Ask HN: Please review my startup: TheSunnyTrail - <AUTHOR>

Hello guys & girls, we are looking for a helping hand from the HN community (especially from people that run web apps that use the SaaS model)
We enable founders / CEOs to easily to track the financial performance of their web apps in order to make better business & product decisions.
Here's how it works: Companies can use our API to send us transactions (signups, payments, upgrades, downgrades, cancellations) occurring in their webapp. Our web interface then allows them to keep track of metrics such as churn, customer lifetime value and others.
We'd love to explore whether this is something that might be helpful to you and hear your feedback.
You can check out the product over here: http://www.thesunnytrail.com <comment><USER2> Nice site design. It's certainly unique and you stand apart from the crowd.

I just registered an account and I'm playing with it right now. I really, really like the getting started flow after the registration page. Just pick your programming language, then you're presented with the methods for installing the API wrappers, then you get your API key and help on making calls, handling errors, etc. I'm not left in the dark on how to proceed -- I'm shown what to do next.

The API wrapper for Python looks simple and easy to use. I could easily see myself using this for my next Web app.

For some reason on <https://www.thesunnytrail.com/start>, while logged-in, I am unable to click on the Stream, Overview, or Plans links below the logo. Also, there is no page title.

The settings page is dead-simple -- I like that.

Without being able to click on those other links that's all I could test so far. However, so far so good! Good luck, I think this has a lot of potential.

Edit: Played with the demo account. The dashboard looks good. I really like the stream feature. I think that's something I'd have open in a browser tab, going back to it every 10 minutes or so to refresh the page and see if anything has happened. It definitely appeals to the "stats update addict" in me.

<comment><USER3> I rarely comment on these threads, but I had a quick look at yours and I like it a lot. It's fresh, nicely designed (although some of it could be a little "tighter" perhaps although I'd struggle to quantify that). I also think it fulfills a useful niche. I think it's going to live or die by the price points to some degree - companies who can afford X probably already have the capabilities of visualising this data, where X is the problematic point, if that makes sense.

But I think there's a niche there. It's certainly something I'd consider using if a project had this requirement.

Only one design point I'm not so keen on - the cutting off of the descender on the "y" of sunny trail on internal pages - it just feels a little jarring to my eye. Fairly minor quibble though - nice project!

</comment></comment><comment><USER4> Clickable: <http://www.thesunnytrail.com>

</comment><comment><USER5> Hello there,

First of all, the overall design is beautiful, bright and esthetically pleasing. I enjoy the use of the bright colors and vector graphics to make the home page more appealing.

Although I do think that there should be more information on the home page. Probably a tabbed format or a simple slideshow to display the main features of the application. I understand you are aiming for simplicity but I personally enjoy a more feature filled application.

When visitors access the "Features" page, you can add a more detailed description explaining how the application works. Maybe a step by step process to setting up the API.

The "Pricing" page is great, simple and answers the most common questions users might have.

The "Developers" page is also very instructive. Although as a PHP developer, I would like to be able to access a wrapper example or a step by step tutorial explaining the process. Maybe a tutorial to match the Demo Dashboard setup.

For the link to the blog, I would have liked to see a dedicated blog for thesunnytrail.com. Seems unprofessional. Could be a simple Wordpress installation with a matching theme. You could even use a simpler platform such as Posterous and create a matching theme.

I enjoyed the simple and straightforward "Dashboard", but the sidebar seems empty. Maybe add additional submenu items horizontally under the main tab bar.The interactive jQuery charts are a must.

Overall, I think this is a fantastic idea and a fantastic application. Great job. I think it will be very popular for any web startup. Good luck!

<comment><AUTHOR> Thanks for taking the time to share your feedback Karl!

</comment></comment><comment><USER6> UI comments:

\- Separate the primary call-to-action from everything else. On your homepage, the bright orange call-to-action is competing for attention. Perhaps things can be rearranged such that the primary call-to-action is in the direct reading path of the user. Also, I strongly recommend de-emphasizing/gray- scaling other links/logos (for example, the green link, "Check out the Sunnytrail dashboard", is the first action I saw).

\- Play up the video a bit more. Make the video placeholder smaller, then place it where the "green hills" are now (the hills take up too much space, for very little value added).

\- Tighten up your "tag line". What are the revenue metrics? Be specific and concise when presenting the purpose/value of your product. A useful formula: 3-7 (basically, keep it short) words to grab the user, then one supporting sentence below.

I think messaging will be your best advantage here. If you can communicate clearly and concisely exactly what you are doing and how you make it EASY to do, then you may find yourself better off.

PS: to be honest, I actually don't know what I can do with these metrics. I need to be sold.

<comment><AUTHOR> thanks for sharing your feedback!

</comment></comment><comment><USER7> I absolutely love the idea and the look/feel of this app. When I first heard about it I thought... this is what I've been looking for.. an easy way to auto capture and generate all these important metrics!

So I got started immediately with integrating it into TweetSaver. Unfortunately, I ran into a show stopper pretty quick.

When passing a signup event, they require you to send a unique username. This was a major bummer since for the free level of my app, users are not required to give an email address and in general emails may not be unique to a user in the system. This essentially renders sunnytrail unusable for me.

The best part though is that co-founder Octav is always in the live chat on the site, so I explained my situation and he said they would take a look to see if there is a better solution. I'm anxious to see if they can make some changes that will allow me to use their service!

<comment><USER8> Hi Brad! I'm glad you like Sunnytrail. Your problem can be easily solved. I suppose that you are generating for each users some sort of unique ID. My advice is to use that to generate an username (if not already available) and a dummy email address. You should be able to update those later when that customer upgrades to a paid plan. TweetSaver looks great! Get back to us on email if you've got more questions.

<comment><USER7> that feels pretty hacky to be honest.

the real issue is that one person may have multiple accounts in the app, and they may want to use the same email address for all accounts... I have no reason to enforce a unique email address.

It's odd that Sunnytrail would when there is usually a common unique identifier across all apps for users.. user id

<comment><USER8> Sunnytrail does not enforce an unique email address or an unique username. We are tracking users based on the supplied internal user ID (or an email address hash if an internal user ID is not provided).

<comment><USER7> hmm, I'm pretty sure that's what Octav had told me in chat.. either way you require an email address...

        RuntimeError: The request is invalid: {"message": "invalid JSON message", "errors": [["", "A valid email address is mandatory"]]}

<comment><USER8> required but not unique. just generate a dummy one based on the user id.

<comment><USER7> so just really curious.. what's the reasoning behind requiring it?

<comment><USER8> we are planning to add some features that depend on that email address (some sort of advanced client profile)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Looks like an implementation of some of the ideas in this article - [http://thinkvitamin.com/business/how-to-track-six-key- metric...](http://thinkvitamin.com/business/how-to-track-six-key-metrics-for- your-web-app/) . Will definitely give your application a look when I create my own SaaS application.

<comment><USER8> Exactly and that's just the beginning. We are working on adding more metrics and better visualizations.

</comment></comment><comment><USER10> Agreed, site design is very nice.

Any plans for node.js support? I would install today if you had that :)

One minor UX quibble: after signup, it's not so obvious that my registration has succeeded if I have to step out of the linear flow - e.g. to read the API docs. You need a "Hi Foo" message somewhere.

<comment><USER8> I believe you can write a wrapper in node.js in minutes. Check the raw API docs at <https://www.thesunnytrail.com/developers> I would do it myself but I'm not familiar with node.js. Let's get in touch. You can find me at firstname.lastname@example.com

<comment><USER10> coding it up now :)

<comment><USER10> <https://github.com/rjrodger/sunnytrail>

<comment><USER11> And this is why HN is fucking awesome.

</comment></comment></comment></comment></comment><comment><USER12> Octav, I've spent a bit of time staring at your signup page because it wasn't clear if you're asking for my full name or for a login (here — <http://cl.ly/1E2e1S3B2y2J3R0N2r3U>).

Other than that, looks terrific.

<comment><AUTHOR> We're asking for a username (for login) rather than your full name :-)

</comment></comment><comment><USER10> You kinda also need a proper About Us page - photos, bios, investors? etc. Where are you based?

<comment><USER2> Honest question: Does anyone really care about seeing photos and bios of people in the company? I don't think I've ever looked that information up, even if I pay that company money. I agree though that there should be some kind of about page on the site. They also need to list their privacy policy and possibly a terms of use page as well.

<comment><USER13> Honest answer: yes, I care. Like the privacy policy and terms of use, executive photos and bios are one of my 'this is a real company and therefore it's safe to pay them money' filters. It's not as important as things like SSL on the login page or not sending back my password in plaintext, but it still matters.

<comment><USER8> Honest answer: I also care. It's not like we are trying to hide something. Most of the time Octav it's available on the Live Chat and we write individual emails to all the users that signup for the service. As side note security is really important for us and we are taking all the measures needed to ensure data privacy.

</comment></comment></comment></comment><comment><AUTHOR> Thanks, everyone for sharing your ideas / comments / questions! Keep'em coming :-) If any of you wants to get in touch via email you can find my address over here: <http://scr.im/sunnytrail>

</comment><comment><USER14> Very nice. I spend so much of my time designing reporting like this or doing it manually in excel. I especially like the cohort reporting. Im launching a new product now and will seriously look at a this. Any details on the pricing?

<comment><AUTHOR> Not at this moment. We are going to offer pricing tiers based on the size of your userbase.

</comment></comment><comment><USER15> Beautiful design. It definitely addresses a problem. Pricing seems to be on the higher side. But then again I wouldn't mind paying that if my own product had revenues and could afford it.

</comment><comment><USER16> There is a market for this no doubt about it. Although several startups I know prefer to do this internally - for privacy reasons.

</comment><comment><USER17> This is a great example of someone finding a nice, untapped niche that was staring us all in the face. Well done!

</comment><comment><USER18> nice good</comment>


Student Loans: The new indentured servitude? - <AUTHOR> http://www.dissentmagazine.org/article/?article=1303

<comment><USER2> Sorry for being dense, but how are student loans bad/worse than any other debt? My wife and I had maybe $15k worth of student loans. We paid them off in 7 or 8 years (the interest rates were ridiculously low, iirc) and got the monkey off our backs. It was a choice we made.

We could have taken on a lot more debt, but chose to work most of our way through college instead. Graduation took longer, we never went out to eat, and drove a crappy old car. Isn't that what "having no disposable income" is supposed to look like?

<comment><USER3> You can't discharge student loans in bankruptcy.

<comment><USER4> If you could, every college graduate would go bankrupt. Then there would be no student loans.

<comment><USER3> Which is why student loans were a dumb-assed idea in the first place.

Unlike with a car or house loan, there's nothing to guarantee the loan except for human capital. Which means that we have to choose between an inhumanity (using a _person_ as collateral, which is effectively what the current system entails) and student loans turning into bad debt on a system-wide scale. Neither's acceptable, so let's get rid of the whole thing.

<comment><USER5> What exactly is inhumane about allowing an individual to take on personal, non-dischargable debt in exchange for an education?

How would the world be a better place if no one had access to this (generally very low-interest) source of funding for their education?

I may be biased because I put myself through college on a combination of ROTC and loans, both of which were in different ways using my own time and labor (present and future) as a way of investing in my future. There was no other way I was going to be able to attend MIT, a dream I'd had since I was about 8 years old and saw a PBS special about the 2.70 design contest.

Sure, some people take loans and don't spend the money wisely (fail to graduate, choose an expensive school for a very low paying career, max out their loans and gamble or fritter it away). Those are all personal choices and I don't have a problem with those people suffering the consequences in exchange for what I perceive to be the greater good: that a motivated kid from middle or lower income family (such as I was) is able to attend MIT, thrive there, and as a result go on to have a substantially more fulfilling life. Oh and by the way, as part of that life, you'll have to pay back that money that someone fronted you when you were penniless, unemployable outside a mall context, no credit history, no significant employment history, etc.

Taking that opportunity away from all such kids, in exchange for having no one be able to make a poor choice specifically around student loans, is not a good trade, IMO.

<comment><USER6> Beautifully put, and I fully agree.

There is a flip side though. There are people who made every effort and did everything right and still did not graduate because of things such as major family issues, accidents leading to disability, or simply failing out despite their efforts. They are then shackled to student loans without the benefit of the degree. Granted, these tend to be a very small minority but in discussing the system the edge cases should not be forgotten.

<comment><USER5> You make an excellent point there, and I have to admit that I don't have a good answer. Your username is apt, and I wish I could double up-vote you for reminding me of the outliers on the downside.

The cold-hearted realist in me says "Well, some people are going to struggle and fail in life, ulimately dying in debt and this is just a different mechanism that manifests in that sliver of folks with stupendously bad luck."

The compassionate human in me says "There ought to be a way to let people not have to suffer the rest of their life for stupendously bad luck when they were young."

The realist then worries about how to make that almost as gaming-proof as the current system where you have to die or at least fake your own death and create a new identity (either of which would "game" _any_ system).

I would go so far as to donate to a charity setup to payoff the loans in those exceptional cases you describe (ideally at a negotiated discount, reflecting that those loans were unlikely to be paid anyway). Perhaps requiring that the person declare "normal" bankruptcy as well, and then that "qualifies" them to apply for a hearing of some sort before this new charity's board where they can state their case and answer questions. The forcing of "normal" bankruptcy as a qualifier is intended not to punish the individual but rather to ensure that it's not undertaken lightly and that the charity is hearing few frivolous cases.

You ahve shaken my belief system enough (in a good way), that you may have literally given me a direction to focus my future charitable endeavors. Thank you...

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This guy took an unnecessarily long paragraph to express his central point, but it breaks down pretty simply.

 _College student-loan debt has revived the spirit of indenture for a sizable proportion of contemporary Americans. ... Because of its unprecedented and escalating amounts, it is a major constraint ... binding individuals for a significant part of their future work lives. Although it has more varied application, less direct effects, and less severe conditions than colonial indenture did...and it does not bind one to a particular job, student debt permeates everyday experience with concern over the monthly chit and encumbers job and life choices. ... [Lenders subsist] off the desire of those less privileged to gain better opportunities and enforc[e] a control on their future labor. ...the planners of the modern U.S. university system...promoted equal opportunity in order to build America through its best talent. The rising tide of student debt...counteracts the meritocracy. ...the current system of college debt ... leads those less privileged to bind their futures._

I think you can meaningfully divide student borrowers into two groups. One group consists of those who reasonably estimate a positive ROI on their student loans. For these people, it may be somewhat troubling that you can't discharge the debt, but it seems at least somewhat fair since you can't divest yourself of the education, either. These students have no rational reason to complain: they made a financial investment and rationally expect to profit. In their case, the meritocracy is not only intact, but even helped by their ability to raise an investment.

The other group consists of those who can't rationally estimate a positive ROI on their student loans. If you're really serious about wanting that education, it's your call whether to blow tens of thousands of dollars on it and realize you will never repay your investment. You have to know you're impoverishing yourself for the sundry benefits of spending years of your life getting a college degree. Maybe it's still worth it. Maybe it's not. But if it isn't, it's not the lenders who are at fault, it's the cultural expectation to get a college degree, even in a field that doesn't increase your earning power. The lenders may benefit, but so do the universities, which get a glut of Ph.D.'s to string along for cheap adjunct positions and millions in tuition. ([http://chronicle.com/article/The-Big-Lie-About-the-Life- of/6...](http://chronicle.com/article/The-Big-Lie-About-the-Life-of/63937/)) (This very glut _also_ means that, as an example, the humanities have at least the potential for greater meritocracy, in practice.)

Student loans--and for that matter, colonial indentures--are probably a great opportunity for those with the capability to make something either out of an education or out of a trip across the ocean. And they're probably worthwhile for someone who seriously believes their life would be improved by a stint in college or a change of continent, even if it doesn't directly pay off. So I'm reluctant to criticize the system just because it has certain dangers.

</comment><comment><USER8> Student loans are also related to universities raising their costs substantially. I think it would be very hard to pay full tuition at Stanford, MIT, Harvard, etc without student loans even working full time in college. Part of the blame can be an educational system that has costs spiraling out of control

<comment><USER5> Taking away student loans would remove some of the upward pressure on tuition, but frankly those schools would have the luxury of accepting only rich kids. (If you're turning away 90% today, and your applicant pool is cut in half, you still have to turn away 80%.)

I won't go so far as to say that arguing against student loans is directly arguing to reserve elite colleges for the wealthy only, but I am one kid who wouldn't have been able to go without loans. Perhaps that makes me "too involved" or "too passionate" about my own experience to be fully objective, but I'm glad every day, workday or not, about the choices I made and the fact that loans were available so I could make that free choice to take them.

</comment></comment><comment><USER9> If the collateral is human capital (not a house or car), why don't they offer loans where you pay back a percentage of your future income, rather than a fixed amount? This seems like it would automatically smooth over the worst of the variance resulting in default.

<comment><USER10> This seems like it will break down badly:

\- I'm poor, I need to take a student loan and get educated if I ever hope to get out of my poverty and jump into the middle class. I sign away X% of all future income.

\- I've graduated and luckily have a decent job. I pay X% of my income monthly to the government (isn't that just a tax?), and thus my family's quality of life suffers, in particular compared to rich families who never had to take the loan to begin with. In fact, by the time I die I would've paid this loan back several times over.

\- I cannot afford to bankroll my children's educations, because I am X% poorer than someone else who has this job but never had the loan. My children will end up signing away X% of _their_ income also for life.

This smells like a recipe for increasing the wealth gap by _drastic_ amounts.

<comment><USER11> If you still have a balance left of the loan when you die, then by the time value of money you have actually never paid it back. Plus with inflation it seems very unlikely that you will ever have to pay back the real value of the loan if you spread the payments over your lifetime.

<comment><USER10> But that's not the system proposed - what you're describing is already what we have - i.e., pay it off over however long period and then you're done.

What I was responding to was the notion that instead of signing up to owe a particular sum, you sign up to owe a portion of all future income - and thus remove the risk of being bankrupted by your student loan (e.g., if you're out of work, you owe nothing, because you make nothing).

The trick here is that by removing your risk from that end, you are committing to essentially an unlimited mountain of debt. No lender will give you an easy out from a loan without a steep downside on the other end - like a big, nasty private income tax for the rest of your life.

<comment><USER11> Sorry, I totally missed that. Thank you for pointing it out.

</comment></comment></comment></comment></comment><comment><USER12> i seriously doubt we'd see the end of student loans, in the event that you could default on them. the banks would expect cosigners, a credit history, and maybe they'd actually look at whether or not the career options for your field of study could actually support the kind of loans you were taking out. (loaning a kid tens or a hundred thousand dollars so that they can get a degree in english lit in four years is just cruel, even if they can default on it.)

maybe kids would have to work for a year or two, to save a bit of money, and build a credit history before they'd be loaned the funds. just as well, imo. most 18-19 year olds aren't ready to be in college, anyways.

<comment><USER13> > maybe they'd actually look at whether or not the career options for your > field of study could actually support the kind of loans you were taking out

The problem lies in the fact with our unemployment situation there are plenty of people in "good" fields that are still screwed.

<comment><USER14> And those people might default. But factoring that risk in is a bank's job.

</comment></comment></comment><comment><USER15> The annual payment on my Swedish student loans is calculated from my income (it's 4 or 5%) and when I hit 65, the debt is forgiven. They still accumulate interest though, so it's not until last year, 12 years later (but on grad student/postdoc salary) that I've started paying off even the interest.

Apparently the government realized they will be stuck with a huge hit around 2035, because they have since changed the terms of student financing to constitute a larger fraction straight grants, but if you do take out loans, the terms are much more strict.

<comment><USER16> In Australia the repayment is 4-7% of income (going up as income increases). Interest is charged at CPI.

I think it's honestly a pretty good system.</comment></comment>


The Perils Of Greed - Stop Trying To Be Google - <AUTHOR> http://futurephilanthropreneur.wordpress.com/2010/04/29/the-perils-of-greed-stop-trying-to-be-google/

<comment><USER2> I wish this guy luck. He certainly has the right idea.</comment>


Women rise through the ranks of IT more rapidly than men - <AUTHOR> http://www.i-cio.com/profession/cio-profiles/item/women-it-professionals-on-a-faster-track-than-men <comment><USER2> Reading the comments on articles like this on hacker news always make me deeply uncomfortable to be a woman in tech.

I know it's hard to believe, but women don't usually get sent to coding summer camp as teenagers. Our parents don't usually encourage us to take AP computer science, and our best friends aren't in CS and don't refer us for sweet internships at Microsoft and Google.

If you're a woman in this industry, it's GENERALLY because it is something that you very much care about and want to do.

It's not some feminist conspiracy that women are being promoted, it's just that the women who go into tech are usually already pretty gritty people. You're comparing a very driven and passionate subset of women to a very general subset of men.

Here's a really great article I read once -- "I need terrible female engineers": [https://medium.com/@amyngyn/i-need-terrible-female- engineers...](https://medium.com/@amyngyn/i-need-terrible-female- engineers-1023a2e973dd#.l85nr149d)

<comment><USER3> "I know it's hard to believe, but women don't usually get sent to coding summer camp as teenagers. Our parents don't usually encourage us to take AP computer science, and our best friends aren't in CS and don't refer us for sweet internships at Microsoft and Google."

Is it hard to believe most men don't do those things, too? Some do, sure. And of people that do these things, historically more have probably been men than women (don't have the stats, but it sounds reasonable). But how many men do you think do those things, vs those that don't? Some anecdata: I didn't do any of those. Of all the engineers I can think of, male and female, very very few went to coding summer camps or took AP computer science. Few had best friends in CS in university, but sure, more did this than AP computer science or coding summer camp. And few had sweet internships at tech companies.

<comment><USER2> Oh great, more anecdotes in this thread. There are the cold hard facts, you know:

[http://www.theatlantic.com/education/archive/2014/01/techs-g...](http://www.theatlantic.com/education/archive/2014/01/techs- gender-and-race-gap-starts-in-high-school/282966/)

>"It's already too late," Paul Graham, founder of the tech entrepreneur boot camp Y Combinator, said last month in a controversial interview. "What we should be doing is somehow changing the middle school computer science curriculum or something like that."

>Ericson's analysis of the data shows that in 2013, 18 percent of the students who took the [AP computer science] exam were women.

Who makes high school students' schedules? Parents and teachers, at least in the US.

So let's put aside anecdotes and reactionary attitudes and just look at the facts.

<comment><USER3> Happy to look at the facts. That more men than women take coding summer camps, AP CS, have friends who are CS major, or get referrals to top companies sound believable. Presenting evidence in the form of cold hard believable statistics would be nice. I don't see any, but I'm willing to give you the benefit of the doubt, because I believe those claims anyway (though the AP CS stats of recent times might be different - what parent doesn't want their child to program? And women tend to get better grades than men and perform better in school settings, so more women might be in AP CS classes in recent years).

Again, men don't usually do the things you're claiming, either. You're claiming it with the language "women don't usually" because usually means more often than not - over half. But I'm open to changing my mind with stats. I'm happy to look at any you provide.

Do you have stats on most men being sent to coding summer camp as teenagers? Most men having parents that encourage them to take AP computer science? Most men having best friends who are in CS? Most men who refer them for sweet internships at Microsoft and Google?

Men usually don't do those things either. Just because more of the people that do those things are men than women, does not mean men, in general, do those things. That's my point.

<comment><USER4> No one claimed "most men _______." The claim is that your average woman who is employed in this sector faced more adversity than your average man who is employed in this sector. Therefore, you'd expect the average woman employed to have more grit than the average man employed, since the women with less determination were filtered by various filters that don't exist for men.

You could argue that it's not a filter against women but a magnet towards men, but that doesn't actually change the crux of the argument. There is clearly _something_ that causes only 18% of AP CS exams being taken by women.

<comment><USER3> OP claimed most "most men _______." She made other claims as well, which I didn't respond to. She claimed "most men ________" when she implied most men experience code summer camps, parental encouragement to take AP CS classes, etc. She said "women don't usually get sent to coding summer camp as teenagers. Our parents don't usually encourage us to take AP computer science, and our best friends aren't in CS and don't refer us for sweet internships at Microsoft and Google."

Usually means "under normal conditions; generally." Generally means more often than not, meaning over half / most.

[https://en.oxforddictionaries.com/definition/usually](https://en.oxforddictionaries.com/definition/usually)

<comment><USER4> And under what logical system does "women generally don't do ____" imply that "men generally do ____?"

At most, it implies that "more men than women generally do ______," which is totally true. Even that implication would be a bit of a leap were it not for parent's later explicit clarifications on the point.

<comment><USER3> I want to talk to you about two groups - tall people and short people. Usually, short people can't reach items that are on very high shelves.

Above, did I imply something about tall people's abilities to reach items on very high shelves? I didn't claim anything about tall people specifically. But I think I did make a claim about their abilities here, by implication, given the context. It's natural to infer the claim - this is just part of how people communicate. The claim is strongly implied - tall people can reach items on very high shelves.

I believe OP's clarified claim (of people in AP CS classes, most are men; of people at summer coding camps, most are men; etc), rather than OP's initial claim (most men take AP CS classes; etc). The clarified claim seems accurate. The initial claim is clearly inaccurate - and OP "stand[s] by it 100%".

<comment><USER5> yea exactly. 'Usually people don't fly' is valid statement grammatically but makes no sense.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I suppose I could think of a number of explanations for this observed effect.

1\. Selection- because so much of IT is hostile to women, the only ones who become senior in the field are the very good ones.

2\. Affirmative action- companies promoting women regardless of merit to seem progressive.

3\. Some sort of inate or socialized advantage– the "women are better at people stuff" philosophy. If this is the case, then you'd expect more women to be in management.

4\. Methodological flaws in the survey. I can't find any detailed discussion of their process, but phrases like "Of the senior developers who responded to the survey" seem to imply there could easily be significant selection bias.

Feel free to take your pick based on what you already believe. Personally, I'm going to wait for more data before forming any solid conclusions based on this.

<comment><USER7> >Selection- because so much of IT is hostile to women

that's an unproven premise

<comment><USER6> It's not a premise at all- I'm basing nothing on it. I'm not even claiming it's true. I'm just saying that it is one of several possible explanations for the available data.

</comment></comment></comment><comment><USER8> This immediately made me think of Paul Graham's article "A Way to Detect Bias". He talks about how a hiring bias (against women in this case) results in those who are hired being above average in skill.

Just one hypothesis on this data, but that would help explain why those women who are hired then get promoted faster - because they are actually outperforming their peers.

[http://www.paulgraham.com/bias.html](http://www.paulgraham.com/bias.html)

<comment><USER9> I remember when this was first posted to HN the top comment was about a serious flaw in this hypothesis. Need to find the comment thread again...

Edit: Found it, [https://news.ycombinator.com/item?id=10483751](https://news.ycombinator.com/item?id=10483751)

e.g. the other explanation could be that women applicants are just better than men, and that they aren't discriminated against.

<comment><USER10> Thank you for re-posting that.

</comment></comment></comment><comment><USER11> It's interesting that there is a huge emphasis on the gender disparity, especially in tech, without also bringing race into the equation. When I first read the article and headline, I first thought to myself: "Are we talking about predominantly white women? Black women? Hispanic women? Asian women?"

For example, I know that Asians are generally 'over-represented' in tech yet if you look stats which compare professionals by ethnicity ([https://d.fastcompany.net/multisite_files/fastcompany/inline...](https://d.fastcompany.net/multisite_files/fastcompany/inline/2015/05/3045954-inline- i-fig-3-1ascendrptmanagement-pipeline-by-racegraph.jpg)), Asians (both male and female) get promoted at a lower rate than white men and women ([https://c.fastcompany.net/multisite_files/fastcompany/inline...](https://c.fastcompany.net/multisite_files/fastcompany/inline/2015/05/3045954-inline- i-fig4ascendrptaggregate-execparityindexbar.jpg)). And we could look at specific company's like Intel, Yahoo, and LinkedIn to find similar patterns, namely white people have a much higher likelihood to achieve higher executive positions compared to Asians (even when controlling for difference in company demographic composition).

<comment><USER12> It would interesting to see that data broken up by age of immigration to the country. I've worked with a large number of incredibly intelligent Asians who immigrated here in theirs 20's-40's. And they are all too smart and hard working for their positions, and it seems like the primary reason they've been held back is because of things like visa issues, lack of fluency, lack of a college/highschool/family network to draw upon, and less cultural understanding which inhibits bonding. This has meant that many of them are 1-2 promotions behind where I think they would be if they had immigrated here in middle school.

</comment></comment><comment><USER13> Following the logic of most mental gymnasts here, the best IT companies should be women-only companies by now. People seem automatically to turn off their brains when discussing anything that might oppose the orthodoxy of affirmative action. This is a case where a bias that first appeared in academia ([http://www.news.cornell.edu/stories/2015/04/women- preferred-...](http://www.news.cornell.edu/stories/2015/04/women- preferred-21-over-men-stem-faculty-positions)) and is now bleeding to corporate life.

If men or any other subgroup are not rising through the ranks as fast, that is a clear discrimination and it is a problem, not an 'achievement'. It's this kind of ill-logic that brings pro-women policies in a bad light.

<comment><USER14> Because there are less women in tech, the best companies should be all women? That logic makes no sense. If only the best women are hired, while average men also get hired, that means there's discrimination against women, while the few women that do stay in the industry will tend to be of above average ability, and therefore rise faster.

As long as the vast majority of programmers are men, it's ludicrous to complain that men are being discriminated against. There are dozens of studies showing that men have it way easier in a multitude of ways. But it's good that there are more visible women in tech, and hopefully that will lead to even out the balance in the future.

<comment><USER13> Surely it makes sense, like everything else in these comments! If societal bias filters only high-performing women into tech, then the company that managed to snatch all the females would surely have an advantage versus all the rest. But let's not stop there with this rabbit hole: if indeed hiring bias is the cause that women rise faster in tech, and we want women to reach the highest echelons of tech industries, then logic dictates that we should keep discriminating with equal vigor, or else women will stop rising the ranks, leaving the goal unfinished. Oh, and by the way we could apply this wise reasoning to any kind of group that is disadvantaged in tech, say, the blind, the latinos, the blacks, those under 6 years old etc. They should all be rising higher in the ranks, so that soon all senior positions are filled by minority groups, leaving the "averages" in the lower ranks. simple logic.

<comment><USER14> If a company is more eager to hire women, they'd probably end up hiring more average women, and the difference between men and women would go away. Also, there are still plenty of above average men. The smartest company would hire the best men and women, not hire just women, on the assumption that women are better than men, because that assumption would end up defeating itself.

Though if a company only hire people who already established themselves at other companies, and hire them blindly, only knowing their gender and nothing about their performance, I suppose hiring women would be the better bet.

</comment></comment></comment></comment><comment><USER15> There's a common misconception, that technical excellence is a primary skill for managing a team of programmers. It's not the primary skill but a secondary one. The primary skill is managing people. One still needs to have technical competence -- far beyond just being able to code. However, the focus shouldn't be on dazzling displays of technical esoterica. The focus should be on balancing a tangle of conflicting cost/benefits and communication with the team -- logistics and tactics, not fisticuffs.

You can be a great manager with solidly average technical skills, so long as you can find a resource to advise you. (Dunning-Krueger trap: You may not know enough to understand if you truly understand the advice.) A team managed by such will usually outperform an average manager with great technical skills.

Alexander the Great would probably have conquered more of the world, if he had personally fought less.

<comment><USER16> Didn't Alexander die of poisoning, not combat wound?

<comment><USER17> I think the poster was implying that if Alexander hadn't used wars for all his gains he might have made more

<comment><USER15> Also true, but I was saying that he probably could have performed even better through war, if he hadn't been as injured as he was at the end of his campaigns.

</comment></comment></comment></comment><comment><USER18> As a man, I've noticed the "women promotion difference" very importantly in companies I've been employed in: Since 2006, it's mostly women who are promoted, with configurations like my last job where both my team lead and the manager were women.

On the other hand, I've left those companies because I could notice there was no career path for me, and created my own. I identify to a generation of men who've been sacrified for women equality. I'm all for equality, as long as everyone has equal chances, which we currently don't have. I'm very happy that we now start having studies supporting that men are less promoted than women today in some context (a minima in Luxembourg, France and Australia for what I'm concerned).

It's now time we study across all countries the mean-time-to-promotion, and it's time we include talks in conferences about the difficulties of men.

And it's time we stop having differentiated education and career paths for women. Today, women are equal in the mind if most men, and have a large swathes of explicit advantages granted by laws.

<comment><USER19> As a man, I'm embarrassed that this is the top comment on HN. This talk about "a generation of men being sacrificed" is absurd. Men still dominate the IT industry at all levels. To say that we're being sacrificed en masse is hyperbolic to say the least. It reminds me of the way that the Trump campaign makes its points about the state of the world.

Furthermore, so many men in tech are quick to explain away statistics about women/minorities being hired less by saying, "There's no bias! It's because they're not as skilled!" But when stats show that women advance faster, the story flips, and suddenly it's, "This proves bias! There's no way it's due to skill!"

Come on, HN, we're better than this.

<comment><USER20> Absolutely.

It's not a hard argument to make that women (and many other underrepresented people) are subjected to a stricter filter in the tech world, playing with a deck socially and structurally stacked against them. It's no surprise at all that people who can find success despite playing on a harder difficulty level will be among the most capable. An article like this is actually heartening, as it indicates that achievement and ability are internally recognized.

And now I've broken one of my cardinal rules (don't engage with social flamewar threads on HN), but you're exactly right - many of these comments are too embarrasing to let pass.

edit: calex just made this point far better than I in another comment in this thread. [https://news.ycombinator.com/item?id=12687015](https://news.ycombinator.com/item?id=12687015)

<comment><USER18> The whole equality story was, at the beginning, "If there's more men passing one stage (IQ tests, high school diploma or promotion), then it's biased against women.

Then suddenly when women are promoted more often than men, your story becomes "Women are just smarter than men, it's normal". Can't you just have a little compassion for men who didn't have the skills and deserve to be pushed and taught a little bit? And the prejudice about "men are stupid" is repeated in many innocent settings:

\- [https://snag.gy/qDceHS.jpg](https://snag.gy/qDceHS.jpg)

\- [https://pics.onsizzle.com/i-wish-i-was-strong-like-him-i- wis...](https://pics.onsizzle.com/i-wish-i-was-strong-like-him-i- wish-i-3621297.png)

\- Everyone can cite 10 qualities of women, especially smartness [1].

\- You can't quote any quality attributed to men. There's none, no quality attributed to men in any newspaper, in any document, in any culture. "What about muscles?" The thing about muscles is, women reckon we have strength because it would be hard to deny it and it helps construct the idea that we're violent. But muscles also help build the image of men being stupid, and it doesn't give us a skill.

This prejudice does have real-world effects:

\- Men are twice more likely to be homeless or to fail their studies,

\- Men are 30 times more likely to land in prison.

THIRTY times! But somehow, women succeed to capture all the work we do for equality.

The fact you're unconscious about male difficulties shows how much work there's left to do about male equality. The progress we've made for women about equality of chances and freedom of pursuing good jobs, we now need to make it for men too. Since you're talking about politics, the fact that the only way to "vote for men equality" is to vote for Trump is a horrible abomination: I want equality, I'm keen to vote for a woman, but if that means that she'll do even more to accentuate the "privileged path" for women and accentuate messages breeding hate between women and men, then you're asking a voter to make... a dangerous choice.

[1] Qualities that are generally attributed to women: "Women are better at multitasking" – where scientific studies are much more gray-area than that; "Women are better at communication" – where in fact it's males who are handicapped about communication and who deserve some equality budget for "education to communication" and "education to feelings"; "Women are better at tastes and decoration" which harms the participation of many interested men in decoration topics; "Women are more mature, earlier" when in fact this maturity is judged on a biased set of responsabilities; "Women are better at raising children" which creates unprecedented disadvantages for men who want the custody of their child, _and finally, "Women are better at school"_ when in fact it's teacher bias which gives them better marks ( [http://www.bbc.com/news/education-32302022](http://www.bbc.com/news/education-32302022) ) – As you can see I'm very well documented on every quality which is theoretically attributed to women and where, in fact, it's just that many papers are unfairly condescending towards men.

<comment><USER20> Edit: your comment has been edited extensively, so I'm responding to whatever it was at the point in time I started typing.

\---

To put this very dispassionately, filtering more aggressively reduces both total count and false positives (if the filter shares any correlation with success). The population subjected to the stricter filter will have a higher percentage of people who are deserving of promotion.

This would be true even if we limited our entire workforce to ivy league white men and then applied an additional filter to a random subset of them. If the filter correlates, the subset will outperform. I don't mean to say this is the _only_ thing impacting who works where and how successful they are, but it is certainly present.

You're responding to an argument that I didn't make. The global population statements about which gender is "smarter" are your own.

Regarding Trump (I'm pretty sure I didn't bring this up, either), his recent exhibit of repeatedly mentioning that he was being shortchanged on time during the debate while actually having (negligibly) more time to speak (~40min vs ~39min) is a perfect illustration of the "prejudice" you're describing. When used to a privileged position, equality feels like bias.

(Debate time to speak, pick your source: [https://www.google.com/search?q=trump+clinton+time+to+speak](https://www.google.com/search?q=trump+clinton+time+to+speak))

<comment><USER18> > You're responding to an argument that I didn't make.

You're correct, I answered to both parents in one comment, and found it useful to put my comment under yours because you had a very common objection, although I forgot to address it.

Concerning the "filter" story, how do you know girls just aren't just less interested in programming? Example that may be the norm: I've tried many times to get my god-daughter interested in computers, but the computer/tablet/phone/electricity/mechanics/woodworks/Mythbusters thingy really doesn't raise any interest or even bare curiosity. She just does it because she loves spending time with me, but remembers nothing.

If there were a genetic or social construct that made that fewer girls identify with programming, then it would kill the argument that "due to filtering, women are better" and reinforce the argument that "Women are promoted, not because they're better, but because companies are required to promote women".

And in fact, studies have demonstrated that fewer girls are interested in programming because of society.

<comment><USER20> > And in fact, studies have demonstrated that fewer girls are interested in > programming because of society.

I agree! But why? And when? And is it just girls? The filter I'm talking about extends far beyond and is applied far earlier than the job interview, or the application to college, or which classes someone takes in high school. The paths laid out for all of us have varying degrees of difficulty, and shape how we grow.

Speaking as a white male from California who grew up with a computer in the house, in many ways my own career in tech is the path of least resistance. Sure, I've worked hard and chose to invest myself in these skills and this career, but the impediments to doing so were much, _much_ less significant than the social and structural biases that people with other backgrounds run into at every. single. step.

Simply recognizing that I got to shoot for the hoop from a few feet closer than the rest of the population has given me a great respect for those who made the same shot from farther out. It's not that an individual like myself (like you?) with an advantaged position _couldn 't_ overcome the same challenges, we simply have not been tested in the same ways. I don't mean to speak for you as an individual, only that over a large enough group you're going to see a lot more people make it who got to take the easier shot.

I think our fundamental disagreement is that you're saying people like me (perhaps us?) don't actually get that easier shot. And that I simply do not believe, because of my experience in and observation of this industry, and because of the near-endless supply of evidence to the same. [citation needed: plenty in this thread, and every thread like it]

<comment><USER18> No, that's not our disagreement. Our disagreement is that if fewer women want to get into programming, then they're not being discriminated against. They are free and just didn't choose programming.

It could be a social construct of genders where male babies are exposed to other things than female babies, it wouldn't matter. The girl (e.g. my god- daughter) who likes chemistry goes into chemistry and is not being "discriminated against because she didn't go into programming". And your argument is in the same family that says there should be 50% women in programming because there's 50% females at birth.

You're also focussed on demonstrating that men get an easier shot. But if women _who want to do programming_ can do it with no more barriers than men, then no-one is being discriminated against. And in fact, today, if a girl takes programming, she'll have a better career than men, because we promote women. There are countless stories that "women are harassed in IT", but they are all anecdotal and match with the global story told to girls since birth: "You're a victim, and you should spend your whole life finding occurrences where you can prove that you're a victim". It's not a tin-hat stuff I've invented, it's what, for example, the brand Always teaches to little girls with the #LikeAGirl video.

To come back to stories about girls being harassed: Is there a scientific experiement that we could do to prove that women really have a harder time than men, when we include sexual harassment of course, but also include when a weak male like me have been victims of some alpha manager, and include stories of men being fired because a woman doesn't like them (And I have live examples such as: Douglas Crockford, the PyCon conference story, the GitHub ceos, the GitHub's white males who've been fired, and two colleagues from my Australian company)?

All in all, I see women promoted all the time, I see women receiving a warm welcome in every team, I see many males being extra carful about including women, I see many downvotes and condemnation when someone posts a sexist remark on HN, I see corporate help to ensure women are untouchable and promoted: Not to paint the real world with rainbows, but I won't just buy into a story of a few women saying "You can't learn programming when you're a girl".

I also receive 20-50 upvotes when I remind people that women need to work _too_ , so the feeling that women are too unfairly advantaged before they're really competent seems to be a common resentment across the community. Just try to think about what we'd do if we wanted peace. We certainly wouldn't try to accentuate victimization so much, and wouldn't try to have different paths for men and women (hard lonely work with no help for men who'll stay programmers, little programming but a lots of socializing and girls-in-web groups for women who'll become managers). And we certainly wouldn't have the following video, which is both dishonest towards men and an incitation to hate for female viewers:

[https://youtu.be/VhB3l1gCz2E](https://youtu.be/VhB3l1gCz2E)

Unity, peace and solidarity is something we build together, unless it's not unity, peace or solidarity that we want. And women certainly aren't currently working for that.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> > The study of more than 4,000 UK IT professionals, published to mark > International Women's Day, reveals women typically reach management level > three years faster than men (in nine rather than 12 years) and they are > appointed CTO/CIO two and a half years faster (in 13 versus 15.5 years for > men).

> However, the survey also reveals a colossal gap between the numbers of men > and women working in top IT roles. Of the senior developers who responded to > the survey, only 6% were women; with IT managers the figure was 8%, and of > those heading up IT only 7% were female.

These statistics are weird together. How can this be?

Speculation: There is a bias against average/underperforming women relative to men entering and staying in tech. This means that the women who do stay in are from the upper end of the distribution. It's as if you took a normal distribution (as skill often is distributed) and truncated some segment of the lower half. This would explain why there are much fewer women reaching managerial positions but why the ones that do reach it do so very quickly.

Is there any data on how qualified and performant female engineers are relative to male engineers who occupy the same position? A result that would support this hypothesis would be something like women in the same position as men in tech have beefier academic credentials or more awards.

<comment><USER22> That's one explanation that fits a narrative. (and ignores the fact there are far fewer women who even attempt to enter the tech industry).

The gender gap in tech starts with children, is seen in STEM enrollment rates and continues in the job market where a multitude of diversity initiatives exist to promote underrepresented groups in tech.

So, an alternative speculation for the abnormally high promotion rate for women is there are fewer women interested in IT in the first place and companies are scrambling to compete for women because it makes them look better (via diversity initiatives).

There is a great documentary examining actual science on the subject and interviewing both scientific researchers and social scientists on opposite sides of the issue:

[https://www.youtube.com/watch?v=p5LRdW8xw70](https://www.youtube.com/watch?v=p5LRdW8xw70)

Should we attempt to combat the gender gap in the nursing industry with the same vigor that we are focused on tech? How about the gender gap we see with garbage workers or psychology?

edit: clarity.

<comment><USER23> >> This means that the women who do stay in are from the upper end of the distribution.

> Another explanation is there are fewer women interested in IT in the first > place and companies are scrambling to compete for women because it makes > them look better.

Those aren't even mutually exclusive explanations. It seems likely that both are true as the people that go into it despite the lack of interest from the rest of their cadre will be better candidates vs. borderline candidates.

<comment><USER22> I am mostly playing the devil's advocate. Both explanations may be true to a degree.

I believe it is misguided to shoehorn discrimination as the goto explanation for every statistical difference between groups of people. In this scenario the data literally implies the opposite conclusion yet danharaj was able to contrive an explanation that leaves women as the victim despite lliterally being promoted twice as fast. You can bet danharaj would still be arguing the same conclusion if the data had born out the opposite results.

<comment><USER23> To be fair there it's likely that there's a bit of victimization there as well if it's harder to go into one field vs. another due to social norms. You get it from both sides, too! "You're a man, why do you want to be a _nurse_??". Going back to tech, if you were a borderline woman candidate that wanted to get in it seems that you would statistically be less likely to follow that dream.

I like to step back and just say that it's not something that has to be fixed if a cadre of people appear to "collectively decide" based on individual decisions. It sucks that if you are in the cadre and have to fight the perception that you should(n't) be doing something. But I think (as I suspect you do as well) that saying that your individual decision should be different simply because you share an identifying trait with others is broken.

Ideas that men or women are some collective that needs to be pushed one way or another are difficult. You can generalize based on the apparent preferences of the group, but then judging an individual based on those preferences is where it starts to get troublesome.

<comment><USER24> Try being a male who wants to go into education for young children. I have a friend who went through the process as the only male member of his entire graduating class, and he says the level of suspicion he had to face from his professors and fellow students was overwhelming at times.

It was consistently implied that a young male would only want to teach young children for puerile reasons.

Even when he was given the benefit of the doubt, it'd only be to say "oh, so you'll take your education degree and enter administration?"

</comment></comment></comment></comment></comment></comment><comment><USER25> Please don't take this as flippant, it's a legitimate query. I keep seeing the call for "more women in technology", however I don't see a similar rally for say, "more men in early education". Most teachers in early to middle school tend to be females by a wide margin[0], men comprise less than 20%, yet I don't see people screaming there should be more men teaching in those roles? Why is that?

[0] [http://www.menteach.org/resources/data_about_men_teachers](http://www.menteach.org/resources/data_about_men_teachers)

</comment><comment><USER26> I've been reading HN for a few years now. The tone of the response to women in IT hasn't changed much. I kept believing that if I were good enough, smart enough, and if people liked me enough, I would get ahead.

Turns out, there's a real ceiling on where I can go. Not because I lack talent. I am very good with people. My last manager believed I would be a VP at the company someday. I maxed out at that fake "architect" role made for people that require more money but can't be promoted to management. This was a large F-50 type organization.

We found that the HR departments at very large companies definitely improve diversity up and down the ranks. But there is a blockade that eventually presents itself.

This blockade can probably be summed up mathematically: The first females to go up stream will always be white. As the number of females up the ranks increases, the less obligation white males feel to grant other minorities the same privilege. Eventually, it works out to where there will be a multitude of white women paving the way at VP level, and until they die off or retire, the blockade prevents advancement for anyone else.

I call it the "wall of white women" with a sub-wall of "white male architects" waiting for their chance. If the minority applicant is not blindingly obviously superior to the wall of white males just beneath the wall of white women, there's no chance.

Unfortunate. I find it kind of hilarious and enjoy watching it form at every single major corporation.

<comment><USER27> I'm a first gen korean-american woman (I guess after 30 its weird to call yourself a girl). I've definitely seen this situation too, it was a little depressing.

So I've been bouncing around startups,and even started contracting under my own c-corp to make connections and money. The respect difference has been unreal. I've had to toughen up significantly, you have to really learn to read bs and move on without emotion.

That's another option you can take, I'm personally enjoying it right now.

<comment><USER26> Thank you for responding! I like hearing solutions. Listening to my own whining is tiresome.

To your point, I left my large F-50 employer this summer and started at a smaller company. I am strongly considering contracting. Your response is encouraging.

</comment></comment></comment><comment><USER6> This seems to be based this survey data: [http://www.emolument.com/career_advice/women_in_it_career_ev...](http://www.emolument.com/career_advice/women_in_it_career_evolution_best_paying_jobs)

</comment><comment><USER28> Only because women and men are equal as human beings and should be treated accordingly it does not mean they are identical. Not so long ago everybody said that we need more women in [paste a well paid white collar job]. You wanted positive discrimination. Now you have it.

Ironically nobody wanted to have more women on construction sites, in the military service or as a surgeon...

</comment><comment><USER29> This shouldn't be surprising to anyone given the stated goal by large companies of hiring more women, and the relatively small pool on which they are drawing from

</comment><comment><USER30> As a sidenote, the USD to GBP currency figures shown in this article really show how much the pound has slumped over the last 6 months.

Article: "£52,000 ($74,000)"

Current day: "£52,000 ($63,020)"

</comment><comment><USER31> > despite still being heavily outnumbered

Despite?

<comment><USER32> Yes, that's a word; [http://www.dictionary.com/browse/despite](http://www.dictionary.com/browse/despite)

Its use here means something like " _contrary to the expectation that_ women face barriers in IT (as evidenced by lower numbers of women in the top positions in IT and in general), they rise through the ranks faster than men."

<comment><USER33> > contrary to the expectation that women face barriers in IT

Hasn't this been debunked already? AFAIK the percentage of women in IT is about the same as the percentage of women graduating from CS.

<comment><USER32> It could be; in any case, that is neither here nor there since the article seems to be taking that for granted as the basis of its "despite".

</comment></comment></comment></comment><comment><USER34> I'm totally OK with this.

Am I the only person who dated a senior analyst and is now married to an IT Director?

</comment><comment><USER35> It this specific to UK?

</comment><comment><USER36> One explanation would be that women could be said to have a better instinct for power, and they recognize quickly that as a corporate survival strategy, power over people is more rewarding and sustainable than power over things. Feminism isn't about women becoming IT guys, it's about becoming bosses.

Sort of breaks with the victim narrative, but provides a more plausible story.

</comment><comment> guard-of-terra As if getting into management was an universal desire.

<comment><USER37> Yep. Every woman developer I've talked to wants to be a manager someday.

Some even go for junior manager (a lot lower pay) even thought they have the degree and skills to be mid developers without any problems.

<comment><USER38> This is ridiculous. Not every woman I know wants to be a manager, and despite their proficiencies, they are seen as "more personable" and implicitly, less technical. Women being pushed into management and out of technical lead roles is a very well known phenomenon in the field, and people here pretending like this is "success" seem to be very happy to ignore that this fits very nicely with the status quo of sexism.

<comment><USER39> Aren't management positions better paid than technical ones almost anywhere though? I realize some progressive companies try to establish engineering path and managerial path but it's still not standard. I think thinking in terms: more likely to be a manager = more successful in corporate environment is not that far fetched.

</comment></comment></comment></comment><comment><USER40> I'm not too worried. I'm sure the feminists are going to condemn these companies and call for the resignations of the executives and stage protests over this blatant inequity. And the media will plaster this all over the news to spread awareness. And these companies will take heat from clients, end users, and advertisers, _right_?</comment>


Ask HN: How you dealt with YouTube/social media addiction? - <AUTHOR> <comment><USER2> I quit using social media around 2012. The first year or so was difficult because I had to deal with friends and family not understanding why I was no longer part of things like Facebook which was number one at the time. Now it's been so long that I feel like a complete outsider to social media. Not a care in the world and when I see how my friends and family interact with it, I see it as something that I don't need and probably is unhealthy anyway. It's like when you quit drinking soda and after a certain point you look at soda and can only visual the 40g mass of sugar that dissolved in there.

I guess that's a big long-winded since I never felt like I had an addiction and not sure if this helps. But just evaluate if you think it's healthy, and go from there. However, the most effective way would be to delete you accounts completely and remove any way to re-enter.

</comment><comment><USER3> It's a kind of FOMO - you want to keep reading more posts or watch until the end of the video. Rarely you'll find something wonderful, often you get nothing out of it. That's how Skinner boxes work: if you got a reward 100% of the time, it's less addictive, and even with diminishing gains, people still stay addicted.

Going cold turkey works very well. It's about as easy as quitting caffeine. And because the gains are, in reality, really low, it's hard to get back in.

Another option is to simply break impulse. Allow yourself social media on certain periods of the day, or if it's really urgent, force yourself to wait about 10 minutes. That makes it a bit harder to build up a habit of browsing when you want to procrastinate. This is also similar to why the Pomodoro technique works.

</comment><comment><USER4> Don't have those apps on your mobile devices and block them with your hostfile on desktop. If I really want to check something I have to modify the hostfile and I always put the site back in when I'm done.

But each person responds differently to these types of measures. You'll probably find a few recommendations here so try all of them and see which is the most effective for you.

</comment><comment><USER5> Think of what you want to achieve in your life.

Do being addicted to social media would help you reach that goal?

</comment><comment><USER6> mostly I don't, but I've found that most of the time I mess up is when I have more than 30 min of unstructured time at home with energy.

</comment><comment><USER7> Remove social media apps from mobile Use computer for social media instead of mobile Focus on health / food / books [hardcopy]

</comment><comment><USER8> YouTube/social media in themselves are not bad. But when it becomes an addiction, then there's an issue. If they are needed for your job description not for learning purposes, you may not be able to completely cut them off. You can however as someone to install parental control (yes!) On your computer system and/or phone and lock it with a password. That way, even if the urge comes, you cannot help it. Accountability helps. But if it has nothing to do with the above, deletion may not still help. For example, Gmail accounts come with a YouTube account. If there's a way to disable the YouTube account while retaining the email, fine (I dunno). Yahoo! has videos too. You may want to go for email providers without the video option. Drawbacks means you lose those email accounts - not easy.

I'll go with the controlled approach, nonetheless.</comment>


Webservers shouldn't have direct access to keys - <AUTHOR> https://plus.google.com/106751305389299207737/posts/WM4i4Rqxs5n <comment><USER2> This really isn't really the end of the story. As far as your web app goes, HTTP cookies can be just as or more sensitive than your SSL keys, and they also slop around in your web servers memory. This is one reason why we run SSL/TLS in the first place, after all. In many cases we really use TLS as a way to ensure application layer authentication. Confidentiality, in and of itself, is often not the primary concern. Do you care more about people accessing your Amazon account, and buying things in your name, or people seeing what you're buying? With your Amazon cookies, I can do the former.

So are we all going to jump back to pre-forked, multi-process Apache now, tack on a TLS slave daemon, and ignore gaping big holes in the application layer?

<comment><USER3> They are orthogonal issues. The point of separating private keys is to contain exposure. Heartbleed still would have happened, and all data could be exposed. But right now we not only have to deal with data leakage, but after we patch and fix the bug we have exposure due to the private keys potentially being leaked. We then have to get new certs signed and experience all sorts of additional certs. If the private keyvwas not leaked, then while we still have to deals with the security breach, we can at least avoid having to revoke and reissue all certs.

<comment><USER2> As long as forward secrecy is/was used then the impact on the individual user is more or less the same. Remember we're largely talking about active MITM.

In the short term your user is compromised whether it's a cookie, an AES key for the TLS session (which will presumably still have to be resident in the process sending you data), a credit card number in a POST request, or your certificate master key.

Anyone who can intercept my traffic in close to real time, and wishes to target me, is going to know I'm talking to amazon.com, IP x.y.z.f, and that that's where they should target their Heartbleed attack for a good stab at accessing my PHP session cookie or TLS session AES key.

There are some cases, like e-mail phishing, where this isn't the case of course... but then a redirection service would be sufficient to let me script an attack against many sites.

<comment><USER3> Agreed that the effect on the user is the same, for the most.

It does make my life easier in the event of a vulnerability, with little cost to users. Since I can more efficiently respond, the user arguably gets a better experience.

I agree this doesn't solve everything, but it is a strict improvent over our current system.

</comment></comment></comment></comment><comment><USER4> Key management is a major issue across the board, not just web servers. Even a theoretically unbreakable crypto will always have a weakness if the keys themselves are compromised. Stopping keys from being copied is a major challenge though, because anything you can do to truly protect them involves major hassle.

Think of the problems credit card processors deal with: Hiding the keys themselves from their own employees, so that getting a root password is not enough to be able to just take all the credit card information. You don't want the key in any filesystem, and you don't want the key in an easy to retrieve memory location. You end up with servers that require multiple people to boot up, as the keys only really appear when multiple people provide their own piece of the secret.

Eventually, enough security leads to the risk of data loss, as an error can make the keys become unrecoverable.

This is why we have to add security breach detection, and make recovering from a breach easy and having low consequences. Linus said that with enough eyeballs, all buts are shallow. With enough attackers, all systems are insecure.

<comment><AUTHOR> If I was running a bank, I'd hopefully use a proper HSM. You ask it to generate a private key, you then ask it for the public key, get it signed into a cert, and use that. The HSM promises to never give out the private key to anyone (including the administrator), usually in a tamper evident way (if someone did manage to extract the key, you'd notice). Even if you have root on a machine that has an HSM plugged into it, you can't get the private keys out.

However, my personal webserver isn't a bank. Not everyone can justify spending this much money on a HSM to get this level of assurance. What I'm proposing is a simpler solution that isn't robust against sophisticated attacks (eg when the attacker manages to get root), but is far more robust to some classes of the common attacks we see today (where the attacker can read any memory/file that the webserver has permissions to see).

<comment><USER5> For other curious readers:

HSM = Hardware Security Module ([http://en.wikipedia.org/wiki/Hardware_security_module](http://en.wikipedia.org/wiki/Hardware_security_module))

</comment></comment></comment><comment><USER6> Mac OS X has something similar to this "Software HSM": the Keychain. You can put private keys in your keychain, and apps can use them for signing or encrypting, but they can't extract them. It's quite nicely implemented; when an app tries to access a key the first time, a dialog will pop up saying something like "Mail is trying to use key xyz for decryption. Do you want to allow?".

Of course, this requires using Apple's APIs, which are poorly documented and a pain in the neck even compared to OpenSSL. It's also not suitable for servers.

<comment><USER7> That wouldn't help when there is a bug that lets an attacker read your server's memory; you'd still need to reissue your certificates as a preventative measure because you couldn't guarantee that the bit of memory used by the software HSM hadn't been compromised.

<comment><USER8> The keychain operates out-of-process.

<comment><AUTHOR> But not out of user. If I can run code as your user, I can attempt to retrieve those keys, although I assume MacOS prevents you from attaching a debugger to the keychain.

Linux has Gnome-keyring, which, amongst other interfaces, operates as a PKCS#11 softhsm (I think), but it still runs as your user.

<comment><USER8> Of course. If you can run code as the user, then solutions intended to protect against arbitrary memory _read_ bugs don't apply.

That doesn't mean that the solution is worthless. It simply means that it doesn't cover an unrelated class of bugs.

Migrated to hardware-based tokens, or Intel SGX-protected software tokens, would extend the solution to cover the case of arbitrary code execution. That doesn't eliminate the value of the software-only solution.

</comment></comment></comment></comment></comment><comment><USER9> This proposal is very similar to Plan 9's "factotum" scheme (see [http://qedragon.livejournal.com/99938.html](http://qedragon.livejournal.com/99938.html) for a nice explanation with reference to Heartbleed; factotum is similar to a generic ssh-agent or gss-proxy), except proposing that the daemon run as a separate user, which is a reasonable extra layer of security that deals with some remote-code exploits.

<comment><AUTHOR> Yeah, I was aware of factotum when I wrote this post. GNOME uses p11-kit (which is a wrapper around PKCS#11) and gnome-keyring to kinda provide similar functionality.

</comment></comment><comment><USER10> Is everyone falling into the trap of over-securing last week's security problem? Isn't this just like banning water bottles on planes after a failed liquid bomb attack?

Be careful that in our haste to secure the private keys, we ignore easier attacks. The article seems to gloss over an attacker hacking the web server, when in fact that gives them such powers that going on to grab the private key might not even be attempted.

<comment><USER8> OpenSSL isn't last week's security problem: The code didn't magically get better in a week, and all signs indicate that there are likely more serious issues in the library.

Looking past OpenSSL, C didn't magically become a safe language in a week, either; this approach guards against a real problem in C that is not limited to a single bug in OpenSSL: over-reading off the end of a valid buffer.

</comment></comment><comment><USER11> Wouldn't it make sense to lower the exposure by having the server only have access to its own ephemeral private key?

So instead of having the key to the hard to change site certificate on many vulnerable front-line servers, it rolls up a key and on boot sends a certificate signing request to a hardened internal system?

<comment><USER12> This is feasible in the current X509 public CA system, thanks to name and path length constraints. However, I don't know of any CAs which will issue restricted suitable certs for any sensible amount of money.

<comment><USER13> I'm very confused why the X.509 model isn't already set up to accommodate this. Imagine that a CA could only sign CSRs for subjects hierarchically-below its own subject. Then:

• Instead of issuing plain leaf-node certs, CAs could (and would) issue CA- certs by default.

• You'd be able to issue as many plain certs as you like, using your own CA- cert, and revoke them as often as you like. (OCSP would be much more necessary here.)

• The current CAs would be renamed to "global CAs": their power would come from the fact that they have no subject (or their subject is '.') in their CA- certs.

• Anyone owning a domain would become the CA for its own subdomains. (foo.tumblr.com would be signed by Tumblr's CA; foo.s3.amazonaws.com would be signed by the Amazon AWS CA; etc.)

<comment><USER14> Because your browser doesnt know the chain, yourdomain.com could sign google.com and browser will accept it as is today.

For your proposal to work the CA system would have to check with dnssec and probably another protocol to enforce the subca signs only its domain constraint.

<comment><USER13> I think the change would simply require servers to always send a certificate chain (up to at least the cert's most-proximate global-issuer CA) instead of just a cert. Which is pretty much what every web-scale site does already, to short-circuit OSCP lookups on intermediate CAs.

DNSSEC needn't be involved; you aren't determining whether the CA owns the domain it's issuing certs for at runtime. Instead, the parent-CA who issued the CA's signing cert determined that when they issued the cert. As long as each certificate in the sent chain both 1. checks out as signed by its parent, and 2. _has a subject hierarchically below its parent 's subject_, you can be sure each CA in the chain did whatever it considers diligence before issuing certs to its child-CAs.

</comment></comment></comment></comment></comment><comment><USER15> What is described is something like ssh-agent of openssh.

<comment><USER16> My thought exactly. It loads the key into memory and never exposes it, just lets you perform operations such as signing and returns the result.

It seems primarily geared at clients rather than servers, but in theory can be used for both (I'm not even sure you can load your openssh server key into ssh-agent, can you?)

<comment><USER17> > _(I 'm not even sure you can load your openssh server key into ssh-agent, > can you?)_

Yes, actually, as of OpenSSH 6.3 you can. (I wrote most of the patch that added that feature.) However, even without doing that the OpenSSH server performs crypto operations in a separate process from the network-facing child process (unless you've disabled UsePrivilegeSeparation). The purpose of having the server talk to an ssh-agent was to allow keeping your host keys encrypted on-disk or loading them from a smart card.

</comment></comment></comment><comment><USER18> > Ideally you'd want your TLS keys to be stored in an HSM

Does an open spec HSM module exist? I can be somehow sure that linux and apache/nginx don't have backdoors as the source is audited by many people, but I need to be "sure" of my HSM too.

<comment><USER19> There's an open-source software HSM: [http://www.opendnssec.org/softhsm/](http://www.opendnssec.org/softhsm/)

<comment><AUTHOR> It runs in process tho, so it would have had the exact same result with heartbleed. Its keys need to be readable to that user, so exploits like [http://blog.detectify.com/post/82370846588/how-we-got- read-a...](http://blog.detectify.com/post/82370846588/how-we-got-read-access- on-googles-production-servers) would also still leak your private keys. So no net win here unfortunately.

opencryptoki has a softhsm too, but again, it appears to run in process. Same problems.

</comment></comment></comment><comment><USER20> This seems like a good idea but this fixation on PKCS#11 seems strange. Why use a whole API when Apache and Nginx can just add a simple daemon with their own internal API to do this?

The same amount of security can probably be obtained by just launching a process on server startup to do this with sufficient isolation from the parent process. I believe OpenSSH does something along these lines to run most of its code as an unprivileged user. It's probably even possible to do this seamlessly based on the existing SSL config directives in apache/nginx requiring no more intervention from the sysadmin than upgrading to a newer version.

<comment><AUTHOR> The major reason is that when your website becomes popular, and becomes more of a target, you can swap out the software hsm daemon with a more sophisticated hardware solution, if implemented properly, by just changing a pkcs11: url[1] to point at the new HSM.

PKCS#11 has a few irritants, but it's a fairly sensible API. and it's already implemented by many things (browsers, gnome-keyring, ssh, ...). OpenSSL, GnuTLS at least both support it via one mechanism or another, my only real complaint from the webserver side is that the configuration knobs aren't really plumbed through.

[1]: [http://tools.ietf.org/html/draft-pechanec- pkcs11uri](http://tools.ietf.org/html/draft-pechanec-pkcs11uri)

<comment><USER20> That would be an argument for supporting both. I fear that otherwise what you will end up with is that a minority of security conscious people will have HSM (actual hardware or software) and most others will just configure their Apache/nginx software as quickly as possible and get on with it. Having the basic config be more secure by spawning the soft-hsm itself sounds like a win.

</comment></comment></comment><comment><USER10> How much protection does this really give? If you manage to hack the web server, then you can quickly feed the HSM/software daemon unlimited amounts of chosen plaintext to encrypt. Would this make it possible to recover the private keys?

<comment><USER21> Provided that a large enough private key is used, using a "chosen-plaintext attack" (the kind you describe) to obtain the key should be computationally infeasible with known attacks on RSA/DSA/ECDSA.

Much more likely that they'd just hack the web server and MITM you or something.

</comment></comment><comment><USER22> Has anyone ever used the thinkpad's tpm for anything under linux? Whenever I looked into it the tpm support seemed shoddy especially on my t41. I have not checked the w500 in a long time.

<comment><AUTHOR> [https://www.lorier.net/docs/tpm](https://www.lorier.net/docs/tpm) are my notes with experimenting with the TPM in my T530. The trick is that the TPM will protect itself fairly aggressively, so before you start turn off the laptop, unplug the power _and_ battery (if possible), and on the FIRST boot after you put eveything back together, go into the BIOS and clear the TPM. If the menu option isn't there, then you probably have to power everything off :)

</comment></comment><comment><USER23> Soft HSM, meet local privilege escalation exploit. #sadtrombone

</comment><comment><USER24> The stuff that should encrypt, should have the keys. That is how easy it is.

Personally I think the web server should do the encryption. As it is the part of the software that contains the sensitive information, AKA the content. You can get new keys you can't get new content.

<comment><AUTHOR> Your content is often not in the webservers user, it's often stored in a SQL or NoSQL database somewhere. Various access controls can be applied there. But your right, unfortunately this isn't a 100% magic pixie dust solution to everything.

When you say "you can get new keys" which is true (although startssl appears to be the fly in this particular ointment), browsers don't validate CRLs, so the old keys are still just as valid as the new ones. Which makes getting new keys potentially worthless.

This is providing similar protections for your TLS keys to what your database server already applies.

<comment><USER24> The content in this scenario is. The http body with banking info or wathever.</comment></comment></comment>