Google Translate, Now With Voice Input - <AUTHOR> http://googlesystem.blogspot.com/2011/04/google-translate-now-with-voice-input.html <comment><USER2> Might be worth mentioning that the Google Translate app for IOS already had this feature for a while. It actually works surprisingly well in all the languages I have tried (even though I speak some of them with a horrible accent). I suspect they just added an interface for Chrome to an existing back-end.

Update: I just noticed that this is actually an implementation of the HTML Speech Input API ([http://lists.w3.org/Archives/Public/public-xg- htmlspeech/201...](http://lists.w3.org/Archives/Public/public-xg- htmlspeech/2011Feb/att-0020/api-draft.html)), so technically this could appear on any site. This makes things actually a lot more interesting :)

<comment><USER3> It's because Chrome just added support for the Speech Input API:

[http://chrome.blogspot.com/2011/03/talking-to-your- computer-...](http://chrome.blogspot.com/2011/03/talking-to-your-computer- with-html5.html)

<comment><USER2> I just noticed that too; that is of much broader interest :)

</comment></comment></comment><comment><USER4> I wonder why Google is doing it like this. Sending an audio file of your voice over the wire seems like unnecessary overhead. From an API perspective I'd much rather have client-side speech-to-text built into the browser (accessible via a JavaScript API). I think they're already doing STT client-side in Android, so what's the hold-up with embedding it in Chrome and letting web developers go nuts with voice-enabling their web apps?

<comment><USER5> I'm not familiar with Android, so I'm not sure about the capabilities of its client side speech recognition algorithms, but the short answer is that competent speech to text is currently a very, very intensive problem.

SR is roughly divided into acoustic and language modeling. The acoustic model proposes words that might have been said given some chunk of speech and the language model tells you what the most likely actual word is given what's been said.

The acoustic model can be solved in a large number of ways — though production technologies use very large hidden Markov models — but decoding a word sequence from speech might scale like O(knm^2) with n being the size of your vocabulary (often _large_ ), m the complexity of the acoustic model (# of phonemes modelled, perhaps) and k the number of acoustic frames. The n at the very least can be parallelized (embarrassingly), but the m and k cannot.

The language model involves a search through an exponential search space of orderings of words in the vocabulary (n^l choices, but l is also unknown). Anything sophisticated also will have an incredibly large (in memory) model as it has to have parameters across words, pairs of words, triples of words, grammatical categories, topics, etc. etc.

Solving both of these problems well simultaneously is not a task for a consumer computer. Speedy algorithms with small vocabularies and simple models exist and are implemented (Dragon Naturally Speaking, for instance) but Google didn't go and record a million hours of GOOG-411 to produce Dragon's technology over again.

\---

Finally, there's a lot of work on front end signal processing in SR. Before you get into acoustic and language modeling, you often transform your input into another representation (often spectral components from sliding 10ms frames). A growing camp in SR research involves finding _sparse_ front end representations of speech though. If the client-side software is capable of quickly computing a sparse representation of the speech, that could dramatically reduce the latency and bandwidth issues.

<comment><USER5> By the way, the reason Google is willing to spend this computational effort for your convenience is probably the same as GOOG-411. They are definitely recording every translation they do in order to use as a huge training corpus later.

 _The best data is more data._

</comment></comment></comment><comment><USER3> What's interesting to me about the Speech Input API is that most browser vendors don't have access to the underlying technology to make the api useful. Microsoft has the tech, and Apple has it a little bit, but certainly Mozilla and Opera do not. They _might_ be able to afford providing it through 3rd party access, but any one smaller than that (read: community browsers) aren't going to be able to implement this.

It's the first HTML standard that I can think of where this is true.</comment>


An Innovative Phishing Style - <AUTHOR> https://tehaurum.wordpress.com/2018/09/30/an-innovative-phishing-style/ <comment><USER2> > As far as I could tell, the debugger trap was basically calling the debugger > function if it detects a running debugger.

This is a fairly common trick, you just run the debugger method in a setTimeout loop since it's a no-op if the debugger isn't open. It's a common tactic used by quasi-illicit sport streaming websites that are usually filled with ads.

There's a button in Chrome Dev Tools to disable breaking on breakpoints that gets round this.

</comment><comment><USER3> The site's dead now - the DNS record was pulled about an hour ago. But, I got a snapshot of the site and all the code before it got taken down, and I took the liberty of deobfuscating the big blobs of code:

[https://github.com/nneonneo/steam-phishing- analysis](https://github.com/nneonneo/steam-phishing-analysis)

It's fairly simple code, in the end. The phishers copied the legitimate trading site, as well as the Steam Community login page, and then added some JavaScript code to both as well as tweaking the HTML a bit. In total, three snippets of JS were added: the first detects debuggers using [https://github.com/sindresorhus/devtools- detect](https://github.com/sindresorhus/devtools-detect) (the bit that the original blog poster found), the second pops open the fake browser chrome and sticks the fake login page inside an iframe, and the third (running in the iframe) harvests credentials off the copied Steam login page.

<comment><USER4> How was the JS obfuscated? Did they, by any chance, use [1]?

AFAIK that tool includes a very similar anti-debugging technique.

[1] [https://github.com/javascript-obfuscator/javascript- obfuscat...](https://github.com/javascript-obfuscator/javascript-obfuscator)

<comment><USER3> They did a first pass obfuscation which replaced local variable names with gibberish and then applied some minification. Then they applied an obfuscation tool 2-3 times for each of the three code snippets, causing the code to bloat up quite considerably. However, at least two different obfuscation tools were used - one simpler one (used for the antidebugger hook) and one more complex one that looked almost like a virtual machine.

The output looks a little like the output from your link, but there's a lot of structural differences so I'm not sure it was the same tool.

</comment></comment></comment><comment><USER5> Thanks for the good writeup. This technique however is not new, as others have mentioned. If you look at this phishing site on the "Similar Pages" feature on [https://urlscan.io](https://urlscan.io) you can see a bunch of other phishing pages with similar themes (gaming / skin customisation) that employ the same phishing kit, going back five months: [https://urlscan.io/result/24dc54ec-2008-4fe1-b526-4a25fca25f...](https://urlscan.io/result/24dc54ec-2008-4fe1-b526-4a25fca25ff3/related/)

Some example domains: skinssoul[.]com, skinsnecro[.]com, dotaskins[.]eu etc...

</comment><comment><USER6> I will vouch for the author of this article. Smart kid!

On a slightly off-topic, I think it's safe to say that trading and farming items in popular games, is responsible for cheaters, unfair practices, and in turn developers churning out more of these.

I hope we can return to games, where I pay for a title for its entertainment value, bar of all loopholes and caveats.

<comment><USER7> It's a stretch to say it results in cheaters, people have been writing cheats since quakeworld.

<comment><USER8> The rate may have accelerated due to present incentives.

</comment></comment></comment><comment><USER9> I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel, I would have fallen for it maybe 80% of the time.

I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure.

I don't think teenagers and non-techy users would stand a chance against this.

<comment><USER10> Note that LastPass didn't autofill the password and the box stayed gray instead of red. That would tip off most LastPass users that the url was wrong.

edit: Image in question: [https://i.imgur.com/hVTEKfD.png](https://i.imgur.com/hVTEKfD.png)

<comment><USER11> 1Password saved me from getting phished by "colnbase.com" because the completion hotkey didn't work. I still wince thinking about how close I got.

You used to just have to be moderately tech savvy to avoid scams but I find myself tricked more and more often these days. Recently it was a "click to start download" ad. I sent the page to my friends and they got fooled too.

</comment></comment></comment><comment><USER12> The fake pop-up window isn't new. This does seem a fairly well engineered version of the trick, but sites have been pulling this shit since the 90s. It has been a while since I've seen it though, but then I use an ad blocker so I suppose I wouldn't.

<comment><USER13> I distinctly remember laughing at fake popups using Windows UI styling while I'm using Linux.

<comment><USER14> Yeah, and this one isn't any better in that regard. Was just examining it on a Mac, where it uses the same Windows UI style.

One should think that malware authors would have already implemented some JS library of sorts for their fake popups that fakes Windows, MacOS and Linux UI styles more convincingly.

Especially since they've applied serious thoughts to other parts of the fake, like the language chooser in the fake Steam popup. It causes a spinner for a short while and then an error popup saying something like "cannot communicate with Steam server". Nice idea to dead-end page components that they didn't want to fake more convincingly.

<comment><USER15> Unthemed Windows & Mac OS will be convincing to a lot, Linux will be pretty hard. Then again those who tinker with their computers are unlikely to fall into this trap.

<comment><USER16> This specific phishing website mimics an ingame website for Counter-Strike Global Offensive, a shooter game with the vast majority of players using Windows. Linux isn't supported at all and while the game technically runs on a Mac most people don't (or play it with Bootcamp).

I would not be surprised if 99% of the audience for this website is using Windows, the vast majority with default themes (and the ones without either won't notice this or think Windows is buggy when a popup shows the default theme).

<comment><USER17> >Linux isn't supported at all

What? Valve games tend to have pretty good Linux support.

</comment></comment></comment></comment></comment></comment><comment><USER18> Wanna bet that if I call anybody working in a bank, telling them I am from the IT department and I want them to check the new login page (done the way described in this article), they will enter there their login & password?

<comment><USER19> Well, first, phishing is not calling someone, but at our bank we train our employees monthly about phishing by testing them, and if they fail they must take a class. Serial failures could result up to termination. So, how much you wanna bet?

<comment><USER20> > So, how much you wanna bet?

You're not resigned enough to be on an infosec team, and if you're not on an infosec team you probably don't know the true percentage of how many employees are failing over and over (it's a ton, it's _always_ a ton).

I'd go big :)

<comment><USER21> Personally I'd be pretty sure that, at least at the bank I currently work at, this would rarely ever work.

I mean, other than the attempts to foster a relationship between bank staff and the tech people through things like days of letting tech people hang out and try and be helpful at branches in order to "see what real difference they could make" \- and that laegely ending up being a fairly regular educational exercise for everyone involved theres two problems I see:

1\. All the phone calls into branches are monitored (you may have noticed so many "we will record this call and it may be monitored" messages - they arent kidding) and if certain key words, or even key tones of voice are picked up someone from a relevant team silently dials onto the call to listen in. 2\. The general process for _anyone_ not in it interacting with any IT system is to click a button on their screen which generates a 6 digit pin and if you cant match that pin with the person talking to you and dont confirm success then alerts go out immediately.

And given the hit rate on the "generate pin" api, tellers are definitely using it properly.

So i'd be inclined to go pretty small if I where to bet at all.

Not sure why the assumption that you can social engineer your way onto any half way competent institution still persists,but nowadays, as far as I know, you have to pick the _really_ low hanging fruit for someone to let you in so easily.

<comment><USER22> > half way competent institution

At which attackers shift their targets from a bank to a mobile phone provider... :(

<comment><USER23> Obligatory "SMS 2FA needs to stop" comment. Because it does.

<comment><USER22> Additional obligatory "2FA doesn't excuse weak password choices or password reuse."

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Apparently Cloudflare doesn't require a credit card to sign up for the free plan. Not that scammers couldn't figure out how to provide a credit card that wouldn't trace back to them.

<comment><USER25> Why would it require a credit card to sign up for the free plan? To "prevent" scams and abuse?

<comment><USER26> It's a common sales technique. People are willing to give their CC details for a free plan since they are not charging anyway. But by the time your site grows, this takes away the friction of switching to a paid plan. Mailgun does the same.

<comment><USER27> Maybe it's a cultural thing?

I've never come across a situation where anyone would give their CC number for a free service. That gives a _really_ shady impression.

Or expose myself to that risk.

<comment><USER28> Free service that requires a credit card? That is almost always a red flag for me and just screams "scam". Who falls for that?

<comment><USER29> Heroku, HBO, Discord, Amazon Prime, etc all have free trials/plans that require a credit card . . .

<comment><USER27> Not sure what Prime is but I suspect everything you can do requires a purchase anyway? If so that could, perhaps, be reasonable.

Wouldn't ever sign up for any of the others though.

And when a free trial requires a cc that kind of implies that you have to read the fine print very carefully and actively cancel before you get "upgraded".

Doesn't exactly inspire trustworthiness, I'd research competitors closely before considering a company that does that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> This is hard to defend against, but changing the default colour scheme (also used for every window title bar) helps somewhat.

<comment><USER31> A good solution is to force popup windows to open as a tab in the current window, so that the address bar is absolutely always in the same place. This distorts the popup window because it can't change size but that's a small price to pay. I find it annoying that any website should open a new window anyway. I'm not sure if this is possible in Chrome, or if so how to do it, but in Firefox the setting is browser.link.open_newwindow.restriction.

It would also help if Windows had proper contrast between the title bars of active and inactive windows, since then it would be obvious there's a problem from the two simultaneously active top-level windows. The contrast was excellent from at least Windows 3.1 through to Windows XP (colour vs greyscale) but in Windows 7 it dropped dramatically, and it's almost indistinguishable in Windows 10. Microsoft seems to have an endemic problem of redesigning visual styles for the sake of it, even if it makes things worse, presumably to justify the wages of full-time designer staff.

<comment><USER32> If you go to the page, you'll notice that they are not displaying a popup. Instead, they have recreated the entire UI experience, and if you're on Windows the only way to tell that something fishy is going on is if you try to move the window and you'll notice you can't move it outside the bounds of the parent Window.

It's incredibly well done, and I was almost fooled by it when I went to the web site. If I hadn't been using Qubes OS where my dispvm's are using red borders, I probably wouldn't have noticed at all.

<comment><USER31> > they are not displaying a popup

But that's exactly my point! If you have set your browser to make all popups appear as a tab taking up the whole of your existing window (and adding an entry to your tab list), and then a fake one looks like a separate window, then it will stick out as fake immediately. For me, a browser-like window within the boundary of my actual browser is so foreign that I wouldn't even consider the possibility that it's real.

</comment></comment></comment></comment><comment><USER33> Browsers should implement some mechanisms to combat this type of phishing. I've gone ahead and reported this as a phishing site on Google safe browsing and other services.

<comment><USER34> > Browsers should implement some mechanisms to combat this type of phishing.

combatting this doesn't require browsers - you can have a passwordless login mechanism (like email links!).

Or, if browsers do indeed want to combat issues such as these, we'd need support for client-side certs (so you can login using a key-pair!), rather than username/password.

Or, rely in a tool like lastpass to consistently enter the credentials (which, presumably, will check the domain first and if it doesn't match, won't let you put the credentials in).

<comment><USER16> The problem with e-mail links is that if the e-mail inbox gets hacked the hacker now has access to all the user's services.

<comment><USER35> Unlike with passwords, where the attacker has to go to the extra step of clicking "I forgot my password" in order to convert access to the email inbox into access to all the user's services.

</comment></comment></comment></comment><comment><USER28> OAuth and similar technologies are a blessing and a curse. Users are too willing to use one site's login credentials to log into another site, and this willingnessis a phisher's dream come true. This whole class of problems would go away or at least be minimized if there were fewer of these "log in with Facebook" and "log in with your google account" opportunities to exploit.

In this case it looks like the 3rd party service required deep integration with Steam so it was probably unavoidable, but many sites use OAuth as a crutch because they don't want to bother butlding their own sign-in system.

I've stopped using services if they don't provide an option to create a site- specific username and password. Facebook login the only way to sign up for your site? How about no.

</comment><comment><USER36> Doesn't OAuth and similar work by _redirecting_ you to the login page?

I don't recall ever seeing a version that opens a popup to get you to login. This would immediately raise my suspicions on this basis (popup windows can be controlled by the opening website to a large degree!).

<comment><USER37>
      I don't recall ever seeing a version that
      opens a popup to get you to login.

You'll often get a login pop-up if you pay with paypal - they call it the mini-browser in their documentation [1] - and I guess the intention is you don't have to leave the merchant's website in you main browser window.

[1] [https://developer.paypal.com/docs/classic/adaptive- payments/...](https://developer.paypal.com/docs/classic/adaptive- payments/ht_ap-embeddedPayment-curl-etc/#step-4-test-the-html-form-1)

<comment><USER36> I think this was a bad option they offered in the past and now they are stuck with it. Notice the alert at the top of that page:

> Important: Adaptive Payments is now a limited release product. It is > restricted to select partners for approved use cases and should not be used > for new integrations without guidance from PayPal.

In other words, popup loading another website is just wrong and should be avoided by both website makers and their users.

</comment></comment></comment><comment><USER38> > "The whole thing was just a drawn up window inside the phishing website!"

This reminds me the "Phishing Alert Toolbars" section from Ross Anderson's "Security Engineering" book on what he calls a "picture-in-picture website" [0]

[0] [https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c02.pdf](https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c02.pdf)

</comment><comment><USER39> Tangentially related (and an absolutely shameless self-promote): a colleague and I recently described a repeatable approach and methodology (including example) for malware deobfuscation in a recent conference talk. Full narrated video of the talk is here [1], deobfuscation portion is roughly the middle third.

[1] [https://youtu.be/RAtjW7PVGaM](https://youtu.be/RAtjW7PVGaM)

</comment><comment><USER40> They should use user agent to change the style of the fake browser. You can maybe get access to the chrome theme assets also.

</comment><comment><USER41> For what it's worth, I noticed that the login does not load up on IE11 and Edge, although it loads up for Chrome, Firefox, and Opera and will label the fake pop-up window with said browser name.

</comment><comment><USER42> You could open the dev tools in a popup. The device tools detector works by comparing some distances in your browser.

</comment><comment><USER43> Hey, Russian detected in HTML/JS code. Takedown notice has to be issued from skins.cash.

</comment><comment><USER44> This is really interesting, though I can't see it exploited very widely in everyday use.

<comment><USER45> Why? I think the main thing stopping it is safe browsing, which is the same thing stopping all other phishing sites from getting too big.

</comment></comment><comment><USER46> This is why I think WebAuthn can't come soon enough.

</comment><comment><USER47> a phising attemp that emulates a OS window in html is lame and should have been spoted a mile away. real popups open as tabs to begin with.

<comment><USER48> Depends on the browser, but in Firefox and Chrome you can certainly pop a window using a click event. Assuming a JS library was clever enough to simulate the OS-chrome believably it could be easy enough to trick people.</comment></comment>


Show HN: PrettyPrintGmail, Chrome Extension to clean up printing for emails - <AUTHOR> https://chrome.google.com/webstore/detail/pretty-print-gmail/gdanfldekhdgkbmdoeapbgbcpfglkflg

<comment><USER2> I've always been surprised/baffled by the fact that you need to click the print icon in Gmail to get a reasonable print output. Does anyone know why they don't use a print stylesheet or something similar to allow printing straight from the conversation view? Too many of my colleagues print straight from the conversation page resulting in ugly printouts and wasted paper.

<comment><AUTHOR> Same, which is why I made this. It would be nice if I could override the Ctrl + P command while on an email, but I don't think I can, so I went with Alt + P to pretty print.</comment></comment>


Marissa Mayer's Secret Plan for Tumblr Revealed: Make It YouTube - <AUTHOR> http://www.businessinsider.com/marissa-mayers-secret-plan-for-tumblr-2014-10

<comment><USER2> This is a really good idea for Yahoo. I hope that it succeeds so that YouTube isn't too powerful.</comment>


Instagram's First Acquisition Is Video Sharing App Luma - <AUTHOR> http://techcrunch.com/2013/08/23/instagram-acquires-tech-and-team-of-video-sharing-app-luma-which-will-shut-down/

<comment><USER2> ... why is this "Instagram's First Acquisiton" and not "Facebook's Nth Acquisition"?

</comment><comment><USER3> I always wondered why Instagram video had such good stabilization!</comment>


The 6 Minute Pitch - <AUTHOR> http://blog.spanishcurls.com/the-5-to-6-minute-pitch

<comment><AUTHOR> Really curious as if it's missing anything big.</comment>


The Limits of the Earth, Part 1: Problems - <AUTHOR> http://blogs.scientificamerican.com/guest-blog/2013/04/17/the-limits-of-the-earth-part-1-problems/ <comment><USER2> > And the ultimate solution to those problems is innovation ...

I can't believe I'm reading this. How many times does this same fairy tale get to be repeated before someone states the obvious -- there are too many people, our reproduction rate is much too high, and the _only solution_ is population control?

At present growth rates, the world's population doubles every 60 years. For how many doublings of population will someone be able to write a fairy-tale rationalization like the one linked above, before someone finally says (along with Pogo), "We have met the enemy, and he is us":

[http://upload.wikimedia.org/wikipedia/en/4/49/Pogo_- _Earth_D...](http://upload.wikimedia.org/wikipedia/en/4/49/Pogo_- _Earth_Day_1971_poster.jpg)

<comment><AUTHOR> [http://www.ted.com/talks/hans_rosling_on_global_population_g...](http://www.ted.com/talks/hans_rosling_on_global_population_growth.html)</comment></comment>


Our book launch was botched and it's been crazy at work trying to fix it - <AUTHOR> https://m.signalvnoise.com/our-book-launch-was-botched-and-its-been-crazy-at-work-trying-to-fix-it-99b68fb775d5 <comment><USER2> It's easy to crap all over the publisher, but it sounds like there were a lot of opportunities to mitigate these issues throughout the process before they became a problem.

Sold half a million copies of the last book and didn't bat an eye when the publisher mentioned the initial print run is under 20,000 copies? Come on.</comment>


Loongson – The Intel and AMD alternative (LoongBT runs x86 code) - <AUTHOR> https://www.imgtec.com/blog/loongson-mips64-processors-performance-barrier/ <comment><USER2> Loongson contains several hundred "x86 compatibility" instructions to do things like calculate status codes as x86 does or implement x87 80-bit floating point operations.

This means a dynamically recompiling emulator like Qemu can emit short instruction sequences for blocks of x86 instruction, instead of long workarounds to emulate its oddities.

</comment><comment><USER3> you should add (2015)</comment>


Traditional watchmakers turn to smartwatches as Montblanc unveils the e-Strap - <AUTHOR> http://www.theguardian.com/technology/2015/jan/02/watchmakers-smartwatches-montblanc-e-strap-swatch

<comment><USER2> This just makes my brain hurt. The actual cost of the technology involved is significantly less than the selling price.

While brand and marketing adds some value, I fail to see how it adds a 700%+ uptick in price.</comment>


I Had a Caffeine Addiction, So I Quit–This Is What Happened (2018) - <AUTHOR> https://www.mydomaine.com/caffeine-addiction <comment><USER2> > Here's my setup at home: A Rancilio coffee grinder ensures each cup is made > with freshly ground beans, and a top-notch Italian Ascaso espresso machine > pours the perfect espresso shot (with the creamiest crema), not to mention a > frother to create the fluffiest almond milk ever—no sugar needed.

On a tangent, but as Italian I always find funny how fancy the coffee and wine people get _outside_ of Italy. In Italy we drink cheap coffee out of a cheap moca and in the south we buy wine by the liter (from $2 per liter). Yes in Italy we get fancy sometimes but not each day, fancy stuff is supposed to be special, daily routines kill the special factor.

<comment><USER3> That's funny, I don't view daily routines as killing the special factor. I prefer to optimize for quality where ever I can as often as I can, that way I get to enjoy it more often in the short amount of time we have to walk this earth. I'm not knocking the $2 cheap coffee; if it brings you joy, then great! To each is own.

In terms of "addiction to coffee", this optimization for "specialness as often as possible" puts me in a spot where if a place serves bad coffee, I'll just opt for tea or something else that I will enjoy. It reminds me that I drink it because I enjoy how it tastes; not because it amps me up.

</comment></comment><comment><USER4> So, another reason to drop the addiction if you get withdrawal symptoms: If you have to go to the hospital and stay over for a surgery, you won't get caffeine, and only very limited doses of pain medications. The headache was worse than the gallstone pain I went in for.

Anyways, there's your TMI for the day.

</comment><comment><USER5> For me, I feel like caffeine is a constant reminder of how stressful my life is. The day I can forego caffeine is the moment I feel like I've made it in life. But for now, when I sometimes go cold-turkey on it, within days I will have someone reminding me of some business chore that has to be completed. A cup of coffee helps me find the motivation to complete the task.

The same goes for work. Shit hits the fan during the day, and to offset the frustration I drink coffee.

It's the same for past-time. When I start slipping from my workout routine, a fast line of pure caffeine just before I should be going to the gym sets my mind on going to the gym.

And I don't take it lightly -- when the stress from expectations and accumulated responsibilities start appearing at the same time of the year (as they in some wicked way always do) I start piling on caffeine. Once I was even hospitalized.

Years ago in simpler times, I was able to take a week-long vacation in a forest cabin without electricity (or coffee). The first day I did not want to do anything, so I slept 20 hours instead, waking up occasionally for an hour or so before going to sleep again. This continued for the next two days, and the people accompanying me thought I fell sick. On the fourth day, I finally felt like actually doing something. I felt like a lot of the stress and crankiness was gone, and I became more open about helping others again. Yet, at the same time, this is exactly how I end up finding new responsibilities - worthy of the added concentration of caffeine - again.

</comment><comment><USER6> It is by caffeine alone I set my mind in motion. It is by the beans of java that my thoughts acquire speed, my hands acquire shakes, the shakes become a warning. It is by caffeine alone I--I AM IN CONTROL OF MY ADDICTION!!!

</comment><comment><USER7> Switching to green tea for a few weeks before getting fully off of caffeine helped to alleviate headaches for me.

After a year or so of no caffeine, I started working in an office where they have one of those Starbucks machines and the temptation of delicious iced coffee from freshly ground beans was too much for me to withstand so I started back up again. There was no decaff option for iced coffee unfortunately.

</comment><comment><USER8> Despite repeatedly saying that she's given up caffeine, the author has instead dramatically cut her consumption (which is a good idea, but a different thing!). I find the immediately abutting sentences "… now that I'm not drinking caffeine …. While it does have caffeine …" rather bizarre.

> I'll pour myself a green tea, which I probably only have once a week. I > prefer the taste of the traditional toasted rice flavor, and now that I'm > not drinking caffeine, I definitely notice it when I have one of these. > While it does have caffeine, there are other benefits that outweigh the > caffeine content such as being packed with antioxidants to reportedly help > fight inflammation as well as other anti-aging properties like boosting > brain health and lowering your risk of stroke and heart disease.

</comment><comment><USER9> I recently quit coffee and was also surprised to get more energy (after the headache was gone), especially in the late afternoon and evening.

That's really unfortunate since I really enjoy the taste of coffee.

<comment><USER10> You could always switch to decaf!

</comment></comment><comment><USER11> Coffee has no effect on me, or a paradoxal one (I am sleepy). My brother is the same. I wonder if there is some genetic component.

I can go from 6 espresso a day to no coffee for a week, without any effects.

This is fantastic because I like coffee a lot (except some days, and then I do not drink any).

</comment><comment><USER12> I've quit caffeine for extended periods (the longest recent time was over 5 months). I get headaches for a day or two, but the constant fatigue doesn't leave until I start having caffeine again.

I'm done avoiding caffeine. Like waking up early, quitting caffeine may or may not make you feel better or otherwise improve your life; subjective bloviations of the self-absorbed notwithstanding.

</comment><comment><USER13> I have taken breaks from coffee repeatedly over the past two years or so and, at least in my case, the worst of it passes after 48h or so. The two days of headaches are pretty debilitating for me, but I feel like I have a bit more respect, in lack of a better word, for coffee as a psychoactive drug. The whole world is actively hooked on caffeine and we all seem unaware of it.

<comment><USER14> It's not uncommon for me to go without coffee for a few days if I'm traveling or just out of coffee at home, but I've never never experienced caffeine withdrawal symptoms. How many ounces of coffee did you drink daily and for how long? I typically have 2-3 ~8 oz cups per day.

<comment><USER13> Roughly the same, I would say.

</comment></comment></comment><comment><USER15> caffeine addiction is way more intense that i realized it would be. I quit about a year and half ago, the obvious withdrawal lasted i think 9 days. exercise helped with the headaches. I initially had problems sleeping, i dreamed about drinking coffee. I was in a haze and couldn't think straight. caffeine causes so much digestive and body issues, im becoming skeptical of all the claims of how healthy coffee and caffeine are.

Now i just drink socially, for taste, or if i really need an energy boost. Im careful not to drink to many days in a row. Quitting for me wasnt some magical life enchancement, i didn't suddenly get more energy or stop being anxious. It is nice being free from the addiction though, I can just wake up and get going, I don't need to plan my life around drinking a cup.

</comment><comment><USER16> I've been mulling over getting off caffeine (two cups of very strong cold brew per day) to hopefully improve energy levels, and make getting off sleeping pills easier.

Interesting anecdote, but those withdrawal symptoms seem a bit exaggerated for one cup of coffee per day.

</comment><comment><USER17> nice advertisement

</comment><comment><USER18> Interesting that she's drinking dandelion tea now. Grounded dandelion ("cicoria", Italian for chicory) was used as a replacement for coffee during WWII in Italy.

<comment><USER11> It is still common in France, especially as the morning coffee.

</comment></comment><comment><USER19> I drank 3+ espresso's a day for years. Read some books regarding circadian rhythms vs. sleep vs. caffeine vs. adenosine.

Decided to quit coffee. Quit the next day for a year or so. I had zero symptoms like the articles mentions or anything like that. No substantial effect at all.

tl; dr highly suspicious of this article.

<comment><USER8> I think "I didn't have withdrawal symptoms so no-one does" is a bit of a dodgy position. I don't think much of the post (a long post about how she doesn't drink caffeine, which ends with her recommendation for caffeinated green tea), but you need only browse this thread to see that there are people for whom caffeine withdrawal symptoms are real. My own are very mild (just some headaches), but that doesn't mean everyone's are.</comment></comment>


Node.js Ops First with Pandora.js, Today - <AUTHOR> https://github.com/midwayjs/pandora/wiki/Node.js-Ops-First-with-Pandora.js,-Today <comment><AUTHOR> Pandora.js is an application manager dedicated to Node.js applications. The first release is built by Taobao Midway team mostly, and involves contributors all over Alibaba group.

Thanks to the dev productivity brought by Node.js, a few lines of code can make a working web application. And Pandora.js can enable it with the operation capabilities, make it manageable, measurable, traceable and highly available.</comment>


A/B Testing with Jinja2 and Pelican - <AUTHOR> http://mrsenko.com/blog/mr-senko/2016/05/12/ab-testing-with-jinja2-and-pelican/ <comment><USER2> Think this looks great, thanks for sharing, have yourself a wonderful day.</comment>


Ask HN: Hacked website, what should i do? - <AUTHOR> https://roomsurf.com has been hacked couple days ago.
Hackers asked for ransom on their homepage (i forgot to take screenshot)
They fixed everything since then but i am afraid that hackers took 1M+ of user data including mine.
There is no info about hack anywhere on their homepage.
What should i do? I sent email to roomsurf but still no info about this <comment><USER2> I got this email from Roomsurf earlier today:

> Dear Roomsurf Members,

> Student safety has always been our top priority at Roomsurf. I wanted to > notify you that we recently experienced a data breach into certain user > contact information that included names, phone numbers, and email addresses.

> Because your safety is our top priority, Roomsurf does not store your credit > card information, so none of your financial related information has been > taken or compromised.

> Our top priority is taking care of you and helping you feel confident about > using Roomsurf and it is our responsibility to protect your information when > you use our Website.

> Please know we moved as swiftly as we could to address the problem once it > became known and specifically, we have: > 1\. Closed the access point that > the outside users used > 2\. Moved the Roomsurf Website code and databases > onto brand new servers with new security safeguards

> We appreciate your understanding with this matter and apologize for any > inconvenience this may have caused.

> Sincerely,

> Dan Thibodeau > CEO

</comment><comment><USER3> Do you remember what the ransom was/what it said on the homepage? I can't find it in Wayback machine (and others).</comment>


Anil Madhavapeddy: The Functional Innards of Docker for Mac and Windows - <AUTHOR> https://www.youtube.com/watch?v=zqFDEDl5Zes <comment><USER2> Any idea when the source for this will be released? I am curious to see how they do it. I will watch the full video in the meantime.</comment>


Orbits and orbitals (2006) - <AUTHOR> http://www.chemguide.co.uk/atoms/properties/orbitsorbitals.html <comment><USER2> One useful way to think of each year of chem/science study is to assume _it's the last year this student will take the subject_. From that perspective, the student will spend the rest of their life with _this_ mental model.

When viewed like this a mental model of a nucleus with electrons 'orbiting' around it is entirely valid and literally drops the student in the early 20th century.

One of the problems with experts is that they try building a straight line from zero to expert that never needs a backtrack step.

Personally I like the opportunity for students to learn about the experimental evidence that _forces them_ to need a better theory than the one they've come in with. Cognitive dissonance is one of the most powerful forces students have for learning - a good teacher should be engineering these moments as part of their lesson design.

</comment><comment><USER3> These concepts make more sense after one has been exposed to quantum mechanics. One of the first things you do in an intro to quantum mechanics class is calculate the energy levels of a Hydrogen atom (and then Helium.) Chemistry is literally applied quantum mechanics; and everything in quantum mechanics is probabilistic. A more accurate picture of an orbital is that it's an energy level where a cloud of probability mass lives that corresponds to, if one were to take a photograph of the atom, the likelihood of finding an electron in any given location (wave function collapse.) But before a measurement, the electron really was a cloud of probability mass.

<comment><USER4> Chemguide is aimed at A-level students, e.g. 17 year olds: Doing the math is out of the question, sadly.

<comment><USER5> But even before 17 I've learnt with the orbitals diagrams like here:

[https://chem.libretexts.org/Bookshelves/Physical_and_Theoret...](https://chem.libretexts.org/Bookshelves/Physical_and_Theoretical_Chemistry_Textbook_Maps/Supplemental_Modules_\(Physical_and_Theoretical_Chemistry\)/Quantum_Mechanics/09._The_Hydrogen_Atom/Atomic_Theory/Electrons_in_Atoms/Electronic_Orbitals)

Which I still find more informative than the drawings on the original post page.

</comment></comment></comment><comment><USER6> How might one conceive of orbitals with respect to the De Broglie–Bohm theory[+]?

[+] [https://en.wikipedia.org/wiki/De_Broglie%E2%80%93Bohm_theory](https://en.wikipedia.org/wiki/De_Broglie%E2%80%93Bohm_theory)

<comment><USER6> Found this, _The Hydrogen atom in Bohmian Quantum Theory_ [+]

      If the Bohmian interpretation of quantum mechanics is considered in
      the case of the hydrogen atom, it leads to a prediction that "normal"
      quantum mechanics does not make. That is the existence of a distance of
      closest approach of the electron to the proton. This distance of two
      hundred fermi is of the order of the Planck length, a region where the
      "normal" laws of physics are thought to break down. If the probability
      density of finding an electron inside this region could be experimentally
      measured, that would thus be a definite test to differentiate between the
      two interpretations of quantum mechanics.

[+] [https://www.academia.edu/483415/The_Hydrogen_atom_in_Bohmian...](https://www.academia.edu/483415/The_Hydrogen_atom_in_Bohmian_Quantum_Theory)</comment></comment>


A better way to store password hashes? (2012) - <AUTHOR> http://opine.me/a-better-way-to-store-password-hashes/

<comment> ryan-c > To brute force even a single user's password, the attacker would have to > search the entire Hashes table after each iteration.

The attacker can use a bloom filter to avoid this.

<comment><AUTHOR> Interesting, could you give a quick explanation how this could work?

<comment><USER2> Bloom filter:

A quick way to do a probabilistic check of if an element is in a set.

Setup: Take the hash of each element in the set, bitwise-or them together.

Lookup: Take the hash of the element you wish to lookup. If any of the bits that are on in this hash are off in the Bloom filter, you know that the element is not in the set. Otherwise, the element is probably in the set, but could be a false positive.

By choosing the length of the hash and the hash function, you end up with ~10 bits/element for a 95% success rate.

As most of the password hashes will be misses, this is an ideal situation. The only time you actually need to do the slow lookup is when a password is a hit.</comment></comment></comment>


Museum of ZZT - <AUTHOR> https://museumofzzt.com/ <comment><USER2> ZZT had a programming language called "ZZT OOP" and you could write scripts that would be performed by objects in the game. The objects could move around, change shape, and send messages to each other. It was difficult to get them to cooperate—they'd move at different times and fall out of sync—such that you had to add synchronization code to keep them working together. Thinking back on it now, this odd little environment actually taught me some lessons about distributed systems.

<comment><USER3> Have you seen Preposterous Machines? Some lunatic made a Mandelbrot renderer in ZZT-OOP: [https://museumofzzt.com/file/p/prepostm.zip](https://museumofzzt.com/file/p/prepostm.zip)

<comment><USER2> I hadn't seen this, thanks. Lunatic indeed!

</comment></comment></comment><comment><USER4> Anna Anthropy's book about ZZT (and really about the culture of game development that thrived around the game) is very good. [https://bossfightbooks.com/products/zzt-by-anna- anthropy](https://bossfightbooks.com/products/zzt-by-anna-anthropy)

</comment><comment><USER5> I loved ZZT! I can't remember which was first for me, that or QBasic, but I have many fond memories of being 8 years old and hacking away on little games. I think I started with both at about the same time, and they instilled a love of code. The idea that you could just type in a few words and make the computer do what you wanted was pure magic to my young brain.

In hindsight, the limitations of ZZT were very freeing — with such a limited palette of options, you couldn't bite off too much more than you could chew, and you had to get creative to make anything work as intended.

My palette has increased since then, but the principles are still the same. I haven't touched ZZT in years, but in a way my career has been built on it.

</comment><comment><AUTHOR> ZZT was an early example of a game that included a level editor and scripting language. Lots of people say they got their start in development work by modifying games, and their "this is how I got started" stories are interesting to me.

Sometimes on HN you'll find someone involved in the original game, and their stories are usually interesting.

<comment><USER6> And it's IMO a critical piece of game history - ZZT, in part thanks to its level designer, became quite successful and allowed Tim Sweeney to found Epic Megagames, which had a number of successful shareware games afterwards (also thanks to Cliffy B) like Kiloblaster (I remember that one) and Jill of the Jungle, Epic Pinball and Jazz Jackrabbit, until in 1998, a good seven years after ZZT, they made Unreal. And again, part of what made Unreal and later Unreal Tournament popular was its level editor and programming interface - which became available to other game creators in the form of the Unreal Engine, which still is a popular choice a lot of the AAA games of today.

So think again when you hate on emoji :p.

(I wanted to do the ascii smiley face but it doesn't seem to be supported. 2018 everyone).

<comment><USER7> David Newton did a whole video series on the history of Epic Megagames, in fact. [https://www.youtube.com/playlist?list=PL-36gm0W-VKneGghS9-8X...](https://www.youtube.com/playlist?list=PL-36gm0W-VKneGghS9-8XOvOl_m7Zf2IF)

</comment></comment></comment><comment><USER8> First shareware game I bought back in the day. I think I might still have the original 3.5" floppy somewhere in my basement. Played it on my parents Tandy 1000 TX 286.

</comment><comment><USER9> Its fun to look back and remember the original IBM PC ROM character set had a smiley face when "emoji" seems like such a recent development.

</comment><comment><USER10> I misread that as ZTT and was looking forward to seeing something quite different...</comment>


SlideShare's April Fool's Prank: Cruel, Or Just Unusual? - <AUTHOR> http://mashable.com/2009/04/01/slideshare-april-fools/

<comment><USER2> Aside from most people being bad judges of their own sense of humor, it strikes me that many of these jokes land in the subtle-middle-mediocre swamp. If you're going to do one of these pranks, you've got to go to extremes. Way over the top, huge amounts of self-deprecation (witness aspects of Qualcomm's WolfPidgeon bit), etc.

Slideshare's mistake was two zeros. They should have put on an absurd number of zeros, and made the counter go up while the victim watched, by a lot. Maybe break as it passed a bajillion and shatter as the numbers fall off the page. Now it might be that this isn't that funny either, but at least it's pushing hard on people's expectations and a bit absurd. It certainly would have been self-evident as a prank, which is a pretty important component of any April 1 joke that affects you personally.

<comment><USER3> yeah, on kgs, www.gokgs.com an online place to play Go, they changed everyone's rank to 9 Dan. It was funny because it was absurd and fun to see such a high rank next to your name. If they'd just increased everyone's rank by two, I'd have thought they changed their ranking algorithm or something, and been sad later.

</comment></comment><comment><USER4> How could these folks think making their customers look and feel like idiots would benefit their business?

<comment><USER5> I'm not sure why everybody's gotten their panties in a bunch over this. It seems to me that users got free traffic out of the deal, at least the way I see it: If I had gotten the e-mail, I certainly would have tweeted about it, and people who hadn't seen the prank yet would probably have thought it was cool enough to go check out my slideshow. After I realized it was a prank, I probably would have tweeted again, bringing in even more traffic.

Is the argument that it added lots of erroneous Twitter posts? Get over it. You tweet when your eggs are too runny, a single tweet about a slideshow isn't gonna hurt.

Are you saying it makes the people who fell for the prank look stupid and unprofessional? You really think being the butt of a joke on April Fools Day is the end of the world for your public image? It's Twitter, not your company's quarterly report.

I, too, get tired of the endless barrage of April 1 jokes that flood my favorite sites once a year - its a little excessive, and in this case, not even that funny. But those that are calling for SlideShare's head in this situation either have too much time on their hands or need to stop taking themselves so seriously.

<comment><USER6> I did get the email, and I did send the tweet. However, I assumed it was a bug in their traffic counting code.

However, there is a subset of the social web that measures worth with simple numbers (wheter it be # of Twitter followers, FeedBurner subscribers, or SlideShare views). For the people who fell for it and are always talking about their big numbers, I would imagine that this could make them appear foolish, mostly because putting too much stock in those numbers is foolish in the first place.

I think it was a brilliant campaign. We are all talking about SlideShare and #bestofslideshare was a trending topic on twitter. I have a sense that the online slide sharing space is getting more competitive with new services launching, so why not use April 1 to help assert your position as the market leader.

<comment><USER5> This is a good point... As an advertising campaign, it was deviously clever. I would love to see the traffic spike they got from Twitter, and the successive spike from the buzz around the story.

</comment></comment></comment></comment><comment><USER7> There is one problem with this article: the line at the end.

> What do you think of the prank? All in good fun, or did SlideShare cross the > line? Let us know your thoughts in the comments.

This suggests that majority vote rules in situations like this.

But really it should not.

So, for example, if I had slides on SlideShare (I don't), and I had fallen for this, then I'd probably just laugh it off (along with some irritation; April Fools Day pranks stopped being funny around 1980, okay?). However, other people, who might use this for more "serious" things, have been significantly wronged by the SS people. Does my laughing it off make this okay?

I guess it all boils down to two points.

1\. If you are in a situation where people entrust their reputations to you, then you need to take this seriously.

2\. It does not matter in the slightest if 99% of those people think it's okay to do damage to those reputations. Don't.

</comment><comment><USER8> I think this prank was hilarious. People need to stop taking themselves so seriously.

<comment><USER9> Not just hilarious, but truly in the spirit of AFD, unlike most of the lame "pranks" that plague the internet every April 1st. Maybe it was unwise and bad for business or maybe it didn't actually matter, I don't know. But either way, this was a great prank!

<comment><USER10> I agree about the spirit of AFD. In old good days, AFD was always about making fool of somebody else.

</comment></comment></comment><comment><USER11> In summary, egos have been hurt and this has caused much whining.

<comment><USER12> Addendum: SlideShare learns the hard way that the Internet is Serious Business™

<comment><USER8> Well said, both of you :)

</comment></comment></comment><comment><USER13> Thanks to Mashable for bringing some sense in the April Fools stupidity. I like the idea of the day, but if it's not really really funny don't do it. Notably, "company X buys company Y" is dull. Doubly so if X == Google.

<comment><USER14> google buys Morton Salt, salt 2.0 on the way?

<comment><USER15> Another Chicago institution bites the dust. ;_;

</comment></comment></comment><comment><USER16> I was sure Hacker News would get "hacked" for April Fools.

</comment><comment><USER17> slide show hucksters

april fools

egos deflate ;)

</comment><comment><USER18> Not cruel. Not unusual.

Just poor taste spam.</comment>


Ask HN: For those working on more than one site, how do you manage this? - <AUTHOR>

Hi,
let's say you start a couple of sites and suddenly one of them picks up pace and it looks it is really going somewhere.. but then you also have other smaller sites which are also doing well and may lead to something in future after all (you know the slow and steady money earners).
Do you just orphan those and focus all your energy on the winning project (allocating more and more time in marketing and development of the winner)?
what if you have another idea that you think is brilliant/easy to launch? do you just stop making new sites afraid that your time and energy is better spent improving a product which may be on the cusp of being the next big thing? (though you never know for sure!)
anyone want to share their thoughts on this? <comment><USER2> It's important to learn to say no to a lot of things. Opportunities will always present themselves overtime and it's just as important if not more important to learn to say no just as it is to focus on doing a few things well.

Certain sites that are producing passive income at a certain point, I leave them be. If I got something with potential, I focus my time on that.

EDIT: See this, [http://www.youtube.com/watch?v=x7dqG9m9d44&feature=playe...](http://www.youtube.com/watch?v=x7dqG9m9d44&feature=player_embedded#t=114s)

<comment><AUTHOR> Thanks for the advice and an awesome video. It definitely helps clear my mind. Have been torn about this for a long time now.

The situation also gets complicated when one of the sites you're very passionate about (in terms of technology not money) is the runt of the litter, while a b2b site does 10x better business but isn't that mentally stimulating.

</comment></comment><comment><USER3> It's a good problem to have. :)

Having multiple projects that pick up and start competing for your time is much better than the more likely outcome that none of them takes off.

If you start to have too many successful websites that you feel overwhelmed, feel free to give a couple to me.

(I'm only partly joking here. You could use a service like Flippa.com to sell your websites if you start feeling like you're not the best person to be maintaining them.)</comment>


Ask HN: What should I do to prepare for a meeting about my annual raise? - <AUTHOR> I've been at my current job for one year. My work-iversary is coming up and we're meeting to talk about giving me a raise. How can I come up with what is a fair raise? <comment><USER2> It has probably already been decided. You can articulate what you think is a fair raise for next cycle.

You're getting some silly advice here that will make you seem a bit cocky at best, delusional at worst (do not produce a promotional packet for yourself). This is what happens: the company defines a budget, the budget is allocated across teams based on risks/prior success. The budget defines the pool of salary adjustments and that is the anchor. You can influence your share of that pool in this conversation, at best.

If you want to get your manager to the right frame of mind, have this structure of conversation: first, if you are dissatisfied with your salary, say it. This is not a bluff, you have to be dissatisfied and have options elsewhere. Know what the pay at those options are, and be prepared to get bad news (either they don't think you are worth that, or cannot match it). If you are looking for incremental adjustments, know that COLAs are usually 2-3%, promotions are usually 5-10%, and merit is somewhere in the middle. Think about what you've done in the past year that has a lot of business value (if you did analytics that saved money or increased sales, or did important work on a product that won/retained customers). If you've shown professional development (leading a project, mentoring new team members) or improved the efficiency of an existing process (lower cloud costs, shorter duration) mention it and try to get a read if your manager remembers them and/or agrees. Since this is a form of negotiation be prepared to talk about how you want to build on last year's achievements/progress next year, and ask what you can work on that would help you achieve your salary/growth goals and help the team (what return your manager can expect from the increased investment in you).

<comment><USER3> The ridiculously low yearly raises, regardless of performance, are why I became a freelancer.

</comment></comment><comment><USER4> 1\. Data points. Data points. Data points. Go through and document, line by line, what you have done this year. Translate each line item into approximate value created for the company, whether in dollars or resources freed up. Chances are your manager will need to get any bump or promotion cleared with the powers above him, so make it easy by providing as much data as possible.

2\. Make a sort of mental script that goes over the data points from item 1 and why all those make you worth what you are seeking. Practice it. Not only will it help you articulate your ideas more clearly, it will also help calm you down a bit. Salary discussions and negotiations can be intimidating.

3\. Have a vision for what you can continue to add to the company, after you have received the raise/promotion you are seeking. Is there a specific project you can lead, team members you can mentor, etc. Demonstrate that you have a vision for yourself in the future at the company, to go with (hopefully) a strong list of achievements that have already added value.

<comment><USER5> > Translate each line item into approximate value created for the company,

How you do value things in the following cases 1) are opinion (eg Fixed a bug, or 300) or 2) things that have no direct value (wrote a microservice that supports a microservice that alerts users if a microservice is neither micro or servicing) or 3) You delivered exactly what was asked of you, FeatureX say, but FeatureX was poorly researched/designed and received no traction?

Nonetheless I will try to do as you've suggested, I see a lot of value in being able to deliver what you're pointing at.

<comment><USER6> Try to value the results of your work, not the work itself.

1\. If you fixed a bug, what problem did it solve? Was it costing the company money or time? Your customers? Be a _partner_ to the business, not a code- monkey.

2\. Fixing a line of code has no value (gasp!) in a vacuum. What happens if that microservice uptime alert _doesn 't_ go out? How did your work prevent THAT from happening?

3\. You delivered _exactly_ what you asked for. Full stop. You executed (well, presumably) and worked with the business to build to address an opportunity. Not all opportunities pan out but all opportunities go to waste if not acted upon.

</comment></comment></comment><comment><USER7> Why would you want to be paid fairly? Aim to get paid what you want - not what some group of people decide is "fair". If you don't get what you want, that's not the end of the world, just gives you goals to strive for.

<comment><USER8> This is good advice.

Also, never let people who pay you tell you what is fair. You only talk about what you think you're worth, and what they are willing to pay -- if there's overlap then great, otherwise no cigar.

And final point to OP of thread

> How can I come up with what is a fair raise?

You search inside your soul and find a number that below which you'll feel bad (resentful/undervalued/cheated/etc) and above which you'll feel good (well- compensated/proud/valued/etc). That is the number you aim for

<comment><USER9> This sounds like good advice, but lost its luster once I thought about it for a bit. Given that it's a market, people's worth is constantly changing, sometimes dramatically so, and you should largely try to get as much as you can.

But yeah you should also consider both party's BATNA when deciding how hard to push.

<comment><USER8> It's a market, but I don't think we're at a point yet where we're a commodity that is line replacable. There's no fair running daily auction on standard- issue developer/tech talent. Everyone has backgrounds and specialties that are so unique you can't really make apples-to-apples comparison.

</comment></comment></comment></comment><comment><USER10> For your next annual raise, I suggest the following: start a work journal and make entries in it daily. Log the things you've done, the things you're waiting for (blocked on), the meetings you've had and how long they took. Use this as a guide to read from during your standups, if you have them.

At the end of the week, look through the previous week's entries and conduct a review [1]. Create a separate entry in a weekly log detailing the accomplishments, things to improve, things that went well, etc.

You can keep rolling these up if you prefer (monthly, quarterly, etc.), but I've found ~50 weekly logs pretty skimmable in the time leading up to a review. Keep in mind that the more rollups you do, the more work it will be, and the more likely you will be to stop logging altogether.

While you may be able to capture some big accomplishments with an end-of-year brain dump, your weekly logs will expose the more subtle things: conflicts encountered, how you moved obstacles out of your way, the people you worked closely with, etc. Addressing these things in your review alongside your "hard" accomplishments will make for a stronger argument in your manager's eyes.

[1] Cal Newport, in "Deep Work" ([http://calnewport.com/books/deep- work/](http://calnewport.com/books/deep-work/)), has a good section on doing a weekly review as a means to increase the amount of deep work in your working day.

</comment><comment><USER11> You should understand in advance the way the company does raises. Typically youll have a (usually guaranteed) COLA which is small. From there salary is tied to peformance and responsibilities. Your manager should have already shared this with you and ideally youve been working towards making progress.

If none of those things are in place then like other posts suggest, perhaps get a backstop and negotiate with other companies. Just remember the difference in salary might not make up for all other benefits. Just be honest with yourself about what you want / need.

</comment><comment><USER12> Don't make it personal. This is a business transaction. So don't think or talk about it in terms of what you want or what you think you need or what you think is fair. That's going to lose the negotiation.

Find jobs that are similar to what you actually do (not necessarily the same title or description) and get salary information about them. Pick a number that's in the range of what you can find and go with that.

The conversation from there is simple: this is what I'm actually doing, and this is what the market pays for it. That number will either be in your boss's budget or it won't. If it is, the conversation shouldn't be difficult for either one of you. If it isn't, you can negotiate for things that might be available but not counted towards budget. Extra paid vacation, ability to expense some things, etc.

If it's just not in the budget, though, you've accomplished a couple of things by keeping it a business transaction. 1. You've put your boss on notice that you know what the market value is for your skills and you've done it without having to play any mind games or go get some other offer to try and negotiate that. And 2. You've just done some of your boss's job for him/her. You've just given data they can use at the next budget meeting so say, "Yeah, this position is getting x amount from everywhere else. We need to match." 3\. You've proven that you have an adult understanding of how these things work, which will be very much appreciated.

If you let the conversation go personal based on what you feel like you want or need, this is a risky move, whether it's an initial salary negotiation or an incremental. If you say you need this or were hoping for that and the company can't match, you're a flight risk. You have very probably just priced yourself out of a job.

Keep it business, appeal to market data, and play your personal feeling close to your vest and you can negotiate for as much as you want without painting yourself into a corner.

</comment><comment><USER13> Check out this site - good starting point: [https://fearlesssalarynegotiation.com/book/](https://fearlesssalarynegotiation.com/book/)

<comment><USER14> Specifically, check out Chapters 1 & 2 (they're pretty short) to get a sense of how companies decide what to pay you and then jump to Chapter 7 for specific steps to take as you prep for your meeting.

(Thanks for the pointer @f_allwein, I appreciate it!)

</comment></comment><comment><USER15> Working hard, being punctual, never calling in sick, being respectful are all things a company is already paying you for. I know shocking. These are not qualities for raises, they are expected of you. What matters is your impact to the company and helping them make money. Build your talking points around the value you add to the company and it reaching its goal (make money). Also keep in mind, salary is only one point in compensation. Things like more vacation time, better benefits, pension/401K contributions, stock options, educational funds, having them pay for an annual conference(s) you want to attend. But much of this depends on the company you are working for.

<comment><USER16> I agree with all the other points in your first sentence, but your company should not expect you to never call in sick. You get sick days for a reason.

<comment><USER17> The only thing worse than an employee calling in sick is an employee not calling in sick when they are sick. Nothing good is going to come of doing a half assed job and infecting the rest of the office.

<comment><USER15> I'm not advocating no sicks days. They are a good thing and the last thing I want is a sick person coming into the office and infecting others. The point I was making is that "ideally" this is what is expected.

</comment></comment></comment></comment><comment><USER18> _" I really like working here. I really want to keep working here. And I think I've proven that I'm a very valuable member of the team. But to continue being happy working here I need to receive a raise of $n. Otherwise I'm going to feel like I'm not being fair to the financial future of myself and/or my family."_

Being direct and firm is really the only way. The threat of quitting is probably better implied than made directly. It feels less like a harsh ultimatum which might trigger a defensive response. You want them to understand that you're not upset at anyone, you're just doing what's best for yourself and/or your family.

But it's important to realize that it's usually hard to get a significant raise without changing jobs. Most companies have a very hard time doing this even when it's entirely warranted.

</comment><comment><USER19> All of these answers are right and wrong. It depends on the company and how things are structured. I manage about 90 people in an environment where the main lever for compensation upgrade is promotion. About 5-10% can get promoted in a given year. IMO, 30% deserve more. You may be a superstar, but go unrecognized (in dollar form) because I have a position in a different title series or tied to a project.

You need to have a clue about how decisions are made and where discretion lies. In some places, you'll be assigned numerical ratings and HR pukes out a number. In other cases, a manager/director has discretion, in others you get a 2% raise for breathing for another year.

In all scenarios, you need to be able to confidently talk about the value you bring today and tomorrow. The hardest part is knowing who to tell the story too.

</comment><comment><USER20> Find another job first so you can ask for a reasonable pay rise and play it hard if needed.

</comment><comment><USER21> Well, you can put together a promo packet. Collect all your best design docs, pull requests, list out the feature you shipped, the people you mentored, the opportunities you won the company, the money you saved the company, feedback from your peers and managers, etc..

Although I agree with jaequery, if you really want a raise the sure fire way is to get another job offer and have your current company match or take the other offer. The biggest raise I've gotten at a company without that is $10k, but changing jobs can gain you much more.

</comment><comment><USER22> Ideally, go and interview at other companies, get an idea of the market, you may even unintentionally find something you're interested in.

</comment><comment><USER23> Ask for more responsibility. Put your manager on the spot and get them to tell you how you can take the next step in your career. But you need to be ready to actually do it. Just asking for more than a cost-of-living bump for no particular reason is not likely to get you much unless you are underpaid significantly (from HR's perspective) for the position you are in.

</comment><comment><USER8> 1\. Have you defined your value statement? What qualities you bring to the table, and what you have developed over the previous year that make you more impactful and invaluable at your current company. That is your starting point for discussing a raise.

2\. Determine what would make you feel good (i.e., a what salary increase would make you feel short changed and resentful, and what would make you feel good and valued and fairly compensated). Take that number and use that as your baseline.

If what comes in is under that threshold (at which you feel fairly compensated), you can discuss the raise again with the manager and how you feel it doesn't reflect your increased value. If this does not bring your salary to the lower end of your fair-compensation threshold, it's time to look for a new job. Otherwise, unless you're able to not let it bother you too much (I can't do this), resentment builds and it's best to look for an exit.

<comment><USER24> > Have you defined your value statement?

I suppose this is good advice, but boy oh boy does it make me want to live in a cabin in the woods as far away from the corporate world as possible.

<comment><USER25> Explaining how your skill-set matchs with the paradigm currently in place to advance the corporate mission statement should net you a couple thousand while making a little piece of your soul die.

<comment><USER8> Not really. If you have a life and meaningful relationships and purpose, this is but a little hack to increase your long term earnings to make that life a bit more comfortable.

</comment></comment></comment></comment><comment><USER26> Usually an engineer in large company doesn't need to prove their work had business impact, only that they did what was asked and did it well. But if you can identify the work that you've done that did have positive business impact, talk only about that.

</comment><comment><USER27> I don't ever recall asking for a raise except once where there was an agreement to raise me to market in 6 months if things worked out (or I would go).

You can bust your hump for a 3% bump or just go work for someone who does value you and get some multiple of that. I called it "giving myself a raise".

As the sales guys like to say: "Your W2 is your review."

I suppose if you wanted to be proactive, let your manger know that no raise or a very small one is sending the message that you have no future with the company. It's not a threat, it's just business.

</comment><comment><USER28> How is your relationship / communication with your boss (assuming he has some input on the decision)?

Lots of good posts here but I find a good relationship with your boss and co- workers can be big factors.

</comment><comment><USER29> Nothing gets you a good raise like having an offer for another job.

</comment><comment><USER30> The problem with asking for a raise is it usually needs to be approved by a separate HR/payroll department. I can't even really think of a time where someone that I know got a sizable raise without either taking on more responsibility (ie: promotion) or using an offer as leverage. The sad reality is most companies would rather waste thousands of dollars recruiting, hiring, and training new employees instead of giving that money to the employee they are replacing.

</comment><comment><USER31> its really not rocket science.

before asking for a raise, always apply to other jobs and have something to leverage off of by looking around and applying to other companies. name your price higher than what you are getting now.

if they accept your offer, you can now go back to your company and name a price in a take it or leave it situation.

if they accept, great. if not, atleast you now have other alternatives to fall back on.

<comment><USER23> I recommend against getting job offers as a method of forcing your current employer to pay you more. If it works, then you just became a liability and at the next convenient opportunity you will be first out the door.

Go find a new job when you're ready to leave, then leave.

<comment><USER32> This is bad advice that gets repeated a lot. Employers will work to retain good people and they know that good people understand how a labor market works.

Managers aren't going through the hassle of making a case to raise/promote you only to dump you later. That would make them look pretty bad to their managers.

<comment><USER23> Managers talk to each other. Your manager talks to his boss and says "really can't afford to lose this guy right now, so we need to give him enough to keep him." So he's making a case alright, but everyone in the chain knows _why_

Problem is, now they know you're thinking of leaving. Since most of the time people do not leave over a few dollars, they assume, most likely correctly, that something else is pushing you to leave and the money is just delaying the inevitable.

When you do that to your manager, it demonstrates to him that he has a business risk which needs mitigating. So he keeps you for now while he tries to get someone else in a position to take over for you should you go through with your original plan to leave.

I've spent decades in the corporate world and I can't recall a single time that a forced raise like this ended up with either side happy, and nearly 100% of the time one year later the employee is gone for one reason or another.

<comment><USER31> I don't know how you come to that conclusion.

How would the manager or anyone else know that he is leaving?

He is just simply asking for a "raise". He is not going around telling everyone, hey "i am leaving, give me a raise or i am gone". Now that would be plain silly, lol.

As I said, you look around to leverage yourself so that you know how much you are worth in the market. Lot of devs out there, working at companies for over 5+ years tend to underestimate how much they are worth, and they become a bargain for the company. They are simply too shy to ask for just how much they are worth and companies usually don't give raises to employees (besides the annual small pct increase) unless asked upon.

<comment><USER23> > He is not going around telling everyone, hey "i am leaving, give me a raise > or i am gone". Now that would be plain silly, lol.

I think you are misreading what we are talking about on this tangent. Forcing a raise by threatening to leave for a more lucrative job is exactly what we are talking about, and I suggested that it is not a great strategy.

</comment></comment></comment></comment></comment></comment><comment><USER33> Read a few books on salary negotiation.

Try Negotiating Your Salary by Jack Chapman.

Fakespot says that Fearless Salary Negotiation by Doody is loaded with fake amazon reviews, so I might give that one a miss.

And, read "Never Split the Difference" by Voss.

<comment><USER14> I had never seen Fakespot - that's... interesting. I appreciate you mentioning it. I need to see why it thinks those Amazon reviews are fake.

The good news is you don't have to buy it on Amazon to read it - there's a link to the online version of Fearless Salary Negotiation in another comment on this post - so you can read it for free and see what you think :)

\---

Another response to your comment says that salary negotiation is different than asking for a raise - I totally agree. I treat them as separate things that require unique processes.

</comment></comment><comment><USER34> Just straight up tell them you want more money and if they say no then leave.

</comment><comment><USER35> Nothing. You have no bargaining power since you already work there and depend on your job for your livelihood. If you want more than your 0-2.5% raise then just go find another job.

<comment><USER27> This is 100% effective advice. You may not _like_ it or want to leave a job you like, but is the only _sure fire_ way to get paid your worth. Business "systems"[1] are desighed to keep you from getting paid market. These systems are so rigid that they would actually rather hire some else to replace you at great expense, than make an exception for the individual. The way to "hack" the system is to get a new job - the new place has no choice but to pay market rate if they want to hire you.

[1] examples

"Sorry, 5% is the max raise per year."

"I'm sorry, you should feel good getting 6%, most everyone got less but we really value you."

"Make the project successful and you'll be rewarded." (Hint, _somebody_ will be rewarded for the late nights and weekends, but it won't be you.)

</comment></comment><comment><USER36> Awkwardness is okay</comment>


What are successful startups that raised a seed round from family and friends? - <AUTHOR> <comment><USER2> HYPR Corp just raised $3M in VC and apparently have some large enterprise customers. Their first round of $800k was entirely friends and family.</comment>


Disinformation Strategies and Tactics - <AUTHOR> https://schmud.de/posts/2020-05-29-disinformation-strategies.html <comment><USER2> Sadly I didn't learn any strategies or tactics from this article.</comment>


Ask HN: Is there a repository of failed startups (re-usable startups idea)? - <AUTHOR> I was wandering if someone keeps records of failed tech/internet startups and their codebase?
Maybe it's not a bad idea to go back and re-use some of the failed startups whether it's a codebase or just a business model. I found a lot of reason for failed startups but not many use cases - mostly scattered around the Internet.
If someone would built such a database would you contribute your failed business model and codebase? <comment><USER3> I wrote a book that describes ~150 venture-backed internet startups that failed in the late 90's.

Many of them had significant users and revenue, but were mismanaged and failed.

I've often thought many of them could be successful today.

"F'd Companies: Spectacular Dot-com Startups" <http://www.amazon.com/gp/aw/d/0743228626>

<comment><USER4> There were many gems hidden in the rough on your original website. Whatever happened to the db of posts?

It was practically a catalog of pathological behaviors during a company's end.

<comment><USER3> I still have the database somewhere. Those days are behind me though so I probably won't put it online.

The best ones really are in the book though.

</comment></comment></comment><comment><USER5> I own TheSunsetList.com domain and was planning on using it for this exact purpose. To catalog what has been tried, what mistakes have been made so that they're not made over and over.

If you guy(s) want to, we can team up and colaborate on this and make it happen. Yes crunchbase exists but it describes only the biggest failures and doesn't go into much detail as to why they fell and shut down.

<comment><USER6> Well tbh, the question is really how would you go on about knowing about failed startups. Especially not the big ones, since typically no one covers a failed startup that no one has heard about and they just go out without even a puddle in the water.

<comment><USER5> I figured a few of us here would start by pitching in our own stories, giving numbers, time spent, money lost, the nitty gritty details and in time when others see how valuable that information is they'll feel comfortable enough to share their stories too, adding on to the list. I mean entrepreneurship is all about failure. For anyone to NOT want to talk about it is to reject the fact that it's our failures that lead to successes. And there's plenty of entrepreneurs on HN and plenty of failures. Definitely enough to put together a few stories.

</comment></comment></comment><comment><AUTHOR> I was thinking about a database where (co-)founders would enter the data - <USER2> drop-down menus, where possible, for data mining. Something like:

        1. Here is what I was trying to build
        2. Here is the source code (link to GitHub?)
        3. Here is a screenshot
        4. Here is how I wanted to make money
        5. Here are my competitors
        6. Here is how much I raised money
        7. Here are top 5 reasons why I failed
        8. ???

Yes, CrunchBase has some of the above and, yes, some founders will put it on their blog. But wouldn't be it so much nicer to have a _centralized_ database that could spit out some _analitycs/trends_ and give guidance to newcomers? The volume of startups will grow. What if some failures are seasonal or can be pick-up and fixed? I think we have a chance for a data driven approach but only if _founders_ are willing to contribute.

EDIT: I suspected that CrunchBase will have some errors and missing info since ANYONE can edit those entries. Maybe there was NO way to have founders enter such data ...

</comment><comment><USER7> There's a _deadpooled_ tag on Crunchbase:

<http://www.crunchbase.com/companies?q=deadpooled>

</comment><comment><USER8> Not sure about a dedicated site, but an entity like YC or TC would be a very good fit for tracking this sort of info, because it is directly related to what they do.

I could contribute a couple of entries, both of which are highly recyclable and I was actually waiting for a way to let other people have a go at them.

</comment><comment><USER9> Here's a compilation of 32 startup failure post-mortems which means 32 biz models to take a look at.

<http://www.chubbybrain.com/blog/startup-failure-post-mortem/>

<comment><USER10> Submitted:

<http://news.ycombinator.com/item?id=3438716>

</comment></comment><comment><USER11> There was an awesome site during the early 2000's dot com crash called fuckedcompany.com - the company I worked for at the time was listed ("SmartWORLD" - it went bust on sept 12, 2001). The fuckedcompany.com site is now inactive, but you can check out the list of snapshots on the wayback machine here ...

[http://wayback.archive.org/web/20010101000000*/http:////////...](http://wayback.archive.org/web/20010101000000*/http:////////fuckedcompany.com)

<=== this is all the 2001 snapshots ... note lots of activity in the last 3 months of the year.

Here's the home page from Nov 30, 2001 for example. [http://web.archive.org/web/20011130073049/http://www.fuckedc...](http://web.archive.org/web/20011130073049/http://www.fuckedcompany.com/)

The archive link on the home page works ok for some more write ups.

</comment><comment><USER12> Better angle: compile a list of companies that have been acquired by goog/msft/fbook and so on.

Luckily wikipedia has done the work for you:

<http://en.wikipedia.org/wiki/List_of_acquisitions_by_Google> [http://en.wikipedia.org/wiki/List_of_acquisitions_by_Microso...](http://en.wikipedia.org/wiki/List_of_acquisitions_by_Microsoft) <http://en.wikipedia.org/wiki/List_of_acquisitions_by_Oracle>

And so on.

</comment><comment><USER13> You might have trouble getting the codebase. I was employee #2 at a startup that shut down after about 1.5 years, and at the end we sold off _everything_.

I don't specifically know what happened to the source code but last I heard there were companies interested in it. Nobody that was going to do exactly what we were trying to do, but companies who could make use of a decent codebase if they could get it on the cheap. They would have gotten a few years of work for significantly less money (and time) than it'd cost them to build it themselves.

<comment><USER6> Do you know the process they went about in selling everything? I'm in a startup and we may be thinking of this too, perhaps approaching competitors. But still unsure about it.

<comment><USER13> For all the physical pieces of the company, I know he sent an email to the local tech-startup mailing list, at least. There's a pretty solid startup community here. For the digital assets, I really don't know, sorry. I assume it would be similar to seeking acquisition offers, but I'm definitely no expert.

</comment></comment></comment><comment><USER14> Good question. And it could lead to the possibility to resurrect a site: in code, in name or in users.

I would crosscheck crunchbase against the underlying domains, and not rely on the deadpool tag. Also, check the site stats the profiles show.

Take livekick for example: <http://www.crunchbase.com/company/livekick> <http://livekick.com/>

You could also look at tweet activity: last to and last from. (and last blog post)

You could call the site Life Support.

</comment><comment><USER15> I'd be very careful about trying to "resurrect" failed start-up ideas like this.

Unless you're one of _very_ few people, you can't effectively solve a problem you don't have personally. If you try and things start to look like they're working, someone who actually has the problem and knows all the details can pop up and wipe you out.

Also, the reasons why start-ups fail are not always obvious. In many cases, what appears to be a good idea really isn't for reasons that only the prior founders understand. Without exact knowledge of the past, you're very likely to fall into the same trap that killed the previous start-up.

<comment><USER14> I suppose there are two workarounds for this:

1) ex-founders can aim to work or advise for any take-2 startup: the site helps them do that

2) reasons for failure are placed on the site, and possible solutions

</comment></comment><comment><USER16> If I were you I would be more interested in companies that were started, got some traction and sold out for low double digit millions only to be shut down by their acquirer.

Fflick, for example, was a really interesting idea and seemed to be getting some play - now it's gone. Dodgeball -> Foursquare, etc.

Edit: Whoops - I didn't read the OP closely. I thought you were only looking for ideas/ business models, but obviously this would not work for codebases.

</comment><comment><USER17> I am working on something that addresses this need exactly. Should have a product out very shortly, been working on it for a few months now as a side project.

<comment><USER18> Can you PM the OP and the other interested people? It would be great if we could pool our resources and make this happen.

<comment><USER19> I wondered a bit. "Can you post meridiem the OP"? "Can you Prime minister the OP"?

Oh, I got it: "Can you personal message the OP" (which lacks a verb).

</comment></comment></comment><comment><USER20> For mobile apps, keep an eye out for Apptopia (<http://apptopia.com/>)

</comment><comment><USER21> It would be nice if there was a site built ontop of CrunchBase to document failures, reasons & any other insight.

</comment><comment><USER22> <http://www.crunchbase.com/company/reddit> ?

<comment><USER23> Launched in 2005, deadpooled on August 9, 1973 :O

<comment><USER24> Am I missing the inside joke on this?

<comment> mkr-hn It looks like someone edited the exit year for Reddit to 1973.

</comment></comment></comment></comment><comment><USER25> You're probably better off going after proven, successful ideas than failed ones. Friendster, MySpace, TiVo, Palm pilot, Blackberry, Alta vista, were all up and dominated their markets when a new competitor took over.

The value is more in the execution than the idea.

</comment><comment><USER26> FuckedCompany.com was the place to be. Also the chapter on the dotcom bubble in A Random Walk Down Wallstreet has a nice selection ;-)

</comment><comment><USER27> try crunchbase? I know the German equivalent of crunchbase has a list of "failed" startups as well.

</comment><comment><USER28> Sounds like a decent start-up idea</comment>