BTC Stolen from Poloniex - <AUTHOR> https://bitcointalk.org/index.php?topic=499580 <comment><USER4> I made a comment on an earlier thread about the security properties of hot/cold wallet and the security properties of separating the matching and settlement systems. ([https://news.ycombinator.com/item?id=7340505](https://news.ycombinator.com/item?id=7340505)) This incident is an example of the Bitcoin community's best practices "working." They lost 12.3% rather than 100%. That's actually a considerable accomplishment in Bitcoin, but not a success condition for most people who deal with money.

If they had the settlement processed asynchronously on a different system, likely with human interaction, they'd be able to say "Hmm, it seems like account #944325 has convinced us to schedule a withdraw of $250,000 more money than he has on deposit. Well that would be a really bad idea, now wouldn't it. Denied. Now I think I'll sip a cocoa while leisurely planning my review of our withdraw scheduling code."

<comment><USER5> This is the most fascinating part of the Bitcoin story: watching a group of people who are philosophically opposed to most elements of the modern economy discover, one by one, why all those elements exist.

<comment> kot-behemoth I wonder if perhaps a similar thing is going to happen to the meal replacement products, such as Soylent and Ambro and others. Maybe in their attempt to "hack" human nutrition they, too, will rediscover why human nutrition research exists. Except perhaps with more serious consequences involving health issues.

<comment><USER6> I can't _wait_ for the marketing copy that will go out when Uber starts a jitney or a city bus line.

</comment></comment></comment></comment><comment><USER7> I know everyone is gleefully using the failure of three poorly-coded Bitcoin exchanges to crow about the many wonders of regulations.

However, has anyone stopped to ask _why_ so many exchanges are poorly-coded? No, it's not because everyone in Bitcoin adores PHP. I've met some of the most capable coders among cryptocurrency enthusiasts. Go check out Conformal's btcd, or any of Jeff Garzik or Warren Togami's projects, or the amazing talents of the Bitcoin core dev team. (If you decide to denigrate the abilities of any of these Bitcoin/cryptocurrency developers in a response, please be sure to include a link to your own github)

No, it's not because there's no talent. Rather, it's because nobody who is competent in the Bitcoin world is willing to risk their hides or the welfare of their families on something they know the authorities will eventually crack down on. You see, competent people actually learn about the space, and the relevant regulations before jumping in. And they understand that -- absent several million in start-up funding -- there is no way to legally open an exchange at this point.

So by process of elimination, the only ones left to open exchanges are either scammers, or ignorant, incompetent coders who can barely code up a PHP site, or a very few brave, mostly-competent individuals who have the money and lawyers to at least (hopefully!) keep them out of jail when the inevitable crackdown occurs.

I know personally of several extremely competent entrepreneur-developers who have abandoned Bitcoin projects out of regulatory concerns. And I'm sure that's just a small sample.

So that's the reason for the prevalence of poor coders among Bitcoin exchanges. Your solution to this problem will of course be a function of your worldview.

<comment><USER8> My suspicion is that simply removing barriers to entry for more cautious folks would not effectively resolve this sort of problem. Methodical people who take their time in engineering ironclad software systems backed by rock-solid accounting practices don't get first mover advantage, and they might not have bottom lines capable of supporting the kind of fee structures that would allow them to compete effectively with faster, sloppier businesses.

An unstated major premise of the "wonders of regulations" argument is that regulations exist because sometimes the hand of government is needed to handle situations where the invisible hand is a demonstrable failure.

<comment><USER7> Perhaps, in the case of the _most_ cautious developers. But right now, I'd be happy with just _competent_ developers.

And to me, at least, it's pretty clear why competent, responsible developers are not participating in this space -- we're too frightened by possible government sanctions.

<comment><USER9> > And to me, at least, it's pretty clear why competent, responsible developers > are not participating in this space -- we're too frightened by possible > government sanctions.

I don't think that's clear at all.

In fact I think bunderbunder has it right. Those who make the best products will require a large enough expense for formal design, implementation, secure hardware acquisition, physical security (i.e. no simply running your exchange on someone else's cloud without a lot of oversight), the _works_. This requires tons of _time_ and _resource investment_.

Because if any part of that chain is improperly coded, designed, implemented, etc. it will eventually be exploited and you'll be no better than the Poloniex type exchanges of the world.

In the meantime there will be those "incompetent" developers you mention with a shipping product already on the market. And theirs will be much cheaper as they don't need to devote "Space Shuttle computer software" levels of development design and implementation effort. So you'll be both late to market and more expensive.

If you're talking about financial security here then you effectively need to be building a Bentley instead of a Pinto. But you'll be competing in that unregulated market with Pintos with a consumer base full of people willing to take the risk of driving in a Pinto instead of a Bentley they can't afford anyways.

And this has nothing to do with the government yet, either sanctions or regulations.

In fact this type of "tragedy of the commons" is exactly why there is government regulation. They help ameliorate the inevitable "race to the bottom" by artificially limiting where the bottom may be.

But government regulation probably won't help too much here since you can always run your exchange out of a country that doesn't care and people can make their transactions with whatever identity they wish.

Who knows, maybe the industry will self-create and self-adopt appropriate regulation as a market differentiator. But that still would open the question of who does the enforcement; if competitors discover their competition isn't actually following the regs then they'd be forced to "streamline" themselves and then the whole thing goes to pot again.

<comment><USER7> But here's where I disagree with you: it costs literally millions of dollars to get the needed state money licenses to legally operate a Bitcoin exchange[1]. FinCEN has been very explicit that they consider Bitcoin exchanges to be money transmitters.

So those millions are money that could go toward building the infrastructure you describe. Bitcoin companies like Coinbase who have finished their Series A have to spend their runway on licenses instead of developers or infrastructure.

It's a huge problem, whether or not people are willing to admit it.

But thank you for arguing in a rational and non-bullying/non-contemptuous manner.

1\. [http://payment-systems.quora.com/The-Money-Transmitter- Licen...](http://payment-systems.quora.com/The-Money-Transmitter-License- Dilemma)

<comment><USER9> Well as long as the cost is fairly applied to new entrants then I don't see that as being problematic per se (as after all, any new entrant will have to deal with the same selectivity). In fact that's practically the point, to ensure that the "fly by night" Bitcoin exchange shops that couldn't survive a theft of 50 Bitcoins without going under don't actually make it into legit business.

Yes, this is unfortunate for those devs out there who could solve the problem of making a good Bitcoin exchange if only the cost-of-entry were cheaper, but that happens in tons of other industries too (and not always due to the government), and it already has an answer.

</comment></comment></comment></comment></comment></comment><comment><USER10> "the auditing and security features were not explicitly looking for negative balances".

WTF, who are these clowns that purport to be running the equivalent of a bank?

It's like everyone running a BTC exchange either is corrupt or slept through the part of Databases 101 where they explained "this is why transactions are important, here is banking as an example". Seems likely both.

<comment><USER11> I think it's just the rush to be first on the scene and capture the perceived network advantages that arise from being first. These are MVP's.

<comment><USER8> I think we're seeing now that they're actually just MPs.

<comment><USER12> If the V stands for "good enough to get people to pay you," then you have to admit that this product had it.

</comment></comment></comment></comment><comment><USER13> Gosh, it would be nice to have some sort of assurance that the group holding on to my monetary reserves met some sort of minimum level of competency in dealing with quantities of currency. Or, lacking competency, some guarantee that any bank screw-up wouldn't result in loss of funds from my account...I wonder why no one has thought of this before?

Oh, wait...

Seriously, if I was an economics or law professor today, I don't think I could come up with a better classroom to teach financial regulation than the mess that is the Bitcoin economy.

<comment><USER14> A percent of every card transaction goes to cover system's losses on fraud. There's value in the costs being predictable, stated up front, etc, but it's not fundamentally different.

<comment><USER15> IMO that predictability makes it fundamentally different. I can handle a regular 2% fee, but I can't really handle a sizable chance that I'll be completely wiped out.

<comment><USER13> Exactly! I know how to fire a gun, tie a tourniquet, extinguish a structure fire, and set aside an emergency fund. I also know that paying someone else to relieve me of having to worry about these things is money well spent. You call it regulation, I call it peace of mind.

</comment></comment></comment></comment><comment><USER16> "We fucked up, so we're deducting the losses from everybody's accounts so that people don't immediately withdraw all their money."

If my bank sent me this notice, the FIRST thing I'd do is withdraw all my money - there's every chance it may be "an absolute necessity" to steal more of it at any time...

<comment><USER17> Happens all the time [http://en.wikipedia.org/wiki/2012%E2%80%9313_Cypriot_financi...](http://en.wikipedia.org/wiki/2012%E2%80%9313_Cypriot_financial_crisis)

<comment><USER18> Those things are called crises because they actually happen quite rarely. When such episodes become a regular occurrence people tend to abandon the system in question.

I keep seeing this attitude among Bitcoin fans. Of course, there have been many financial crises with regular currencies and banking systems. But that doesn't mean they're the norm. When you look at the number of crisis against the number of different financial systems and years-without-a-crisis it's obvious that they're exceptional. Sadly, the number of Bitcoin shocks seems to be increasing linearly with scale.

I don't think this is inherent so much as a problem of overconfidence and magical thinking. Right now Bitcoin service providers (in the aggregate) are like builders whose structures catch fire distressingly frequently, but who excuse this by pointing to famous fires of the past. The fact that fires have historically been a problem doesn't mean fire codes are useless; quite the opposite, in fact.

<comment><USER17> I agree that most Bitcoin service providers are total bullshit. Satoshi does backflips to create a decentralized system, and the first thing these idiots do it to try to centralize it in all sorts of ways. If the people doing the transaction can agree on a trusted 3rd party, then you don't need Bitcoin. But credit card fraud happens every day, large bankruptcies happen every year, and sovereign default happens every decade, because _people_ are unreliable.

<comment><USER18> You're quite right, but we should view the incidence of fraud, bankruptcy, and default in the context of the economy within which they take place. Like there may be thousands of credit card fraud attempts every day within the US, but the number is fairly insignificant compared to the number of legitimate transactions by honest users. Likewise there are a few bank failures every month, but institutional failures where large chunks of depositors' money disappears are fortunately quite rare).

</comment></comment></comment></comment></comment><comment><USER19> Sounds like somebody used an eventually consistent nosql database to handle monetary transactions and discovered why that's a bad idea...

<comment><USER20> Sounds more like he forgot to wrap multiple mutually dependent queries in a transaction. It doesn't require advanced technology to make a mistake.

</comment></comment><comment><USER21> _> If you have 2 BTC, withdraw 10 BTC, and are left with -8 BTC, the software would see that you deposited 2, withdrew 10, and have exactly what you should: -8._

Nice, I wish my bank was so chill about having a negative balance. :)

This reminds me of the early Amazon bug, where you could add negative numbers of items to your cart, and it would credit your account, and then wait for you to ship them the book. ;)

<comment><USER22> My bank is completely OK with that. Most banks probably are. The problem is that then they charge me even more money for it rather than going bankrupt themselves. Talk about a bad response...

</comment></comment><comment><USER23> The comments on the bitcointalk thread are interesting. Here you have a bunch of people who have just lost 12% of their funds _and most of them are totally ok with that_. If you are looking for evidence that bitcoin supporters are driven more by ideological reasons than economical ones, here is a pretty good example.

<comment><USER24> Eh, there's a lot to be suspicious of, but people have gotten locked out of a _portion_ of their funds, with a promise by this guy who they previously trusted to make it up.

Apparently it's only $50,000 ("only"), meaning no individual lost tens of thousands of dollars.

It's unfortunate that this guy being upfront with everyone puts him above average, but it does, so his business will probably continue, such as it is.

</comment></comment><comment><USER25> If BTC is going to survive there needs to be insurance against loss. An FDIC for Crypto.

The exchanges take a cut on every transaction, so Poloniex should have self insured for the first 3% (or what ever their transaction fee is). After all they made that money on the transaction.

They should carry insurance for the rest.

The 12.3% deducted from everyone's account is "wrong" in my view because Poloniex absorbed none of the loss, and kept its cut of the transaction.

The "right" thing in my eyes is for Poloniex to adjust minus their transaction fees.

-Brandon Wirtz (Not a Poloniex customer)

<comment><USER26> A better solution would be for the Bitcoin Foundation (or some other entity) to certify exchanges and online wallets as being compliant with a well defined code of practice and audit them regularly.

Consumers could look for the mark as indicating that the exchange is a well run outfit rather than a bunch of cowboys.

<comment><USER27> That doesn't solve the problem, though: how do you trust that they're able to do a good audit?

(I don't have to trust that my bank can, because my accounts are insured by something that rhymes with "duvvermint".)

</comment></comment></comment><comment><USER28> Look: every startup gets owned up somehow in its first year or so. If you think your company hasn't, I have an adage about the sucker at the poker table for you. I'm not sure how many people on HN really understand this, because every thread I read about Bitcoin companies having security problems features highly-voted comments expressing shock at how bad their security must have been. No: this problem is universal.

The difference between Bitcoin companies and cat sharing companies isn't fly- by-night operational practices (although in some cases, sure).

The difference is that when a cat sharing company gets owned up, you don't hear about it. Only a small subset of security compromises involve password hashes dumped to pastebin. A quiet security incident at a cat sharing company doesn't end that company; they patch the bug, (hopefully) reimage their servers, and get on with their lives.

Even payment companies have incidents. But (perhaps counterintuitively) incidents at payment companies aren't company-ending events. Payment companies don't hold bearer-bonds, for magic cards or anything else, on their servers. Attackers might get a few thousand credit cards out of the rolling transaction feed of a payment company. Why bother? Those attackers can just acquire massive dumps of credit card numbers from major retail compromises. Attackers report flaws to payment companies! They're better off trying to score a $500 payday from a bug bounty than trying to monetize those breakins illegally.

Not so at a Bitcoin company. When Bitcoin companies get owned up, whatever "hot" assets they have get taken. Bitcoin companies aren't stepping stones for attackers the way cat sharing companies sometimes are; they're the intended target.

It bothers me when people caution that Bitcoin companies are scary because they're "targets", because I think the people saying that only grok 75% of what's happening. It's not that Bitcoin companies get owned up because attackers spend more effort targeting them. No. Attackers expend effort on everyone's companies, _and are usually successful_. The difference is what happens after the attacker succeeds.

People considering starting (or funding) Bitcoin companies need to understand this. I feel like there may be a memetic belief that competent security teams can reliably stave off security flaws if they're just careful with two-factor auth and parameterized SQL queries. That meme is false. When you start a new software service, you need to build it on the assumption that you are going to get owned up, if not by a stupid password compromise than by a memory corruption bug deep in V8 or MRI or CPython or nginx that only a few dozen people in the world know about. It is going to happen. If you give custody of cash-equivalents to a startup, you should be doing it with that in mind.

<comment><USER18> _cat sharing companies_

Off-topic, but as someone with too many cats I would like this idea to take off pronto. I could use a full night's sleep.

I'll show myself out.

<comment><USER29> Snapcat: A whole new way to share your cats.

YC '14, here I come.

<comment><USER30> Catsmolo: A social network to share your cat with your local neighbors. Mobile app enables you to browse current inventory or list your cat. Members can up and downvote cats, based on cuteness or difficulty.

SOMOLO FTW

</comment></comment></comment></comment><comment><USER31> Seems to be a recurring theme recently. Evidently too many developers inexperienced in proper security are building these things. You would have thought after everything that has happened so far that people would take a long hard look at their security measures.

<comment><USER32> My (completely pulled out of thin air) opinion is that there is no way that startups populated by young, hip developers can build a proper system for handling money. You need to have a baggage of a thousand bizarre things how these systems can be violated, unless you want to repeat the same mistakes - and that comes with time and experience.

There are literally at least hundred thousand developers who have worked for 20+ years on financial systems - the industry employs a lot of them. If you're going to be storing money of other people, picking up a random such guy - <USER2> completely mediocre, boring one - would at least bring up the many issues that are taken for granted in 'that world' but nonobvious if you're not from the financial industry.

<comment><USER33> Moreover, these things should be built upon the certainty that somebody smarter than you, the coder, might be interested in free money, and that the software _will_ be broken.

Only with that mindset can one build a system that doesn't screw over every legit customer when it happens.

<comment><USER32> Ahh, the default finance mindset is a bit different - first, assume that your own employees, managers, sysadmins and developers would be interested in free money. Design the system, processes, checks and audits according to that - <USER3> it covers most of the precautions against outside hackers as a natural consequence.

If you start a BTC exchange, write half of the initial code yourself, have access to the servers and own the company - then you should ask a simple question: could I myself steal funds undetected? If you're an investor, could the CEO/founder steal funds undetected? If the answer is yes, you have work to do.

There are some theft options by privileged people that can't be realistically prevented, but you can make sure that those scenarios would be detected within a day, and thus those privileged people simply wouldn't do it to avoid jail.

<comment><USER33> Even better.

</comment></comment></comment></comment></comment><comment><USER34> The missing link for bitcoin is coverage under something like the Uniform Commercial Code- a system that specifies general principles governing transactions and the framework for their completion and resolution of conflicting claims. Caveat emptor is not a foundation for a currency.In practice bitcoin's very anonymity makes it a more attractive target for theft- bitcoins come pre-fenced. As Patio points out, the bitcoin community is inclined to build magic bullet software that assumes theft can be prevented and policies whereby the victims of theft are shit out of luck as in this case and Mt Gox. For an ordinary good citizen bitcoin is a bet that the people holding the funds are not only honest but the smartest people in the world or at least smarter than all the criminals.

Saying that a company has the most secure bitcoin system in the industry, even after proof it was the case, doesn't change the fundamental design tradeoff in bitcoin. Bitcoin offers anonymous possession in exchange for risk. Because the risk is high relative to normal forms of commercial exchange, bitcoin attracts rational actors for whom the rewards outweigh the risks and the distribution curve of interested parties has a tail that skews criminal.

The missing link for bitcoin is coverage under something like the Uniform Commercial Code- a system that specifies general principles governing transactions and the framework for their completion and resolution of conflicting claims. Caveat emptor is not a solid foundation for a banking system..

<comment><USER35> _In practice bitcoin 's very anonymity makes it a more attractive target for theft_

Also the fact that the people making software seem incompetant when it comes to technology.

<comment><USER24> Eh, I'm not sure they are incompetent. They are, however, swimming in a sea where the slightest mistake is lethal.

Some people see these stories and think "ha, I could do better than that!" Other people see these stories and think "can I really be sure that I haven't made even one fatal mistake?"

All software engineers write bugs. All software engineers write security holes. For most of us, the fatal flaw doesn't irrevocably wipe out a bunch of people's life savings.

<comment><USER36> > _Eh, I 'm not sure they are incompetent._

Some of these guys are indisputably incompetent with regard to the software and services they are building. While it's true that all software can have bugs, these are extraordinarily unsophisticated attacks that any non-hacker can exploit by, say, refreshing his browser in rapid succession.

That is, there is a sliding scale with regard to the level of competence imputed to, say, a certain _type_ of bug. And, this wasn't a simple coding error (which, can be more easily forgiven). This was a fundamental oversight in the overall approach to the software, with regard to a critical operation. And it involves such basic concepts as transactions and race conditions. While eliminating the latter can be difficult to get right, it appears that they didn't even consider the fact that they could occur.

I am one of the guys in your group who thinks "have I considered everything?" In fact, I would be inclined to believe that I haven't. Perhaps that's pessimism or just realism, given what I've seen from determined hackers attacking my business over the years. So, I can certainly give a pass to oversights or errors. But, at a certain point, the nature of some oversights or errors are indicative of the fact that the developer(s) are not competent, at least with regard to the domain.

</comment></comment></comment></comment><comment><USER37> X-Powered-By:PHP/5.5.9-1+sury.org~precise+1

Mt. Gox, Flexcoin, and Poloniex. What do they all have in common? It's not what you think. (:

<comment><USER38> What they have in common: they deal in Bitcoins, they're not banks, they have a "o" and an "x" in their name.

Now if you're trying to bash PHP (or Ubuntu?) for banking software that does not take an exclusive lock on rows it reads then modifies and a daemon that does not check balances on withdrawal, try again.

<comment><USER39> What if you're trying to bash the likely competence of people who, when deciding to write a bank, decide that PHP is the best tool for the job.

To make that decision requires that you be insane, or don't know any other tools.

<comment><USER40> There's nothing wrong with that decision up to the point where you start handling the money - beyond that point I agree with you.

Setting up a _website_ which is secure and not vulnerable to SQL injection or basic BS is quite doable in PHP.

</comment></comment></comment></comment><comment><USER24> _The hacker discovered that if you place several withdrawals all in practically the same instant, they will get processed at more or less the same time. This will result in a negative balance, but valid insertions into the database, which then get picked up by the withdrawal daemon._

When I was a kid I imagined that banks were incredibly vulnerable to this.

Later I discovered transactions and thought my kid-self was just silly.

I've learned that my kid-self understood things pretty well, sometimes.

</comment><comment><USER41> It's the same kind of exploit that plagued many web games in the past; it's just something most programmers do wrong, because it's not a requirement in most cases.

</comment><comment><USER36> It's good that these guys appear to be very transparent and accept full responsibility for their error.

But, this is an outlandishly amateurish oversight. Race conditions and atomicity where balance-affecting transactions are concerned would seem to be one of the first considerations that pops to mind. That, along with sanity checks just before final execution of the transaction.

It's clear that there are a lot of people building exchanges with little to no experience in the financial/transactional software field. But, I am beginning to wonder how much experience they have building _any_ software.

</comment><comment><USER42> Who in the heck is writing this stuff? Are they just hacking together crappy sites in an effort to get things running as soon as possible?

Bitcoin isn't going anywhere until the people who trade in it approach competence.

</comment><comment><USER43> Let's not suggest this is just a race condition. Sure, it's a race condition, but whats the maximum damage you can do? c * your current balance, where c is a low number (10 is a very optimistic guess), since at some point the race concludes and you can't exploit it further.

But apparently they didn't even check or put a proper constraint into the database that your balance should be positive (and if you do find a negative balance, shut the system and investigate). Now that's not a "pretty stupid race condition", it's reckless.

</comment><comment><USER44> Dang it people. Race conditions. Security.

I know it's not easy but it is important to get it right.

<comment><USER45> Seriously. I thought this bit of code from the MtGox leak was interesting. Sure looks like a potential double-spend race condition:

      $out = \DB::DAO('Money_Bitcoin_Block_Tx_Out')->searchOne(array('Hash' => $bean->Hash, 'N' => $bean->N));
      if ($out) {
          if ($out->Claimed == 'Y') {
              $bean->Available = 'N';
              $bean->commit();
              continue;
          }
      }

What if someone else claims $out between the read and commit? Is no one at BTC exchanges really asking these kinds of questions?

</comment></comment><comment><USER46> On the plus side, Bitcoin isn't regulated like a nation-state's currency, and the vast bulk of fiduciary institution law that nations have doesn't apply (or simply isn't applied) to Bitcoin exchanges. So when a mistake like this happens, nobody has to go to jail.

On the minus side, $50,000 of innocent people's money just got stolen, and nobody is going to jail.

</comment><comment><USER47> I don't understand how so many people in that thread can be OK with this happening. Saying "at least you didn't lie to us" when your money is stolen is hilarious. I'd rather keep my money under my mattress than use bitcoin for anything right now.

</comment><comment><USER48> _The major problem here is that the auditing and security features were not explicitly looking for negative balances. They add deposits and withdrawals and check that accounts are in balance. If you have 2 BTC, withdraw 10 BTC, and are left with -8 BTC, the software would see that you deposited 2, withdrew 10, and have exactly what you should: -8.

Another design flaw is that withdrawals should be queued at every step of the way. This could not have happened if withdrawals requests were processed sequentially instead of simultaneously._

Oops!

</comment><comment><USER49> As some one who's almost entirely oblivious to the trappings of cryptocurrency... is it not possible to trade on sites like this with a local wallet? Or do you have to keep a balance with them separate from your wallet?

It's invalid logic to assume that because some bitcoin sites have been hacked, all of them will be, but at this point it seems pretty clear the entire community needs to be a little more careful. Until that happens I don't think keeping a balance with a service like this makes sense.

<comment><USER15> They need to have your money before they can execute a trade from you, otherwise they're opening themselves up for significant fraud. If it's trade- then-send, I could sell some bitcoin, then wait a few minutes to see whether the price went up or down before I send them. If the price went up, just refuse to send the bitcoin, and execute a new sale at the higher price.

You can certainly put money in right before you execute a trade, and pull it back out right after. But that introduces significant lag, up to an hour for bitcoin, depending on how many confirmations you wait for, and several days for USD.

That said, I don't understand why people keep significant balances in these places. Keep a small amount to trade with and save the rest yourself!

<comment><USER49> _That said, I don 't understand why people keep significant balances in these places. Keep a small amount to trade with and save the rest yourself!_

Yeah, that's what I mean.

 _You can certainly put money in right before you execute a trade, and pull it back out right after. But that introduces significant lag, up to an hour for bitcoin, depending on how many confirmations you wait for, and several days for USD._

Thanks, that's definitely something to consider. I can see it being very inconvenient, though I still agree that the idea of keeping a balance larger than your trade volume in a service like this is hard to fathom.

<comment><USER15> I can only guess that people have become so used to solid financial institutions that present little risk for deposited money. Even non-FDIC institutions, like stock brokerages, usually have extremely low risk for deposited cash. If you're thinking like that, why _not_ let them hold onto it? It's less effort. Of course, we see the answer to "why not?" here.

</comment></comment></comment></comment><comment><USER50> I am only so familiar with Bitcoin, but why not have an additional wallet per user of the exchange? That way its not possible to exceed the funds of that wallet.

<comment><USER51> Then each trade takes 10 minutes. Check out Coinkite if you like this kind of architecture.

</comment></comment><comment><USER52> Hold on, did anyone read their proposed "solution"?

"Right now, all markets and withdrawals are still frozen, and they will remain that way until the _negative balance watcher is written and in place_ and balance deductions are calculated."

A "negative balance watcher" sounds like a horrible idea. Isn't this a solved problem? Atomic database transactions.

Does not inspire confidence.

</comment><comment><USER53> "not looking for negative balances." If this caused the problem here, this shows that this is just the tip of the iceberg. Someone should start an open source project for BTC Exchange's back-end.

<comment><USER54> Buttercoin did that. Then they decided to go closed source and do a traditional exchange.

[https://github.com/buttercoin](https://github.com/buttercoin)

</comment></comment><comment><USER55> Can some of these exchanges get together and create an open source exchange framework?

</comment><comment><USER56> Someone's never heard of unit tests.</comment>


Is HabitRPG NSFW? Here's a trick to make it more SFW - <AUTHOR> http://rjsteinert.github.io/#!make-habitrpg-safe-for-work.md

<comment><USER2> It's built in - go to [https://habitrpg.com/#/options/settings/settings](https://habitrpg.com/#/options/settings/settings) and uncheck "Show Header"

<comment><AUTHOR> Nice! I didn't notice that setting. My code also removes more than just the header though so it's still useful for my purposes of making HabitRPG more SFW.

</comment></comment><comment> n-gauge You need ;void 0 on the end of your bookmarklet to avoid the redirect :)

<comment><AUTHOR> w00t! That fixed it. Thanks n-gauge!</comment></comment>


Tom and Jerry: 80 years of cat vs. mouse - <AUTHOR> https://www.bbc.co.uk/news/world-us-canada-51357832 <comment><USER3> > "I think most people can identify with little Jerry because there's always > an oppressor in our lives," he says.

As a child I sided with Jerry, but as I grew older I've come to a different conclusion: _Jerry is a jerk_

In nearly every episode he is the instigator and Tom simply wants to be left alone. He'll be sleeping or trying seduce Toodles, and Jerry will come and steal his food, wake him up, or mess up his chances. There is only a handful of episodes where Tom directly starts the confrontation.

The life lesson is that in a David v Goliath situation, it's not always the big guy in the wrong.

<comment><USER4> > Jerry is a jerk

Haha, indeed. They have a few episodes (maybe two or three) in which Tom wins in the end. I loved those.

</comment></comment><comment><USER5> I clearly remember one sequence from Tom & Jerry I watched while waiting for a plane in London (I guess because of the violence it must be one of the originals?):

* The neighbor's bulldog is chained up.

* Tom figures out how long the chain extends and draws a line on the ground there.

* Tom taunts the bulldog and the bulldog runs to the end of his chain.

* Tom uses the dog's blurred biting and scratching motions to carve a bat out of a 2x4.

* Tom beats him over the head with the bat.

* Then Jerry secretly erases the line and redraws it closer to the dog.

* Tom taunts the dog again and this time the dog jumps right into his lap.

* Tom literally leaps out of his skin, which the dog holds like a coat and hands back to him.

If anyone knows the name of this episode I would be much obliged since it may be the funniest thing I've ever seen on television.

<comment><USER6> Around the 1.30min mark: [https://www.youtube.com/watch?v=1uNDQOCgOT8](https://www.youtube.com/watch?v=1uNDQOCgOT8)

</comment></comment><comment><USER7> My favorite Tom and Jerry is episode from 1964 produced by Chuck Jones where Tom is a famous baritone singing "Figaro!":

[https://en.wikipedia.org/wiki/The_Cat_Above_and_the_Mouse_Be...](https://en.wikipedia.org/wiki/The_Cat_Above_and_the_Mouse_Below)

A YouTube clip:

[https://www.youtube.com/watch?v=gdVUdB1PjmQ](https://www.youtube.com/watch?v=gdVUdB1PjmQ)

</comment><comment><USER8> To call a cartoon racist based on a minor character that barely appears in some episodes is ridiculous. Just about every show back then that had non white people was racist. The whole society was racist, just as it is now. Frankly, it's ludicrous to focus on such a small, mostly irrelevant part of the show in light of the context.

<comment><USER9> Cartoons are typically put in front of kids without any context. If you're going to show them without cutting the stuff that was okay in the 1940s but won't fly in the 2020s, then you had damn well better surround it with context, and mark it as something kids shouldn't be watching by themselves. What's a six year old kid now gonna know about the forties? Nothing, that's what. They're gonna see gags from a time when we were _actively_ engaged in constructing negative stereotypes of the Axis powers and when second-hand caricatures of minstrel shows was the only way anyone knew how to draw black people and just assume that's what those people are like.

I love the medium, I trained to work in it. I have watched a _lot_ of old cartoons. There is some stunning work by masters of the form at the peak of their powers that is also incredibly racist by today's standards; it's worth preserving this work, but Cartoons Are For Kids, and if something needs context you have to _scream_ about this to keep distracted parents from just putting it on for their kids.

<comment><USER8> Ah, the old save the kids argument. You think kids are that stupid? You really underestimate them. I was watching these cartoons when I was young and I didn't become a racist piece of shit. This was in a country that is almost completely white, where most people are actually racist. But hell, if Tom and Jerry are what's making America racist, let's ban that shit. Maybe we can ban the confederate flag while we're at it too. Oh wait, not that's racism disguised as "heritage." Don't ban that. They're still flying the swastika in Berlin right?

<comment><USER9> Darling, I grew up in the American South with old cartoons on TV and managed to not be a racist asshole too.

I'm not saying watching Mammy Two-Shoes shuck and jive her way through a couple of setups for Tom and Jerry to engage in a few minutes of slapstick comedy is going to turn you racist. I'm saying that times have changed and that stuff falls flat now, and that no matter how hard people campaign for animation as a medium appropriate for adults, there are still a lot of people who think that _any_ animation is appropriate to plop unsupervised kids in front of, and is it such a terrible idea to mark some old cartoons as Not To Be Watched Without Context?

Is "making it hard to acquire eighty year old cartoons that get really racist is a terrible idea" really a hill you wanna die on?

And, yes, I am all for banning the Confederate flag. Assholes would find new symbols to rally around, but depriving them of the ability to call it "tradition" sure won't help their cause.

<comment><USER8> If it doesn't negatively affect kids, as you say, then why not let them watch it? Also assuming children know nothing about their history and culture to provide their own context seems a bit presumptive, especially for the older kids that would be watching. I don't buy this idea that kids are completely ignorant of their culture and history. Not to mention that the mammy character is so small and minor, it's almost irrelevant to the show.

</comment></comment></comment></comment></comment><comment><USER10> When I was a kid, Looney Tunes felt like home and Tom and Jerry felt like a slightly flat off-brand. I say this not to judge their fans or even the cartoons themselves, but I'm curious if "Tom and Jerry" people come from different regions of the country or world, different cultures, or different socio-economic backgrounds (I grew up poor and quasi-Catholic, splitting my time between Florida and the rust belt).

On the other hand, the article makes it seem like Tom and Jerry came about as a desperate bid to have something as lucrative as Looney Tunes or Disney, so maybe my impression is right on?

<comment><USER11> I visited Moscow years ago (2011, IIRC). Visited an 'American' diner - <USER2> really for tourists, but more of a place for locals. Kinda like a cross between Arnold's from Happy Days and a Denny's, but darker (I mean... low lit). I think the waitresses were on roller skates(?), and it was 24/7.

There were multiple monitors showing silent Tom and Jerry cartoons. No one was particularly _watching_ , they were just ... on. I was told that T&J was sort of a 'thing' in Russia, but I wasn't there long enough (and didn't speak enough Russian) to ask much about it. What struck me, which I hadn't really realized as a kid, is that... it's basically silent anyway - there's no talking/voice, it's just antics, with music. Maybe there were some episodes later where they talked, but none I can remember. Very different from the Looney Tunes where the voices were half the fun. Still love me a good... I say I still love me a good Foghorn Leghorn voice.

<comment><USER12> The non-talking was a big advantage for us non-native English speaking kids; it meant we could enjoy them fully in their native versions.

In fact, my favourite Looney Tunes cartoon was always Roadrunner vs Coyote, for the same reason.

<comment><USER11> спасибо :)

<comment><USER12> Oh, I'm not actually Russian, just from another non-English speaking nation :)

</comment></comment></comment></comment></comment><comment><USER13> > A new version of the show, animated by flash instead of being hand-drawn, > has been broadcast since 2014.

I always wondered what animation technology was used in these new episodes. Apparently Adobe's Flash Animation was used for many cartoon series:

[https://en.m.wikipedia.org/wiki/List_of_Flash_animated_telev...](https://en.m.wikipedia.org/wiki/List_of_Flash_animated_television_series)

</comment><comment><USER14> Tom and Jerry is one of my favorite cartoons and I still watch them once in a while.

> When their department was closed down in 1957, Hanna and Barbera set up > their own production company.

> But only a few years later, MGM decided to revive Tom and Jerry without its > original creators. In 1961 they outsourced to a studio in Prague to save on > costs. Chicago-born animator Gene Deitch was tasked with heading the remake, > but struggled with a tight budget and staff with no knowledge of the > original.

> His studio also secretly made episodes of other cartoons, including Popeye. > Czech names were Americanised on the credits to stop viewers associating the > shows with Communism.

So much in here. I hope we also remember these instances when we talk about copyright, trademark or stealing IP.

<comment><USER9> The stuff Deitch did in Prague was all above-board with respect to IP ownership. The secret was just that it was made in Czechoslovakia instead of the US.

</comment></comment><comment><USER15> I suspect Tom and Jerry are the inspiration behind their modern equivalents, Itchy and Scratchy.

I like both.</comment>


Reading at Work, A Clever Flash Program - <AUTHOR> http://www.readatwork.com/

<comment><USER2> Okay, it's pretty much not something that is going to help production, but it's very, very clever. Nice work.

</comment><comment><USER3> With the economy in shambles I hope people are actually doing work in the office rather than wasting time and money. Clever app though.

<comment><USER4> Some people's relationship with their employer is so transactional that they will do only the bare minimum to not get fired. This is a good site for them.

<comment><USER3> If the economy did not suck I suppose they could find another job or save money and build a startup. Seems a bit too risky in these times though.

</comment></comment></comment><comment><USER5> Doesn't seem to work on my Mac; clicking on the icons just makes them jump around.

<comment><USER6> Double-click.</comment></comment>


Sound project management practice to make developers fix bugs "off the clock"? - <AUTHOR> http://pm.stackexchange.com/questions/18771/is-it-sound-project-management-practice-to-make-software-engineers-fix-bugs-off <comment><AUTHOR> OP here: Where does this sort of thing still happen??? (Having developers fix bugs on their own time i.e. for free.)

<comment><USER2> Nowhere with sane management.</comment></comment>


A Modern Space Cadet (2012) - <AUTHOR> https://stevelosh.com/blog/2012/10/a-modern-space-cadet/ <comment><USER2> Since it wasn't obvious to me (I thought it was more space related, eg, Heinlein's "Space Cadet") - the term here refers to the Space Cadet Keyboard.</comment>


Ask HN: Have you rejected an offer to work on a project because of self-doubt? - <AUTHOR> Hi, I'm a third year CS student. I have been coding for a little over two years. I have worked on a few side projects.
Recently,more than once I was approached  by people who wanted me to help implement their projects. But I have always refused just because I think I'm not good enough.<p>So, I wanted to ask the HN community: have you ever done that? how do you deal with self-doubt? Thank you! <comment><USER3> > more than once I was approached by people who wanted me to help implement > their projects. But I have always refused just because I think I'm not good > enough. [...] have you ever done that?

Absolutely. I'd say that 90% of the time that I've been offered consulting work, I've turned it down because I know it would require some skills -- web design, graphics, SQL, linux, ruby, C++, etc. -- which I know I don't have.

I have a reputation for being very good at what I do, and it is certainly true that there are some things I am very good at... but a large part of that is that I don't do the things which I'm not very good at.

> how do you deal with self-doubt?

If you're a generalist, there's almost certainly going to be someone else who is a better generalist than you. If you specialize, it's not hard to find a niche in which you are one of the leading experts in the world -- because the group you're being compared against is losing the 99.9999% of people who never looked at that particular niche. So I'd recommend looking for a niche; because once you're the world's leading expert on something, it's pretty hard to doubt your competence in that area.

<comment><USER4> This so much.

While I love to learn new things I do so on my own time.

My clients only ever see the expert because I only ever agree to do things that I know I can do better than almost anyone else they can hire.

This is in my opinion one of the most important things in building a successful consulting reputation.

If you choose your niche well you will never need to look outside of it until you have ramped up your skills for your next specialisation.

<comment><USER5> _> If you choose your niche well you will never need to look outside of it until you have ramped up your skills for your next specialisation._

... or until your niche dies out. This is my situation at the moment: my niche is very profitable but likely on its way out in a year or two. Related fields are either very boring or much less profitable. If I had stuck to a more generalist career, I'd have made less money for a few years, but maybe my employment would have been a bit more secure in the long run.

Ah, the vagaries of IT life...

</comment></comment></comment><comment><USER6> I've definitely had self doubt, and have turned down projects because of it. However, as I got more and more experience, I realized, I probably should have taken on those projects. The project owners (sometimes) would have been better off had I taken the project instead of them going with somebody unreliable who thought they new it all.

What I would suggest, which is pretty much what I did, is to take projects where you 1) feel like you can add more than just your code 2) pick projects you think you'll learn from, 3) pad your deadline significantly.

There is no shame in letting the project manager know that you want to take some extra time to make sure you're doing the best job, or getting the most benefit of learning from the project. If the project is with a larger company, maybe you can even get feedback from a more senior dev as you go along.

I had one contract with a larger company, where I really thought I was in over my head, and I thought their CTO would either give me helpful advice when he reviewed my code, or would dump all over it. He took a look at the code, and basically just said "yeah, looks fine", which didn't really help me at all. Looking back on that project only months later, I know I would have done it differently, but they were happy with the end result, and that is really the most important thing. Can you make them happy with what you can do, and can you grow from it.

I also think a bit of self-doubt is healthy, I think the sign of a bad developer is one who thinks they are at the top of their game.

</comment><comment><USER7> What about thinking of it in terms of risk / reward. Say in the (unlikely case) you completely fail to deliver... does it matter? Are they paying you? Can you structure the project so that you can do lots of small iterations and continually give them something which is useful?

On the plus side if you pull it off, which is probably more likely if you've been coding for a couple of years and have side projects already, then you'll have a public project to your name, and you'll learn heaps just through the process.

As for how I personally deal with self doubt. Badly ;) have heaps of it and find giving advice far easier than taking my own. I mean you'll never know unless you try right, and the only way to get better is to try & fail & get better a bunch of times. One book you may enjoy (short read) is called mindset: [http://www.amazon.com/Mindset-The-New-Psychology- Success/dp/...](http://www.amazon.com/Mindset-The-New-Psychology- Success/dp/0345472322/)

Good luck, and I say give it a go.

<comment><USER8> This exactly. It's good to have _some_ doubts but at the end of the day you learn a lot by simply trying, regardless of success or failure.

I think it's very important though, that you learn to accept criticism. Learning from constructive criticism is key to improving.

</comment></comment><comment><USER9> Sounds like classic imposter syndrome. I've dealt with it at times myself. The best cure I've found is taking on a tough task, breaking it down to more manageable chunks, and completing them. Even after completing some tough projects, I still feel the fear grip me. I took a new job recently that required working with an unfamiliar framework and design patterns. Early on, I kept running into road blocks and thought for sure that everyone would think I couldn't hack it. Turns out everyone was actually impressed that I was picking up on things quickly. Just because you perceive something, doesn't mean others perceive it the same way. Go for it, and ask for feedback early (just don't get too hurt if they have something negative/constructive to say. Remember you can't be perfect)

</comment><comment><USER10> I have considered not accepting every job I've had since graduating college 10 years ago for this exact reason, and I have ended up being one of the top performers at each of those jobs, which has led to better job opportunities, each of which I don't believe I'm qualified for.

One thing you have to accept is that you will never know everything, and that's okay. One of the most important skills you can have is the ability to communicate effectively. Customers and coworkers don't expect you to know everything, and when you tell them that you are weak in some area and want to have your expert friend/coworker assist because you want to make sure you get this completed correctly for them, they see you not as an expert on all things, but instead they see you as something much more valuable: someone who they can trust to get the job done correctly.

There is value in knowing your limitations. If you know you can't complete a job on your own, and you can't line up the right people to assist you, then it's a wise move to pass. Like the important/unimportant-urgent/nonurgent quadrants (from the 7 Habits book), there are the competent/incompetent- secure/insecure quadrants which let me say that I am completely incompetent when it comes to brain surgery, and I am not the least bit insecure about it. I am also very competent at my job, but ironically I am somewhat insecure about my ability to do that job.

I am a generalist in my field, and I think part of the tradeoff is, there are always people around me who know more than me in some areas, but in return, I always know I can get a new job in about a day. If you take the generalist path, it's important not to get into adversarial pissing matches with the specialists. Win them over as friends and it's of mutual benefit. As a generalist you have exposure to more opportunities, which you can throw their way, and they will be glad to help you when needed. And by "help you", I mean paying them to help you (usually).

</comment><comment><USER11> I got hired straight out of college to build a credit card processing system. I had NO idea what I was doing. I was copy/pasting code out of the Stevens Unix/Networking books and working 100 hours a week. This security flaw: [http://seclists.org/bugtraq/1997/Nov/58](http://seclists.org/bugtraq/1997/Nov/58) happened and I remember patching it and shipping a new version while the entire C level staff of a publicly traded company was standing behind my desk.

Yeah, it was stressful. I learned a lot though, not just from the coding under fire, but from that experience AND the aftermath (after the company tanked, you talk to the same C level guys and realize they appreciated the effort and many of them are good friends still).

I want to be coding and building stuff for the rest of my life. If you find it fun and enjoyable now, you'll always have people asking you to build stuff. And then the business side can take over (like... is this a good idea or not) but to be honest you don't even have to worry about that either, because it's not your problem. Code stuff, build stuff.

</comment><comment><USER12> I've been transparent about the lines between my competencies and what i know more in theory. For me that kind of granularity has kind of helped filter offers.but I'm still relatively new in terms of full time employment programming and don't have any institutional instruction to speak of.

</comment><comment><USER13> This is why when you are learning - which is the rest of your life, btw - <USER2> want to try to get involved in projects with a small team of developers, and do your best to do things outside of your current scope.

There is not much time to learn outside of work, and learning from studying is not the same as learning from real production projects. Learn by working with people with other strengths, helping each other.

As for your direct question - yes, there is nothing at all wrong with turning down something if you are sure you understand the skills required, and that you genuinely are not experienced enough. Good idea, actually.

</comment><comment><USER12> I had once early on where i got in over my head. Once i realized it I told them about it. Wasn't fun, but I'm glad for the experience, I learned a lot on many levels.

</comment><comment><USER14> All the time. I do consider taking it on anyway and learning what I need as I go, even if I put in some "unbillable" time though. I usually look into it to see how hard I think it would be to learn what I need to. Over time, you get an intuition for how far in over your head you can go.

I also remind myself that lawyers have no trouble at all billing clients for research into areas of law that they are unfamiliar with.

</comment><comment><USER15> I think you have to distinguish reasonable self-doubt from unreasonable self- doubt. If you genuinely don't have the skills required to do a job, it's reasonable to doubt your capacity to do it. Perhaps ask a friend or tutor who is familiar with your skills to help determine whether you're up to a particular job?

</comment><comment><USER16> I don't know if this is really self doubt, but as a consultant I don't like to take on work in areas where I am not an expert.

I spend lots of my own time learning new technology, but I don't like to accept tasks when I have to spin up while billing time.

As someone else here pointed out, it is very nice to be well known in technology niches.

</comment><comment><USER17> Never. You should try it. Admit you don't have the skills when you tried out and failed. Or get the skills right in the moment when you need them. But NEVER say you don't have the skills for anything.

</comment><comment><USER18> I didn't think I was good enough to do the backend so I applied for an internship doing something else. They later asked me to do the backend and I even taught some people a few things! Just go for it!

</comment><comment><USER19> Impostor syndrome? Most people I know are affected from it.

<comment><USER20> I think the resolution to impostor syndrome is to recognize that you have more things to learn and to try to challenge yourself all the time, and also find a mentor so you can get feedback. If you have a good team or a good manager you should be able to get this kind of help. Your employer can only gain by you getting better, and this kind of motivation for self-improvement is the best kind of attitude to have. Even on the rare and off chance if it somehow turned out you don't have the skills people thought you did, if you have this kind of attitude, you should come out ok.

Also never be afraid of saying "I don't know" or "I don't understand". If someone is explaining something to you, and they mention a concept you aren't familiar with, have the courage to ask them to explain it to you. I have never been criticized for saying "I don't know." In fact it builds trust, credibility and confidence.

</comment></comment><comment><USER21> It depends how much they pay and how tight is the deadline. Actually most of the times I work on stuff I don't know but I want to learn.

</comment><comment><USER22> I've programmed for 14 years and have 8 years of professional experience as a software engineer who is slowly entrenching in his niche -this is my personal philosophy to career management, ymmv:

What has worked for me in dealing with self doubt has been to separate my private self from my professional self when performing self evaluation. The professional self has a specific skillset with regards to the field, a specific capability to finish projects and specific market value. This is my public interface to the job market, my employer, and my co-employees when not at a coffee table, so to speak. I evaluate my situtation professionally with regards to this professional self. This creates certain detachment and alleviates emotional baggage (which I do have).

When figuring out where to professionally head next I evaluate this from the point of view of career risk and career opportunities. Projects are a one way to evolve your professional self, and they include opportunities as well as risks.

Given your situation, I would respectfully suggest a similar strategy in managing risk as with stocks. The risk of failure should come with some comparable advantage, and as you age, reduce the level of percieved risk. Be prepared to accept high risk projects early if they have some obvious percieved advantage to you.

The good part about risky projects is that if chosen correctly, they provide almost always the best benefit to you regardless of their outcome - experience.

There is good risk and bad risk, and you need to learn identify these. Bad risk is usually associated with some classical thedailywtf scenario with all the horrors of legacy software attached. Good risk is associated with scenarios that have some obvious advantage - i.e. usually learning new skills, making connections, and so on.

Reald world risky scenarios are usually a mix of these two.

Unless you are in a really precarious situation I would claim that professionally you are still in a situation where you professinal portfolio can endure quite a lot of risky situations. If you fail now you are just considered a bit wet behind the ears, a decade from now that would labeled as ineptitude.

Most of all, software engineering is a hands on craft. There more varied your experience, the better.

If you have self doubt in a perceived positive risk scenario I would advice you to dive in. But this is important - you must not give up, no matter what, you must finish the project. The result can be as hacky as necessary to fulfill you feature list (don't worry, as you gain experience you will find better ways to solve the specific feature) but it must become complete unless terminated by client. Strive for simple solutions.' Keep it simple stupid' should be your first approach in all scenarios.Complexity will happen any way, no reason why yoy should add any.

Do not burn yourself out. If you do not have the time for a project don't do it.

Like suggested, one way to make yourself a good career is to foster domain specialty in some niche that you perceive has long term traction. Specifically, what this might be, it's really hard to say. Generally, I would suggest to steer away from only specific vendor technologies towards either some abstract yet practical discipline (e.g. cryptography, computer graphics and so on) or a specific real world application domain (sensor software for heart rate monitors, for instance). Which is best for _you_ it is very hard to say.

Trying to find something that everybody around you is not doing and that sounds interesting would probably be a good start.

Declining projects for some perceived opportunity cost that is related to bad risk is a good choice.

How to find your niche? Hard to say-But as an example: The deeper you dig into some specific area, you start to identify the missing pieces , the gray areas and zones where there are lots of obtuse papers and dusty tomes but wikipedia seems strangely bereft of any practical advice despite your acute technical need. In this case you are doing something wrong or you have diacovered a niche.

Try not to fall into a narrow and cushy niche that does not have market value. The individuals who fall into these are called expert beginners. Learn to separate these from the true experts early on, try not to become an expert beginner and you are well set.

</comment><comment><USER23> self doubt will destroy you.</comment>


10 tips for starting entrepreneurs - <AUTHOR> http://www.slideshare.net/netlash/10-tips-for-starting-entrepreneurs-presentation <comment><USER4> I think that #0 should be: "Actually start. Don't just talk; do."

</comment><comment><USER5> Maybe we don't need anymore advices. Advices are what got us in this position in the first; "How to invest for the long term", "How to get the right mortgage", "10 steps to build a web company"......Seriously, let's take a break from this type of advices.

</comment><comment><USER6> Why not the accountant be a family member? I have one that is good, that I trust, and does not charge too much.

<comment><USER7> In my experience family members give overwhelmingly conservative business advice because there's a deeper sense of guilt if things go amiss.

<comment><USER8> In my experience, the problem's often the opposite. With most startups, the accountant's job is to tell you when you're being woefully irresponsible with your cash and are about to fail because of it. That's harsh news to give to a friend.

The first company I worked at had an accountant that was a friend of all 3 founders. She was quite well qualified - Ph.D in accounting, taught at Bentley, had previously worked at several big companies. But she was not comfortable saying "No, we don't have the money for this" when the founders did something stupid, like hiring an expensive engineer sight-unseen from China or delaying the product launch by 6 months while the engineering team pursued a different direction.

We ended up going out of business rather abruptly when a $6M bridge loan from the VCs came due and there was no cash to pay it off. My boss (who was the only member of the management team who wasn't previously friends with the accountant) was incredulous that she could have forgotten that we needed $6M ASAP. Of course, she hadn't forgotten at all. She just wasn't comfortable telling management "Your dreams are about to go up in smoke unless we get more cash quickly and drastically cut expenses." Which is completely understandable in a friend, and completely unforgivable in an accountant.

</comment></comment></comment><comment><USER9> Could someone write down the list? I don't get SlideShare at work.

<comment><USER10> There's a Slideshow Transcript at the bottom of the page. Don't you see it?

<comment><USER11> If the site is blocked... he doesn't.

       1. Slide 1: 10 tips for starting entrepreneurs Titel tekst "So youBeschrijving to build want slide your own business?" Barcamp Ghent 2 - 30/11/2008
       2. Slide 2: Hi, my name is Bart.
       3. Slide 3: I work at webagency Netlash. ... and at a few other companies:
       4. Slide 4: You can find me here: www.ondernemeringent.be www.netlash.com www.metatale.eu www.tagger.fm www.kopjekoffie.be www.planetgadget.be (Yes, that's a lot of www's)
       5. Slide 5: Starting your own business 10 tips from my personal experience
       6. Slide 6: Listen carefully...
       7. Slide 7: * personal experience *
       8. Slide 8: It might not apply to you. Or your business.
       9. Slide 9: My 10 tips
      10. Slide 10: 10 1. Your new best friend 6. 2. 7. 3. 8. 4. 9. 5. 10.
      11. Slide 12: Your accountant
      12. Slide 13: 1. Your new best friend Your accountant Choose him carefully Make sure his office is within a 15 minute drive Do not go for the cheapest!
      13. Slide 14: 1. Your new best friend Your accountant And whatever you do...
      14. Slide 15: 1. Your new best friend Your accountant And whatever you do... Do NOT take a friend or a member of your family as your accountant.
      15. Slide 16: 1. Your new best friend Your accountant And whatever you do... Do NOT take a friend or a member of your family as your accountant. ... Just don't.
      16. Slide 17: 1. Your new best friend By extension Find yourself a good bank manager, and join that bank. The personal relationship with the bank manager is far more important than the brand of bank.
      17. Slide 18: 10 1. Your new best friend 6. 2. Show me the money 7. 3. 8. 4. 9. 5. 10.
      18. Slide 19: Watch your cash-flow
      19. Slide 20: 2. Show me the money Watch your cash-flow No matter how profitable you are, if you run out of cash, it's
      20. Slide 21: 2. Show me the money Watch your cash-flow No matter how profitable you are, if you run out of cash, it's GAME OVER
      21. Slide 22: 2. Show me the money Billing Send out your bills asap Follow them up for payment Be firm but friendly! Ask advances
      22. Slide 23: 2. Show me the money Oh, and should I mention: You HAVE to have a business model.
      23. Slide 24: 10 1. Your new best friend 6. 2. Show me the money 7. 3. Be a 'Mensch' 8. 4. 9. 5. 10.
      24. Slide 25: 3. Be a Mensch Mensch Mensch (Yiddish:  מענטשmentsh) means \"a person of integrity and honor\" http://en.wikipedia.org/wiki/Mensch
      25. Slide 26: Build your rolodex
      26. Slide 27: 3. Be a Mensch Networking Don't network to build business The network of your network is far more important! "Pay it forward"
      27. Slide 28: 10 1. Your new best friend 6. 2. Show me the money 7. 3. Be a 'Mensch' 8. 4. Be easy to work with 9. 5. 10.
      28. Slide 29: Availability
      29. Slide 30: 4. Be easy to work with Availability Answer your phone, answer your e-mail Reply to RFP's within the hour! Be reliable, make good on your promises Communicate often and clearly
      30. Slide 31: 10 1. Your new best friend 6. 2. Show me the money 7. 3. Be a 'Mensch' 8. 4. Be easy to work with 9. 5. Build alliances 10.
      31. Slide 32: Cooperation
      32. Slide 33: 5. Build alliances Cooperation More value-creation through cooperation Share your ideas Be open
      33. Slide 34: 10 1. Your new best friend 6. Get a sparring partner 2. Show me the money 7. 3. Be a 'Mensch' 8. 4. Be easy to work with 9. 5. Build alliances 10.
      34. Slide 35: Sparring partner
      35. Slide 36: 6. Get a sparring partner Get a partner It's very hard to build a bigger business on your own Find an opposite It's like cycling...
      36. Slide 37: 10 1. Your new best friend 6. Get a sparring partner 2. Show me the money 7. Find your niche 3. Be a 'Mensch' 8. 4. Be easy to work with 9. 5. Build alliances 10.
      37. Slide 38: Say No!
      38. Slide 39: 7. Find your niche Niche Create your own niche, and dominate it "Blue Ocean" It's ok to say No - sometimes it can win you clients! Focus
      39. Slide 40: 10 1. Your new best friend 6. Get a sparring partner 2. Show me the money 7. Find your niche 3. Be a 'Mensch' 8. Set your goals 4. Be easy to work with 9. 5. Build alliances 10.
      40. Slide 41: Don't steer - <USER2>
      41. Slide 42: 8. Set your goals Launch your 'torpedo' Know what you want to be: consultant, entrepreneur or manager Define the numbers
      42. Slide 43: 8. Set your goals SMART Specific Measurable Achievable Relevant Time Framed
      43. Slide 44: 10 1. Your new best friend 6. Get a sparring partner 2. Show me the money 7. Find your niche 3. Be a 'Mensch' 8. Set your goals 4. Be easy to work with 9. Cherish your talents 5. Build alliances 10.
      44. Slide 45: Precious diamonds
      45. Slide 46: 9. Cherish your talents Diamonds Hire people that are smarter than you Hire for diversity Even the biggest diamond has to be cut - push them! Balance your 3P: People - Profit - <USER3>
      46. Slide 47: 10 1. Your new best friend 6. Get a sparring partner 2. Show me the money 7. Find your niche 3. Be a 'Mensch' 8. Set your goals 4. Be easy to work with 9. Cherish your talents 5. Build alliances 10. Follow your passion
      47. Slide 48: You can not outsource passion.
      48. Slide 49: Outsource passion?
      49. Slide 50: You can not outsource passion. (Some people might not agree. Like pimps. And advertising agencies.)
      50. Slide 51: 10. Follow your passion Passion There can only be 1 real drive for entrepreneurship: passion.
      51. Slide 52: 10 1. Your new best friend 6. Get a sparring partner 2. Show me the money 7. Find your niche 3. Be a 'Mensch' 8. Set your goals 4. Be easy to work with 9. Cherish your talents 5. Build alliances 10. Follow your passion
      52. Slide 53: 11. Free extra tip
      53. Slide 54: Your home base
      54. Slide 55: 11. Free extra tip Your home base An entrepreneur can only be succesful if his partner supports his plans. (I can only thank Gudrun, Wolf & Kobe that they do, and love them for it.)
      55. Slide 56: 10 1. Your new best friend 6. Get a sparring partner 2. Show me the money 7. Find your niche 3. Be a 'Mensch' 8. Set your goals 4. Be easy to work with 9. Cherish your talents 5. Build alliances 10. Follow your passion
      56. Slide 57: Start your own business!
      57. Slide 59: Start your own business! It's a rollercoaster, but a fun one.
      58. Slide 60: And remember...
      59. Slide 61: Don't give up.
      60. Slide 62: There's only one difference between an amateur and a professional. The professional is an amateur that did not give up.
      61. Slide 63: Questions?
      62. Slide 64: Bart de Waele email@example.com www.netlash.com www.ondernemeringent.be Barcamp Ghent 2 - 30/11/2008

<comment><USER12>
      Your attempt to be helpful (thank you!) has
      backfired, making everything on the page harder
      to read, at least in FF3, because <PRE> areas
      here don't wrap or clip properly (you eeediot!).

      Of course it's not your fault. News.YC should
      go to a DIV-based, rather than TABLE-based,
      layout so that CSS works more consistently across
      browsers/versions.

      See this comment/thread on the 'Feature Requests'
      perma-story for more detail:

<http://news.ycombinator.com/item?id=235923>

</comment></comment></comment></comment><comment><USER13> A picture of a baby and... "an entrepreneur can only be successful if _his_ partner supports _his_ plans"?

I hate to be the PC nazi, but this strikes me a bit crude...</comment>


Telemetry for Open Source - <AUTHOR> https://alexgaynor.net/2015/sep/03/telemetry-for-open-source/ <comment><USER2> You know what would sell me on that telemetry being okay?

A: Ironclad consent. It doesn't happen unless you opt in, and we don't 'assume' the user is okay with it.

B: The telemetry itself, is also open. A public dashboard of all data collected, complete datasets freely available.

</comment><comment><USER3> Oh, it's bad when MSFT does it, but not vice versa?</comment>


Sheryl Sandberg: I want to address some of the claims that have been made - <AUTHOR> https://www.facebook.com/717545176/posts/10160967443525177/ <comment><USER2> She doesn't address any of the specific facts that investigators found among:

* hiring Republican lobbyists to make a good name for FB

* Sen. Schumer's apparently personal involvement in protecting FB

* the firing of Alex Stamos, who surfaced Russian Inflirtration

This is just another vapid "we're sorry, we promise to do better next time" posts. Completely meaningless... does she really think SV will be fooled by this crap?

<comment><USER3> > * hiring Republican lobbyists to make a good name for FB

??? There's an entire paragraph in her post about that.

> * Sen. Schumer's apparently personal involvement in protecting FB

True, she didn't address that. It doesn't really seem to be one of the major issues people have found offensive.

> * the firing of Alex Stamos, who surfaced Russian Inflirtration

The NYTimes never claimed that Stamos was fired (and, afaik, no reputable source has).

<comment><USER2> A social media company getting the Senate leader of one of the 2 major parties in the US on their side is a huge fucking deal.

The Stamos firing is mentioned prominently in the article. He seems like the only person with the guts to speak truth to power... and he was fired, his career basically ended, for exposing the truth of a foreign Governments malicious interference? Come on man... this is HUGE. The message She sent with Stamos' firing was: if you get in the way of our growth, we will git ya. And she hasn't addressed that in this post.

<comment><USER3> > A social media company getting the Senate leader of one of the 2 major > parties in the US on their side is a huge fucking deal.

Odd then that in the many comments on this very website discussing the original article ([https://news.ycombinator.com/item?id=18453958](https://news.ycombinator.com/item?id=18453958)), the terms "Schumer", "Senator", "Senate", and "Sen." never appear.

</comment></comment></comment></comment><comment><USER4> Oh dear.. I don't know what to believe. Hasn't Facebook reached the whole 'check with legal' thing yet? I mean seriously, I've worked with companies the size of Facebook and vetting vendors/vendor relations was always a thing, especially for touchy matters (large transactions, government relations, government contracts, PR, anything that touches politics, PACs etc..). I find it hard to believe upper management legitimately has total ignorance.

<comment><USER5> They're used to getting away with things, and think it's going to keep happening. They've been running unregulated, so have really had no need to check with legal.

</comment></comment><comment><USER6> So facebook didn't know that they were paying for the creation of fake news? Seems like they are really going to be up against the wall trying to figure out who their platform is making fake news if they can't even see it under their own nose.

</comment><comment><USER7> I think it is time to Lean In and do something, like put your customer first.

Honestly, after integrating with your platform 6 years ago, I realized that if you want to post something privately on FB - you just don't post it.

<comment><USER8> It was always about the customers. The users, however...

<comment><USER7> Are the product

</comment></comment></comment><comment><USER9> Internet Archive link for those who don't want to give Facebook any traffic or have the site blocked: [https://web.archive.org/web/20181116055923/https://m.faceboo...](https://web.archive.org/web/20181116055923/https://m.facebook.com/717545176/posts/10160967443525177/)

</comment><comment><USER10> > I did not know we hired them or about the work they were doing...

If true, was this by design, to have plausible deniability, much like the willful ignorance on the part of the military top brass when it comes to massacres etc.?

Regardless, some lack of coordination seems real even as now the scandal unfolds:

> Our relationship with Definers was well known by the media... > [[https://newsroom.fb.com/news/2018/11/new-york-times- > update/](https://newsroom.fb.com/news/2018/11/new-york-times-update/)]

</comment><comment><USER11> > We're no longer working with them but at the time, they were trying to show > that some of the activity against us that appeared to be grassroots also had > major organizations behind them. I did not know we hired them or about the > work they were doing, but I should have.

It never occurred to anyone at Facebook to _audit_ what Definers was doing?

For goodness sake, make sure you don't read the comments on that post.

<comment><USER12> Two suspicious things about these claims:

1) In Facebook's official response [1], they say

 _> Our relationship with Definers was well known by the media – not least because they have on several occasions sent out invitations to hundreds of journalists about important press calls on our behalf._

But somehow neither Sheryl Sanders nor Mark Zuckerberg [2] were aware of this "well known" relationship.

2) If Definers' job were really as benign as exposing faux-grassroots criticism, why mask the connection to Facebook by going through then? Why wouldn't Facebook respond directly, as they did to the New York Times exposé?

[1] [https://newsroom.fb.com/news/2018/11/new-york-times- update/](https://newsroom.fb.com/news/2018/11/new-york-times-update/)

[2] [https://www.businessinsider.com/mark-zuckerberg-says-he- didn...](https://www.businessinsider.com/mark-zuckerberg-says-he-didnt-know- facebook-hired-definers-to-discredit-critics-2018-11)

</comment></comment><comment><USER13> What about the Rohingya, Sheryl?

<comment><USER14> Everyone is reading this in Archer's voice

</comment></comment><comment><USER15> > I also want to address the issue that has been raised about a PR firm, > Definers...I did not know we hired them or about the work they were doing, > but I should have.

To be fair, are COO's normally aware of every firm that the company is working with? I feel like the CFO would need to know given their role in overseeing company financials, but not sure if it would make sense for a COO to be in the loop.

</comment><comment><USER16> oh please really? her excuse is she's incompetent and didn't know who she was hiring? and what about the fact that she yelled at the security chief for being honest about russia?

</comment><comment><USER17> They lied to congress directly in claiming during testimony that Palmer Luckey was not fired because of his $10k donation to an anti Hillary PAC. As the recent Wall Street Journal article shows, what FB told Congress was untrue.

Why believe them now?

</comment><comment><USER18> It's over for facebook, they are myspace 2.0. They should count their blessings they bought instagram.

<comment><USER6> Come back in 6 months and say that.

Not trying to be cruel, but it seems like social media entities like FB seem almost impossible to unseat from their position of being the new public space of the 21st century.

Nothing over the last day has been overly surprising and pretty much typical facebook behaviour, doesn't seem like near enough to overcome the demand-side economies of scale they hugely benefit from.

<comment> gingerbread-man Speaking personally, two things have kept me from permanently deleting my Facebook account: my contact list, and apps that require FB sign-in.

Facebook's core utility as the web's primary identity provider, and the network effects underlying that position, form a tremendous "economic moat."

The amount of time users spend on Facebook.com and the iOS/Android apps may decline and cut into their revenue, but their core platform isn't going away for a long time.

<comment><USER19> > Facebook's core utility as the web's primary identity provider, and the > network effects underlying that position, form a tremendous "economic moat."

Maybe its just me being extremely privacy-conscious, but I only ever had Airbnb and Spotify linked to Facebook. I never wanted to link Facebook further into my life than I had to. When I deleted my Facebook account it was simple to convert my Airbnb account, and I just let the fb-linked Spotify account die with it.

</comment></comment></comment></comment><comment><USER2> @dang.. why has this article disappeared from the front page?

</comment><comment><USER20> To clear things up for confused people like me, when she says the IRA she means the Internet Research Agency, not the Irish Republican Army.

<comment><USER21> That dang IRA is always popping up.

</comment></comment><comment><USER16> how can we vote for either part when the leader (schumer) is so corrupt?

<comment><USER22> As a society we are learning that democracy doesn't work when you vote for the person you least hate, or the other side hates most.

Don't vote for a party. Vote for a person, and the person you actually want.

</comment></comment><comment><USER23> Say it under oath, Sheryl.

</comment><comment><USER24> Facebook is directly culpable in abetting a genocide level event in Myanmar. Enough said.

<comment><USER25> People are, not the tools. There are always tools that could be used for bad acts but people are the once who can deicide how to use them.

<comment><USER26> Exactly. Going on a tangent here but this is exactly what I tell gun control proponents. Deal with the root cause of the problem and leave gun owners be.

<comment><USER27> Unfortunately, the root cause in that case is unstable people getting a hold of guns and then killing people with them (themselves or others). (Leaving aside gun accidents, which are also a problem.) While we should certainly do everything we can to help prevent and treat mental illness, it will never be possible to eliminate it completely. Therefore we should also make it as unlikely as possible that such a person would have access to a gun.

That's not to say that people should not be allowed to own guns, but I believe it does follow that very careful standards should be in place to ensure that licensed gun owners will use, transport, and store their weapons with the due level of care. Reasonable people could certainly debate what sort of standards those would be, in terms of licensing, restrictions, education, storage and transportation requirements, etc., but given the evidence that availability of firearms contributes to deaths by homicide and suicide, the issue certainly seems worthy of investigation.

<comment><USER26> > Reasonable people could certainly debate what sort of standards those would > be

Sounds reasonable to me. I would however, also ask you to consider that excessive control leading to difficulty in accessing guns for personal protection is dangerous as well. The question becomes how much power do you want to give government over this issue.

A lot of gun owners cite the concerns that they have over the emergence of a tyrannical government. With guns, these citizens can protect themselves more adequately.

You don't want a scenario where the government of the day rounds up a bunch of deplorables/undesirables and sets out to massacre them. This has happened before and I'd bet that guns in the hands of each of these individuals would have accorded them a fairer chance at defending themselves.

As far as deaths go, governments have killed more people than a few gun toting individuals who clearly have mental issues have. Governments are more dangerous.

<comment><USER27> I don't think it's fair that you're getting down votes here without replies. I didn't down vote, but I'll explain why I disagree.

It is most likely true that governments have killed more people than individuals with guns acting alone, although I don't think it's as lopsided as you suggest. As an example, the United States death toll in all of World War II was about 400,000. Currently there are over 30,000 gun deaths in the US every year.

The more significant issue though, is the claim that a prevalence of guns would prevent government tyranny to the extent that it outweighs the damage they cause. Speaking of the US specifically, that would first require that the US would have a government at some point that was intent on killing hundreds of thousands of its own people. But not only that, it would require an armed insurrection against that government to actually be successful in stopping it. I'm no fan of the current US government's policies or effectiveness, but both of those events seem astronomically unlikely anytime in the foreseeable future. It is incredibly unlikely that the US government would morph into a murderously tyrannical regime. And if that somehow did happen, it is also unlikely that individual citizens with guns could do much to stop it. On the other hand, it's a fact that access to guns causes tens of thousands of deaths in the US _every year_.

I just can't see any reasonable argument that the likelihood of the emergence and defeat of a tyrannical government is so great that it is _remotely_ likely to outweigh the existing annual gun death toll. Not to mention that I'm not even suggesting preventing gun ownership, just sensible restrictions. In order to drive a car you need to prove that you know the rules of the road and that your vision is sufficient (or that you will wear corrective lenses). Your car must be registered and in good working order. I'm in favor of a similar licensing process for guns: a thorough, standardized test to prove that you are of sound mind and are aware of proper safe use and storage. Registration so that law enforcement can be aware of potential threats, and can track weapons used in crimes. Restrictions on how guns can be legally stored and transported, and where they can be taken. I'm not an expert, and I could certainly be convinced I'm off on the specifics, but opposing any restrictions on ownership whatsoever seems an untenable position to me.

<comment><USER28> I agree with you completely except that I caution people not dismiss the idea of an armed rebellion so easily. It's really easy to fool ourselves into thinking bad shit doesn't happen and we are "beyond violence". I want to believe it too, but let's just say for example Trump starts rounding up "illegals" and shooting them if they refuse to leave our country. Just think about that. At some point many of us would break and as we see our friends and families torn apart we would be willing to die to defend their humanity. Hopefully we'd have some of the military on our side, but we'd likely break out in civil war. Our military is powerful but not as big as many people assume. It can't do shit to a bunch of people in concrete urban structures with AKs what makes anyone think 100MM citizens with weapons wouldn't be effective in seizing control back from a tyrannical leader?

Those who sacrifice liberty for safety deserve neither.

I know you've heard it before. But I honestly worry we're suffering from a "times are good why do I need all these liberties my ancestors fought for" phase and it would be really dumb to forfeit them all and then end up back at square one with an actual actively oppressive system governing us and no way to defend ourselves against it.

<comment><USER26> > Trump starts rounding up "illegals" and shooting them if they refuse to > leave our country

I'd say that that's a valid I'd concern even as a Trump supporter. All governments are capable of copious amounts of nastiness. Today, my guy could be in power, tomorrow someone else's will be. Therefore, systems that take this into account would perform better than those that don't.</comment></comment></comment></comment></comment></comment></comment></comment>


Visions for the Future Internet - <AUTHOR> https://findingctrl.nesta.org.uk/ <comment><USER2> First AI get elected? Don't think so</comment>


The new website of the C++ standard - <AUTHOR> http://www.isocpp.org/

<comment><USER2> Does it have the actual standard there, or do you still have to pay $$$ for a copy?

<comment><USER3> $30 for official. Free for "almost official" [1]. I have no idea what that means. Here's a direct link to the free PDF ("almost official"): [http://www.open- std.org/jtc1/sc22/wg21/docs/papers/2012/n333...](http://www.open- std.org/jtc1/sc22/wg21/docs/papers/2012/n3337.pdf)

Edit: That direct link is actually to a January 2012 version. The link in _stephan's comment is the download page. There's also a Github repo: <https://github.com/cplusplus/draft>

[1] [http://isocpp.org/blog/2012/08/where-to-get-the-standard- and...](http://isocpp.org/blog/2012/08/where-to-get-the-standard-and-drafts)

</comment></comment><comment><USER4> New huh? That logo made me think we were in 2002.

<comment><USER5> That logo makes me think of C++.

</comment></comment><comment><USER6> Yep, looks like a C++ developer built that site.

</comment><comment><USER7> It's great place, although I'd love to see more content that is not only MS and Visual Studio oriented.</comment>


Equity for seed funded companies - <AUTHOR>

I am negotiating equity at a seed funded startup in NY (raised a large seed round of 3 million) for a lead engineering type role. They have a cto, 2 full time remote engineers, and about 5-10 contract engineers. What is an appropriate range of equity assuming I am taking a lesser salary (~120K) <comment><USER2> Serie A ? If yes, 1% equity min, more if your direct boss is the CTO/CEO.

<comment><AUTHOR> not a series A, simply a seed funded company. My direct boss will be the CTO

<comment><USER2> 2%-5% I would say.</comment></comment></comment>