Google's Abandoned Android Authenticator App - <AUTHOR> https://shkspr.mobi/blog/2020/02/googles-abandoned-android-authenticator-app/ <comment><USER2> Related current thread: [https://news.ycombinator.com/item?id=22443225](https://news.ycombinator.com/item?id=22443225)

</comment><comment><USER3> This is a bad article. Let me summarize my thoughts:

\- The "security bug" it references isn't one at all. Accessibility Services can draw over other apps and interact with them _by design_. They're designed as an alternative way of interactive with android for disabled people consequentially they can do anything a normal user can do. The security "researcher" found a non-bug then convinced an ignorant journalist at zdnet to publish an article about normal/correct Android functionality.

\- If it were somehow a bug, it is still impossible for Google Authenticator to patch/mitigate it. Accessibility Services act as the user, therefore they can do anything a user can do. You cannot block them for good reason (breaks disable user's ability to use Android).

\- The third party apps they reference don't block Accessibility Services either, making it hypocritical to criticize one while pointing to others with the same fictitious flaw.

\- Switching to a random open source TOTP/HOTP 2F app might reduce your security, not increase it. You'll either compile it yourself requiring enabling "Allow installation from unknown sources" (bad) or you'll more commonly just grab it from the app store, in which case that random OSS developer's account can feed you evil-ware either intentionally or via compromise. As soon as it is from the app store the "open source" nature is completely irrelevant, it isn't a security guarantee.

\- No unpatched security bugs have been found in Google Authentictor. Google Authenticator's lack of updates are annoying though (unfixed bugs, poor backup support, QoL features like secondary pin, etc). Just not the way the article frames it.

<comment><USER4> > compile it yourself requiring enabling "Allow installation from unknown > sources"

This is one of my biggest pet peeves about Android. I wish i could add my own signing key for apps I compile myself, rather than just being given the choice of Google play or anything at all.

<comment><USER5> In a round about way you sort of can now. The "allow installation from unknown sources" is per app-source now. You need to enable it for Google Chrome if you downloaded the package from Chrome, or for F-Droid if you downloaded it from F-Droid. So, the solution you're looking for could be just a small shim app to download from your own repository of sorts. Janky .. but it's a bit more possible than before I guess. As an added bonus you could do some signature validations too!

<comment><USER6> If you use F-Droid, you could also just set up your own local repository for your custom apps.

<comment><USER5> Yup! I was just running under the assumption the parent comment wanted no other apps period, with a smaller surface to attack.

</comment></comment></comment></comment></comment><comment><USER7> Wait. The vulnerability report says, "Abusing the Accessibility privileges, ..." the trojan can steal your OTPs. If you give a program accessibility privileges, it can read the screen. Is that all we're talking about here? What is the proposed mitigation that Google should implement on the app? You can't block accessibility on the OTP app because then blind people will not be able to use it.

<comment><USER8> > You can't block accessibility on the OTP app because then blind people will > not be able to use it.

You can block accessibility from the specific field of the OTP app, if you also have a system framework that retrieves exactly the contents of that field into your paste buffer when you interact with a privileged UI element (i.e. the keyboard-UI "autofill 2FA" accelerator.)

<comment><USER9> That won't work if someone it trying to use the code on their desktop. The screen reader won't be able to read the code to them, so they won't be able to log in.

<comment><USER10> Thee is no reason not to have a special privilege level for screen readers.

<comment><USER11> There is a special privilege level for screen readers. The issue is that the hypothetical malicious app pretends to be a screen reader.

<comment><USER10> Do you mean it hypothetically actually functions as a screen reader but also steals data, or something that just requests the privilege while being something completely different?

<comment><USER11> Either one, but realistically the latter.

In the former case, you just call your app SuperLegitScreenReader, prompt the user to grant accessibility access, and then snarf up data. Bonus points if you bundle in some open source or pirated screen reader code so your app can act the part, but you could probably just say "fetching reader data, screen reading will be functional in ~60 minutes" and count on most users to not bother uninstalling the app or revoking permissions.

In the latter case, you call your app "CandyNinjaBirds", and have it pop up and say "to let you share cute stickers to your friends, you need to enable accessibility access" and count on the vast majority of people to click "allow".

The latter case is way more common because the former case limits your target audience to people who actually want a screen reader.

<comment><USER10> Ok - but given the small number of actual screen readers it would be easy for a store to have extra policing for this privilege.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I switched to Authy some years ago. It took Google forever to add the ability to Authenticator to let you migrate 2FA codes to new devices, and even then, it was only Google codes. I got tired of having to _deactivate_ 2FA on my 20 or so accounts, switch to my new Android device, _reactivate_ 2FA, and then scan the QR codes on the new device. Authy made it a painless experience, particularly since I could verify codes were working on the new device before factory resetting the old one.

<comment><USER13> I use Authy, but God, I hate their UI and UX. Finding the accounts there is a pain in the ass, and for some reason, I always end up with duplicated accounts (when I just added them once). Also, it has been two months since their last iOS update, so it's not like Twilio is taking care of it either.

<comment><USER14> Give andOTP a try[0]

[0]: [https://github.com/andOTP/andOTP](https://github.com/andOTP/andOTP)

<comment><USER15> I love andOTP, it does one job and gives me (not my phone's firmware) control over the secret storage.

</comment></comment></comment></comment><comment><USER16> I recommend to use anything but Google Authenticator. andOTP is my preferred considering you can make non-encrypted and encrypted backups of all entries.

I lost my phone once and was primarily using Google Authenticator at the time. Because I didn't backup the seeds when registering entries to Google Auth, I had to go through some recovery processes on many of my accounts which where time consuming, nerve wrecking, and annoying. This was at the height of crypto craze so one account was Coinbase in which I had to go through some in depth recovery process (with an ID an all, which ended up crossing some legal lines in my state).

Do yourself a favor and either use a service with a supported and up to date app or take control with an app like andOTP and take backups yourself.

</comment><comment><USER17> I got rid of Google Authenticator in 2018 preferring Microsoft Authenticator after feeling weary about having to setup 2FA on a new phone and subsequently reading posts like [https://smartphones.gadgethacks.com/news/google- authenticato...](https://smartphones.gadgethacks.com/news/google- authenticator-is-not-best-2fa-app-anymore-0186776/) which made me aware that I didn't have to go through that pain anymore if I dumped Google Authenticator.

<comment><USER18> If you do not mind your phone contacts are shared with the app [1], Microsoft Authenticator is fine.

[1] [https://docs.microsoft.com/en-us/azure/active- directory/user...](https://docs.microsoft.com/en-us/azure/active- directory/user-help/user-help-auth-app-faq)

<comment><USER19> "Contacts and phone: The app requires this permission so it can search for existing work or school Microsoft accounts on your phone and add them to the app, helping to ensure your account works properly. This permission also helps save you time while adding your personal Microsoft accounts, by automatically filling in some of the info for you, like your first and last name."

Wow, they really did their best to find a sliver of justification for that permission. I don't need an OTP app to autofill my first and last name.

And to those arguing about their opt-out for this permission, ask what unnecessary permissions your coworkers/family/friends have denied on the last few apps they installed.

<comment><USER17> Recommend that you install the application first and check what it asks for before coming to a conclusion based on this doc. The score would have taken a hit based on what you are saying. Furthermore there is no argument here just facts based on user experience.

> Contacts and phone. The app requires this permission so it can search for > existing work or school Microsoft accounts on your phone and add them to the > app,

Keyword here is requires. This doc is out of sync with the application, unsurprisingly.

<comment><USER19> Honestly, I wouldn't willingly install anything by Microsoft. Everything is overloaded with unnecessary telemetry.

On that note, for anyone using Microsoft's VS Code, I recommend [https://vscodium.com/](https://vscodium.com/)

</comment></comment></comment></comment></comment><comment><USER20> This looks like the same pattern observed with the iOS Google Authenticator app. That one was neglected for multiple years as well, up to the point at which it looked ridiculously out of place on newer devices because it was running in some compatibility mode for old screen sizes and screen resolutions. After multiple years of no support whatsoever, they finally updated it. But apparently that was just random luck - the current version is over a year old already as well, with the update news saying "Added support for iPhone X".

I don't get it why Google apparently does not get the notion that they basically "own" the brand identity of what we technically-minded people know as the TOTP 2FA scheme - and they own it because of the Google Authenticator app. Thousands of websites ask their users to install "the Google Authenticator app" if the user wants to enable 2FA - they don't tell them to install "an OTP app" or something like that, no, practically everyone refers to this scheme and the associated apps as "Google Authenticator".

And it can't be too hard for a company able to fund and drive the development of a leading web browser engine to keep a simple TOTP app up to date and well- supported in the two major smartphone ecosystems. Heck, a single full-time developer should be more than enough manpower to do that! And Google has like, what, 100.000 of them?

Instead, Google lets other companies slowly chip away at their mindshare in the 2FA market - during the years of Google's inactivity, lots of alternative applications sprung up, and many password safe apps added TOTP support to their feature catalogs. We're at a point at which most technically savvy people advise other people to use ANY of those apps, but NOT Google Authenticator, even if the website tells them so. It's just a matter of time until the sites catch up and quit suggesting Google Authenticator (after all, the shortcomings of Google's application, like inability to backup seeds, probably cause additional burden on support channels for sites explicitly mentioning Google Authenticator, and if there are other apps that cause less problems, suggesting to use those at some point in time will be more beneficial than the brand name recognition bonus provided by suggesting an app by Google).

<comment><USER21> "2FA market". Wait now 2FA apps constitute a market? The whole article is inaccurate and tries to jump on the stereotypes we see in the news about Google to capture clicks.

Authenticator is still a secure 2FA app (unlike Authy) and the fact that the devs did not ship a new build or updated the UI recently might not be great but the app does its job.

If "awk" does not ship a new build in a few years would it be considered abandonware?

<comment><USER20> Command-line applications for consoles are not exactly comparable to smartphone apps in that regard, because their natural habitat changes only at a glacial pace nowadays, while the habitat of smartphone apps - the smartphone OSes - evolved at ridiculous speed during the last decade.

</comment></comment></comment><comment><USER22> The author doesn't explain why this is a google problem other than their code is "old".

The way the source article reads, it seems like the vulnerability would affect any OTP app.

<comment><AUTHOR> The latest version of [andOTP]([https://github.com/andOTP/andOTP/releases](https://github.com/andOTP/andOTP/releases)) indicates that it protects some of the fields from accessibility hijack. I suspect other apps will find a way to prevent this attack.

The problem I, the author, have is that it seems unlikely that Google can fix this. What are the risks associated with suddenly changing a codebase which is 2.5 years old? Is there anyone there who works on it day-to-day, understands how it works, and can release a verifiably fixed patch?

Security products need constant maintainance.

</comment></comment><comment><USER23> Good thing TOTP is an open standard, so there are some alternative apps available.

I guess they consider TOTP as legacy and are focusing on U2F, I think in their products you can't even sign up for TOTP based 2FA anymore.

I amassed quite a collection of U2F Titan security keys that Google gave away for free at conferences, some of them have become obsolete already though and some had serious security issues (the Bluetooth one). I prefer using the Yubikey for that reason, though I find them quite a bit overpriced.

<comment><USER24> You can still sign up, but it's a bit of a pain.

When you initially enable 2FA, you won't be given the option. But you can register with SMS/U2F/etc. Once you've enabled the first authentication method, you can go into your 2FA settings and add a virtual 2FA device. Once _that 's_ done, you can go back and delete whatever you added initially to be left with only a virtual 2FA device.

</comment></comment><comment><USER14> And the usual Google neglect of its products continues. It's a vicious circle, they keep neglecting apps, people start using them less and less and as they notice people using them less they neglect them more and the cycle continues until they kill it.

This is one of the main reasons I stopped using any of their new projects.

</comment><comment><USER25> I recently switched to Aegis, it's so much better, and open source[0]. Crucially it has biometric encryption, and import/export so switching to a new device isn't a horrific ordeal. It also has some great QoL features like custom icons, highlighting, and reordering. To anybody looking to move away from Google Authenticator, I highly recommend it.

0: [https://github.com/beemdevelopment/Aegis](https://github.com/beemdevelopment/Aegis)

<comment><USER26> This looks good but I can't find any information about who is behind it and why I should trust them. I wish they were collaborating with a well known project like andOTP instead.

</comment></comment><comment><USER27> Potential vulnerability aside, I think the article leaves you with wrong impression about stat of Google Authenticator app. In my understanding Google Authenticator app you install from App Store is not the same as github app authors talking about. As it clearly says in README "While this fork is open source, the official version of the app still remains proprietary. There is no guarantee that the open source repository will receive any changes made upstream (or vice versa)."

<comment><AUTHOR> If you visit the Authenticator app on [https://play.google.com/store/apps/details?id=com.google.and...](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en) \- you'll see at the bottom that it was last updated on September 27, 2017 As in, that's the last time an updated was published on the Play store.

I'm sorry I didn't make that clearer.

</comment></comment><comment><USER28> I don't think it actually needs an update. Supporting new features would be nice, but it's not a requirement.

</comment><comment><USER29> Hmm. I see a lot of people here responding that disabling this would break the Accessibility Services, and I completely agree.

However, it does seem to me like there is a genuine problem here. Perhaps the solution is to have a two-layer accessibility permission system? One permission for reading the screen of non-inherently-sensitive applications, like web browsers and email clients, and another permission for reading high- sensitivity applications like Google Authenticator. Enabling the second permission would come with very strong warnings about security, and the admonition that you should _really really_ trust this application provider a lot more than your average screen reader app.

</comment><comment><USER30> I recently switched to Aegis Authenticator: [https://getaegis.app/](https://getaegis.app/) It seems to be as well- maintained as andOTP, and I like that it is licensed GPLv3 rather than MIT.

</comment><comment><USER31> The most frustrating thing about this app.... is that it ignores other algorithms such as sha-256 or 512.

But get this!

On iOS it correctly shows the right OTP code for these algorithms.

On android it acts like it's a sha-1 and has the wrong code....

</comment><comment><USER32> I'm a big fan of using the Yubico Authenticator instead of Google's apps:

[https://www.yubico.com/products/services- software/download/y...](https://www.yubico.com/products/services- software/download/yubico-authenticator/)

In addition to being supported, it avoids the possibility of a future mistake leaking TOTP seeds since they're stored on the key rather than the phone.

</comment><comment><USER33> FWIW, the iOS version was last updated on Sept. 12, 2018, a minor update for iPhone X support and "Minor bug fixes". The second-to-last update, from 2.3.0 => 3.0.0, was Feb. 2016:

[https://apps.apple.com/us/app/google- authenticator/id3884976...](https://apps.apple.com/us/app/google- authenticator/id388497605)

</comment><comment><USER34> Surprised there (this far) no mention of Authenticator Plus ([https://www.authenticatorplus.com/](https://www.authenticatorplus.com/)) here. I welcome scrutiny of this option (but I am not affiliated in any capacity with them)

</comment><comment><USER35> If Authenticator is actually abandoned, are there any suggested alternatives?

I know I can just get a yubikey, but I'm still not comfortable with the process for temporarily authenticating on a computer or phone that isn't mine. In those cases I much prefer to type in a code.

</comment><comment><USER36> if you are on Android, I highly recommend Aegis [https://github.com/beemdevelopment/Aegis](https://github.com/beemdevelopment/Aegis)

its open source, supports import of keys as well as export with a very active dev.

</comment><comment><USER37> I've recently tried switching to YubiKeys to store all my 2FA tokens and only later learned that they have a hard limit of 32 stored tokens.

Does anyone know of an alternative hardware token that supports more than that and also all the other protocols that YubiKeys do?

<comment><USER38> Why can't yubikey use a single root secret and derive all sub-secrets from that root secret?

<comment><USER39> Because usually the server sends the shared secret and there are just 32 slots for shared secrets available.

<comment><USER38> Yubikey and webauthn[0] supports public key authentication where the client chooses the secret.

[0]: [https://webauthn.io/](https://webauthn.io/)

<comment><USER39> Yes but that's a whole different 2FA implementation, where sites must support U2F (webauthn). Unfortunately, the implementation of TOTP is far more common than U2F.

Ideally all sites will implement U2F as two factor authentication, but there aren't that many users who have a U2F compatible token. The reach of TOTP is far more beyond U2F, which is probably why sites use TOTP more than U2F.

When sites offer both, choose U2F. When sites offer TOTP only, use it. It is better than nothing. When you have a yubikey already, use the Yubico authenticator app to store the TOTP secret to make your TOTP attack surface less and to have the availability to change your phone without losing TOTP secrets.

<comment><USER38> >When sites offer both, choose U2F. When sites offer TOTP only, use it.

This, 100%

In some sense TOTP, basically HMAC, seems like it would be harder to screw up than a public key system. RSA is amazingly hard to get right. I wonder if the order of preference should be:

1\. U2F ECDSA/EdDSA

2\. TOTP

3\. U2F RSA ... Infinity. SMS 2FA

No idea where ECDAA [0] fits.

[0]: [https://paragonie.com/blog/2018/08/security-concerns- surroun...](https://paragonie.com/blog/2018/08/security-concerns-surrounding- webauthn-don-t-implement-ecdaa-yet)

</comment></comment></comment></comment></comment></comment><comment><USER40> I've moved to Authy. They allow a backup password to encrypt all tokens on their servers. I think that is a valid tradeoff with a random password saved in Keepass. Otherwise, changing a cellphone (or hard resetting) is an arduous task.

</comment><comment><USER41> It scans qrcode. It shows current 2fa code. It ensures no one will able to generate your 2fa code without stole the device physically (because it can't be backup).

What else do you need? Why do anyone need to update it if it is completely fine?

</comment><comment><USER42> Wait, can it steal the stored secrets or just codes? I'd love for a utility that can "steal" the secrets so I can migrate to my yubikey 5c.

<comment><USER43> If you have a rooted Android phone, I wrote a tool to pull secrets from most popular OTP apps: [https://github.com/puddly/android-otp- extractor](https://github.com/puddly/android-otp-extractor)

<comment><USER44> You might not even need a rooted phone. For at least one of these apps, you can extract the secrets from an ADB backup, which does not need root (it only needs the developer mode).

<comment><USER43> Interesting. Do you know which still one allows backups?

</comment></comment></comment></comment><comment><USER45> I remember even installing Google Authenticator for some kind of Microsoft project, which seemed to legitimize it even more.

</comment><comment><USER8> The fact that malware can steal Google Authenticator TOTP seeds, means that non-malware apps on your phone—e.g. other TOTP apps—could _also_ steal (i.e. import) these seeds, no?

I'd quite enjoy if e.g. 1Password would import all my Google Authenticator tokens into itself automatically. I've been meaning to move them over for a long while now, but it's a whole process, since there's no place in the Google Authenticator UI to retrieve the original seed value.

<comment><USER46> It's just using the accessibility privileges to look at the contents of the screen like a screen reader would, and copy the shown code. This isn't quite as advanced as "stealing your seeds".

</comment></comment><comment><USER47> I thought the keyboard apps listed as abandoned at the end of the article were all rolled into the main Gboard app?

</comment><comment><USER48> I use the lastpass authenticator and I like it. Works well in conjunction with the lastpass app

</comment><comment><USER49> Website is blocking my access with a challenge that doesn't work :-(

<comment><AUTHOR> I've had a few reports of that. Are you using Tor or something similarly exotic?

<comment><USER50> Assuming this is recaptcha, I have heard that sometimes your IP/cookie reputation can be so bad that they reject valid responses to the challenge.

</comment></comment></comment><comment><USER51> Is Microsoft authenticator interchangeable with Google's?

</comment><comment><USER52> This affects any totp app like Symantec VIP, doesn't it?

</comment><comment><USER53> Is the app truly abandoned? If there's one 2FA app I wouldn't expect to be abandoned, it is Authenticator.

</comment><comment><USER54> At this point should we assume that ANYTHING Google does will be supported in the future? Fool me once shame on me, fool me over and over again and I'll replace you with someone who cares. This is a pattern of consumer abuse (privacy and abandonware) that Google continues to exhibit. Why should we continue to support them?</comment>


Homegrown master-master replication for a NoSQL database - <AUTHOR> http://highscalability.com/blog/2017/5/3/homegrown-master-master-replication-for-a-nosql-database.html <comment><USER2> Has anyone used Tarantool and can share their experience with it? How does it compare to other NoSQL and NewSQL engines?</comment>


Free OpenBSD Shell Provider - <AUTHOR> http://devio.us/

<comment><USER2> Just what I needed to complement my OpenBSD learning (right now I have OpenBSD installed in my only computer). There is also an entry at the OpenBSD Journal.

[http://undeadly.org/cgi?action=article&sid=2010042621303...](http://undeadly.org/cgi?action=article&sid=20100426213038)

</comment><comment><USER3> I've been wanting to try out BSD *nix for some time...

Community seems nice, I've spoken with admins regarding some registration issues and everything was sorted out immediately.

I'll probably pay for the background processes even if I don't need them, cause they seem like a nice bunch ;).

</comment><comment><USER4> This is really cool of the people who put it together because from the looks of it they are trying to build a community over generating any sort of revenue.

They also activated my account right away which probably means they are having fun with it in their freetime.

</comment><comment><USER5> oh man, that's really interesting. It /might/ even be a realistic fremium model. The only real question is how they will cheaply handle abuse. If they can keep their abuse handling costs down, it's possible that they'll do rather well with this.

But, I've found that charging massively helps deter abuse. Man, when I was doing the 'first month free' deal? that was bad for me. But maybe these folks can pull it off?

But certainly, dealing with abuse cheaply will be the challenge. if they can solve that, they may end up doing quite well.

</comment><comment><USER6> Great service. Really impressed with the default app set and speed.

</comment><comment><USER7> loving it so far, very fast.

</comment><comment><USER8> I just signed up for an account. It seems fairly nice, but the big issue with shell accounts is whether or not they stick around. Their manifesto page (<http://devio.us/manifesto>) seems to indicate that they're taking this seriously, so let's hope they stay. (:

<comment><USER9> Well, you know the old saying, "promises of eternal free services and a dime will buy you a cup of joe" :)</comment></comment>


Lighting a room using 900+ RGB LEDs - <AUTHOR> http://dmitry.gr/index.php?r=05.Projects&proj=19.%20Room%20Lights <comment><USER2> I always cringe a bit when folks approach hardware like they do software but I'm encouraged that more and more people are building things. Unlike with software, bugs in hardware can have much more interesting (and for some definitions, exciting) failure modes.

That said, using the outer edge of the room to source the lighting is good for accent lighting but not really a good overall lighting scenario.

Of course a simple way to get started is with something like the Hue or LiFX bulbs (I've got some Hue bulbs) and I find that things like persistent notifications (I can have my lights go a different color for time when I'm voluntarily not drinking any caffeine, or to indicate 'stand' and 'sitting' times. ) But for overall room lighting I find there is really a relatively small gamut of colors that make "sense". From deep red, through orange and then right into yellow then white (perhaps with a bluish tint). Brown, Purple, Orange, Green, and Magenta lights? I can't really stand them for very long.

<comment><USER3> Yeah, except it occurred to me that for the price of Hue bulb, I could buy a RasPi and a Unicorn Hat that could be controlled via Wifi.

OK, I don't know the brightness difference, so maybe I'm talking out of my hat, but those high-tech controllable RGB LED light bulbs are still way out of reach for anyone without a lot of disposable income.

<comment><USER4> For a lot cheaper you can use an esp8266 and a ws2812 LED strip. The esp8266 is <$5 and includes wifi and a microcontroller that can be programmed in JavaScript, Lua, or C. Various ws2812 forms (strips, rings, matrices) are available for cheap on eBay. You can reproduce the functionality of an Phillips Hue for less than half the price. This is assuming that you can write your own smartphone app to communicate with the esp8266 and have decent soldering skills.

What I've noticed about the maker community isn't really related to disposable income. Most people with skills like programming and soldering have disposable income. The people that could benefit from saving money by making their own stuff don't usually have the skills to do so because they didn't have good schooling.

<comment><USER3> Actually I think price does have a significant role in the Maker mindset. I'm sure when they see one of these cool, but really expensive products, like the Hue, a lot of folks will say, "Oh, I could make my own for much, much less." and some will inevitably add "With blackjack and hookers!"

Anyone could benefit from saving money by making their own stuff, if they are interested (i.e., their time is worth it) and they have the knowledge and skills... and the project I suggested wouldn't take more than hardware skills than plugging things in and no more software skills than a few lines of Python.

I can't imagine the maker movement is made up of the idle rich, but of everyday people, some with mortgages and kids (like me), or some who are themselves kids. Given how much one of the main selling points we hear about neat new devices like the Pi is the price, I think your characterization isn't correct.

I'm sure in 10 years, something like the Hue will cost as much as a regular light bulb does today, but for those of us who don't have hundreds to drop on a cool colored lighting system for their homes, there are other options, just like you described, that are much cheaper and often not complicated at all.

</comment></comment></comment></comment><comment><USER5> A better power-supply system would be to use a step-down DC-DC converter on each strip or each group of strips to step down from a higher voltage (say, 24V). These converters can be had for ~$1 apiece on eBay. This would reduce the current requirements down to ~20A, which is within the realm of what you can buy inexpensively (also on eBay).

<comment><USER6> _These converters can be had for ~$1 apiece on eBay._

Yeah, that's _exactly_ the type of hardware I want hanging on my wall. Because eBay is the world's preeminent source of UL certified electrical devices. /sarcasm

</comment></comment><comment><USER7> > The room is 4 x 4 meters.

> The strips require a 5V supply, and will consume 57.6 Amperes at full > brightness.

[later, really -5% or so, fine]

> The light created looks very cool, even if a bit eerie. Nothing in the room > casts a shadow.

I can believe that, tossing over 250 W of LED light (some 2kW in old incandescents) into a 160 sq. foot room ...

P.S. In other news, this week I saw a youngster playing with a Bluetooth 4.0 controlled 9W LED lamp (replacing a 60W incandescent). Bought from Bee Wi, via a local FNAC sale, 23 euros. Not homemade, so less virtuous, but perhaps more practical ;-)

</comment><comment><USER8> Years ago we built what we jokingly called a "light canon". It had 504 very tightly packed 1 Watt RGB LEDs for a total of 1512 W. This thing was so bright it was actually dangerous to look at directly. Truly scary amounts of light.

That project then evolved into something else. Still, I have the prototype off in a corner of our R&D shop. Every time I look at it I think about adding a Fresnel lens in front of it. One day...

</comment><comment><USER9> Built something very similar earlier this year (on an Arduino[1]). Lights are fun :) Excellent job, OP.

[1] [https://www.adafruit.com/categories/168](https://www.adafruit.com/categories/168)

</comment><comment><USER10> The chip tune soundtrack is perfect.

<comment><USER4> The song is by Ronald Jenkees: [https://www.youtube.com/watch?v=0O2aH4XLbto](https://www.youtube.com/watch?v=0O2aH4XLbto)

If you like that song, you should definitely check out his other songs. He's pretty good.</comment></comment>


Ask HN: Is there really a shortage of developers in the startup world? - <AUTHOR>

I've read a lot that there is a shortage of developers for startups to hire, but I don't really believe it. Can someone in the industry confirm that there is in fact, not enough developers up for grabs, for startups? <comment><USER2> There is a shortage for developers with certain skill sets, in certain locales, at certain prices which companies are willing to pay.

If we get away from the baggage of the word "shortage", it is a true statement that the hiring market currently favors those who are selling talent as opposed to those who wish to purchase talent, across a wide variety of first- world metropolitan areas, in many fields of software engineering, including but not limited to fairly generic web and/or application development.

</comment><comment><USER3> I think there is a shortage of developers of the quality that startups want to hire for the price they want to hire them.

Digging a bit deeper - I do think there's a pretty universal shortage of high- quality developers in the software world. Understand your CS fundamentals + current technologies and have decent social skills and you will never lack for work. I think that Google and Facebook have gobbled up the vast majority of these developers, because they are willing to pay higher wages than most startups can. That's the way economics works: the people who can pay the most get first crack at the supply.

</comment><comment><USER4> As others have stated, the shortage is in the number of quality developers that are willing to work for under market rate. I had several startups in SF offer me 60-80k, and I laughed my way out of each of those interviews. I get that startups have to stay lean and not overspend, but development talent is one place you absolutely don't want to cut corners.

I think that's the real sticking point - quality developers are going where they'll get paid what they're worth, and in most cases that's not startups on shoestring budgets that could go under at any minute. It helps to keep in mind that quality developers are often older, with families, who want to find somewhere they can be well-compensated for putting in a solid day's work before going home in time for dinner. This doesn't seem to jive with what a lot of startups expect of their employees.

By the way, I don't mean to put _all_ startups under this generalization: this purely based on anecdotal evidence from myself and people I know.

</comment><comment><USER5> As a developer looking for work I found a ton of startup job opportunities in the NYC area. But I found the companies hiring for a very specific set of skills (frameworks, insert random buzz words) instead hiring for general ability and knowledge. It's an interesting dynamic as the startup has limited funds and limited time. They want someone who can jump in on day one without any learning curve. The smaller startups are willing to wait for the perfect candidate because hiring the wrong person could be a disaster.

In my own startups I've found the developers I know love the idea of working for a startup. But when it comes down to it, they are risk averse and value job security and cash compensation over the freedom and equity that a startup offers.

</comment><comment><USER6> As echoed by others on here, there is a shortage of __good__developers for hire. I've seen plenty of developers get interviewed at some startup companies only to be turned down for the job and I've known a few that were trying to apply and get denied. Majority of companies are hiring but that doesn't mean they'll hire just any developer. The issue is developers are not all created equal and I've been around enough developers to know that rejection is common, some times several rejections, before they finally are able to land a job somewhere (not necessarily even a startup by the time its done).

</comment><comment><USER7> I can vouch for the fact that in Chicago at least, there seems to be a shortage of quality developers. Or perhaps rather, our company (and every other tech-focused company I know of) has a continual burning need to hire more quality developers than they can find.

I don't know what "for startups" has to do with it, but if it matters, I work for a 90-person company that calls itself a "mature startup." :)

<comment><USER8> What sort of business do you operate? There are a lot of qualified developers in this town. The price is the sticking point.

</comment></comment><comment><USER9> In addition to the pay issue addressed in all of the other answers so far, the top tier programmers are also likely to be looking for more stable employment. A single college grad with no experience can take a gamble on a startup, but someone with a few years of experience and a family is more likely to want a job that they know will be around for a few years.

</comment><comment><USER10> There's a shortage because employers don't want to pay enough. Hence employees take advantage of the free market for their labour and go to places which pay more (competition at work!).

</comment><comment><USER11> We had a personal issue with recruiting developers The main problem is the high cost you need to pay for these developers to make your startup a real option for them.</comment>


Luerl - Lua on the Erlang VM - <AUTHOR> http://erlang.org/pipermail/erlang-questions/2012-February/064481.html <comment><USER2> There are a number of reasons why I did this:

1\. I want to experiment with implementing an imperative language with mutable global state on top of Erlang. A goal was to do it in straight Erlang without extensions.

2\. I am giving a talk on implementing DSL's on Erlang at the next Erlang Factory in San Francisco in March, <http://www.erlang- factory.com/conference/SFBay2012> (be there, it's going to be good, the whole factory I mean), and I wanted to be able to give practical experience from implementing a real-life imperative mutable data language. Lua is a nice, small, relatively clean language and is a good choice for this. And it is actually in use. I was also considering PHP or Javascript but they are definitely not small and clean.

3\. Lua is an interseting language in its own right and has some cool ideas. You can get quite far with a few simple primitives. I don't know if these would be transferable to Erlang.

4\. I like implementing languages.

While erlua is definitely interesting it is "just" an Erlang interface to a standard Lua system and not what I was after. I know that this idea is being used in some commercial systems so it is definitely a viable option.

Whether this is of any practical use I don't know. For doing large amounts of Lua execution then a solution like erlua is probably better as the straight lua implementation is faster than luerl can ever be; doing mutable data in an immutable environment is not free. However, the interface between Erlang and Lua in luerl is definitely faster so for smaller amounts of work it may be better. There is also the benefit of while there are many languages there is only one system running them. Could lead to easier maintenance.

This only a first version and there is much still to do. I am experimenting with different ways of implementing Lua's mutable data and I am looking at compiling the Lua code down to native Erlang machine code; the current version is an interpreter. There are also some language features left to implement. More libraries would help.

That is the status as it stands. My goal is to have a system where people could take their Lua code and just run it in luerl.

</comment><comment><USER3> This might be a stupid question but, you know you should never shy away from stupid questions. What actual practical use would this have? To put another way, what purpose does this serve that could not be served by the normal lua interpreter?

<comment><USER4> Is he (Robert Virding) looking for a lightweight, Turing-complete data description language extension?

I started using Lua because I needed to gather logs from many different systems and build timelines around the events to identify patterns across all the aggregated data. The logs were large, and the metadata was often very complicated.

I looked at several SQL-like solutions, and at Perl extensions on CPAN. After lots of googling, it finally occurred to me that I might need a programming language that had been designed with efficient data description as a high priority. I was surprised that a streamlined "little" language like Lua fit my requirements [0]. I was expecting to have to learn something big, complicated and esoteric.

I needed my resulting datasets to be portable between various Unixes, and fairly standalone. Because of the long load times, I didn't want to use a tool that required any more processing steps on input than absolutely necessary. While serialized Lua tables are more verbose than CSV, they do compress well. They are also valid Lua programs. They can include metadata of arbitrary complexity, and even turing-complete snippets to modify expression of the data as it is loaded.

Salvatore Sanfilippo (antirez) had many languages to choose from for his "data structure server". The next major release of Redis will have a Lua interpreter. [1]

I don't know Erlang well enough to guess -- is a valid Erlang program an appropriate way to store a large amount of polymorphic data? Is Lua perhaps a better way to approach this problem?

[0] "Lua as a data description language (Dimitris Papavasiliou)" <http://lua- users.org/lists/lua-l/2004-06/msg00028.html>

[1] "Short term Redis plans" <http://antirez.com/post/short-term-redis- plans.html>

<comment><USER5> One of Lua's predecessors, Sol, was a data language strongly influenced by BibTeX (<http://www.lua.org/history.html>). Lua's table syntax also bears a strong resemblance to JSON.

I don't know about embedding it in Erlang, but anecdotally, it works quite well as a data dump format.

</comment></comment></comment><comment><USER6> ErLUA felt a lot more intuitive IMHO, looks good though!</comment>


Google Tips for the Entrepreneur (2002) - <AUTHOR> http://ecorner.stanford.edu/authorMaterialInfo.html?mid=1076

<comment><AUTHOR> I also recommend checking out <http://venturevoice.com/> specifically the treehugger mp3

</comment><comment><USER2> Really cool stuff ... the other clips in this series look like they're worth checking out too</comment>


Juno Drivers 'Gett' Only Pennies Following $200M Acquisition - <AUTHOR> http://observer.com/2017/04/gett-acquires-juno/ <comment><USER2> _"In a nutshell, we're going to be nice. We're going to be ethical. We're going to be respectful of our drivers," he said. In that talk, Marco said his partners planned to give drivers a stake in the company. In fact, it had suggested it would set aside 50 percent of the company's founding shares for drivers, as we previously reported._

 _Initial reports on the deal indicated that all shares accumulated by drivers would be nullified in the acquisition_

 _Another driver forwarded us a letter that offered $251 for 14,173 restricted shares, a value of roughly $0.02 per share. This post[0], shared on the UberPeople forum, shows an estimated value for restricted shares at $0.20 each, last July._

At least Uber isn't hiding behind some sign claiming to be ethical.

[0][https://uberpeople.net/threads/juno-refer-a-driver-get-a- bon...](https://uberpeople.net/threads/juno-refer-a-driver-get-a-bonus.92609/)

<comment><USER3> 2 cents a share is better than nothing, which is what I got from the last startup I worked at that got acquired...

<comment><USER4> I worked at a place where, when we got acquired, our shares were worth about $40,000, so everybody was pretty happy.

Then the stock tanked. And tanked. Six months later (1 year vestment) they were underwater, and still dropping. Everybody was miserable.

If they had just handed us $250 on the day of the sale, I believe we would have been a little unhappy but we would have gotten over it.

</comment></comment></comment><comment><USER5> Serious question: Is there any way at all for a minority shareholder to avoid getting royally screwed in situations like these? Or are they completely at the mercy of the majority to be very nice and decent and not just give them the short end of the stick?

Would it e.g. provide any benefit at all to have a clause about dilution not reducing ownership share more than the majority owners, or would it be possible to weasel out of such an agreement too? How do the rich and powerful do business with each other if agreements are this open to interpretation and backstabbing?

<comment><USER6> It's all down to the shareholder agreement. For example ours says all decisions are made by consensus, no matter how many shares you have. That's an extreme case which works with a very limited amount of shareholders, but the point is that you can protect minority rights.

</comment></comment><comment><USER7> The phrase "nullify a share grant" has no legal meaning that I'm aware of.

There are some semi-legal ways to do this, eg dilute some shareholders by issuing a ton of new shares and give them to other existing shareholders (you see this done in The Social Network). However, minority shareholders do have rights and they can sue if there is no basis for the new grants.

What Juno seems to be doing is asking people to sign away both (1) their shares and (2) their right to sue in exchange for around 10% of what they previously thought was the cash value of their shares.

I suspect the reason for this is that the acquisition is taking place in shares of Gett stock, not cash, and Gett doesn't want 10,000 small shareholders on its cap table, but also doesn't have $50 million of cash lying around to pay these drivers, so it's trying to pay them $5 million and make the problem go away.

<comment><USER8> Doesn't sound like they are real shares: " _Still, drivers have been building up restricted shares (called RSUs)._ "

<comment><USER9> Most commonly (and traditionally), RSUs _are_ "real shares" of common stock, just wrapped in another layer of requirements (e.g., vesting schedule). This is not always true (e.g., Facebook and "phantom shares"). Regardless, RSUs have a value that is pegged to common stock.

<comment><USER10> RSUs =/= restricted stock; however, people tend to use the terms interchangeably. A RSU isn't a real share until it vests (at which point it becomes a common share), while restricted stock is a real share that has vesting requirements or some performance requirements (or both).

<comment><USER9> So the bigger point here is that _RSUs are worthless_... until they vest (at which point they aren't RSUs anymore). So, technically, Juno is being _incredibly generous_ by offering _any value whatsoever_ for RSUs ("unvested stock").

Now, even more technically, RSUs do have _value_ and are kept on company books at the same value as the underlying stock. But they don't have value to the RSU holder.

And unless you have an acceleration clause in your equity agreement (which most people can't negotiate until they're pretty senior), those RSUs expire with a $0 value. (The value of the underlying stock drops to $0 because the corporation no longer exists.)

</comment></comment></comment></comment></comment><comment><USER11> Interestingly enough, just lately their landing page mentioned "50% reserved for drivers" [http://web.archive.org/web/20170203175819/https://gojuno.com...](http://web.archive.org/web/20170203175819/https://gojuno.com/), but no that claim is gone

<comment><USER12> Theoretically, it may still be 50% except the higher-class stock may have some huge liquidity preference. Such is the unfairness of multi-class capital structures. They can be very misleading, and the capital structure is often kept obscured so there is no way to value the worth of a stock in different scenarios.

</comment></comment><comment><USER13> at what point do we stop calling these companies "ridesharing"? The idea of ridesharing and the sharing economy seems completely incompatible with Uber, Lyft and friends, who are all basically private car hire firms.

<comment><USER14> I keep waiting for pimps to rebrand their business as "body sharing".

<comment><USER15> Great example, because euphemisms were certainly never a thing in prostitution (and the word you're looking for is 'escort').

<comment><USER14> I'm not sure what you're trying to say with the sarcasm. The entire point of the joke was that using counterfactual euphemisms like "ridesharing" is a sign of an industry that's on shaky legal ground -- and "escort" is indeed the textbook example. Thanks for explaining the joke, I guess?

</comment></comment></comment></comment><comment><USER16> None of the articles mention the amount that Juno raised, so it's possible that this sale is smaller than the liquidation preferences.

<comment><USER17> Yep. The question of whether the payment to drivers for their RSUs is "fair" depends on who is in line in front of them. It is possible that they could all try to band together and somehow block the sale, but without more information it's hard to assess whether that's a good idea or not.

I would assume that the company's offer isn't an amazing deal, because if it were then the company would probably try to tout that to bolster/save their reputation. OTOH, it's possible/likely that the only way to "prove" that this is a good deal for drivers would be to violate confidentiality agreements with many investors.

</comment></comment><comment><USER18> Here's the thing I really don't get: This is going to get out. This is going to taint the brand. Why do something as shitty as this? Why do startups do this? Is it honestly that hard to be ethical, and pay out what you promised?

</comment><comment><USER19> Uber, Lyft, Juno. All the same.

<comment><USER20> this needs justification. how are they the same?

<comment><USER18> Well, both Uber and Lyft have some pretty predatory car renting programs. And with this move, Juno has shown that they're pretty crappy to their drivers, just like Uber.

I guess we haven't heard of Lyft or Juno having a toxic culture of sexual harassment and bro-ness, so there's that.

</comment></comment></comment><comment><USER21> HN headline hurts my brain. Original is a stupid pun, but at least it makes sense.

Juno Drivers 'Gett' Only Pennies Following $200M Acquisition

<comment><USER22> Yeah, the pedantry of the modified headline is far less readable than the original.</comment></comment>


Ask HN: Do you know any complete food database with UPC code? - <AUTHOR>

<comment><USER2> What do you mean by "complete"?

<comment><AUTHOR> There are services which aggregate food products as a service like foodessentials.com which claim to have more than 70000+ products but do not have all of them in their database.</comment></comment>


WxCL: A GUI for Common Lisp (wxWidgets) - <AUTHOR> http://www.wxcl-project.org/language/en/

<comment><USER2> WxCL is quite old and doesn't seem to be maintained. A better GUI library for CL is cells-gtk. It also offers a more declarative approach compared with mainstream GUI toolkits.

<comment><AUTHOR> Thanks, I'll take a look.</comment></comment>


How can we help make the process of moving to HTTPS easier? - <AUTHOR> https://docs.google.com/forms/d/e/1FAIpQLSdSIZm1UhUafpynMETA85adbuISNwVyQQNGS30dGUpADr2x8g/viewform?c=0&w=1 <comment><USER2> Its already pretty easy with [https://letsencrypt.org](https://letsencrypt.org)

<comment><AUTHOR> Installing SSL is much simpler now with Let's Encrypt, but there's still a number of other hurdles & pitfalls for site owners to move existing sites, such as fixing mixed content and similar issues.</comment></comment>


Celebrating the Death of Comcast: The Case for Net Neutrality - <AUTHOR> http://blog.jonathanoliver.com/celebrating-the-death-of-comcast-net/

<comment><AUTHOR> It all comes down to this: not putting the customer first. If my business depends on customers for income, then it only makes sense that I should be doing whatever it takes to serve my customers.</comment>


EFF asks for the right to revive "abandoned" online games - <AUTHOR> http://arstechnica.com/gaming/2014/11/eff-asks-for-the-right-to-revive-abandoned-online-games

<comment><USER2> Bungie specifically allowed this to happen with the old Myth franchise. They open-sourced their bungie net code when they shut it down. Since then, several fan sites have kept the servers alive. The game was published in 1997.

<comment><USER3> Bungie released Marathon for free as well (including all assets and code).

<comment><USER4> There was also some work by Bungie earlier this year to keep Halo PC (11 years old) online after GameSpy shut down.

[http://www.eurogamer.net/articles/2014-05-12-bungie-to- updat...](http://www.eurogamer.net/articles/2014-05-12-bungie-to-update-halo- pc-with-server-fix)

(disclaimer: I work for Bungie, but not on that project)

<comment><USER5> I believe it was actually the work of a member of the Halo PC community; one non-affiliated programmer aliased as "btcc22" who kept it alive.

Soon after the GameSpy services shut down, he wrote an emulator to replace the official master server. Bungie then (shockingly) released v1.10 to point the game to the new server, and stepped in and ate the cost of the AWS services used to power the lobby.

Source: I gave my life to that game for a very, very long time and still check in on the community every now and then.

Fun fact: Eric Koger, the CEO of ModCloth.com, also spent quite a bit of time reloading his pistol and rifle.

<comment><USER6> He's still really active today and I can't find any reference to his real name. Bungie, hire him!

<comment><USER5> I talk to him regularly. I'm sure Bungie has his info, but if anyone is reading this and wants to contact him directly, I can provide an intro.

</comment></comment></comment></comment></comment></comment><comment><USER7> Sadly, I don't think the game companies are going to accept this – they are probably afraid that legitimizing this will make _development_ of replacement server code start early (in anticipation of the shutdown of the official servers) and that the _existence_ of working code, even though it will somehow be illegal to run, will still be run by many people, loosening the company's iron grip of the players through the official servers.

<comment><USER8> Which is sad considering the "iron grip" is not really going to help them much; for an extreme example look at what server mods did for Minecraft.

<comment><USER9> Most of the minecraft money comes from selling copies of the client, not from server subscriptions as in the case of WoW.

<comment><USER10> To clarify this point, the Minecraft server is free to download [0], even if you have not purchased the game at all.

[0] [https://minecraft.net/download](https://minecraft.net/download)

</comment></comment></comment></comment><comment><USER11> Correct me if I am wrong but the statement "game's audiovisual content is primarily stored on the developer's server and not in the client" is not true for any mmo.

3D models and audio are saved to the clients disk. It's the state of the persistent world that is stored on the server.

<comment><USER12> Hmm. This is true for WoW if you don't have a full install.

<comment><USER13> This only allows for a streaming install. It's without question _definitely_ primarily stored on the individual users' harddrives. Once you've downloaded the textures/models/whatever, you will not be requesting them from the server ever again.

<comment><USER14> Yeah there's even an open source map viewer, all you need is the DVD: [http://wowmapview.sourceforge.net/](http://wowmapview.sourceforge.net/)

</comment></comment></comment></comment><comment><USER15> I'm kinda disappointed that they're carving out a huge exception for MMO-style games. If anything, I think that (if only due to the social structures that evolve within them) they're the most valuable but fragile types of online games.

<comment><USER16> Allegiance [1] is an example of this happening in the MMO space.

[1] [http://en.wikipedia.org/wiki/Allegiance_(video_game)](http://en.wikipedia.org/wiki/Allegiance_\(video_game\))

<comment><USER17> And for further reference: [http://www.freeallegiance.org/forums/index.php?act=home](http://www.freeallegiance.org/forums/index.php?act=home)

This game has really great mechanics with a really huge emphasis on teamwork. It was probably ahead of its time when it was released.

<comment><USER18> At work so I can't click the link--is that game still alive? I played it a little when I was in high school.

<comment><USER17> Friday nights and weekends, although I haven't played it in years, basically since I switched to Linux.

</comment></comment></comment></comment></comment><comment><USER19> I believe EA gave permission for xwis.net to do this for Red Alert 2. You can sign up with a legitimate key and it works as normal as the protocol was reverse engineered and DNS taken over :)

This was probably straightforward for an old game like this but I can't imagine that reverse engineering the infrastructure required for modern games is feasible. I doubt games companies will have the cash or resources spare to consider this from the beginning nor years after.

</comment><comment><USER20> If we could get "NoX" by Westwood servers back online with clan matches and rankings I just may die a happy man

<comment><USER21> Hear, hear!

</comment></comment><comment><USER22> Does anyone know if the previous abandonware allowances are still in effect?

[1] [http://www.gamespot.com/articles/abandonware-now- legal/1100-...](http://www.gamespot.com/articles/abandonware-now- legal/1100-6162308/)

<comment><USER23> Nope, that exemption for video games was not renewed in 2012. The EFF lost that round.

If you're curious, the Copyright Office discusses their reasoning for and the arguments on both sides starting on page 42 of [https://www.eff.org/files/filenode/ruling2012.pdf](https://www.eff.org/files/filenode/ruling2012.pdf)

<comment><USER24> From page 49 (emphasis mine)

> The Register further found that even if proponents had satisfied their > burden of establishing noninfringing uses, they nonetheless failed to > demonstrate that video game console access controls have or are likely to > have a substantial adverse impact on such uses. Proponents identified _two > broad categories of activities that were allegedly threatened by the > prohibition on circumvention, scientific research and homebrew software > development_.

So it looks like the EFF are going at it from the abandonment angle this time having failed with the science and homebrew arguments. I'd say they have a better chance of making their case this time.

</comment></comment></comment><comment><USER25> Am I the only one still concerned that this is all still in the power of the Library of Congress? It's certainly nice when they're promoting openness and consumer rights, but I'm not sure I like the idea of leaving these choices up to unelected bureaucrats.

</comment><comment><USER26> I am not a hundred percent behind this in the realm of where the game had no means to be played without the server active. This mostly concerns MMOs. If a stand alone game is hobbled by lack of authentication servers or cannot perform mulitplayer without them I see little issue with the idea of a work around.

However the sub model that most MMOs work under feels more like a lease than ownership to me

<comment> 0x5f3759df-i MMO's are specifically excempt

</comment></comment><comment><USER27> Seizing the "moral high ground" in an attempt to get flappy birds back!

</comment><comment><USER28> I actually started a petition about this a year or two ago. Check it out and sign it: [http://www.ipetitions.com/petition/let-memories- live/](http://www.ipetitions.com/petition/let-memories-live/)

</comment><comment><USER29> This is neat, so there's no chance it will happen.

</comment><comment><USER30> I wish this could apply to old WoW expansions.

<comment><USER31> For sure. Or offer "Vanilla" servers. I remember back in the day Ultima Online servers would pop up form time to time with the classic UI.

<comment><USER32> FWIW, there is a long history of illegal private servers that offer Vanilla and specific xpac servers for WoW. They are especially popular with people that are into player versus player because people tend to have certain xpacs that they believe were more fun for a variety of specific reasons, mostly related to balance between different character classes.

<comment><USER33> Somewhere out there is a server populated entirely by retardins ...

<comment><USER30> Every expansion has a "best class", that's for sure. Even if you try to balance everything, that's impossible to achieve; every class has dozens of spells, talents, buffs... and then, some of those spells, talents and buffs can interact with other classes (especially when in party or raid) improving or nerfing them.

In that expansion I'm sure you're talking about, paladins are somewhat better, and shamans are worse. That's normal, and it's not a problem when you play in live servers, since they are making modifications to spells and everything constantly. But when you're stuck in some version, then, you're stuck with how classes work in that version forever. That makes the population lean towards one class.

More information about FOTM here: [http://wowpedia.org/Fotm](http://wowpedia.org/Fotm)</comment></comment></comment></comment></comment>


Anonymous Hacks Official North Korean Social Media Accounts - <AUTHOR> http://readwrite.com/2013/04/04/anonymous-hacks-official-north-korean-twitter-account

<comment><USER2> And this is going to help the conflict how..?

It's clear that this new leader believes he has something to prove to the world. This only serves to aggravate the situation. By hacking his accounts and posting insulting photos, they just give him more reason to carry on with this pointless endeavor.</comment>


'His Joy, His Life': Nabokov and his wife - <AUTHOR> http://www.nybooks.com/articles/archives/2015/nov/19/nabokov-his-joy-his-life/ <comment><USER2> Rebecca Solnit about Lolita:

"You read enough books in which people like you are disposable, or are dirt, or are silent, absent, or worthless, and it makes an impact on you."

She quotes Vera:

"I wish, though, somebody would notice the tender description of the child, her pathetic dependence on monstrous HH, and her heartrending courage all along…"

And Azar Nafisi:

"Lolita belongs to a category of victims who have no defense and are never given a chance to articulate their own story. As such she becomes a double victim—not only her life but also her life story is taken from her. We told ourselves we were in that class to prevent ourselves from falling victim to this second crime."

[http://lithub.com/men-explain-lolita-to-me/](http://lithub.com/men-explain- lolita-to-me/)

<comment><USER3> The author may present her case inaptly, but she comes off as very dislikable.

So she wrote an article about Lolita and got a comment: "To read Lolita and 'identify' with one of the characters is to entirely misunderstand Nabokov"

I haven't read Lolita, don't have any literary criticism training and don't have the slightest idea whether this assertion is general consensus, debatable or total lunacy.

But it is certainly civil. And there is no indication at all that it was posted because the author is a woman.

Still, the comment is supposed to be a prime example of "mansplaining".

I think the author just can't cope with criticism. And since her peer group seems to be radical feminists, what better way to discredit it than by asserting it is against feminism.

Have I missed anything else in this posting? There was lots and lots of ranting, but this comment thing seemed to be the only thing of substance.

<comment><USER4> While I actually sympathize with the author's intent, Nabakov is not the best of literary targets, as even his most sympathetic characters form a cabinet of grotesqueries -- _vide_ the protagonists of Pnin, Bend Sinister, or Pale Fire -- and Humbert Humbert is most assuredly a monster. On the other hand, the sexual politics of Nabakov are worthy of interrogation; he is a literary giant, but hardly immune from criticism, and his female characters tend towards the underdrawn at best. But great works are often great in spite of their politics, and the Russian novelists perhaps more so than most. One should not hastily lock away our artistic heritage on the same grounds upon one might dismiss a political jeremiad.

Edit: And, to address the contretemps itself, I'm going to take the cowardly middle path and say that, while to _identify_ with Nabakov's characters is to generally if not always misread Nabakov, it is also true -- death of the author and whatnot -- that deliberately misreading an author is a laudable act! The central tenet of postmodernism is the recognition that just as we have unreliable narrators, we also have unreliable _authors_ and, if one feels that Lolita is mistreated not as a matter of plot but of characterization, then interrogation of the text and author is a service to scholarship. The only requirement to misreading an author is to at all times be aware of what the author intended. Accidentally misreading the text is academic malpractice.</comment></comment></comment>


Mathematical Theory of Reality as More Than the Sum of Its Parts - <AUTHOR> https://www.quantamagazine.org/a-theory-of-reality-as-more-than-the-sum-of-its-parts-20170601/ <comment><USER2> TLDR: Sensitivity to initial conditions of beings at the micro or atomic level means the system is too chaotic to make (mathematical) predictions at that level, so viewing the system as a (macroscopic) whole is more reliable when looking at the maths of causal prediction.

The only interesting part to me: "Brain-imaging experiments are being planned in Madison and New York, where Hoel has joined the lab of the Columbia neuroscientist Rafael Yuste. Both groups will examine the brains of model organisms to try to home in on the spatiotemporal scales that have the most causal control over the future. Brain activity at these scales should most reliably predict future activity. As Hoel put it, "Where does the causal structure of the brain pop out?"

<comment><USER3> What I read from the article was that high-level models are more than just compression - a device for a La-Place-demon to cut on computation time.

But I also have a strong suspicion that this is not what they meant; maybe someone can clarify? In the other case (my interpretation being in line with the intent of the authors): How do they justify this?</comment></comment>


Ask HN: What mailserver can we use? - <AUTHOR>

I've been receiving more and more complains from my client that their mail is being block by apple, microsoft and google. It seems to become a trend to block shared hosting mail server from these big guys and why not? The more they block shared mail server the more people will sign up with microsoft mail, gmail and apple - so it's a win win situation for them.<p>I would prefer no to move to a public free service - but I understand that shared hosting doesn't provide the best mail server. Going all the way to run your own vps with your own mailserver seems probably a nice way to go about it, yet adds a lot of work and I am not sure I could charge for such a service to my client. It's not really in the culture to pay for mailserver service. What are people using here on HN? Are there reliable mail server service that make sure not to end up on spam listing, by monitoring the usage before it hits a spam cop site? <comment><USER2> If you use a shared system then you are at the mercy of both (a) the expertise of whoever configures and maintains it, and (b) the behaviour of others on that shared system. Chances are high that it's poorly configured and maintained and that other on the same host are spammers, or their systems are infected with spam-sending bots - so your IP gets on all the blacklists.

If your client _really_ cares about getting mail through then they _will_ be happy to pay for a service, or for you to work though a good setup of postfix on a VPS. If they're _not_ willing to pay for this then don't stress about it.

</comment><comment><USER3> Mail doesn't get blocked because of the mail server you are using, but rather what you are sending and who you are sending it to. If you/your clients send spam mail (unsolicited emails) then no matter what you use, you'll get blocked. Even if you use Google/Yahoo or anyone else's services, you'll get your account suspended if you send spam. You can setup your own mailserver but make sure you have relays turned off so others can't use your mailserver to send unsolicited emails.

<comment><AUTHOR> Well in the case of shared hosting, if any user of that shared hosting spams, it will block the whole server. So the idea of using a vps is more and more interesting - now just have to find a way to market that to my users :D</comment></comment>


Ask HN: Rank technology skills in your résumé - <AUTHOR>

It seems nonsense to just make a list of technologies you came in touch in your life on your résumé. It does not reflect how skilled or experienced you are with a certain technology.<p>How would you rank the technology skills in your résumé in way, that the recruiter gets a good impression of your knowledge? <comment><USER2> This is what cover letters are for. Use words such as 'I am strongest in', most experience in, etc. And also remain positive with things such as 'I am also familiar, have smaller experience, am exploring'.</comment>


Present Timing for Kids (2018) - <AUTHOR> https://www.jefftk.com/p/present-timing-for-kids <comment><USER2> I've been trying to push back on the number of presents my kids get, both from us and from our parents/family, but it's really an uphill struggle.

At Christmas my son hit a point where each successive wave of toys stopped having an impact on him, there was just too many for him to handle and half of them have been barely touched since. It's really frustrating seeing so much money and resources effectively go to waste when he would have been just as happy with half as many. I particularly take issue with some of the plastic tat that people were buying as "little extra" presents, cheap trash that got played with once and then ignored and ultimately ended up recycled.

I totally get that everyone wants to be generous, and I don't want to be a scrooge, but the cumulative effect is overwhelming for a 4yo, and ceased to have any meaning for him. Just so much waste.

<comment><USER3> The present flood is unstoppable, especially for young kids. Relatives feel bad if they don't buy presents for kids and there's no changing that. Birthdays for young kids are also terrible. They invite the entire class and get 20 gifts: 10 lego sets, 5 nerf guns, 2 knock off nerf guns, and 3 "educational toys".

I think the only solution to to stash 99% of them out of sight after a day our two, wait another week or two, and then drop them at the goodwill. I wish I could build an underground pneumatic tube system straight from my basement to the goodwill toy bin.

<comment><USER4> We initially felt obligated for each of our kids to have their special day with a party and friends/family over. It became a stressful challenge we didn't look forward to with each kid's birthday. There's still plenty of gift giving, but we have shifted to planning a family day doing something fun. Whether it's just a dinner and movie, fun activity or overnight stay somewhere, it's much funner for everyone and just as special.

</comment></comment></comment><comment><USER5> One thing my in-laws do. A gift a day starting on Christmas and extending to New Years Eve. Grandkids don't get the present fatigue of all in one day and you can extend Christmas shopping into the next week when items get marked down for clearance. Makes Christmas time longer. There are downsides and I think my kids are getting too much stuff, but that's what we do.

</comment><comment><USER6> Naive idea, but what about giving money to charity to undevelop countries? This kids get too many toys and the problem is that they don't have enough time to enjoy/learn with them. Here is a more important problem: kids that don't have enough resources for a proper development.

Maybe every year every adult could take turns to buy an actual gift and the rest gives each 20 to charity.

<comment><USER7> I've asked gift givers to instead give contributions towards my kids' college funds. They have too many toys as it is. But from their point of view I can understand not wanting to show up at a kids party empty handed. Compare that to the experience of watching a kid open up a present excitedly and play with it during the party. So I can see why givers prefer that option.

<comment><USER8> Is there somewhere you can set up one of those tax-advantaged college funds such that others can easily add money to it? I can imagine grandparents and such adding money from time to time, maybe even not around holidays/birthdays, if it were a quick & painless process (no more painful than buying something on Amazon).

[EDIT] and I think it'd be an easier sell to discourage toy-giving. The world is drowning in toys for 0-5yo. If you're not too picky and don't mind used stuff you can stock a playroom for a kid in that range from Goodwill and garage sales (and maybe Ikea's toy section for a couple thing) for almost nothing.

</comment></comment></comment><comment><USER9> I have a 3yo and it definitely does feel like a shame on Christmas and birthdays to make her put down something exciting she's just received to open another present.

Part of the problem is that my extended family are all overseas, and they want to see picture messages of her with the gifts they sent! They are understandably sad to missing out on these events themselves, so use gifts as a way to show their love.

My wife and I end up figuring out who would be least offended and putting those gifts aside for the next day. We have to make sure we don't forget though! We recently found some books on top of the fridge that were hastily hidden on Christmas day!

<comment><USER10> Just spread them out, that what I do anyway, if we're seeing someone reasonably close to Xmas, presents get opened there and then, else start Xmas eve, through to boxing day.

Have to hide chocolate away though. Should last them through to Easter this year!

</comment></comment><comment><USER11> I wonder if this would have a negative effect on the earlier presents.

For instance if you give your child presents over 5 days. Will the first day's gift be old hat by the fifth day?

What a first-world problem!

<comment><USER10> Don't think so, certainly not at 3. They have prefered toys completely unrelated to value, when they got it etc.

</comment></comment><comment><USER12> For our kid's third birthday, we quietly smuggled the presents from the party venue back to the house, and would open maybe one a night. This probably won't scale when she's older, but she'll hopefully also be getting fewer presents per birthday.

<comment><USER13> Interesting choice of word - "scale". Jokingly wondering if you mean adding more kids to the mix, increasing age and decreasing agility, or something else...

Adding that my partner and I do something like this too and I like it. We also just randomly buy our kid gifts during the year _when_he_has_been_good_ just cause, and we try to make religious holidays less about presents.

</comment></comment><comment><USER14> This past Christmas, the volume of presents was out of control. Next year we plan to do a "Secret Santa", where you pick someone's name out of a hat, and get them a present (i.e. everyone gets 1 present).

<comment><USER15> This is a problem I've been running with my in-laws and it infuriates me. It feels like every year we agree to have fewer gifts, then many of us don't follow the rule; the ones who do follow it get pissed that they only bought 1 gift for each person and got like 3 times as much.

It's so much waste, and it's overwhelming for all recipients.

</comment></comment><comment><USER16> We've gone through the same (first world) problem and are currently experimenting with the following method -

Our child is allowed to open all gift wrapping. All underage/overage gifts are kept separately. Out of the ones for his level, he's only allowed to open one per day. This also only happens in _exchange_ for removing one toy from this current set to give away for donation.

There are two outcomes we expect:(1) Toy stash volume is kept constant and (2) Child decides which one to keep.

It worked well at Christmas; let's see how the birthday goes...

</comment><comment><USER17> Congratulations you've invented Hanukkah

</comment><comment><USER18> I just want to point out (slightly off topic) that I love this web site design. Simple, clean, and light. Bravo.</comment>


Feedback Needed on GetRandomNode Algorithm from BST - <AUTHOR> https://pastebin.com/nRLkWCKK <comment><USER2> you could call n=Rand() once (instead of in each recursive call) and then find the nth item</comment>


A Dating App, Happn, to Find a Match Nearby - <AUTHOR> http://www.nytimes.com/2015/01/04/nyregion/a-dating-app-happn-to-find-a-match-nearby.html?ref=technology <comment><USER2> how is it different than every other dating app that matches you based on people nearby. There are multiple. What makes this one better? How will it compete for market share? Is there anything original about this?

These are the first questions that come to mind.

</comment><comment><USER3> So it utilizes GPS in the background, or is it bluetooth?</comment>


YC emails are sent - <AUTHOR> <comment><USER2> For me it's obvious that rejections are often born out of a very high bar, limited capacity to take on startups and the limitations of human foresight.

It would be one of the more difficult tasks for me to imagine ever being upset at YC for a rejection (Got my 4th tonight, no stranger to it). If this was your first or second, don't worry , it gets better.

I can honestly say I've never felt closer to success and making progress than I do as I, every six months, write up a summary of where I'm at, where I'm going and then compare it with the previous series of rejected applications. Heck next time I could see myself easily with an actual website and customer base, or, if I get lucky, with a co-founder - how novel would that be?

So grow, YC, do it in a way where you don't loose your soul. And hey, if I never get in...well I'm in enough...

I'll make it. That's one of the best feelings. I know that it may look nothing like I presently imagine, but I'll make it. That's the beauty of malleable but relentless dreaming.

Now someone call Hollywood, er Kickstarter, I've got a killer idea for a film about two co-founders in the valley, 'Dotcom Quixote de la Big Chanca' and 'Sancho "the Ramen" Panza' as they go tilting at Heroku Dynos and courting Aldonza Horowitz aka "Andreesenea".

:)

<comment><USER3> Would love to read your summaries if you have them posted somewhere. Would be a great learning curve for me as this was my first rejection (planning for more ;P)

<comment><USER2> I've found the best single thing that's helped me, both in terms of conciseness, product and effort focus, and gaining empathy for my target audience, is to see what I can cut out and what I can simplify. Focusing is seemingly among the most important, and often most difficult, tasks.

But I'm just some repeat offender/y-comb reject.

<comment><USER3> Focus is always the key. Without it you cannot achieve what you want without getting distracted.

Another hint which I often receive is to always narrow your market as much as possible. You can always expand later.

</comment></comment></comment></comment><comment><USER4> I wonder how many visitors of HN, like myself, sometimes forget that there's all of the Y Combinator stuff going on behind it...

<comment><USER5> That makes me wonder, are there any other examples of a regular business' forum spinning off like this? And to dive into it a little further, in hindsight this can be seen as a brilliant marketing move by pg, but was this intentional?

<comment><USER6> Devshed. But as soon as the owners realized that was happening they decided to kill off the community with in forum blackberry ads. Every one dispersed within a year including me.

Over all I think Its bad. Eventually the fact that the goals of yc aren't aligned with hn will be revealed. Then every one will disperse.

<comment><USER7> HN is aligned with the goals of YC because it provides a useful source of information about [some] applicants. From what I read, the success of a startup is in part dependent upon the communication and technical and social skills of its founders, and HN is a forum where all of those are often on display. A YC application plus an HN profile is going to lead to better filtering than just a YC application.

More than that, in YC's business model the cost of running HN probably doesn't even amount to rounding error. Until recently the website was running on a single server [it may still be, since I haven't heard otherwise since the infrastructure change to Cloudflare] and with PG himself handling a significant portion of the maintenance and coding. In other words, the financial side of a business like YC is incompatible with most people's experience in offices - it's not about profits from sales. It's about internal rates of return on working capital.

</comment></comment></comment></comment><comment><USER8> Rejection notice here. The application process did help us learn a lot and improve our plan quite a bit though so it definitely was worth the time and effort put into it.

Congrats to everyone receiving interview invites.

<comment><USER9> What is your startup? I've started a thread for people to post their rejected ideas: [https://news.ycombinator.com/item?id=7596563](https://news.ycombinator.com/item?id=7596563)

<comment><USER10> Why would you post your rejection publicly? You can bet that this can be used against you in several ways. (copycats, sharks, people seeing 'rejected by 'x' as a negative'.

Better to learn as much from your rejection as you can, swallow and prove them wrong.

There are lots of times when openness is a good thing, being rejected by YC may or may not be such a time, it depends on a lot of factors and if you open up make sure you've thought through the consequences of doing so.

Typically in the VC world, when a VC passes on an investment they keep very quiet about it to avoid tainting the seeker of funding.

See: [http://www.bvp.com/portfolio/antiportfolio](http://www.bvp.com/portfolio/antiportfolio)

It would be very interesting to see the YC equivalent of that!

<comment><USER11> You've got a point about VCs. (Hollywood works in the exact same way) Some industries act like a high school hive-mind popularity contest that runs on social proof over logic. Perhaps it works better for them to think emotionally like customers and users do. However, I've gotten 3 job offers when I posted my failures on HN. I've gotten no job offers when I posted my successes. Overall as hackers/entreps we understand that "failure = successful trying" so sharing failures on HN has it benefit.

<comment><USER10> > However, I've gotten 3 job offers when I posted my failures on HN. I've > gotten no job offers when I posted my successes.

That makes good sense, failure indicates 'availability' whereas success indicates the opposite!

</comment></comment></comment></comment></comment><comment><USER12> To those of you who got rejected: you're still fine. It's just one of many ways to possibly succeed. Not a big deal.

<comment><USER13> I submitted (non-profit track) kind of on a lark. Shrug.

<comment><USER14> same here

</comment></comment></comment><comment><USER15> Rejection here. Was prepared for this, but still, it stings.

> We're trying to get better at this, but the hard limit on the number of > interviews means it's practically certain that groups we rejected will go on > to create successful startups. If you do, we'd appreciate it if you'd send > us an email telling us about it; we want to learn from our mistakes.

Next goal: To reach the point where we can send that email!

Edit: Congratulations to everyone who got the invites to the interview. Good luck!

</comment><comment><USER10> If you get rejected, make sure you don't take it personal and ask yourself: If we needed YC to accept us to succeed were we on the right track? And if the answer is no then make it work without them. After all, YC is a factor in the success of quite a large number of start-ups but there are many more start-ups succeeding without having gone through YC than that did.

If it were the only factor common to all successful start-ups rejection would be a bad thing.

So go prove them wrong.

</comment><comment><USER16> I submitted my non-profit, CharityCoin.org and unfortunately was not accepted. However, I firmly believe in our mission to create a sustainable charity so I am still working on it. We do not need the capital, but It would have loved to get some advice from YC.

To anyone else that has not been accepted - please consider CharityCoin- we are the kickstarter for charities that helps startups raise money for Free.

Here is how it works: We ask celebrities for their permission to mint gold and silver coins with their image. We then give those coins to donors that promise money to their favorites charities. But the money raised goes to startups who promise to pay back and support the charities. This effectively is a loan and the interest is just a commitment of volunteer time to promote the charity.

Please go to [http://CharityCoin.Org](http://CharityCoin.Org) to check it out and contact me Ric AT CharityCoin.Org

</comment><comment><USER17> Based on [http://ycombinator.com/howtoapply.html](http://ycombinator.com/howtoapply.html), it seems that there's a point in the application where if you're impressive enough, they'll spend more time on it and if not, they'll disregard it.

> If the founders seem promising, I'll now spend more time trying to > understand the idea.

It might be a good idea to put the applications that don't get past that point in one pile, and send them a different and more specific rejection letter. (I was just rejected and am naturally wondering how close I was, and this idea came to mind.)

<comment><USER18> Imagine sending 3,000 tailored responses that spawn discussion threads. Not feasible. Believe in yourself kid!

<comment><USER17> I'm not saying to give "tailored responses". Just maybe put them in a different pile and send out a first rejection letter saying that you didn't make it past the "first cuts".

<comment><USER18> Ah. I'm sure they've considered something like that. Smart suggestion. But at the end of the day does it really matter?

</comment></comment></comment></comment><comment><USER19> There once was a lonely developer. Who got rejected by Y-Combinator. Paul Graham said "No!" But it don't make him feel low. He'll make next year's attempt so much better...

</comment><comment><USER20> In an earlier startup I went to 88 meetings over 8 months before getting to a VC term sheet. That is a lot of 'no'. If you are going to be an entrepreneur you need to learn to live with rejection and keep moving forward. I got my "sorry" email from YC tonight, but that's fine. I knew the odds were very long. I'm getting up early tomorrow to continue working on my idea. I may apply again in the future with this (or another) concept, but for now I'm just going to keep on hacking!

</comment><comment><USER3> Rejection here too. Would've loved to get some feedback but I know how time consuming that would be.

<comment><USER21> Lots of founders were kind enough to give me feedback on Hall.com when I had $0 funding. Since then, we've raised $6m+ Feel free to send over your info and I'll give you feedback. (firstname.lastname@example.com)

<comment><USER22> this seems to me an awesome opportunity brett. Will send you some info

<comment><USER21> I hope you do...

</comment></comment></comment></comment><comment><USER23> Acceptance here. We're pretty stoked.

<comment><USER3> Congrats. Hope all goes well. Would be great if you could write up a blog post or something to share your experiences.

</comment></comment><comment><USER24> I didn't make this round but I am still excited because if one waits until you're 100% sure you will never accomplish anything. Go with 75% sure and you'll get there. I know I will. Thanks for the No Thanks. That's how one gets off their back and keeps going.

</comment><comment><USER25> Acceptance here!

For those who didnt get in, chin up! It is not the end! Keep hustling and keep pushing forward!

</comment><comment> mark-bain We've also got rejected, and now I'm pretty sure that Ycombinator is just a great bottleneck itself. It can even be inferred from Kirsty's email or Sam's post: [http://blog.samaltman.com/the-worst-part-of- yc](http://blog.samaltman.com/the-worst-part-of-yc).

Anyway, it's now like a challenge for all of the good/promising startups (including ours) to prove them their mistakes or missed opportunities resulting from undercapacity. On the other hand, I wish all the best to every accepted company! You're now on a better track to your success ;)

Good luck to everyone, Mark Bain

</comment><comment><USER26> Rejected, but not dejected. The process was invaluable and I'm excited for the next opportunity, and congrats to those called in for the interview.

Mixpanel and others have offered special deals for rejects in the past. Silver lining!

</comment><comment><USER27> Anyone NOT get a response yet?

<comment><USER28> We haven't.

EDIT- Got it a few minutes after posting.

<comment><USER29> In my case I found it under the "Updates" tab in Gmail, only after I read this thread and went looking for it. It might be worth checking it out if you haven`t already.

<comment><USER14> whats the email id they are sending email with ? We can search with that. EDIT: Got the mail, Rejected.

</comment></comment></comment></comment><comment><USER30> Rejection here too - honestly think we just weren't far along enough (0 users, 0 traction, barely working prototype) - will keep hustling and re-apply in 6 months.

In all honesty, I really can't blame YC because the only reason we didn't have users/traction is we only started working on our idea a couple weeks before application deadline but from the perspective of a YC partner, I can imagine their first thought is that a lack of users/traction communicates that you're not hustling hard enough.

Good luck to everyone who has an interview :)

</comment><comment><USER31> I only just had the idea about a week before the deadline for the apps, so I knew the odds were stacked even higher against me. On top of that, I'm currently a single founder. However, the objective of my idea needs to be satisfied, so I am absolutely continuing to work on the idea with a bit more urgency now that I won't have YC guidance and connections.

My project is [http://www.MyAdversity.com](http://www.MyAdversity.com) \- A mock-up of how my profile would look is at [http://www.MyAdversity.com/profile.htm](http://www.MyAdversity.com/profile.htm)

The idea is to have a central hub where employers with available positions and applicants looking for a job connect. Unlike current (and highly successful) services that attempt this while obeying the status quo of hiring, MyAdversity will provide two huge and beneficial differences:

(1) Employers will hire the best person for the job far more successfully. Applicant profiles will already be screened and sorted. So an employer simply has to search for qualities and skills they're looking for in an applicant, and a ranked list of applicants will appear with the best match first. An applicant's profile will provide the employer with most information that is sought by a conventional interview. Therefore, employers will be able to focus their time on conducting a better interview that likely includes a sample of real work the applicant would be assigned if hired.

(2) Applicants will have a level playing field when pursuing a position they really want. The screening process does not depend on the inaccurate filters employers use today to save time, nor does it weigh so heavily on pedigree. Applicants will be judged by who they are, what they're passionate about, and what they're capable of. Applicants should have hope that if they acquire the skills to competently perform the work at their dream job, that they have a reasonable chance to be hired.

Even though it's only an fleshed out idea with a first iteration mock-up while I code the actual MVP for beta, I'm not in stealth mode. If anyone steals the idea and executes it better than I will, then the objective will be satisfied, and I'll be grateful. That is my main goal. I greatly appreciate any feedback you may have. Congrats to all of the groups who were chosen for an interview, and best of luck!

</comment><comment><USER22> I got rejected. Then rereading the email, i remembered Drew Houston didnt get in the first time. The best way to experience success is to overcome rejections and go on to succeed. I personally think between the YC partners blogs, we have enough advice to continue working with our product. In 5 years YC or not, the target is at least 20m users or whatever else is your targets. just target 5% growth.

</comment><comment><USER32> Rejection here. Congrats to everyone who got an interview.

I feel okay with not receiving a reason for being rejected. We put in effort when filling out our application, and YC put in effort (at least according to our Youtube analytics) in reviewing our application. Sure, it would be nice to get some feedback, but all we asked for was a fair shake. And because they watched our video, I feel we got it.

<comment><USER33> How many views, if I may ask? For us, youtube analytics shows 2 views, both on April 9th (one from Australia).

<comment><USER32> Three views (one from London), all of which were for a substantial portion of the video.

</comment></comment></comment><comment><USER34> Got rejected.

My startup is visual programming system ala Spreadsheets + Zapier, here is my YC application – [http://spreadsheets-on- steroids.tumblr.com/post/82903500034/...](http://spreadsheets-on- steroids.tumblr.com/post/82903500034/my-failed-application-to-yc-summer-2014)

Would like to hear some feedback on my application.

</comment><comment><USER35> "Y Combinator is wrapping up wading through 3000 applications for this summer's intake" From this url: [http://www.forbes.com/sites/hollieslade/2014/04/15/early- sta...](http://www.forbes.com/sites/hollieslade/2014/04/15/early-stage- startups-the-biggest-killers/)

</comment><comment><USER36> Another rejection here. It was our first time applying for YC (or any other incubator). The application process sure helped us view things in a perspective other than co-founders as coders. Even if we decide not to apply again it will be a great exercise to answer the application questions every 6 months.

</comment><comment><USER37> If anyone wants feedback on their idea from a smaller accelerator, Chris Heivly, co-founder of MapQuest and later The Startup Factory would like to schedule a one-on-one video meeting to talk about your application. If that sounds interesting, send us an email at email@example.com.

</comment><comment><USER38> Rejection here as well. We had applied with a marketplace for used cars, and even engaged in an email conversation with Paul regarding the idea. He had suggested a couple of models & a way to bring supply onto the platform.

Little dejected & disappointed right now.

</comment><comment> mark-bain Ohh, and one more thing. Maybe I missed it, how many applications did you/YC receive for S14 batch? I've read on Sam's blog that it was around 20% more than in the previous edition, but would be great to know the exact number ...

<comment><USER39> They received more than 3000 applications for this batch. Going by past ratios, 9% are interviewed -- and in the end 3% are selected.

<comment> mark-bain Without going into details it sounds, like 97% chances that you would be rejected ...

</comment></comment></comment><comment><USER35> Still waiting. Our idea is 'Try before you buy for Github repos' \- [http://beta.howtox.com/](http://beta.howtox.com/)

<comment><USER40> Sounds neat. How do you figure out the dependencies? I have to imagine this works for a limited set of languages. Was there any language that was preposterously hard to support?

<comment><USER35> Lisp... just kidding... you are right that that is one of the hardest problems in the project

</comment></comment></comment><comment><USER41> Has anyone else STILL not received any email yet? I've checked all over my inbox and misc folders (junk, spam etc.) and couldn't find anything

</comment><comment><USER42> Still waiting - gotta check the 4-5 gmail tabs now ! Kyle (at) reputer.co

</comment><comment><USER43> Not an applicant, but would love to chat with somebody who got accepted.

</comment><comment><USER44> Rejection here

</comment><comment><USER45> Reminds me of my comment about an year ago:

[https://news.ycombinator.com/item?id=5648760](https://news.ycombinator.com/item?id=5648760)

(1) Quality of applications, as in number of people who can write and talk really well, have gone up and the (2) number of applications have gone up; means the gate is even more crowded than ever before. So the pressure to dole out a silkier YC application next time will go up.

Obviously the outcome of this cycle is that the focus of the entire selection ruckus will move towards "best of best applications written in English" and not really start-ups (which look/are bad) but have the potential to go on to become unicorns/home runs.

Meanwhile, this pressure will also give rise to energetic backbenchers. A psychology for those who feel cheated by fate to go after and kill it outside of the incubator loop. Good luck YC, no-YC both!</comment>