Careers in security, ethical hacking and advice on where to get started - <AUTHOR> https://www.troyhunt.com/careers-in-security-ethical-hacking-and-advice-on-where-to-get-started/ <comment><USER2> As a counterpoint for this fluff piece for Pluralsight (mentioned 29 times), I'd like to offer the following links with very good information by well respected people in the industry:

\- [https://www.corelan.be/index.php/2015/10/13/how-to- become-a-...](https://www.corelan.be/index.php/2015/10/13/how-to-become-a- pentester/)

\- [https://tisiphone.net/2015/10/12/starting-an-infosec- career-...](https://tisiphone.net/2015/10/12/starting-an-infosec-career-the- megamix-chapters-1-3/)

\- [https://danielmiessler.com/blog/build-successful-infosec- car...](https://danielmiessler.com/blog/build-successful-infosec-career/)

<comment><USER3> Allow me to enhance your list.

"Owasp Testing Guide V4" is a must read for web hackers, at least for starters: [https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table...](https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents)

OWASP has vulnerable application projects for you to play with, such as WebGoat "[https://www.owasp.org/index.php/Category:OWASP_WebGoat_Proje...](https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project"), but there are many applications like these such as "DVWA - Damn Vulnerable Web Application" and variants in Node JS ([https://n0where.net/damn-vulnerable- node-application-dvna/](https://n0where.net/damn-vulnerable-node-application- dvna/))

I also developed two free courses on "WordPress Security" and "Docker Security" [https://dadario.com.br/courses/](https://dadario.com.br/courses/)

The point is to learn development / infrastructure first, then study attacks and defense to develop a security mindset. Get involved in bug bounties, but learn how to fix, don't let your code skills rust. Then learn more security concepts, how to build a corporate security program and keep moving :)

There's also a very famous book in the area: "The Web Application Hacker's Handbook" [http://mdsec.net/wahh/](http://mdsec.net/wahh/)

</comment></comment><comment><USER4> As a hiring security manager: go break shit. I don't care if you have a CEH, I care if you can bring me good vulns. Show me you can break things I care about and that you're not a horrible person and you'll go straight to the top of the list. It's that simple.

How do you get started breaking shit? Github has tons of shit. Go break it. More interested in hardware? Go buy some crappy iot gear and break it. Vulns are not rare and they do not require a damn piece of paper to find. Find them, and you will have no problem finding jobs.

If you are reading this and still don't know where to start, I am happy to help you find things to break and suggest approaches that might help. But seriously,don't waste your time and money getting certified. I don't care at all.

<comment><USER5> To this point, bug bounties, bug bounties, bug bounties. If someone is applying to be a security developer, consultant, or anything beyond a security help desk operator my expectation is that they can tell me about bounties they've collected. In lieu of that, I'll accept them telling me about their ethical disclosures. Also playing CTF's, even without winning is a good sign. It shows passion and that's what matters at this point as we need people in security not because of the money, but because they passionately want to make the world a safer place and enjoy the work as a bonus.

<comment><USER6> I want to push back against this a bit because you used the word "expectation." Yes, I strongly agree that bug bounties are _one way_ to achieve and demonstrate a certain level of expertise in information security, especially if you are trying to break in. However, don't make it more than a job for people who just want to do the job, and don't arbitrarily make it the whiteboard of the security industry.

My best colleagues, the people I most deeply respect and the people who inspired me to work in this industry all neglect bug bounties. They mostly don't participate in them at all. Bug bounties are usually pursued by people who have the free time and bandwidth for them. For the most part, most security consultants and engineers do not actually engage in them because they are already highly paid. This is why you most frequently see bug bounty participants from countries other than the United States and Western Europe.

Those that do have a full-time position and also engage in bug bounties certainly have a commendable passion for the work (or sometimes more accurately a workable formula for getting to low hanging fruit in new programs first), but please don't expect all or even most skilled security talent to adhere to this rule. Many people enjoy being skilled without sacrificing work- life balance. Just as not every software engineer needs to contribute to open source or have a GitHub profile, not every security engineer needs to have badgers for every company they've hacked.

<comment><USER5> I agree with you on your assessment, but those people you respect and inspired you are the one's who are already in the field. They already have accomplishments and have done things to earn that respect. I've found that it's near impossible to differentiate "posers" from actual security people when it comes to hiring someone without a long, formal, and vouched for by others security career. This is where bounties and ethical disclosure come into play. Also note the careful choosing of long, formal, and vouched for wording above. There are certainly people in our industry who are here because they are good at social engineering rather than here because of their technical skills or work ethic. Those individuals are very damaging to our field.

<comment><USER6> Can you clarify what you mean by "good at social engineering"? Do you mean they try to specialize in that and pass it off as actual security rigor ("hacking")?

<comment><USER5> Exaggerating their skill-set, claiming to have skills when they don't. Yes, it could be the Dunning–Kruger effect in action but more than not I think there is careful plotting involved to deceive. It's actually odd if you think about it a bit. I've been going to DEFCON for the last 11 years, have done the CTF thing, the speaking thing, etc., and it strikes me in many ways as a tale of two cities. You've got your highly skilled and technical security professionals who are talking and sharing but then you have all of the roadies, the fans, the people who watched Hackers and want that lifestyle. We don't see this in any other technical field that I'm aware of - I mean I'm pretty sure there aren't blue-haired database administrator wannabe's showing up to DBCon, are there? What ends up happening is that people like the idea. They want to be a "hacker" but want it as a day job but don't have the technical skill so they must figure out ways to social engineer their way into the field.

The folks at Attrition tend to cover it a bit more when it comes to "security rockstars":

[http://attrition.org/errata/charlatan/](http://attrition.org/errata/charlatan/)

<comment><USER6> Yikes, what a list. I see your point though.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I like Troy, but I need to put in a word here against pursuing certifications.

There are no employers in security that I know that anyone wants to work for that take certification seriously. The best people working in security --- not just in application security but in network security, red-teaming, exploit development, and cryptography --- don't have certificates.

If you want to work in startups, a hiring process that even asks if you have a certification is a big red flag. This is less true in the broader tech industry, but while it's probably not a good idea to discard a prospective Fortune 500 employer just because they _ask_ if you have any certifications, it is certainly reasonable to pull the ejection lever hard if an employer _cares_ about them.

Every minute you'd spend pursuing certification is better spent building programming skills.

For whatever it's worth, I still stand behind everything in here:

[https://krebsonsecurity.com/2012/06/how-to-break-into- securi...](https://krebsonsecurity.com/2012/06/how-to-break-into-security- ptacek-edition/)

<comment><USER8> Care to elaborate why programming skills are so important in the field of security? Genuinely curious. I have always wanted to take my skills to the next level but have never actually gotten started. This might be the time for me to start.

<comment><USER9> It's of varying importance depending on what field of security you're talking about, but generally it's the chasm that separates entry-level security folks from the rest.

Using systems administration as an analog, there exists a class of sysadmins who can't write even basic scripts. Their ability to troubleshoot or problem solve are limited to using predefined tools. Whole categories of tasks will be infeasible for them to accomplish (mostly because of the amount of time it would take to do them manually, not necessarily because they are technically impossible).

Lacking the ability to do any programming limits their job prospects to the bottom of the sysadmin barrel. That being said, programming isn't necessarily a prerequisite for their job, it's just a ceiling.

Going back to security, most tasks benefit from the ability to automate some part of them. I come from application security, where that frequently manifests in having to quickly piece together tools for interfacing with a specific protocol or API. Application consulting exacerbates that even more, because you'll usually have to do all of this in a very short amount of time, so that you can spend the allotted assessment time actually doing the assessment, and not trying to get your tools to work with the environment.

</comment></comment></comment><comment><USER6> I'll echo what debatem1 and tptacek said here with what I tell everyone:

0\. Do not pursue certifications at all.

1\. Learn to code. C + Python is a great choice, to start with (or C + Ruby).

2\. Start with application security, because it's the easiest place to get your feet wet.

3\. Work through _The Web Application Hacker 's Handbook_ (don't just read it).

4\. Find bug bounties in as many programs on BugCrowd or HackerOne as you can. Extra resume points (and money!) for bug bounties in Google, Facebook etc.

5\. Join a reputable security consultancy (NCC Group, Optiv, Bishop Fox, etc.) and mature your skills.

6\. Decide how you'd like to specialize.

<comment><USER5> > 2\. Start with application security, because it's the easiest place to get > your feet wet.

This is true because of the availability of targets, however, the easiest place to get your feet wet is not the same thing as the easiest discipline and people must keep that in mind. Application security is the toughest of the discipline's in my book; far tougher than netsec, oppsec, and many others because it's a world of vast diversity of solutions. It's also a world of vast diversity in attacks from SQLi to XSS, to remote unauthenticated remote code execution, to the identification of logic errors which result in the exposure of sensitive information.

<comment><USER6> Yes, I agree, and this is a good addendum to my point. I could quibble about it being the most difficult (I specialize in AppSec and I find crypto much more difficult), but you're right.

</comment></comment></comment><comment><USER10> On a related note, here's a quick guide to infosec in the defense industry:

1\. Graduate from any school with a degree in CS/CE/Math/Physics.

2\. Solve one crackme in your free time.

3\. Apply for all entry level jobs at GENERIC DEFENSE CONTRACTOR that involve keyword "ida pro." Prepare to move to a deserted town in Florida or the DC megalopolis.

4\. Die on the inside when you spend years working on unbelievably complicated problems that do nothing else except get a government employee promoted. Have everyone else in the news/online tell you you're evil.

5\. Spend several months working for a government employee that is amazing at what he or she does. (part of the 20% of employees doing 80% of the work)

6\. Watch as that employee is immediately promoted and replaced by someone else who doesn't care.

7\. Try to transition to non-defense and discover that for all the talk about "cyber!!!!" and infosec in the news, all anyone actually wants is an IT professional that took a one week course at Blackhat on exploitation/has meaningless certificates/knows how to buy and install Nessus products and Palo Alto products. That has to be 90% of the job postings out there.

In all seriousness, if you do think you want to go down the government route, stick to a dedicated research institution or try to get a federal job. There are a very, very small few defense contractors that truly do good work, but they burn too bright and are eventually snuffed out by corporate greed or insane management.

<comment><USER11> Ha ha ha. That was right on the money. Though it seems a bit too pessimistic. And CCOEs mostly have really boring projects.

Raytheon SI, Mantech, and Booz Allen Hamilton have some decent contracts; yes they are in Melbourne and Annapolis Junction (where else would they be in the U.S?).

It's hard to get involved in the smaller firms, because DoD wants to keep the best employees from going to these contractors to do their current job for 2x the pay.

I'm biased, but I think the better way is to start federal, get into a cool 3-year rotational program for poverty wages, and then go contractor once you've paid your dues for a couple of years.

This is, of course, pretty damn niche for infosec. Most infosec folks I've met in the industry have no exposure to this.

<comment><USER10> I think that's decent advice. If I was young again, I'd just apply to one of the many security engineering internships out there and skip defense work. Those didn't exist when I was in undergrad.

Federal jobs are pretty awesome everywhere except extraordinarily expensive cities. Unfortunately, a good percentage of them are based exactly there. :) (Also, a bit easier to admire the benefits and stability they offer when you're older. Early 20s me would laugh and then apply to whatever popular corporate grinder was hiring for prestige and 6000 hour weeks.)

Grass is always greener.

</comment></comment></comment><comment><USER12> I've enjoyed Troy's posts explaining past high-profile hacks, so I assume the content he created for Pluralsight is pretty good, too. I'm glad he didn't directly tailor them to the CEH, because from what I've seen it's not the most esteemed certification. Most managers I've talked to on the security side of things have said something like Security+ is a good starting point for newbie hires, and CISSP or OSCP are a decent indicator for mid-to-senior hires.

In general though, the prevailing sentiment has been that demonstrated experience is the #1 factor. Infosec isn't a career path that begins as a totally oblivious hire after floating around in college. It begins in your bedroom in the evenings poking around bug bounties or playing on hackthissite.org and its forums and that sort of thing. A professional setting isn't required to gain some good real-world experience, so there's no reason you should be inexperienced by the time you're sitting for your first professional interview.

<comment><USER13> A CISSP is only a good indicator that someone wants a free ride past HR. As a technical certification, or a measure of technical ability, it is worthless.

<comment><USER14> I wouldn't say worthless, a lot of CISSP's are in management where actual technical ability gets delegated to non-CISSP's. I'm pretty confident that most CISSPs could pick up almost any security-related technical skill if they were motivated to do so.

<comment><USER13> The context of this thread is that we're talking about technical positions. If you see my other comment, I already mentioned that it's a management cert. Also, if a person with a CISSP is capable of picking up technical skills, that's simply coincidental. The CISSP didn't teach them to learn technical skills, it's completely unrelated. In my experience, motivation is the largest factor in learning anything, so of course a person motivated to spend time learning a specific subject is capable of picking it up.

</comment></comment></comment></comment><comment><USER15> Content-wise, CEH is probably one of the worst infosec certifications in existence. And EC-Council is nothing more than a paper mill. This can't be emphasised enough.

Check out a few sample questions: [http://www.gocertify.com/quizzes/ceh/ceh1.html](http://www.gocertify.com/quizzes/ceh/ceh1.html)

Also review their attrition.org page that exposes how they just copypaste their material from other authors. [http://attrition.org/errata/charlatan/ec- council/](http://attrition.org/errata/charlatan/ec-council/)

Especially this part: [http://attrition.org/errata/charlatan/ec- council/history_and...](http://attrition.org/errata/charlatan/ec- council/history_and_criticism.html)

Oh yeah, EC-council keeps your passport scans and other PII unencrypted in their gmail inbox. I would know, I hacked them once. [https://cdn.arstechnica.net/wp-content/uploads/2014/02/EC- ha...](https://cdn.arstechnica.net/wp-content/uploads/2014/02/EC-hack.png)

Stay away from CEH and EC-Council, don't support these scumbags. They're just a bunch of charlatans that managed to grow their paper mill by spamming and stealing material from others.

EDIT: Oh! But there's more! Apparently they like to serve ransomware on their website [http://arstechnica.co.uk/security/2016/03/ethical-hacker- web...](http://arstechnica.co.uk/security/2016/03/ethical-hacker-website- ransomware/)

tl;dr: stay the fuck away from CEH and EC-Council.

</comment><comment><USER16> 10+ year info sec veteran here. I think first order of business is do you want to be a specialist or a generalist? Application security is but one piece (albeit in many cases a very important piece). I chose generalist and I am happy to have done so. Today I am diving into Strict Transport Security, yes, but also working with HR and IT on our employee onboarding and off-boarding process, reviewing vendor and customer contracts and federal compliance requirements. Privacy, Regulations and Law, Compliance, IT and infrastructure security, corporate IT security, and yes application security - every day I deal with all of the above and I love that. And a great foundation into all the things a security person may do, I cannot recommend the CISSP enough go for the CISSP (or, alternatively, CISA) certification.

<comment><USER7> I literally can't think of a single person I talk to in security --- and I talk to lots of security people --- who will mount a defense of the CISSP certification. Most of the people I know see it as a plague on the industry.

(I'm 22+ years in the industry, for whatever that's worth.)

<comment><USER14> There's nothing wrong with the CISSP for what it is, a wide gamut glance into InfoSec, but a lot of hiring managers have been led to believe it holds high technical merit. A few years ago I took a job with my then shiny new CISSP and I was uncomfortably flattered a bit at how much awe it held with people who had no idea what it even was. They assumed I was a master hacker when neither my work nor my resume suggested any such thing.

<comment><USER7> What does it actually tell employers, and, for whatever that thing is, how likely is it that having a CISSP is a reliable indicator of that thing?

<comment><USER14> I think what it tells employers, who don't know better, is that the person is a Certified Information Systems Security Professional, and they might have heard all government security employees must have one, so it must mean that the people are extremely skilled. In this, I'm not qualified to say but my hunch is, not very likely based on a few untechnical people I know in the last few years who passed the test successfully.

What it should tell employers however is that the person is capable of critical thought and has a light familiarity with a wide range of security concepts.

<comment><USER7> Why should I have to pay a pretty significant amount of money at the start of my career to buy a piece of paper that suggests I'm capable of critical thought? In fact: isn't doing the exact opposite of that actually doing a better job of demonstrating critical thinking skills?

<comment><USER17> It's difficult for most companies to distinguish a skilled IT worker from a disaster.

<comment><USER18> So would you want to work for those companies?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> When we hire skim the list of certifications and look for indications of experience. A list of CVEs, a blog or several years in a serious role rank much higher on our hiring queue. And when we interview, we specifically check for depth on the areas the resume indicates depth on, and we look for breadth everywhere else.

</comment><comment><USER3> I'm surprised that he didn't mention CSSLP from (ISC)², the same organization that created CISSP. Certified Secure Software Lifecycle Professional (CSSLP) is a certification focused on all phases of software development lifecycle and is for those who want to add security to the whole development lifecycle instead of focusing on 'finding bugs'. It's great to find bugs, but application security is much more than that, so is information security. This is how I become certified [https://dadario.com.br/what-it-takes-to-be- csslp/](https://dadario.com.br/what-it-takes-to-be-csslp/) and more info about the certification [https://www.isc2.org/csslp/default.aspx](https://www.isc2.org/csslp/default.aspx)

</comment><comment> FLUX-YOU >That's also reflected in how well rewarded security pros are

>That's bad for employers but good news for cybersecurity workers, who can command an average salary premium of nearly $6,500 per year, or 9% more than other IT workers.

Why are the technical skills (in this article specifically) so demanding, but yet the salary is only 9% higher?

Same for the other career-starting directions given here -- most of which seem like multi-year time investments. Many of them ask even more of your technical ability than the article before entering the field with a salaried position, and yet that's only worth 9% extra salary?

</comment><comment><USER20> > That's bad for employers but good news for cybersecurity workers, who can > command an average salary premium of nearly $6,500 per year, or 9% more than > other IT workers.

$6,500 / year? Am I misunderstanding the term "salary premium"?

Also the bar graph confuses me. Shouldn't cybersecurity positions be included in "all IT positions"?

<comment><USER21> That's salary above the average for IT workers.

The average IT worker makes $72000, while cybersecurity workers are making $78500, a 9% premium

</comment></comment><comment><USER22> I believe an area that goes unnoticed by new security analysts looking to work in penetration testing and exploit authoring is that of OpenVMS and VMS-based systems hacking. I've worked on these systems for years and the word floating around out there is that they are "unhackable". While some have arguments against why this would matter in this day and age, why it really does matter can't be discounted. [1] Finding OpenVMS vulnerabilities and discovering ways to own boxes running the system is not only important but a great resume bullet.

[1] [https://www.defcon.org/images/defcon-16/dc16.../defcon-16-ob...](https://www.defcon.org/images/defcon-16/dc16.../defcon-16-oberg- nyberg-tusini.pdf)

</comment><comment><USER23> "That's bad for employers but good news for cybersecurity workers, who can command an average salary premium of nearly $6,500 per year, or 9% more than other IT workers."

I think $6,500 per year is very low...

<comment><USER24> 'Premium', which is to say how much more money security IT work pays than other IT work, on average.

Of course, it's still a bit of a silly comparison, because the distribution on "IT" is so wide that you don't learn much without bucketing further.</comment></comment>


Too many projects I need a wingman/wingwoman - <AUTHOR> I have a problem. I am a solo, full-stack dev and I've done quite well over the past number of years, earning approx. €120K Per Year, building and delivering solutions for clients.
Recently, my business has started to really expand, and I would expect to double up on revenue this year.
The problem is, it's too much for me. With this in mind, I've looked into (1) Freelance sites like Upwork (2) Outsourcing to small agencies (3) Outsourcing to larger agencies.
I'm finding that they don't work for me for a number of reasons. (1) they don't show much initiative (2) they are only interested in the quick pay cheque (3) they look for the quickest way to build the app, which is not always the best way. I could go on.
I guess, I'm looking for someone who I can say "hey, I've a €50K project, want to split it? I'll do the API and Mobile App, and you do the Web App and DB stuff".
I'm really interested to hear some thoughts? <comment><USER2> Hi, it seems to me that you're not charging enough. That's just enough for yourself, and not really enough for a small dev shop. I'd like to hear other people's experiences from HN, but in my opinion, you should have some capital to pay for another engineer as a part of your small business.

I wouldn't "run and gun" with contracts, because as soon as you've got an employee and it's not just yourself (or at least a co-founding partner) you're not just responsible for delivering solutions to clients, you're responsible for supporting employees.

I'd continue to do what you're doing, raising prices until you've saved up capital, bring on an employee and start raising prices to make a small development firm economically feasible.

</comment><comment><USER3> Hi! I made [https://RemoteHacker.com](https://RemoteHacker.com) specifically for this problem :) A lot of people have managed to find new partners to continue developing and building businesses!

<comment><AUTHOR> Hi Eric,

Site looks good, I just posted on it, so real interested to see how it goes.

I think there's a need for a site like this. Are you working on it full time?

<comment><USER3> Hi, thank you! Hope it goes well :) Well, not 100% full time. I'm also working on another product together with my dev partner, which requires a little bit more work than RemoteHacker for now, so I'm basically balancing between those two projects and client work.

</comment></comment></comment><comment><USER4> 1) Freelance sites like upwork won't work for you because they're filled with people that either have long contracts or dont have any, with latter being the majority and they're in it for the quick buck.

2) Agencies won't work because agencies are in it for themselves. If their funnel is big, they could care less about your project and will only dedicate enough resources to get paid.

3) Larger agencies won't work because you're not a big client.

What you need to do is either get a partner or start your own consulting agencies.

Alternatively, other approach is to raise your rates to filter out clients. Also, unsure if you're doing maintenance work, but you can switch from that to new projects exclusively to eliminate 10-20 hours, however that might lose you a contract in the future.

Shameless plug - My long term (1,5+ years) contract is coming to an end and I'm actively looking for another or for an opportunity to partner up. I do full-stack, but I prefer backend and/or apis and have six years of experience.

Regardless of whether you're interested or not, feel free to reach out even for just a chat :) email is in the profile.

<comment><AUTHOR> I agree with your points. I recently reached out to a larger agency. I put to them a very small project, to get a feel of their pricing, process, etc. I estimated it would take me max 5 days. They came back with an estimation of 4 - 5 weeks!! I feel like they just stretched it out to maximise income. They really don't see the bigger picture.

</comment></comment><comment><USER5> You have three options.

1\. Learn management. If you want people to do things to your satisfaction, you have to be explicit about your expectations, communicate it, monitor progress, and review results. Even if you get a talented coder to help you, he probably has different ideas about how things need to be done, and you still need to clarify who's responsible for what.

2\. Give some of your projects to others. Instead of split a 50k project, you give this entire project to others, maybe charge a fee. You'll earn less and have less headaches.

3\. Raise your fees so you have less clients.

<comment><AUTHOR> I think you are spot on about learning management. I spoke with one of my mentors, and he feels I don't know how to manage because I never needed to. So it's a skills gap I have. I'm not really sure I have the time to invest in it at this point. It's a bit of a chicken-and-egg scenario.

I also raised my fees, so that now I will only discuss projects at a minimum of €10K. It definitely helped shift some of the crap :)

<comment><USER5> After reading your comment about more context. I honestly feel you should seriously consider learning how to manage people/projects. Or, how to bring in help without bringing in problems.

Ask yourself is this increase of work temporary. After all current deadlines are met, will you still be as busy? Can you expect to relax and rest, or are you expecting as much new work waiting for you? Will there be as much work two months later? six months later? Will there be more work? Will there be new clients?

If it's not temporary, if there will be only more work, then it's only reasonable to focus on seeking help now. You can't handle the workload you can't handle forever.

You probably need to change your mindset too. From "what do I need to do to solve this problem?" to "what help do I need to solve this problem?"

I recommend reading E-Myth Revisited, exactly the book for small business owners facing too much work to do.

</comment></comment></comment><comment><USER6> Well, I thought I was the only one with this problem...

I think it is doable, but you have to be very clear on your expectations and Honest about the invoice, etc.

Let's say you came to me and said:

Hello, superflit there is this project it is $xx xxx,00 Euros we split. I do zzz, and you do the web or backend.

Once we agreed we have to set the scope, tech, and deliverables. Because we are looking for the long-term partnership, I had to trust you, and you have to trust me. So we have to be clear what we are charging getting for every project and expectations.

My email is on my profile enter in touch if you want to.

<comment><AUTHOR> I think you are right it does come down to trust. It's no different than building a business "partnership" in my mind.

A lot of these projects tend to move very quickly, where I meet the client, spec, price, develop and deliver. It requires a lot of trust to share that with a partner and trust that they can interpret the project.

</comment></comment><comment><USER7> The problem is that _you_ don't scale.

If you want to make more you need to _scale_ and scaling probably means starting an agency and turn from programmer to _manager /director_.

Another approach is to charge more. If you have many clients, it is possible that some of them are willing to pay more than others.

Finally, granted that I don't know anything about your situation, stop and think: do you _really_ want to do this? I mean, 120k/year in _most_ European cities is a very good income.

<comment><USER2> Software agencies don't scale. People in software shops know this. In fact, even successful ones, for years on end, may have just months of runway. That's literally the business. It's just how it works.

The more devs you have, the more clients you need, or bigger ones.

So, OP, to be clear, software agencies are lifestyle businesses. Don't expect to scale if you're working on client solutions, because that's what agencies' bread and butter _is_.

There is a fundamental difference, however, between being a marketing agency, a mobile development shop, or a software company going through RFP cycles for govt. contracts and being a product or service company.

They feel different, too. There might be similar headcount, but differences in goals are just significant enough to matter.

The latter _actually_ scales, but can still be a lifestyle company, too.

<comment><AUTHOR> I think they can scale, but they require expertise around managing people, scaling companies, etc. Because I've forever been involved in software development I don't have those skills. At the moment it is fair to say it's a lifestyle company, but it could probably sustain two/three people.

<comment> olab-eric Sent you an email. We do workshops for our clients on how to scale, would be happy to give you some pointers. Would love to work together as well. We're a team of co-located like minded creators, even though we've got a logo.

</comment></comment></comment></comment><comment><AUTHOR> Thanks everyone for the feedback, it's a very lonely journey at the moment (although I'm lucky to have very supportive family/friends and HN :).

Some more context ...

(1) The projects are split between three Enterprise Clients, two of which I've been working with for about 10 years. I've developed Mobile Apps (originally Windows Mobile, now Android), done some integration with their ERP's, and built some Web Apps (Angular). I used to work with smaller clients, but the 80/20 applies i.e. they take up 80% of your time for 20% of your revenue. I turn down this work now.

(2) Quick story - when I first approached one of these Enterprise Clients I quoted a price of just over €10K for a small project. Another vendor laughed at me and quoted €50K. I won the business and have since made €500K from that one project. I always look long term.

(3) The work is remote. I work from home, with very little meetings. I tend to have total control over the project architecture, development, etc. They trust that I will deliver the best solution and let me get on with it.

(4) Strategically, I'm working to implementing a common stack across all projects that is robust, and allows me to deliver more efficiently. To that end, I'm moving to Xamarin (I have a core expertise in C#) for Mobile Apps, .NET Core for API's (I was using Node - great, but a pain to debug e.g. "console.log('HERE')"!!), and Angular 1.6 for Web App (although on this one, I'm not 100%. I find 1.6 mature, whereas Angular 2/4/6/or whatever it is now is a bit of a mess), and a SQL Server or Postgres DB.

Here's a curve ball - I've also been accepted onto a great startup program for a side-project I had been working on. It's also now got customers, revenue, and a great chance of success. The same week I got accepted onto the program I also heard from one of my existing clients (a multinational) enquiring about working with their sister companies in other counties to deliver the solution I recently did for them (HELP!!)

BTW - Some of you have expressed an interest in partnering up. I'm definitely interested in reaching out and have set up a temporary email address I will use to contact you. I'm not using my real email because I'm being bombarded by agencies (which I've no interest in using). I'll open up more if it looks like me could work together.

<comment><USER8> I would love to help if you need to fill a gap with your current workload.

</comment></comment><comment><USER9> Sounds like you need to build up a network of other freelancers who you can share/sub-contract work to. And ideally who can share their work with you, send work your way when they are too busy, or the work suits your skill-set more.

</comment><comment><USER10> My colleague and me (both from Germany) are always looking for interesting side projects. Mail is in the profile, website gives a rough idea of what we do. We would love to hear from you.

Regards!

</comment><comment><USER11> Maybe this thread will help the both of you!

[https://news.ycombinator.com/item?id=17819673](https://news.ycombinator.com/item?id=17819673)

</comment><comment><USER8> Having too much work is definitely a nice problem to have. Feel free to reach out to me if you ever need help to fill a gap.

</comment><comment><USER12> Senior Engineer in Lisbon here. Feel free to reach me, my e-mail is available on my profile.

</comment><comment><USER13> Senior engineer with some contacts available. Would love to chat. E-mail is in my profile.

</comment><comment><USER14> Put your email in your profile and I'll contact you.

</comment><comment><USER15> Been there, done that. We can help. :)</comment>


Jawbone Demo - <AUTHOR> http://us.jawbone.com/demo.aspx

<comment><USER2> Not sure what version of the Jawbone it is, but pg is giving one of these away at Listia. <http://www.listia.com/auction/201>

If you're going to register a new account, I could give you my referral ID so I get the bonus points... I'm going for the HDTV they are auctioning.

</comment><comment><AUTHOR> I don't mean to be lame in posting a commercial, (btw I do not have any affiliation with this company) but I saw this demo and believing it to be real, was thoroughly impressed.

I can't imagine this is a simple problem to solve. Does it have tactile sensors? or just sound?</comment>


Scientists develop skin for robots - <AUTHOR> http://www.theage.com.au/news/technology/scientists-develop-skin-for-robots/2008/08/13/1218306953569.html <comment><USER2> That's a real breakthrough. Now we are real close to see someone building an artificial human.

But I got this thought(may sound silly). Now since artificial humans should be able to think a lot. That would imply a lot of processing, which means the electronic components would generate a lot of heat. This artificial skin is said to be able to handle heat. So to get rid of excess of heat(more than the amnt the skin can handle), there needs to be a method to handle the excess. The two ways i can imagine... By having a fan or heatsink like in a computer or by storing the heat and using it to power further processes. For the second method it would be better to accommodate the storage area in the skin itself. That would reduce the size of the artificial human(and make it look more like a human, since having a bump else where in the body would look odd).

[ disclaimer: just my thoughts over tea ]

<comment><USER3> why not use water for cooling ? if the skin is porus (not clear from the article) it can possibly be made to appear as sweat, and then it gets replenished in the usual fashion !

please take all of this with a huge mountain of salt :o)</comment></comment>


Show HN: The future of CrossStitch designs - <AUTHOR> http://www.lovestitchdesigns.com

<comment><AUTHOR> A platform for creating, selling, buying and downloading cross stitch patterns. I'm looking for feedback, investors or mentors.</comment>


Studying Water - <AUTHOR> https://www.tbray.org/ongoing/When/202x/2020/09/03/Studying-Water <comment><USER2> Kelvin & Helmholtz were also fond of studying water: [https://books.google.ch/books?id=OcZ5iKsGrmoC&pg=PA336&dq=tw...](https://books.google.ch/books?id=OcZ5iKsGrmoC&pg=PA336&dq=tw+körner++thomson+helmholtz+yacht&hl=en&sa=X&ved=2ahUKEwidz5KJneHrAhVMCewKHdQ7BsoQ6AEwAHoECAMQAg#v=onepage&q=tw%20körner%20%20thomson%20helmholtz%20yacht&f=false)

Lee on adaptive learning: "You must be shapeless, formless, like water. When you pour water in a cup, it becomes the cup. When you pour water in a bottle, it becomes the bottle. When you pour water in a teapot, it becomes the teapot."</comment>


How to install Docker/Kubernetes from scratch on OS X - <AUTHOR> https://gist.github.com/Nikkau/8f4badc0d87871b5feb4 <comment><USER2> Yay! I'm going to try it out later today.

</comment><comment><AUTHOR> Probably the simplest/fastest setup guide I've seen to go from zero to a running Kubernetes cluster on OS X</comment>


User-Submitted Feedback: When Does It Matter? - <AUTHOR>

Tonight, I submitted my first ever piece of feedback to Google re: a feature-suggestion for Google+. While constructing my feedback, my mind was thrown into a brief war with itself. The source of the conflict? Whether or not the time I was spending piecing together my feedback was worth it or not.
Because I know the "Send feedback" button is there for a reason, I ignored the conflict I was going through and submitted my opinion on principal anyway. Regardless of this fact, I'm _still_ questioning whether or not what I just submitted was worth the time I spent putting it together.
So, I've come to the ever-intelligent members of HN to ask the question, "When does user-submitted feedback matter?" I would like to think that user-submitted feedback is handled democratically, wherein the majority rules and once a specific number of people have weighed in on a specific thing, action is taken.
But, honestly, I can only see user-submitted feedback being handled democratically if the feedback is inherently negative, i.e a bug that completely decimates the user-experience in it's entirety, rather than feedback that is inherently positive, i.e a feature request.
That said, although I ended up submitting my feedback to Google for a feature I think would add positively to the user-experience of Google+, taken what I've said above, I'm almost positive it's a textbook example of grasping at straws.
So, what do you guys and gals think? Does user-submitted feedback matter? If so, when? If not, why not? <comment><USER2> I've been a community manager since 1996 and at all the companies I've worked, even the biggest ones, we did look at that feedback and use it. It was usually my job to read it all over and report back to the product team with numbers and suggestions. Granted, sometimes it didn't make business sense to implement a feature so we didn't act on it, but for the most part it is the desire of companies to make products that are appealing to their users. So, yes, companies look at and discuss your feedback.

Unless it's just 'this sucks', people are reading and using your feedback.

</comment><comment><USER3> Probably it just depends how much feedback the developers have to deal with. If yours is the only feedback submitted this week it'll probably get plenty of consideration.

I imagine that feedback submitted to an organization like Google is handled more democratically, so in a sense you've cast your 'vote'.</comment>


1984, Hungarian Edition  - <AUTHOR> http://krugman.blogs.nytimes.com/2013/06/17/1984-hungarian-edition/ <comment><USER4> For the folks who are interested, as a Hungarian I can give you a small report based on first hand experience.

The current Fidesz government is simply a Mafia. They are the sons and grandsons of the communists who killed hundreds of thousands of Hungarians. Sándor Pintér[1], Minister of the Interior of Hungary is the biggest godfather in the country currently. They kill rivals, or send them into prison.

Hungarians have the fewest rights in this country. They intentionally positively discriminate the Roma population to spark a civil war. Divide and conquer.

There is also an ongoing international propaganda about how "antisemitic" are we. Nothing is further than the truth, there are 0 jewish people beaten per year. But this will be a good excuse to further decrease our liberty.

A bill is going to pass (in a couple of weeks) which will allow foreigners to buy unlimited amounts of land without any control exposed on the process. This will result in the poor Hungarians losing land to wealthy people. If the bill passes (it will), Hungary will cease to exists in decades.

The Jobbik and a couple of true politicans fight against these issues, they want to preserve the Hungarian nation. That's why you see a propaganda about them, framing them as evil, fascist, hateful people. Because the Jobbik and the defense of the homeland interferes with the bussiness of the Mafia government.

[1] [http://en.wikipedia.org/wiki/S%C3%A1ndor_Pint%C3%A9r](http://en.wikipedia.org/wiki/S%C3%A1ndor_Pint%C3%A9r)

A Hungarian

Edit: a little bonus, worthless anecdote, probably I am crazy and fascist because I find it disturbing:

The Fidesz announced that to prevent minors from smoking they will move the selling of tobacco products to certain specialized shops.

Poor dumb masses were like "ohh, not a stupid idea, young people smoking is bad hmmkay". Then, came the news, that the government decides who can run these shops. Of course all the winners were Fidesz friends (parts of the Mafia).

Then first they raised the price of tobacco products, to provide bigger margins to these shops because "this is their only source of income".

Then they allowed to sell other products, like chips, ice cream, whatever, they allowed such a wide range these products combined make up 40% of shop sales.

So basically, with this move, the Fidesz took the right to run shops from the common people and gave it to the Mafia members.

Well played!

This is how the Hungarian middle class is being erased.

And this is just a recent story! There is more to come I am sure.

<comment><USER5> > Hungarians have the fewest rights in this country. They intentionally > positively discriminate the Roma population to spark a civil war. Divide and > conquer.

So, government is positively discriminating Roma population now just to try to fix the problem that Roma population was systematically discriminated for decades (centuries), and they can't possibly go out of mud on their own. It's sad that some Hungarians see that as a problem.

> There is also an ongoing international propaganda about how "antisemitic" > are we. Nothing is further than the truth, there are 0 jewish people beaten > per year. But this will be a good excuse to further decrease our liberty.

No Jews, no racism, isn't it? Maybe there are 0 beaten Jewish people per year now, but only because there were 0 Jewish people left in Hungary after the WW2, where democratically elected Hungarian government got rid of them.

I don't say that your government isn't corrupt, but whenever I hear talks about "preserving the nation", "Roma and Jews has more right in my country than me" and similar claims, my nazi detector starts to alert.

EDIT: s/discriminated/systematically discriminated/

<comment><USER6> Not to attack your larger argument, but the Hungarian Jews were not entirely exterminated, although an attempt was certainly made. My wife's father's family is ethnically Jewish, some of them survived the concentration camps, and they stayed in Budapest after the war. There is a synagogue in Budapest. So tone down your own rhetoric a little, if you would.

<comment><USER5> Well, the Hungarian government in the past certainly did its best to the cause. Just take a look at the numbers here [http://en.m.wikipedia.org/wiki/History_of_the_Jews_in_Hungar...](http://en.m.wikipedia.org/wiki/History_of_the_Jews_in_Hungary)

The fact that Hungary wasn't punished nearly as much as Germany for their crimes in ww2 doesn't help either.

<comment><USER6> Sure, because punishment of nations always helps.

You're still wrong when you say there are no Jews here.

</comment></comment></comment></comment></comment><comment><USER7> Overall, the development of politics in Hungary over the past few years has been disturbing. Right wing populists with fascist tendencies have been voted into power, large rallies of uniformed believers in the streets of Budapest, overt and unapologetic antisemitism, overt and violent threats against other minorities, pointless nationalist posturing towards neighbouring countries.

<comment><USER4> >> Right wing populists with fascist tendencies

They are patriots. They are being called fascist because they want to stop the current practice of paying 2000$ for Roma families for raising children, while Hungarian families get 1/20 of that for the same task, all this while the average Hungarian works for 400$ a month.

Don't believe everything what you see on TV. Go figure.

A Hungarian

<comment><USER8> This is the most ridiculous framing of Hungary's problems with racism and extremism [1][2][3][4][5] I've read in a long time.

[1] [http://www.guardian.co.uk/commentisfree/2013/feb/05/hungary-...](http://www.guardian.co.uk/commentisfree/2013/feb/05/hungary- right-political-abyss)

[2] [http://www.hrw.org/news/2013/05/16/hungary-rule-law-under- th...](http://www.hrw.org/news/2013/05/16/hungary-rule-law-under-threat)

[3] [http://en.wikipedia.org/wiki/Jobbik](http://en.wikipedia.org/wiki/Jobbik)

[4] [http://www.telegraph.co.uk/news/worldnews/europe/hungary/100...](http://www.telegraph.co.uk/news/worldnews/europe/hungary/10037188/Inside- the-far-Right-stronghold-where-Hungarian-Jews-fear-for-the-future.html)

[5] [http://library.fes.de/pdf-files/id- moe/09566.pdf](http://library.fes.de/pdf-files/id-moe/09566.pdf)

<comment><USER4> What is your point exactly? I can call your post ridicolous and link 4-5 links too but I will still lack a point!

<comment><USER4> To the two sibling comments:

In those links, please tell me, what proves that the Jobbik is a fascist party? Also, I am not a person sympathizing with Jobbik, I am first and foremost a Hungarian, who lives here.

If people are murdering my family, no amount of your links will prove that they are alive and well. It's that simple.

<comment><USER9> _If people are murdering my family, no amount of your links will prove that they are alive and well. It 's that simple._

But you were the one claiming they aren't anti-semitic, so why should we believe it in face of the reported incidents?

<comment><USER4> Why should a party be anti-semitic? Do I sleep better if the guys in Israel have a bad time? No. I wish them the best. On the other hand, if a country (be it Israel or any other) threatens my country why can't I speak up?

<comment><USER9> The incidents I read weren't related to Israel, so I'm not sure why are you bringing it up.

<comment><USER10> Because he is anti-semite, in their modern form they say "...but israel!" whenever you criticize them or even question their ideology. There's a strong myth about liberals/jews being responsible for the devastating economic policies of the government in hungary.

Fun fact: Most Jobbik members and sympathizers are describing themselfs as apolitical hungarians who are "just patriotic".

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Just a note, for anybody jumping on the Oh My God Hungary bandwagon: the people who passed this law and the people who are vocal antisemites and anti- Roma are not the same people.

Fidesz is likely to lose the next election; they've really been overstepping their power. But it's a small country. As long as nobody outside supports them, they'll move on.

What you read in Western European media is Eurocorporates being sure that if Hungary should ever endanger the profit they extract from the Hungarian poor (which is essentially everybody), they'll be sure to be knocking on the door with military force in the name of democracy. I think we know whose playbook _that_ came from.

Source: I'm an American living in Budapest.

Racism is a convenient way to marginalize those who see inequity. They so very much want to understand why they don't have the money they see on TV. The answer is simple, as it always has been to the Eurogentile: the Jews took it! The Gypsies took it! It's never "The Swiss banks took it by giving you loans in a foreign currency knowing that the forint would slump", and God forbid it should ever be "Two years' worth of the Hungarian GDP was stolen and deposited in Swiss (and Cayman, etc.) banks by the old regime when it became obvious the handwriting was on the wall."

This is the first I'd heard of this ridiculous law. There's a reason it's a problem when one well-disciplined party gets a supermajority so they can pass whatever the hell law they like. I hope the door strikes them soundly on the ass as they leave next year.

<comment><USER6> Addendum to this, by the way, after talking it over with my wife (who is herself Hungarian):

Hungary is a small country. There are 10 million people here, and for five hundred years they've been subjects of one or another foreign king - until the 90's (I count the USSR as a foreign king for the purposes of this post).

In short, they're a country governed by rank amateurs.

Orbán in particular is an odd duck, as well as the Fidesz party. They're a student protest movement who abruptly found themselves in control of a whole sovereign nation. As such, they have a lot of ideas about how to fix things - most of which are harebrained.

In the last election, Fidesz obtained a supermajority of Parliament, meaning that whatever Orbán says, becomes law. And here's the thing: Orbán says _a lot_. And Fidesz says, "Hyuck, hyuck, sure, let's write it down and pass it!"

Then the other 10 million Hungarians try to figure out how to pay for it, what kind of procedure might be involved, how to make decisions fairly - all in the sure and certain knowledge that those clowns in Fidesz are going to change it all next month anyway.

It's easy to look at something like this surveillance law and think "OMG! Hungary will be 1984!" \- but no. First, nobody even knows who would be in charge of the surveillance. Who will pay for the program. What procedure will be followed. It'll be yet another clusterfuck of massive proportions.

Case in point from two months ago: Fidesz suddenly decided that tobacco sales would require a permit, and that there would be a fixed number of permits, effective immediately. Since the corner tobacconist is a staple of the retail distribution system here, this immediately put a large number of long-term family businesses at risk.

So they sued. It came out that Spar automatically got permits - and Orbán openly said, "Sure, I've got financial interests in Spar, so it's natural we'll trust them." But Fidesz swore that other than that political considerations would not determine who got permits.

Until somebody got recordings of some local Fidesz mayor determining who would be given permits, based on their Fidesz loyalty, and people sued to see the procedure. No, Fidesz said, that's confidential. Well, but procedure can't be confidential by law. So Fidesz wrote a new law retroactively declaring confidentiality for that class of procedure.

They still have to win an election in 2014, and right now people would be perfectly happy to stew them up and eat them whole. The only stick they've got is maintaining that if people don't vote Fidesz that Jobbik will win - and we all know what fascists they are! That, or the Socialists will win - and we all know how corrupt they were!

Point being, people see through this shit and mostly just get on with their lives, because it's all Keystone Kops anyway. Short of closing the borders, Orbán can't actually impose a dictatorship, and if he actually tried to do it, what real force would he have? The military isn't going to back him up. He's already pissed off the police by calling their union clowns (remember the cops dressing as clowns in protest a couple of years ago? No? Maybe because that doesn't fit with the budding-fascism story line?)

In short, it's chaos. Interesting times indeed! But it's not the Third Reich, and it's not going to be. Racism is a real problem, that's true. The only thing that would fix that would be economic prosperity - and honestly, Orbán has been doing pretty well resisting Union demands for austerity, so I'll give him that much.

Discount the gloom-and-doom. It's just more theater.

<comment><USER4> > if people don't vote Fidesz that Jobbik will win - and we all know what > fascists they are!

Sure, they are born evil people. They would sacrifice their own children just to kill others - anyone who differs in skin color.

Am I right?

There were multiple cases of Jobbik supporters rallying in Roma populated cities, for various reasons. Nobody got hurt. Nobody will. How fascist are them then exactly?

<comment><USER6> Jobbik has some good principles. I like the idea of a little pride in Hungary. But the Roma are part of Hungary that you need to have some pride in. You're not Magyars freely riding across the plains any more, if indeed you ever were.

The Roma are not your problem, man, no matter how many knife attacks there are - and I know there are. But there aren't as many as you think, and there are plenty of violent attacks in the other direction, like people burning Roma houses down with the Roma still in them.

As to your point of Jobbik rallies in Roma cities - yeah, that's true as far as official rallies go. I do quite clearly remember a strongly Jobbik demonstration over near the Tisza last year that was not exactly sunshine and butterflies, though. Hatred does not pay.

And if you think the taxes going to support Roma kids are sapping your economic strength - there are a few ethnic Magyarok who stole 100 trillion forint from you thirty years ago and still have it. You could stack every Roma baby in the world end to end and they wouldn't be as tall as that. Those guys are your enemy, and _they are Magyar_ , not Roma.

Jobbik is misguided, but I don't think they're _fundamentally_ misguided. Their nationalistic principles show promise, like I say. Somebody has to start keeping the money in-country, and they'd be likely to work on that if they can get their heads out of their asses long enough.

Add to that the fact that Jobbik will have to be part of a coalition if they do gain more representation in Parliament (there's no danger whatsoever of a Jobbik supermajority!), and that would temper them a little and let them learn about government, and I think there's hope for the future.

Hungary has only been newly independent for twenty years. They've got time to make a few mistakes before everybody has any right to throw up their hands and say they can't be trusted.

 _All that said_ , yeah - your topmost point about the rhetoric used to paint the Jobbik as a threat is 100% dead on. They're all just Nazis reborn! Look at the laws Hungary is passing! Oh, wait, that's another party? Oh, well, all Hungarians are the same anyway.

<comment><USER4> Thank you for taking the time to write these replies, I appreciate it. I agree on certain points, but I still hold my opinion of that you were tricked by the media which demonized the Jobbik.

I personally know multiple politicians who are members of the Jobbik. None of them want to burn Romas. None of them even blame them, they blame the government.

<comment><USER6> I'll give you that, I know a few Jobbik myself and they're exactly as you describe. And I also remember the party official who discovered last year that he himself was ethnically Jewish and was forced out.

But fair's fair, I haven't personally been at any such demonstrations - <USER2> I'll bet you haven't been at any knife fights, either.

As to the media - after 25 years of marriage to a Hungarian, and now a year living in Budapest, my Hungarian still sucks. I can keep up my end of a conversation if I've had enough sleep and I can read text fine, but I usually have to ask my wife what any given news story is about. Most of my exposure to current events consists of her watching the news while I'm finishing up one job or another on the laptop. So I'm not 100% up to speed on detail.

The media here honestly seems less slanted than in the States, but that is a really vaguely anecdotal judgement. It would be nice if a study were actually possible, but such is the nature of media that it isn't, really.

<comment><USER6> Also: they may personally believe that Roma are not the problem - but is that the rhetoric they use to sway voters? Even subtly? Because you started out trying to justify the Jobbik by citing knife attacks, and got widely slapped down for using local rhetoric in a global forum - that's a good sign that your local rhetoric is a lot more slanted than you think. And what you say ends up being what you believe.

<comment><USER4> I don't think I ever mentioned anything about knife fights on this forum. I also use no local rhetoric. I just wrote what I see on the country side. If you think it is a rhetoric to trick voters into voting then I am glad - <USER3> must be very far away from the problems these voters experience, and that's fine.

You live in Budapest you say. That's an entirely different place then the rest of the country.

The amount of poverty and suffering people endure in the country side is almost unimaginable. Unfortunately I can imagine it because I grew up in it.

PS:

I have been at knife fights unfortunately. That can happen when you want to drink an orange juice in a pub here.

PS2:

How do you like the Hungarian language? I am a natural language geek. What do you think how does it sound? Any thoughts appreciated.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> This trend is also notable in Slovakia. Similar attitude toward Roma minority and sparks of shocking nationalism[1]. This is combined with nonfunctional judicial system and one party rule[2](recent poll).

It is fucking scary.

[1] [http://www.economist.com/blogs/easternapproaches/2013/03/slo...](http://www.economist.com/blogs/easternapproaches/2013/03/slovakia)

[2] [https://fbcdn-sphotos-f-a.akamaihd.net/hphotos-ak- prn1/10134...](https://fbcdn-sphotos-f-a.akamaihd.net/hphotos-ak- prn1/1013458_10200495223117924_530936534_n.jpg)

</comment><comment><USER12> There doesn't seem to be any upside to this, long-term.

Don't sign the consent: You get fired.

Sign the consent: In the short-term you get to keep your job, but you and your spouse get spied upon and you potentially lose your job one day anyway. And probably face criminal proceedings because you did something someone else didn't like.

<comment><USER13> [EDIT: Ignore me, I was talking nonsense, sorry chiph]

<comment><USER12> Don't think so..

 _Now that the law has passed, potential targets of surveillance must sign a "consent" form. If the targets have spouses, the spouses must sign consent forms, too. And if the targets or their spouses don't consent to this surveillance, the targets lose their jobs. In short, this "consent" is not optional and the whole family is fair game for surveillance._

</comment></comment></comment><comment><USER14> I would LOVE for all politicians to be spied on in this way, I think it is perfect. It is the only way to keep power in check.

<comment><USER15> Who watches them? Are the watchers watched? By whom?

</comment></comment><comment><USER16> Krugman telling us it's bad for people in power to be under public scrutiny. Oh, Sweet conflict of interest.

<comment><USER9> "Public" scrutiny? Where's the public part?

<comment><USER16> Allright, you are right, but some scrutiny is better than none at all.

</comment></comment></comment><comment><USER17> I'm not sure if anyone else clicked through to the article expecting a tirade on the evils of Hungarian notation. Needless to day, I was disappointed.</comment>


The Problem with 'Hey Guys' - <AUTHOR> https://www.theatlantic.com/family/archive/2018/08/guys-gender-neutral/568231/?single_page=true <comment><USER2> Apropos of the article, I started using "folks" a lot more because of a colleague that would use it in 2012.

My thinking has also been shaped by the book _On Writing Well_ which suggested I use their job instead. In other words, don't write that he should avoid semicolons, instead write that "authors should avoid..."</comment>


World's largest offshore wind farm to be built – Hornsea 1 - <AUTHOR> http://www.dongenergy.co.uk/news/press-releases/articles/worlds-largest-ever-offshore-wind-farm-to-be-built-by-dong-energy <comment><AUTHOR> 1.2GW, 120km off the UK coast.

The UK currently (Jan 2016) has ~8.5GW onshore wind, and ~5GW offshore, so Hornsea 1 is a significant addition :)</comment>


Chrome Privacy - <AUTHOR> http://mikewest.org/2011/09/chrome-privacy <comment><USER3> 2 responses:

1\. Chrome is the only major browser not to support the Do Not Track header. Google is also the browser vendor whose bottom line would be most impacted if users could easily opt out of tracking. Coincidence?

While I welcome folks from the Chrome team to weigh in on the reasons for this, my own understanding is that adoption of this feature is being blocked by Google's Mountain View based policy team, and is not a decision that is in the hands of engineers.

Compare this to Chrome's absolutely spectacular record in the area of security, where folks like Adam Langley and Chris Evans have been able to ship innovative features that haven't worked their way through the standards process. Examples include HTTPS certificate pinning (that recently led to the discovery of MiTM attacks against Iranian users using the DigiNotar certs).

In the area of security, Chrome's engineers deploy whatever they think will help users. In the area of privacy, Google's lawyers and lobbyists are calling the shots.

(Also, there still isn't a working API to let others support DNT in Chrome. An API exists, I think, but it is quite buggy, AFAIK)

2\. Blocking 3rd party cookies by default. Apple defaults to blocking 3rd party cookies, Chrome does not. Both are derived the same webkit core (yes, I know there is different code now), but when Google decided to create Chrome, they went with a different default than the one that Apple had already used -- one that hasn't led to websites breaking for Apple users.

Again, which browser vendors' bottom line would suffer if Chrome users could not easily be tracked? Google.

Let me be clear - I don't think that Chrome is engaging in any sneaky shenanigans to directly track users. No, that would be too obvious. Instead, Chrome just makes it easy for Google's other services to track users, when they stick with the deaults.

<comment><USER4> > 1\. Chrome is the only major browser not to support the Do Not Track header. > Google is also the browser vendor whose bottom line would be most impacted > if users could easily opt out of tracking. Coincidence?

The Chrome team has already addressed this issue. The problem with Do Not Track is that it isn't clear what it blocks and what it does not. It is also pretty useless as most websites that survive using ads will never support the Do Not Track headers, so it's a faux solution to the problem. Google already offers a browser extension (Firefox, Chrome and IE) to block Google Analytics. Last but not least, there is a dashboard on Google to know what Google ads know about you and the possibility to delete this information.

I think what's really bad is that DNT headers offer a false sense of privacy when in fact no websites respect the headers. Google's alternative solutions have the upside of being very clear about what they accomplish for your privacy.

<comment><USER3> Some ad networks already respect DNT. But you are right, many of the big ones don't. While Google can't force most of the ad networks to respect DNT, Google can choose to respect the header, which is currently sent by 5% of Firefox users, when it is received by the Doubleclick and Google Analytics servers.

Instead of supporting a header that millions of consumers are already sending, you instead offer a browser add-on for analytics, and "keep my opt outs" for ad network opt out cookies.

The signal sent by a consumer setting the DNT flag in their browser is just as clear as a consumer installing your analytics opt out plugin, or obtaining the doubleclick opt out cookie.

You could, right now, respect the DNT header as you currently respect your own opt out mechanisms, but you don't.

I get that Google is not a charity. I get that Do Not Track (or any other mechanism that makes it easy for consumers to avoid tracking) threatens your bottom line. What I would prefer though, is honesty.

Please just admit that you want to make it difficult for consumers to opt out, and that a single, easy to use mechanism built into the browser is something you want to avoid at all costs, even if that means you are ignoring millions of consumers' intent.

<comment><USER5> 1\. I wrote Keep My Opt-Outs. It has exactly the practical effect you're looking for with regard to DoubleClick and about 60 other ad networks _right now_. Installing it opts you out of interest based tracking in exactly the way that clicking the DNT box in Mozilla doesn't (yet): [https://chrome.google.com/webstore/detail/hhnjdplhmcnkiecamp...](https://chrome.google.com/webstore/detail/hhnjdplhmcnkiecampfdgfjilccfpfoe)

2\. Google's participating openly in <http://www.w3.org/2011/tracking- protection/> to work out what DNT means in a detailed sense, so that when users send a header, either via a checkbox or via an extension, there's agreement about what the practical impact is. I'm not sure it's reasonable to expect much more than that right now.

<comment><USER3> 1\. Keep my opt outs is not a serious privacy enhancing technology. If it were, it would be built into the browser by default, and enabled via a simple, easy to discover UI (or better, enabled by default).

Keep My Opt Outs is largely political propaganda, or if you will, privacy theater. It gives your DC people something to talk about when they testify before Congress or the FTC. It allows them to say, "look, we do offer users the ability to opt out", while knowing that few users will seek it out and turn it on.

Compare, for example, the 5% of Firefox users who have enabled DNT, vs. the 62k users of KMOO. That number of users is pathetic, given how many people use Chrome.

2\. Since when does something need to have gone through the standards process for Google to ship it in Chrome?

Consider, for example, what Adam Langley wrote when he added support for DNSSEC certificates to Chrome:

"I'm also going to see how it goes for a while. The most likely outcome is that nobody uses [this feature] and I pull the code out in another year's time." See: <http://www.imperialviolet.org/2011/06/16/dnssecchrome.html>

Google's approach to security (and in many other areas) is to iterate, quickly, see what works, and if it doesn't, kill it off.

Likewise, Chrome supports an early draft of WebSockets. The spec isn't finalized yet though. Google added support to a draft spec, and then will update Chrome to the final spec once it is done. See: [http://blog.chromium.org/2010/06/websocket-protocol- updated....](http://blog.chromium.org/2010/06/websocket-protocol- updated.html)).

It seems to only be in the area of privacy where Google wants to wait until technologies have gone through the slow standardization process. In the mean time, while you wait for things to work their way through the W3C, Google's ad business continues to build detailed behavioral profiles on Internet users.

The longer the W3C takes, from Google's perspective, the better.

Look - I get that it must be frustrating to be a privacy engineer working on Chrome, when upper management won't let you deploy serious privacy enhancing features to users. I get that it must be embarrassing to work on the only browser that doesn't support Do Not Track (usually, IE is last to the party). What I don't get, is why you tout features like KMOO and Google's involvement in the W3C process as though you expect them to be taken seriously.

Google is not committed to enabling users to easily protect themselves from Google's widespread collection of their private data. To argue otherwise is foolish.

<comment><USER6> DNT is privacy theater too. It encourages a business model shift and research into data mining that has the same effect as tracking but without an implementation that would violate DNT. DNT does not solve the problem of ubiquitous online tracking. That problem is most likely unsolvable.

On my home network, Google, Facebook, and Twitter compete for the most web tracking next to my ISP's own capabilities. Traffic weighted, Facebook is now the leader in my household.

</comment></comment></comment></comment></comment></comment><comment><USER7> I tried to look at what chrome sends to google with wireshark, and there are quite a lot of connections made to google servers, but it's all encrypted (ssl). So I actually have no way to know what is sent to google.

Did someone make a detailed analysis of what info gets sent to google on a default install of chrome?

<comment><USER8> I noticed awhile back that even if you disable Chrome's safe browsing feature, Google still sends data to their server. I'm not sure if this is still the case today.

[http://superuser.com/questions/236637/how-to-disable- google-...](http://superuser.com/questions/236637/how-to-disable-google- chrome-from-sending-data-to-safebrowsing-cache-google-com-a)

<comment><USER9> Yep, this still appears to be the case. It establishes a long-lived SSL connection to one Google's servers few seconds after the start. If the connection is forcefully killed (e.g. with SysInternal's TcpView), it won't be re-established, but needing to kill it every time I need to use Chrome is really annoying.

It is also _the_ reason why I have Chrome updates permanently disabled - <USER2> don't trust Chrome enough to let it run anything in a background.

<comment><USER5> Can you file a bug at <http://new.crbug.com/> please? That doesn't sound like the behavior I'd expect.

<comment><USER9> Sorry, I can't. It wants me to log in with Google ID which I don't and won't have.

<comment><USER5> Ok. Would you mind dropping me an email (email@example.com) with details? I'm happy to file the ticket for you.

<comment><USER9> Well... :) That would require setting up a dummy email account and what not, and that's a bit too much hassle. It'd be far more prudent if you'd remove Google ID requirement in front of the bug repository. I frankly don't understand why it is needed in the first place, at least for browsing the repo that is.

<comment><USER10> you can browse just fine: <http://code.google.com/p/chromium/issues/list>

I'm pretty sure all the browser bugtrackers require an account to file a bug.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> According to Chrome help ([http://www.google.com/support/chrome/bin/answer.py?hl=en&...](http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=165139&from=165138&rd=1)), only passwords are encrypted, not bookmarks, autofill data, apps, extensions, history, preferences, and themes. Is this still true?

Edit: in Chrome 15 (beta) just found an option "Encrypt all synced data". Yay!

<comment> mike-cardwell Confused at why no-encryption would even be an option for this data.

<comment><USER12> Hmm, this feature seems buggy. I just tried enabling the option and it never finished. Had to kill it.

Filed a bug report: <http://crbug.com/97939>

<comment><USER5> Thanks. It's now sitting in the Sync team's queue.

</comment></comment></comment></comment><comment><USER13> Wow, that was an amazingly skillful non-denial denial. Notice how he never said Chrome does not collect user information. Because, as we all know, it does. I've often wondered how much it collects, by what mechanisms (including via third parties or analytics added by third parties) and to whom the information is available and under what circumstances. The statement from Mike West does not appear to shed any additional light on this; maybe it's answered elsewhere -- does anybody know? I've seen the Google Chrome TOS and wasn't able to get a clear picture from that.

BTW anyone in Mike's position still may not be privy to everything that is done with the data, as some data collection and sharing may be subject to national security orders that that most employees are not allowed to know about. So any statement his team makes about this should be couched with "to the best of our knowledge."

<comment><USER5> Chrome does not collect user information, unless you explicitly opt-in to sharing aggregated usage information and crash reports with Google. If you do opt-in to these metrics (and you have to opt-in, it's disabled by default), you can opt-out at any time via chrome://settings/advanced#metricsReportingEnabled

The data collected is available for you to peruse at chrome://histograms/

All the data that Google collects is subject to the privacy policies at <http://www.google.com/intl/en/privacy/>, and Google of course complies with SafeHarbor regulations ([http://en.wikipedia.org/wiki/International_Safe_Harbor_Priva...](http://en.wikipedia.org/wiki/International_Safe_Harbor_Privacy_Principles))

<comment><USER14> "Chrome does not collect user information, unless you explicitly opt-in to sharing aggregated usage information and crash reports with Google"

OR if you don't opt in to anything and you simply type some things into your Chrome Omnibox which get sent to Google for suggestions, or if you don't opt in to anything and you simply mistype a URL and that send data to Google for more helpful error pages, or if you don't opt in to anything and Google's phishing and malware service collects sites you're visiting. Oh, and where you don't opt in to RLZ, but you get it anyway.

As I said on Twitter, I'm not really bothered by these things, but it's disingenuous to pretend they don't exist or to respond to peoples' privacy concerns by insisting that aggregate usage stats is the only information Google collects.

<comment><USER10> I see (what I imagine to be) both perspectives. If you're a programmer, you think _of course_ suggest is talking to google -- that's pretty much the only way it can work. That doesn't really fall under whatever mysterious third- party bodies collecting your browser history that the OP was trying to FUD up the place with.

On the other hand, most people _don't_ stop to think that search suggest is sending each character to get new suggestions, which _is_ "user information" that is collected (though admittedly the privacy policy does say the logs are anonymized within 24 hours). So it really should be in the list of information that Chrome collects, even if it feels self evident to some.

> As I said on Twitter, I'm not really bothered by these things

Well I hope not, considering if you replaced parts of your comment:

"if you don't opt in to anything and you simply type some things into your [Firefox search bar] which get sent to Google for suggestions, or if you don't opt in to anything and you simply [type a malformed] URL [into the AwesomeBar} and that sends data to Google for [a search page], or if you don't opt in to anything and [Firefox queries of] Google's phishing and malware service collects sites you're visiting"

it still applies. _and_ Mozilla essentially sells that information by selecting a third party default based on some non-transparent bid process :P

Personally, I'm just sick of the FUD, especially in comments on an article asking to stop the insinuations and actually list problems so they can be fixed. There are and probably always will be defaults some people disagree with (and feel are doing users a disservice since users rarely change defaults), but there is a world of difference between that and "I don't need to give evidence, I can just feel it. We all know Chrome is etc etc"

<comment><USER15> There is no bid process. Mozilla sets the default search engine to whatever search engine provides the best search results for its users, as far as that can be determined.

This is why the search engine is different in different locales; for example Yandex has way better Russian search results than Google, and hence is the default search engine in the Russian localization of Firefox.

<comment><USER16> Mozilla makes a 9 digit income in referral fees from setting search engine defaults, almost exclusively from Google.

At least they no longer solicit donations, but for them to pretend they're viable without that _omg privacy violating_ teat to suckle at is just gauche.

<comment><USER15> The major search engine providers all have referral fee programs.

So while Mozilla does make money from those, it would do that no matter which of the major search engines it defaulted to, no?

And note that there is a reason the search field is not merged with the url bar in Firefox. Precisely because it would be a privacy violation.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Question for mikewest:

Can Google do anything to help make browsers appear to be less unique, and thus less trackable?

I'm talking about <http://panopticlick.eff.org/>

I'd much rather find a technical solution to that than a political non- solution.

<comment><USER17> Enabling click to play for plugins in Chrome is already possible and makes you much less trackable. You will get much less bits of identifying information in panopticlick because your fonts and some other things can't be read out without Flash or Java.

<comment><USER12> You sure about that?

I already do click-to-play for plugins in Chrome, and it doesn't seem to help much. According to Panopticlick, there are 19.75 bits of data in my Browser Plugin Details, and for the "value" it describes all the plugins I have enabled.

Also with click-to-play enabled, Panopticlick can see my system fonts (20.75+ bits of data, one in 1,769,122 browsers has this value). Apparently Panopticlick is not using one of my plugins to get that data... I haven't whitelisted eff.org or otherwise enabled plugins there.

Looks like Panopticlick is using JavaScript/CSS font detection methods: <http://www.lalit.org/lab/javascript-css-font-detect/>

Hmm... Panopticlick reports "No Flash or Java fonts detected" when I try it with IE9 on the same system. Is IE9 doing something to block Javascript/CSS detection of those fonts, or does Panopticlick have a bug with IE9 or what? Looks like that method worked for IE6/7...

<comment><USER12> Whoops, I have to take back what I wrote above.

Somehow my Chrome had lost its click-to-play setting. I don't remember unsetting that... hrm.

Anyway, with click-to-play enabled you are correct: Panopticlick cannot see my fonts. Sorry about the confusion.

However, with click-to-play definitely enabled, Panopticlick can still see my Browser Plugin Details.

</comment></comment></comment></comment><comment><USER18> Ah, the old "no no, just trust us" defense.

This is just a thing Chrome has to live with, it's a browser developed by a company that makes money selling user behavior to advertisers. You'd have to be stupid _not_ to think this is a possibility.

Must be frustrating to the developers who know what it does and doesn't do though.

<comment><USER19> We put the source out there and try to be as transparent as we reasonably can. In the end though, people make their own decisions.

<comment><USER20> One problem is that Chrome is not open source - Chromium is. But 99% of people use Chrome, and there is no way to build Chrome from source to be sure what code is running.

We have to take Google's word for it that Chrome is identical to Chromium as regards privacy, and as others stated, Google's business interest is clearly to track user information, not to respect their privacy.

<comment><USER19> I've already explained why this framing is incorrect: <http://news.ycombinator.com/item?id=3034628>

So, go ahead and check out a release branch, set the "Official" build flag yourself, wait anywhere from 2-8 hours for the binaries to get built, and verify it against the bits we ship.

<comment><USER20> Thanks for the information, I have never seen this stated officially anywhere.

So one can build Chromium with "Official", then add some DLLs (Flash, etc.), and get something 100% identical to Chrome?

Edit: And is there an official statement of this somewhere?

<comment><USER19> I went through it and there's still some ugly hackery involved on Windows. These are technical issues (e.g. how ffmpeg is compiled via MinGW), but they make it complicated to generate a non-branded, psuedo-official build. That said, all the pieces you need (minus the closed-source plugins) appear to be in the repository and can be built and compared against an official release. It could definitely be made easier, but would require some non-trivial engineering to do so.

</comment></comment></comment></comment></comment></comment><comment><USER21> For whatever reason, Chrome does seem to make life hard for privacy extensions like Ghostery:

"As Chrome's resource blocking API is not yet comprehensive, some elements may execute." - <http://www.ghostery.com/download>

<comment><USER5> The main dev on the WebRequest API sits right behind me, and is making steady progress. It's the first synchronous extension API that interacts with the network stack, and it's a nontrivial effort to get it running. I can assure you, however, that making life hard for privacy extensions is the exact opposite of what we're being paid to do.

Look at the progress on privacy-related APIs over the last year: WebRequest is coming along nicely, WebNavigation and ContentSettings are feature complete and in the final stages of polish, and Proxy went out to stable in Chrome 13. Privacy and Clear just landed in experimental, and we're iterating on them rapidly.

(Details on the state of each are available at [http://code.google.com/chrome/extensions/trunk/experimental....](http://code.google.com/chrome/extensions/trunk/experimental.html))

<comment><USER22> Is it possible to restrict requests to the host in the URL I'm visiting? XSS, DNT, etc. become much less of an issue when you can block all external resources requested by a page.

<comment><USER5> That will be possible with the WebRequest API, yes: [http://code.google.com/chrome/extensions/trunk/experimental....](http://code.google.com/chrome/extensions/trunk/experimental.webRequest.html) For example, you'd be able to intercept and block network requests from a particular tab that didn't hit the same domain.

The API in experimental now, so download a dev release of Chrome/Chromium, enable experimental APIs via `about:flags`, and start filing bug reports. :)

</comment></comment></comment></comment><comment><USER23> At the end of the day Google is really not the company you have to be worried about - it's the ad networks. They are the ones implementing zombie cookies using the 10 or so methods of storage and the ones that directly sell your information to even seedier companies. I used to work for one so I know what goes on. This will always be a dance between smart developers usurping tracking efforts and smart developers coming up with new tracking methods.

I really don't understand the extreme sentiment that your info via cookies is the worst form of privacy breach there is. Why would you not be more concerned with the companies that charge $.50 per call to access an API that can fetch information on anyone that fills out a form ("Oh I never knew my neighbor only makes $48k a year")? I guarantee you these companies know more about you than Google, Twitter and Facebook (unless you post every thought ever, of course). Case in point, they knew my coworker's wife at the time was 4 months pregnant. Unless you can derive such information from searches (doubtful and completely not worth the effort) then this information obviously came from elsewhere. Perhaps, for instance, like the doctor's office.

<comment><USER14> "At the end of the day Google is really not the company you have to be worried about - it's the ad networks."

Google is the largest ad network on the Web.

</comment></comment><comment><USER24> I'm pretty sure Chrome send URLs to Google at least for indexing purposes. I've put up random pages on my websites, not linked to them anywhere at all but visited them in Chrome and then BAM - indexed soon after in search.

<comment><USER25> IIRC, it has components of Google Toolbar built in. If you accessed those pages with a browser with the Google Toolbar you'd have experienced the same.

<comment><USER26> You recall incorrectly. Chrome does not send the URLs of pages you visit to Google for indexing, or for any other reason.

Please see the privacy policy. It answers these questions quite clearly:

<http://www.google.com/intl/en/privacy/>

<comment><USER27> <http://www.google.com/chrome/intl/en/privacy.html>

...

> When you type URLs or queries in the address bar, _the letters you type are > sent to your default search engine_ so the Suggest feature can automatically > recommend terms or URLs you may be looking for. If you choose Google as your > search engine, Google Chrome will contact Google when it starts so as to > determine the best local address to send search queries. _If you choose to > share usage statistics with Google and you accept a suggested query or URL, > Google Chrome will send that information to Google as well_. You can disable > this feature as explained here.

...

> If you navigate to a URL that does not exist, _Google Chrome may send the > URL to Google_ so we can help you find the URL you were looking for. You can > disable this feature as explained here.

...

> If you enable the optional AutoFill feature, which automatically completes > web forms for you, _Google Chrome will send Google limited information about > the structure of pages that have web forms and information such as the > arrangement of the form_ so that we can improve our AutoFill service for > that page.

(end excerpts)

Could you give us more information about the AutoFill feature? Does it send the URL along with the listed information? Does it do this for every URL that contains a web form?

</comment></comment></comment></comment><comment><USER28> Why not just use Chromium?

</comment><comment><USER29> The same thing also applies to Android.

<comment><USER29> Not entirely sure why I'm being downvoted but the same privacy concerns should apply to Android as well as Chrome.

</comment></comment><comment><USER30> I thought it was general knowledge that the closed-source Chrome sends (some) data back to Google while the open-source Chromium does not.

Disclosure: I use Chrome (default) and IE9 (whenever Chrome fails).

<comment><USER31> chromium contains RLZ identifier

<comment><USER19> The RLZ identifier is present only if Chrome is installed through some sort of third-party deal like a system or software bundle. If you install the stock Chrome from Google it's not present. You can find a good overview of RLZ here: <http://blog.chromium.org/2010/06/in-open-for-rlz.html>

</comment></comment></comment><comment><USER32> If you don't like third party cookies then I encourage you to go to chrome://flags/ and Enable the 'Block all third-party cookies' experimental feature.

Simple as that.

</comment><comment><USER33> Just use Iron.

[http://www.srware.net/en/software_srware_iron_chrome_vs_iron...](http://www.srware.net/en/software_srware_iron_chrome_vs_iron.php)

<comment><USER26> <http://chromium.hybridsource.org/the-iron-scam>

<comment><USER33> Interesting. Thanks</comment></comment></comment>


Identified.com - increase your profile - <AUTHOR> https://www.identified.com

<comment><AUTHOR> Interestingly I added Starbucks to my employment history (I was a part time barista whilst at university) and subsequently went down two points for it :S I guess the moral is only put down relevant experience to your domain. . .</comment>


Large Scale Study – SSD Failures [pdf] - <AUTHOR> http://users.ece.cmu.edu/~omutlu/pub/flash-memory-failures-in-the-field-at-facebook_sigmetrics15.pdf

<comment><AUTHOR> Here is a link to the easy to read article.

[http://www.zdnet.com/article/facebooks-ssd- experience/](http://www.zdnet.com/article/facebooks-ssd-experience/)</comment>