How a Google Headhunter's E-Mail Unraveled a Massive Net Security Hole - <AUTHOR> http://www.wired.com/threatlevel/2012/10/dkim-vulnerability-widespread/ "Harris wasn't interested in the job at Google, but he decided to crack the key and send an e-mail to Google founders Brin and Page, as each other, just to show them that he was onto their game." <comment><USER2> Full article: [http://www.wired.com/threatlevel/2012/10/dkim- vulnerability-...](http://www.wired.com/threatlevel/2012/10/dkim- vulnerability-widespread/all/)

</comment><comment><USER3> Sloppy work by affected companies since RFC was unambiguous. But why didn't RFC keep it consistent by requiring verifiers to only work with the same minimum key length?

RFC 4871 (sorry for formatting but ipad issue) " signers MUST use RSA keys of at least 1024 bits for long-lived keys. Verifiers MUST be able to validate signatures with keys ranging from 512 bits to 2048 bits, and they MAY be able to validate signatures with larger keys. Verifier policies may use the length of the signing key as one metric for determining whether a signature is acceptable.

       Factors that should influence the key size choice include the
       following:

       o  The practical constraint that large (e.g., 4096 bit) keys may not
          fit within a 512-byte DNS UDP response packet

       o  The security constraint that keys smaller than 1024 bits are subjec to offline attacks..."

</comment><comment><USER4> Seems to be some conflation in this thread. Are DKIM and authentication (PGP) really comparable in practice?

Here's my take: DKIM is an attempt by _third parties_ (i.e. "email providers", not the author or the recipient of the message) to control who can send email (but guess what? anyone can send email, go figure). On the other hand, authentication (PGP) is an attempt to allow senders to sign messages and receivers to verify signatures (no third parties needed).

Bob printed his PGP public key on a card and gave it to Alice when they had lunch. He then signed an email message the following week using PGP and sent it to Alice. But Bob's "email provider" decided to block Bob's message because Bob didn't pay money to someone for the use of a "domain name" and Bob's "email provider" thought his email was "spam" because he hadn't been "authorized" (by paying money for use of a domain name) to send email.

</comment><comment><USER5> I find it cute how clueless mathematicians and physicists are about how clueless we (programmers) are. Weak crypto? Assume it is a puzzle!

</comment><comment><USER6> Ok, this got me scared, checked with Sendgrid support,of course they use 1024, back to breathing again.

</comment><comment><USER7> What a happy ending, no threats of jail or lawsuits.

<comment><USER8> It's still bit of a let down that they didn't contacted him in any way. They could at least track him and since he is a well meaning guy they could send him something funny.

</comment></comment><comment><USER9> What is the Direct Link to this guy's website?

</comment><comment><USER10> >But the government of Iran probably could, or a large group with sufficient computing resources could pull it off.

Yes, I can see it now: _Iran endures crushing sanctions in order to pursue spam email program._

<comment><USER11> The rule of thumb that I have heard, and seen played out, is that there are basically 3 tiers of who can factor what. governments or government sized companies (upper millions, or billions sized budgets), modestly sized companies / research projects (millions), or hobbyists. Each can handle about 256 bits more than the next, and the time for one to reach the capabilities of the other is somewhere between 5 to 10 years.

Hobbyists have been factoring 512bit keys on a whim for a few years now, so....

</comment></comment><comment><USER12> DKIM is not the only tool for catching spoofed emails; to my knowledge SPF is more widely used because it is much easier to set up. I'd be shocked if the little Larry/Sergei joke email made it to their inbox since it would fail the SPF lookup.

<comment><USER13> Yes lots of sites have SPF, but what I've seen most sites set it to soft-fail mode.

I think this is because SPF is still sometimes broken in practice. For example, it can fail when there are misconfigured e-mail forwarding (e.g. mail aliases) at _other_ peoples servers[1]. Or with web forms that set the envelope sender to the "From" field in web page...

[http://en.wikipedia.org/wiki/Email_forwarding#Forwarding_ver...](http://en.wikipedia.org/wiki/Email_forwarding#Forwarding_versus_remailing)

</comment></comment><comment><USER14> Props to Wired for disclosing that their silly phony photo setups are phony. I found that comforting.

Props to Google for fixing the problem instantly.

Weird that he thought the email was phony based on content. Who wouldn't want a computer savvy math genius on their team? Google has lots.

<comment><USER5> Google very rarely hires pure mathematicians AFAIK.

</comment></comment><comment><USER15> Dangerous move, other companies have would set the police on him for that stunt.

<comment><USER16> There are a lot of stories of people getting jobs by disclosing security holes like this.

</comment></comment><comment><USER17> Seriously old news... I attacked Facebook's 512 bit DKIM key back in 2010: [http://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should- be...](http://blog.jgc.org/2010/06/facebooks-dkim-rsa-key-should-be.html)

<comment><USER18> I'm curious to hear what you think about DKIM in general.

<comment><USER17> At one time DKIM and SPF were good indicators that an email was spam because spammers adopted it so that their mail looked more legit.

I never look at DKIM or SPF. If I really care about who a message comes from I use PGP. It's a handy input for learning spam filters that use it as one piece of information, but it has about a 10% failure rate (legit mail where the signature fails to verify because of message manipulation in transit). It's most useful if the domain it's matching against is also trusted in some way. For example, a good signature against google.com is likely to mean the mail is good; a good signature against frohfuwehfwo.biz is not very helpful unless we know that that domain always sends spam.

Also, the most important piece of mail I ever received (from the Prime Minister's office) came without SPF or DKIM and I authenticated it by calling the office. In general, external authentication like that tends to reassure me.

</comment></comment></comment><comment><USER19> I got one of those emails too once. I still can't figure out why. I did post to LKML a couple times in the past, but I haven't done anything kernel in over a decade. And a random Google recruiter emails me to congratulate me on my experience and offer me an unspecified position as a SRE. Not only do I have zero experience or interest in sysadmin and large server type stuff, they don't even have any facilities within 400km of me. What the fuck, Google?

<comment><USER20> In my experience (ex-Googler here), recruiters tend to be contractors who work off a script and get bonuses proportionate to how many people end up in the hiring pipeline. There are checks and balances to prevent outright spam, but the motivations are aligned in such a way that a pretty wide net is cast.

Also, until you have interviewed, all positions are "unspecified". Many positions need to be filled and they don't pick one for you until they know what you can do.

Geography is not really considered to be an issue. Once SRE finds someone they really want they will help with relocation.

<comment><USER21> Also an ex-Googler here, they cast the net far and wide trying to pick up SRE. When I was there they were offering significant bounties for submitting recommendations that only had to make it pass the resume screen. Want a brand new shiny PS3? Less than 10* that made it past the resume screen, and it was yours.

I has additionally heard rumors that recruiters were so silo'ed that they would actually just throw away a resume rather than route it. Reason being that they were in a competition with all recruiters, and worst performers (based strictly on a numbers game) didn't get their contracts renewed.

*May have been as low as less than 5, its been a few years, and I never really took to memorize what was posted on the wall while I was at the urinal.

</comment></comment></comment><comment><USER22> Well, afaik key length isn't the problem. Weak algo is. I assume they use RSA, they should use ECC. 512 bits is more than enough.

<https://www.nsa.gov/business/programs/elliptic_curve.shtml>

<comment><USER23> That doesn't make much sense. There are key lengths for which RSA is strong, and key lengths for which ECC is weak.

ECC keys may be stronger at shorter lengths, but that hardly means that key length isn't the problem. After all, using a longer key would fix this problem.

<comment><USER24> Using ECC would solve this particular problem, because in both DKIM and DNSSEC usage of key lengths of 512 to 768 bits and not more are motivated by what can fit into one UDP DNS reply packet. Also for RSA signature size is equal to key length, and not some small multiple of security parameter and you don't want to expand messages by including large signature that might well be larger than actual payload.

<comment><USER23> Right. Either expanding the key length or using ECC would fix it. So saying the problem isn't one of those, but is only the other, doesn't make much sense to me.

ECC may even be a better solution, as you say, but that doesn't mean that the problem isn't also one of an insufficiently long key.

</comment></comment></comment></comment><comment><USER25> I hope this guy's inbox is full of job offers. That's a heck of a find.

<comment><USER26> <http://www.linkedin.com/in/drzacharyharris>

Wow, the guy's a monster. Fluent in classical (and Levantine) Arabic, Chinese, Greek; Top Putnam score (twice), teacher, Christian missionary. Sounds like he's got drive.

<comment><USER27> Nit-picky corrections:

1\. Top Putnam score _in Colorado_. There's a pretty big difference between that, and say, top Putnam score in Massachusetts (which is more likely the same as top overall due to many Putnam Fellows coming from Harvard or MIT).

2\. _Elementary proficiency_ in Classical and Leventine Arabic, Mandarin Chinese, and Koine Greek

<comment><USER28> Can you beat any of it?

<comment><USER27> Sure, I may have actually done better on the Putnam than he has. I've gotten top 100 and top 200 before... but that really wasn't the point I was trying to make. I was just making the correction because the original claim is, at least to me, much more impressive than what is actually stated on his resume.

</comment></comment></comment></comment></comment><comment><USER29> > _Harris thought there was no way Google would be so careless, so he > concluded it must be a sly recruiting test to see if job applicants would > spot the vulnerability. Perhaps the recruiter was in on the game; or perhaps > it was set up by Google's tech team behind the scenes, with recruiters as > unwitting accomplices._

Ha! That's optimistic.

<comment><USER30> Or paranoid. Or naive. Or narcissistic.

It _might_ be somewhat feasible if they wanted him to be security engineer, not a devop. Still, he expected they have set up what essentially is an elaborate prank just to send a cold-call email to just one of probably numerous potential candidates.

How likely this is? What would be the risk-to-reward ratio for doing that, considering that many of unsolicited recruiting mails are not even read? Isn't it more feasible for it to be a genuine mistake on their part? Google's not infallible, omnipotent being after all.

<comment><USER31> Back when I believed the hype, I made the same mistake with materials from Google's recruiters. They gave me driving instructions from SJC which left me in the wrong part of the valley on a Friday night during rush hour (this was before smartphone navigation). I figured it was some kind of test. It wasn't.

I called it my "cleverness attribution error" and wrote about it this summer: <http://rachelbythebay.com/w/2012/06/19/attrib/>

I've run into it in a few other places, too.

<comment><USER32> The chess champion Capablanca said that he was protected from losing games due to minor blunders because his opponents assumed he was so brilliant that he saw something they didn't, so they played safe and avoided taking advantage.

<comment><USER33> I think I read an article recently (probably highlighted on HN) that talked about how Deep Blue did exactly this versus Kasparov. A bug caused it to make a sub-optimal move, and it's quite likely Garry misinterpreted it as genius and psyched himself out going forward.

<comment><USER32> Yeah I'd read that. Kasparov was pretty freaked out by Deep Blue. He wrote this:

"I got my first glimpse of artificial intelligence on Feb. 10, 1996, at 4:45 p.m. EST, when in the first game of my match with Deep Blue, the computer nudged a pawn forward to a square where it could easily be captured. It was a wonderful and extremely human move. If I had been playing White, I might have offered this pawn sacrifice. It fractured Black's pawn structure and opened up the board. Although there did not appear to be a forced line of play that would allow recovery of the pawn, my instincts told me that with so many "loose" Black pawns and a somewhat exposed Black king, White could probably recover the material, with a better overall position to boot. "

about a move most computers of the time would find pretty quickly, and most decent human players would intuitively have thought OK at first glance.

<http://www.azillionmonkeys.com/qed/chess.html>

My theory is that a significant part of his game was based around human psychology, so he found it hard to grasp computers. He played computer- friendly risky openings as if to taunt the machine, and heavily talked up the influence of the programmers on Deep Blue to an almost paranoid extent.

The result was that he lost against Deep Blue when he should have won fairly easily if he'd been more disciplined.

</comment></comment></comment></comment></comment></comment><comment><USER34> "A 384-bit key I can factor on my laptop in 24 hours," he says. "The 512-bit keys I can factor in about 72 hours using Amazon Web Services for $75. And I did do a number of those. Then there are the 768-bit keys. Those are not factorable by a normal person like me with my resources alone. But the government of Iran probably could, or a large group with sufficient computing resources could pull it off."

"But the government of Iran probably could"...At this point I stopped reading, as this article became propaganda.

Did you know this month is National Cyber Security Awareness Month, as advertized by the DHS?

<http://www.dhs.gov/national-cyber-security-awareness-month>

<comment><USER35> > At this point I stopped reading, as this article became propaganda.

Even if that was true (it's not), how could you know it without reading further?

<comment><USER34> What's not true? (what's 'it' that you talk about)

<comment><USER35> The article did not become propaganda.

<comment><USER34> The article up to that point was great.

However, that sentence "But the government of Iran probably could" made the preceding paragraphs appear to be a vehicle to deliver a meme (like a shaggy- dog story). The rest of the article could have been great, I just stopped reading.

The journalist _could_ have made a neutral statement about what entities have the resources to crack a 768-bit key. But they or their editor chose not to.

Instead, everyone that reads the article will go away with the meme "Iran, if they wanted to, could crack 768-bit keys". Which is, by common definition, propaganda.

It might be unintentional, i.e. the journalist is riding a wave of popular opinion, which they should not do; or it might be an attempt to load the article with link bait.

<comment><USER36> I don't understand. That statement was part of a quote during the interview. A single, continuous quote. Do you consider reporting what someone said to be propaganda. Should the journalist have left out that part of the quote?

<comment><USER34> Good observation. I stand corrected. I wonder how Zachary Harris would defend the lack of neutrality of that quote, if he was asked to do so.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> DKIM is an anti-spam mechanism. It does _not_ authenticate the sender of an email message; to do that, use something like PGP. This is an interesting story, but it's not a story about a "massive net security hole". Mail on the Internet has always been spoofable.

<comment><USER37> Gmail (possibly Hotmail) put a little lock icon next to DKIM authenticated email from some senders, such as eBay & PayPal and outright reject unauthenticated emails from such domains. They've flaunted this feature in the past

So if an authenticated PayPal email pops up in your Gmail inbox saying you must do this and that to unlock your account, you may be more likely to do so due to the legitimacy of DKIM.

<comment><USER18> The reality is that people will act on "Paypal" mail that comes from "Payapal.ng". Let's not pretend that DKIM has much to do with that decision. I agree, though, that the little lock in the Gmail UI is misleading.

<comment><USER38> Just register serverX-paypal.com (where x is a number) ftw. People in general are stupid. When asked what browser they use, the overwhelming majority respond by saying "Google". That says all that needs to be said about the general public.

<comment><USER39> Quite a sad view of humanity. I don't think people are stupid, I think they just don't care and shouldn't care about the browser. It's a tool used to get access to the information they need.

I am reading HN on chrome, but unless I go looking for what browser I use, I wouldn't know.

<comment><USER40> Decoupling the concept of "you don't intimately know what I have spent my entire life playing with" from "stupidity" seems to be really difficult for the tech crowd.

Always sad. People willing to discount countless hours of expertise and knowledge because a user doesn't know what the name of their browser is. As if that means anything.

For example, I really don't give a shit if my neurosurgeon is aware of what his browser is named. Nor would I dream of calling him stupid if he didn't. Chances are he knows leaps and bounds more about me on most topics, just not casual desktop computing.

Likewise, discounting someone entirely because they're uncomfortable with or uninterested in computers is one of the most ridiculous, ignorant, and self- absorbed things you can do.

<comment><USER41> This is a useful consideration. It Appears to be an affliction of many (if not all "experts") of various stripes.

<comment><USER42> I'm immediately tempted to apply it to politics. I won't, or at least certainly not here, but it's interesting to think about.</comment></comment></comment></comment></comment></comment></comment></comment>


Why is the crypto market so down today? - <AUTHOR> https://coinmarketcap.com/ <comment><USER2> Current discussion [https://news.ycombinator.com/item?id=16156687](https://news.ycombinator.com/item?id=16156687)

</comment><comment><USER3> atleast bitcoin will end</comment>


Show HN: Mapster - <AUTHOR> http://gsundeep.com/mapster

<comment><USER2> How is this better than the yelp search functionality (other than the fact that I'm not a fan of Yelp's UI)?

</comment><comment><USER3> What's the point? Mapster uses the Google Places API or am I wrong? I'm missing some cool benefits.

</comment><comment><USER4> Re-editing the address after providing one doesn't work. Hitting enter or clicking the search button doesn't work in this case either.

Using an intersection like "California and San Antonio Rd., 94043" sorta works but the map is centered incorrectly and doesn't use locations near that actual intersection, mostly just where the map is mis-centered.

Clicking on an pin, then the name, breaks and takes me to a url with "undefined" in it.

It is unclear what this is supposed to do and what value it's supposed to provide.

It is unclear where the ratings/stars are coming from and what they mean.

Clicking "let us locate you" prompts me via the HTML5 location API, but it doesn't actually work and does nothing after I provide it with permission to use my location.

This functionality works outside of your app.

That's the last feedback I can provide, if you want more, I can tell you my billing rate.

Back to my startup. Godspeed.

<comment><AUTHOR> Some of the things you mentioned that are broken do work on my browser (Chrome). I haven't had a chance to test this with other browsers, I'll try FF and Safari and see if those problems show up there.

Thanks for the feedback!

<comment><USER4> I'm using Google Chrome 20. Happens on my older Chromium too.</comment></comment></comment>


Tech Investor News Delivers Exactly What You Assume It Would  - <AUTHOR> http://www.techcrunch.com/2009/07/22/tech-investor-news-delivers-exactly-what-you-assume-it-would/ <comment><USER2> You don't have to take the word of Techcrunch. I've been reading it regularly for a while now and like its stories and links enough that it has reduced my reliance of several feeds:

<http://www.techinvestornews.com/page-one.html>

</comment><comment><USER3> Say what you will about TC, but they know how to write a headline for the Internet.

</comment><comment><USER4> Yes, but _not_ leads to the best discussions on HN - even the business-related ones.

But, I agree, it may be a nice supplement to my several-times-a-day visiting to HN.</comment>


Ask HN: Why hasn't anyone bought airtime against SOPA? - <AUTHOR>

With Jeff Bezos and Elon Musk making large investments in private spaceflight ventures, it seems like the tech community has cash to spare.  Since the mainstream media is not covering SOPA, and with so much to loose for the internet, why haven't tech companies bought commercials on mainstream media to inform people about SOPA? <comment><USER2> For the same reasons Google and Wikipedia don't plaster their opposite on their homepages.

<comment><AUTHOR> I don't understand this comment. Google's ad networks carry ads for many things that could be seen as Google's opposite (i.e. Yahoo, Books, TV News)</comment></comment>


Hope: High-Speed Order-Preserving Encoder - <AUTHOR> https://github.com/efficient/HOPE <comment><USER2> Flash take: huh cute, these students wrote a paper formalizing something so simple I can have opinions about it

After browsing paper: holy cow that's awesome, where do these rocket scientists get their crazy ideas and when can we have it in Postgres

tl;dr: its basically a compression algorithm that produces a compressed stream whose sort order matches the sort order of the original uncompressed data

Minor complaint about the paper itself: all the datasets they picked can be expected to have very high redundancy. Would be nice to have included one approaching-random collection

</comment><comment><USER3> Getting a 500 from Github.

Here is their paper:

[https://arxiv.org/pdf/2003.02391.pdf](https://arxiv.org/pdf/2003.02391.pdf)

</comment><comment><USER4> Is this like a succinct data structure? Can the compressed data be used in place without uncompression?

</comment><comment><USER5> aren't there prior art? This would be super useful for a string sorting algorithm I am trying to implement in Julia</comment>


Bridgepoint invests $30M in Trustly (company behind BankAPI) - <AUTHOR> http://www.bridgepoint.eu/en/news/press-releases/2014/bridgepoint-development-capital-invests-in-european-online-payments-services-provider-trustly/

<comment><AUTHOR> For those of you interested in our open-source projects, please check out our Github page at [https://github.com/trustly](https://github.com/trustly) Trustly is also a contributor to PostgreSQL, and a heavy user of the database: [https://github.com/trustly/keynotes/raw/master/PgConf%202014...](https://github.com/trustly/keynotes/raw/master/PgConf%202014%20Trustly.pdf)

</comment><comment><USER2> Congratulations Joel!</comment>


Marker: A terminal command palette - <AUTHOR> https://github.com/pindexis/marker <comment><USER2> CTRL-K for bookmarking seems like a possible mistake. That is a very common key combination for killing text forward from a cursor, and one which I use often every day.

It would also be wonderful to see this work with shells beyond Bash and Zsh, such as Fish or Csh for example.

<comment><USER3> This seems like a non-issue since it supports changing the key combinations with environmental variables. Anyone who uses Ctrl-K regularly (which I imagine is not the majority of shell users) can override the combo in their shell's rc file.

<comment><USER2> Yes I saw that.

Generally I don't want to have to resort to ENV config variables in order to get back to the default shell navigation key combinations which have worked on POSIX shells for thirty years.

It's nice they allow for overriding, but I'd prefer if people were more cognizant of built-in shell navigation.

</comment></comment></comment><comment><USER4> Looks nice! By command pallet, I understood as color pallet, as in color scheme. But this looks pretty handy!

<comment><USER5> Thats what my brain read it as well.

</comment></comment><comment><USER6> fzf does the same thing, but with more integrations: [https://github.com/junegunn/fzf](https://github.com/junegunn/fzf)

<comment><USER7> `fzf` is more of a broad interface for fuzzy matching lists with any number of possible uses.

Marker uses a similar interface but is built entirely for a particular use case (bookmarking, recalling, and autofilling commands with their options and placeholder parameters). Something that could have been built on top of fzf but it's not the same thing.

</comment></comment><comment><USER8> I've been searching for this for years! Never could figure out what people would call it, but I knew it must exist. Goodbye Ctrl+R x 100.

</comment><comment><USER9> I'm personally achieving something like this with a combination of binding Ctrl-R to fzf's history search and using zsh's vim command edit mode: [https://asciinema.org/a/fELHDWUytNGMBEFBGEjo5jJO7](https://asciinema.org/a/fELHDWUytNGMBEFBGEjo5jJO7)

<comment><USER10> Are your dotfiles available anywhere? I'd be interested in trying out this setup.

<comment><USER9> It's a bit messy, but everything related to zsh should be in here [1]. Apparently the vim command editor thing comes at least partly from prezto [2]

[1]: [https://github.com/Infinisil/system/blob/master/config/new-m...](https://github.com/Infinisil/system/blob/master/config/new- modules/zsh.nix)

[2]: [https://github.com/sorin-ionescu/prezto](https://github.com/sorin- ionescu/prezto)

</comment></comment></comment><comment><USER11> This seems very cool! A nice cross between tl;dr-pages and zsh autocompletion. Installed.

</comment><comment><USER12> I have been wanting to do something like this and been procrastinating hoping someone will do it for me.

</comment><comment><USER13> Looks cool. I will try it today</comment>


Ask HN: Academics who switched to industry, what's your experience been like? - <AUTHOR> Academics: junior academic researchers including phd students, postdocs and early career profs. <comment><USER2> When I was post-doc at a well-respected university, the Profs treated me with a combination with disrespect and contempt (when they were not outright ignoring me). I switched to industry; my pay went up 3X-fold, and my talented colleagues praised those problem-solving abilities that I developed over the course of my academic career. My advice to you; f*ck academia! Its a petty pointless prison where you'll never do anything worthwhile. Switch to industry in order to work and projects that actually have some impact on the world. Only then will you be treated with respect.

<comment><USER3> > the Profs treated me with a combination with disrespect and contempt (when > they were not outright ignoring me).

That's my experience of working with PhDs in software development (Germany). Yes, you are very smart Mr. Dr. Whatever. No, your PhD doesn't give you authority on picking the building blocks for the front-end and devops stacks. Now chill and bugger off, go back to the C++ image processing ML models (1 year of development and no release still).

<comment><USER4> I've worked with lots of PhDs from all over the world, and I've seen something similar from the Germans among them. Trying to assign menial tasks to their "lesser" colleagues; trying to meddle in their work and impose arbitrary decisions on them. In fact, I've seen them do it _among themselves_ and not just to the non-PhDs.

<comment><USER5> The German academic system is extremely hierarchical. So the head of the lab will be on all of the papers, in spite of having no academic input etc. Possibly the German PhDs you've met have inherited this toxic system as being the management style to aspire to.

</comment></comment></comment></comment><comment><USER6> I left academia in the UK as a postdoc in robotics, joined Firebase via H1B visa to San Fransisco, got aquired by Google, worked for 4 years. I found working for Google stressful, but lucrative and so it was the best decision i made. It totally change the course of my life for the better. I learnt so much about building teams, scaling impact, productionizing software, dealing with public. I missed academic problems, they are fun, but knowing your software has millions of users feels better and its nice having family vaguely recognize what you do. The medical and financial stability let me start a family without fear, not having to stress about money is a huge weight off my shoulders. I feel very lucky.

Not sure how repetable that is. I was lucky to get a h1b, and i was lucky picking a winner like Firebase early stage, but i genuinely beleived it was the future of development. So great move, and i think i could go back into academia if i wanted, so its left me in a stronger position.

<comment><USER7> Firebase is good platform and loved by many now.

What was your reasoning to join firebase in its initial days ?

<comment><USER6> I had failed to make a multiplayer computer game with traditional approach and realized firebase solved all my concurrency and push problems in a much neater way, and the security language didnt compromise too much expressivity unlike many other SaaS dbs. So i saw it solved a real problem in a simple way, way better with better ergonomics than i could do myself

I found out about it just by reading hacknews and noticed it seemed to be posting a lot and well.

<comment><USER8> Thanks. I missed one such opportunity in my life .. encountered guys at a YC event and thought they were brilliant. Managed to get an interview but it didn't work out (partially my fault, and partially because they had no idea how to deal with PhDs). Such opportunities are so rare in life. It is almost like winning the lottery.

<comment><USER6> Yeah i seized the oppertunity with both hands. I proposed and married my girlfreind in 2 days to get the visa jointly.

I got a job offer becuase i wrote software to solve a particular issue with firebase at the time, and posted it to their user group, then they offered a guest blog post which i wrote here [https://firebase.googleblog.com/2014/02/firesafe-add- complex...](https://firebase.googleblog.com/2014/02/firesafe-add-complex- security-logic-to.html?m=1) then i think i got the offer!

</comment></comment></comment></comment></comment><comment><USER9> I did my PhD in physics, and worked as a SWE right after graduation. Halfway through grad school, I started to feel academia is not my thing, but I cannot quit for all sorts of reasons (at least if thought so at the time). I used Matlab/FORTRAN/python for data analysis in my research work and intentionally looked into CS stuff along the way. I loved it, took a lot of MOOC and managed to eventually get a job in the industry. I loved it in the beginning, spent a lot of personal time doing work and had no complaints. The industry has amazing stride of coming up new technology/ideas, there is always something I can learn which never makes me bored. Most of the people seem generally smart and love their job. Over time I start to realize work is work and there are many factors in the play. I have to find a balance among interesting work, nice colleagues and good pay, but it is not too hard given the amount of opportunities the industry offers. Overall I am happy I made the move.

My academia background wasn't in the CS field, so I am not sure how relevant my experience is. I did often need to look up and read CS papers to help with my job, obviously not the same way as in research. I hated paper reading in grad school but start to enjoy it now, one of the reasons is the interest and motivation are stronger and also the for-fun mindset. Strangely it came to me that maybe things would work out as well had I stayed in academia.

<comment><USER10> > I hated paper reading in grad school but start to enjoy it now, one of the > reasons is the interest and motivation are stronger and also the for-fun > mindset.

You're not alone! I found reading papers for the sake of reading them to be boring. I'm not smart enough to read papers for fun like that. I need motivation. As soon as I'm actually working on software, I can cut through relevant papers and documentation like butter. Anything that isn't relevant to a problem _I 've created for myself_ is very hard to get through.

</comment></comment><comment> alex-mohr Matt Welch has written extensively about switching from tenured Professor at Harvard to Software Engineer at Google: [http://matt- welsh.blogspot.com/](http://matt-welsh.blogspot.com/), with the initial post [http://matt-welsh.blogspot.com/2010/11/why-im-leaving-harvar...](http://matt- welsh.blogspot.com/2010/11/why-im-leaving-harvard.html) Matt's blog is great because (a) he writes it, (b) he's still connected to academia via program committees and (c) you can see how his thinking has evolved over the last 8 years.

And there are of course a number of other former faculty there too, but none that I know of who've blogged as much as Matt. In the systems space, off the top of my head: Amin Vahdat, Mike Dahlin, Steve Gribble, Craig Chambers, David Patterson, David Wetherall, Eric Brewer.

Personally, I've had way more impact (and fun!) building Compute Engine and Kubernetes than I had in academia. If in doubt, try industry for a summer or a year -- nothing we write can replace personal experience.

<comment><USER11> Given that he put "teaching" in with "overhead", there's no shock that he left. The precise reason I chose to push to continue into a professor position was my love of teaching, and my willingness to sacrifice lucrative pay and work-life balance for it.

To me, hearing this is like an architect talking about loving the job, but not caring for all the designing buildings it seems to entail. And it's part of the reason that I never advise my students who dislike teaching to even contemplate the academic job market and trying to get a faculty position. If you don't love teaching, go get actually paid elsewhere.

<comment><USER12> At a tier one, you are paid to do research, not teach, unless you are a clinical or adjunct. So it's not just the professor binning teaching as overhead, but the universities as well.

If you love teaching, then being a professor at a top tier CS program might not be the right choice.

<comment><USER13> Teaching, research and service is the traditional job description for tenure- track professors.

Which tier one school does not expect and pay CS profs to teach?

<comment> barry-cotter Carnegie Mellon has no problem with you not teaching anything but grad courses if you bring in enough grant money to cover your salary and I'm not sure they care if you teach grad courses either.

</comment></comment></comment></comment></comment><comment><USER14> I finished my PhD in neuroscience, then went to work for a new biotech startup in the Bay Area. I did a mix of programming and chemistry automation there. Then I started a software company with a lifelong friend and after a couple years we found product market fit and it took off. We're almost 100 people now.

The work I do now has nothing to do with neuroscience, but I have zero regrets about my PhD. It was a fascinating period for me and I view it as an adventure I did in my 20s. I loved the work I did and it didn't need to lead into something else.

</comment><comment><USER15> An education :) Two start ups after phd and postdoc. Liked academia but couldn't afford it with two young kids. Joined a well funded start up. Was great for the range of problems I got to engage with. Was eventually sold to a multinational and very quickly turned into a soul destroying journey into the abyss. So much dreadful politics and nastiness. Left for another start up and am enjoying it. Have been involved in more of the business side this time, which is also interesting (and maybe depressing). I think I like the early stages of making something new. Supporting production systems and generally being "in operations" isn't my cup of tea. Your experience may vary... Strangely mostly miss teaching rather than research. I do more research now, just don't publish it.

</comment><comment><USER16> I earned a PhD in Neuroscience. Then suffered through a couple of postdocs and was not advancing in that career. I jumped ship to tech, working at startups and big-ish companies in San Francisco. The money was nice but working style did not match my preferences (frequent interruptions, projects decided by others, and hierarchies).

I decided to go back to academia (and stay in SF), primarily teaching Data Science. I realized that teaching is my passion. I took a pay cut, but it is more joyful for me. I can pick the courses I teach and get to mentor students. As I long I deliver, I can manage my time how I please. I still consult with tech companies.

I realized that I had to make my own way through my life. I found my niche which is 75% academic and 25% industry.

</comment><comment><USER17> No degree, worked in lab for 1.5 years writing software for neuralfeedback and data analysis for eeg/fmri systems in the NE area using a variety of programming languages/hardware. 1 co-authorship for a paper and 1 acknowledgement in another.

I dont find industry nearly as interesting subject wise, but pays way better than a research assistant with no degree. I worked remote (live in SE asia now, and traveling some from ME to Japan) for the past 3 years from one hedgefund to pharmaceutical data company (an arm of a hedgefund), and some random work. Now I algo trade my own funds and work on neuro related software/hardware side projects.

Only complaint is that too many employers still want people on site, but I dont care about it that much as I used to now that I'm doing my own thing and contract work if someone brings me something that interests me.

Don't see myself going into academia again in the same way, not intersted in the lab politics nor grant-paper hamster wheel.

</comment><comment><USER18> I was an academic on track to being a professor at a second-level university, or a principal investigator at a National Lab. Moving to industry was a great move- I didn't realize how badly compensated I was (2-3X income), had much more support and freedom for exploratory research, and people paid much more attention to my work (granted, I worked at Google, not all industry gives you this level of freedom). I also learned a ton of better software engineering and how to generally spend less effort to get better results.

If I had stayed in academia, I'd be spending all my time writing grants and papers and getting scooped by less scrupulous but more fecund authors.

</comment><comment><USER19> One of the things that really struck me is that after you drop out of academia to go into industry there is really no going back. I hadn't expected that; I thought I'd just give industry a shot since I can always go back to academia if I don't like it. Not so. The people hiring for academic roles see it as an act of high treason punishable by lifelong exile.

<comment><USER20> I don't think that is universally the case. I transitioned back into academia after being in industry. Admittedly, I was only out in industry a couple of years and I've not found academia to my liking.

My background is microelectronics, and in my experience there is still a big skills gap inside academia which I think only people from industry can really fill. There is no substitute for practical/applied engineering experience, and that experience goes a very long way in informing how realistic or implementable a piece of new research is.

If professors are insightful enough to see the skills which engineers from industry can offer academia, then it's a benefit to everyone.

<comment><USER19> Did you get hired in a proper research and/or teaching role though in the subject area that you previously worked in when you were in academia? Or did they just pay you out of a research grant for a role as a technician of some kind? Big difference there, as the latter are, in my experience, treated as a "lower caste" and get paid neither as much as other academics nor as much as they would get paid in industry.

</comment></comment></comment><comment><USER21> I'm a PhD dropout, but I did do lots of (somewhat poor) research leading up to that. For me, I was always a practical type, which made me less good as a researcher and more focused on engineering. Throughout my time in school though, I'd worked on the side (first commercializing our raytracing work, then consulting for Sony Pictures Imageworks).

I still stay involved in research, as I attend SIGGRAPH every year and often go to HPG. But, fundamentally, I'm sort of bad at imagining what will be a problem several years from now, and much better at solving something that's right in front of me. That led me to doing fairly systems-ey hardly research work, and then doing that as a full-time job :).

</comment><comment><USER22> A former co-worker of mine gave a lecture about what it was like to go from academia (Ph.D. in Classical Literature) to working in the tech/creative industry.

[https://youtu.be/4-wNv9FHLqM?t=232](https://youtu.be/4-wNv9FHLqM?t=232) (timestamped to just before he starts speaking)

</comment><comment><USER23> In the US. Undergrad degree included CS. Spent a few years in software engineering industry. Left industry to pursue a PhD in computation _al_ science. Returned to industry right after completing the degree. At a hedge fund for 4+ years now. Dunno if that counts as "switching". Anyway...

I love it. Interesting problems with demonstrable business impact when you find a good solution. Software in an environment where robustness can be critical but, too, overpolishing work can be full of opportunity cost. A chance to keep reading/using academic literature. I hit a conference about once a year. Great coworkers from a myriad of backgrounds. I can afford to have a family, to spend time with that family, to give them a nice quality of life, and to save for the future. I have been lucky/blessed/etc.

</comment><comment><USER24> This is a great question. Would be helpful if respondents could at least indicate the city/country of their experiences.

Living in Sydney, Australia I am not finding much interest by potential employers in my knowledge and experience in the field of software engineering. From discussing the situation with people I meet at international conferences, it would appear that the employment opportunities vary greatly across Europe and USA.

</comment><comment><USER25> The answers to this question will be as spread as possible, as a PhD is hardly comparable to another PhD.

Academic experience varies as much as the experience of working as a toilet cleaner compared to a man of independent means (= someone who stopped working for his/her money) - had to look this up (German: Privatier). It seems to me that there is no word for this in the English language which transports the true meaning [1]. Prove me wrong, please.

[1]: [https://dict.leo.org/german- english/privatier](https://dict.leo.org/german-english/privatier)

<comment><USER26> I think that's generally called financial independence in English.

<comment><USER25> Thanks, kaybe.

After discussions with my SO she suggested to checkout wikipedia, and guess what we found:

      Privatier ([pʀiˈvaˈtjeː], also spelled Privatus, with the feminine forms
      Privata or Privatière, meaning "private person") is a French word that
      was used from the 19th century in Germany and some other countries as
      a title by members of bourgeois families of substantial financial means
      in lieu of another professional title. Much like rentier, it denoted
      someone who did not have to work to make a living, and who lived off
      their assets of some size, e.g. interest, profits from investments, real
      estate and current assets.

sources: [0] [https://en.wikipedia.org/wiki/Privatier](https://en.wikipedia.org/wiki/Privatier) [1] [https://en.wiktionary.org/wiki/rentier](https://en.wiktionary.org/wiki/rentier)

<comment><USER27> "Privateer" has two more common meanings:

\- State funded sea pirates, esp. during the 17th and 18th centuries

\- In motorsports, a team which is funded by a private individual or group instead of a public corporation

"Financial independance" is the correct modern term.

</comment></comment></comment></comment><comment><USER28> I did my PhD in Civil Engineering and a 2 year postdoc in Austria (home country). I saw absolutely no future in academia, chances to get a permanent position were really slim and you could only go from one project to the other, which you had to hope to get funding for. Additionally, I was not happy with the group I was at.

So I decided to quit and found a new job at a small start up that is developing and providing consultancy for a CAE software. It was the best decision I ever made. I also did simulations during my academic life, but the pace has picked up significantly. I'm still at the forefront of research, but instead of pondering forever over minuscule details I'm now making stuff work. While the pay has not increased a lot, it's still better and I don't have to worry about getting funding, even though we do some research project, but if we don't get them it's not a huge issue. I have quite a diverse range of responsibilities including some managerial duties and I have grown and learned a lot in the past two years.

To sum up, it was great to leave and I wouldn't return unless I would be offered a professorship. I was extremely lucky with the company I work at and I think being in a small company allows to not just be another number in the system but actually contribute in many different ways. Obviously you need to have the right kind of people (incl. bosses) for that to be possible. Clearly, in a small company the human component is a crucial one.

</comment><comment><USER29> I left a research lab, started a BE company, failed, started a dev shop, which has had some success. I am glad I left, but there is very little opportunity to do research, or work on anything related to my phd. In retrospect, my opinion is academia is a toxic, low productivity environment that punishes ambition.

</comment><comment><USER30> Not many professors from business schools leave academia in the US partly because in business schools the salaries are much higher compared to other fields. Of course they are still lower than in the industry. However, many b-school professors do consulting and executive education which pays really well - anywhere between 2K to 10K per day. Btw, you can look up salaries of b-school professors in state universities in most states. (This usually excludes other income though) Some of the top professors make more than a quarter million a year. The highest I know earns more than a million a year only from salary.

I know a few people who quit business schools to join industry. Their reasons were mostly personal (spouse didn't get any job or the weather was terrible). They joined different companies in the Bay area. One of them said he is very happy with the transition in terms of money and dynamism but he rarely sees his kids now!

</comment><comment><USER31> There's a few options in between, namely the "industry professor" and the "industrial researcher". Many universities will hire someone with suitable industry experience who has previously adjuncted to teach classes and occasionally do research as a "Visiting professor" (but you have to be good at both sides, think [https://en.wikipedia.org/wiki/Bjarne_Stroustrup](https://en.wikipedia.org/wiki/Bjarne_Stroustrup)).

There are also numerous roles in industry which do research (even Oracle has a research lab!). This is probably the easier route, especially if you're not as keen on teaching, and more and more companies are open to people doing speculative work and publishing papers (note that i'm making the assumption we're generally talking about software development, ML, hardware development, etc).

</comment><comment><USER32> I've got PhD in a quantitative social science from an R1 university, so my experience may be different than others with PhDs in CS, Engineering, or the Physical Sciences.

In my view moving to industry was one of the best decisions I made in my life. Much(!!) better salary, much easier to find jobs, lots of choices of where to live, and better work/life balance. Having a decent salary and job choices also helped to stabilize my personal life as well.

The big reasons for leaving academia were job and money. Some of the brightest people I knew were fighting to get $40K postdocs jobs in high cost of living cities. Others were taking adjunct professor jobs in towns they didn't want to live in. All of it to hopefully one day have a tenure track job. One of the research jobs I was a finalist for had a terrible salary in NYC, but they provided subsidized housing in what was basically student housing for faculty. Not getting that job was one of the last rejections before I gave up academia.

The small reasons were all around being disillusioned with academia, both with research and teaching. The more honest professors would tell students to explore life outside academia. The ego-manics would boast about how they had a great tenure process and great retirement benefits, but all that was gone for new graduates. Some of the best and worst human beings I've met in life were in academia.

I was lucky that before my PhD I was a developer. So I had a some credibility when I applied for roles in software companies.

Just for a different viewpoint, it's really hard to evaluate the life you didn't live. When I looked at my PhD cohort 1-5 years after graduation it looked liked academia was a terrible decision. 5-10 years out the folks who wanted to stay in academia are doing well and the ones who left are also doing well. By well I mean with life, not just money. So maybe in the long run things work out, but the first few years after graduating can be awful.

</comment><comment><USER33> As soon as I finished my PhD in computational science, I left to the Bay Area. I did consider some positions in academia, but as others have described, the low impact of the problems I was working on and the path to permanent position didn't really motivate me. I have been one year in industry and though I am doing something different, filtering and sensor fusion, I would describe my overall experience as very positive. I still get to read a lot of papers, work with very intelligent and motivated people and every now and then I get some praise from my coworkers on my maths knowledge, which is nice. Deadlines are tighter and the metrics in which my work is judged on are very different.

</comment><comment><USER34> Got a PhD in Europe and later moved to the US for postdoc, then visiting asst. prof. then tenure-track asst. prof. All of these were very positive experiences, teaching- and research- wise.

I switched to industry while in 3rd tenure-track year and moved back to Europe, though the topic is the same (nonlinear discrete optimization). Most of the work is software development.

Enjoying a better paycheck and working 9to5 Mon-Fri (rarely had a non-work evening/weekend while in academia) but the research is still great and I get to publish articles and go to conferences. Miss teaching a lot and clearly I can't pick my own research topics, but the switch was definitely worth it.

</comment><comment><USER35> I graduated this past semester (Fall 2018), but I started working in industry a little over a year ago. I knew in my second/third year that academia wasn't for me. However, grad school gave me a paycheck (albeit small) + tuition and time to develop other skills that I did not have after undergrad. Further I had an awesome PhD advisor and enjoyed my research.

My experience in grad school wasn't bad and I think it only benefited me when transitioning to industry. At my job, I thoroughly enjoy my work and team (it's important you find your fit). The compensation bump was also nice compared to a PhD student stipend.

</comment><comment><USER36> Pharmacology PhD (6years), post-doc(6 years), despite excellent publication record, not flashy enough to get grants or a tenure-track position after post- doc, continue as super post-doc(RS at our institution) for 7 more years until funding finally ran out. Gravitated to big data analytics, learned coding, learned ML and more math, looked for job. Total unemployment time == 1.25 years. Found current position (almost a year now) after about 200 applications. Happy as a clam and not the old bitter scientist of old.

</comment><comment><USER37> Better payment and people didn't care about proofs anymore.

It's okay to leave a few edge-cases out if it simplifies the solution drastically and doesn't lift the error rate too much.

</comment><comment><USER38> I don't think a general answer is possible. Academia and industry both cover such a huge range.

For example in my case, I did a PhD and then went into embedded industry. We did better engineering in some research projects than in the industry project I'm currently in. In both cases the projects are not representative though.

In general, I can only say that I enjoy building stuff which gets actually used. The chance for that is much higher in industry.

</comment><comment><USER39> I completed a Ph. D. in software engineering between 1998 and 2003. I started out in Sweden (Blekinge Institute of Technology) and finished it in Groningen (NL). After that I continued as a post doc and then decided to quit the academic world.

My main reason for this was that the paths to success in academia are basically to be a glorified manager (aka. a professor) or a teacher. Doing research seems to be mostly not on the table for either path as that is outsourced to Ph. D. students and post docs on temporary contracts. The path to professorship is long and hard and involves dealing with organizational politics to establish slow progress via post doc positions, an eventual tenure track position to maybe a professorship. Over the course of this career you have progressively less time to do research and you get bogged down in bureaucracy, budgets, and other management stuff.

The alternate track of becoming a teacher seems reserved for those that fail the first path. This has always felt a bit wrong to me as an important function of a university is teaching. But the reality is that as a teacher, you do no research and you report to professors that are mostly interested in doing research and regard you as a second rate citizen. This seems to be more true in Europe than in the US where quality teaching is key to university revenue and thus your career.

I was well on track with the research path having a steady stream of publications and options for continuing. But neither path appealed to me and I found the prospect of dealing with university politics, funding, and publications for the next forty years to be unappealing. Teaching could have been appealing to me but not as outlined above where you are essentially treated like a career failure.

So I left university to work for a small software company (for the first time practicing what I had been preaching) and later rebooted my academic career for a few more years in industry by joining Nokia Research in Helsinki. In there I found myself doing a lot of the same things as a post doc but with a decent salary and career options. I had a lot of fun and worked with some smart people on some cool projects. Unfortunately Nokia did not last and I transferred out into the maps unit in Berlin. After a few years, just before it turned into here.com, I joined the startup scene and have also done some freelancing.

I haven't really looked back. I enjoy building software and learning new things while doing that. I'm currently in a CTO type role and I haven't published anything this decade. So, my academic career at this point is pretty much over. I don't miss it but it is definitely been educational and formative. IMHO the most important function of a academic education is learning to think for yourself and the ability to learn new things. That doesn't really stop when you leave academia and they don't have a monopoly on this. Especially for computer science related fields, a lot of the progress is actually made in industry, not academia.

</comment><comment><USER40> It depends how well you enjoy your work. Some business feels like a dream, some business feels like hammer+nail=your life.</comment>


Turkey PM: Social Media Is "Worst Menace To Society", 25 Twitter Users Arrested - <AUTHOR> http://techcrunch.com/2013/06/05/social-media-is-worst-menace-to-society-says-turkey-pm-25-twitter-users-arrested/

<comment><USER2> Well, of course it's a menace to (their) society. They've created a society that depends upon people not organizing themselves and being completely dependent upon their leadership.

Not to say there is any country which isn't to some degree.</comment>


Pricey 'pirate ship' home is what's wrong with Bay Area real estate - <AUTHOR> https://moneyish.com/splurge/this-insanely-pricey-56-sq-ft-pirate-ship-home-is-exactly-whats-wrong-with-bay-area-real-estate/ <comment><USER2> Pretty sure this is 56 feet long, not 56 square feet in area. So the per- square-foot price is overinflated.

<comment><USER3> _Three bedrooms_ in a 7' by 8' (for example) area.

People who complain that the Bay Area needs more "high-density housing": this one is for _you!_

To be fair, this property _is_ unusually resilient with respect to rising sea levels.</comment></comment>


StandupMail: Keep your team up-to-date - <AUTHOR> https://www.standupmail.com/# <comment><USER2> I have to say I don't see the added value of your service. Unless I'm mistaking something, the flow is that you email everyone once a day and they have to reply with what they've done, and then everyone gets an update of what everyone has done. This is manual work, and something that could be set up by anyone using cron in minutes.

The thing is, almost all services that people use for tracking projects nowadays have some way of interfacing with the information. So I have tools that _know_ already what I've done. Why would I want to spend my valuable time writing that up again?

<comment><USER3> This is a strangely familiar tone of Hacker News...

Remember Dropbox? [https://news.ycombinator.com/item?id=6625306](https://news.ycombinator.com/item?id=6625306) with these comments: [https://news.ycombinator.com/item?id=6625818](https://news.ycombinator.com/item?id=6625818)

<comment><USER4> Eh, I'm not sure you can really compare the two.

I think when the naysaying is "this is not technically feasible or efficient/too costly/has no revenue model", yet the theoretical idea is good in a "perfect world", you have a real shot at proving them wrong.

When the naysaying is "even if this works exactly as expected, most people would not get a lot of value out of it", assuming their reasoning is correct, then the naysaying can be justified.

It looks like most of the original concerns over Dropbox from sensible and experienced people fall in the first category, not the second.

I'm not a VC or startup/business person so I could be completely wrong, but that's the view I've managed to piece together over time. I think pg's model of "can you envision a small cult following of users who will _really_ love this product/service?" is the best way to look at it. If you can get that initial cult following, then all other problems can (likely) eventually be overcome. If you can't get that, then you're sort of wasting your time.

</comment></comment></comment><comment><USER5> Shouldn't workers be home spending time with their families in the evening? Why is this considered acceptable behavior from an employer?

Maybe there should be a "premium" option for an automated nightly conference call, where employees can call in and confirm that they replied to the nightly status email, and also share any cool stories about what it was like to be away from the office for a few hours. It would be a great team building exercise.

Another productivity booster is chemical castration. Families really eat up a lot of time, which ends up costing the companies. Employees who voluntarily get vasectomies could be given a 15% spot bonus.

<comment><AUTHOR> You're free to define when the team is expected to answer. It could be in the morning... during the day. Alle-in-one emails but also one email per task finished fitting into existing workflows.

However, the idea is to send a quick answer back, when your accomplishments are still "fresh" in your mind - Shouldn't take you longer than 5min.

And yes, workers should spend time with their families. I'm doing that right now, too :)

</comment></comment><comment><USER6> It is more or less same as idonethis, but a bit less priced.

If you like this, take a look at [https://github.com/agiliq/worktogether](https://github.com/agiliq/worktogether). We use and like idonethis, this app is just experimental at the moment.

<comment><AUTHOR> Besides pricing, the differences lie in the details, i.e. we allow for different types of bullets sent in etc. We're also fully focused on providing the best possible experience for teams.

<comment><USER7> "We're also fully focused on providing the best possible experience for teams."

Wouldn't anyone making any product ever say this?

<comment><USER8> it's right out of Faker::Company.bs

</comment></comment></comment></comment><comment><USER9> Okay, first I take a little issue with the notion that we're transferring the time spent during a morning stand-up meeting (during work time) to the evening (supposedly non-work time). Is that a selling point? Do we really need to erode our after-hours time even further? Seems the only winner here is the company purchasing the 'service'.

Secondly, isn't this something most people with even basic scripting language savvy could whack together on their own (company) server? Setting up a mailing list with a daily digest (sent out first thing in the morning) and a daily 'reminder' e-mail in the evening isn't exactly hard. If I was so miserly that I'd want to screw my employees out of ten minutes of their time, I'd certainly be miserly enough to set this up myself, not pay 10+ euro a month for it.

</comment><comment><USER10> This is great in many ways: 1) Your boss can skip coming to your desk and interrupting you with "what have you been working on?," 2) Every time you answer that question verbally you forget something important, 3) Using other tools to report on your work makes everything complicated, 4) Email is easy, 5) You get to summarize your day, if not for report for your own good 6) Forget the team, I now have an archive of everything I have done.

Added feature: Perhaps users can send emails throughout the day if they want to, instead of waiting.

The scary part: Your company's information in the hands of a company you do not know much about. It becomes very easy to be kept hostage, I guess unless exporting your data and completely deleting it from their servers is an option.

</comment><comment><USER11> Is it different from: [https://idonethis.com](https://idonethis.com)?

</comment><comment><USER12> I've seen this concept before and thought it might be useful in my organization. The general opinion I got back was that people hate email, and the daily digest would be pretty well ignored. Once I was reminded of this, I fully agreed.

In fact, using tools like slack, asana, phabricator, and github enterprise there's an overall goal to do less and less email and something like this would be a step in the other direction.

What we're looking at setting up is a centralized dashboard to tie our tools together and include status updates. The tool I'm looking at is [anthracite]([https://github.com/Dieterbe/anthracite](https://github.com/Dieterbe/anthracite)) which bills itself as an event manager ("an event / change logging/managament app").

On the surface, this looks like something you use to track when code is changed or server changes are made. And that is a lot of it. But it's really a way to display events and you can have pre-made filters of events (call them event streams). You can integrate it with your chat system or email to post status updates by hand, you could have task management systems like asana post updates, etc.

Granted, I'm not entirely sure yet if anthracite is mature enough for what we're looking for, but we definitely are angling for that approach.

</comment><comment><USER13> Right or wrong, many people that I've worked with view the 10-minute morning stand-up meeting as a "starting function" for their day. This would completely break that function of a stand-up.

I'm also not too fond of anything that would cause people to work later in the evening. The one problem I see this potentially fixing is the feeling of forgetting everything you did over the weekend.

<comment><AUTHOR> StandupMail shouldn't replace your standup. But think of situations when you're working with distributed teams. Many teams are working in this mode... not just development teams. Think of marketing, sales etc.

</comment></comment><comment><USER14> We're a generation of coders raised by email. I'm wondering if another email is really the answer we need.

<comment><AUTHOR> It's 1 more aggregating many others you don't need then anymore. And, it's not only for coders :)

</comment></comment><comment><USER15> I'm not exactly sure what problem standupmail is trying to solve, or if it's artificially creating one. Sending out automatic reminders for status updates and a daily digest doesn't justify the pricing IMO, as it's something that can be done easily via automatic email reminders / calendar events.

StandupMail seems to want to replace daily standups for teams, which I don't think is a good idea.

First of all, standup meetings are essential to start the day. It's the team's huddle before heading out into the field. It's to provide updates on yesterday's play, but also to discuss briefly any topics of importance, making sure everyone's on the same page for the present day. Replacing that with a one-directional email update would hinder all that.

>INCREASE PRODUCTIVITY

I would argue that taking the time to write an email, read each other's update etc actually reduces productivity overall. It's much easier to go to a 5-10 minute standup and hear everyone's update as well as verbally provide your own update. In fact, if I need more clarification from someone's update, I'd have to interrupt that person after I've read the email, or write out more emails.

> Avoid time-consuming status meetings and interrupting the team from > accomplishing their tasks.

Standups and status meetings are supposed to be brief. They usually happen at the end of day or beginning of the day where it provides a lot more value (as a wrap up or an anchor to the start of the day) than interruption (if any). If your status meetings are taking a long time, you're doing it wrong.

> NO MICROMANAGEMENT

If a regular standup = micromanagement, then how is an email reminder for standup updates not micromanaging? Keeping the team on the same page about what needs to be done is easier with a verbal standup. IMO whether there is or isn't any micromanagement in regular standups, it wont change with email updates. It's more of a team dynamic than a process/tool issue.

<comment><AUTHOR> Problem to solve: keeping a team of people working on the same project up-to- date in a simple way - overcoming barriers like availability and distribution of team members.

You might be right with your arguments if you see StandupMail as a tool replacing your Scrum standup. However, it's intended to be a tool for every team out there working on the same topic - most teams don't even know what a "SCRUM Standup" is (ask your sales team for example).

</comment></comment><comment><USER16> You seriously need to show an example workflow without having to sign up. If you don't have money for a video, just create a page with a few screenshots and short explanations.

</comment><comment><USER17> Interesting, I just built a service sort of like this yesterday and was going to 'beta' test it with my team starting monday. I don't like the "evening" and "morning" emails, as I work on a distributed team and "evening" and "morning" are very subjective.

Distributed and remote employees I think is one of the biggest challenges facing the work place at the moment, with no good solutions available yet.

btw, your ssl cert is broken when visiting non-www.

<comment><USER18> I built a system like this one that we coined "daily update" and supporting the concept of a non uniform morning was just a matter of using timezones. Each employee had a timezone setting that was automatically detected but could be overridden and our morning email was sent to them at their 9am. Now, obviously what time you start your day is subjective but it seemed to work for those that enjoyed it by being the earliest value.

</comment></comment><comment><USER19> What we have found from running Weekdone ([https://weekdone.com/](https://weekdone.com/)) which has options for both daily and weekly update reports I would say around 5-10% of customers opt for the daily option. For most, weekly updates via e-mail are enough - just like many rune their stand-ups weekly and not daily. Of course, we do have a real- time newsfeed which many use on mobile and web for the updates.

<comment><AUTHOR> You can do weekly reports with StandupMail as well. You're free to schedule reminders/digests however you want under "settings".

</comment></comment><comment><USER20> We use teamsnippets.com. I've a love/hate relationship with them. As a part- time employee and a full-time father, the last thing I want to do in the evening is switch context _again_ and type up what I did during the working hours.

On the other hand: I do like reading what my colleagues did during the day....

</comment><comment><USER21> We are using standup mail everyday to update our tasks. Unlike standup mail we do it manually every morning.

Idea is good but I am not convinced with the pricing. I can do it manually anyway by just cc ing the entire team.

I suggest to give it for free upto 5 or 10 users then charge for the members above that.

</comment><comment><USER22> It's a nice to have, but it's not priced with respect to value.

I'd also be hesitant to route somewhat confidential emails through a one-man band development shop who may or may not be snooping them out of interest.

</comment><comment><USER23> Actually we've taken this to the next level with [https://teamlens.io/](https://teamlens.io/) \- and as email may be good way of reporting your progress, it's a bit obsolete + it requires actual "answering" to it, so it (it my opinion) adds extra complecity to the whole process (it's hard to give status "in real time" or whenever you want it during the day). We'll be launching next week or so (hopefully).

</comment><comment><USER24> I get a blank page with JavaScript disabled. Is this how the web is supposed to be in the future?

<comment><USER25> And I can't drive places without fuel in my car. What's your point? You made a conscious decision to cripple your browsing experience, what did you expect?

<comment><USER24> My point is: is there absolutely no content that can be displayed without JavaScript being enabled? I'm sure there is.

It's a matter of principles (I shouldn't be compelled to enable JS on a website only to view its static content - or _any_ content at all), it's a matter of accessibility (people with impaired vision who use text-to-speech software will have a harder time with this page)and it's a metter of compatibility (not all devices/browsers run JS)

</comment></comment></comment><comment><USER26> How can I contact support ? Don't see any info regarding this on the website ? Thanks.

</comment><comment><USER27> how's this different to iDoneThis?

</comment><comment><USER28> sounds good. i will give it a try!</comment>


New service to help out journalists - <AUTHOR> http://helpareporter.com/

<comment><USER2> This service has actually been around for nearly a year. We interviewed the founder, which resulted in an interesting little exchange in the comments with its established rival, PR Newswire:

[http://www.thestandard.com/news/2008/07/22/source-source- cou...](http://www.thestandard.com/news/2008/07/22/source-source-course- course-except-when-its-free-and-driving-huge-company-crazy)</comment>


Across the Country, Fans Gather for iPad - <AUTHOR> http://www.nytimes.com/2010/04/04/technology/04ipad.html?hp

<comment><USER2> I'm going to use this with Dropbox to create compilations of Reference materials. (PDFs of music and programming references.) I'm also going to use this as an eReader and a test machine for iPad development. (EDIT: Correction, I am using it as an eReader with the Kindle App.) I'm going to use it as an electronic travel guide. (I can use the flap from the Apple case to help me with daylight readability, if needed.) I have a 3G mobile WiFi hotspot, so I'm also going to use it to research products while in the store -- far more comfortably than on the iPhone's small screen.

Basically the iPad will be put to most of the tons of uses I've found with my tc1100 Windows Tablet, but in a form factor that's half as light, much brighter, a battery life of "don't worry," and unencumbered by a stylus.

Skype works great on this thing! Having a jailbroken iPhone 2G with the Google Voice app on it as a companion is great. I'm notified of a call when my phone rings, and I can just switch to Skype on the iPad in time to receive the call. (Did this when my Dad just called.) Can't get my Plantronics 510 to sync with it, though. This thing is going to save me prepaid T-Mobile minutes!

<comment><USER3> I just purchased goodreader for 99 cents and it is better than dropbox alone. (I love DropBox by the way) this lets you import data from multiple places in your filesystem. Not just from the dropbox folder hierarchy. it will even let you use the app to download stuff from the web into your iPad. Well worth a buck.

</comment></comment><comment><USER4> Editorialize the title much? Can you just switch this back to the NYT's title?

<comment><AUTHOR> The title is a summarized quote. I wanted to use the entire quote as the title but there is an 80 character limit. Here is the quote:

"Many of the people waiting for the iPad had a vague sense that they were involved in yet another big Apple moment, although they could not precisely say how they would use the tablet computer"

So no I didn't really editorialize, because it's the quote that I thought was significant.

I guess my objective was to spark a discussion about why people are buying this thing if they don't know how they will use it. Because it's a big apple moment?

<comment><USER4> You should write a blog post with your thoughts about the launch in it, and submit that, instead of submitting other stories with a spin on it.

<comment><AUTHOR> Spin implies misrepresentation. As the other comment noted I did not misrepresent anything.

<comment><USER5> Sure you did. You presented one minor aspect of the article as if it were the theme of the article. It wasn't.

</comment></comment></comment></comment></comment><comment><USER6> I _really_ want one too, but most of that is indeed from the fact that all my buddies are picking them up, and it seems like a nice gadget. For someone like my mom, grandparents, this is a perfect device. My grandpa has a shitty old WebTV for his email, because it uses a familiar interface (his la-z-boy and tv dinner table), but I could _easily_ see him picking this up, opening emails with his finger, etc...

For me though... it's a novelty. I live in my Macbook Pro, so I don't need another webkit device to play around with on weekends. Although.... it would be really nice on plane trips. That 10hr (12hrs by David Pogue at the NYT) battery life (playing video) is going to be a game changer for sure. Tie that in with Netflix streaming, and you've got a pretty sick portable movie machine! Hopefully they do some kind of client-side caching "offline" mode, so you can get a streaming movie stored for a flight.

</comment><comment><USER7> There's a NYT article from Thursday with better man-on-the-street sentiments: _"Where am I supposed to use it? Am I supposed to use it on the bus — and get robbed?"_ [http://www.nytimes.com/2010/04/02/technology/personaltech/02...](http://www.nytimes.com/2010/04/02/technology/personaltech/02gadget.html)

</comment><comment><USER8> People waiting for the first Mac didn't know how they would use it either. Look how far we've come.

</comment><comment><USER9> Personally, I can't wait to use the iPad to research and write up my speculations on Apples next device.

</comment><comment><USER10> Submitter must be working for Fox News.</comment>


In Defense of Chrome OS - <AUTHOR> http://techcrunch.com/2010/12/14/chrome-os-future/

<comment><USER2> So the "defense" as I read it boiled down to:

1) Just because it isn't ready yet doesn't mean it won't be someday,

2) It has a better chance of being improved because it's closer than other Google projects to their company's core competency, and

3) The market may not be ready for it yet.

Even if I grant the first two, that last point is problematic. While there are plenty of people who like keeping their data in the cloud, I get the impression the Chrome OS use case is for people who only want their data in the cloud. I wonder how many machines that will equal, given that we've just had a couple of decades of laptop usage and having more than one computer is popular.

Tangentially, at the risk of sounding like a 2nd cousin to rms, I find I'm still a trifle irked that Android and Chrome are being referred to as operating systems when in fact they're new user interfaces stuck on top of Linux.

</comment><comment><USER3> Why do people feel the need to 'defend' products that aren't their own? Either those products will stand by themselves, or they aren't worth it.

<comment><USER4> Why do people feel the need to 'attack' products? Either those products will fail by themselves, or they're worth it.

</comment></comment><comment><USER5> I don't think a pre-beta product needs any defense further than the fact that it is pre-beta. Besides most of the 'reviews' were positive about the OS and critical about the hardware which is merely the conduit for the OS at this point.

<comment><USER2> Back in the dark ages, we used to break pre-production into three stages: alpha (distribution inside the organization for comment, subject to possible radical change after feedback), beta (distribution to key customers for feedback), and gamma (more wide-spread release after feature-freeze).

I don't know how you can call something "pre-beta" if you're giving it a release outside the organization. It's not as if Google didn't know people would be commenting on it. What does that term mean?

<comment><USER6> It's just a way of saying that the beta is released earlier than it normally might be, on account of caring more about getting user feedback early and less about that feedback being taken as negative reviews.</comment></comment></comment>


O'Reilly drops ebook DRM, sees 104% increase in sales - <AUTHOR> http://www.boingboing.net/2010/01/22/oreilly-drops-ebook.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+boingboing/iBag+(Boing+Boing)

<comment><USER2> Note that the post is from boingboing, not O'Reilly, whose post says nothing about DRM. I've no doubt that the main reason for the sales increase is that more people are buying ebooks, not the dropping of DRM.

<comment><USER3> I think any reader of boingboing should first consider if they are reading a specious argument designed to further the author's agenda. One should not use the comments at boingboing for reference material in this effort, unfavorable facts are sometimes removed from those.

Edit: I don't mean to rag on boingboing. They are what they choose to be and it works for them, but sometimes people mistake {headline,paragraphs} for journalism.

</comment></comment><comment><USER4> Offtopic for the linked article, but the original O'Reilly article says that digital sales will take over physical book sales sooner than people thought.

I think that's true, judging by my own purchase behavior. I haven't bought any O'Reilly digital books yet, but I have bought a few from Pragmatic.

I now prefer buying technical books in a digital format to overcome the high shipping charges(international customer). And although I can pirate most books, I don't. As long as they provide me with an easy way to give them my money and very few restrictions on how or where I can read the content that I bought, I'll be happy to fork over my hard earned dollars. Music downloads on the other hand, don't provide that and so....

What remains is the feeling you get when you grab a physical book and a cup of tea to enjoy on your couch. You get used to reading on your ebook reader and your phone, but it won't be the same. Things are getting better with different reader designs and I think newer generations will find this less of a problem.

<comment><USER5> _Music downloads on the other hand, don't provide that and so...._

Amazon MP3s have no DRM, and pretty much everything in the iTunes Music Store is also DRM free these days.

<comment><USER4> Amazon doesn't allow me to purchase mp3s from the store since its US only. I don't know if iTunes does that, but I am not a fan.

<comment><USER5> I believe iTunes sells DRM-free 256kb AAC files, except in Japan.

They sound great, and play on pretty much everything.

<comment><USER6> I'm not quite sure why they still have county lockouts (except for the potential marketing release dates, but still).

Its fascinating though to see such consistently strong numbers for increase in downloads due to the removal of DRM. We'll see if dollars incent publishers to ease their usage of DRM in the future.

</comment></comment></comment></comment></comment><comment><USER7> What would the percentage gain have been during that timeframe anyway? Print -> online sales are making huge gains each month, not necessarily because of DRM or not.

That being said, removing DRM is fantastic, and everyone should buy or contact publishers and let them know how much you appreciate the lack of DRM.

</comment><comment><USER8> correlation/causation

<comment><USER9> You're absolutely right. Your two word snark has really added value to this discussion by clarifying that there is really no reason we should believe that these two things might have anything to do with each other whatsoever. I mean, variables routinely fly up and down by over 100% for no reason.

As xkcd had it: "Correlation doesn't imply causation, but it does waggle its eyebrows suggestively and gesture furtively while mouthing 'look over there'."

</comment></comment><comment><USER10> O'Reilly's original post does not say anything about DRM.

<comment><USER11> Apparently DRM was dropped 18 months ago, and mentioned in a previous O'Reilly announcement. This current post linking to the announcement of sales going up is simply inferring that one lead to the other.

<comment><USER12> O'Reilly has never used any DRM on their own (oreilly.com) downloadable stuff ever. The first 12 titles they put into the Amazon Kindle Store had (were forced to have) DRM for a while, then they got Amazon to drop the DRM.</comment></comment></comment>


How we boosted our API's performance 8x by switching from PHP to Go - <AUTHOR> https://www.kairos.com/blog/php-to-go-how-we-boosted-api-performance-by-8x <comment><USER2> Should have a subtitle, "The benefits of a compiled language over an interpreted language"</comment>


Live: SpaceX CRS-10 Falcon 9 Rocket Launch - happy-go-lucky https://www.youtube.com/watch?v=xdOuZ2WZHv8 <comment><AUTHOR> Landing was filmed live from the rocket. Kinda cool to watch:

[https://youtu.be/xdOuZ2WZHv8?t=52m36s](https://youtu.be/xdOuZ2WZHv8?t=52m36s)</comment>