Negotiation - <AUTHOR> http://yongfook.com/negotiation.html

<comment><USER2> These "sharks" are terrible!

One of them offered him 75% equity for a $150K investment? The other one wants 100% equity and he'll give the entrepreneur a 4% royalty on gross revenue? What planet are they living on?

Anyway, the negotiation by the entrepreneur was very well done.</comment>


Nigerian scammer nets $40.5 million in 15 months - <AUTHOR> http://online.barrons.com/article/SB124122575455379423.html

<comment><USER2> I'm using a new alias, for obvious reasons, since after reading this article I realized that we were almost conned by this.

It seems that they work not only via the email lists, but also through craigslist.org.

Here is what happened. My wife was looking for an accounting position and saw a post in craigslist.org. She sent her resume and got the response below. Note: in the response below they are even offering a salary of $1800 per month. I was really confused by this and seemed shady so we didn't pursue, but just a warning to all the folks.

 _Company Name ; AXM GROUP LTD

Detailed Job Description – Accounting Assistant

The primary goal of the Accounting Assistant is to provide local customer support to our clients within North America. This includes providing convenient payment options and informing them of shipping and the terms of sale.

You will be assisting our clients within North America, the assistance to be provided will include: payment collections and customer service via email.

Your duties will include: \- Collecting Local Payments When a buyer in the US decides to purchase an item through an online auction from our sellers he has the following payment options: pay pal, international wire transfer, international check, local certified check or local wire transfer. The quickest option of these is local wire transferring. Local wire transfers and certified checks are the options that the sales support representative will provide to the clients.

\- Managing Data Along with the payments received from buyers you will be receiving details for these sales. These details will include items sold, price, and buyer's information. You are to file and maintain these purchasing records and transactions.

\- Forwarding of the Payments Once you receive each payment you will be keeping 5% as commission and forwarding the rest to the seller or representative, whose information will be provided prior each transaction. It is crucial to complete forwarding of the payments in a time efficient manner.

\- Correspondence You will be submitting brief reports, weekly reports, and monthly reports. Weekly and monthly reports are to be done in Excel format and are to summarize all transactions completed within the week, or month.

Here is an example of a brief report:

Date: August 2, '09 Buyer: John R. Smith Item: Jowissa Men's Watch Price: $ 1,921.27 Commission 5%: $96 Fees: $ 75 Total Forwarded: $1750.9 Forwarded to: Godwin Newton, Whitefield ,United Kingdom Reference Numbers: 23497839

\- Fees, and Transferring Procedures All fees are covered by the company. The fees for transferring are simply deducted from the payments received. No client will contact you during initial stage of the trial period. After three weeks of the trial period you will begin to have contact with the buyers via email in regards to collection of the payments. For the first three weeks you will simply receive all of the transferring details, and payments, along with step by step guidance from your supervisor. You will be forwarding the received payments through wire service.

-Salary During the trial period, you will be paid 1,800USD per month while working on average 3hours per day, Monday-Friday, plus 5% commission from every payment received and forwarded. After the trial period your base pay salary will go up to 2,400USD per month, plus 5% commission.

-Taxes You will receive a monthly invoice stating your total income. All applicable taxes are covered by the company.

\- To Apply Kindly fill out your personal information below for immediate consideration of this position so you can get started as soon as possible

Personal Information Full Name : Full Address: City: State: Zip/Postal code: Home phone : Cell phone: Recent occupation: Gender: Personal Email Address:

The employee,acknowledged the Trial and Detailed Job Description and signed _______________ (First Name and Last Name of Employee)_

</comment><comment><USER3> _Investigators in the U.K. who are tracking him note that, since Dec. 1, 2008, Macjon has targeted 13.5 million Americans with the work-at-home e-mail scam. Investigators estimate his success rate at around 0.1%. That's 13,500 victims from whom he's stolen as much as $40.5 million._

Oh, the title is pure guesswork. That big, big number is essentially pulled out of thin air.

 _Frighteningly, Macjon is merely one of about 100 modern-day 419ers plying the trade._

Seriously? This must be a much larger "industry"? Maybe the successful ones are that few, but there's got to be tens of thousands trying their hand at it at least?

 _He and the others buy American e-mail address lists from about a dozen U.S. based "lead sellers."_

What? Do these companies operate in the open? I was under the impression that the botnet owners that do harvest email addresses were purely criminal organizations?

 _The U.S. Secret Service, which used to aggressively track Nigerian scammers, no longer updates its database of 419 scam letters as regularly, owing to budgetary constraints and manpower issues._

Or, perhaps, the explosion of the scam industry and the increased sophistication of the tools make it completely useless to keep a database of scam letters? I admit I'm not keeping up-to-date with email scams, the spamfilters are winning the fight for me, but it sounds like this article is horribly out of date or popularized, and if so, what's it doing on here?

Or am I wrong? Are there only actually a small number of email scammers in Nigeria? Do they get their email addresses from a handful of legit companies?

<comment><USER4> _Investigators estimate his success rate at around 0.1%. That's 13,500 victims from whom he's stolen as much as $40.5 million._

 _Oh, the title is pure guesswork. That big, big number is essentially pulled out of thin air._

I'd say more out of a thin butt. According to these figures he on average extracted $3000 USD out of 30 people, every _day_. If making $90k in profit per day is really as easy as sending out 13.5 million e-mails then I think I should seriously reconsider my business plan...

</comment></comment><comment><USER5> We all spend days designing web forms that won't scare away customers, page designs that keep important content above the fold, bits of CSS to deal with buggy browsers, and rewrite the same sentence in an email template 20 times before we will send it all in an effort to woo the same people who fall for a 419 scam.

What can we take from the `success` of this guy and apply to our businesses?

<comment><USER6> Probably that the 80% solution to a problem is probably good enough. Though, a lot of business does not target that large of an audience which make the 419 scammer economics work.

</comment></comment><comment><USER7> I'm surprised this wasn't thrown out as an idea in a recent Ask HN post: <http://news.ycombinator.com/item?id=1171520></comment>


Micro-promotions and mentorship: impact of small actions in engineering culture - <AUTHOR> https://circleci.com/blog/micro-promotions-and-mentorship-the-big-impact-of-small-actions-in-an-engineering-culture/ <comment><USER3> > Significantly, they also acknowledged the contributions I made. > Acknowledgment doesn't require a parade. These are small gestures that folks > made that were meaningful to me:

> Using the :clap: emoji in a pull request comment to highlight a clever bit > of my code.

> Sending a direct message of thanks upon realizing they were actively > benefiting from a refactor I'd made to a previously gnarly bit of code.

> Posting a note to our #gratitude channel on Slack recognizing how helpful > some documentation I'd written had been to them, and encouraging others to > use it.

I remember reading a study about how for a romantic relationship to succeed, the ratio of positive to negative interactions has to be 5 to 1. [1]

Work relationships might only need a ratio of 1:1, but especially as an engineer, where the default's to critique and only pick out the bad parts in code reviews, these really help! Even at Stripe, I remember how far a "Nice! I've been meaning to do this for a while" as a part of a code review would go in just making all the other suggestions go down better. Definitely kudos to CircleCI for making this a part of the culture.

[1] [https://www.gottman.com/blog/the-magic-relationship-ratio- ac...](https://www.gottman.com/blog/the-magic-relationship-ratio-according- science/)

<comment><USER4> "Work relationships might only need a ratio of 1:1, but especially as an engineer, where the default's to critique and only pick out the bad parts in code reviews, these really help!"

I'm on mobile so I can't pull a source, but research for work relationships generally agrees on a ratio of around 6:1 positive to negative ratio for negative feedback to be taken in a positive way.

You're correct that engineering culture falls FAR short of this, and leads to some really bad outcomes as a result.

<comment><USER5> I'm not exactly a software engineer, but I have a really hard time imagining how 6 in 1 statements about anything could be complements. In my area, most work is average (by definition) and the main reason you show your work to people sitting in the chair next to you is so that they can catch your trivial mistakes. (Kind of like code review.) I do know that in the average program there are far more bugs than clever inventions.

<comment><USER6> In between those trivial mistakes is a lot of functional code I didn't have to write myself. Very often, that's code that _I personally_ no longer have to write (if I'm reviewing it, there's a good chance it would've ended up on my place if they didn't take care of it for me), or that I get to leverage in my own code. That's stuff I can thank them for.

Phrasing is important. "Here's 3 things you fucked up, fix it" is negative. "Here's 3 minor nitpicks. Otherwise, LGTM, thanks for tackling this! :thumsup:" is overall positive. Both could be describing the same code review. "While you're in there, could you add unit tests for X and Y?" is asking for a favor you can then thank them for doing, "X is missing unit tests, why?" is demanding answers for a mistake.

You can still help set the tone on the receiving end of code reviews as well. "Good catch!" when people spot significant bugs in my code, reacting with thumbs up emojis when people voice their concerns. Elicit feedback, suggestions for improvements - instead of "what is everything this code does wrong", it's "okay, here's a first draft - how can we make it better?".

The goal is not to deliver perfect code. That's impossible - we're human. Trying to do so anyways is counterproductive - static analysis, and a second set of fresh set of eyes will find some bugs faster. Seperating onself from one's work like that can be difficult - but between setting an example yourself, and showing geniue appreciation for the person's work even as you're finding issues in the code can help.

<comment><USER7> I hate when people says LGTM but still have nits to pick. Either its ready to ship or its not.

<comment><USER6> It's ready to ship.

Because nothing ever ships without issues. When talking about end products, we're often - if not usually - talking straight up known bugs, not mere nitpicks. Hell, I'm willing to OK _known bugs in changelists_ under some circumstances - like being less buggy than what's currently checked in!

Serious bugs can be a good reason to hold off on something. But nitpicks - say, a minor quibble about function naming is a subjective personal preference that should never devolve into a lengthy debate holding up an important improvement that otherwise checkin. We both have bigger, more important dragons we could use our time to slay. It's worth discussing briefly - <USER2> we can achieve consensus and find a better option - but if you want to check in your code as is, right now, for pretty much any reason whatsoever? Go for it. We can always make a followup changelist. Hell, please do - those are easier to diff! Even if we're working in "commit straight to shared master branch in perforce" style. If you're using git, but are worried other people about to start refactoring and want to merge into the main work branch ASAP? Go for it. Naming debates can wait. Typos can wait. There's always the next changelist. Just have a general dread of having lots of files checked out? Go for it. Make your commit. The issues are nitpicks, not blockers.

I've seen plenty of good work - changelists that are objectively improvements - die in analysis paralysis and never get checked in because of quibbles over less important details. It sucks. Minor naming quibbles should not be a cause of this. Significant design problems - maybe - but not minor easily fixed after the fact naming quibbles.

"LGTM otherwise!" is also a good finisher to signal "Okay, I've gone through everything, I think I won't find anything else." In more relaxed review environments, it's a signal that I don't feel the need to re-review your change - maybe with minor fixes for outright bugs - before you commit. It is carte blanche to move forwards.

</comment></comment></comment></comment></comment></comment><comment><USER8> I am struggling to phrase this comment in a non-abrasive way. Please read on charitably.

I, similarly to the author, was hired into a position without necessarily having a huge amount of skills. The reason I was hired was due to me showing an aptitude for being able to be dropped into a new situation and find my own way out of it. My hiring experience was baptism by fire. There was no onboarding, just JIRA tickets and some architecture diagrams.

My team races at a million miles per hour, and frankly doesn't have the time to hand-hold a juniour as they learn the ropes. I was put on pagerduty and started putting out production fires within 3 weeks of being hired. With no prior experience.

That is not to say that my team didn't help _at all_. However, I distinctly recall trying to limit my questioning to daily stand-up, and only asking further questions if I was very stuck on some proprietary technology (because Google searches can't help you with in-house tech.) My manager during performance reviews would heap praise on me for being so green and yet so low- maintenance.

Now at this point I'm programming, doing "infrastructure as code" in the cloud, and working on baremetal hardware. Coming from basically nothing. Allow me to brag a little bit. I'm proud of myself.

It is stressful, there are long hours involved, but the experience hardens one for sure.

Maybe I'm just experiencing a sort of Stockholm syndrome. Maybe I was put into a terrible situation and just accepted it as normal, even good. Experience is subjective like that.

<comment><USER9> If your organization has a junior putting out "fires" in production after 3 weeks, a few major things are wrong. First of all, code shouldn't be "on fire" frequently in production. Especially a domain of functionality that is simple enough for a 3 week old junior.

Honestly I can't think of as valid reason why there would be something breaking in production that a junior with 3 weeks of experience on a team could fix. Where are the dev ops people? Why is the production code so fragile? If the "fire" is easy enough for a junior with 3 weeks experience on the codebase to put out, why is it even a problem in the first place? Many questions here.

<comment><USER10> Yeah, this. It's great that the poster leveraged it as a learning opportunity and could handle things, but it speaks to the poor quality of the organization/team that this would be an issue to begin with. But of course we have limited details.

Also, when you're a green software engineer it can be hard to know when to ask questions. You definitely don't want to ask too many questions which are trivial and easily googleable. But you also don't want to spend 4 hours figuring something out that a teammate could explain in 10 minutes, unless their time really is 16x more valuable than yours.

</comment></comment></comment><comment><USER11> This is the first time I've heard the term "micro-promotion," and I would very much like to never hear it again.

<comment><USER12> I think it is in terms of promoting in terms of publicity rather than advancement. I'd like a better word, but it seems to be in contrast to micro- aggressions.

I like the concept but the homophone makes it confusing. (Giving positive feedback in public regularly and in front of peers and management seems to be a good thing.)

<comment><USER13> Given that micro-aggression are arguably mostly created by the mentality of the receiver, and not the acts of the sender, I don't think the comparison is entirely right.

How about just calling it casual encouragement?

<comment><USER14> We can pretty easily call micro aggressions casual [race/sex/class/etc]ism.

Sound good?

<comment><USER15> No, because those are real things, based on actual classifiable actions and behaviour.

Micro-aggressions are just made up offenses in the mind of the receiver.

<comment><USER16> The person above you was correct and they are real things that are called microaggressions. A micro aggression is defined as "A statement, action, or incident regarded as an instance of indirect, subtle, or unintentional discrimination against members of a marginalized group such as a racial or ethnic minority."

</comment></comment></comment></comment></comment></comment><comment><USER17> I really like this article. It's very concrete in terms of what the author experienced, how it felt, and the actions the people around her took to make her experience go well.

In a lot of the discussions around gender, I end up thinking. "OK, I care. Now what should I _do_?" This post actually has some answers.

Also, even though I've got basically all of the privilege merit badges, I can empathize with her about what it feels like to be intimidated and how a little caring support goes a _very_ long way in that time.

<comment><USER18> I recently started reading about non violent communication, and this is a big tenet from what I gather. Affirmatively communicate your feelings and your needs.

I found there are two difficult aspects to this: clearly defining the relationship from feelings -> needs (many examples in the book of this, and how people twist words when asked to describe what other people do that they don't like), and avoiding specific language mannerisms I've grown used to but recognize as following negative patterns.

I found the approach helpful when I tried using it during some emotionally tense situations.

</comment></comment><comment><USER19> >For the last decade, I have worked in male-dominated environments. While during this time I've encountered many nitwits and detractors...

What a way to start an article that will presumably be read by your current peers, subordinates, and superiors.

<comment><USER20> That's only part of the sentence.

> For the last decade, I have worked in male-dominated environments. While > during this time I've encountered many nitwits and detractors, I've also > been fortunate to encounter many proponents and advocates.

That doesn't seem like a blanket denunciation of their peers, subordinates, and superiors.

<comment><USER19> I expect more from someone in a team leadership position (Engineering Team Lead) than to have public, petty and negative opinions about a vague "many" number of their coworkers. This is a red flag when it comes to leadership, and if they're serious about attracting and keeping experienced software developers, they'll keep those kinds of opinions out of the workplace's acceptable discourse.

<comment><USER21> Personally, I value honesty and a critical eye in my leaders. If those two things happen to reveal something negative about a workforce or a talent pool, is that a negative?

<comment><USER22> There are many ways to say the same thing.

</comment></comment></comment></comment></comment><comment><USER23> It feels good, and is a good motivator, when your code is received positively. Especially early on when you aren't necessarily confident that you are a "coder" yet. I think that is a great nugget of truth for anyone working on an engineering team.

That said, this person graduated a coding bootcamp + joined their first team less than 3 years ago. I'm not sold that they have much to teach about managing an engineering team (not that I do either).

<comment><USER24> > Especially early on when you aren't necessarily confident that you are a > "coder" yet.

When I was lacking experience, I actually really just wanted negative feedback. The absence of feedback, to me, was synonymous with "your work is correct." But no one would ever tell me what I was doing _wrong_. Even now, half a decade later, I have yet to get that negative feedback. I hope that means I'm just a good coder, but I always have this nagging feeling that it's because no one has actually reviewed my code before.

<comment><USER21> I'm actually in your position, and I agree, sometimes what you really want is to know what you did wrong.

That said, imposter syndrome is a very real thing, and it's felt disproportionately by women and minorities in tech — I think we should be cognizant that a lot of our colleagues have been told throughout their lives, implicitly or explicitly, that their work isn't good enough, and so that positive affirmation can do a huge amount of good.

</comment></comment></comment><comment><USER25> The problem with adhoc public praise is that it invariably gets unevenly applied which makes people feel unvalued if they work on a less visible or more esoteric part of a system. It may actually result in them being undervalued because some manager who has twenty reports, never sees Bob get any :claps: and so begins to assume bob isn't generating value.

Ultimately this about measuring and rewarding value generated which I prefer be evenly applied, objective as possible, transparent, and continuous. I prefer a culture of professionalism - a premise that we're all good at what we do and we all have agreed on some process to determine what is valuable to work on so we don't need continual praise - if the work wasn't valuable we wouldn't be working on it.

</comment><comment><USER26> I found it tricky when working with junior devs. I remember when I was junior several years ago, I wasn't given the permission to update some shared google docs, not even correcting some obvious typos. Only senior engineers who "own" them have the write permissions. When I raised the question in the team meeting, the management simply said that's an established process and showed no willingness to change that.

Part of me interpreted it as they don't trust me and tried to defend from my stupid mistakes. But I told myself to be patient and shook off the negative thoughts.

Recently I updated my view. Since I became a component lead, I wanted to be a bit more open-minded and let a junior dev to help edit a document. He messed up a few times (fat finger typos, pasted letters without accents, unsorted columns, etc.)

I researched together with him into why he inadvertently made those mistakes and it turned out he's very new to the IDE and not familiar with some editing tricks. He was a bit ashamed about that and tried to learn. But mistakes still happened sometimes.

One day, faced with deadlines and no time for re-doing edits, I turned off junior dev's write permissions.

I knew that this would cause negative emotions and explained to him. He understood it too. Things went smoothly for that deadline.

What I wanted to say is, some micro-act of taking away permissions is good for team efficiency, but may also show distrust, especially for sensitive team members.

My current take is: Trust by default. If breached more than twice, build it into the process and explain carefully.

What do you think?

<comment><USER27> You are right because, while I tend to be easy going, if I were that junior dev I would see having my write permissions taken away as a big F-U. I'd be polite about it, and begin looking for a new position elsewhere.

</comment></comment><comment><USER28> I'm more curious how she went from no experience SWE to Senior SWE and a team lead in 2 years.

I'm not saying its not warranted but I've seen people working at Google for several years and not get the Senior title.

<comment><USER29> In some places, "Senior" is the second tier with other titles coming after. I once worked some place that was:

* SWE

* Senior SWE

* Staff SWE

* Principle SWE

I think it depends a lot on the company and what terminology they use. Even at my current company, "senior" is not the highest level.

<comment><USER30> Yes these titles vary widely at different companies. In fact, that's exactly why we build [https://www.levels.fyi](https://www.levels.fyi) \- We don't have CircleCI on there yet but hope it helps.

</comment></comment></comment><comment><USER31> The actions in here are excellent. At most workplaces you have to ignore everything that does not please management and only do the things that do. Even if it means ignoring a lot of little things that customers will view as quality.

</comment><comment><USER32> One of the thing about code review I found sad is that many engineers have big ego.

Time to time, I see review like: "This is confused to me" and the person who write that code explains a lot but refuse to make chances...I think those don't assume good intention in code review.

We aren't in school anymore. We are all get paid to work on something and to help the companies success, or the next engineer to success. When people spend time review your code, read your code, being thankful for these free advice.

I learned so much and thank deeply to people who review my code literally line by line.

The extra emoji, tactic, micro-promotions etc add no value to my learning experience.

<comment><USER33> >Time to time, I see review like: "This is confused to me" and the person who write that code explains a lot but refuse to make chances...I think those don't assume good intention in code review.

The flip side to the coin is that "This is confusing to me" is not particularly useful feedback. It reminds me of my days in academia, where professors told students they can't help them if they come to them and merely say "I don't understand this." You have to give more details.

</comment></comment><comment><USER34> As a low level individual contributor, unless the micro-promotion comes with a pay raise, the title changes are just patronizing IMO.

<comment><USER35> Title changes can be very valuable. The thing is, they're only valuable because they help you get a better job elsewhere. "Here's something that is only useful if you leave". Cool, I appreciate it, but do you expect me not to use it?

If you want to help your employees, give them title changes. If you want to help _and retain_ your employees, give them title changes _and_ pay raises.

</comment></comment><comment><USER36> Along these lines, I think some people need to do some introspection and ask themselves why isn't it their default to give praise. If someone does a good job, say it. I mean seriously, how freaking hard is that?

</comment><comment><USER37> Sometimes remote calls with multiple participants feel awkward, and there's this mild detachment and lowered engagement (not sure about the cause and effect relationship there). Laugh track, used sparingly with good timing, sounds like a golden idea or at least something hilarious to try.

<comment><USER38> >Laugh track, used sparingly with good timing, sounds like a golden idea or at least something hilarious to try.

Oh gosh no, voice calls are bad enough already. I'm sure we'll see something like a soundboard in slack or discord at some point specifically for this though. :|

</comment></comment><comment><USER39> Abstracting from the poetry, what could be the factor when the time spent by senior developers coaching bootcamp's product and not working on actual company's product could cause recent circle ci production issues?

</comment><comment><USER40> First of all, this is an important article that reminds that cultivating an inclusive environment means culmination of small and subtle gestures as opposed to simply declaring that diversity is important. It's a great article but... I just couldn't forgive this line:

> He also uses Emacs, which is terrible, but nobody's perfect.

This is triggering me hard. I guess I know it's a joke, but most legendary programmers use emacs and for good reasons, it's a huge productivity booster. There's a high learning curve, but if you're going to tackle one of the more intelligently sophisticated industries with a semi-high learning curve let's not shy away from tools that that are also hard to learn.

Sorry for the rant: you all have a nice weekend. Maybe practice how to use emacs for a couple hours!

<comment><USER41> But vim is better?

</comment></comment><comment><USER42> I love reading blog posts like that. But wouldn't it be better to spend that time on ... you know ... keeping the service functional to paying customers? [https://status.circleci.com/](https://status.circleci.com/)

<comment><USER43> Ah yes, people must be working at all hours of the day. How dare they spend time doing other things!

</comment></comment><comment><USER44> I have a theory that if you want to be promoted for your skills, work ethic ect you have to work at company that's facing the pressures of capitalism. Wants to succeed.

If you work a major bank or something, there is nothing stopping your managers from covering their asses ( all along the hierachy) an simply transferring the blame onto the lowest level employees.

<comment><USER17> That theory assumes that skills and work ethic directly translate to capitalistic success.

My impression is that many ways to win in business don't involve working smart and hard, but instead involve reducing competition, influencing regulation, restricting consumer access to accurate product information, etc.

In other words, you can win the market by being the best, or you can just change the market itself. Your bank example is a good one — look at what a financial successful strategy it has been for banks to capitalize on their gains and then distribute their losses onto us by getting bailed out.

<comment><USER44> Yea that makes sense.

I am not sure then how low level employees can protect themselves from becoming a scapegoat for failures and theft of success . Its hard to asses management before you join a team and harder to change teams.

<comment><USER45> The only way is networking. You have to find good people and stick with those people. Only work somewhere if you know someone good who works on that team and likes it.

</comment></comment></comment></comment><comment><USER46> This is a great example of how to foster an inclusive culture that isn't at all limited to women and minorities. The things described here will make everyone feel good about the work they do and the people they do it with.

</comment><comment><USER47> These are some fine ideas, but I'd argue they should be separated from the very ideological elements in the reference 'micro promotions' document here: [1]

It may very well have policies that are in fact illegal in terms of their application.

I would never work at a company that promoted these specific ideals in an official manner, not because I don't believe in the general impetus of the notion that 'we should be helpful to those who are minorities in tech' (of course we should), rather, that one would be subjected to wicked well- intentioned-but-ultimately-maligned discriminatory policies.

\+ For example, boycotting / refusing to attend 'speaking engagements that require 50/50 female/male representation in micro cultures that are in fact heavily skewed in one direction - this is in fact discriminatory. I'm not going to boycott a conference because it's mostly dudes, or women, or whatever group may constitute the majority of speakers/attendees.

\+ "Discipline or fire employees who abuse privilege". This is definitely a dealbreaker, as in, 'run away from this company as fast as you can'. Consider for a moment who is defining privilege, on what basis, and what might constitute 'abuse' of such privilege?

Besides the fact that this is probably illegal, and surely immoral - it means that you will be subject to disciplining and firing on the basis of your perceived status as defined by race, gender, background, nationality, immigration status? What else?

And who is making such assertions? By what standards? Are they clear? I'd dare the author to articulate one instance of admonishing someone for 'abuse of privilege' which is not in fact illegal.

This policy essentially promotes cult-like authoritarian behaviour on the part of senior management, whereby they'll be empowered to promote, fire, denigrate or support individuals on some arbitrary social basis that basically has nothing to do with one's level of general professionalism, or work ethic.

A much simpler, more pragmatic, less ideological framework would actually help the framers of this policy achieve basic goals.

And again, some 'micro cultural' issues in the article I think have merit, outside the context of the aforementioned document.

Finally, I will say, that a lot of this 'decent management' is normalized in other professions. I think perhaps what we might be talking a lot about companies which are really just 'a bunch of guys who just finished school' \- who may not even have had a lot of mentorship or professional experience themselves. Combined with the longer hours, stress ... maybe it makes for a more toxic work environment wherein 'high five' behaviours are not common?

[1] [https://maleallies.com/wp-content/uploads/2015/01/Male- Allie...](https://maleallies.com/wp-content/uploads/2015/01/Male-Allies-Bingo- JAN-15-2015.pdf)

<comment><USER48> > This policy essentially promotes cult-like authoritarian behaviour on the > part of senior management, whereby they'll be empowered to promote, fire, > denigrate or support individuals on some arbitrary social basis that > basically has nothing to do with one's level of general professionalism, or > work ethic.

Uh, I'd say this predates current practices by a good 50 years. Companies have always done this.

<comment><USER47> Yes, having worked in 'cult like companies' I'm inclined to agree, though maybe not so much 50 years, but 'since the dawn of time'.

But to codify one's arbitrary ideological assumptions, which are probably illegal, is beyond pale.

They are asking for a major lawsuit.

</comment></comment></comment><comment><USER49> > Although no company is perfect, at CircleCI I've had opportunities to grow > my career in an environment I enjoy.

Small gripe. Its funny how software developers think they have a career. Once you leave a job you are basically an entry level programmer again. What I mean is if you stay somewhere 5 years using one set of technologies, you'll find that you are not qualified for the vast amount of open positions that use other new (just came about in the last 5 years) technologies. You basically have to start all over again or somehow find a team that is using the same set of technologies (which is rare). You know (React now) wait until 5 years from now when you try for a new job, there will be something else and your experience won't count only your knowledge of the hot new thing.

At the new job, the culture will be white make dominated, if not age < 32 white male dominated. So a career in software == a job in software that gets reset every time you change jobs, and there is no escaping white male domination because software is based is often blind trust and the ones with the highest probability of getting that are white males (It may be hard to swallow but it is true).

As for mentor ship, the culture of most places dictate that the most experienced mentor who that like. Females are usually excluded from this group and made to handle the bug list and given minor tasks. After 15 years they may be put in a position of leadership so that the company can save face (if the female employee sticks around for that long).

<comment><USER50> No offense but you sound like someone who got burned.

> Once you leave a job you are basically an entry level programmer again. What > I mean is if you stay somewhere 5 years using on set of technologies, you'll > find that you are not qualified for the vast amount of open positions that > use other technologies.

I doubt this is true for your average Java/Python/C# developer or even a powershell person.

> At the new job, the culture will be white make dominated, if not age < 32 > white male dominated.

What does this have to do with anything related to the first point?

> As for mentor ship, the culture of most places dictate that the most > experienced mentor who that like. Females are usually excluded from this > group and made to handle the bug list and given minor tasks.

This is still true at some companies, but I think it is changing far and wide in the US. I've met some amazingly gifted female developers, some terrible. I've met amazing male devs and terrible ones too. When we become blind to that bias and we have a good diversity on a team, I find teams become pretty cool to be apart of, especially when we have a mindset of mentoring.

<comment><USER49> >No offense but you sound like someone who got burned.

No offense taken. If I didn't get burned (I guessed "burned" means to have observed this first hand countless times over 15 years in the industry), then how would I know it to be true?

> I doubt this is true for your average Java/Python/C# developer or even a > powershell person.

You can know Java, but if the team is using mongo and you don't know mongo, then there is a problem - if you know java and mongo - but there is a react front-end, then there is a problem... get my drift. The industry is going with a "experience doesn't count - you have to know what I know or be good at faking it" kind of theme. It very prevalent.

> What does this have to do with anything related to the first point?

I has to do with the article. Did you read it?

> This is still true at some companies, but I think it is changing...

"Changing" isn't good enough. Think about something horrible , anything, would you want it to be "changing", or would you want it changed?

<comment><USER50> As a minority, I guess I'll just have to agree to disagree.</comment></comment></comment></comment>


iPhone 7 Cellular Performance Test - <AUTHOR> http://cellularinsights.com/iphone7/ <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=12759643](https://news.ycombinator.com/item?id=12759643)

<comment><USER3> Isn't this post about SSD performance on the iPhone 7, whereas this page is about cellular performance of the respective broadcomm and intel chipsets?</comment></comment>


Want to Spam Your LinkedIn Contacts and Be Humiliated? Try FounderDating - <AUTHOR> http://ilikestuffblog.com/2013/04/26/do-you-want-to-spam-your-linkedin-contacts-and-be-humiliated-try-founderdating/ <comment><USER3> The name sounded familiar. This company is a bit spammy anyway.

I am part of the Silicon Valley Java User Groups meetup. I got this e-mail from one of their employee in early March:

====

Hey fellow Dev's,

I'm a ux designer who just joined the community and I wanted to share info about a great service that seems super relevant for this crew - <USER2> (no, it's not romantic). FounderDating (FD) is an invite-only, online network for entrepreneurs to connect with cofounders. Why FD?

High Quality - members are carefully screened for quality and readiness (no recruiters, etc.) Applications and members' identities are confidential, but a few of the folks who are part of the network are former founders or early employees from: stackmob, Salesforce, Zynga, Loggly and Gilt just to name a few.

Balanced - 50% engineering & 50% non-engineering

Reach- FD's online network allows you to connect with people in your city and beyond to share ideas and begin building something you're passionate about.

No Idea Necessary - FD is about the people, so you don't need to have an idea, just be ready to work on a serious side project

The deadline is April 8th, so apply now. <http://members.founder[redacted].com/application>

Cheers and feel free to reach out to me off-list with questions, Abby

===

BTW, this is "Abby's" meetup page: <http://www.meetup.com/sv- jug/members/8035133/>. Not sure if she also goes by another name (Gail) or what. Let's give her the benefit of doubt.

Who joins a new meetup and right away sends plugs for their own project? At least, I don't think that's the norm.

<comment><USER4> Maybe Abby is Abby Beck, Designer Extraordinaire who makes user friendly products - <http://founderdating.com/about/who-we-are-2/>

On various meetup pages, Abby also describes herself as a designer.

I am sorry now I signed up to unlock my city.

<comment><USER5> Who do all those ManagingDirectors [sic] direct? Title inflation ahoy.

<comment><USER6> Those ManagingDirectors [sic] are not employees. I'm familiar with two of them. They are folks in the startup space, likely operating in an advisory role, probably brought on to lend credibility to the company. Or maybe they were brought on for access to their contacts.

This is as misleading as the stunt they pulled with spamming that poor guy's LinkedIn contacts. Where there is smoke, there is fire.

</comment></comment></comment></comment><comment><USER7> It's surreal that, after all the blow-up-in-your-face moments that social media apps have had after doing underhanded things like this in recent memory, companies are still pushing under-the-radar hard sells like this. It has to take an incredible combination of obliviousness and ethical failure to still consider something like this a good idea.

Also, this gives me a very vivid sense of deja vu; I swear I read this exact article at some point last year... strange.

<comment><USER8> It's not really an under-the-radar hard sell. Here's the page in question, which nobody in this thread can be arsed to look at: <http://cl.ly/image/2V302C3j290B>

Now, I can see how one might miss the fact that this will send an email.

Things you can say if you're being intellectually honest:

      * The fact that this will send an email should be more prominent
      * The content of the email should be more explicit
      * The tone of the email was overly personal
      * The from: field appears as if it's from the person, not FD

Things you can't say if you're being intellectually honest:

      * The form is opt-out
      * There's no copy on the page indicating an email will be sent
      * The copy on the page is hidden below the fold
      * The copy on the page is worded designed to mislead the user
      * The fact that clicking submit will send an email is obscured
      * There is no indication about the content or tone of the email that will be sent

Looking at this page, the most aggressive case I can make is for a slightly confusing design that should better highlight the consequences of choosing vouchers. It doesn't seem in any way misleading and doesn't show any of the fingerprints of someone looking to trick a user into accidentally emailing their friends.

<comment><USER9> That's not the page the blog post is talking about. The page the blog is talking about is the one people are sent to after they vouch for someone who has filled out that page.

<comment><USER8> Fair enough. Before people jump on the "omg spam" train they should take it upon themselves as thinking individuals to look at the primary source.

I just created a fake LinkedIn account and will post a similar (and honest) analysis after I receive the invite.

The fact that nobody in this thread bothered to do their due diligence before pouncing is enough for me to discount their opinions as uninformed. But we'll see what the actual page looks like in a sec.

<comment><USER10> Screenshot & description :

<https://news.ycombinator.com/item?id=5677462>

</comment></comment></comment></comment></comment><comment><USER11> Actually, I'm the CEO of FOunerDating and what's surprising is that no one has actually asked if this is what really happens. We not only state (in white writing) on black backgroud) that "a message will be sent to your chosen linkedin contact) and let you see the message but it's also completely opt-in - no tricks where you can't find the "x". People can choose to a) not send or choose who they send a message to. There is nothing sneaky about it. If someone doesn't read the line "this will send a message" there isn't much we can do about that.

<comment><USER12> For the record, "opt in" has a specific meaning. For your spamming to be considered "opt in", a user would have to actively take an action that indicates that they want you to spam their friends. What you have described appears to be an "opt out" scenario.

<comment><USER13> > _I didn't have to do it but I thought oh well, I guess I'll do it and see > what happens._

The guy whining in the blog post exactly opted in.

<comment><USER14> For context:

> _FounderDating asked me to identify ten that I would vouch for. I didn't > have to do it but I thought oh well, I guess I'll do it and see what > happens. So all I did was click their photos. Nothing more._

Can't speak to the rest of the flow but clicking photos indeed sounds like opting in.

<comment><USER15> Yes, he opted in to "vouch for" those people. A ethical UX designer would have shown a modal showing the full message with the list of people it would go to BEFORE sending it on the user's behalf.

</comment></comment></comment></comment></comment><comment><USER16> I'm the first to jump into the pit and start publicly shaming companies that abuse my privacy but in this case I'm not sure FounderDating deserves as much flak as it's getting:

1) Selection of which contacts to message was opt-in. The OP decided that he wanted to send a message to a particular subset of his contacts.

2) There was a View/Edit message link that the OP didn't bother to utilize.

So between 1) and 2), we have case where somebody opted-in to having a service message their contacts, didn't look to see what that message was going to be even though they had the option to, and then got angry when they discovered they didn't like the content of the message that they could have viewed or edited beforehand.

The "I highly recommend applying... you'll thank me later" piece of the message is certainly inappropriate because this was a "get friend to vouch for you" feature, not a "recommend founder dating feature". Still, I don't see this as "spamming your LinkedIn contacts" nor a massive violation of trust. Also, OP's failure to mention the existence of the View/Edit Message link in his rant seems rather dishonest.

Edit: I'd love if the early down-voters could explain why they disagree. You seem to have read my entire message in about 20 seconds..

<comment><USER17> Good points. A clarification (also stated in the first paragraph of the post): this was not "get a friend to vouch for you." This was "who would you vouch for?"

I am the OP.

<comment><USER16> Thanks for the clarification. I'd say as long as it was clear that a message was going to be sent, then a the "Who would you vouch for?" context actually makes the recommendation _less_ inappropriate and puts FD even more in the right.

(Of course, there is still the questionable practice of writing such an enthusiastic endorsement in the first person, but again you had final veto powers on the wording and you opted in to it. Such practices are unfortunately "par for the course" nowadays.)

<comment><USER10> > _Such practices are unfortunately "par for the course" nowadays_

This is the most extreme faux-1st-person endorsement I've ever seen. It makes schoolFeed look positively reserved.

Even if it were the norm (which, based on the response here, it clearly isn't), something being common doesn't make it the least bit right. That's the worst kind of complacency.

</comment></comment></comment></comment><comment><USER18> Aside from this being really uncool, FounderDating doesn't really work anyway. I've done it. Gathering a whole bunch of people who have an idea they want to work on in one place doesn't lead to very many of them pairing up and ditching one of the ideas. It's a lot easier to meet future co-founders, potential hires, and potential bosses before you actually need them. That's how networking works.

I'm toying around with a free, open source solution to this problem that reflects its true nature. If you're interested in contributing, contact info's in my profile.

<comment><USER19> I think it's more likely to be effective than blind networking. Building an early team just a fundamentally hard problem with no single / quick solution. FWIW I've met very helpful (non-cofounder) people through the site. In it's capacity to be a more startup-specific linkedin, it's interesting.

</comment></comment><comment><USER20> Happened to me too. Very spammy (I reported it to LinkedIn too, I hope they kill their API access).

First, I received a private email from a close friend I trust. Didn't know he was quitting his job and starting something new. All he was asking was for me to vouch for him. Ok. Then a few days later, he told me I should join too. That got really weird.

Looks like I wasn't the only one being played.

</comment><comment><USER21> Hey guys --

 _jmalter_ is the founder of FounderDating.

 _jfarmer_ is the founder of Everlane.

Both have terrible UX, but only one of them is being a total ass in this thread (vs. pretending to be oblivious to dark patterns). Mind who you're insulting about their behavior.

<comment><USER6> "but only one of them is being a total ass in this thread"

lol. And the winner is: jmalter.

</comment></comment><comment><USER22> Surprisingly enough this is one thing I really like Facebook for.

I _always_ select "Visible only to me" (and of course never grant messaging rights.) The app can't tell the difference and if I really like it I'll green light it once I see what they actually post on my behalf.

Given that your relationship with your contacts list on LinkedIn is much more fragile I'm really surprised they haven't given this more attention yet.

</comment><comment><USER23> I generally assume that every site that gains access to my contact list will try to exploit them without my consent. It's very easy as a developer to do, so I look for dark patterns in the onboarding process that give me red flags into their principles. FounderDating was one that I initially used and immediately deleted after realizing they were attempting to spam.

</comment><comment><USER24> This reminded me that one of my friends wanted a recommendation from me on FoundersDating. I got to the form you're talking about and here is a screenshot:

<http://imgur.com/KSsinEq>

On the bottom left corner, you'll see they tell you that they'll send a message to your chosen contacts. You can also edit the message.

<http://imgur.com/yA8tHNP>

The text is really small. I may not have noticed it had I not been looking for it. Also, I don't know when this was added.

<comment><USER25> Seeing the screenshot (not having looked at the site or anything), the "see/edit this message" is pretty small. Everyone else isn't exaggerating when they say it is small.

I also think it's important to notice that the big, friendly button says "Agreed". "Agreed" doesn't lead me to think that it will send a message, just that I will vouch for them.

<comment><USER6> The button should say "Agreed. And send the message to my Contacts."

No one would press that. Hence the fraud.

</comment></comment></comment><comment><USER26> Honestly, I don't know what the hell some of these companies are thinking but sure wish I had a blacklist of all of them that abuse contacts so I can never ever patronize them.

<comment><USER15> I would use this chrome/ff extension!

</comment></comment><comment><USER27> I'm in SF for a month and stumbled upon this web site that seems interesting to find co-founders and like minded entrepreneurs to exchange ideas and maybe some early feedback about my upcoming launch startup. I tried to sign up but dropped in the middle and received the follow email:

 _Hey, I saw that you started to apply for FounderDating yesterday but haven't finished it yet. Just wanted to reach out and see if there is anything I can help with - I'm on the community team? Happy to answer questions or if you're set highly recommend taking 3 minutes to finish it up Finish it up and submit here >> Here to help, Kristen_

I responded:

 _Hi Kristen, I don't have a LinkedIn account. This is the reason that I haven't finished._

The answer surprised me. No workaround.

 _Hi: We do require a LinkedIn account, it's the easiest way for applicants to save time and pull in past experience and education. Would love to see your application, Kristen_

Why on earth a company rely so tightly in another company like that. Well, the post gave me a clue.

</comment><comment><USER28> Congrats, you have been GrowthHacked™!

</comment><comment><USER29> > I figured behind the scenes maybe they would send notes to these people, > telling them their contact Brian Morearty had used FounderDating, and > suggesting that they try it too.

How is _that_ even acceptable? Obviously it's far less insidious, but it still sucks.

</comment><comment><USER30> Your social contacts are currency these days. I could see being burned by this, so I won't say something stupid like he deserved it... but I also feel like he deserved it.

</comment><comment><USER31> LinkedIn is full of embarrassments. I have no idea why it continually begs me to scrape my gmail inbox for contacts? There is no way my inbox represents business associations that I want shared with anyone let alone LinkedIn.

</comment><comment><USER32> This is a deceptive, but it's not anything who hasn't used a Facebook app in the past 5 years hasn't been trained to avoid. It makes the OP sound very naive.

</comment><comment><USER33> It's because of similar experiences to this that I will avoid using a social network to sign up for things if it has access to anything more than my details.

</comment><comment><USER34> [CEO responded, see buried comment from 'jmaleter' currently about half way down the comments].

</comment><comment><USER35> This happened to me! I had to apologize to so many people.</comment>


Everything You Know About Obesity Is Wrong - <AUTHOR> https://highline.huffingtonpost.com/articles/en/everything-you-know-about-obesity-is-wrong/ <comment><USER2> As an aside, and an almost cliche hn commentary, the 'everything you know ' trope is just so tiring to see.

"Everything you know about flux capacitors is wrong" \-- probably, I'm not an expert.

"Everything you know about caulking in high humid environments is wrong" \-- probably, I'm not an expert

</comment><comment><USER3> The title says everything you know is wrong, but there is little in the article I have not read many times before, and in mainstream publications.</comment>


How to liberate a Chromebook - <AUTHOR> https://ar.al/2018/12/31/sometimes-you-have-to-stick-a-screwdriver-in-it/ <comment><USER2> Or just follow Google's instructions if you want the same outcome without the invective: [https://www.chromium.org/a/chromium.org/dev/chromium- os/deve...](https://www.chromium.org/a/chromium.org/dev/chromium-os/developer- information-for-chrome-os-devices/samsung-sandy-bridge).

<comment><USER3> Having followed these instructions before, they're not quite suitable for making a Chromebook run an alternative operating system for the average user. A developer, sure. But every time you boot up the computer, you hear an annoying beep and have to wait ten seconds, during which you're a few keystrokes away from wiping the machine and restoring it to a pristine copy of Chrome OS.

The reasons for this design are documented: [https://www.chromium.org/chromium-os/chromiumos-design- docs/...](https://www.chromium.org/chromium-os/chromiumos-design- docs/developer-mode)

(Of note, the newer Chromebooks no longer require a physical hardware switch or jumper to be toggled. The hardware folks said this was expensive, so newer devices let you enter developer mode by holding the correct keys on boot.)

For now, if you truly want to give a Chromebook running another OS to someone, you have to replace the EEPROM: [https://www.chromium.org/chromium- os/chromiumos-design-docs/...](https://www.chromium.org/chromium- os/chromiumos-design-docs/firmware-boot-and-recovery) [https://www.chromium.org/chromium-os/chromiumos-design- docs/...](https://www.chromium.org/chromium-os/chromiumos-design- docs/verified-boot)

<comment><USER4> > _An attacker with physical possession of the device over an extended period. > The attacker has access to tools including a soldering iron._

Yeah, if that is the vulnerability scenario they see necessary to "protect" me against, it's pretty clear I'm not the owner of the machine. I think the anger if warranted.

More broadly, I find the distinction between "normal users" and "developers" in that article pretty telling. I guess the goal isn't anymore to make everyone Computer-Literatur enough to run anything else than Chrome OS.

<comment><USER2> You misread the document. You're quoting from the vulnerabilities section, which lists scenarios that Chromebooks either do or do _not_ protect against ("We cannot prevent this attack").

</comment></comment></comment></comment><comment><USER5> The tone of this article is off putting to the point of being unreadable, and I'd say I'm more privacy conscious than the average technologist...

<comment><USER6> > The tone of this article is off putting to the point of being unreadable

Now who's exaggerating? I'm largely in the middle of privacy vs convenience but I can get through the information just fine.

</comment></comment><comment><USER7> I recently got a 2017 Google pixelbook to replace Razer stealth 2017 that I unsuccessfully tried to replace 2017 MBP with.

Similar to OP (little less emotion maybe), I flashed coreboot[0][1] on it and installed Ubuntu[2] (display brightness, audio doesn't work so I have usb-c audio adapter) - couldn't be happier: keyboard is excellent, it's light, it was relatively inexpensive (for low end i7, 512gb , 16gb ram), it's silent (no fans), display is 3:2 aspect ratio (I think) and it's not 4k, hardware feels nice and solid. Other than audio issue, Ubuntu runs solid on it after some tinkering. If you're willing to tinker with it s bit - Google totally nailed it on this![3]

[0] [https://www.coreboot.org](https://www.coreboot.org) [1] [https://mrchromebox.tech](https://mrchromebox.tech) [2] [https://www.reddit.com/r/elementaryos/comments/9vu3hm/juno_o...](https://www.reddit.com/r/elementaryos/comments/9vu3hm/juno_on_my_pixelbook_looks_amazing/) [3] [https://www.google.com/chromebook/device/google- pixelbook/](https://www.google.com/chromebook/device/google-pixelbook/)

<comment><USER8> Try the galliumos kbd file for media keys support:

[https://github.com/optio50/ChromeBook-Keyboard- xkb/blob/mast...](https://github.com/optio50/ChromeBook-Keyboard- xkb/blob/master/README.md)

</comment></comment><comment><USER9> Says the guy sending the output of a curl into the laptop's firmware.

<comment><USER10> I cannot stop laughing at this comment.

</comment></comment><comment><USER11> To echo some of the other comments - this looks like a useful guide but the attitude is atrocious. You only need to make your anti-google complaint once and then move on.

</comment><comment><USER12> The suggested coreboot distribution (johnlewis') is not maintained any more. You should use use mr. chromebox's builds or build from source. ([https://doc.coreboot.org/distributions.html](https://doc.coreboot.org/distributions.html))

</comment><comment><USER13> I've updated the firmware on every ChromeOS device I've owned and installed Linux. It's fun!!! But I've also restored some of them to factory condition and given them away to friends or family who find it challenging to apply regular security updates. It sounds like the author gave someone a broken ChromeBook instead of giving her the freedom to decide how she wants to use it.

<comment><USER14> Yeah, I hope he asked her what she wanted before forcing her to use that…

</comment></comment><comment><USER15> To clarify, "How to liberate an _Intel_ Chromebook in ten easy steps." Older ARM Chromebooks are doomed to a life of a corporate surveillance endpoint unless you are willing to put in a huge amount of effort.

</comment><comment><USER16> I can't tell if "if remove all /eight/ screws" is meant as a "look how few we used back then" or as a "look how many screws that is!" comment. It's eight screws. Even my ancient Dell Inspiron has more than that...?

<comment><USER17> The very next sentence answers your question of why /eight/ is emphasized:

> _Four of the screws are hidden under the pads for the feet..._

<comment><USER16> How is that an answer? So does every other laptop I've ever owned that has "feet" pads rather than shaped bits of chassis. That's like going "and then I had to REMOVE the outlet part from the wall socket box so I could switch live and ground!" as if that's somehow crazy unexpected.

<comment><USER18> Maybe because some have never had the pleasure of taking apart modern equipment and might consider resorting to force, without the knowledge of those four other screws?

I consider it a helpful reminder to count to verify I have gotten them all.

</comment></comment></comment></comment><comment><USER19> Why is he running Chromium, then, after all that? Or am I misidentifying the browser in the final screen shot?

<comment><USER20> It's probably Chromium. GalliumOS defaults to Chromium with some fixes to make it more Chromebook like.

</comment></comment><comment><USER21> It would be nice if there were a link to purchase the right jumper. I'd rather spend 50 cents, and permanently enable write access, than mess around with the screwdriver.

<comment><USER16> Permanent write access to the chip that houses your bios? Do you want an unremovable virus? Because this is how you get an unremovable virus. You want to unlock that chip only for exactly as long as you are going to knowingly change its data yourself, and then lock it right back up.

<comment><USER21> Cheers. I hadn't thought about that. I just saw the photo, and it doesn't look like a pleasant way to work. Screwdriver breaking something off, ESD, etc.

</comment></comment></comment><comment><USER22> >Pry open the lid by sticking a small flat-head screwdriver in and gently moving it all around the edges.

Instead of a screwdriver, which can easily damage the casing, breaking a washing line pin in half gives you a sturdy plastic object of right size for the job that won't scratch stuff.

</comment><comment><USER20> I did something similar with my Chromebook. I flashed the bios and installed Arch + Sway + GalliumOS patches. It's been a pretty stellar experience so far.

</comment><comment><USER23> Hmm.

I appreciate the sentiment behind the author's desire to do this. But I'm wondering:

\- Did it void a warranty if it was still valid, and the tampering with the case had damaged some hardware that the end user can't fix on her own?

\- Does the user require knowledge of GalliumOS, and understand that updates may need to be pulled manually?

\- Can common college programs in her major be run on GalliumOS and on the hardware defined by Chromebooks (low-end)? Can she run SSH to Linux or VNC for Windows w/o difficulty?

I agree having one corporation say to the poor and the young and the otherwise disenfranchised that a corporate, locked-down operating system is good for you is not a great idea. It trades your freedom for convenience, and no matter how appealing that may be for both parties (the end user for cheapness and ease of use, and the corporation for not having to deal with the insanity and unworkablity of some users), it's not a good tradeoff in the long run for anybody, including the corporation that discovers too late that hiring the same sheep it raised is bad.

But I don't think this is the right way to go about it. Shrieking the principles of Stallman from a hill just makes you look like an old crazy person. I personally didn't get to love Linux until I had a MacBook Pro, a UNIX fork that works pretty nicely on a laptop, and moved slowly into Linux until I prefer the CLI over GUIs for many things now. At every stage of my transition, everything worked, and worked best for me, and I understood _why_ I needed to move further. Doing something like this and encountering issues solved by ChromeOS may create a negative impression of Linux in a young mind, which is the exact opposite of what you want to do.

As an alternative way forward, I installed Ubuntu on my parent's laptop after Windows 10 kept freezing up on them. Yes, it has binary blobs and a corporation runs it and whatnot, but it _works_ and it's still Linux.

My dad got a virus from downloading a YouTube video somehow, and I could fix it because I could reinstall chrome using 'apt', and taught him how to use 'youtube-dl' instead (open terminal, paste, enter key). I don't think he cares that it's Linux, but I do think he is happy it works and I can fix it when it goes wrong.

You never want to do the right thing by going against the laws of power, because that's how you end up as cannon fodder and a footnote in an moldy AP compsci textbook somewhere.

</comment><comment><USER14> If you're willing to go halfway and live with the verification screen (which doesn't require opening up the computer), I wrote up a guide for dual booting: [https://saagarjha.com/blog/2019/03/13/dual-booting-chrome- os...](https://saagarjha.com/blog/2019/03/13/dual-booting-chrome-os-and- elementary-os/). But back to the article, the author seems to fundamentally misunderstand the reasons for the warning screens. They are there to alert you if your system has been compromised; if you're looking for the ability to verify what you're booting it's either that or iOS where you can't install anything else at all. I think I vastly prefer the former option.

<comment><USER24> Those are not the only two options available. They could also allow you to provide your own signing keys, and then verify that whatever it is you're trying to boot is signed with those.

<comment><USER14> That's a valid option but I haven't seen any consumer hardware implement this properly. The issue seems to be that the ability to change signing keys makes it possible to change them without the end user noticing. Unless Google had a service that could deterministically burn your keys into the hardware at manufacture time instead of their own I can't see this working: can you think of anything else?

<comment><USER24> I don't see why it can't work if the only way to change them is through a special UI at boot (the security of which can itself be protected with hardware-assisted measures).

<comment><USER14> Because then other people can change the key without you knowing?

<comment><USER25> This is trivially avoided by adding a setup password. Additionally, the system could display a hash of the keystore at boot - AIUI, Purism has worked on something like that.

<comment><USER14> This doesn't help ordinary users who aren't going to check the hash at boot.

<comment><USER25> OK, so we're talking about users who have unlocked the system themselves and enrolled a user key onto it, but aren't going to notice if it changes unexpectedly? Suuure.

<comment><USER14> No, you also have to include users who would like to run "stock" Chrome OS and continue trusting Google's keys. How do you protect them?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> I have an i5 Chromebox I got at I/O a number of years ago, and I was considering doing something like this to make it useful. For the moment I haven't put in the effort to tackle it yet.

</comment><comment><USER27> Does GalliumOS auto-update, including security updates for all packages?

<comment><USER12> It's ubuntu based, but they use their own kernel. So you rely on their kernel builds, which is not ideal. If your device is one that works well with upstream kernel, you should just use a regular distro (or switch your galliumos kernel to track the regular ubuntu kernel).

<comment><USER8> Galliumos is no longer under development see r/galliumos for more info. Ubuntu 18.04 works great, see my other link in this for how to enable media keys.

<comment><USER12> It seems like they are still active, although not quite as much. The stickied post on that sub says so at least. The main draw for galliumos is support for odd devices for which upstream support is lacking. That's kind of why it exists, and I don't think things have changed materially for a lot of these old devices. Going forward, things should be a bit better since chromeOS itself tracks LTS kernel releases now, and I think they also plan to do kernel upgrades over the life of a device.

</comment></comment></comment></comment><comment><USER28> I wonder if the person he gave the laptop to appreciated that he installed Gallium OS. I bet Annie can figure her way around Chrome OS, not sure about Gallium

</comment><comment><USER29> Not all Chromebooks have a write-protect jumper like this. The HP Chromebooks have a write-protect screw. Rather than jumping terminals, you remove the screw.

</comment><comment><USER30> Who is Annie? I hate when people write like this. Despite this, it's a great technical piece.

</comment><comment><USER31> I'm curious what are the 2GB RAM and the Celeron 867 good for in 2019. Apart from text editing.

</comment><comment><USER18> "Screwdrivers for Freedom" \- A sentiment I can get behind...

</comment><comment><USER32> utter bollox

</comment><comment><USER33> But why? Buy a cheap laptop, reinstall windows (acquire Enterprise LTSC), profit. I rarely give the tech industry money.

<comment><USER16> I think you just made your own case for why to do this? Your solution costs money, this guy's solution costs however much a few inches of clear tape costs. Between the two "I rarely give the tech industry money" kind of suggests you are on board with repurposing old tech rather than just buying something new?</comment></comment>


Show HN: KafkaLite – A simple message broker inspired by Kafka - <AUTHOR> https://github.com/panyam/KafkaLite <comment><USER2> I feel the readme is lacking; I would hope to see something about its use case, what makes it lite, etc. How is it like/unlike Kafka? It seems like it is only available as a c library and does not expose a protocol. Is this just a single instance of a producer/consumer and a transaction log with topics available to the one running program? It would also be nice to see results under the benchmarks.

<comment><USER3> +1. FWIW It seems to be a kafka-style cursor based messaging system without the dependency on zookeeper (just what i gleaned from the readme)

</comment></comment><comment><USER4> Can you please explain what this library is for, how is it lite or competing, and how Franz Kafka is related? I just spent few minutes on Readme to understand nothing.

<comment><USER5> I imagine it it related to Apache Kafka ([http://kafka.apache.org/](http://kafka.apache.org/))

<comment><USER6> I wish how it was related to Apache Kafka was explained as well, since it looks like a totally different beast, and appears to only share the name.

</comment></comment></comment><comment><USER7> So it's a small in-process library for writing and reading append-only logs on disk, that supports multiple threads concurrently reading and writing as a pub/sub system.

It seems inspired by the Apache Kafka project in that it organizes logs into named topics, but it is not networked, does not split topics into partitions and segments, and does not do housekeeping like deletion of old logs.

It looks pretty new and immature, for instance [https://github.com/panyam/KafkaLite/blob/master/src/kltopics...](https://github.com/panyam/KafkaLite/blob/master/src/kltopics.c#L39) reads from a potentially uninitialized field and could randomly fail (but will not propagate the error!). Have the tests been run with Valgrind?

Not bad, but it could definitely do with an introduction in the Readme describing its purpose.

<comment><AUTHOR> Very nice pick. Valgrind has been used extensively to test this (valgrind is applied to all tests in the tests package). It looks like when i create my topic array, I zeroed out the memory (with calloc). So the topic is initialised to zero. But this would have resulted in uninitialised read accesses for any new topics that were created beyond the original topic buffer (with initial capacity 32). This has now been fixed (thanks again).

I chose to keep networking out of it for now as I felt it was something that could be added by the client (eg by having a websocket listener publish events as it saw fit). Also partitioning was not a high priority now as creation of new topics actually had fairly low overhead. Also deletion and compation of logs is something that was not a high priority right now but definitely something I would like to look at (would love some help :) )

</comment></comment><comment><USER8> Definitely seems like something to replace leveldb with vs kafka. Or maybe more akin to [http://chronicle.software/products/chronicle- queue/](http://chronicle.software/products/chronicle-queue/) minus the TCP replication

</comment><comment><AUTHOR> Guys firstly thank you very much for the exceptional feedback. And I apologise for the missing details. I found that as I was adding more to this the more I felt I had to add (fear of publishing really). So I wanted to push one out so I don't end up waiting for the perfect thing for ever.

In short the purpose of this library was to allow any application to embed an event broker with persistence so that it could consume events at its own pace. The purpose of this library is NOT to replace or compete with GCD or java.util.conc (which provide excellent primitives to do in memory queuing and processing of events).

The main use case that we wanted this for was message synchronisation. Consider a mobile messaging application that allows users (on mobile clients) to send and receive messages as well as do other CRUD ops on messages . To synchronise these events across all clients (say users in a channel) we would have to keep a connection (eg websockets) open to the server that would receive publish events to the client or poll for change events periodically by the client (of course the server would have to maintain its own event log - but a Kafka event sprayer that publishes to websockets is easily done).

In either case, when these events are received by the client they need to be processed as soon as they are received or the client would have to refetch them (harder to do on a non-polling situation as the state of what events have been consumed is expensive to record and maintain). Problem with having to process these events as soon as they are received is that there is no way to prioritise the events and there is no way to defer processing to a time convenient to the client. So with this library we have an append only log of events onto which we persist the events as we receive them (and because we can have multiple topics for each KafkaLite - KL - context) it allows us to impose prioritisation on which events are to be processed when.

I have not built in replication replication as it can be built on top as and when required. Also sharing of messages on a particular topic across processes while doable was not an immediate priority (would love to hear other use cases for this) so was eschewed. One other thing I would definitely like to do is provide a few sample producers that are platform specific (eg websockets based publishers, polling based publishers) but these seemed not generic enough (at least as of now) so I have not had a chance to investigate these further.

I would also like to apologise for any confusion with the name (especially to the gods of Apache Kafka!). As I had mentioned, this was only inspired by Kafka's original design (ie a stateless, fast and append only log). This library is written in C so as to be portable across any platform and not having to incur the cost bundling and invoking a JVM (clearly there is a lot to be done for this to be useable on the server side) - Hence the "Lite".

Again I really appreciate the feedback. Even though you see it when you read others content, with your own content you start with the bias of clarity as I did. Even more so if any of you would like help in using it in your own applications I would love to have a chat as to what features we could add to improve the robustness and usefulness.

<comment><USER9> > So with this library we have an append only log of events onto which we > persist the events as we receive them

You could also use any member of the CouchDB family, such as PouchDB for the browser (even as a lightweight desktop solution), or any member for the mobile [0] [1] [2]

[0] [https://github.com/couchbase/couchbase-lite- net](https://github.com/couchbase/couchbase-lite-net)

[1] [https://github.com/couchbase/couchbase-lite- android](https://github.com/couchbase/couchbase-lite-android)

[2] [https://github.com/couchbase/couchbase-lite- ios](https://github.com/couchbase/couchbase-lite-ios)

What could be really interesting is another member as a library; I don't think there exists any, but kafkalite could be the beginning of something...

<comment><AUTHOR> Hey rakoo thanks for sharing that. I actually came across this earlier. (Also RocksDB /LevelDB are amazing as embedded key-value stores). My starting point was to see what a pure log would give you and let the application worry about what it did with the events (eg in the messaging case - update the messages in the respective channels with the new content - the channel is just a table in sqlite!) - essentially a way to decouple the processing of events from their transport and persistence.</comment></comment></comment>


Post Quantum Cryptography - <AUTHOR> https://access.redhat.com/blogs/766093/posts/3031361 <comment><USER2> Heh, this looks familiar. The article is suspiciously similar to the Wikipedia page for Post-Quantum Cryptography: [https://en.m.wikipedia.org/wiki/Post- quantum_cryptography](https://en.m.wikipedia.org/wiki/Post- quantum_cryptography). Especially the algorithms section.

This is poorly executed content marketing, in my opinion. It doesn't really explain much that you can't get out of simply reading the Wikipedia page, and stops short of where I figured there might be some really interesting breakdown or insight.</comment>


Sort and group your iOS apps by color - <AUTHOR> https://github.com/marciok/rainbow <comment><USER2> This would make a good "Show HN". [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)</comment>