How to hire engineering talent in LA? - <AUTHOR>

My partner and I founded our startup in June. Since launch, we've already been through outsourced labor in India, and localized contractors through oDesk, and it's just not meeting our expectations. We realize to grow successfully we need to get some real amazing engineering talent as full time & offer equity and potential co-founder status. The struggle is we're based in LA, and talent is hard to come-by. Most candidates are either working for the Snapchats and Factuals of the world, or they're doing their own thing & just freelancing.
Any tips / tricks on how to attract and find good engineers & developers? We really need to move on this as we're hindering our development.
TY <comment><USER2> Pay them a Silicon Valley salary, or you can hire someone from SF that loves LA, like me.

I wish there were better paying tech jobs in LA. I'd go in a heartbeat.

The biggest problem with wanna-be LA tech companies is that they havent figured out that the engineers are the rock stars and try to undercut them on salaries and perks. Good luck with that.

Maybe I'm generalizing.

Anyway, as a startup your challenge is immensely larger, not to say its impossible, but consider that all the talent is concentrated in the Bay for a reason -- then refactor your expectations.

I would suggest you develop your own prototype, pitch to investors and then move your office to San Jose, it'll at least be cheaper and youll have better access to engineers.

Excellent well-established engineers cost money, inexperienced and undiscovered ones can be lured if you are in the right location.

<comment><AUTHOR> Definitely take your point to heart. We've bootstrapped this thing so far, but have recently started seed rounds to find money to pay the talent.

What's the going SV rate? including some equity/title included?

<comment><USER3> For co-founder caliber talent? $100/hr or equivalent. Minimum.

<comment><USER4> Bare minimum. That's less than my consulting rate in Alabama, and it's not exactly Silicon Valley out here.

<comment><USER3> I feel like an hour of consulting work at that rate is slightly different. I personally wouldn't expect to bill for 2000 hours of work in a single year as a contractor.

As a technical co-founder, I would expect the full 200k/yr as salary, plus equity and a cash bonus if goals are met.

</comment></comment></comment></comment></comment><comment><USER5> Good question - LA is indeed a challenging town for recruiting engineers. A few thoughts:

1\. Meetups; i.e. if it's a Ruby shop, you could sponsor, participate, or simply attend Ruby meetups. Creating awareness of your company and meeting people/making a positive impression could only help spread the word.

2\. Industry events; i.e., a founder of an EdTech start-up could meet some helpful contacts or even directly connect with engineers passionate about your specific field of work/product/mission.

3\. Your existing network: mentors, accelerator partners, CS professors, old colleagues on LinkedIn, etc. It never hurts to ask :)

3\. Unique perks; first one that comes to mind is potential for remote work. Given the adventure (read: nightmare) that is LA traffic, this could draw lots of attention. I understand it's difficult as a small start-up, as cohesiveness and face time is important, but even one to two days/week (or the potential for more once the employee's established) could set you apart.

FWIW: I run a tech recruiting agency with a distributed team around the country - LA is one of our cities. Feel free to shoot me a message if you have any Q's or if you're curious about using a recruiter: firstname.lastname@example.com.

Good luck!

<comment><AUTHOR> great insights, much appreciated.

We're happy to talk to your recruitment team. My email is eli(at)arbibo.com

</comment></comment><comment><USER6> Have you ventured into Orange County ? Not everybody that works or is willing to work in LA lives in LA. Try looking a little more south, specially Irvine.

From what I have seen there are a LOT of .Net developers in LA and Orange County, if your stack is .Net you should not have a problem finding good people.

Ruby and Python developers are a pain to find. A lot of the "Good" developers are not even proficient in the language/tools.

There are good java developers here, but not as much as .Net developers.

Tips:

* Use LinkedIn to find people in LA, Orange County and even San Diego.

* Target user groups. There are a lot of good developers in the UG and they usually have friends that are developers as well.

* Always get recommendations from people that know the developer you are interested. I have even seen some startups that only hire people that have been recommended from someone they know.

<comment><USER7> > _Ruby and Python developers are a pain to find. A lot of the "Good" > developers are not even proficient in the language/tools._

Care to elaborate on this? I used to live in San Diego and didn't experience this. Is it that much different in OC/LA?

</comment></comment><comment><USER8> My approach is to try to attract strong developers by using the best languages and tools. What technology stack do you use?

<comment><USER2> Stack and tools dont attract strong developers. Salary and work-life balance does.

<comment><USER8> You couldn't pay me enough to work on some stacks.

Also, certain technologies do a good job of convincing potential employees that you know what you're doing and committed to using the best tools available IMO.

<comment><USER2> I agree completely.

It's hard to generalize though, you can find engineers for just about any stack with the right price points.

</comment></comment></comment></comment><comment><USER9> You should talk to the guys at Originate. They know how to grab talent. Also, they're pretty open to talking to people and are at quite a few events throughout the nation.

Full disclosure: I used to work at Originate.</comment>


Show HN: JS script to color HN items according to their ranking score - <AUTHOR> https://github.com/auzias/hn <comment><USER2> How do I install that to Tampermonkey? Is it available on [https://greasyfork.org/](https://greasyfork.org/)?

</comment><comment><AUTHOR> Any suggestion are welcome ! That's actually my first JS scripts

</comment><comment><USER3> if you rename it to hn_ranking_color.user.js I think greasemonkey users will be able to install it automatically.

<comment><AUTHOR> It's already named as it.</comment></comment>


Ask HN: Who is hiring (entry level) - <AUTHOR>

This is not a post for companies looking for star hackers/ninjas who have years of working experience. This is also not a post for summer interns. This is a post for companies that are offering interesting and challenging entry level jobs to recent graduates. <comment><USER2> no one? :(

</comment><comment><USER3> Why do they have to be recent graduates?

<comment> tomh- Recent graduates need opportunities to work together with the "stars/ninja's/samurai's" so they can be the next "rockstar" programmers.

<comment><USER4> I think he means why is it required that the person is a recent gradute. Your cited reason would be no less valuable for a non-recent graduate or a has- never graduated.

<comment><USER5> Or for that matter someone that wants to change their career.</comment></comment></comment></comment>


Emacs on a tablet PC with gestures - <AUTHOR> http://lispgamesdev.blogspot.com/2010/12/gnu-emacs-tablet-pc-touchscreen-gesture.html

<comment><USER2> Hi, I made this video. I don't show it in the video but this is a Touchsmart TM2. The screen flips up and swivels 180 degrees to reveal a conventional laptop form factor with keyboard, so I mainly use emacs that way. However, gestures are still available above the keyboard when the screen is in that mode, and also emacs code reviews that i talk about could be interesting... I have a lot of other stuff planned, see <http://lispgamesdev.blogspot.com/> for more.

</comment><comment><USER3> This makes about as much sense as using command-line interface to drive a car.

<comment><USER4> I think it would be pretty sweet to run common emacs commands without contributing to RSI.

</comment></comment><comment><USER5> The editors I've seen for iOS all have issues with special characters so I had been really curious to see how the emac folks would deal with that. I was pretty disappointed when I found out they didn't.

The gestures were pretty cool anyway, though. From what I could tell, they seemed pretty intuitive, too.

</comment><comment><USER6> I would be curious to see the usability of this when actually editing a buffer. Search-as-you-type would be a cool example.

</comment><comment><USER7> "Because key chords weren't painful enough"

<comment><USER8> Anyone that doesn't rebind Emacs' awful key chords deserves all the RSI and carpal they get.

</comment></comment><comment><USER9> Slightly OT: anyone know of attempts to port emacs to android? If I had that and an attachable human-size keyboard, I could ditch my laptop for many purposes.</comment>


Great Northern Machine Wars – IEEE Computer Society [pdf] - <AUTHOR> http://www.computer.org/csdl/mags/an/2014/02/man2014020016.pdf

<comment><AUTHOR> There's another copy of the pdf here:

[http://www.kameli.net/~marq/great_northern_machine_wars.pdf](http://www.kameli.net/~marq/great_northern_machine_wars.pdf)</comment>


Glass stops antisocial drinkers from looking that their phones - <AUTHOR> http://www.thedrinksbusiness.com/2013/06/glass-stops-anti-social-drinkers-looking-at-their-phones/

<comment><AUTHOR> I really thought this article was going to be about google glass.

<comment><USER2> Same. Not having to look at your phone since you get all updates right on your Google Glass.</comment></comment>


99.99 + 0.02 = 100.00999999999999 - <AUTHOR> https://ideone.com/XFN9Rp <comment><USER2> If I was clippy, I'd say "Are you trying to ask a question on StackOverflow?" Please don't post things even a 1st year student already knows.</comment>


Remote Code Execution on packagist.org - <AUTHOR> https://justi.cz/security/2018/08/28/packagist-org-rce.html <comment><USER2> I would like to emphasize that php is notorious for these sorts of issues because every single function to execute an external program is based on

        ["/bin/sh", "-c", $cmd]

If we would just stop telling developers that the interface to start a process is "a string that is then processed by bash" we wouldn't have these issues anymore.

Every other programming language starts processes using a path and a list of arguments, even bash itself, in its own awkward way.

It feels like the php security community is too centered around sanitizing inputs instead of adding secure interfaces that only require logical validation instead of checking-for-evil-bytes-and-defusing-them.</comment>


Netflix Downloads - <AUTHOR> https://media.netflix.com/en/company-blog/downloads-make-it-even-easier-to-watch-netflix-on-the-go <comment><USER4> While this is great and very usable, especially for people with limited data plans, I can't help but feel disappointed that simple offline caching of content is still considered a major feature in 2016. Without DRM, this would be a no-brainer.

<comment><USER5> Who would license content to a company without any DRM protection?

<comment><USER6> Your question implies that there's any practical use for that DRM in streaming services. There's not and it does nothing useful but annoy users.

Anyone with ounce of motivation can easily bypass and extract the media content, so the only thing DRM does is piss of paying users which can't watch content on flaky connections, flights, travel and alternative operating systems.

Meanwhile on torrent sites you find Netflix digital dumps in matter of minutes after release.

<comment><USER7> Not true.

An important use for DRM in regards to streaming services is to prevent people on shared networks from getting access to the data. For instance, if I was in a college dorm with dorm-wide wifi, and I was watching my de-DRM'd Netflix, anyone on the dorm intranet could snoop my packets and get the data being transmitted to me by Netflix, for free.

That is nigh on impossible to do when the content is encrypted with DRM.

<comment><USER6> Never in my times of working for content provider / transport was that even remotely the reason for DRM.

It was always passing the legal buck ("It wasn't us that let those evil evil pirates steal your series, we did all we could, look at that DRM software certificate!").

Snooping packets in dorm rooms? No.

<comment><USER8> Not to mention that even if it were an issue, TLS would be a much easier and cheaper solution.

</comment></comment></comment></comment></comment></comment><comment><USER9> Looks like it's only available for smartphones and tablets, not for computers. Probably because on smartphones and tables they have their own app and don't have to rely on a browser.

<comment><USER10> Too bad they couldn't make it a chrome extension or something at least

<comment><USER11> Can someone please explain why this comment is being downvoted? Is it not feasible or is that stupid in some way? I'd just like to know if the downvotes are from a technical perspective.

<comment><USER12> DRM relies on handing the ciphertext, a decryption program, and the key to the opponent, and then telling them not to use it except when they are allowed to use it.

If your browser is in charge of running the storage of the ciphertext and the decryption, it is much easier to debug it and apply a patch that will store the plaintext than if you have to do this all in an Android emulator as well.

But either way: DRM doesn't work for long.

In the meantime, Netflix is providing enough value for me that I happily pay their monthly fee and don't bother looking for ways to break their DRM.

<comment><USER13> As they say 'convenient is better than better' and I've long looked for a company like Netflix who will allow me to give them money and they will let me watch what I want.

<comment><USER14> I think that's what Netflix wants to be, getting the content creators to agree is the tough part, I imagine. Another benefit to their producing their own material.

</comment></comment></comment></comment></comment></comment><comment><USER15> I reeeeeeally wish I could watch my shows in a more legitimate way than currently. I recently went through everything that I'm watching and tried to find out what I could actually watch on streaming services.

.....which was unfortunately only a limited subset, especially since I'm not US based (Scandinavia here).

Besides the problem of everything being spread out over Netflix, HBO, Amazon Prime and what have you not, some content is just not available, such as Supernatural outside of US/UK/Germany.

I almost feel like the TV networks wants people to pirate things...

<comment><USER16> I think the TV networks were very short sighted and ended up with shitty contracts that never accounted for distributing or streaming their content internationally.

They would if they could, but they'd have to go back and renegotiate all those old settled contracts.

<comment><USER17> Still happens today. Example being Amazons Grand Tour not being available in Canada from launch. Of all companies they should have had that figured out.

</comment></comment></comment><comment><USER18> What kind of DRM would they use to store local copies?

EDIT: On Android 7.1 VLC for Android, was able to "open" (duration etc) a large file I found in Netflix directory (.hidden), though not decode sound or video. There were two smaller files besides I suspect are audio tracks. And several other very small files, subtitles maybe.

<comment><USER19> They probably aren't storing the videos as you are traditionally thinking about them - you don't get to download a video file which you can play anywhere.

Most likely what they've done is stored the video chunks locally and then the Netflix app is "streaming" these chunks from the local storage rather than the netflix servers. If you looked through the folder that holds these chunks, you'd probably just see a bunch of randomly named 100mb files. That's all the DRM they need, you have no ability to consume these files without the Netflix app.

<comment><USER20> That is not "all the DRM they need". Files split up into "randomly named 100mb chunks" does not make them safe from would-be pirates with a penchant for reverse engineering.

<comment><USER6> DRM never did stop "would-be pirates with penchant for reverse engineering". Ever.

Plus, the owner of the Android/iOS device is paying for that content anyway, why would it be in any way a problem if he can open that downloaded file in another software?!?!

<comment><USER21> Technically paying for a license to play said content in the Netflix app.

I agree that DRM is a waste of time and the pirates are going to get the content whatever happens, but a $10/m streaming service is only licensing you to watch video in a few specific scenarios. If you had spent $3 an episode (or whatever it is on iTunes/Google Play these days) to own it, then I'd expect a DRM free file to be available (Though I doubt you actually get one in reality).

</comment></comment></comment></comment></comment><comment><USER13> I saw Netflix's chief product officer Neil Hunt say a while ago Netflix would "never" offer downloads, but I have to say I'm really pleased with this. Getting the train through spotty service areas effectively rendered Netflix unusable, but now! :)

<comment><USER22> Neil Hunt a year ago [[http://www.gizmodo.co.uk/2015/09/the-real-reason- netflix-won...](http://www.gizmodo.co.uk/2015/09/the-real-reason-netflix-wont- offer-offline-downloads/)]

"I think it's something that lots of people ask for. We'll see if it's something lots of people will use. Undoubtedly it adds considerable complexity to your life with Amazon Prime – you have to remember that you want to download this thing. It's not going to be instant, you have to have the right storage on your device, you have to manage it, and I'm just not sure people are actually that compelled to do that, and that it's worth providing that level of complexity."

Part of me wonders how much this was marketing spin to cover a gap they had relative to Amazon Prime and they were in actuality evaluating how to catch up.

This happens far to often. Notorious example is Ballmer saying iPhone will be a flop when teams internally know that Windows Mobile just blew up.

<comment><USER23> He wasn't wrong, it does add serious interface complexity.

But we all know that it's a very desirable feature and most people are willing to pay for that complexity to be able to watch offline.

So it was mostly spin, like Steve Jobs saying they'd never make a tablet at a point where it had to be in final development internally.

<comment><USER24> > He wasn't wrong, it does add serious interface complexity.

How? I don't have Netflix, but, for Amazon Video, you get a download button—that seems to be the only bit of the interface that reflects the ability to download at all. After that, you don't have to worry about whether you're watching a local or streamed copy; the movie plays just the same.

<comment><USER23> It was "click on anything and it plays".

Now it's "click on anything and it plays. Unless your offline. Where search also doesn't work. And when you're offline you probably go somewhere else to see what you're looking for. When online we need to show that too. And buttons to let you download or see the download status. And....

I'm not saying it's insurmountable, but it's quite a bit more than the old "everything you see you can watch now and that's all there is to it" model.

<comment><USER24> > It was "click on anything and it plays".

> Now it's "click on anything and it plays. Unless your offline. Where search > also doesn't work. And when you're offline you probably go somewhere else to > see what you're looking for. When online we need to show that too. And > buttons to let you download or see the download status. And....

But it seems that your 'before' is not quite right: if you can't download videos, then it's "click on anything and it plays, unless you're offline", full stop! That is, by allowing download of videos, a total-failure mode has been replaced by a mode with different functionality. Although it's technically true that "you can do some things" is more _complicated_ than "you can't do anything", I'm not sure that it's really _worse_.

<comment><USER23> No, because if you were off-line the app wouldn't let you in. The app set that condition clearly and enforced it. So there was no confusion, 'cause if you could see it you could play it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> PlayOn is on sale for $50 right now: [https://www.playon.tv/playlater](https://www.playon.tv/playlater)

Browse/download any streaming service (that you have access to) easily - <USER2> love it.

<comment><USER26> Isn't BitTorrent still free?

<comment><USER27> Trackers aren't doing so hot right now :(

</comment></comment></comment><comment><USER28> Seems like only a limited selection is available offline.

From the article: "For example, Orange is The New Black, Narcos and The Crown are available for download today."

<comment><USER29> It's probably due to licensing. These are all Netflix originals where as movies or partnerships would probably charge a fee for offline content. I'd imagine offline would be considered "rentals" so it would be treated similarly to Amazon Video or iTunes.

<comment><USER23> There are some non-original content movies and such too.

</comment></comment></comment><comment><USER30> This has been the differentiator between Netflix and Amazon Prime - <USER3> welcome news indeed. I do wonder how limited the number of allowed downloads will be, though...

</comment><comment><USER31> It's probably not a coincidence that this is coming out at the same time as AT&T is zero-rating their own streaming service.

</comment><comment><USER32> Looks like it's only going to be on Netflix originals at the moment. But at least it's a step in the right direction! Wonder how long you can keep the content for after download?

<comment><USER33> Your account seems to be marked as [dead] btw. I have vouched for you, as I can't see any real reason for this.

</comment></comment><comment><USER34> Oddly not everything is downloadable though. No Luke Cage here on Netflix Hong Kong (which is odd given it's Netflix made).

<comment><USER7> Not every Netflix Original is available in every region. This can be either because Netflix was producing the show before they were in that region, and so signed over the rights to the show in that region to a different provider, or because they have agreements with other producers that need to be on board as well. The same idiosyncrasies will probably apply to downloads.

For instance, in the case of Luke Cage, maybe Marvel needs to sign off on delivery changes like this? Hard to determine without looking at Netflix's actual contracts.

<comment><USER35> A lot of the Netflix "Orginals" are really just Netflix being the exclusive distributor in a particular region of a show produced by someone else.

</comment></comment></comment><comment><USER36> I literally just typed "netflix offline mode" in Google, because of an upcoming long flight next week. This couldn't have come at a better time. Even if this is just limited to Netflix originals, I'm fine with that. Their original content is better than their studio catalog at this point.

</comment><comment><USER37> I am on a tablet on Android 4.4.4, with the latest Netflix version downloaded 4.12.0 (code 13287), trying to download Narcos, and don't see the download icon as shown on Netflix's instructions[0]. Anyone else not seeing it?

[0]: [https://help.netflix.com/en/node/54816](https://help.netflix.com/en/node/54816)

</comment><comment><USER38> Fantastic, this has been a welcome feature on Amazon Prime and even moreso on Netflix where the selection is currently more to my liking.

</comment><comment><USER39> Nice! I'll travel with a bunch of kids to a place without internet. We would like to watch a movie at night in a projector connected to a laptop.

It looks like it won't be possible to stream the contents of the netflix app in my phone to the projector.

<comment><USER40> depending on which kinda of phone you have you can have your smartphone screen shared via HDMI to your projector:

[https://www.amazon.com/Samsung-MHL-HDMI-Adapter- Packaging/dp...](https://www.amazon.com/Samsung-MHL-HDMI-Adapter- Packaging/dp/B005LGUDKK)

</comment></comment><comment><USER41> It's a nice Nexflix addition. When's Pandora/Spotify is going to do this? It only makes sense.

The real fix is to have reasonably priced unlimited 4G/5G data. But it doesn't seem to be coming.

<comment><USER42> You can do that with Spotify if you are a Premium user.

</comment></comment><comment><USER43> Is this the precursor to making Netflix a hybrid/P2P service, too?

</comment><comment><USER44> Huh? Just updated the app, doesnt work - no downloads ready. Not even the Netflix shows they promote in the blogpost. Im on android 5.1.1. Hopefully theyll get it together, nice feature.

<comment><USER45> I wouldn't be at all surprised if it's a limitation of your "old" Android version. Not saying that's definitely the case, but wouldn't be surprised.

<comment><USER46> Looks like they support 4.4.2 and higher [https://help.netflix.com/en/node/54816](https://help.netflix.com/en/node/54816)

</comment></comment></comment><comment><USER47> Any confirmation of what resolution? Preloading 4k HDR might make a more consistent experience than random downsampling mid-scene.

</comment><comment><USER48> I have a new theory about user requirements. Spotify and Netflix has same feature now. Only one difference exists music vs. video. What will be the spotify and netflix of VR content? It will be downloadable to our mobile phones. to be continued...

</comment><comment><USER49> Good!

Now fix subtitles and expand the catalog...

<comment><USER7> I've never had an issue with Netflix subtitles, what exactly is your problem with them?

And yeah, it would be swell if Netflix could snap their fingers and expand their catalog, but they can't.

<comment><USER49> Some subtitles just fail to load or appear on an android device.

Also sometimes the last character is trimmed.

</comment></comment></comment><comment><USER50> Fuck DRM. Seriously.

</comment><comment><USER51> Apple will be happy more people will pay for the extortionate large iPhones.

<comment><USER7> How could you possibly be correlating Netflix supporting downloads and phone screen size preferences?

<comment><USER52> I think he means large storage space, not physically large devices.

<comment><USER51> Yeah I was meaning storage, but larger screen size phones might see a boost in sales too.</comment></comment></comment></comment>


BSDploy – FreeBSD jail provisioning - <AUTHOR> http://docs.bsdploy.net/en/latest/ <comment><USER2> Why doesn't *BSD have a greater market share? I just set up an openbsd firewall and loved it. Plus I have experience with zfs on FreeBSD-also loved it.

<comment><USER3> In my opinion (mostly Debian user with a bit of FreeBSD playing), people use Debian as a server for the same reason a lot of people like MacOS over Linux - It Just Works.

1\. For many years, the only way to install software was ports. Now if you're a full time sysadmin with time on his hands, it's great. But if you just need something up and running fast (and if you don't know your software internals, and don't know if you'll need perl's FLAG_ABC) , it's horrible.

It just feels like Linux in the 90's (been there), where recompiling the kernel/freex86 was a right-of-passage into Linux hackerdom. Nowadays, most of the time it's just not worth it.

2\. apt vs ports/pkg. This is actually the biggest thing keeping me on Debian - stable + backports.

If I'm running my server, I want things to be stable. Now I know that there's no other project the size of Debian, which can backport security fixes to two year old software (and sometimes four year old software), but there's nothing like apt update && apt upgrade and 99% of the time have everything update without a hitch.

Yes, FreeBSD is more elegant (why couldn't GNU/RedHat have just modeled ifconfig rather than ifconfig, ifup, ip, etc.). Yes, FreeBSD's man pages are amazing (which is quite important, as there's not as many FreeBSD blogs around), but if you're learning a new system (coming from Windows), Linux isn't that much harder to learn than FreeBSD.

 __EDIT __

And RedHat?

They work like Oracle - You pay them, and they'll hold your hand, and (unlike Oracle) they release their software under an OS license.

If you're a non-tech Fortune 500, that's _very_ important.

Note, by the way, that those two distros have the vast majority of GNU/Linux installs.

<comment><USER4> Debian doesn't always just work, because a lot of packages are very old. I think Ubuntu is (or is supposed to be) more "just works." But I think this is a personal point of view thing.

Also I think the FreeBSD handbook is awesome, even for newcomers. Is there something like that for Debian?

<comment><USER3> >Debian doesn't always just work, because a lot of packages are very old.

If you need new packages, you don't run stable.

You run stable if you need things, well, stable and "just works".

<comment><USER4> My point is that Debian does not always just work. That is my argument. It very well may "just work" in your use case, but it doesn't "just work" for all cases like your original comment seem to point out.

Also, there is a difference between new, like bleeding edge (e.g. Fedora), or newer (like Ubuntu or Debian Testing).

I don't know if *BSD "just works" either, but that is not what I am arguing here. I am making a point against your statement that Debian "just works."

</comment></comment></comment></comment></comment><comment><USER5> A similar amazing project in my opinion is iohyve. It has a fairly large portion of what you need to become a vserver provider in one command, easy to use:

[https://github.com/pr1ntf/iohyve](https://github.com/pr1ntf/iohyve)

<comment><USER6> Also vm-bhyve, which I've been happily using since 2015. Also amazing, also dead simple.

[https://github.com/churchers/vm-bhyve](https://github.com/churchers/vm-bhyve)

It is nice that there are multiple wrappers around bhyve - competition is good, and it shows a healthy community.

</comment></comment><comment><USER7> I've never understood why jails didn't take off. I guess maybe since linux took off and the bsds didn't, but they're just nice and elegant.

<comment><USER8> Linux "containers" didn't take off before Docker either, despite existing for many years (first in the form of OpenVZ, then as LXC).

<comment><USER9> I can't get my head around docker, and LXC is so much easier to understand. It's a lightweight VM, administered traditionally. It's easy!

<comment><USER10> There There! I think the same way. I feel like LXC is super powerful and flexible at the same time. Docker and all its terminology around(docker file, compose, swarm and many more) just feels like unnecessary complexity.. A few unixy scripts to automate LXC commands and The infrastructure should be set. The less wheels to grease the better at this level.

</comment></comment></comment></comment><comment><USER11> To me the separation of kernel and OS with Linux versus all together with BSD makes the container solution cleaner.

Take Google that is rumored to be using the same kernel in their cloud, ChromeOS and Android.

They concievably could have the same kernel from iOT, wearables, phone, tablet, 2 in 1, laptops, TV and cloud.

Google now is using the container functionality in ChromeOS to enable Android. Now if they give access I can run my cloud service on a laptop or a tablet. Instead of spending a fortune for a Swift version and a copy in Java.

But I also could develop once and deploy. Google has the containers like!E this on ARM and X86 and in their cloud on Power.

Now the containers are arch specific but not far from fixing that.

Google needs to allow a second SSD that is walled from the system SSD and give us access to launching containers. We get such storage in something like the M3 with rumored 16gb Samsung Pros but it is flash.

It is just not possible to do the same in BSD based on my very old experience. Has it changed?

</comment><comment><USER12> Is this docker for BSD or is there more going on here?

<comment><USER13> Docker for FreeBSD is over a year out of date and not production ready. I tried to use it for some things and it does work, but doesn't support any of the newer APIs in newer versions of docker compose and other orchestration tools.

I really wish the Docker team would have made FreeBSD a first-class citizen, considering the native zfs support in FreeBSD. Currently the only thing Docker runs on natively is Linux. Even with the newest MacOS/Win variants, it still running in a hypervisor.

<comment><USER14> Docker runs natively on Windows as well as Linux, with no hypervisor. There is a Solaris port being worked on (unless it got cancelled). We would love an upstream FreeBSD port, I have talked to a few people who are interested in working on it. The ZFS side should be fine as there is already support, and the old port should be useful as a basis.

<comment><USER11> Containers use the Linux kernel. How does a Linux container run native on Windows? Are the entry points mapped? How does Windows enable shared read between containers? With Linux it is the dir path and then inodes. How does Windows pull this off? How does SElinux work?

What is exposed inside Windows?

<comment><USER14> Windows containers use the Windows kernel. Windows does not have SELinux so of course that is not supported. It runs Windows program not Linux programs, so there is no mapping of entry points. There is lots of docs from Microsoft eg [https://docs.microsoft.com/en- us/virtualization/windowsconta...](https://docs.microsoft.com/en- us/virtualization/windowscontainers/quick-start/quick-start-windows-server)

</comment></comment></comment></comment></comment><comment><USER15> > BSDploy's scope is quite ambitious, so naturally it does not attempt to do > all of the work on its own. In fact, BSDPloy is just a fairly thin, slightly > opinionated wrapper around existing excellent tools.

But how is the author going to become rich and famous and be invited to all those conferences doing that? They need to drop this silliness and write the whole thing from the ground up! Get cracking, we want to see AT LEAST 30 000 lines of Go, or 10 000 of OCaml!

<comment><USER2> S/he threw about 100,000 lines of fortran in for rendering a completely CGI cat gif.

<comment><USER16> He needs to integrate it with systemd

<comment><USER17> FreeBSD, thank god.</comment></comment></comment></comment>


A major new Intel processor flaw could defeat encryption and DRM protections - <AUTHOR> https://www.theverge.com/2020/3/6/21167782/intel-processor-flaw-root-of-trust-csme-security-vulnerability <comment><USER2> [https://news.ycombinator.com/item?id=22495251](https://news.ycombinator.com/item?id=22495251)</comment>


Boxer is a Slick App That Brings DOS Gaming to Your Mac - <AUTHOR> http://thenextweb.com/apps/2012/01/05/boxer-is-an-awesome-free-mac-app-that-lets-you-relive-your-dos-playing-days/?awesm=tnw.to_1CSrb&utm_campaign=social%20media&utm_medium=Spreadus&utm_source=Twitter&utm_content=Boxer%20is%20an%20awesome%20free%20Mac%20app%20that%20lets%20you%20relive%20your%20DOS%20playing%20days <comment><USER2> The headline says "Slick", but in my opinion this goes even further than that. Every part of it that I've seen so far is beautiful. That includes the homepage, too. This is the kind of really well-made apps that made me switch to OS X in the first place. Would love to see (much) more of this :)

</comment><comment><USER3> XCOM UFO Defense. Greatest game ever. Just started a new game for kicks on superhuman. First UFO landing, every soldier died. Perfect!

<comment><USER4> That game is a testament to the immortality of well-done software. I still play it today, and it's still scary doing those first night missions against the sectoids.

On a related note...do any of us care what language or environment those games were implemented in? The software rocks. That's good enough. :)

</comment></comment><comment><USER5> Boxer + GOG.com = retro heaven. It's just a shame you need a windows pc to get the GOG installer to extract the setup installers

<comment><USER4> If you're willing to make the investment, VMWare Fusion is great for that. Though of course you still have to obtain a copy of Windows afterwards. I've addressed this by taking my ancient, ancient Windows laptop and running a program provided by VMWare that creates an image from your physical machine. (I've forgotten its name at present).

To make the creation process go faster, I usually restore the machine to factory defaults. That way, the registry is smaller and everything is much smoother.

</comment></comment><comment><USER6> I love Boxer! It's beautifully designed, and it's handled everything I've thrown at it so far with aplomb. Some of my favorites to revisit: Monuments of Mars, Scorched Earth, Commander Keen, Dark Forces.

<comment><USER7> No wonder, Boxer is built on top of DOSBox, the industry standard FOSS DOS emulator.

</comment></comment><comment><USER8> <http://boxerapp.com/>

</comment><comment><USER9> It's about time to revisit Day of the Tentacle :)

<comment><USER10> For adventure games running on the SCUMM scripting engine I really suggest you check out ScummVM[1]. It's similar to DOSBox in some regards, but it's designed to run old adventure games, namely those from LucasFilm Games. It even runs games designed for Windows systems on OS X and Linux (The Curse of Monkey Island works great for example).

[1]: <http://www.scummvm.org/>

<comment><USER9> Awesome, thanks for this.

</comment></comment></comment><comment><USER11> I downloaded this a while ago with the intention of installing a few games and then got sidetracked with work (or perhaps unsidetracked) and forgot all about it. Thanks for the reminder! It does indeed look nicely done.

 _Rest well this night, for tomorrow you sail for the kingdom of Daggerfall._

</comment><comment><USER12> It would be a smart move for gog.com to buy these guys out and also port it to linux and windows, and use it as their main steam-like thing (without the lockin).

Edit: Oops, looks like it's open source already. Great!

</comment><comment><USER13> Great. Now, thanks to Space Quest III, I will not get any work done this month.

<comment><USER14> Be sure to grab the MT-32 ROMs too, so you can enjoy Space Quest III as it was originally intended! INSERT BUCKAZOID and all. (They don't come with Boxer for legal reasons, but they're easy to find from a Google search.)

</comment></comment><comment><USER4> One game that I've searched high and low for is Hyperspeed by Microprose. Few people seem to have played it but it was one of the best strategy games ever made.

</comment><comment><USER15> My first thought: There's already DOSBox (which I bet was already ported to Mac), what's the point?

 _> It's powered by DOSBox._

My second thought after reading that: DOSBox is GPL'd, where's the source of Boxers?

 _> Clicking through a few links: <https://github.com/alunbestor/Boxer> _

Well, okay, I really don't get the point of this "App" but I guess as long as it's free software...

<comment><USER16> It looks like the DOSBox equivalent of Winebottler to me

<comment><USER15> I really don't get the point of that either. As far as I can tell, it wraps... Wine. What's the purpose? I could just run Wine (or DOSBox) directly, same result.

<comment><USER14> (Disclosure: I'm the developer of Boxer.)

Boxer does a whole lot more than wrap up games. If you have a Mac, just download Boxer and give it a spin: the difference between Boxer and DOSBox will be immediately apparent.

If you don't have a Mac or don't feel like trying it out, then here's an exhaustive answer I gave to a similar question in a previous thread about Boxer (<http://news.ycombinator.com/item?id=2363917>):

\</comment></comment></comment></comment><comment>-

Boxer uses DOSBox as its emulation core, but it has a completely redesigned UI and workflow for installing and playing games.

Boxer bundles DOS games into gameboxes, a self-contained app-like package format that appears as a single file to OSX and can be launched by double- clicking. Each gamebox is a self-contained DOS ecosystem that contains the game and everything it needs to run: drive folders and images, configuration settings, documentation etc. They're path-independent, which means they can be stored wherever you like, moved around, backed up easily, and shared with friends: without needing to reconfigure anything inside the gamebox.

You can create gameboxes by drag-and-dropping game CDs, floppies, disc images or folders onto Boxer's game import window. Boxer guides you through the game's installer if needed, then packages the game up into a gamebox (and rips its CD to an image, if appropriate).

Boxer aims to make DOS games require zero configuration and zero knowledge of the emulator's esoteric inner workings. It automatically sets up drives appropriately; it also pre-configures hundreds of games that need custom emulation settings, with more automatic configurations added in each new version. If needed, you can tweak common emulation settings (like CPU speed, emulation optimizations and mouse behaviour) directly while you play, using Boxer's inspector window.

The inspector also lets you add and eject DOS drives by drag-and-drop, at any time while you're playing a game: this lets you easily hot-swap CDs and floppies for multi-disc games. To this end, Boxer also auto-mounts any CDs or floppies you insert while playing, and removes them from DOS once they're ejected.

You can resize and zoom Boxer's window while you play, and toggle between rendering styles (HQx etc.) on the fly. Boxer's renderer has much sharper graphics than DOSBox at large window sizes, and has dramatically better fullscreen support: you can access the menu, dock and inspector window in fullscreen by unlocking the mouse, and switch back and forth to other applications easily from fullscreen. This is handy for checking up a PDF game manual for instance: which Boxer scans gameboxes for, and displays automatically in the Help menu for easy access.

While you're at the DOS prompt, the window displays a slide-out program launcher tray so you can run the game program with a single click; while you're running a game installer, the tray displays installation tips instead to help you through common installer questions.

Boxer has plug-and-play joystick support, letting you add and remove joysticks at any time with zero configuration. Boxer automatically corrects axis and button layouts for a number of popular HID controllers that are otherwise broken to the point of unusability with regular DOSBox. It also integrates with Joypad (<http://getjoypad.com>) so you can use your iPhone or iPod Touch as a controller if you so desire.

Boxer reimplements DOSBox's standard 2-axis, 4-axis, Thrustmaster and Flightstick Pro joystick modes, and adds a racing wheel emulation mode with axis behaviour designed for driving games (this mode uses tilt control in Joypad incidentally, which is a surprisingly cool way to play). Boxer's Flightstick Pro throttle emulation also has assists for gamepad thumbsticks and displays an on-screen throttle indicator. You can switch joystick modes on the fly while you're playing.

Boxer also has built-in Munt MT-32 emulation: you'll need to find the ROMs yourself, but adding them to Boxer is just drag-and-drop. Boxer automatically enables MT-32 emulation for over 400 games, so there's no need to manually switch between MIDI emulation modes. Boxer's MT-32 emulation even displays the MT-32's LCD messages in a spiffy bezel - something no other emulator does to my knowledge. Boxer can also detect if you have a real MT-32 plugged into your Mac, and if so will automatically pipe MT-32 music to it (though not General MIDI - it can tell the difference).

Apart from that, Boxer has the usual trappings of a Cocoa app: proper menus, sane keyboard shortcuts, integrated Apple Help and automatic application updates.

I think that about covers it.

<comment><USER15> Thanks for giving a detailed explanation, I appreciate it, and I do see some of the plus factor this adds over DOSBox.

To my personal defense: I just don't like it when people build meaningless abstractions over existing tools, and Boxers looked like just that to me at first, and I might have jumped to conclusions. I've been proven wrong and have to apologize.

<comment><USER14> It's worth noting that vanilla DOSBox is much, _much_ harder to use on OS X than it is on Windows. DOSBox on OSX cannot open EXE files directly and OSX has no concept of application shortcuts: so you cannot just right-click->Open With on EXE files to launch them, or set up shortcuts for your games that pass different startup parameters to DOSBox, like you can in Windows.

Instead, to launch a game with a custom configuration file (pretty much a necessity if you have more than one game you want to play) means typing in the following lovely command in the terminal:

/Applications/DOSBox.app/Contents/MacOS/DOSBox -conf /path/to/my/game/config.conf

...each time, or learning Applescript or bash scripting in order to write your own launcher script for each game to run the appropriate commands. That, on top of learning DOSBox's config file and mount syntax so you can write the configuration files each game needs. Needless to say, this is way too much work for the majority of would-be users on the Mac, even those who have a working knowledge of MS-DOS.

Users who overcome that learning curve still have to contend with things that simply _don't work at all_ in the DOSBox OSX build: like swapping one physical CD for another while playing (DOSBox keeps the CD busy so it can't eject, and the new CD would be at the wrong path anyway), or using fullscreen mode in OS X 10.7 (broken in DOSBox 0.74), or using Tandy emulation mode on a PowerPC mac (graphics glitches galore) or pausing the game (the default pause key doesn't exist on a Mac keyboard, and even if you rebind it the emulator will not unpause once paused) and so on and so on.

Boxer doesn't just provide added value; it provides a usable DOS emulator for the Mac in the first place.

</comment></comment></comment><comment><USER17> While Boxer is great it isn't new. I'm surprised it hasn't gotten coverage on HN before.

</comment><comment><AUTHOR> did anyone tried Blood game ..</comment>


Ask HN: What online storage are you using for your own private files? - <AUTHOR>

I'm interested about online storage (maybe cloud) solutions were you keep your pictures, videos, ebooks or any other documents.
One example would be Dropbox for sure. But I would like to see more options.
Thank you <comment><USER2> Dropbox looks like the best option to me. I've got it on my laptop, desktop, Android phone and BlackBerry PlayBook.

</comment><comment><USER3> Google Drive - I hate to be too "mainstream", but we've been using Google Drive to share docs between our small team and it works great. Collaboration on Google Docs is native and simple, plus we're able to keep our Office docs alongside without trouble.

</comment><comment><USER4> ZapDrive.com! You get 100 GB for just $19.99/year. Upgrade upto 10 TB at the same rate. (200 GB for 39.99/year and so on...). And, unlike Dropbox, you don't have to save everything on your computer, cuz ZapDrive behaves like a network drive.

<comment><AUTHOR> I'm interested in two things: 1\. Is the connection to Zap Drive encrypted? 2\. How are the Public Folders working? (cannot find any details more in the docs)

<comment><USER4> Yes, the connection is encrypted through SSL. You can make any folder public, by right clicking on it and selecting "Get Public Link". You will get a link that you can share with anyone.

</comment></comment></comment><comment><USER5> I've got a few files stored on <https://tarbackup.com/>. It's free (for now). It doesn't have a lot of features, but I like the simplicity.

</comment><comment><AUTHOR> Finally I chosen Box because it supports most of the Dropbox features at a lower costs, around 15USD per month for 1TB

</comment><comment><USER6> My own VPS for projects and some docs, for random things dropbox. But i do not have any photos music videos & c.

</comment><comment><USER7> Two lowendboxes (each with 20G storage for 15USD/year). A shell script remotely mounts encfs and runs rdiff-backup.

</comment><comment><USER8> box for iphone and Asus web storage also for iphone

<comment><AUTHOR> What type of account are you using on Box? I'm seeing that 50GB personal is 17E and ~1TB for 1 user professional is 13 E.

<comment><USER8> business, our office shares: <https://www.box.com/pricing/></comment></comment></comment>


Traf-O-Data - <AUTHOR> https://en.wikipedia.org/wiki/Traf-O-Data <comment><USER2> "Even though Traf-O-Data wasn't a roaring success, it was seminal in preparing us to make Microsoft's first product a couple of years later. We taught ourselves to simulate how microprocessors work using DEC computers, so we could develop software even before our machine was built."

\-- Paul Alan</comment>


Ask HN: Is there a good guide to the Internet that I can buy for my Dad? - <AUTHOR>

Hi everyone, I've been searching for a good book that introduces key internet concepts and has some fun and interesting things to do on the net. My Dad has just started using the internet with the family laptop and he knows how to email, but I want something that will show him the true power of the net. I couldn't really find a book that fits the bill. Does anyone know of any? <comment><AUTHOR> Some of my findings:

The Internet for Dummies: [http://www.amazon.co.uk/Internet-Dummies- Computers/dp/111809...](http://www.amazon.co.uk/Internet-Dummies- Computers/dp/1118096142/ref=sr_1_1?s=books&ie=UTF8&qid=1355838795&sr=1-1)

Wading The World Wide Web: [http://www.waterstones.com/waterstonesweb/products/keith+kyk...](http://www.waterstones.com/waterstonesweb/products/keith+kyker/wading+the+world+wide+web/5317421/)

This is what I'll go for: [http://www.waterstones.com/waterstonesweb/products/john+naug...](http://www.waterstones.com/waterstonesweb/products/john+naughton/from+gutenberg+to+zuckerberg/9154808/)

</comment><comment><USER2> In addition to whatever you find and think up (and it would be nice of you to post what you find later) ...

Set your Dad up with a blog - blogger, wordpress, posterous, tumbler ...

Discovery is very different when you're a participant rather than a mere consumer.

<comment><AUTHOR> I was thinking of something like this. Maybe a book that takes you through the process of just signing up for a blog and describes each part of the process. It could also show a bunch of other things to do too, like joining up with social media, posting videos on youtube and vimeo, even setting up your own site. Anyway, I will continue my search and report back with details later.

</comment></comment><comment><USER3> Could be the subject of a good eBook that could be kept reasonably up to date as time (and the key sites of interest) passed.

Otherwise - why not just email him a link every day until he is a confident Internet voyager?

<comment><AUTHOR> The link emailing sounds like a nice idea. To be honest I'm kind of fishing for a Christmas present too. I think a book would be a good way of introducing it to him. It actually seems quite odd that there isn't a book that performs this function, or even a website that gives you a guide to getting set up on the net from the ground up. There must be thousands (millions?) of people out there who'd like to get involved, but are stuck outside of the net.</comment></comment>


Ask HN: What was your biggest challenge when you became a team leader/manager? - <AUTHOR> What was the biggest pain you faced after you were promoted or hired for the first time to the leadership position? <comment><USER3> Daisy-chaining a couple bigger recent related discussions that might be helpful since this one didn't get much juice:

Ask HN: Just made Director, now what? [https://news.ycombinator.com/item?id=14937290](https://news.ycombinator.com/item?id=14937290)

Ask HN: Developers who became engineering managers, how was the experience? [https://news.ycombinator.com/item?id=15463612](https://news.ycombinator.com/item?id=15463612)

<comment><AUTHOR> Good idea, thanks for the links!

</comment></comment><comment><USER4> The number of Engineers in denial about their serious mental health issues was my biggest challenge. Getting people help and convincing people, esp high performers that they need help was how I lost most of my hair. Remember kiddos - being good at technical work and being good at life, both require the same levels of effort.

<comment><AUTHOR> Wow, this is an interesting point! I can see how difficult it could be to convince people that they need help with a problem they might not even realize they have.

May I ask you, how did you find out about the mental health issues?

</comment></comment><comment><USER5> For me it is still having programming responsibilities and having to manage the team.

<comment><AUTHOR> Is your boss expecting you to do the programming? Or do you do it because you enjoy it or don't want to delegate?

</comment></comment><comment><USER6> It's easier to debug a program than a person's programming habits.

<comment><AUTHOR> Oh yeah, great point. I have similar experiences. Humans are mewling, disorganized, and miserably analogous :-).

</comment></comment><comment><USER7> If you love writing code more than anything in the world, you will be a shitty manager. You must give up your love for writing code to be a great manager. You must learn to love dealing with people more. I have folks rolleyes sometimes when I say this, but I firmly believe it.

You must learn to communicate to people effectively in all forms. You must learn to inspire & motivate your team. It's not enough to tell them what needs to be done. Even when people understand, they might not be in the mood to do it. You must connect and paint a bigger picture between the code that has to be written and it's value be it how it's changing other people's lives or bringing in profit for the company. Yet after painting this picture and they buy it, you might be shocked to see no sense of urgency. You must learn to instill a sense of urgency and ask them to go the boring route to move quicker. When they want to use the new shinny framework or language but yet something as boring as plain PHP or Python will do. You must beg and plead. Based on where you find yourself, the culture might be working against you, and you might find yourself working really hard not just to delegate but to build a positive culture. The team might not like working together, too many egos, you have to figure out how to get them to work together. Perhaps instead of cooperating, they like to compete, and it shows in the way they slay each other's code reviews instead of pairing. You have to figure out how to tame the ego.

Your job is no longer to program computers, but to program humans. You must enter the right input to get the right reaction, except unlike computers humans are very fuzzy. What works with one person will completely fail with another. You will realize that any failure truly comes down to you. Even if someone failed to do their job. It's all you. Team of 10 people? 10 ways to possibly fail, including your personal short comings.

You are not in the business of managing people really, but yourself. You must be properly organized, get a great time of time management. Learn to trust and not redo what they have done. You are there to serve your team. Give the choice between exciting work and boring, you gotta do the boring work. You gotta go to the meetings. You can't read that new tech book or play with that new tech. You need to read more business books, things that will make your old tech friends question your friendship. :D Books like "High output management", "The Manager's path"

The biggest challenge is that you MUST become an entirely new person and be comfortable doing so without suffering from an cognitive dissonance. It's a whole different game and the things that made you a great developer/whatever will not make you a great manager.

<comment><AUTHOR> Thanks for the insights! It rings very true, but scary at the same time.

I particularly like the point that we must give up our love for writing code to be great managers. It sounds like the biggest mistake managers make - <USER2> they keep doing the technical work, instead of focusing on people.</comment></comment>


The 2018 Wealthfront Career Launching Companies List - <AUTHOR> https://blog.wealthfront.com/2018-wealthfront-career-launching-companies-list/ <comment><USER2> Rover.com made it to the list this year! I think that's a great milestone that we reached as a company.

If you like pets and want to be part of the future of pet care services, give us a try. We're hiring!

<comment><USER3> Are you planning to expand to cats? I could occasionally use someone to come by and feed my cats when I'm out of town.

<comment><USER4> We don't specifically cater to cats at Rover, but we do have people who use Rover for drop-in and other cat care. There's a lot of folks with both dogs and cats, and we have plenty of sitters who are happy to look after both.

And yes! We're hiring!</comment></comment></comment>


Grand Theft Auto IV's First Week Sales: $500mm and 6mm Units - <AUTHOR> http://ryanspoon.com/blog/2008/05/06/grand-theft-auto-ivs-first-week-sales-500mm-and-6mm-units/ <comment><USER2> I wonder what Rockstar would do with a persistent GTA universe a-la WOW.

<comment><USER3> God, I don't think I'd ever leave the house, that would be much better than real life.

</comment></comment><comment><USER4> what's an "mm"? mega millions? :D

<comment><USER5> MM is actually just millions ... it's a weird Roman numeral thing.

<comment><USER6> MM in Roman numerals is 2000. Perhaps the double M is to distinguish between mille (1,000) and million (1,000,000). Cue discussion about short and long form billions and use of dots and commas as numeric seperators.

<comment><USER7> Millions would be M with a slash above the letter. I don't think we can make slashs above letters with any encoding, though.</comment></comment></comment></comment>


Pfizer and US Govt Set up Fake Subsidiary to take Lawsuit - <AUTHOR> http://techdirt.com/articles/20100402/1844298860.shtml

<comment><USER2> _Pfizer was deemed "too big to fail" like that. Why? I have no idea. If the company really did have to close down, it seems likely that others would have picked up the company's various products -- and perhaps done so without putting people's lives at risk._

Pfizer is the number one drug company by sales in the world, so it seems unlikely to me that not being able to bill Medicare/Medicaid for their products would have shut them down. A more likely scenario was that they dared the prosecutors to indict the parent company and then explain to seniors and poor people why they were suddenly required to pay full freight for Lipitor, Zithromax, Celebrex, etc. Pfizer still owns patents to major, important drugs and it seems unlikely that the government could change that without passing broad legislation or running into constitutional issues. I suspect that the people who run the justice department took a hard look at this situation and decided to let these guys off the hook and spin it as "too big to fail" instead of facing the political consequences of prosecuting aggressively. The law preventing companies from billing government insurance programs looks like more of a bug than a feature at this point because it would give them extra leverage if they decided to play chicken with prosecutors in these cases.</comment>


Best Buy rumored to add Apple Genius Bars, display more Macs in stores - <AUTHOR> http://www.appleinsider.com/articles/11/01/10/best_buy_rumored_to_add_apple_genius_bars_display_more_macs_in_stores.html <comment><USER2> From what one of the Geek Squad guys told me, they actually sell their Apple products 'from' Apple (IE Apple gives them stock to sell, rather than Best Buy buying it to sell).

I'm not sure how accurate his statement was, it wasn't exactly a thing to verify with his manager. It's certainly interesting if true, and would add credence to Apple expanding the Genius Bars into Best Buy through a bigger cooperative deal.</comment>


Ask HN: I hacked an ecommerce website, what do I do now? - <AUTHOR> Hi all,
I'm a web developer by trade and I (inadvertently) hacked an ecommerce website yesterday.
It started innocently, while ordering a replacement part for one of my domestic appliances. I received an email with the order status, the website was... let's say antiquated. Curiosity abetting, I soon had access to the whole database, with the full order history, the suppliers and the whole server.
I know I could wreck them but that's not my goal at all. This company has a turnover of > 5M€, based in France (as am I), I very well know the consequences of the chaos I could create.
I'm aiming for a responsible disclosure, but I don't want to get sued. I'd like to help them to get better at security and development, how would you approach this?
Love to all hackers and tinkerers! <comment><USER2> Hi there-

My name is Jon and I'm a Technical Program Manager for HackerOne. HackerOne has a free, voluntary service called Disclosure Assistance. The way Disclosure Assistance works is that we take the vulnerability details you submit and attempt to contact the organization on your behalf. We have a wide range of tools and contacts within the industry that enable us to find the relevant contacts.

HackerOne will attempt to contact the affected organization and verify the identity of an appropriate point of contact to receive the vulnerability information. Once their identity is verified, an email is sent to the point of contact with a secret link to the contents of the bug report and the interactions between the hacker and HackerOne. At this point, the vulnerability information has been successfully shared with the affected organization.

We have helped hundreds of researchers responsibly report security issues, and would be happy to help in this instance as well. I want to reiterate that this is a free, voluntary service. You can read more about it and submit a report here: [https://hackerone.com/disclosure- assistance](https://hackerone.com/disclosure-assistance)

</comment><comment><USER3> Tu es déjà dans l'illégalité pour maintien dans un système informatique. Supprime tout ce que tu as pu récupérer, efface ton historique de navigation, etc puis oublie cette histoire. Certains ont déjà été condamnés en France pour ça. La loi n'est pas faite pour protéger les personnes comme nous qui trouvent une faille par hasard et voudraient aider en la communiquant au propriétaire du système informatique. Tu n'as malheureusement que des soucis à tirer d'une telle histoire.

Du point de vue de la loi française, entrer ainsi dans un système informatique, c'est comme entrer dans une maison ou une voiture dont la porte est grande ouverte. Illégal. L'analogie a ses limites (on peut voir une porte de maison grande ouverte sans entrer et avertir le propriétaire, alors que pour un système informatique c'est une foie entré qu'on voit que la porte était grande ouverte).

<comment><USER4> A noter, l'article 323-3-1 "Le fait, sans motif légitime, notamment de recherche ou de sécurité informatique, d'importer, de détenir, d'offrir, de céder ou de mettre à disposition un équipement, un instrument, un programme informatique ou toute donnée conçus ou spécialement adaptés pour commettre une ou plusieurs des infractions prévues par les articles 323-1 à 323-3 est puni des peines prévues respectivement pour l'infraction elle-même ou pour l'infraction la plus sévèrement réprimée."

Tel que je le comprends, si tu transmets un bug report à HackerOne... ben... tu morfles aussi!!! Parce que je doute que tu puisses te prévaloir du "motif légitime" de "sécurité informatique" puisque tu n'es pas dans le cadre d'une prestation spécifique de sécurité pour un client.

</comment></comment><comment><USER5> Contact a lawyer who represents clients for this sort of thing (if such even exists). The company in question — who knows how they will react. Even if we (all of us here on HN) know your intentions are noble, your discovery may inevitably lead to someone getting fired over this. That person may very well portray your hacking as malicious and try to divert the blame on you. Better safe than sorry.

<comment><USER6> I would even suggest that the lawyer contact the company on your behalf without revealing your identity. I've seen these things go sideways and if you really want to disclose, make sure your identity remains anonymous until they explicitly agree not to pursue any legal action. I'll also add that they might behave irrationally - it can take many forms (denial of a security issue, legal action, defamation of character). But I might be a bit cynical as well, been down this road in the past.

</comment></comment><comment><USER7> Part of your ethical consideration in making this decision is the well-being of all the customers whose data is waiting to get stolen

</comment><comment><USER8> Do they have an email address for security incidents? What about responsible disclosure documentation? Could be a good indicator on whether they value the security report or not.

I'd personally disclose it to them in the interest of protecting everyone else that uses their platform. You have the power and ability to stop what sounds like a pretty catastrophic leak.

IANAL but you're intentions are clearly in the right place, they'd be uproar if they tried to prosecute you...having said that they might still try

<comment><AUTHOR> Unfortunately, they don't have one. Their development and security practices are straight from the 1990s, I don't think they even have someone reponsible for these areas anymore.

I'm at a loss because I've got the feeling that they are no technical people at all. I feel for them because I know the pains of selling online and I don't want to wreck the livelihood of these people.

</comment></comment><comment><USER9> I've sent emails anonymously but I'm not sure I would do it in the future. It doesn't seem like it's worth the risk.

You might wait 30 days or more in hopes their logs don't have your previous requests in them which could potentially identify you.

Ethically it doesn't seem right to feel obligated to help a business that has a problem. They have money and it's their responsibility to run their business competently, not yours.

</comment><comment><USER10> Try to contact them and offer to fix the errors.

I did something like this and when I reported the URL with the vulnerability they didn't answer, but when I tried to access that URL I got a page that said "the bug is in uranus". Unfortunately if you added any parameter to that URL the admin panel was still public.

<comment><AUTHOR> That's exactly the kind of childish answer I'd like to avoid if I disclose the security vulnerability ;-)

</comment></comment><comment><USER11> No good deed goes unpunished. Walk Way.

</comment><comment><USER12> Under GDPR they must disclose to their users this security problem because they could have a potential data breach.

This situación should be handled by the Data Protection Officer (DPO) the company must have either a) con payroll or b) as contractor.

If I were you, I would report this anonymously to avoid beign sued.

Even better: talk to your lawyer and ask him/her to report anonymously the incident for you.

I have been un court as a designed expert and the concept of accidentally discovering a vulnerability is hard to explain to law people.

Other developers / security people will understand it, but DPOs are usually lawyers that report to the board that is composed of lawyers...

</comment><comment><USER13> First, create CLEAR instructions that shows how to access the database from outside the company. It's best if you create a script.

If you have zero tolerance for risk, then print out the instructions and a copy of the script AND put the script on a thumb drive. Then mail them (physical mail, in a literal envelope) both to the company with no return address.

Then you've done your part, and you're unlikely to be sued.

Good luck.

<comment><AUTHOR> Unfortunately, they don't seem to be technically oriented, their website was built in 1997... I'm not that risk averse and I'd like to help them to improve their security and development practices, I'm aiming to get in touch with them without compromising myself if they react badly.

</comment></comment><comment><USER14> > based in France (as am I)

The laws in France seem a bit better as far as "unauthorised access" is concerned, I haven't heard of any precedents where security researchers have been prosecuted there.

In any case, I'd recommend disclosing it anonymously over Tor (do they have a contact form? If so just fill it in using the Tor Browser).

</comment><comment><USER15> Wait for your order to arrive and then submit a GPDR request to delete your information.

</comment><comment><USER16> I'm not sure what the legal framework for this is in France.

Hence, my best advice is this: Contact a lawyer who's well-versed in local IT law before doing anything further at all.

</comment><comment><USER17> Be very careful! Don't take any risks for them.</comment>


Go-flavored Pascal: A small embeddable self-hosting Pascal compiler for Windows - <AUTHOR> https://github.com/vtereshkov/xdpw <comment><USER2> It's interesting how the software landscape twists and turns sometimes. Go itself has some good Pascal-ish flavor, mostly via Oberon (although I actually liked the comparison with Algol 68[1], flawed as it was)

A good comparison of Go-like interfaces vs Oberon's minimalistic record extension would be interesting.

[1]: [http://cowlark.com/2009-11-15-go/](http://cowlark.com/2009-11-15-go/)

<comment><USER3> Indeed. Pike also created the editor acme, which clearly was inspired by Oberon.

<comment><USER4> I really love that the Pascal/Modula/Oberon lineage became mainstream via Go.

<comment><USER5> Pascal used to be mainstream, but it fell out of favor after Borland became the defacto standard and then self-destructing.

<comment><USER6> I believe that Pascal's problem was that it didn't have any standard, while C and C++ were standardized early (even before the official standard there was an informal one). There was also the influence of UNIX software behind C, while Pascal was not as well established.

<comment><USER5> Pascal was actually standardized both as ISO 7185 a few years before C and the same year as C as ISO 10206 (see [0]), however both (especially the second) saw very little interest and any further standardization efforts stopped soon later. Even from its inception (like all of Wirth's languages) it was meant to be extended - even the standard itself mentions that any deviation from it is accepted as long as it is documented. Dialects are much more common in Pascal, pretty much like BASIC (and other languages - standardization to the level of C and C++ isn't really that common).

In practice every implementation was copying features from the most popular of its time - UCSD Pascal in the earlier days, Borland Pascal in later days (and Borland Pascal actually copied a bunch of features from UCSD Pascal). Implementations were running on systems that had enough differences as to not be worth the portability anyway.

Nowadays pretty much all Pascal compilers are either pure procedural Pascal compilers loosely based on the first standard (i do not think the extended one was implemented much) or the object oriented variant introduced in Delphi. AFAIK pretty much all of the latter support the Delphi 7 dialect, so that acts as a sort of de-facto standard.

The UNIX influence was a much much bigger reason that C got so widespread and C++ simply piggybacked on that.

[0] [http://pascal-central.com/standards.html](http://pascal- central.com/standards.html)

</comment></comment></comment></comment></comment></comment><comment><USER7> Amazing Work!

Exactly the right level of functionality vs. complexity for compiler writing educational purposes, which is very hard to do!</comment>


First Glance at Objective-C and the iPhone SDK (by a Java and C Developer) - <AUTHOR> http://webbtech.posterous.com/a-java-developers-first-glance-at-objective-c

<comment><USER2> "Message (function call) syntax seemed funky."

"When I first realized the language offered weak typing -- with the (id) variable -- it seemed to go against everything that C stood for in my mind."

These are good observations, and reflect deliberate choices in the design of Objective C.

The funky message syntax makes clear that a sending a message is _not_ equivalent to calling a function. Conflating the two will eventually lead to pain and confusion.

Declaring a variable as "id" does indeed launch you out of C's type system, into a realm where any object can potentially respond to any message, regardless of its type. This leads to a lot of interesting possibilities and patterns that Cocoa (and iOS) leverage heavily.

<comment><USER3> Sending a message is indeed equivalent to calling a function, specifically the function objc_msgSend (or one of its variants, depending on return type).

It's also very much like calling a virtual function in C++, only slower.

<comment><USER4> In the normal case it's still very fast [http://www.friday.com/bbum/2009/12/18/objc_msgsend-tour- part...](http://www.friday.com/bbum/2009/12/18/objc_msgsend-tour-part-3-the- fast-path/)

<comment><USER3> My day job is working on a mixed C++/Objective-C project (Safari). My statement that ObjC method calls are slow is based on staring at a lot of profiles and poking into the assembly. If you study the page you linked, you can see that even the fast path results in four serialized load instructions:

1) Load class pointer from object movq (%rdi),%r11

2) Load cache pointer from class movq 0x10(%r11),%r8

3) Load cache entry (IMP) from cache movq 0x10(%r8,%rcx),%r11

4) Load function pointer from IMP movq 0x10(%r11),%r11

Notice that each of these loads reads into a register which is then treated as an address by the next load. This does a great job of totally stalling your pipeline while you wait for memory reads. I've been staring at this same grim pattern in the profiler since the days of PowerPC.

C++ virtual function calls are doubly-indirect in the worst case (read vtable pointer from object, read function pointer from vtable). And because it's emitted at the call site and not hidden in a function, the compiler can often reduce it down to singly indirect or even direct link it as a static call, if it can prove the exact type.

Objective-C is not as bad as some say, but if your code is highly optimized, method call overhead can become a bottleneck.

<comment><USER4> Nice reply, thank you.

</comment></comment></comment></comment></comment><comment><USER5> While that's a decent summary of his current perspective, I'd wager that the biggest adjustment won't be memory management. Although that is a trap for new players, a bigger adjustment will be to think and code in the "Cocoa-way".

In my experience, Cocoa Touch has all the benefits of it's very mature Mac OS foundation, and to develop effectively, and minimise friction, you need adhere to the Cocoa way.

<comment><USER6> I thought ObjC had garbage collection now?

<comment><AUTHOR> I don't know the history here, but based on the autopool directives it looks like they toyed with the idea.

<comment><USER7> With gc enabled, [autoreleasePool drain] asks the gc to run (IIRC), with gc disabled, it releases everything currently owned by the pool. Even on the Mac, you may still want to build your app without gc for performance reasons, and Apple gives you that option.

I'm sure we'll see gc on iOS devices eventually, but it's probably too memory hungry to be practical on the phone right now.

<comment><USER8> Either that, or the objC gc isn't ready for a phone-constrained environment yet. Android seems to manage OK, but they put in a lot more up-front work into making it viable there.

</comment></comment></comment></comment></comment><comment><USER9> I started about a month ago... As someone with a background in Java/C++/Python, here are some more that have caught my attention:

\- The ability to assign types as ClassName<Protocol>, instead of the protocol specifying the type completely. Neat, I guess...

\- Because it's message passing, you get duck typing for free, albeit with compiler warnings (you send a message, and wouldn't you know it, the selector exists!). Not that I recommend this approach over protocols.

\- The awesomeness of @selector, especially if you're coming from Java and used to writing anonymous classes everywhere simply for the sake of making functions first-class entities.

\- The lack of public/protected/private visibility modifiers and how variables are suddenly part of the public API when you define them in properties. Say you have a variable you want to keep private, but you need to frequently update its value. You go ahead and define @property (nonatomic, retain) for it so within the class so that you can simply do self.varName = newVarValue to update it. But now all your clients/outside clients will see; you need to write the release-and-retain setter yourself in the .m file to prevent this.

\- The minimalism of Xcode. Hey, it's faster than Eclipse, thank $DEITY for that. But when I want to alphabetize the filenames in the left sidebar, I have to go to Edit -> Sort -> By Name for _every_ file group?

<comment><USER10> You can use @public, @private, or @protected on the instance variables. Unfortunately these do not extend to the properties themselves and you have to use a different approach as in the sibling comment:

      @interface SomeClass (SomePrivateCategory)
         @property (nonatomic, assign) NSUInteger count;
         ...
      @end

<comment><USER11> Actually, Objective-C has class extensions for just this purpose. No need for a private category.

</comment></comment></comment><comment><USER12> One of the biggest pitfall for beginners is the fact you can send messages to nil objects.

Secondly, while this is minor, I find it annoying that when declaring array's I have to include nil at the end.

</comment><comment><USER13> Exactly when and where did Apple suggest not to use NSAutoReleasePool?

<comment><AUTHOR> I know this is a broad statement on my part. Apples says the following in the hello world tutorial, "In general, however, you should try to avoid using autorelease wherever possible since it means memory may be reclaimed later than it would be if you used release."</comment></comment>


Pico Process Overview – Linux binaries on Windows - <AUTHOR> https://blogs.msdn.microsoft.com/wsl/2016/05/23/pico-process-overview/ <comment><USER2> Compare to the way Cygwin does things: [https://www.cygwin.com/faq.html#faq.api.fork](https://www.cygwin.com/faq.html#faq.api.fork)

<comment><USER3> That link contains some fascinating insight into the machinations required to get POSIX-like behavior on a Win32 backend. Thanks for posting.

</comment></comment><comment><USER4> Instead, MS should create a properly supported Win ABI for Linux. That might actually be useful.

<comment><USER5> WINE and ndiswrapper are doing just fine.

<comment><USER6> I don't know when the last time you used Wine was but there's a ton of incompatibility still. A properly supported compatibility layer from Microsoft would remedy a lot of problems.

</comment></comment></comment><comment><USER7> I realized I was constantly programming services that would be run on Linux servers, through a Linux container dev environment, running on a Linux VM running on Windows. I finally just cut out the middle man and installed Linux (Fedora w/ GNOME3) and it was the best decision I ever made.

I might try "bash on windows" but there have been compatibility layers like this for years and there are always drawbacks. For instance it'll be years before this can be considered stable for production, so this is purely for developers. As most developers know, when you go to deploy on a production machine things don't always work the way you expected them to because the production environment is slightly different than your development environment. If your development environment is a frankenstein OS with different parts sewn together to make it work then it's going to just add further complication to the process (Will a Linux service interface with a windows service?).

My workflow involves spinning up containers (usually gentoo) on a remote server for each new project and just sshing into them and using vim and other cli tools to build projects. This has been the most superior workflow I've found. I can use a light laptop for pretty much everything because a remote server does all the hard work.

I know many developers who use this workflow and for large projects that require powerful computational resources this is essential.

The only reason I see to use Windows for development is if you were developing Windows desktop apps and I don't know anyone who's building new windows desktop apps, most people are targeting mobile. Those who do work on Windows desktop apps are usually maintaining something that's been around for years. There are a few other reason to use Windows over a unix or unix-like OS but most of them come down to Microsoft and other companies releasing proprietary software which is locked into their ecosystem, and I'd like to avoid software like that.

Also I'd just like to add that I never realized how bad fonts were on Windows until I tried other operating systems. If MS wants to attract developers they need to fix their fonts. IMO this is even more important than a Linux compatibility layer because all I do is stare at text all day.

<comment><USER8> Mac is very popular in developers, while not being used on servers. Reason? You get high end laptops with drivers and a linux like command line. But the applications and frameworks are all different, osx and linux have separate binaries for node, java etc.

Luckily that doesn't matter, most of the programming and testing is done at a high level, where base OS doesn't matter. This is the market they are after.

<comment><USER9> >Mac is very popular in developers, while not being used on servers. Reason?

Linux is free ?

<comment><USER10> UNIX utilities on Win32/64 still feel weird. You don't really have forward- slash paths adopted everywhere, and you have weird volume drive mounts. Writing a Windows app means you have to deal with the realities of Win specifics (e.g file systems) and the fact that you can't link to a UNIX-shared library like you can with OS X. Windows line-endings have screwed me over with running bash scripts (easy to fix with git settings). Have to deal with cmd as default shell. Windows out of the box loves the wchar_t type and std::wstring, a 2-byte character which doesn't even really encapsulate Unicode (UTF-8 is used just about every other operating system).

While OS X binaries aren't compatible with Linux, it's usually just a recompile. Sometimes there's a little more to it. But generally a lot less work than Win32/Cygwin. Yet to be seen with Ubuntu on Win32/64, but apps written in Windows Linux subsystem have been said not to be fork able from Win32/64 apps.

However, Mac's file system HFS+ is terrible. That's a good reason not to use it for servers on top of parts of it being proprietary.

</comment></comment></comment></comment><comment><USER11> The video in the post is worth a watch, very informative whiteboarding.

</comment><comment><USER12> This is part of the 'drawbridge project', I wonder if the idea is to pull up the bridge at some point. Embrace, extend and extinguish.

<comment><USER13> Describe how the "extinguish" process would work.

<comment><USER14> Hypothetically, it comes after the "extend" phase, during which Microsoft alters, extends or replaces the functionality of GNU tooling in attractive ways under non-free licenses so that, over the course of several years, users end up building their applications on non-free foundations that Microsoft has made available both in windows and in linux distributions.

When moving to the "extinguish" phase, Microsoft uses their non-free licenses to unilaterally retract support for linux, leaving windows server as the only option.

There's no concrete evidence that this technique is what's going to happen, but Microsoft has a history of it and everyone who invests in this platform should be aware that even if that is not the plan right now, it is possible for the plan to change at any point down the track. I recommend maintaining a healthy level of suspicion for the next few years.

<comment><USER15> Well for now their top priority is to make a binary compatible way to run pre- existing (parts of) Linux distro, and it works quite well for beta software (I would not have said the same if it was released software in the same state, but they seem to very actively be working on it and fixing bugs, and progress is shown between builds)

Some technical console details are far from perfect IMO, but already good enough for common scenarios and given the context they are in its quite impressive (even if shortcuts are taken in regard with Windows interop)

What will come after will largely depend upon the reception on the first release, I guess. Loads of people already want to at least be able to spawn Windows processes from the WSL env, but that's quite understandable and present no serious risk of extinguishing the GNU/Linux ecosystem by some kind of miracle. I would not see any point of MS going further; they have their own complete ecosystem which in some aspect is technically far more advanced and/or has far more potential than competing solutions (UWP is all about convergence and unless they reboot once again, which I think they have no reason to do anymore, they will eventually get it right on mobile, now maybe from a time to market point of view this will be too late but I highly doubt that the android subsystem will be resuscitated so I don't see what WSL could bring to that story anyway), most people are not even going to want to run WSL in production for server workloads (and would have not wanted to even if MS told them it's OK, which they did not).

The dev target is a very good choice and the approach solve 90% of the issues previous attempts (Posix subsys, SUA) had (not used enough, separate target with small ecosystem, eventually buggy because of that), and for some other applications Cygwin is already available right now and good enough for what it does and how it does it. The Posix subsys had actually been instrumental for MS to a wide take over of US public markets in an impressive bad faith stunt (and that actually was the only reason for its very presence), but the situation is radically different now and the expectation have moved to higher layers, so if they manage to use it like that again I think it will only be in anecdotal proportions.</comment></comment></comment></comment>