Shortcuts To Landing Your First Job - <AUTHOR> http://www.collegefeed.com/blog/use-shortcuts-land-first-job-infographic/

<comment><USER3> One thing I'd add is don't be afraid to list non-technical work experience on your resume when you're looking for your first job. We all assume each entry level candidate with a CS degree has done the standard coursework and projects which can be evaluated in a technical interview. However, experience in unrelated fields, like waiting tables, is a differentiator in my mind since it tells me the candidate has already had a taste of the time and commitment responsibilities one has to take on when entering the working world.

<comment><AUTHOR> great point!

</comment></comment><comment><AUTHOR> Would add that students should "open source" showcase their work - <USER2> CS students - host your code on github, participate in open source projects, participate in stackoverflow... so you can showcase your real working code to employers rather than writing code on whiteboards during interviews.

<comment><USER4> I think this is huge for CS grads, and I would add to not overlook a blog/SO as it can really showcase your ability to discuss and explain technical topics. I can never write a blog post because every time I try I end up with an outline for a 9-part series explaining everything I've ever learned tangentially related to <topic>, but SO gave me the focus needed to showcase some of my communication abilities. I know that helped me at least get noticed by companies.

<comment><AUTHOR> Great idea, plus with beautiful, idiot simple tools like medium.com its so easy to write a blog today.

</comment></comment></comment><comment><USER5> What's that 14.7% of 'Information Systems' unemployed graduates?

People that degree in IT but can't actually code/sysadmin/whatever is the technical skill they're supposed to have?

<comment><USER6> Probably.

There's a non trivial number of these around. Politicians, students, parents, etc. are keen to _build relevant skills_ is high demand areas. On paper that's great. In reality creating programs overnight and admitting students without the vocation because the funding and students are available is a recipe for problems. There are a lot of "IT Specialists," graphic designers and other (genuinely needed) "professionals" around that can't do anything useful.

Some didn't like it, so never got good. Some are just unsuitable talent-wise (I don't think I could have ever been more than a barely competent designer). For some it's a combination of things. Below average suitability. No motivation. Bottom rung course.

Thinking of Tertiary Schools as factories for turning people into professionals at something is problematic analogy. Often its a case of we need to do something, lets do this. The result is weird numbers. High unemployment in high vacancy professions.

</comment></comment><comment><USER7> I seriously don't agree with working for free for "exposure and experience". Didn't HN just have a couple of posts recently about the serious negatives of unpaid internships?

<comment><USER4> This is pretty tech-specific. In many other fields, unpaid internships are seen as a good deal, mostly because their are so few of them and so many applicants. A friend of mine who recently converted an (unpaid) internship to a job in DC worked really hard just to land the internship. At the same time, he was learning the job but in no way provided the same benefit to his employer as a tech intern does.

<comment><USER8> Sort of adding on to that, an unpaid opportunity doesn't have to be an unpaid internship. An unpaid opportunity could be a CS student in college working on the website for an on-campus club, for example, or a public relations student serving on the executive board as the PR chair of an on-campus organization.

</comment></comment></comment><comment><USER9> Interesting information. College students often tend to ignore the "Explore" phase. It is very important to be strategic about your job search and spend enough time thinking about what direction one wants to go into. This make the job search (including the networking much more effective). Unfortunately too many of do not spend enough time thinking through our goals. It has to to be SMARTer than 'I want to work at Google'

<comment><USER10> As a college students, I find it the hardest to "explore." The best advice so far has been from parents and friends that refer something. On campus, it seems like the only resource is the career fair...and that only has big known companies. I wish there was a way to find startup opportunities.

</comment></comment><comment><USER11> This stuff is mostly consistent with what I've found to be effective. I would also really emphasize the effectiveness of learning about your prospective employer, not just the company but the actual individuals in it. Demonstrating that you're genuinely interested in the people you're talking with and the company they work for can really pave the way for you. The book How to Win Friends and Influence People by Dale Carnegie has a lot of good examples of how to get what you're after (in an honest, non-manipulative way) by focusing on the other person's interests before your own.

</comment><comment><USER12> As a college student who is trying to find a job, I believe that most people my age skip over many steps and therefore, are unable to land their dream job. More specifically, students major in anything they find "easy" in college and expect to be able to find a job after college. As much as we would like this to be true, it is not. The steps outlined by Collegefeed in this infographic highlight that the first important step is to "Explore". You must find a job that you are actually interested and that is the field where you will flourish in the future.

</comment><comment><USER13> Networking is key and a lot of times students forget to leverage off of their current networks. Networking doesn't necessarily have to be connecting with new people but getting referrals from friends and family can be huge. I've noticed in my experiences that a lot of times students don't know how to ask someone to help them find a job.

</comment><comment><USER14> These really don't seem like "shortcuts" per se. More like general tips to position yourself for getting hired. Maintaining an online presence, preparing for interviews (especially technical) and networking all take a ton of work and must be done consistently to have some impact.

<comment><USER11> That's actually a pretty good point. Networking is a more effective way to get work than just scanning craigslist, although I can see why you might call these tips "shortcuts" since from the perspective of a naive job seeker you're going of "going in through the side door" and circumventing the "traditional" job seeking process (even though most jobs are not filled through the "traditional" process).

<comment><USER15> I think the point is most college students don't know that most jobs are not filled through the 'traditional process'. This article helps explain that.</comment></comment></comment>


Yahoo blocked emails about Wall Street protest - <AUTHOR> http://news.cnet.com/8301-1023_3-20109134-93/yahoo-blocked-e-mails-about-wall-street-protests/?part=rss&subj=news&tag=2547-1_3-0-20 <comment><USER2> I'm not saying this _was_ blatant censorship; but the overwhelming consensus in this thread of 'this is obviously a case of dozens of people hitting `mark as spam`' or some other coincidence is really surprising.

Twitter blocked #occupywallst from trending; people switched to #takewallstreet and it was trending again.

I don't see any really good reason to think of yahoo or internet in the USA as some bastion of freedom; especially when it can be 'blocked' by such murky means as a spam filter (plausible deniability allows people to act out just a bit more).

Our government has shown again and again that it is willing to tap all our means of communication (to the point of potential constitutional infringement) and mega corps have been generally willing participants.

To dismiss some phrase or website being manually dropped into a spam filter as an outrageous conspiracy theory makes me wonder if _I_ am insane; because it's my perception these mega corps, banks, and government agencies will go to whatever extreme they can get away with; rather than up to some arbitrary point of what is 'right or wrong'; and this certainly seems like something they can get away with.

<comment><USER3> Not to put words in your mouth, but I am asking myself this question:

Yahoo! and Twitter care enough about between 200-5,000 protestors marching on Wall Street to commit acts of censorship? Why? What does this accomplish for these companies? They're protecting the tight-knit oligarchy which they are a part of?

I'm struggling to see why this would even be on Yahoo!'s radar.

<comment><USER4> It's not Yahoo's radar. It's individual(s) who work for Yahoo that have their fingers on the censorship button and also happen to be part of a tight-knit oligarchy.

Some New York government official phones up his old Harvard buddy at Yahoo and asks him for help in avoiding civil unrest and an outbreak of violence. In exchange he promises undying love and future favors. The Yahoo guy realizes he has plausible deniability and so is happy to indulge.

How do you climb the status ladder in America? You do favors for powerful people.

Who wants to avoid the scary possibility of a massive viral wall street protest that inspires the nation to rise up? Lots of powerful people.

Powerful people are by definition capable of getting shit done and influencing others. This is why the cookie crumbles in their favor so often.

<comment><USER5> In order to have plausible deniability, the guy at Yahoo has to have direct, personal access to ban this domain. This makes him an ops person. Pretty much anyone else needs to go through a chain to get anything like this into production, denying them deniability.

If there's a conspiracy, it's an ops guy showing off to an oligarch friend. I don't see how any member of a thigh-knit oligarchy could get this done without leaving a trail that could get him fired for cause and publicly humiliated.

<comment><USER4> VP of whatever at Yahoo shoots an email to his pet nerd in ops and asks him to add a few domains to the spam filter. A list of 20 who personally spammed an angry customer.

VP of whatever says, "Nerdbro please add these domains to the filter before noon. An angry advertiser wants immediate action on this before closing a big deal. By the way I've recommended you to the division head for that position. Thanks for helping me out on this."

In the corporate world almost everything that happens has it's genesis in an exchange like this. If you need a citation: Robert B. Cialdini

Awhile later there is some PR consequence to this decision. Some PR guy in yahoo goes to ops and asks what happened.

Immediate answer: "they were mistakenly added to the spam filter." "how did thus mistake happen?" "its technical; and anyway I'm not authorized to reveal the workings of the filter because hackers/spammers want to know how it works. "

PR guy: "say no more. I understand. I'll make sure to let the public know it was an accident"

</comment></comment></comment></comment></comment><comment><USER6> This makes me think about an interesting attack vector ;-)

If you want to silence emails in email provider Y about subject X, you send email to many accounts of Y about X. Then you have the accounts report the messages as spam. Now every email to an account of Y about X goes into the spam folder...

<comment><USER7> <http://en.wikipedia.org/wiki/Joe_job>

<comment><USER8> Anyone know what the legality of that is? What would my recourse be if someone forged an e-mail from me that caused me damages? Is it just a civil matter, or would this be criminal?

</comment></comment></comment><comment><USER9> Not to say that this is malicious, but if it was, they always make excuses like that.

"It was inadvertent, and we're working to fix the problem".

And by the time the problem is fixed, the damage has been done and the desired censorship in this case has been achieved.

<comment><USER10> _Not to say that this is malicious, but if it was, they always make excuses like that._

 _"It was inadvertent, and we're working to fix the problem"._

The problem is, most of the time any IT-related issue rears its ugly head, the problem _is_ caused by incompetence and not by malice.

Given the usual bugs, don't you think that a system like this would catch enough false positives that people would notice? Unless... they're censoring such complaints as well! ;-)

<comment><USER11> I would have sided with you before the news that showed US and EU companies are building net censorship tools for governments. They have been exposed in Syria, Libya and Tunisia but how could they not sell services to democratic governments too ? Saber-rattlers have been talking about cyber-warfare for several years now. Some of the millions spent on this buzzword was probably spent on equipments that can block messages with a deniable excuse.

<comment><USER12> But one doesn't need that type of infrastructure to block an URL. Yahoo has already spent millions building an infrastructure to block emails that look like spam.

It's "dual use" technology.

</comment></comment></comment></comment><comment><USER13> If this happens in China, it would be immediately declared an obvious case of censorship and mass control. But it happened in the very "house of the freedom", so it is obviously a simple error and anyone thinking it was on purpose is a lunatic conspiracist. I read the comments of people that know nothing about (place the subject -antispamming algorithms-) but they are more than ready to defend (place the corporation or government -Yahoo-), and just an image comes to my mind. Sheeps. Blind sheeps.

<comment><USER14> In general, the country with less of a constant trend towards mass censorship gets the benefit of the doubt. And for all the United States' faults, they have a significantly better censorship record than China.

</comment></comment><comment><USER15> Looks like a typical spam filter block. Go to your spam folder copy a url and send an email containing it and you should get the same response.

There's the question of how the url got on the spam filter blacklist, but it could easily have been an automated process.

Plenty of startups have issues with their invites getting marked as spam. Doesn't mean it's a conspiracy.

<comment><USER16> Conspiracy theories make better headlines.

</comment></comment><comment><USER17> Care of Wikipedia :A Yahoo is a legendary being in the novel Gulliver's Travels (1726) by Jonathan Swift. Swift describes the Yahoos as vile and savage creatures, filthy and with unpleasant habits, resembling human beings far too closely for the liking of protagonist Lemuel Gulliver, who finds the calm and rational society of intelligent horses, the Houyhnhnms, far preferable. The Yahoos are primitive creatures obsessed with "pretty stones" they find by digging in mud, thus representing the distasteful materialism and ignorant elitism Swift encountered in Britain. Hence the term "yahoo" has come to mean "a crude, brutish or obscenely coarse person".[1]

</comment><comment><USER18> Anyone remember the HBGary hack. After what came out about government and corporate dirty tricks during that episode is it so unreasonable to think that somewhere in the US a consulting service was working for some Wall Street billionaire to derail the protests.

</comment><comment><USER19> They are responsible for the service that they provide, even if they farm some of it out to third parties.

</comment><comment><USER20> Those conspiracy theories are actually hurting the credibility of the movement. Right now the protest simply does not have the critical mass to threaten anyone.

</comment><comment><USER21> Hmm, I could see it as a spam filter which notice a really high volume going into one account and flag it as suspecious, but it would seem much more suspecious if the emails were going out of a new account at a very high rate.

Personally this seems fishy to me. Moreso since it is comming from Yahoo.

<comment><USER22> A spam filter should act when one account sends several similar mails to numberous accounts unrelated to the sender.

A spam filter should not act when a hot topic is `trending' -- being send around from multiple accounts mostly to accounts related to them (with existing history of communication).

A spam filter acting on mere global volume of a keyword is a prime example of solution more troublesome than the original problem itself.

<comment><USER23> Doesn't it seem possible (likely even?) that one or more overzealous "99ers" sent numerous similar mails to many accounts to try to spread their message?

</comment></comment></comment><comment><USER24> I will not be surprised if this is by oversight. I am regular yahoo mail user and their spam filters suck. I frequently need to look into the trash and spam folders to check for wrongly filtered emails.

</comment><comment><USER25> Yahoo has always been overzealous about spam. I can't email anybody on Yahoo because my entire hosting company is on their block list, and has been for years. So this doesn't surprise me in the least.

<comment><USER26> Overzealous and yet incompetent. Yahoo mail became unusable to me due to spam very quickly (I have a 4-letter Yahoo handle), and I'm not sure it's much better now (I don't look at my account there often). Whereas Gmail blocked spam pretty efficiently from the beginning.

<comment><USER27> I see this kind of statement all the time from people and its just not a fair test. If you want to do a real test of the spam rates you must use the accounts in the same way.

its a known fact that older accounts get more spam than newer ones. And who knows what services you have signed up before with your yahoo account that you didn't with your Gmail.

<comment><USER28> Fair enough.

But my Yahoo account spam filtering appears to get suffer roughly as many false positives as false negatives which actually makes it worthless.

</comment></comment></comment></comment><comment><USER29> Occam's razor: A few hundred people getting e-mails about an event hit the 'this is spam' button. How is this news?

At least this time the headline doesn't says "blocked" instead of "censored", but still, it's not like this was a willful malicious act. An automated system hit a (debatably) false positive. Happens every day. Isn't a headline.

</comment><comment><USER30> Algorithmic censorship?

I bet it's just the machines' way of getting back at us for CAPTCHAs.

</comment><comment><USER31> Inadvertent my ass. I hope Anonymous retaliates.

<comment><USER32> Yeah, who needs evidence? Vigilante justice every time!

<comment><USER31> And how exactly do you expect the evidence to appear? Will the FBI investigate Yahoo for this? ;)</comment></comment></comment>


You say Lwów, I say Lviv (2010) - <AUTHOR> http://www.economist.com/node/15810902 <comment><USER2> > There is a whiff of pyjamas-at-noon, and of people who check their emails in > the small hours. Time to get a life?

Well nowadays in Ukraine the pyjamas are camouflaged and the 'wrong' opinion may get you disappeared.

I don't think it's wise to dismiss ethnic resentment : when the country is prosperous everything is fine apart from some trolls on the web but when hard times come by, resentment resurfaces and people starts to die.

WW2 Germany, Yugoslavia in the 90s and now the Ukraine, it seems we Europeans don't live well together (or some third players push our buttons to create havoc in Europe but that's another debate).

Given these precedents I'm not optimistic for the future of the incoming migrants in Europe.</comment>


Octobass: The Largest String Instrument Ever Invented - <AUTHOR> https://www.youtube.com/watch?v=12X-i9YHzmE#t=28 <comment><AUTHOR> see also:

[http://www.cmuse.org/octobass-largest-string- instrument/](http://www.cmuse.org/octobass-largest-string-instrument/)</comment>


Programming cheat sheets - <AUTHOR> http://overapi.com/ <comment><USER2> I also like [https://learnxinyminutes.com](https://learnxinyminutes.com) for when I need to understand some code in an unfamiliar language. That site also accepts contributions from anyone via pull request on GitHub.

<comment><USER3> Learn X in Y Minutes is also my go to site for dealing with code in an unfamiliar language. It's managed to get me through learning Ruby and Coffeescript on the job, as well as learning PHP for university.

It's a pity that nobody has done one for SQL yet, I would've thought it would be in high demand.

<comment><USER4> It's good to quickly grasp basic syntax so you can read code in unfamiliar language. However, I don't think that it's a good resource to properly learn language.

You will often miss learning the philosophy of the language (the $language_name way of doing it), the different way of thinking about the problems that the language provides and similar details, which are often not necessary to read a snippet of code, but you want to understand it in order to properly learn the language and make the most of it.

SQL is a good example of it. It might be trivial to explain the syntax of most common SQL queries, but thinking in relations and tables is not natural to most people so there's not much you can do with basic syntax.

</comment></comment></comment><comment><USER5> Impressive until you get to C++ and it turns into a random hodgepodge of 404s or really weak references (no pun intended).

Also, this same cheat sheet has been shared on HN 14 times now. Not a bad thing but interesting none the less.

<comment><USER6> >>Also, this same cheat sheet has been shared on HN 14 times now. Not a bad thing but interesting none the less.

It still gets to the front page most of the time.

</comment></comment><comment><USER7> If you like this sort of thing (and have a Mac), you'll probably enjoy Dash. It's particularly great to load up on anything you feel you might need before heading towards flaky international internet access for a while.

[https://kapeli.com/dash](https://kapeli.com/dash)

<comment><USER8> DevDocs is a great alternative for those of us that don't use Macs. Works fully in the browser, even with no network, which is kinda cool.

[http://devdocs.io/offline](http://devdocs.io/offline)

<comment><USER9> [https://zealdocs.org/](https://zealdocs.org/) was the one I tried, but the main problem is that it didn't support zip/tar files and Windows (explorer.exe mainly) gets very slow when there are >10 000 files in one path.

</comment></comment></comment><comment><USER10> Seems to contain javascript file from linezing which seems to be superslow and upon further examination contain malicious code(?) [https://www.virustotal.com/en/domain/js.tongji.linezing.com/...](https://www.virustotal.com/en/domain/js.tongji.linezing.com/information/)

<comment><USER11> Yeah, they have a bunch of other people's content in GitHub too it appears...

</comment></comment><comment><USER12> I recall rosetta stones for various UNIX operating systems. There were many versions of this most of them outdated now. Quick example:

[http://bhami.com/rosetta.html](http://bhami.com/rosetta.html)

<comment><USER13> There's also Rosetta Code, very useful for finding implementations of various things in different languages.

[http://rosettacode.org/wiki/Rosetta_Code](http://rosettacode.org/wiki/Rosetta_Code)

<comment><USER14> +1 Someone had recommended this on a previous thread; and i believe this to be so cool!

</comment></comment></comment><comment><USER15> Pretty neat, but the first thing I looked for was how to open a file in Python and it wasn't there. I'm guessing it's because the "File" column only displays methods on the file object, and open is a built-in function. I can see how this might be useful when context-switching between different programming languages.

<comment><USER16> Also the "Array" section refers to array.array objetcs, but, as there's no sepparate section for "Lists", they can be confused. Worst thing about this is that .byteswap would seem to be a list method (I know it isn't, but someone who's just beggining may be confused as to way the list doesn't have a bytewap() method!)

</comment></comment><comment><USER17> The regexp cheat sheet is missing the most important part, which is the characters you need to escape.

<comment><USER18> The R cheat sheet also looks incomplete. Is this a work in progress?

</comment></comment><comment><USER11> Well that's just dandy. They are plagiarising.

[http://packetlife.net/blog/2016/mar/9/dont-be-discouraged- pl...](http://packetlife.net/blog/2016/mar/9/dont-be-discouraged-plagiarists/)

All those PDFs that they have taken without permission and stored in their GitHub repository are the giveaway:

[https://github.com/overthecs/overthecs.github.io/tree/master...](https://github.com/overthecs/overthecs.github.io/tree/master/static/cs)

</comment><comment><USER19> When would someone actually use a cheat sheet instead of google?

<comment><USER20> Back in the day when I actually had a desk and walls on which to pin things, I printed out and stuck cheat sheets from the 4 languages in effective use in my context: SAS, R, python and C.

The lag/effort was/is far less than google if the info is right there, and I personally found I kept having brain farts where I'd temporarily forget what language the thought I was having was actually in, and could quickly touch base again by referencing the cheat sheet without bringing up the (often distracting) web browser...

</comment></comment><comment><USER21> This is good cheat sheets, but can we have PDF downloads for it ? Also PhalconPHP would be a great addition :)

</comment><comment><USER22> This is pretty sweet. It's like a super lite IDE but on paper.

For C#, in the online section, you should put a link to [http://www.dotnetperls.com/](http://www.dotnetperls.com/). It also has sections for other languages.

</comment><comment><USER23> not a language, but this is a great redis cheat sheet [https://www.cheatography.com/tasjaevan/cheat- sheets/redis/](https://www.cheatography.com/tasjaevan/cheat-sheets/redis/)

</comment><comment><USER24> The Java page is basically a list of links to tutorialspoint.com, which seems like an odd choice.

</comment><comment><USER25> Would be sweet if you could customize the options in your printed sheets. Example: I know how to preform basic git operations, but sometimes I need a reminder of how to push a local branch to a remote with a different branch name.

</comment><comment><USER11> Isn't this DuckDuckGo's cheat sheets?

[https://github.com/duckduckgo/zeroclickinfo- goodies](https://github.com/duckduckgo/zeroclickinfo-goodies)

I updated the git one the other day...

</comment><comment><USER26> overapi.com can be useful if you want to discover something... but for daily use I prefer devdocs.io

</comment><comment><USER27> A mercurial cheat-sheet would be an excellent addition to this.

</comment><comment><USER28> I really love these cheatsheets for PHP:

[http://phpcheatsheets.com/](http://phpcheatsheets.com/)

</comment><comment><USER29> A lot of the sheets are incomplete. The guitar sheet could use a basic chords sheet, that would be handy when you need to take a break from the computer.

</comment><comment><USER30> Would be nice to see Julia, Racket, or even a Scheme.

</comment><comment><USER31> Should fix the CSS so it looks good when printed.

</comment><comment><USER32> nice web, but there is a bug, when u go to [http://overapi.com/eclipse/](http://overapi.com/eclipse/) doesn't work, but it works when you go to [http://overapi.com/eclipse](http://overapi.com/eclipse)

<comment><USER33> looks like this bug effects anything listed under the "Related" sections on any language. They all go to the "Sorry Something Wrong..." page.

</comment></comment><comment><USER34> Scala's says

"Every value is an object & every operation is a message send."

I've never heard that coming from Scala.

</comment><comment><USER35> Not as good as google</comment>


Ask HN: how to raise £600 by the end of the week freelancing? - <AUTHOR>

Hi all! I'm in a bit of a pickle right now as a client has again delayed payment for work that occupied my last few months and my rent is due by Friday! I've tried vworker/freelancer.com but either the projects are too onerous for the pittance offered - or the work is too long term to help. Rather than the usual suspects for offshore dev shops, I'm hoping there's something I'm not aware of.
Do you know of anywhere a UK based developer can find quick projects to get this money together? I'm a very experienced PHP developer and I can design too.
Thanks! <comment><USER2> You'd probably have more luck finding work at meetup. There's an HN Meetup in London tomorrow. <http://bit.ly/YzG6eN>

<comment><AUTHOR> That's not a bad idea but I'm based further north and getting to London would be too expensive for this month.

</comment></comment><comment><USER3> It could be tough to get some tech gig within such a short time, that too for that much amount. I can think of only the following options. \- Try to contact any training institutes near you where you could quickly give PHP lessons. \- Try subletting your place and get some cash in hand. \- At the same time, try to find some online work. \- Find some part time work - non-tech related or even manual work.

Wish you good luck

</comment><comment><USER4> Could you get a bank loan to cover it?

You are a business, presumably with a track record of getting paid, so if you don't already have a loan, that could be a good option. Even the fact you haven't been paid for a while shouldn't create too much of a problem if you explain the situation (that you have been working), and e.g. produce a contract.

</comment><comment><USER2> I just got done reading this thread: <http://news.ycombinator.com/item?id=4585435>

One of the things people suggested was contacting every web/dev shop around you. The good ones usually have more work than they can handle.

</comment><comment><USER5> It's Tuesday now. So you need $785usd by Friday... Hmm, I have a web application that needs work done but I'm not sure I have enough projects specc'd out to occupy that much time.

<comment><AUTHOR> If you like, my email is in my profile and we can talk it over? I am hesitant to use this as a plea for work off HN - don't want to abuse the community and all but I won't turn things away :)

<comment><USER6> I emailed tclamattack about this posting inquiring about him doing some work and he seems pretty on the level.

To do some promotion for him, here's his company page: <http://pitbot.net>.

</comment></comment></comment><comment><USER7> Do you have a resume/portfolio?</comment>


Ask HN: Books or Courses on Blockchain – Indepth Understanding - <AUTHOR> What are some books or courses on the blockchain that offers in-depth understanding, such as "Mastering bitcoin" from Andreas? <comment><USER2> Blockchain Revolution by Don Tapscott, Alex Tapscott (Author)was on of my favorite when starting to learn about this space.

Not super high level in terms of learning to program your own stuff, however it was quite informative.</comment>


A massive new Skyrim mod, and the 19-year-old who built it - <AUTHOR> http://www.pcgamer.com/2013/07/16/behind-falskaar-a-massive-new-skyrim-mod-and-the-19-year-old-who-spent-a-year-building-it/

<comment><USER2> This is the way to do it. I went to a college that had a Game Design program and no one (that I was affiliated with) modded any games! It completely took me away since modding Tribes, CS and making maps/models/textures for existing games seemed like a perfect way to get 'real world' experience.

They kids I did see in that program mostly stayed in the lounge playing an xbox.</comment>


Why Microsoft Had to Destroy Word - <AUTHOR> http://blogs.harvardbusiness.org/merholz/2009/06/why-microsoft-had-to-destroy-w.html?cm_re=homepage-061609-_-lede-_-headline

<comment><USER2> Wow, talk about a misleading headline.... I suppose _"Why Microsoft had to retool the Word UI"_ wouldn't sound as dramatic.

<comment><AUTHOR> Yeah - I wasn't sure what the Hacker News approach was to sensational headlines so I left it as is.</comment></comment>


'Alchemy of energy': Breakthrough offers mass hydrogen storage options - <AUTHOR> https://www.smh.com.au/environment/climate-change/alchemy-of-energy-breakthrough-offers-mass-hydrogen-storage-options-20200702-p558dj.html <comment><USER2> Lots of sugar in this hype cookie. Great effort to maintain a revolutionary breakthrough tone and avoids any comparison with existing hydrogen systems.

And did they really just refer to high pressure vessel ruptures as "safe nonflammable bursts"? instead of "explosions". I've heard compressed hydrogen will expand faster than it can possibly burn when all suddenly uncompressed but c'mon that's an explosion.

</comment><comment><USER3> > _Professor Aguey-Zinsou said the alloy contained titanium and "other common > materials", but declined to name them, pending the issuance of a formal > patent expected within weeks._

So ... I guess they don't have an independent verification of their claims.</comment>


App Valuation: How to Build, Value and Sell an App - <AUTHOR> https://feinternational.com/blog/app-valuation-build-value-sell-app/ <comment><USER2> Vote and comment collusion will get your accounts and sites banned on Hacker News. Please don't do that.

</comment><comment><USER3> Fascinating! Never knew how many aspects go into consideration depending on the different types of apps/software.

Lots of great takeaways on the marketing side as well. Especially in regards to analyzing the competition.

<comment><AUTHOR> Overall we look at thousands of variables with varying degrees of weighting. Can't just use the same generic approach to each different business model as would over-simplify and ignore (or overplay) nuances of specific businesses that could be strengths or weaknesses.

</comment></comment><comment><USER4> Great insights in this article. I've never read anything that describes the process of valuing and selling an app in the digital domain so well. Thanks so much!

<comment><AUTHOR> Thank you! We are trying to lead the way with content in the space - we've written a lot about SaaS in the past, but not much about apps in general. It's a hard topic to find credible content on as it's a relatively new space and most of the exits you here about are huge apps like Snapchat and Instagram. 99.99% of apps will never fall into that same bracket but doesn't mean there is not a market to sell.

</comment></comment><comment><USER5> Really good piece. Building with value in mind from day one - very interesting approach.

</comment><comment><USER6> Excellent article. Highly in-depth and well written, yet accessible. Was particularly pleased to see a section on SaaS apps in particular. Worth your time if you have or are working on an app, whether or not you've begun to consider about eventually selling it yet.

<comment><AUTHOR> Thanks! Tried to cover a range of apps in there. We've written extensively about SaaS in the past, but not other apps which are also equally popular.</comment></comment>


500startups: make your app a mobile growth engine - <AUTHOR> https://soundcloud.com/branchmetrics/turn-your-app-into-a-mobile-growth-engine

awesome talk about app virality and growth <comment><USER2> bad link :(</comment>


Show HN: slim - Build micro-vms from Dockerfiles - <AUTHOR> https://github.com/ottomatica/slim <comment><USER2> This is interesting. I'm wondering if this might be good for making immutable development environments.

<comment><USER3> Isn't docker already good for making immutable development environments?

<comment><USER2> I don't think so. I've never tried but I don't think running VS Code, Sublime Merge, a Kubernetes cluster and numerous other things would work well in a Docker image, which is only designed to run one process.</comment></comment></comment>


Taming the lizard brain - <AUTHOR> http://devineu.eu/lb.jsp

<comment><USER2> Hahaha, then if I avoid using social media to procrastinate, it gives me a button so I can post about my success on twitter.

<comment><USER3> :-D It is the first and only self-defeating application. And intentionally so (I'm the author).

</comment></comment><comment><USER4> Do i get additional points for resisting going on that website to record a point ??

(Killer app, i think).

<comment><USER3> I just added to my resistances: Resisted checking number of users in LizBrain.

In fact your account will expire after 30 days - so that LizBrain does not become a dependency too ;-)

</comment></comment><comment><USER5> funny service!</comment>


Simplifying EC2 Spot Instances - <AUTHOR> https://www.parkingspot.bid <comment><USER2> I wish AWS were just simpler. Then there wouldn't be a need to have that kind of complex external services on top of it.</comment>


Cybersecurity Pros Name Their Price as Hacker Attacks Swell - <AUTHOR> https://www.bloomberg.com/news/articles/2019-08-07/cybersecurity-pros-name-their-price-as-hacker-attacks-multiply <comment><USER2> The biggest areas for growth for Cyber at the moment are of the not-so-sexy jobs. The asset inventory, patch management, vulnerability management, third party management, risk management, etc. If you are good at any of those and are innovating in any of those areas, you are as close to naming your own price as you can get in Cyber.

As for the most "needed" areas of Cyber, it comes down to education. Not your bachelors degree, but educating and raising awareness to your business, your IT staff, and even your development teams. It's extremely tricky to measure your return on investment, but almost always it comes down to a lack of knowledge causing one massive hole in the fence, leading to a breach.

No amount of controls will stop someone truly motivated and skilled, so you're better off raising the fence a bit higher and hoping that it deters the truly malicious.

Disclosure: I run Vulnerability Management and Assessments globally for one of the largest companies in the world, so my answer may be a bit bias :)

<comment><USER3> I've never understood people who say: "No amount of controls will stop someone truly motivated and skilled". I don't think that's true.

Correct me if I'm wrong, but If there's no holes in the application/web stack to be exploited, then there's no getting in. Right? It's not about hacker/pirate skill. It's about whether or not the target has plugged all their holes or not.

<comment><USER4> Software is only one part. Do you trust your hardware, your people, your supply chain, your physical security. "Truly motivated" can mean extreme resources and willingness to cross all boundaries.

Are you secure if your admin's child is kidnapped and the ransom demand is for network access? Are you secure from the Secret Police wanting to hijack your service for their purposes?

Once you accept you CAN'T stop truly all attacks you can be comfortable with acceptable risk and work to mitigate realistic risks.

<comment><USER5> Yep - this is why you might try to limit pivoting based on an assumption that everything is compromised, you can require coordination from multiple geographies to unlock access to certain highly sensitive resources, you ensure that these protocols aren't published, and above all you follow the New York Times Test: don't type anything that you wouldn't want to see on the front page of the NYT. This requires _pride in security_ at all levels of your organization, and it's something that few organizations outside of the military get right.

<comment><USER6> It boils down to this: if you can access secured data, then someone following the same steps can also access it.

So unless you advocate for no secured data, you are vulnerable to a sufficiently sophisticated attack (I.e. hypnodrones hijack your mind)

</comment></comment></comment></comment></comment><comment><USER7> Not surprising. At Netflix, despite the already high salaries, the security engineers were paid a premium for their skills. The highest paid engineers at Netflix were security engineers. They did stuff like invent entirely new security protocols[0][1].

[0] [https://medium.com/netflix-techblog/message-security- layer-a...](https://medium.com/netflix-techblog/message-security-layer-a- modern-take-on-securing-communication-f16964b79642)

[1] [https://github.com/Netflix/msl](https://github.com/Netflix/msl)

<comment><USER8> How do you know what everyone was paid?

That's definitely not the norm though - security engineers are typically classified the same as an SDE for payroll purposes, and tend to have less negotiating leverage than high level SDEs who build and ship products, except maybe some very rare exceptions. But most companies also don't have their security engineers actually write shipping code.

I think this article, like every security related article from bloomberg, is pretty much BS.

Also, they use the example of CISO at a large company. CISOs aren't actually security experts in the vast majority of companies. They're usually business people or outright frauds, disappointingly. The people who hire and interview them have no way to validate them.

The article makes a case for why CISOs are worth a lot, justifying the cost of a breach. The problem is that CISOs have virtually no impact on whether or not you get breached, and they usually bear no responsibility for it. It doesn't matter who you pay how much - it isn't going to affect the outcome much. Alex Stamos is one of the few that actually has any background in security at all, and look what good that did Yahoo and Facebook. Not much. The other problem is CISOs rarely get any actual authority over product, and when they try to flex, they just get pushed out. The ones who survive are simply master politicians who manage their messaging and their image.

The real reason for this article, I suspect, which appears to be primarily sourced from a security recruiting firm, is that they take a cut of every position they fill. It's very much in their best interest to pump up the value to justify their fees.

Most security money is very poorly spent. I think part of the problem is that hackers are usually bad managers, and tend to be less interested in playing corporate politics. So the manager jobs go to someone else, who has to make decisions they don't understand. The higher up you go, the more this gets amplified. For every breach you hear about, that company likely has a few competent security folks saying, "see, I told you..."

<comment><USER9> I definitely feel like I have much more negotiating power than eng, as someone who used to be in an eng role and is now in security. There are more engineers and eng is a less niche skillset. There are very, very few people with my skillset. Hiring for my team takes months, minimum, with far far fewer candidates in our pipe.

I work at an SF company and routinely field offers from other companies that I can view on levels.fyi, and my colleagues in eng are open with me about their salaries so I have lots of datapoints to compare to.

To your other comment:

> I seriously question whether you understand how mediocre the mean security > engineer actually is, even at top tier companies

This seems equally true for eng.

<comment><USER10> >There are very, very few people with my skillset.

"security" seems to be a very wide notion. Can you give some highlights of what that specific skillset is and what is your job actually consists of.

<comment><USER9> I have an engineering background, which is quickly becoming a requirement for security roles. I do detection and response work.

</comment></comment></comment></comment></comment><comment><USER11> There is an endless supply "infosec specialists" and "ethical hackers."

But there is a massive shortage in motivated experts that ensure packages are up to date and fluent enough in code spelunking to ensure the app isn't trusting user input or allowing privilege escalation.

There's also a shortage in technology leaders willing to spend money on the mundane aspect of security. It requires regular work, not compliance effort and periodic audits/pentests that check off boxes.

<comment><USER12> Software complexity in most companies has exploded. Nobody is doing anything to try reduce or manage complexity so it's only getting worse. The more complexity there is, the easier it is to find vulnerabilities.

<comment><USER2> >>Nobody is doing anything to try reduce or manage complexity so it's only getting worse.

I disagree, I see a number of large corporations starting to standardize either 1) their entire development stack from IDE all the way to how the code is deploy 2) Reengineering entire languages to have one language be used e.g Quartz at BofA 3) at the very least, companies are starting to standardize their middleware stacks, to at least avoid the configuration related issues of having a development team managing that.

While I do agree, that the complexity of third party libraries has exploded and is increasingly difficult to manage, I'd say companies are well on their way to standardizing that, with tools like Nexus, SonaType, Blackduck, etc.

We're obviously a long ways away from being even 75% effective across the board, but to say nobody is managing the complexity is a bit short sighted :)

<comment><USER13> > I see a number of large corporations starting to standardize

My current job in a nutshell.

It's like handling children (No, you can't add a new technology because you want something fancy on your resume)

</comment></comment></comment></comment><comment><USER14> As a software engineer early enough in his career to change tack, how would I go about venturing into this space? Cybersecurity is something that has always interested me, but it seems like such a massive feat that I often find myself overwhelmed and settle back into my comfortable dev job.

Then every time we finish building a new publicly accessible system we send it off to "the security company" to pen test it. I am always very jealous about this.

<comment><USER15> There is the serious end of the security business, the service end, and the fake end. Plus of course all the black-hat ends.

If you want to be in the serious end, which doesn't necessarily pay more than any other software job but can be really interesting work, I would suggest learning about anti-virus and similar attacks (there are books and tutorials) and generally making your server software game as strong as possible. Then get a job with a security company at whatever level and bust your ass looking for challenges. You can rise very quickly if you can move the dial for the customers, and "smart and gets things done" plus "gives a shit about security" is a rarer combination than you'd think.

The service part, e.g. your pen-test company, is going to be much more mercenary. Great experience if you can get it, and probably a good space to start your own company in, but of very limited value in the big world. Security companies will have huge annual contracts, pen-testers and the like will be called in occasionally to check off a box on a security audit. Either one can work for you, but it's best to know what you're getting into.

The fake end of course is companies promising something they won't actually deliver, or will deliver with gross violations of ethics and/or the law. Obviously avoid these as best you can -- for the more serious companies, having your name associated with "SEO" or other spammers can permanently blacklist you from employment at least in the US, obviously the dodgier the play the greater risk of blacklisting. Hiring managers worth their salt have a nose for this, since Ethics is way more important than Skillz for any serious security job.

In case the black-hat part isn't obvious: in many places word gets around if a talented hacker is interested in security. Mafia is mafia even for us nerds. If something sounds suspicious, I strongly suggest you don't take the meeting. (This may be less of an issue in the US.)

Best of luck to you! The world needs more smart people working for a safer Internet!

<comment><USER16> I dunno about some of this; working for a security company in a non-security software role gets you a lot of adjacent experience (take extra courses mandated by the company, go to extra talks, work with super smart security people), but I don't consider myself anything like an actual security expert after doing this for nearly 8 years.

There's a _lot_ of not-security work to be done in the security industry, and it's not all work that gives you security-specific experience. I like to think I'm good at what I do, but it's not security, even though it's to help security people.

<comment><USER15> I've been working in Security Per Se for more than 10 years and I would also be reluctant to call myself a "security expert" \-- as would most of the people I respect in the business. (Free pass for CVs in motion of course.)

This is because many of us have very specific domain knowledge which probably doesn't map to a layperson's expectation of "security expert" \-- and while I don't see much "Impostor Syndrome" I would assert that most branches of Security will humble you if you really know your shit, so a great indicator of someone who doesn't is their readiness to claim broad expertise.

Yes, most of the work in "security" is just "software engineering" \-- but my own experience has been that for people who care about the security angle, plenty of domain knowledge accrues over time. You might not even realize how much you have, but others do: for me there is a _huge_ difference between working with an ops person who has internalized the adversarial worldview of Security and one who is "just a sysadmin."

</comment></comment></comment></comment><comment><USER17> I told my son repeatedly that if he ever wanted a secure and high paying job it coukd be in cybersecurity. We aren't going back to less dependence on networks, and we are putting more and more valuable assets and operations on those networks, which will need to be protected. Although, I suppose ut is possible that computer security could move into the automsted sphere....

</comment><comment><USER18> High-profile well-connected people, friends and peers of executives, and people in a right-place, right-time situation name their own price.

ICs at FAANG get FAANG-level comp. Consultants gladly take dumb money's budget.

"Cybersecurity Pros" get the standard NDA and noncompete.

Until there's a breach.

</comment><comment><USER19> A lot security issues will boil down to the CISO / consultant saying: You have to spend a lot more on your software infrastructure, hire more staff and keep shit up to date and not use bottom barrel $10/hour offshored engineers. It will have to become company culture to keep shit up to date and do the basics in security. Like with equifax:

[https://arstechnica.com/information- technology/2017/10/a-ser...](https://arstechnica.com/information- technology/2017/10/a-series-of-delays-and-major-errors-led-to-massive-equifax- breach/)

And when that is the problem you have to deal with, it's more about executive buy in and management than it's about any sort of security expertise, and that seems fairly difficult to do at most companies with really large systemic security culture issues such as that.

</comment><comment><USER20> "CEOs don't know what it's worth until it's walking out the door," Comyns said. "Then they stand in the door and say, 'You're not going anywhere.'"

They deserve what they get. If you underfund critical parts of your infrastructure that you don't even realize are critical, what do you expect? Pay for talent. End of story.

<comment><USER21> True, but if it's critically underfunded everywhere then it's what we have now where it's just the cost of doing business and a risk you account for.

I would imagine most sites on the internet could be exploited by someone targeted and ultimately relying on the fact that their data/site isn't valuable enough to attack in the first place.

</comment></comment><comment><USER22> No disrespect to actual security experts, but here are the four common areas where a lot of dubious/questionable "pros" can pop up:

\- Health experts

\- Education specialists

\- Productivity gurus

\- Security specialists

<comment><USER23> As a security specialist, 100% agree. It's just not provable that we are worth anything. There is so much theory and guesswork and companies still get hacked because you can't prove if I'm wrong or right until you actually get hacked. There's too much ground to cover and not enough people watching the alarms. And of course he alarms trigger whenever a stiff wind blows.

Everyone wants to do security but no one knows what security means so they just cut a fat check and pretend like it is working.

<comment><USER24> Plus Security Expert is incredibly vague. Like what do you do? Are you a pen tester? SIEM analyst? Compliance? Do you work in SecDevOps? Or are just a firewall/IDS guy? Or maybe you walk around the office and hit your accountants every time they click on a phishing link with a wiffel ball bat.

The world of info sec is so massive that saying you are a expert in 'Security' is useless.

<comment><USER25> > _Or maybe you walk around the office and hit your accountants every time > they click on a phishing link with a wiffel ball bat._

I would like this job. Please post the job link ;)

<comment><USER26> Search for "Corporate Controller". They typically report directly to the CFO and oversee a lot of other financial roles. Every company has one, and they usually only step out of their office to hit someone with a club or something.

A lot of their job is protecting the company from lawsuits, usually because someone somewhere did something dumb.

Source: worked closely with a corporate controller for many years.

</comment></comment></comment></comment></comment><comment><USER27> I'm skeptical about the "more than 300,000 unfilled security jobs" stat. Are we talking about thousands of empty chairs for each of the big tech companies and hundreds for each of the remaining fortune 500?

<comment><USER28> I don't know about this particular statistic, but what is often done in these studies is to survey organisations to ask how many of these staff they want or need, or how many vacant 'positions' they have.

The numbers don't always reflect how many positions they actually have the budget for, or whether they're willing to pay a realistic rate.

Arguably, if they were willing to pay market rates there couldn't be any vacancies, because supply and demand.

<comment><USER29> I rarely see the concept of "supply and demand" used properly.

In introductory economics, it's just two lines crossing somewhere. In reality though, companies still have to make a buck, so there is a definite limit on how much a company can pay a "security professional" and still be profitable.

And worse, if we are talking about a labor shortage across an industry or country, price doesn't really come into it at all. Price is only a competitive factor, it doesn't create or destroy individual developers. If one employer "scoops" an employee for a higher price, the shortage moves to where he just left.

Sucking in talent from other industries or countries also has its limits. And on top of all of that there seems to be some anti-competitive effects preventing wage-wars.

</comment></comment></comment><comment><USER30> cybersecurity is a cat and mouse game, it will never end. If it ends up like another arms race, it s going to be a huge cost to the markets, bigger than any national defense budget. The best way to secure data is not to have them stored in the first place. I think this will be the next big trend, from big data to small data

<comment><USER29> Most cybersecurity threats are "simple" crime, rather than government action, and even the latter is often quite "commercial".

If there is enough law enforcement and enough self-protections by civilians (companies), criminals should get demotivated and the overall level of activity should die down, just like "real" crime. We're far from that though.

</comment></comment><comment><USER31> Also sounds like in the old days and somewhat similar to 'nobody ever got fired for buying IBM'. Why? Well by throwing money a great deal of money to hire the experts (if that is the case) nobody can be called out as they can if they didn't pay for that insurance.

</comment><comment><USER32> I'm curious if anyone has found consistent work doing bug bounty's and things like HackerOne to a sufficient degree that it would replace a FT engineer role.

I'd love to hear/learn about someone's experiences if it exists.

<comment><USER33> I co-manage [https://hackerone.com/googleplay](https://hackerone.com/googleplay) and the top contributor there probably makes 5x - 10x of an average software engineering salary for his home country.

Not a lot of hackers care about Android app security so there's barely any hackers participating and little competition. Most apps have never had anybody do a security review.

Additionally the scope of the program is so wide that you can look through hundreds of apps from companies that have no security posture at all. Finding bugs is easy and payouts are more than generous.

<comment><USER15> > 5x - 10x of an average software engineering salary for his home country.

...which might still be 0.2x of an average Google salary in Mountain View, as noted above.

The fact that you even mention "home country" pretty much requires that you give us specifics if you want us to take the claim seriously.

</comment></comment></comment><comment><USER34> I want companies to be held liable for their breach, especially when they are negligence or easily avoidable. I currently have FREE CREDIT MONITORING as my PII has been exposed by multiple reputable companies plus the government. Monitoring x3 doesn't punish them for leaking my data. I doesn't even (in my mind) give them enough incentive to make it much harder to loose. I'd be happy if is was encrypted and regularly tested to make sure it was still encrypted, both at rest and in motion.

<comment><USER34> note: monitoring X 3 as multiple leakers each are being "punished".

</comment></comment><comment><USER35> >Just last week, Capital One Financial Corp. disclosed that personal data of about 100 million customers had been illegally accessed by a Seattle woman, possibly one of the largest breaches affecting a U.S. bank. The firm's shares have fallen 8.9% since the intrusion was revealed.

Misleading reporting. The whole stock market went down since then, and banks particularly so.

</comment><comment><USER36> Yes and no. The price many cybersecurity pros want, is to be able to live in a place of their choosing and work remotely. Many will even take lower salaries than the market would dictate where the company is located to do so. While this is slowly improving, a majority of companies are still not willing to accommodate this in my experience.

</comment><comment><USER37> I'm studying cyber security in Germany. It's the single best decision I've made so far. The work opportunities seem endless and I love working in the industry.

Most of my fellow students simply decided to go into this field because of the high monetary compensation and expect salaries starting from 60k€ upwards with a Bachelors.

<comment><USER38> Does the name of your university start with an "R"? ;)

</comment></comment><comment><USER39> The last time my work password expired and I had to increase the number at the end from 7 to 8, I asked our 6-figure-salary cybersecurity pro what is the point of password rotation when all it achieves is that regular users stick it on post-its to their monitors or store it in draft emails in Outlook.

> Compliance.

</comment><comment><USER40> I've been interested in learning cyber security for a while, but I can't help but feel if there was a successful attack the fallout and pressure would be intense. Is that a real thing to worry about or is my imagination getting away with me?

<comment><USER41> There are all hands on deck situations, but you just do what you're good at, figure stuff out, and fix it asap. Usually it's a team effort. Not awful. If you're interested I really recommend it.

</comment></comment><comment><USER42> Guess I need a raise.

<comment><USER43> Title is misleading. It should read "Cybersecurity pros who graduated summa cum laude from Ivy League universities with dozens of contacts in the C-levels of Fortune 500 companies and are under 30 can name their own price". Truly unique times we live in.</comment></comment>


Samsung May Be 'Uncatchable' With $15.6 Billion Capex - <AUTHOR> http://www.bloomberg.com/apps/news?pid=20601087&sid=aTso8i8ANjJ0

<comment><USER2> Statements like the title of this article make no sense to me. They suggest nothing ever changes and external forces have no effect. 50 years of technology and markets suggests very few things don't change.

Look at the auto industry. Look at the state of finance and banking. Lots of changes that hit like a ton of bricks. It's probably safe to say Samsung is a safe investment. But calling it 'uncatchable' leaves the suggestion that it's not at the mercy of the markets for some reason.

But then again, I digress. The reporter has his job, which is to get people to read his article.

</comment><comment><USER3> Capex = Capital Expenditure (Spending/Investment)

And, I thought this was an interesting definition for DRAM:

...for DRAM, which temporarily holds data and helps computer processors run multiple programs simultaneously....</comment>


Steve Jobs' Wilderness Years: The Lost Tapes - <AUTHOR> http://www.fastcompany.com/magazine/165/steve-jobs-legacy-tapes

<comment><USER2> "At his memorial service, Laurene remarked that what struck her most upon really getting to know him was his "fully formed aesthetic sense." He knew exactly what he liked, and he analyzed it until he could tell you precisely why."

I find this quote very interesting. To analyse exactly why you like something obviously puts you in a place where you can easily critique and improve on ideas.

<comment><USER3> That is indeed of key importance. I know some musicians who have this and some who don't. I notice that the ones who don't tend to learn tunes that we mutually like, but play those tunes without the things that really make them work.

I think the same thing happens with products.

<comment><USER2> I think it's a very important mindset to have, especially within a startup. I'm going to make a conscious effort to evaluate aspects of my life in the same way. As with anything, repeated use develops the 'muscle' required to do this quickly and I see it being a very valuable skill.

<comment><USER3> I think the Zen folks call this "mindfulness."

</comment></comment></comment></comment><comment><USER4> One new takeaway: _There was one other big lesson he learned from his Hollywood adventure: People remember stories more than products._

</comment><comment><USER5> The cult of Jobs lives on. Ffs let the poor man rot in his grave already.

<comment><USER6> Just because you don't want anybody to remember your legacy when you die, doesn't hold true for everyone.</comment></comment>


Early adopters and Silicon Valley are the easy way to failure - <AUTHOR> http://vanelsas.wordpress.com/2008/08/05/early-adopters-and-silicon-valley-are-the-easy-way-to-failure/ <comment><USER2> <http://ourdoings.com/ourdoings-startup/2008-07-31>

This is a great counter point. There are always pros and cons to every thing. Looking at a single side just appears trollish.

<comment><USER3> That was just my first point, having little actual experience with early adopters. I posted a followup today with four more reasons why it pays to seek early adopters.

</comment></comment><comment><USER4> Seemed to work for Yelp.

<comment><USER5> Throwing a random example of a case where a strategy correlates with success isn't sufficient to dismiss the possible shortcomings of that strategy.

<comment><USER4> Sure, I totally agree, hence revising what I was originally going to post. :)

I don't think it's a random example. If you utilize the early adopters in the Bay Area to gain a foothold, so long as you can leverage that, it's still a good strategy to take.</comment></comment></comment>


A pizzeria owner made money buying his own $24 pizzas from DoorDash for $16 - <AUTHOR> https://www.theverge.com/2020/5/18/21262316/doordash-pizza-profits-venture-capital-the-margins-ranjan-roy <comment><USER2>
      GrubHub... lost $33.4 million over the last 3 months. (In fairness: COVID-19.)

I don't understand the qualifier. Hasn't Covid-19 been a _boon_ to delivery services? If they can't profit during these artificially beneficial market conditions (boosted demand and endless supply of minions to do delivery), how can they ever profit?

<comment><USER3> They are engineered to take a loss. If market conditions improve they ramp up costs. It's not a game to maximize profits yet, it's a game of trying to maximize vale extracted from losses.

<comment><USER4> "We're losing money on every sale!"

"Don't worry, we'll make up for it in volume."

<comment><USER5> Is that from silicon valley? Because I have to say that Seinfeld (Kramer) already did that bit, hilariously, many years ago.

<comment><USER6> According to this post: [https://www.barrypopik.com/index.php/new_york_city/entry/we_...](https://www.barrypopik.com/index.php/new_york_city/entry/we_lose_money_on_every_sale_but_make_it_up_on_volume)

the original use of the joke/phrase goes back to at least 1933 and likely further.

</comment></comment></comment></comment></comment><comment><USER7> Extensive discussion of original source: [https://news.ycombinator.com/item?id=23216852](https://news.ycombinator.com/item?id=23216852)

</comment><comment><USER8> I live in Colombia. A couple years ago right before a new funding round (I guess looking to pump the revenue numbers), Rappi offered 50% cash back on unlimited purchases, up to $1000 per purchase. Bought a few iPhones and netted like 10k reselling them on FB, lot's of people did too. How's that for CAC.

</comment><comment><USER9> Ha, the show Silicon Valley predicted this exactly.

[https://www.youtube.com/watch?v=Txl90NEl92U](https://www.youtube.com/watch?v=Txl90NEl92U)

</comment><comment><USER10> Yelp is another one of the trash companies that's acquired their customer base through bullying small business owners. They're welcome to piss off as well.</comment>


Coinbase and the IRS - <AUTHOR> https://medium.com/@barmstrong/coinbase-and-the-irs-c4e2e386e0cf#.238vo9q3v <comment><USER2> I think you are fighting the good fight Brian!

In tin hat mode, its possible that the subpoena is actually being driven by the justice department not the IRS. As you point out there are a number of less invasive ways of insuring tax compliance but there are not better ways for unwrapping large number of bitcoin transactions involved in ransomware or other extortion or criminal activity. We saw from the MtGox fiasco that when their entire transaction record for all clients was analyzed it identified not only internal corruption but a variety of schemes being used to manipulate or defraud.

Let's assume that Justice has the full transaction records for one or more of the non-US exchanges, by adding all of your records to the mix it would give them the visibility they need to unwind a lot of stuff.

As I understand it, when you make the motion to quash you can compel them to tell you exactly how they were going to use the data. Don't let them be evasive on that point.

</comment><comment><USER3> I used bitcoin quite heavily in 2016 through the 'shift' card that coinbase offers, and I think I'm going to hold off on further use in general until tax stuff is more clear / straightforward - I've made an effort to pay the bitcoin taxes correctly in previous years, but not personally being an accountant, had to hire one to check all the stuff (I'm not super rich, so this is a little bit annoying). The point of this comment is that I think it is a good thing coinbase is trying to standardize some reporting method - I also agree with the '1099 for each cup of coffee bought with bitcoin' seems a little bit much...

<comment><AUTHOR> We make it as easy as we can with the cost basis report [https://support.coinbase.com/customer/portal/articles/149648...](https://support.coinbase.com/customer/portal/articles/1496488-how- do-i-report-taxes-)

<comment><USER3> Thanks - yeah, that is pretty helpful.

</comment></comment></comment><comment><USER4> For some negative context on Coinbase, take a look at [http://reddit.com/r/coinbase](http://reddit.com/r/coinbase).

It looks like, despite the shiny front and claims, they are still not a solid, trustworthy company, even though they play with a lot of others' money. In particular, the mechanics of their transactions are not obvious (e.g. long wait times), and their customer service is subpar, making some customers feel scammed, with no recourse.

<comment><USER5> People like to hate on Coinbase because they took a stance on the block size debate in the past that was at odds with powerful people in the Bitcoin world who also happened to control the main forums for discussing Bitcoin. I think most of the "problems" people have are just a thinly veiled attempt at a smear campaign. At this point they are the the standard in Bitcoin for what a trustworthy and ethical company should be. They have got to hold the record for longest period in Business w/o losing massive amounts of customer funds to fraud or theft.

<comment><USER6> Given that Bitcoin isn't the future of money — it's either a Ponzi scheme or a pyramid scheme [https://www.washingtonpost.com/news/wonk/wp/2015/06/08/bitco...](https://www.washingtonpost.com/news/wonk/wp/2015/06/08/bitcoin- isnt-the-future-of-money-its-either-a-ponzi-scheme-or-a-pyramid-scheme/) it's somewhat hard to be "trustworthy" and "ethical". Are you rating the competing mob families on the trustworthy and ethical scale too?

<comment><USER7> I'll never understand the people who are rabidly anti-Bitcoin. Can anyone enlighten me? Are they threatened by an alternative to traditional fiat currency, or have they just read so much propaganda (like that WaPo article) that they're completely committed to it now?

<comment><USER6> I am mad at the hype leveled at Bitcoin because ordinary people lose so much money with it. Not just because of the inherently fraudulent nature of Bitcoin but because you put something that can be very easily exchanged into money on insecure computers. Every computer is insecure, mind you but people don't really know (or care!) what they are in for until they are hit.

<comment><USER5> No offense but you seem to only have a surface understanding of Bitcoin.

I'm not sure what you mean by ordinary people lose a lot of money with it but ordinary people have surly lost more money in the stock market than they have in Bitcoin. Saying Bitcoin is inherently fraudulent is simply false.

On the topic of computer security. If you are serious about your Bitcoin's security there have been secure hardware wallets available for several years now that are easy to use and eliminate the chance of theft from hacking. They have come down in price to the point where they are very affordable.

The Ledger Nano S for example is $50. It's also super easy to use and never exposes your private key to your computer so it can't be stolen even if your computer is infested with Bitcoin stealing malware. Trezor and Keepkey are similar devices.

</comment></comment></comment></comment></comment></comment><comment><USER8> fwiw, Coinbase wouldn't be the first financial institution to challenge a John Doe Summons. The IRS issued one to UBS in 2008 ([https://www.justice.gov/archive/tax/txdv08584.htm](https://www.justice.gov/archive/tax/txdv08584.htm)). UBS claimed it couldn't comply with the summons without breaking Swiss bank secrecy law, and the Dept of Justice ultimately came to an agreement directly with the Swiss government (under an existing tax treaty) to get the records it was seeking. Simultaneously, the IRS set up a voluntary disclosure program for Americans to pay a penalty on back taxes and avoid criminal prosecution. The amount of back taxes owed on bitcoin capital gains is probably less than the amount being sheltered by the Swiss in 2008, but it's not nothing.

</comment><comment><USER9> These IRS witch hunts do little but inspire FUD about bitcoin, thus hampering widespread acceptance, and keeping the US financial system in a bygone era.

<comment><USER10> Also, is there any idea about how much money the IRS could possibly recover through bitcoin? Is bitcoin even a significant source of loss for the IRS as compared to say, _cash_?

<comment><USER11> I'd say one advantage of bitcoin is the lack of reporting requirements if you wanted to move money without letting the IRS know. So I could see how bitcoin could be a loss for the IRS.

<comment><USER10> Right, but the IRS has already classified bitcoin and provided guidance as to reporting requirements [1]. This situation isn't much different to cash wages. You can in theory not report any of it, but then you're breaking essentially the same law.

My question is: don't losses from unreported cash wages vastly outnumber losses from unreported virtual currencies and isn't that likely to remain the case for the forseeable future?

With this sort of action, is the IRS signaling a belief that virtual currencies will replace cash for average citizens in the near future?

[1] [https://www.irs.gov/uac/newsroom/irs-virtual-currency- guidan...](https://www.irs.gov/uac/newsroom/irs-virtual-currency-guidance)

<comment><USER12> I'm not sure there is the massive "losses from unreported cash wages" you seem to imply there is.

There's two main forms of "cash wages" in the US. One being wait staff, the other being "under the counter pay" to workers, generally labor intensive. Wait staff who regularly under report their tips are easily identified by the IRS. In the second case, these generally aren't well paid jobs (thus wouldn't generate much, if any, tax revenue).

<comment><USER13> There's underreporting and tax evasion in almost any business which can be conducted on a cash basis. I know of a heating air-conditioning contractor (now deceased I believe) who regularly got customers to write checks directly out to him and take those to a check cashing business. He was very clear he was doing this to evade taxes.

</comment></comment></comment></comment></comment></comment><comment><USER14> Bitcoin is a technology defined by its community. That's why they made a public comment about a pending legal issue - to defend their reputation within that community. A community that, for instance, leads a HN discussion to be >50% arguments about whether government of any type is a bad idea. They'd get even more customers of they refused to comply with any subpoena, but then they'd be unable to interface with modern banking.

<comment><USER10> Good point. Coinbase by nature has to walk a line between two communities very much at odds with each other.

There is an onus on the bitcoin community to get more people to accept bitcoin directly as payment. Companies like coinbase could help that process along in theory, but they'll have to keep walking this line while they grow.

</comment></comment><comment><USER15> This is a good move for Coinbase, i'm glad they are defending their users. They are right that it is overly broad. I don't see how IP addresses and customer support transcripts are a matter for the IRS.

<comment><USER14> IP addresses could help them identify people trying to get away with smurfing by setting up multiple accounts [see: [http://www.investopedia.com/terms/s/smurf.asp](http://www.investopedia.com/terms/s/smurf.asp)], and customer support for banking is typically about reconciliation -- if coinbase has any mutable records in their databases (likely) that'd be the only place to find the original information -- if they don't get it in the first court order they won't have a super good reason to ask for it later (a judge will ask them why they think the new order is needed, and if they suspect the information supplied to be false -- if they ask for it immediately it can be used to create a more detailed picture of how certain accounts developed).

Not saying the order is justified, merely that the people asking for it want it for actual reasons.

</comment></comment><comment><USER16> Speaking as a Coinbase user I would _love_ it if they could just send me a 1099. It would make filing my taxes a whole lot easier.

<comment><USER17> Coinbase offers a (beta) cost basis for taxes report via [https://www.coinbase.com/reports](https://www.coinbase.com/reports)

</comment></comment><comment><USER18> > For tax purposes, gains on property do not have a de minimis exemption like > currency. This would mean that even the sale of a small amount of digital > currency (say to purchase a cup of coffee) would generate a 1099 form.

Does that mean you could write a program that created virtual currencies and transactions between them (along with their required 1099 forms) in order to troll the IRS by submitting TBs of data?

<comment><USER19> You could do a lot of things, but antagonizing the IRS would not be a smart one.

</comment></comment><comment><USER20> They estimate it might cost them up to $1MM. Question - if IRS lose, can they recover most of legal fees??

<comment><USER21> Very unlikely.

[https://en.m.wikipedia.org/wiki/American_rule_(attorney%27s_...](https://en.m.wikipedia.org/wiki/American_rule_\(attorney%27s_fees\))

<comment><USER20> But it seems like frivolous lawsuit - its a blanket request for all data.

</comment></comment></comment><comment><USER22> They talk about having "invested" in the tremendous waste of time and effort that is "compliance", simply to enforce ridiculous jurisdictional fiefdoms' opinions about who you can or can't send your money to.

Imagine a world where this terrible waste weren't mandated by the men with guns. Imagine a world where cryptocurrency executives didn't try to spin this huge coerced waste as a positive.

This is the reason cryptocurrency was invented. Shapeshift is the right direction. Coinbase is the wrong one.

<comment><USER23> And when I start getting paid in Dogecoin, I'm sure Shapeshift will be very useful. Right now, I'm paid in government controlled currency, and I don't see why efforts to get people to trade it for cryptocurrency shouldn't be applauded by cryptocurrency enthusiasts.

</comment></comment><comment><USER24> Offtopic, but why would a CEO make an important (for his company and customers) post like this on medium.com? Why isn't this hosted on blog.coinbase.com or something? I know that Medium is a popular platform these days, but I think it weakens the branding of any company or individual to be posting there.

<comment><USER25> Seriously? As a user of their service I'm glad to see them offload an extraneous expense to someplace that's better equipped for the service provided.

After evaluating this situation further, I felt further comfort in knowing there's an added level of authenticity to the post. They could have signed it with a GPG key which would've been nice, but not only would their core site have needed to have been comprised but also their medium account in order to deliver this news. Should this have been a security incident I would have been comforted by these additional ID confirmations.

<comment><USER24> Most companies don't regard brand-building and SEO as an extraneous expense. I'm sure Coinbase has spent their share of money on promotion. I'm also sure they could host a blog, or have someone else do it for them (does Medium have a self-hosted or custom domain option?)

<comment><USER26> They do have a blog at blog.coinbase.com

</comment></comment></comment></comment><comment><USER27> tldr; CEO: "Coinbase and the IRS have (I believe) a shared goal to ensure all U.S. customers pay their taxes. I believe a good option would be to use the same third party reporting mechanism that brokerage firms like Fidelity and Charles Schwab use today: the 1099-B form. We'd ideally like to see that structure applied evenly to all companies in the industry, but even if we're required to go first, we're ready to implement 1099-B reporting. With this potential solution, Coinbase (and other virtual currency exchanges) would issue a 1099-B at the end of the year to all U.S. customers, and send a copy to the IRS. This would make it easy for users of virtual currency to pay their taxes without violating their privacy."</comment>


Materials science researchers develop first electrically injected laser - <AUTHOR> https://phys.org/news/2020-08-materials-science-electrically-laser.html <comment><AUTHOR> >Electrically injected GeSn lasers on Si operating up to 100K

[https://www.osapublishing.org/optica/abstract.cfm?uri=optica...](https://www.osapublishing.org/optica/abstract.cfm?uri=optica-7-8-924)</comment>


The bitter taste of nickels and dimes - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2008/08/the-bitter-tast.html <comment><USER2> Careful waiving fees and reducing costs for some customers and not others, as you might have the reverse effect. i.e. rather than delighting one customer, you piss off ten who see you giving special treatment to some random dude and not them.

We still do it, but in a pretty orderly fashion...we have a reseller system that provides pretty significantly lower prices to our customers that buy a lot and provide the software to their customers rather than using it directly. But it's a pretty predictable discount: Buy a lot, get it cheaper. We also, behind the scenes, gave all of our early adopter beta customers a free year on their licenses. Everybody. But we didn't talk about it a lot, because we knew that wasn't the way it was always going to be...and didn't want people thinking we just suddenly started charging _more_ and giving _less_. T-shirts are also something that we give away a lot...but we give them to pretty much _anyone_ who asks for one (when we have them). We don't even care if they're a paying customer. If they like what we do enough to want to wear a T-shirt with our logo on it, we want them to have one.

So, I dunno. Nickel and dime-ing has always seemed a little short-sighted to me. I'm maybe more of a cheapskate than most folks, but it still seems problematic. To put it in perspective, when I stay at a mid-range hotel, I'm delighted when I find that a pretty good breakfast and parking is provided for free...when I stay at a high end resort, I'm pretty seriously disappointed to find that a maybe slightly better breakfast costs $45 and parking is only available via valet and costs $25/day, plus tips. If I pay $150/night and breakfast/parking is included...why if I pay $400/night, do I still have to pay exorbitant prices for the other stuff? See, I'm cheap! But I'm not complaining about things costing more...just that it feels like the mid-range hotel is providing more service for less, while the high-end hotel is looking to extract money from me every time I turn around. But, then again, the Ritz- Carlton doesn't seem to be hurting, so maybe tacking on all those extra costs works fine when wrapped up in the trappings of "luxury".

<comment><USER3> Because if you pay $400 for a room, then you _must_ have more money to extract.

</comment></comment><comment><USER4> The name of the game is expectation management. It's best to exceed the expectations than to fail them.

For example, Apple guides on 10 million iPhones sold this year. This is a laughably low number as it represents less than 70% YoY growth, well below typical 100% YoY in smratphone market. Add to that world-wide distribution which wasn't there last year and which is not a part of 100% trend. You can bet there will be headlines like "Apple roars, sold double the iphones it expected" in a year from now in every single news paper. And Steve jobs will be on stage saying "well,iPhone was pretty popular this year. In fact, twice as much as we hoped - we can barely keep up production. Sorry about all the lines. ;)"

</comment><comment><USER5> Another piece of "common sense" that seems all too rare.

It may seem like such an obvious point he is making, but it's definitely a point worth making. Focusing on short-term return at the expense of the customer relationship will never give good longterm results, and may not even give good short-term results.

<comment><USER2> Agreed. It's particularly surprising that the employee didn't waive the cost, and raise hell up the chain about the policy. I thought Whole Foods was an "empowered" workplace where employees made the decisions about what happens on the floor. This seems like something they ought to have a say about, if they are, in fact, able to make decisions about how the store where they work operates. I'd certainly never be happy about charging someone $0.50 for ice to go with a beverage they were already paying for...every independent coffee shop I've ever been to will serve just about anything over ice if you ask (and in Austin, on hot days, I found they often asked preemptively if I wanted it iced).

<comment><USER6> >I thought Whole Foods was an "empowered" workplace where employees made the decisions about what happens on the floor.

Starbucks was like that initially too, but neither have been like that for years.

<comment><USER7> I think Starbucks is trying to bring some of that back. I got a free coffee in a Houston Starbucks a few weeks ago.

<comment><USER8> My experience as well. The Starbucks I go to often is constantly giving me free drinks/snacks/extras.

<comment><USER9> Same here. Starbucks is a giant corporation, but each branch has the same people in them from day to day, if you stop by the same branch on your way to work every morning, then you'll soon be chatting to the staff.

I don't know the dynamic behind the free stuff tho'. It could be Starbucks policy, it could be just the staff being nice to a familiar face who doesn't just bark an order at them, or it could be them deliberately screwing their employer. Probably all three at one point or other.

</comment></comment></comment></comment></comment></comment><comment><USER10> The point to take away here is not that you should give preferential treatment to frequent customers.

The point is that some customers do actually look at the price of 'extras' and no one likes to feel they are being cheated. Charging an obviously huge markup makes you seem dishonest and makes the customer feel cheated, rightly so. Things that are obviously cheap in materials AND labor AND creativity should be sold CHEAPLY or free.

Of course some businesses have found that their target customers are completely price insensitive when it comes to the extras, and those customers end up paying absurd margins as a result.

In an age when both the bottom end of the market and the stratospheric luxury end are manufactured by neighboring (or even the same) factory in China, the "value" of an item is finally almost completely disconnected from its cost.

I wonder what would happen if prices were required to include, instead of the meaningless breakdown of price vs tax, price vs. cost (ignoring intagible costs, since it is too hard to measure them meaningfully).

</comment><comment><USER11> I have trouble understanding this? The price for ice was set to 50cent, why should they give it away just because somebody asks? Maybe there is a reason for the price (more manual labor, higher electricity bill, whatever)? If 50 cents matter to Seth, why shouldn't they matter to the food company?

What about flavorings for coffee, or extra milk foam, etc? Maybe these things really don't cost anything, and the companies could give them away for free. On the other hand, if they do cost something, I would be annoyed to pay 50cent extra for a flatrate I don't need.

It just seems as if both models have their merits - maybe a flatrate shop and a "sectioning" shop could exist next to each other and please different kinds of customers.

</comment><comment><USER12> To play devil's advocate here, smaller shops tend to not have as many customers so they can lose a few cents on every transaction. If every Starbucks or big name hotel started giving these freebies, it would go into the big bucks. I guess one can blame shareholders for that.

<comment><USER13> This implies that its a zero sum situation. The goodwill generated might actually ( _probably_ ) lead to an _increase_ in sales overall despite the small discounts per sale.

Big business seems positively blinded to this potential emergent behavior. Sometimes I find it extremely comical how _giant_ companies with the resources to hire a legion of economists will defy common sense in pursuit of a nickel at the cost of a dollar, all the while dragging their reputation through the mud.

<comment><USER14> I think its a result of the difficulties in quantifying customer satisfaction as opposed to simply trying to screw everyone with additional costs.

I think the economists views are that its all about ensuring that you meet or exceed shareholder expectations, so they will take the approach of "its better having a bird in the hand than 2 in the bush" when it comes to these matters.

Besides - when it comes to things like these, I think there is the vocal minority that complains and says that they will never use that company again (the majority of people do use them again anyway) and the majority of people are simply complacent and accept it.

</comment></comment></comment><comment><USER15> I'm surprised no one has mentioned the "low-cost" airlines in this discussion. For example Ryanair are still busy lowering fares, but reclaimming the extra money from all the extras. I think they are doing reasonably well financially. Then again I try not to use them because it's never a good experience...

Can you image check-in desk people waiving fees? (actually I can, sometime I think they just ignore the weight of my bag :)

</comment><comment><USER16> If it could be shown that Whole Foods waived fees X percent more for people of race Y than of race Z, Whole Foods would be sued out of business. Much better to just do away with charging for ice altogether.

</comment><comment><USER17> Whole Foods jumped the shark when it started closing its raw juice bars.

Since then it's been one ham-handed move after the next.</comment>