Ask HN: How much money do recruiters make? - <AUTHOR>

As I'm sure you're all aware, the volume of recruiter-spam you receive when you're actively looking for a job can be deafening. I'm wondering, what kind of financial motivation is behind all this aggressive matchmaking?
Does anyone know how well they compensated? I really have no idea if they're making minimum wage, or millions of dollars. Just looking for some context here.
Any insight appreciated. <comment><USER2> I am not an expert in this field, but I can tell you this much at least in the US:

1\. Most recruiters get paid a percentage of the first year salary. Depending on the position, company, recruiter, etc... that can range from 10-20%. So a recruiter filling a $100K stands to make from $10K to $20K on the one placement.

2\. One of the biggest issues in the industry is what they call "back door hires". Essentially this is where the company hires a candidate referred to them by a recruiter, but does not inform the recruiter of the hire, thus avoiding paying the commission. There are numerous reasons this can happen from complete accident to intended result.

3\. There are recruiters who specialize in placing very specific levels. The higher up the position = the more niche the recruiter = the higher their fees. A recruiter working for a Fortune 500 company to find a new CEO stands to make significant money. Usually these firms will have a very refined candidate pool already developed that they work from. Probably one of the most premier executive level recruiters is Heidrick & Struggles.

4\. It is advantageous to the recruiter to talk to as many people as possible for positions to gain an understanding of who is out there and what their skill set is. Even though you might not be a good fit for the current position, you may be a perfect fit for the next one.

5\. For non-executive recruiters it is advantageous to place as many people in positions. These recruiters while not earning the big single commissions, earn on the volume of placements they make. That is why you see the recruiter-spam you see when applying for jobs.

</comment><comment><USER3> I have worked with recruiters in different capacities over the past 17 years or so. From using them to find work to using them to fill positions. Almost all firms work off a percentage of the hiring salary with a guarantee or buy back within a 90-120 day window. Additionally, they are paid a sliding fee if a candidate is hired within the next 12 months after being referred to the company by the recruiter. The fees are usually around 15-25% of the hiring salary, but I have seen as much as 30% for tough to fill positions. Also, if you use a recruiter to get a consultant for 3 months then hire that consultant the fee will be reduced by some percentage, usually after 180 days you are free to hire the consultant without any further payments to a recruiter.

The fee is paid by the employer to the recruiting firm, the actual recruiters usually make a percentage of that fee. Their take home is usually a small base salary plus their percentage paid out of the 90 day window. You'll know a good recruiter if you are a candidate because he/she will follow you really closely for 90-180 days to make sure you are happy and sticking with the company until at least after their guarantee window has passed. This helps them make sure the company is happy and you are so they keep their commission. Their commission varies, but is usually between 10-35% again partially depending on the difficulty of the position they are filing.

So a decent recruiter, that is good at networking and places people intelligently, will make a reasonable salary. Generally around $75k-$150k, with outliers on either side I am sure. Partners in firms of course will take a higher percentage of each placement.

</comment><comment><USER4> The following information was sent to me unsolicited by a indecent recruiter whom took a bunch of resumes from attendees of niche a user-group and then blindly/unsolicited spammed to potential employers - names intact and uncensored - whilst promising the candidates that "jobs existed".

ie. faking supply/demand for selfish personal growth whilst jeopardising the employment of existing candidates.

[https://dl.dropboxusercontent.com/u/17855015/Permanent%20Ter...](https://dl.dropboxusercontent.com/u/17855015/Permanent%20Terms%20%28Australia%29%20-%20with%20Amendments.pdf)

From page 8 w/figures in $AUD:

        > Standard Fee    Candidate's Salary
        > Flat Fee of     $10,000 Up to $39,999
        > 25%             $40,000 to $49,999
        > 30%             $50,000 to $79,999
        > 35%             $80,000 and above

</comment><comment><USER5> > what kind of financial motivation is behind all this aggressive matchmaking?

You can actually ask the recruiter specifically how they are being compensated. A transparent broker will share that with you. (*Red Flag if they refuse). It's also a good indicator of what their client relationship is like.

The traditional recruiter/executive search business model is currently facing tremendous downward margin pressure on fees. Conversely, the demand for seasoned software developer talent is red-hot. Lots of sharks in the water these days.

</comment><comment><USER6> Having worked alongside recruiters in a firm that placed mostly IT roles for Wall St firms back in ~2005, the highest compensated made a little over 200k while the median was somewhere between 80 and 100k. I would think your typical recruiter makes between 60k and 80k.

As an aside, the firm changed the comp structure because of that 200k recruiter. She was terrible at her job but adept at shoving unqualified candidates into roles. She made great money but seriously tarnished the reputation of the firm during her time there.

</comment><comment><USER7> Usually some kind of finders fee, e.g. $10-20k for a software engineer placement in the SF Bay Area. Often paid after a specific period of work has elapsed (e.g. 3 months). Sometimes a percentage bonus based on the first year's salary.

(I am not a recruiter; I'm on the other side of the same spam, sadly. However, my partner has worked closely with recruiters and gave me a massive braindump of the space just a few days ago. Would love to hear from some actual recruiters.)

</comment><comment><USER8> My recruiter was quite open with me.

The company he worked for charged 15% of my salary. He himself took a percentage of that which increased at stepped intervals when hitting monthly targets reaching almost a third of the fee.

Surprisingly advertising jobs seemed to be one of the biggest costs accounting for about £1-2k per placement. Office, transport and other costs obviously had to come out of the fee too.

Overall he had about a £20K base rate and was aiming for £20-40k in commission each year.

</comment><comment><USER9> I think they make a percentage of the salary of the person they helped hire.</comment>


Show HN: A HN desktop app for reading links and comments next to each other - <AUTHOR> https://florian.github.io/HNClient/ <comment><USER2> This should be a website. My ad blocker doesn't work and I can't open links from stories in new tabs.

<comment><USER3> [https://hn.premii.com/](https://hn.premii.com/)

</comment></comment><comment><USER4> Is there simply no way to login to HN for commenting from within the app?

EDIT: Eh, nevermind. I read a bit of the source and see more of what's happening. I'd thought this was simply fetching in and subtly styling the comments page directly.

<comment><AUTHOR> The HN API doesn't offer this stuff so far. It's readonly. And I don't want to ask users for their password.

</comment></comment><comment><USER5> [https://www.tree.social/](https://www.tree.social/)

</comment><comment><USER6> Looks great. Just started playing with Electron and this one wil be good for learning. Bookmarked :)

</comment><comment><USER7> Please, please add some way to see new comments since you last viewed.

Otherwise, looks awesome!

<comment><USER8> In case you are using Firefox [https://news.ycombinator.com/item?id=11489556](https://news.ycombinator.com/item?id=11489556) Might work on Chrome too but not tested.

<comment><USER9> I use this extension on Chrome, both marks new comments with a vertical orange stripe, and adds expand and collapse thread widgets, including one to collapse the whole thread you're in in the middle of: [https://chrome.google.com/webstore/detail/hckr- news/mnlaodle...](https://chrome.google.com/webstore/detail/hckr- news/mnlaodleonmmfkdhfofamacceeikgecp)

</comment></comment></comment><comment><USER10> Please make one for Reddit too!

<comment><USER11> [http://reddit.premii.com/](http://reddit.premii.com/)

It has a Chrome app, but you can make an app with MacPin, Nativefier, Fluid, WebShell, etc.</comment></comment>


iPhones 'disabled' if Apple detects third-party repairs - <AUTHOR> http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair <comment><USER2> I posted this earlier today, but the current article (from bbc.co.uk) does a poor job covering the issue. In summary, Apple iOS uses a validation system to ensure Touch ID sensor is not maliciously replaced or modified. The Touch ID sensor has access to the iPhone Security Enclave, where fingerprint data is kept. A malicious sensor could, hypothetically, steal fingerprints from an iPhone user unknowingly. This could be used to unlock the phone and make purchases through Apple Pay without the owner's permission. To prevent this, Apple uses a validation system whenever the Touch ID sensor is repaired. When iPhone is serviced by an authorised Apple service provider or Apple retail store for changes that affect the touch ID sensor, the validation paring is updated. Third-party repairs to the sensor will not update the pairing, and will fail validation when using Touch ID. This validation error is shown to users as the mysterious "Error 53".

If the validation fails, the device will function mostly fine, although with Touch ID disabled. However, the device will be prevented from restoring or updating to a new version. Restoring from backup still works. I'm not too sure why restoring or updating is blocked, but my guess is that they want to prevent malicious software from being uploaded in this process.

From the Daily Dot article, if a user encounters this error, Apple's current resolution is a full device replacement. It may be overkill I don't think Apple expected many people to encounter this issue, so it seems reasonable why they chose this option.

This is a great security feature for users, and I'm really glad Apple engineers considered this situation. Unfortunately the media is blowing this and leaving crucial details about what's happening and the reasoning behind it.

Here is Apple's statement on the matter:

 _We take customer security very seriously and Error 53 is the result of security checks designed to protect our customers. iOS checks that the Touch ID sensor in your iPhone or iPad correctly matches your device 's other components. If iOS finds a mismatch, the check fails and Touch ID, including for Apple Pay use, is disabled. This security measure is necessary to protect your device and prevent a fraudulent Touch ID sensor from being used. If a customer encounters Error 53, we encourage them to contact Apple Support._

<comment><USER3> Wouldnt it be more logical to simply disable the Touch Functionality and treat it like a Pre-TouchID button when not replaced by Apple with an OEM part?

<comment><USER4> Why? Then the user is left guessing why their phone is acting like it has no TouchID when it does.

<comment><USER5> Would you rather guess why Touch ID isn't working or have a completely unusable phone?

</comment></comment></comment></comment><comment><USER6> Damned if they do, and damned if they don't.

"Anyone can access your private photos and emails! Just replace the home button with one programmed with your own fingerprints!"

Can you imagine the comments if that were a story?

The problem here is that Apple didn't find a way to tell repair shops and users that this could be an issue.

<comment><USER7> It doesn't have to be either or. Apple could provide a better fail over behavior for the home key, including a way for a consumer to validate the changed hardware.

For instance: "IOS has detected a change in your Secure Home Key. Please contact apple secure support to confirm that your device is still secure!" add a 1-800 number and some security questions. Or automate it by requiring a login to your Apple account, email validation, and email notification of the change.

Bottom line, when one authentication method fails, you need a fail over to something more difficult.

<comment><USER8> The bad guy can then walk the user through that security verification process, and the user is screwed. Think it through.

<comment><USER9> Let's extrapolate this to UEFI/Secure Boot.

If a motherboard displayed an error when a piece of hardware from a different manufacturer was inserted and failed to operate, we'd cry bloody fucking murder. Instead, we expect users to take responsibility and if they compromise their own machine / want to take a risk then that's their business.

Just because it's an Apple phone shouldn't reallign our morals concerning user control and responsibility.

</comment></comment></comment></comment><comment><USER10> I highly recommend reading up on Apple's Security white paper that details how it all works... [https://www.apple.com/business/docs/iOS_Security_Guide.pdf](https://www.apple.com/business/docs/iOS_Security_Guide.pdf)

</comment><comment><USER11> It's totally dumb that a functioning phone is bricked by an update because of repairs done in the past. Imagine the same thing happening to your car. "Sorry sir, the software update done to your car has now disabled the vehicle because in the past someone not related to x (insert name of car company here) has repaired it, your car is now junk (you can't even resell it) and you'll have to buy a new one".

It's just petty revenge because you had to temerity to go to another party other than apple to get your phone repaired and maybe even saved some money in the process. So now, in retaliation we'll destroy your phone in software. I'm sure this will go down well with the various EU courts.

<comment><USER12> Remember the woman who proved that Apple consistently slows down sold iPhones with "updates" right before the launch date of a new model? [0]

Apple is in the business of selling (overpriced/overengineered) hardware. Their tactics make that very clear.

The only problem with that is that there is no real competition in mobile phones anymore, it's just a giant duopoly. Sure, you can switch to Google/Android, which as the giant ad company (in other words: personal data hover/mass surveillance company) is just as bad.

My only hope is for Ubuntu to make the right moves soon.

[0] A source: [http://www.dailymail.co.uk/sciencetech/article-2709502/Does-...](http://www.dailymail.co.uk/sciencetech/article-2709502/Does- Apple-deliberately-slow-old-models-new-release-Searches-iPhone-slow-spike- ahead-launches.html)

<comment><USER13> _Remember the woman who proved that Apple consistently slows down sold iPhones with "updates" right before the launch date of a new model? _

No, because that never was a fucking thing.

Seriously, this is supposed to be a community of reasonably well-informed tech-oriented people. Step back for a second, take a deep breath, and think before you spread nonsense like this. Jesus.

<comment><USER14> That does sound ridiculous.

But please don't comment like this and [https://news.ycombinator.com/item?id=11047606](https://news.ycombinator.com/item?id=11047606) on HN. That just makes the threads worse. Instead, please stay civil even when some people are being silly.

<comment><USER13> You are, as ever, totally right; there's no reason to be rude. Sorry.

<comment><USER14> > _You are, as ever, totally right_

Good lord no. But thank you for the polite response and intention to change. It really is a collective effort.

</comment></comment></comment></comment></comment></comment><comment><USER15> This is still not as bad as the newer laptops in which TPM is soldered onto motherboard and the OS won't boot if it's damaged. You can't even get it repaired, even by the manufacturer without getting a brand new motherboard.

Hardware level security is important, but one must know that whenever you involve hardware into the equation you must allow for collateral damage.

Trusting trust is hard. You can't expect the verifier to verify the security module you got changed from the guy in a basement. Might as well get the OS and kernel from the same guy too.

The reason this disables your phone is the same reason you see a red page when using self signed certificates. The guy vetting you isn't vetted himself. Now there is a case to be made that Apple should just show you a warning and let you use the phone. But this isn't about protecting your privacy, this is about protecting privacy of the guy whose phone you found.

<comment><USER16> How often do you damage a chip on your motherboard? Or need to replace non- capacitor parts on it?

This is such a problem because it's stuck to the screen, and people need to replace screens all the time.

<comment><USER17> This only affects the home button. If you replace the screen and keep your original home button, there is no issue.

I co-own a repair shop. We have known about this for a while. We won't replace home buttons for this reason. But we replace hundreds of screens a month with no issues.

<comment><USER18> Apologies if this sounds rude, because that's not the intent. How can you be sure that people whose screens you've replaced don't then get an "error 53" when they later come to do a software upgrade? Because that's the only time it shows up. Would they know to come back to you about it (possibly shaking fist)?

<comment><USER17> Sorry for the late response--I just now saw this. We've fixed thousands of screens at this point--we'd have an angry mob if screen replacements caused the issue!

Yes, we have had people come back with Error 53; that's how we knew it existed a while ago. All of them had either had their home button replaced or water damaged. We were able to successfully recover one of them after the Apple Store told the guy there was nothing they could do. It was a water damaged home button and we were able to clean the corrosion off of it by soaking it overnight in a special solution. It came back the next day. If your original home button stops working, though, you are screwed.

</comment></comment></comment></comment></comment><comment><USER19> Alternative: Apple stops NSA, China, crooks meddling with TouchID during repair.

[https://twitter.com/charlesarthur/status/695709113964195840](https://twitter.com/charlesarthur/status/695709113964195840)

<comment><USER20> Alternative alternative: Apple wants you to pay Apple a premium to repair your device.

</comment></comment><comment><USER21> The stated rationale is that it's reasonable for a security-critical device to self-destruct if it thinks it may have been tampered with. Unfortunately this is a phone which costs a lot of money and has much of the user's life stored on it. I wouldn't be surprised to see Apple sued over this; I don't know what the interaction of the Sale of Goods Act and remote-bricking is.

I was thinking along similar lines recently when someone sent me an email to an old PGP key - I was able to dig up the key, but had long since forgotten the password. Do you want your computer security system to fail-open (leaking your stuff and potentially exposing you to fraud) or fail-closed (losing data which may be irreplaceable and of emotional significance)?. It's not obvious. But if you store your photos on your phone, you should probably back them up to the cloud - _and_ to a different system that is not under the same account, either locally or another cloud. User-friendly crypto may be possible, but user-friendly key management is a total nightmare.

<comment><USER22> Apple have been accused of copper-bottoming the rules when relatives want to get access to a dead person's phone.

Apple only really need a death certificate and certificates of probate; but Apple insist on different court orders.

So I'm not sure if SOGA etc will affect Apple here.

<comment><USER23> > Apple have been accused of copper-bottoming the rules when relatives want to > get access to a dead person's phone.

> Apple only really need a death certificate and certificates of probate; but > Apple insist on different court orders.

Huh? Why should next of kin automatically be entitled to all someone's personal information?

</comment></comment></comment><comment><USER24> Albeit necessary to check the authenticity of components such as the TouchID sensor for security reasons, bricking the phones seems extreme. Why not simply disable Touch ID? This is them asking for a lawsuit.

<comment><USER25> I wonder if it's really bricked -- could a downgrade to the previous OS version help? (Admittedly, it's not that straightforward for normal consumers.)

</comment></comment><comment><USER26> It is frustrating the the language of MA 'right to repair' doesn't extend to devices. [https://en.m.wikipedia.org/wiki/Massachusetts_Right_to_Repai...](https://en.m.wikipedia.org/wiki/Massachusetts_Right_to_Repair_Initiative)

</comment><comment><USER27> All these comparisons to car warranties, and more specifically how in some countries there may be a question of legality. The U.S. has similar laws that car dealers can't deny warranty coverage because of third party repairs. IANAL, but it would be interesting to see how this translates to phones (or any other similar asset).

[http://www.consumer.ftc.gov/articles/0138-auto-warranties- ro...](http://www.consumer.ftc.gov/articles/0138-auto-warranties-routine- maintenance)

<comment><USER28> Later updates from Apple have said that they'll replace the touch sensor and other hardware if necessary.

I'm curious; although auto makers can't decline warranty coverage, does an "authorized maintenance" shop change the dynamics?

</comment></comment><comment><USER29> Has someone made unintentional medical joke with this error? It reminds me of [https://en.m.wikipedia.org/wiki/P53](https://en.m.wikipedia.org/wiki/P53), which is responsible for apoptosis - programmed death of cell.

<comment><USER30> Could be intentional.

</comment></comment><comment><USER31> The way they've reported on this seems a bit misleading. Isn't it just that the third-party repairers haven't reset the security mechanism after replacing the home button?

<comment><USER32> The problem is, Apple refuses to reset the security mechanism after such repairs have happened.

Ergo, Apple is bricking phones as some sort of misplaced revenge-like behavior.

<comment><USER33> This doesn't follow. Apple refuses to reset the security mechanism because it can't verify the integrity of the repair.

Call it revenge like behavior is just you attacking Apple. It's certainly incompetent or unanticipated and poorly handled, but it's an attempt to maintain their security promises.

</comment></comment></comment><comment><USER34> Wouldn't a better idea be to simply display an error message to the effect of "your phone has undergone untrusted changes, please bring to your nearest Apple store" rather than bricking the whole thing?

<comment><USER35> This, or simply allow it to be completely reset a la Android or Chrome.

</comment></comment><comment><USER36> People in the US should be complaining to the FTC. In the very least, for phone's under warranty, Magnuson-Moss should apply if Apple isn't fixing these problems for free.

[https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty...](https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_Act)

</comment><comment><USER37> I think it's utterly reasonable for the device to shut down if it detects what looks like tampering with a high-security component. It's frustrating, sure, and the error message is beyond poor, but the behavior makes sense. It's not about preventing third party repairs.

It is unfortunate but true that high levels of security ultimately require trust, and that means that some things we used to take for granted will fall by the wayside. Third party repair of what are now secure components may be one of those things.

</comment><comment><USER38> I guess "iPhone 'disabled' if Apple detects key security component replaced with unauthorized version" wouldn't get as many clicks.

</comment><comment><USER39> I'm not sure I understand what exactly happened here. Was it previously possible for non-apple engineers to replace the home button or was it not? The guardian's article seems to suggest it was: "Indeed, the phone may have been working perfectly for weeks or months since a repair or being damaged."

If that is the case and it was possible to replace these sensors before, apple's narrative that the "error 53" code was introduced for security reasons doesn't seem to make a lot of sense: If the hardware sensor wasn't designed with secure authorization (e.g. via asymmetric cryptography) in the first place, all they could do now in a software update would be to add some kind of cosmetic device ID check.

However, any such newly introduced check in software could not actually prevent "malicious sensor" attacks but would only add a (possibly trivial) additional step to the attack where you have to spoof the correct device id.

Or maybe my reading of the guardian article is imprecise and replacing the home button has always meant loosing access to at least some security-relevant features?

<comment><USER40> You can get the button exchanged, but since each one is coupled with the secure enclave co-processor, touch ID doesn't work anymore. But home button still works, so does the phone encryption, you just can't identify yourself with the fingerprint anymore. If you go and try to add a fingerprint, it behaves like you have a muddy finger and can't scan it. But this ain't an issue since encryption is done by a PIN code first, then fingerprints are used as a more convenient way to unlock.

Frankly the device bricking is BS, since the encryption PIN code is still there and unknown to a possible attacker. You just can't use the victims fingerprints to unlock it anymore, or attach a hacked fingerprint reader, because it still won't be able to access the secure enclave to open and get the PIN code.

</comment></comment><comment><USER41> Now might be a good time to make a donation to the EFF.

[https://www.eff.org/issues/right-to-repair](https://www.eff.org/issues/right- to-repair)

</comment><comment><USER42> Could this be a protection against selling stolen iPhones? As I remember a "broken TouchID" rates pretty high as a shady phone. Does anyone know how does this work? Can you reset a stolen phone or do they just sell those as parts nowdays?

<comment><USER43> This would be a great theft deterrent, if you could remotely brick your iPhone.

</comment></comment><comment><USER44> One more proof that you don't own your device?

</comment><comment><USER45> I love the sentence: >He had to pay £270 for a replacement and is furious.

He was so furious that he bought a second iPhone which had the same fundamental design decisions and would fail in the same way if he got it repaired by a non-Apple repairer. No wonder Apple doesn't give a damn about this - everyone is just buying a new phone from them.

</comment><comment><USER46> I don't see why people are upset or surprised about this. Apple is a pioneer in making electronics difficult to open up and play with.

It has always been their approach to control every interaction that every customer has with every part of their business and every product produced by it.

Accept it or use something else.

<comment><USER47> _upset or surprised_

suprised maybe not so much, but it seems pretty obvious one would get upset if his/hers go-to device is suddenly rendered practically useless?

<comment><USER46> I accept your correction. In fact, now I think about it, essentially 0% of apple customers would likely be aware of this possibility at the time they make their purchase. I should have considered that most consumers won't follow stories like this as closely as the tech crowd.

I do stand by my assertion that it is legitimate for apple to behave in this way though. They get to present their business as they choose to just like any other company and the customer get to choose whether to accept their terms. Personally I don't but, empirically, most other people seem to.

I would however support requirements (as legislation) that consumers should be made aware of such practices at the point of purchase such that they can factor it into their buying decision.

</comment></comment></comment><comment><USER48> I feel like a hypocrite criticising this one. Security has always been a tradeoff against convenience. I've been, overall, happy that Apple's starting to take the security of personal data on a very losable device seriously.

I mean, not to gloss over it. I just got stung €320 for a screen repair, and I won't pretend I'm at all happy with that. But I have to accept we can't have it both ways - if we're demanding tough encryption, we have to accept the inconvenience that comes with it.

<comment><USER41> The problem here is not so much that the devices are being bricked as the fact that it's coming as a nasty surprise. People needed to be _warned_ about this, and the warning needed to happen _before_ they bought the phone.

</comment></comment><comment><USER49> So much for owning something you thought you owned. This has happened again and again, and will increasingly happen in the future under whatever disguise, security-wise or not.

</comment><comment><USER50> Something suspiciously like this happened to me on a second-hand iPhone 6 I bought a few weeks ago. Talk about crappy timing.

Everything pointed to a software issue, but every repair person I took it to (both apple and non-apple) kept saying it was a hardware fault.

Touch ID stopped working and the phone drains super quickly despite not being in use. Hoping Apple can provide a "fix", not gonna hold my breath though.

<comment><USER40> I got a second-hand 5S last year with faulty Touch ID, the seller admitted that it didn't work and didn't even notice because he never used it (at the time also many Touch IDs stopped working after iOS 8 updates). I got a lower price and a friend took it to Apple Store in Germany (had couple months warranty left), where they tried to change the display first, then swapped it for a new unit without issues.

</comment></comment><comment><USER51> I'll take it as a positive that there is a good chance if someone tampered with my device my information is still secure.

</comment><comment><USER52> I feel for both sides of this issue. As a consumer I am upset that I am essentially being forced to either buy a new iPhone or do my repair via Apple (do they even do all repairs?). Although, as a business I understand not wanting third party repairs as those can damage your brand if done incorrectly.

</comment><comment><USER53> I think it is a design flaw, putting a security component in a common fail assembly, a fragile glass cover. Sony chose to put their touch ID sensor in a side button. I wonder if they thought of this, it sure looks like a smart design decision in light of this.

</comment><comment><USER52> I feel for both sides of this. On one hand, as a consumer, I think it's unfair to force users to either buy a new iPhone or do repairs via Apple (do they even do them all?). As a business, I understand how non-Apple repairs can damage a brand.

</comment><comment><USER54> This is just the beginning.

High prices and resale values have spawned a substantial and apparently growing 3rd party repair and refurbishment market for Apple mobile devices. Beyond the dodgy corner unlock shops, multiple national chains have sprung up over the last 2 years where I live that advertise heavily on broadcast TV.

Apple clearly sees this as money left on the table and they're concerned about the emergence of a comprehensive parallel supply chain for repair parts. Bricking end-user devices is one of the few levers they've got to try and shut down this industry, since there's no way to effectively identify and pursue the upstream suppliers in mainland China.

Sucks for the users, though. I wonder if Apple will still be selling devices at all in 5 years, or if they'll only rent them out for €25/$25/£25 per month. Ultimately that'll probably be the only way to get the control they want.

<comment><USER55> People buy a high-end watch, like a Rolex. They can repair it if they have then knowledge. The problem is Rolex, and 99 percent of watch manufactures won't sell your, or your Watch Repair person the parts.

You need to send the watch to the factory for service, at factory prices.

So, when you buy a Rolex, your are actually leasing it? You don't truely own it, if you can't get the parts to fix it?

It's just another way to make money.

I didn't think Apple would irritate their customers at this particular point in time?

And yes, I too believe, "This is just the beginning."

<comment><USER56> Actually a majority of the watches, besides Rolex, in the <$5000 range use standard unmodified Swiss ETA movements, which can be repaired by any competent watchmaker. Very few watches in this price range use in-house movements.

<comment><USER57> [http://watchguy.co.uk/swatch-group-parts- policy/](http://watchguy.co.uk/swatch-group-parts-policy/)

<comment><USER56> Thanks - that's really unfortunate!

</comment></comment></comment></comment></comment><comment><USER58> I'm fairly certain that's illegal in Australia. It's called third line forcing.

Looks like Apple is, yet again, going to be investigated by the ACCC.

</comment><comment><USER59> So basically you do not own your hardware.

</comment><comment><USER60> The iPhone6 and F-35 share the same problem trying to detect approved or faulty parts. Funny.

</comment><comment><USER61> Isn't this piece core to the virtual wallet/payment tech installed on the phone? Should apple's engineers have to put in friendly error messages if you exchange components in what's supposed to be a closed system?

</comment><comment> once-in-a-while Don't use smart phones. Just don't. It works for me.

</comment><comment><USER62> Could someone explain what is the legal basis for this?

</comment><comment><USER63> This type of move can't work now, because Apple is losing its mojo in a very fast pace.

</comment><comment><USER64> yet another thing that anti-iphone people rile and iphone users don't care. The bricked owners will buy the next gen iphone and won't repeat the mistake of third party repair. what's the fuss about? yawn...

</comment><comment><USER65> This is just to protect customers. </irony>

</comment><comment><USER66> Wow, Apple hate like on /r/technology.

</comment><comment><USER67> Lawsuit time, which Apple will lose

</comment><comment><USER68> Correct me if I'm wrong, but from what I understand this is done to protect the customers from tampered with Touch ID sensors.

It may be overly paranoid but I can at least understand the motivation behind this. Changing the display also involves disconnecting the Touch ID sensor so technically a malicious person might have done something that exposes the user of the device in some way.

Statement from an Apple spokeswoman:

"We protect fingerprint data using a secure enclave, which is uniquely paired to the touch ID sensor. When iPhone is serviced by an authorised Apple service provider or Apple retail store for changes that affect the touch ID sensor, the pairing is re-validated. This check ensures the device and the iOS features related to touch ID remain secure. Without this unique pairing, a malicious touch ID sensor could be substituted, thereby gaining access to the secure enclave. When iOS detects that the pairing fails, touch ID, including Apple Pay, is disabled so the device remains secure."

[http://www.macrumors.com/2016/02/05/error-53-home-button- iph...](http://www.macrumors.com/2016/02/05/error-53-home-button-iphone- brick/)

<comment><USER69> Yes, but instead of disabling authentication with the non-authenticated TouchID sensor it bricks the phone.

<comment><USER70> ... until the old sensor is replaced.

Which is a good thing.

This is like complaining that forgetting your encryption password "bricks" your hard drive.

Yeah, apple deserves some flack for not making this known to 3rd party repair shops, but it's not a problem itself.

</comment></comment></comment><comment><USER14> Url changed from [http://www.bbc.com/news/technology-35502030](http://www.bbc.com/news/technology-35502030), which points to this.

</comment><comment><USER71> There is a strong bias, and the amazing thing is that its very difficult for the people who have this bias to realize it. As far as they can tell it is fact, and this is in large part because they live in a filter bubble where they only see things that confirm their bias.

For example: Articles bashing Steve Jobs get upvoted a lot more than ones praising him. Exactly the opposite for bill Gates.

Now if you look at Slashdot a decade before Hacker news the results for bill gates would have been the opposite of what you see here.

Effectively, Bill Gates' millions in spending to improve his PR have changed people's perceptions (they will argue that its because he's such a generous benefactor, because that's politically correct, alas, they won't look too close at the activities of the Bill and Melinda Gates foundation lest they notice he isn't.)

Google Good, Apple Bad, Leftism Good, Socialism Good, Basic Income! Global Warming is FACT, and anything you post that goes against this narrative risks getting you slow banned or hellbanned.

Hell, I was once banned from here for relating how I met Grace Hopper as a kid (in a comment on an article about Grace Hopper.)

I have no clue why that was hell ban worthy, after all she was the original "GRrrl in tech!!11!"

Welcome to hacker news where there are no hackers.

<comment><USER72> For me, the real question is where have all the hackers gone? Years ago, there were high quality contributors here. They all had to go somewhere. When slashdot was dying, it was clear where everyone went (HN and Digg). This time around, it's not clear at all.

<comment><USER73> they just left. arguing with kids is boring

<comment><USER72> I wonder if that isn't the case. If that's true, that would be a shame, but I can't blame them.

</comment></comment></comment></comment><comment><USER74> That's how desperate Apple is.

</comment><comment><USER75> The wonder of closed source

</comment><comment><USER76> More reasons for not to be in Apple ecosystem.

</comment><comment><USER77> Has anyone read full Terms and Conditions?

I think most of the people clicked / tapped / pressed "AGREE".

So here you go.

</comment><comment><USER8> What really surprised me, and what most people don't seem to know, is that repairs at an Apple store are way cheaper than third party repairs.

<comment><USER8> Why the downvotes?

I got a Macbook Pro repaired recently and the Genius guy took me aside and said I got a great deal because they have a per-model, per-service visit price cap on replacement parts charges for repairs. Meaning that in one visit, you can get your Macbook repaired and replace the screen, the motherboard, the hard drive, the power board, the battery, the keyboard, pretty much the whole thing, and the price (for parts) is capped at around $280 for my particular model. The labor price is not capped but they are good at what they do, so the labor is super fast and ends up being cheap.

I had a similar experience with an iPhone repair, where my camera had dust in it. Apparently the best way to do this is a back cover replacement, and the back cover comes with the camera built in. I was pretty scared until I heard the price, which was I think at the time $30, way less than third party vendors charge for this.

Again the downvotes, for providing useful information, are really baffling here.

</comment></comment><comment><USER78> So stupid, it's like they are asking for a class action lawsuit

</comment><comment><USER79> I haven't experience any error 53 codes on the devices I've repaired, but if this is true... Wow! That's really shady of Apple. I'm starting to get the feeling that the moves they're making (like charging for Apple radio [not Apple music], and now disabling phones with unauthorized repairs) is their response to their recent report of declining iPhone sales. Disappointing if this is true that these changes are at the expense of their end users and fans (and I am a fan).

</comment><comment><USER80> This seems like a deliberate move by Apple, since they could've put the secure component ("TPM") on the mainboard, where it won't be as easily damaged, instead of the fingerprint reader. It's like an organism whose brain is in one of its appendages instead of its head...

Either way, if the skills of the Chinese (and other far-East) reverse- engineers continue to be what they are, I think workarounds will be found soon enough - from what I've seen, the repair people in particular are _very_ resourceful and clever, and come up with "tricks" to fix things that the original manufacturer never even thought about. It's their core business; you can bet they'll spend a ton of effort on figuring out how. Apple's proprietary cable authentication chips have been cloned. The infamous Thinkpad BIOS password has been circumvented. Replacements for ink cartridge authentication chips (seriously) have appeared. There is always a crack.

I continue to find it amazing how effective the "security" excuse is; it seems you can get the majority to give up anything if you can turn it into some sort of argument about how it'll make things safer. Who doesn't want to feel safe, even if it ultimately results in society where every little thing you do is controlled by some huge bureaucracy? The old quote on security vs. freedom is so relevant today, but related to what I think will happen, here's a variant on that theme: "I wish for the insecurity that gives us freedom."

</comment><comment><USER81> You DO have the right to repair your iPhone; it just has to be done by an official Apple repair centre.

I completely understand the downsides of Apple's particular approach here, and totally get why people want the right to use 3rd party repair services. I've used them myself in the past to save (a lot of) money.

But considering just how much of my life, financial and otherwise, is on my phone, I'm actually very glad that Apple has erred on the side of obsessive security!

<comment><USER82> Apparently, YOU don't have the right to repair your own iPhone then, only an official Apple repair centre does. You mean: You have the right to pay an official Apple repair center, and nobody else, to repair your iPhone.</comment></comment>


Hangouts Chat - <AUTHOR> https://gsuite.google.com/products/chat/ <comment><USER2> Regrettably with everything goog but translate banned in China, I will stick to Slack.</comment>


HTML5 introduces a new attribute on the script tag called async - <AUTHOR> http://www.nczonline.net/blog/2010/08/10/what-is-a-non-blocking-script/ <comment><USER2> The async and defer attributes are great. Don't forget to added them to your disqus script as well.</comment>


C++ at Google: Here Be Dragons - <AUTHOR> http://blog.llvm.org/2011/05/c-at-google-here-be-dragons.html <comment><USER2> I haven't worked in C (or C++) heavily in about 6 years, since I shut down my prior company and stopped working on Squid or having to look at kernel code. But, these errors are simply beautiful, and make me have vague longings to work on C projects again (I'm sure I'll get over those longings soon).

These are the kinds of mistakes I made all the time when working in C, and the kind of thing that made coding extremely tedious...it feels like magic when the compiler catches them with such clear and concise warnings. For whatever reason, I didn't use lint very much back then, as I guess I always assumed I knew what I was doing and that the compiler would catch mistakes. Having this capability in the compiler is pretty cool and brings C/C++ a small step closer to working in higher level languages, is what I think I'm trying to say here.

<comment><USER3> "Having this capability in the compiler is pretty cool and brings C/C++ a small step closer to working in higher level languages"

C++0x is another (much bigger, in my opinion) step that makes C++ a lot easier to program. It's not quite as easy as higher level languages, but far closer than before, and the performance gains over most other languages make it worth using.

<comment><USER4> I agree. Lately I've been writing substantial amounts of 'higher level' code again, and I find myself writing many checks for the types of variables (as members or arguments), return values, contents of containers, in situations where one may make inadvertent conversions etc. I'm thinking that much of the time I spend on that would have cost me less time if I could have just specified them in the code and the compiler/runtime would check them for me, like in C++.

Of course writing unit tests helps too, but in C++ the compiler catches these things easily. And I haven't had the desire to use a variant in years so the advantages of having a 'variable' that can be of any type is quite minimal, imo. The auto keyword in C++0x will make a large portion of the tedious parts of strong typing in C++ go away, too.

IMO thinks like type hinting in PHP are absolutely steps in the right direction. There is room for both 'scripting' and 'compiled' languages, but good support for indicating and checking the expected or required types in scripting languages helps tremendously in proactively validating programs.

</comment></comment></comment><comment><USER5> To me, the most remarkable thing about this post is that when the rest of the world is falling in love with the "power" of weak typing systems, Google is going the _other way_.

<comment><USER6> _the rest of the world is falling in love with the "power" of weak typing systems_

Really? I'd argue the exact opposite -- with F# and Scala (and some others) on the rise, I think there are plenty of people who are fed up with weak/dynamic typing and want to take advantage of building programs with strong type systems.

At the very least, it seems that the programming world is becoming much more polarized. Anecdotally, it seems that every developer I know is either a proponent of strong/static typing or weak/dynamic typing -- but I don't know anyone that's just sitting on the fence.

<comment><USER7> Those in favor of only static typing and those in favor of only dynamic typing are living in the past. Any interesting evolution in programming languages will allow developers to program with and without types / contracts from the same language.

<comment><USER8> In Mascara (my own project) you can start out with dynamically typed JavaScript, but then gradually add type annotation as appropriate to provide stronger verification. It can be done using structural types without changing the runtime semantics, and further by rewriting to use classes and nominal typing.

I think this provides a useful upgrade path, because type verification is a hassle with small projects, but becomes increasingly valuable (IMHO) as the program grows.

The problem with current languages is that you have to decide upfront if you want a language optimized for quick development or strong verification. But often in the real world, programs start out as quick prototypes, and then grow into large applications.

</comment></comment></comment></comment><comment><USER9> When will they enhance it to flag the other error in this line:

long kMaxDiskSpace = 10 << 30; // Thirty gigs ought to be enough for anybody.

10<<30 is ten gigs, not thirty gigs.

<comment><USER10> Doh! Good catch, comment updated. =[ Maybe we do need Clang-for-comments as well as Clang-for-C++ code.... ;]

<comment><USER11> And the error says it's an int, but it's declared long. Am I missing something about long in C++ not being 64 bits?

<comment><USER10> That's the whole point. =] This is a surprising aspect of C++: the shift expression doesn't have the type of the declared variable.

The integer literals we are shifting are of 'int' type, and the shift occurs at that type (based on the usual arithmetic conversions). There is stack overflow question with explanations and a good blog post here about it:

[http://stackoverflow.com/questions/836544/usual- arithmetic-c...](http://stackoverflow.com/questions/836544/usual-arithmetic- conversion-a-better-set-of-rules)

[http://blogs.msdn.com/b/oldnewthing/archive/2004/03/10/87247...](http://blogs.msdn.com/b/oldnewthing/archive/2004/03/10/87247.aspx)

Also, you can look through the C++98 standard to understand all the details. Relevant sections are [expr]p9 and [expr.shift].

</comment></comment></comment></comment><comment><USER12> I wonder if this is an indication that google is moving to clang for compiling (and not just diagnostic tools). If that's true, maybe this is another nail in the coffin for gcc? I see apple and google behind llvm/clang, who's behind gcc? Nobody?

<comment><USER13> _who's behind gcc? Nobody?_

I hear there's this kernel called Linux that depends heavily on GCC.

<comment><USER4> But why would the kernel depend on gcc? Are there so many gcc-isms in there that would be hard to replicate on other compilers?

<comment><USER14> The biggest one is (was?) the use of GNU variable length arrays. The GNU extension has different syntax than C99's variable length arrays. There are also instances of __attributes__ on platform specific code.

</comment></comment></comment></comment><comment><USER15> CLint meet CLang and the better for it. Although if I read correctly between the lines, there might be a little trouble getting the engineers to buy in :) Every met anyone who could actually make it all the way through CLint with all warnings on! Enough to drive you crazy!

</comment><comment><USER16> Well written! The simple bugs that it seems to detect are fairly high frequency so it should therefore improve overall code quality. Looking forward to playing around with this in my spare time.

</comment><comment><USER17> I haven't even done any C++ for a while, but reading those other articles on HN about undefined behavior in C made the example bugs in this article really jump out at me.

</comment><comment><USER18> The article implies to me that the third bug (passing 0.5 to sleep() ) is not caught by gcc. Does anyone know if this is the case? It doesn't seem excessively hard to produce a warning about shortening like that - the first two seem more subtle, but that one less so. I don't have gcc on this machine to check it, but VC++ certainly does emit a warning for that kind of thing.

<comment><USER10> GCC definitely has a warning for 0.5 -> int (likely -Wconversion, but I've not checked). It also has a warning for setting a pointer to "false" (-Wconversion-null). However, turning that warning on in a codebase where every warning breaks the build was challenging because of false positives. We're able to remove false positives and narrow the scope of the warning to just the buggy code in many cases with Clang, and that allows us to turn these warnings on much more aggressively.

<comment><USER19> When is assigning a pointer to be boolean false intentional and correct?

<comment><USER10> Most of the cases we ran into were metaprogramming techniques which test whether an expression is a valid null pointer constants. These got innocently applied to 'false' and trigger the warning needlessly.

</comment></comment></comment></comment><comment><USER20> Eclipse highlights these kinds of bugs in java code. It saves me a lot of time.

</comment><comment><USER21> I wonder how their checks compare to Coverity's and QAC++'s.

I have a passing acquaintance with both, and I'm almost certain both would have caught the three bugs listed on that page.

<comment><USER10> I would expect many of these tools to catch these types of bugs. The challenging thing for us has been to catch _only_ bugs, and to catch them very fast during normal compilation.

A lot of the static analyses we've looked into (and I'm hoping for more detailed blog posts about that in the future) find plenty of bugs, but also find lots of non-bugs. Combine that with being too slow to run during the normal build, and you can't break the build when such a bug is found.

I think one of the most interesting aspects of this is how we catch the bugs early, and force developers to fix them immediately by breaking the build.

<comment><USER22> These sort of articles (and the attendant comments about false positives) always scream out for Ada to me. It's a language designed by a calm, careful thinker back in the 80's for life critical programs. It has everything Java and C++ have except the vast number of undefined states and it's designed for static analysis. By designed I mean, there are formal verifiers and the NSA has used it in a test security system.

Plus the compiled code is pretty fast. So if you're feeling the need to reduce your workload take a look at it, you might be surprised.

<comment><USER23> What kinds of libraries are available for Ada? Half the reason I use C++ is that half the code I need to write is already available in mature libraries.

<comment><USER22> Library support is aimed squarely at realtime life critical systems. You're more likely to find a library with some sort of safety certification than not. If you're expecting to use the latest web libraries or hadoop you'll be disappointed.

However, there is a small collection of oss Ada libraries out there.

<comment><USER24> I seem to remember there was a pretty interesting web framework written in Ada, Adaweb I think?

Anyway, Ada has some other amazingly cool features. The concurrency primitives it offers are very cool, lets you make some much stronger guarantees about the interactions between threads than any other language I've seen. For example, you can define rendezvous sections, which if memory serves, are pieces of code that are guaranteed to only be run once both threads participating in the rendezvous and neither thread can leave the section until both are ready.

<comment><USER22> There's ada web server (aws) which is neat. Similar idea to the java web kits like jetty. You can even hotplug code during runtime.

You're right about the concurrency. Ada has a bunch of stuff like that built into the language since 1983.

The particularly cool toys I like are SPARK (a formal verifier tool) and stackcheck - tells you exactly how deep in the stack your code can possibly go. (Yes you have to annotate cycles.)</comment></comment></comment></comment></comment></comment></comment>


Show HN: Crypto Bonsai – Grow your own crypto coins - <AUTHOR> Apparently, I can't post a .live domain. I guess that must have tripped some filters. I only used it 'cos it's very cheap. After all, I am on a budget. Anyway, the link is in the comment. If that's not okay, then moderators: feel free to remove it. Thx. <comment><USER2> You'd probably make more money if you spent your time building sites for people.

<comment><AUTHOR> Wished that was the case, mate. As a newbie, it's bloody hard getting gigs on marketplaces like Upwork, People Per Hour, Freelancer, etc. Not to mention, the market is saturated with many willing to accept much lower rates. By the way, right now I'm pulling in overtime to save up. So, it's not like I'm just sitting on my bum doing nothing. Nevertheless, I'll still fall short. I'll have to make up the difference somehow. FYI this small project really didn't take much of my time. Anyway, I've gotten 7 sales so far since my post on HN. Yeah, most probably just pity purchases lol But hey, I'll take it :) Well, I'll be reaching out to some reporters for some press. We'll see if they bite.

</comment></comment><comment><USER3> You lost me when you claim "rave reviews" from HN.

<comment><USER4> If the "review" from HN in the OP is fake, is it safe to assume that all the other "reviews" are fake too?

<comment><AUTHOR> _facepalm_

<comment><USER4> I hope the SEC also finds the jokes funny, because if some moron invest money in your site and later loose all the money, he can claim that he was convinced by the reviews.

</comment></comment></comment></comment><comment><AUTHOR> Here's the link to my project: [https://cryptobonsai.live](https://cryptobonsai.live)</comment>


Building an online community around learning from incidents (2019) - <AUTHOR> https://www.learningfromincidents.io/blog/learning-from-incidents-in-software <comment><USER2> I've noticed an interesting phenomenon in postmortem review meetings: whenever someone suggests an additional manual step or bureaucratic approval that might have helped, this suggestion is _always_ accepted. When it's patently ridiculous, the action item will just languish in a queue until it's purged in the next ticketing system migration. But in the moment, the whole room's sentiment is "yes of course, obviously we should have been doing that, how irresponsible of us." No one wants to talk costs, proportionality, error budget, etc. I've stopped bringing it up for fear of seeming reckless. But it's not like we're the space program.

Anyone seen this in their postmortem culture? How did you deal with it?

<comment><USER3> There is a quote from Jeff Bezos: "Good intentions never work, you need good mechanisms to make anything happen.". Hence at Amazon (ideally) any suggestion that a manual step or bureaucratic approval could improve a process is always naturally followed up by "But what happens when good intentions fail? We need a plan for a mechanism". At least this is the theory, and how Amazon and AWS avoid accruing manual steps with no plan to automate them.

</comment></comment><comment><USER4> Read John Allspaw's doc (the first reference in the article).

It's absolutely critical to create a culture that when Kirin makes an error, they have no fear and total incentive to explain what they did, when they did it, why they thought it was the right course of action, what happened when they did it, etc.</comment>


Ask HN: What is the best approach to build a SaaS Product with Multi-tenancy? - <AUTHOR> So do you pick
1) Microsoft - ASP - MVC
https://www.appseconnect.com/how-to-design-a-multi-tenant-application-with-asp-net-mvc/
Or using this guys SassKit
http://benfoster.io/blog/saaskit-multi-tenancy-made-easy
A Multi-Tenant (SaaS) Application With ASP.NET MVC, Angularjs, EntityFramework and ASP.NET Boilerplate
https://www.codeproject.com/Articles/1043326/A-Multi-Tenant-SaaS-Application-With-ASP-NET-MVC-A
2) Django
http://django-tenant-schemas.readthedocs.io/en/latest/
3) Any other approaches?
So I would like to know what sort of architectures some startup's have went with, and some of the challenges they hit by picking that approach? <comment><USER2> "Multi-tenancy"

That term is new to me but after reading a few descriptions I think that CouchDB 2.0 is designed in a way that may provide those capabilities.

It has built-in authentication and uses "Users" and "Roles" and "Design Documents" that provide controls and methods to create and access data on a specific database.

[http://docs.couchdb.org/en/2.1.0/](http://docs.couchdb.org/en/2.1.0/)

You might want to look into PouchDB.js as well as the CouchDB Docs.

[https://pouchdb.com](https://pouchdb.com)</comment>


Quip redesigned for iOS 7 - <AUTHOR> https://quip.com/blog/ios-7

<comment><USER2> I believe the pre iOS 7 era will be remembered as the golden age of skeumorphic design. An era that will be remembered for buttons so delicios you would like to lick them. No it"s time to move on to a more simplified Byzanthine style that replaces the old classic design. When looking at Quips flattened design, the future looks like a bright and fun place.</comment>