made-up-prefix.starbucks.com or something and it could use the Web PKI to make that work safely for everybody.

But APs do not have FQDNs. The WiFi industry has talked about trying to get to roughly the same place by a circuitous route, but the problem they run into is: Who is allowed to call their AP "Starbucks" and why? If you decide it's fine we'll hide a signifier elsewhere, then the user doesn't know why _this_ Starbucks and _that_ Starbucks don't interoperate. Their experience is disappointing and even if you claim it's for security reasons they're left puzzled.

However, there is no need to involve "deploying certs" anyway.

You can use your existing (very likely) Active Directory or similar and single-sign-on infrastructure to allow employees WiFi devices to prove who they are to the WiFi AP, without giving away any secrets. There are an impressively confusing array of different ways to do this, but the good news is that even the really terrible ones are safer than a PSK.

You can even federate this system, a good proportion of all degree institution students and staff in the industrialised world have EduROAM, their laptops (iPhones, whatever) connect to any AP that claims it is EduROAM (maybe in Venice, or New York, or Sydney) and they tell it their email address with their home institution (e.g. where they're employed or registered to take classes) and then they give _that_ institution credentials to connect. The local institution can see that e.g. OK this NYU student is on our network, and if there's a problem (looking at PornHub in class? Not here) they can tell NYU about it and if necessary blacklist a problem user. But they don't get credentials for the user, and the user doesn't get local credentials. No more need for toxic "guest" networks for visitors.

<comment><USER37> > If you were signing into "Starbucks.com" then logically we can arrange that > the AP needs to prove it has a certificate for starbucks.com or some-wifi- > made-up-prefix.starbucks.com or something and it could use the Web PKI to > make that work safely for everybody.

So there's really no way to do so currently, correct?

> There are an impressively confusing array of different ways to do this, but > the good news is that even the really terrible ones are safer than a PSK.

Which would be actually the safest one that would primarily avoid evil twin attacks?

> But they don't get credentials for the user

Assuming there's no easy misconfigurations made by the user? E.g. they can't click "accept this invalid cert" somewhere?

<comment><USER8> > So there's really no way to do so currently, correct?

AFAIK Nobody does this today. It would be difficult to retrofit.

> Which would be actually the safest one that would primarily avoid evil twin > attacks?

Ah. Unfortunately this "evil twin" impersonates an AP and 802.1x does not end up giving us confidence in the identity of the AP per se.

For example say you're using PEAP-EAP-MSCHAPv2 (a common way to set things up with an Active Directory service authenticating your users) - if the bad guys can connect to the server you're doing PEAP-EAP-MSCHAPv2 on from their "evil" AP then your users will consider everything looks fine. The bad guys can't directly learn their credentials in the process because there's a TLS layer, but your users end up connected to their "evil" AP.

Even with certificates (say EAP-TLS) this is no different, if the bad guys are able to talk to your legitimate service they can have your users authenticate with your legitimate service on their AP.

So the main thrust ends up being: Do not trust the network. Use TLS and other technologies to secure your traffic so that you don't care who is providing the network, whether it is who you expected or somebody else.

Sorry.

> Assuming there's no easy misconfigurations made by the user? E.g. they can't > click "accept this invalid cert" somewhere?

Good point. That would definitely vary by client device. There's no good reason why a device should let you do that, but I wouldn't be surprised if lots of them do.

</comment></comment></comment></comment><comment><USER38> This is worrying - not least because every WeWork in the world has the same WiFi password.

</comment><comment><USER39> I am genuinely curious: what is the best resource for understanding wifi and wifi security in depth?

<comment><USER40> Seconding this. I personally do not understand any of the jargon used here at all, let alone what the implications of it is.

<comment><USER41> I wrote a blog post a while ago: [https://www.wtf.horse/2017/09/19/common- wifi-attacks-explain...](https://www.wtf.horse/2017/09/19/common-wifi-attacks- explained/)

<comment><USER40> nice thanks

</comment></comment></comment></comment><comment><USER42> This is why you treat the office wifi connection as any other connection, don't create a 'turtle shell' (hard outside, soft inside) infra and control the DNS configuration of your employee's laptops.

</comment><comment><USER43> Interesting way of cloning networks but still MAC addresses would differ. Original network has a MAC address of a router and clone network has a different MAC address of an access point.

<comment><USER28> > but still MAC addresses would differ

You mean BSSID. It looks like a MAC address and in some cases it actually is one, but it's not required to be. Each AP broadcasting for a given network will have a different one and I'm not aware of client side native behavior to alert or enforce a whitelisted set. Even if there was, you could easily spoof the BSSID too, just would need to war drive to get it.

<comment><USER43> I just mentioned basic security check but I don't know anything about corporate networks or how to manage them. One thing I know is that Microsoft has robust network directory service called Active Directory which "authenticates and authorizes all users and computers in a Windows domain type network—assigning and enforcing security policies for all computers and installing or updating software." So for example you could register all corporate access points to a Windows domain and no way you get connected to a wrong access point.

<comment><USER44> The article does make the same point. Basically companies _could_ configure their WiFi in a more secure fashion but many won't. I'm certain many small companies use very basic setups similar to a home WiFi and at best will just change the WiFi password periodically.

This is why major OS providers are taking it on themselves to tackle some of these issues independently of the WiFi setup - like taking the location in consideration and warning you if you connect to the same network in a different location.

</comment></comment></comment></comment><comment><USER45> This is a good way to target individuals too. If know someone uses wireguard and has it set to automatically connect except when on their home wifi, you can pretend to be their home wifi to lure them into a false sense of security.

I would contend that this is a problem with wireguard. It shouldn't be trusting the name of the wifi network.

<comment><USER46> I just keep Wireguard on even when on my home network. With NAT Loopback on the router this works fine. Is there a reason to have it off?

<comment><USER45> Wireguard kills the battery on my phone so I like it off when I'm home.

Also my wireguard box isn't fast enough to handle gigabit speeds so on my home network it slows things down too much.

</comment></comment></comment><comment><USER47> Any modern enterprise WiFi setup will support containing rogue APs. So this vector won't work if configured correctly.

<comment><USER28> > Any modern enterprise WiFi setup will support containing rogue APs. So this > vector won't work if configured correctly

You misunderstood the issue. Modern enterprise wifi won't detect a "rouge AP" that's setup near a worker's home (or coffee shop), only ones in radio range of the corporate APs.

<comment><USER48> Not quite on the enterprise wifi side, but I have been pleasantly surprised that iOS has alerted me when I connect to a wifi network with the same name, at a new location. So endpoints can play a part in this.

I'm not sure if there is some kind of MDM policy that would restrict locations that are valid for wifi use, but expect it is coming soon.

<comment><USER28> > Not quite on the enterprise wifi side, but I have been pleasantly surprised > that iOS has alerted me when I connect to a wifi network with the same name

Actually, that's the exact opposite of what I was quoting. That's client side detection, not "rogue ap containment" which is an entirely different thing. Rogue AP containment is where a Wi-Fi controller detects unauthorized APs within its AP's radio range and sends client disconnects to the devices connected to it, effectively isolating ("containing") users from it.

</comment></comment></comment></comment><comment><USER49> Corporate WiFi networks are capable of Creating multiple SSID's tied to different VLAN's. Creating a VLAN with client isolation while using WPA2 personal should be trivial.

Giving that network a VLAN to exist on with just an internet gateway should be trivial.

Coupling the VLAN with client isolation should be adequate for most companies.

Any reasonably administered corporate network should be able to then provide company issued devices with more reasonable security.

Posture assessment and other aspects of network management are important for compliance.

None of that should scare anyone. You can still stream music in the bathroom while offering more security for corporate devices.

<comment><USER50> Is that going to prevent phones and laptops in random places from automatically connecting to a spoofed network?

To my knowledge, it will not. So you'd need that SSID and VLAN to be something like a guest wifi. Preferably with a key that rotates often enough that people will not try and remember the network.

Cause otherwise, it just became a whole lot easier to get a layer 1 MitM on anyone who has that network on auto connect.</comment></comment>


Pixastic: JavaScript Image Processing Library - <AUTHOR> http://www.pixastic.com/lib/ <comment><USER2> This is neat, but would be way neater (could handle bigger images, run way faster, and do more sophisticated processing) if JavaScript had some better data type for numeric data than an object full of double-precision floats.

<comment><USER3> I think Firefox 4 will have typed arrays:

<http://developer.mozilla.org/en/JavaScript_typed_arrays>

[http://cvs.khronos.org/svn/repos/registry/trunk/public/webgl...](http://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/doc/spec/TypedArray- spec.html)</comment></comment>


Ask HN: Am I getting a fair deal? - <AUTHOR> I am being offered a developer position at a pre-funded startup and the salary being offered right now is 1/3rd of the market rate(based on my previous employment) for the first six months.
The next 6 months however I will be paid back the diff and also get my market salary, provided there is money.
I will be the first employee who's a developer. (The CTO is a fairly awesome coder, so its not like I am the first developer or building stuff from scratch.) However the development work wll be non-trivial. The only thing which is bothering my is that there is NO EQUITY being offered. The reason being that the company is based in U.S.A while I will be working in its office at a foreign location.
To be fair, It will be a new domain I will be working on, with really smart people on a really interesting problem.
So am I getting a bad deal or am I over thinking this? Badly need some advice.
UPDATE1: Should highlight the fact that after six months, they plan to pay my lost wages subject to the availability of capital.
Market Rate: y FIRST SIX MONTHS SALARY: x NEXT SIX MONTHS SALARY: y+ (y-x) + z AFTER ONE YEAR SALARY: y + z
z being equal to a measure of the risk I am taking
My opinion of the co founders is that they are really smart and honest people.
UPDATE2 : Just got a call from one of the co-founders. He has very kindly explained to me that the deal they have offered me is taking into consideration the fact that any equity I have will be enforceable in U.S. Their idea of this structure is a cash payout in lieu of an equity. <comment><USER3> A terrible deal, you're seeing a bunch of downsides and no upsides.

Unless the work is absolutely fascinating to you then you shouldn't even be considering this. I'm impressed that someone had the balls to put an offer like this on the table. Honestly, even if you loved the work I'd suggest telling them off because it's kind of an insulting trick when some people try to get geeks to work cheaply on "interesting" projects.

If they're somewhere where giving you shares triggers auditing requirements, which is the only reason I can think of them giving for this, there should still be plenty of workarounds. Significantly increased pay back over the following few months at least being the immediately obvious one.

<comment><AUTHOR> They have agreed to do that as I mentioned. After the first six months they will pay me my market rate+ (marketrate- prev salary) + risk money for the next six months, of course subject to the availability of capital.

<comment><USER3> If you want to seriously consider this kind of cash back deal then you should look at the amount of money you're giving up as an exceptionally high risk investment.

What kind of a return would you want the upside to be for you to walk out right now and gamble 3 months of salary on a 25% chance of winning bet. Unless you've got significant wealth already then most measurements that take into account the diminishing returns of wealth will probably suggest a that you'll want the win to be at least 6 times that mount.

That's quite a lot of cash for a startup and it makes no sense to a startup that's worried about cashflow to make that kind of an offer when they could give out nice free equity.

Liabilities are much worse on a balance sheet than having employees with stock. Employees with stock in the company have an ongoing alignment with the company; employees who are owed cash are going to be slowly getting more irritated.

</comment></comment></comment><comment><USER4> We have a similar setup. I am a technical founder who owns the project and company, I hired two developers from overseas full time. They joined because each were interested in the project, and were heavily trained by me. I paid them full salary of their market rate - they told me their existing salaries, and we started from there, including pay rises every 6 months.

This is how it should be. I am taking the risk and paying them full time, and since they were also happy with the interesting work they did not need or ask for equity. In your case you should either get full salary or equity. Because you are taking the risk with them. It is simple as that.

I don't get to judgement that your employer is taking advantage of you, sometimes arranging equity gets complicated, you need lawyers etc. He may have good intentions to keep you until you see the upside. But there is no guarantee, and if he is not paying you now, he should agree to offer you something in exchange that should fulfill you, or simply just pay you your market rate.

You are not overthinking at all. You should protect your rights at all times.

</comment><comment><USER5> It's a really really bad deal. Please listen when I say someone is trying to take advantage of you. You're taking on a lot of risk with no upside. If I'm reading it right, the best you can do is break even with the salary you could be getting. On the other hand, the company is assuming absolutely no risk, if they become successful because of your risk and hard work, they just have to pay you what they should have been paying you from the beginning.

If you're seriously considering this offer there must be something else in play. Is it a visa you're after? Have you always wanted to work at a startup? Is it a field you're very interested in? Have you been out of work for a very long time?

Whatever it is, at the very least, you should push back and try to negotiate to get what you really want.

<comment><AUTHOR> I have always wanted to work at a startup. I am not after a VISA, though it will be good. I quit my previous job at a big company two months ago because I was tired of doing mundane tasks and was shit scared that I had stagnated.

</comment></comment><comment><USER6> This sounds very shady. Wage equals appreciation, and their ability to pay you correlates strongly with the company's viability. At least one of those factors is not what it should be (probably both).

> Should highlight the fact that after six months, they plan to pay my lost > wages subject to the availability of capital.

Another very bad sign, they're already looking for an easy way out. Chances are in six months you're either stuck with the exact same level you started with ("there just isn't any money, we swear!") or they'll just can you. Don't do this to yourself.

I'm not categorically advising people to stay away from bootstrapped startups, it can be fun. But I think if you do something like this, you should have a personal stake in the company (i.e. be a co-founder). Because if this goes south, as the majority of them do, at least you have been working on something that you own as opposed to being a wage slave for a few months.

You also implied you would be the only developer there. If this is in any way a web company, this is another very bad sign. If so, you'll probably end up doing most of the work there yourself.

Sorry to sound so pessimistic, but this just doesn't sound right. If they don't have any money they should make ANY financial promises to you, period. It doesn't feel like they are being completely honest (or realistic) about the risk involved.

<comment><AUTHOR> I would be the first developer as an employee. The CTO is the main developer there.

<comment><USER6> So it comes down to the question whether you trust and whether you can afford this adventure. Trust in this case not only relates to their personal conduct but also their ability to realistically judge where this business is going. In any case, it's a bad deal for you if you depend on the income. But if you have time and money to spare for such an experiment, you might be better off working for no wage at all during that time and taking equity instead.

</comment></comment></comment><comment><USER7> In any deal, you want to look to protect yourself. Look at this -

> The next 6 months however I will be paid back the diff and also get my > market salary, provided there is money.

So, answer, _What if there isn't money? Then what?_

Draw up the contract so that you get something if there's no money for you. You'll feel burned quite badly if the answer is just, "Oh, sorry, we don't have the money now."

So, figure that out. If you want to guarantee you get the cash, have something serious in the event you don't get it. Maybe very significant equity at that point? Then it's very clear that you need to be paid, lest there's consequences. Look, everyone is great and honorable and all that, but things go wrong sometimes, and it's better to have it written down in the contract what happens in the event things go wrong.

</comment><comment><USER8> Based on what you've said it sounds like given the early-stage development you're involved in ("development work will be non-trivial") and the risk involved ("provided there is money") and the fact that you are one of the earliest (first?) employees, you should be in line for at least some equity-- obviously it varies company-to-company, but based on an earlier HN discussion here: <http://news.ycombinator.com/item?id=973060>, it seems there wouldn't be (too) many startups that wouldn't provide at least SOME equity <3% for someone in your position who's taking a fairly large amount of financial risk.

And as a sidenote: if you're uneasy about the terms offered, maybe you already have your answer.

<comment><AUTHOR> I am not uneasy, just unsure. My biggest worry right now is if the company does take off, would i regret not asking for equity?

<comment><USER9> You are taking a risk of only being paid 1/3rd of your market rate for the next 6 months.

After that, you may be without a job. This is your downside, and it's what you should plan for.

In a best case situation, after 6 months you will start gradually earning back the money you missed out on, + a raise.

This means the only upside for you is the raise you _may_ get after 6 months. You should decide for yourself if you're comfortable with the amount of risk you will be taking for this upside.

As an extra caveat: it seems to me like it would be very easy for the founders to claim "there is no capital". Especially considering you are in a foreign country and are likely to not have any insight into the company's financials, it will be extremely hard and costly for you to prove otherwise if things go sour.

</comment></comment></comment><comment><USER10> Ask them to articulate why equity can't go to a foreign person. Make your decision based on this. (if you live in someplace like Somalia or Belarus or China, and they're a defense or security startup, maybe an argument could be made; alternative arrangements like a cash settled "phantom stock" allocation equivalent to the 0.5-2% or so you should otherwise get (over 4y) might be worthwhile instead).

Taking a below-market salary itself, if there's likely funding, isn't horrible, assuming you can live on it. Adding that you're being paid back the difference makes it good, too.

</comment><comment><USER11> You're either a cofounder or an employee, and this deal gives you the worst of both those roles (i.e. all the risk, none of the upside). If you really want to work at a startup with an interesting problem then I suggest humbly that you take a couple of months and see if you come up with any ideas on your own.

</comment><comment><USER12> I think you need to look at the positives and the negatives. Work out what risk you are taking, and how that risk can be compensated.

In this case your risk is that after 6 months of working far below market rate you will have nothing to show for it and then be out of a job.

Paying you back market rate at a later date isn't really compensating for it, unless there is some sort of bonus. Sometimes this bonus is equity, but it could just as easily be monetary (often this is how sales people are motivated - work for cheap, but if you sell then you get a large reward).

It's hard to say what compensation you should ask for. The most important factor is that you don't feel like you're being screwed, you should feel happy with the deal. Because if you are unhappy, then that unhappiness will leak through the stress of a startup and probably result in fighting, you hating your job and depression.

<comment><AUTHOR> Thanks for the reply. I dont really feel like I am being screwed. Based on my interaction with the co-founders, they seem like really decent guys and they have been pretty honest about everything. I think its more to do with the fact that I expected some equity or at least a discussion sometime down the line.

</comment></comment><comment><USER13> Well look at why one gets equity - to compensate for risk. What is risk? Not having money tomorrow to be getting paid. Well you are taking risk according to that definition, but no equity in return. This is one problem, but not the end of the world. Also, giving you equity is going to get them in trouble with the law, and future investors. So giving you equity is stupid for them. So how to compensate you for your risk? Cash money. Ask them for above market, in back pay if you're interested and trust them - walk if you don't.

Get them to sign a contract in your country of origin - so fighting you in court becomes expensive for them. Or maybe in a state far from them within the US.

</comment><comment><USER14> I don't care how interesting the work is, it's not worth 1/3rd market rate for someone else to own it. That's not far from 0% market rate which you would get for working on your own projects which you would have 100% ownership of.

</comment><comment><USER15> Not a good idea they want u to do all the work and Only pay you if it takes off. Scam

</comment><comment><USER16> I don't think it's as bad as everyone else does.

If, instead of getting the missed wages after 6 months, you were offered equity equal to the wages you were missing, would that be fair?

In the end, that's the same deal, assuming you could buy equity. (That isn't necessarily true, though.) If the company survives, you get your money in both situations. If the company doesn't survive, you don't get your money in both situations.

If you still think it's not fair, ask for equity instead. But they apparently just don't have the money right now, so they couldn't possibly pay you more to start.

<comment><AUTHOR> Based on my discussions with the CEO, its more to do with the fact that they are trying to keep costs at a minimum right now.

<comment><USER17> So what's wrong with offering legit equity? Aside from possible overseas issues which doesn't seem to be an issue they're bringing up.

<comment><AUTHOR> Can you give me a link where I can read more about this?

</comment></comment></comment></comment><comment><USER18> It sounds like you know the answer to your own question. What you really want, I believe, is someone to comfort you into thinking that the decision you already made, which is to go to work for them, is a good call. Obviously I may be completely wrong but I would think you would have entered an update stating you opted out based on the recommendations of HN members. The opposite argument is, of course, you are going to do some work you will love and enjoy. If this is the case equity doesn't matter. You may be right and these guys may be truthful and honest; it is their business and they do not need to offer you equity. They will do what they can for you later. I would offer equity if I were them but only after you showed me something. Then it would be a no- brainer. Good luck with this.

</comment><comment><USER19> Yes. You should be getting equity commensurate with the risk and role you're taking.

</comment><comment><USER20> It sounds like you're trying to talk yourself into this. Consider other options. Have you been interviewing for other positions actively (sounds like no, devs are very in-demand)? Will your current employer counter-offer (though there's nothing to counter here except a ~67% decrease)?

Another thing to consider is whether you'll ever be subject to US taxes. Unless this is a non-elective deferral you could face stiff penalties: * <http://www.irs.gov/retirement/article/0,,id=186222,00.html>

</comment><comment><USER21> Ask yourself why you'd take this opportunity. What do you hope to get out of it? If you can't find other work it sounds like a great deal. If you are hoping to get equity later and you'd be willing to risk it, maybe it is a good deal. If you need experience you'll get, that is worth something. If this is just about money, that sounds weak to me.

<comment><AUTHOR> Thanks for this measured response. I am not really looking for work, I am looking to work at an interesting problem with smart people and the experience of a startup.

</comment></comment><comment><USER22> All signs point to NO.

You're taking just as much risk as the founders, however you aren't receiving any equity. Negotiate an equity position that rewards you for your risk.

</comment><comment><USER23> As a rule of thumb, if you have to ask, it's yes.

</comment><comment><USER24> No, you're getting a raw deal. The idea that you can't get equity because you're in another country is absurd. Foreigners can freely own property in the USA, including equity in companies. The only requirement is that you pay US taxes on it if you sell it.

The correct offer, if they want to conserve cash, is to take the 2/3 of the salary they are not paying you in the first 6 months, convert that directly into stock (not options) at the same price that the founders are doing so, and give you a bonus on top of that for risk of say %25-%50 of the stock value.

If they want to stop giving you stock after 6 months, then paying you the amount they're proposing to pay you now would be fair (at least to make up the 2/3 you missed out on for 6 months.)

Basically they're asking you to take as much risk as they are, yet they're going to screw you on equity and on income. And they're not even offering it as a deferred salary (which would give them the legal obligation to pay it.)

To be honest, looking at this deal, it communicates to me that these people are not honest and you should not do business with them. I could be misreading something, but it sounds like they're trying to cheat you and use your nationality as an excuse.

\--

Edit to add: This is the reason for equity in startups. To allow cash poor startups to attract good talent. They're trying to not pay you (until some imagined future cash infusion at which point they can fire you) and not give you equity.... you're going to do the 6 months of work that earns them the big venture capital and then they can replace you without you getting any equity?

That's why I think this transcends raw deal into the realm of cheating you. (And normally I'm of the "whatever two people agree to is none of my business" persuasion. But you asked here so this is my opinion. It doesn't matter how great the idea is or the other guys, if you're not going to be able to participate in the long term. Equity measn they want you around, no equity means they'll replace you in those 6 months.)

<comment><AUTHOR> Thanks a lot for your concerned post and suggestions. Their point was it would be more convenient for me if I take an increased salary after the six months instead of equity. They were also very willing to listen to alternative suggestions I might have. Also I do the think the people are pretty honest. They called up to clarify that it isnt the case that equity is not an option, its just that cash would be more convenient for me. I do believe that they are good and honest people and if I have implied otherwise in my post, Its a mistake on my part.

</comment></comment><comment><USER25> Horrible deal. There's a chance that you will work for 1/3 of your regular salary for 6 months, and there's NO UPSIDE.

Let's say they let you go after 6 months, or tell you "there's no money". If your normal rate is 100K, you will be working working for $33K. Which means that in 6 months you lose $33.5K. That's quite a lot of money.

I would not take that.

WARNING: if they offer you equity, let's say 50,000 shares, but don't tell you what % of the total number of shares that represents, DO NOT TAKE IT, IT'S A SCAM.

<comment><USER26> Of course that would be a scam, no capital letters or warning signs needed - it's very basic math; 50,000 shares of unknown value X has unknown value - <USER2> 5th grader knows that.

<comment><USER27> There's another factor: the shares have no value and no way to sell them.</comment></comment></comment>


Anglophiles: Hang up your VPN; BBC iPlayer isn't for you anymore - <AUTHOR> https://arstechnica.com/tech-policy/2017/05/iplayer-login-tv-licence-fee-dodging/ <comment><USER2> The BBC looks increasingly anachronistic to me. There is little content which would not otherwise be available elsewhere in some form, and the content that is deemed not commercially viable but justified as it serves Reithian principles ([https://en.oxforddictionaries.com/definition/reithian](https://en.oxforddictionaries.com/definition/reithian)) is only a small subset of the whole. I also question whether it's healthy to have a small, unaccountable group having such considerable power over media - certainly the way the BBC handled Jimmy Saville and the Muslim paedophile gangs in Rotherham (lack of coverage bordering on outright suppression of the truth) doesn't fill me with confidence. I could also mention Brexit and Trump, where their coverage has been far from impartial.</comment>


Show HN: Color Picker for iOS and Android developers - <AUTHOR> https://colorsforcoders.com <comment><USER2> I don't know what this is supposed to do or how it's useful but it flickers like crazy on my iPhone6+

[https://www.youtube.com/watch?v=6owWcbPEcbA](https://www.youtube.com/watch?v=6owWcbPEcbA)

It said iOS/Android so I checked it from iOS. The headline on HN says "Color Picker" but there are 16 million colors, what's special about these 105 colors? How do I pick other colors? There's no readme or about or what's this. What's the point? Do I give it a list of colors to show a user? Are these 105 colors special?

<comment><AUTHOR> Thanks for letting me know about the flickering. The point of ColorsForCoders is to provide a convenient way for iOS and Android developers to select and integrate colors in their apps. Code for a particular color is copied to the clipboard when clicked. It is meant to be used on a desktop during iOS/Android development.

</comment></comment><comment><USER3> Nice but HSLa would be a nice addition. I think we really should encourage the use of this format now that it is supported.

The ability to shift saturation and brightness without impacting hue is really useful once it saves your butt a couple times.

<comment><USER4> HSL and the likes are based on a simple cylindrical transformation of RGB. I would argue that we usually want perceptual uniformity, so I recommend cylindrical versions of CIELAB instead; just replace a* and b* with C* and h* , where a* = C* cos( h* ) and b* = C* sin( h* ).

</comment></comment><comment><USER5> Now that all Apple devices and computers can display DCI-P3 [1][2][3], you should expand this to support/include colors from that wider color gamut, and in Extended sRGB and 16-bit formats, especially since the preset examples start with red. :)

[1] [https://en.wikipedia.org/wiki/DCI-P3](https://en.wikipedia.org/wiki/DCI-P3)

[2] [https://webkit.org/blog/6682/improving-color-on-the- web/](https://webkit.org/blog/6682/improving-color-on-the-web/)

[3] [http://www.astramael.com](http://www.astramael.com)

</comment><comment><USER6> There should be a space between an argument label and the parameters being passed. UIColor(red: 0.5 ... For example.

<comment><AUTHOR> Thanks. Fixed.

</comment></comment><comment><USER7> Similar to [https://color.hailpixel.com/](https://color.hailpixel.com/) which is pretty useful too.

</comment><comment><USER8> This is a really good native color picker [http://sipapp.io](http://sipapp.io)

</comment><comment><USER9> Seems to have no ability to scroll with the keyboard. That would be a major impediment to me using it.

</comment><comment><USER10> Is there anything special about that set of colors?</comment>


Ask HN: Does Google still do 20% time? - <AUTHOR> <comment><USER2> Don't know if you can say Google as a whole does 20% time. But there are many Googlers who do 20% time. I've done several 20% projects in the last 2 years.

</comment><comment><AUTHOR> I've heard some people say that 20% time is still in effect and others say that the company has moved away from it.

<comment><USER3> The fact that there isn't a clear, certain answer suggests that it's at least not what it used to be.

I think the more interesting question is, what changed? Is it simply too much time to put at risk as they scaled? Did they determine that 5 days of focus on just one thing works a lot better?

<comment><USER4> When I was there ('09-14), the senior executives would say "20% time means something different to every person you ask".

From Larry's POV, 20% time was supposed to be an escape valve to find the next billion-dollar business. He knew that good ideas often look like bad ideas and that there was a good chance the next great idea wouldn't come from him (after all, crucial elements of Google's success like the ad auction system didn't come from him), so he built in a mechanism where smart engineers could go around his back and work on a prototype without him knowing, and then only take it to him once there was a demo worth looking at. This unfortunately didn't really scale as the company grew bigger, because with more employees, the chance that someone _other_ than Larry would shoot down your idea before it got to him got high enough that basically no good ideas were getting through. (The last 20% project I'm aware of that became a true product area was Google Now, started in 2007 and graduated to a full-fledged product around 2011.)

Craig Silverstein viewed 20% time as a way to build social ties _across_ product areas and avoid siloing and trust barriers. The idea is that if you spent 20% of your time working with a team that had nothing to do with your main project, this created a parallel network, separate from the reporting hierarchy, that allowed information to flow across different departments. This usage of 20% time was still alive and well when I left, even though Craig Silverstein had left a couple years earlier.

Many managers and employees viewed 20% time as a way to "try out" a new team: if you were thinking of transferring, you could do a 20% project for the new team and they'd vouch for the transfer. This mechanism was also still alive and well, for those employees savvy enough to take advantage of it, when I left.

<comment><USER5> I've heard from some that 20% time has since become 120% time (at least in some non-engineering orgs). Thoughts?

<comment><USER4> True but not a recent phenomena. If you hear stories from Google's early days when 20% time was a buzzword (around 03-05), people always worked well more than 8 hours.

It takes a fairly massive amount of time to build something from scratch, and if you chose what you're working on, you'll _want_ to spend that time. Managers _are_ expected to adjust expectations and not require more than 4 days of work if a person has a 20% project, but given that it's software and software never seems to hew to planned deadlines, this tends to stretch.

Actually, I suspect that a lot of the decline in 20% time is because Google hires more people now who want a stable 9-5, who have no particular ambition to try out a new idea on their own or build something from scratch.

</comment></comment></comment></comment></comment><comment><USER6> I asked some developers when I was on a tour there and they said yes and no, and that sometimes their 20% work became they're full time work. Not sure what that means exactly.

<comment><USER7> Gmail</comment></comment>


Windows 7 will ship as Version 6.1 - <AUTHOR> http://windowsteamblog.com/blogs/windowsvista/archive/2008/10/14/why-7.aspx <comment><USER2> Apple has been doing 10.x for a while now. Most FOSS stuff (well, at least the stuff I program for) doesn't change the number before the dot unless there's an API incompatibility. I'm sure there's lots of Microsoft detractors that would just want to say, Windows 7 really is just Vista (and therefore just as bad) because the number has changed so little. Please. While I'm not a Windows user and definitely not an MS fan, arguing the merits of software based on the version number is just silly.

<comment><AUTHOR> I thought it was more interesting from the change control perspective.

</comment></comment><comment><USER3> Seems like a no-brainer from an engineering perspective.

\- They use 7: It says "7.0" when you look at the version number on the About Windows dialog, which nearly no users look at anyway.

\- They use 6.1: All the programs that have a hard-coded check for "6" keep working and you can claim complete application compatibility with Vista.

Windows XP was 5.1 to Windows 2000's 5.0 ([http://en.wikipedia.org/wiki/Microsoft_Windows#Timeline_of_r...](http://en.wikipedia.org/wiki/Microsoft_Windows#Timeline_of_releases)) yet few would claim that Windows XP was not a significant release.

<comment><USER4> I agree. But if, as you suggest, it's an "engineering no-brainer" to retain the leading digit even on a major new release, something about the versioning system is broken.

<comment><USER5> Windows culture is so full of wrong assumptions that any OS change breaks apps. Versioning looks like a very small problem.

</comment></comment></comment><comment><USER6> "Following Windows 3.0 was Windows NT which was code versioned as Windows 3.1. Then came Windows 95"

Wait, what about Windows 3.1 (ie the 16-bit one, the upgrade from 3.0)? Did they have two different products that were both Windows version 3.1, or did "Windows 3.1" get a different version number? These people are nuts.

<comment><USER7> Win 95 wasn't a follow on from NT. There used to be two separate paths for Windows: 95 -> 98 -> 98SE -> ME [end of line], and NT -> 2000 -> XP -> Vista -> 7

</comment></comment><comment><USER8> What happens when they make Version 7.0?

Windows 7 will be a different piece of software from Windows Version 7.0

It's easy to see how something like this could cost MSFT thousands of man- hours of confusion and disambiguation.

</comment><comment><USER9> Did MSFT pick up some insane executives who previously cut their teeth on Java's numbering scheme(s)?</comment>