Skilled devs, low costs: Cluj-Napoca emerging as a tech hub - <AUTHOR> http://www.zdnet.com/article/skilled-devs-low-costs-no-surprise-this-second-city-has-a-booming-startup-scene/ <comment><USER2> I'm from Cluj, but this kind of sponsored corporate PR is not helping us at all.

There are amazing devs here and they don't work for companies like the ones in the article. Most of them are freelancers or working for startups.

Outsourcing companies are screwing people over considering the low overhead of operating. They charge around $80/h or more and pay devs maybe %20 that. The percentage is even worse in the rest of Romania, probably except Bucharest.

Endava and Fortech are both these types of companies, with Fortech offering something like the lowest dev salaries in Cluj. They still have guts to brag about their revenues though.

Spherik Accelerator, mentioned in the article, offer mentorship and aws accounts. That's why they're with their second batch now, and there isn't a single good MVP coming out. Nobody serious would ever apply. The "mentors" there are the same ones involved in every other IT "initiative" (Calin Vaduva, Philipp Kandal, etc.). It's the same people with new outfits and nothing good.

The only good thing in the article is mentioning Moqups, which are doing a great job.

There are other nitpicks with the article like

> We've seen some interesting JavaScript professionals with knowledge of > CoffeeScript or AngularJS.

Finding good JavaScript developers here is close to impossible, that's why at some point a company was offering a $2K referral bonus.

> Romanian headquarters of UK IT services company

This is how all Cluj corporates operate. There's no "UK IT services company", it's just a UK PO box or an empty rented space.

Again, there are great devs here, they just don't work with the local companies.

<comment><USER3> I don't think we can honestly say there is something really serious coming out of Romania (with few exceptions) as long as our overall culture still lags behind. Entrepreneurial culture is built on the general state of culture, the juice youth grow in, the schools, the friends they make in high school and college, the teachers they have and so on.

The pool of developers is large, although not as large as the demand, but the mentality is still one of an employee. Very little UX skills. What to say then about having a far reaching, yet pragmatic vision. Funding also is an issue, but I'd say it's mainly the people, from devs to the way too many 'mentors'.

<comment><USER4> Nothing serious? How about BitDefender?

Regarding the culture of being employed, you should check Germany. Everyone wants to be an employee, lots of benefits. Making a company is extremely hard and capital intensive. A freelancer is chased by all autorities and they make you feel like an outlaw. And so on.

Compared to this, Romania is a littel heaven. Just the corruption and buericracy is holding it back.

<comment><USER3> They're one of the exceptions. However, antivirus market is really crowded, so I don't there're anything exceptional in that. Same with Avangate. VectorWatch is making the news these days, I'm personally not impressed, but if they do make the news, there must be something in it.

You're most probably right, the employee feeling is more broad than Romania.

</comment></comment></comment></comment><comment><USER5> I was there very recently. It's a nice place. It's a bit like you imagine Durham UK to be if it'd been occupied by the soviets - a university town with some incredible old buildings, but with a real feel of poverty about the place. Still, it was pleasent and felt safe. Everyone from the taxi drivers to waiting staff know that it's stuffed to the gills with programmers. Seems there's also a pretty impressive gender split - the tech events I went to tended to be 50% women.

        > he lists the geographic proximity to Western Europe

Getting to Cluj is a completely ball-ache. There are some infrequent flights from Vienna (on a terrifying TAROM turboprop), and a Whizz Air flight from Luton once a day, and presumably at least one flight from Bucharest. Train from Budapest or Bucharest takes for-e-v-a.

<comment><USER6> Yeah, Cluj is a great city. The people are friendly and quite hard working, IMO. There are multiple flights from/to Bucharest every day (and from there pretty much any place you want to go) so travel shouldn't be too difficult. There is undoubtedly a lot of undiscovered talent that can be had rather cheaply because of the rather undeveloped economy outside of IT in general. I hope it continues to grow and develop as more companies see fit to invest in Cluj and Romania in general.

</comment></comment><comment><USER7> I'm a guy who worked for one of these outsourcing behemots based in Cluj- Napoca named SoftVision. While on the surface everything looks great, you should know that life inside this company is pretty miserable. And this will affect you as a client because just as we are being constantly lied to destroying our motivation, you as a client will be also lied to: starting with being offered fabricated resumes and all the way through false information about the number of people allocated to a certain project (there are people who work with their name only on a several projects) and the number of hours worked.

If you're curious about more hit up SoftVision on Glassdoor but change to a date based sorting, because their default sorting seems to favour glowing reviews written by the PR department.

I'm not saying all outsourcing companies are like this and I'm most definitely not saying that you can't find skilled devs in Cluj-Napoca. Just try to avoid SoftVision and their web of lies.

<comment><USER8> You're pretty much describing most body shops that call themselves agencies.

</comment></comment><comment><USER9> I am wary of the "gosh look how cheap we can hire developers in $latest_broken_country_with_maths_education"

Managing teams across distance and cultures is _hard_ and requires commitment - commitment that seems to vanish when hard things happen - remember when hiring programmers in Ukraine was a no-brainer? How many development teams got pink-slipped and how many got airlifted out with their families? Which one is showing the commitment ?

I applaud andrei512 for his entrepreneurial edge and desire to bring some of the world's cash to his home town.

But I wish that all those companies seeing 10% of cost of a London team will have backbones in a years time. I doubt they will. Backbones are expensive and these guys are looking for cheap.

<comment><USER10> Thank you! But I'm not offering cheap developers. I'm one of those kids who started coding by himself at age 10 and did really good at coding contests. I have a lot of friends like me. I can hook you up with one of them :)

edit: Also my plan isn't to bring cash to my town. My plan is to give power the real hackers of my town. Companies charge about $100/h and pay about $10-$15/h back to the developer. Money is already pouring in - it just goes the wrong way...

edit2: Yes. Romaina is a broken country. Cluj is not like that. I would have moved a long time ago if that would not be the case. Cluj is actually the only city in Romania that is growing in population.

<comment><USER11> I'm from Cluj-N and I disagree with your following points: \- "real hackers". I guess if you mean torrenting and refusing to pay for software products, then yes. \- "Cluj is not broken". You need to take a walk through the city. A __hole drivers, bad infrastructure, bad services. Did I mention a __hole drivers?

<comment><USER10> I think you might be from the bad part of town... where all the bad drivers and pirates where moved.

I usually rent an office 10-15 minutes from where I live so I can walk to work. No need to get in traffic or find a parking place and blame the system...

If you don't like Cluj then why didn't you move to Berlin, London, Amsterdam?

</comment></comment></comment></comment><comment><USER12> My Brit friend moved there about a year ago, does motion graphics with remote clients in London. Loves it and lots of amazing scenery appearing on my FB regularly :) I'm working with an iOS dev from Cluj currently, good guy. Looking forward to visiting soon.

Northern Romania and Transylvania is culturally closer to Hungary, it's not really comparable to say, Bucharest.

</comment><comment><USER13> Colour me biased (I'm romanian) but I think that Cluj is the perfect town to be based in if you have a well paying remote job.

Great internet (like everywhere in Romania btw), nice town, cheap living, nice places to hike to in the surrounding countryside, university town (aka lots of girls).

<comment><USER14> Except if you stop and look around, Cluj has the highest rents and building prices out of Romania.

If you're working for a western salary, then sure, it's cheap. Not for a regular Romanian, though - especially if you're not working in IT.

</comment></comment><comment><USER15> A friend of mine hired developers in Romania a few years ago and still uses the same team. This is just one data point, but they were really nice to work with (I helped my friend for a while).

Similar experiences working with teams in Vietnam and India, BTW. Teaming with developers in lower cost of living tax jurisdictions can make sense, depending on how tightly coupled dev tasks are. Even with time zone inconveniences, it can also be a lot of fun working with people remotely who are in different countries.

<comment><USER5>
        > Similar experiences working with teams in Vietnam and
        > India

A very small dataset, but I've found the mindset of Eastern European teams I've worked with and Indian teams I've worked with to be massively different. The EE teams were very culturally similar to the more Western teams, but with funny accents.

The Indian outsourcing I've worked with has - with no exceptions to date - been an absolute clusterfuck. Incompetence compounded by arrogance, byzantine technical architecture, inflexibility, obsession with rank, authority, and certification, and a tendency to lie out of bad situations. It felt like identical experiences across three different projects with three different large IT services firms that were India based. I began to seriously worry I was going to start to have a subconscious racist reaction to Indian accents over the phone.

I'm sure there are dreadful Eastern European outfits, and exceptional Indian ones, but my gut reaction will be to reach for the Eastern Europeans first next time I need to outsource development.

<comment><USER16> Well, Romania as well as Hungary and Bulgaria are fully European cultures. Sure, there are historical influences and economic contexts that made them different than mainstream Western Europe, and one can quote "Balkans" as a different attitude, but in terms of mindsets and value systems EE and WE are in the same category, different than India, China and other geographical regions. Not passing a judgement value here, just pointing out the similarities and the reason why US/WE people can work easier with EE people than with, say, Chinese - just as those Chinese would work better with Vietnamese or Indonesians, etc.

As a particular element to note: say what you want about it, but behind the Iron Curtain education was taken very seriously in sciences and engineering (maybe less so in the so-called humanistic areas because those would risk to come in conflict with the official communist doctrine). The technology and labs in the universities were sometimes lacking, but they surely made up in terms of solid theoretical education. So the foundations were there for competency when the computer age dawned - what generally lacked was (still is) the capital.

</comment></comment></comment><comment><USER17> Has anyone seen a comparison of developer billing rates by geographic region? A somewhat related question is how would one go about locating remote workers from a cheap region such as this. I know odesk is an option, but are there others to establish direct relationships?

<comment><USER10> You can get really good developers for anything between $35 and $80/hour. I help companies find developers in Cluj-Napoca. If you are interested send me a message on twitter @andrei512

<comment><USER18> With the current USDEUR for $50-$80 you can get excellent programmers in most of europe. And most of the world by the way.

Edit: it depends ofcourse if you get a company with projectmanagement, testers, overhead for that or just people coding in their attic. I find working with a small company of techies with a strong PM and process works well and is worth far more money. Not talking about outsourcing factories which are horrible.

</comment></comment></comment><comment><USER19> Sure, why not. Outsourcing to Romania is kinda like outsourcing to some of the more rural parts of the United States.

Only they speak Romanian in this case and the price difference is far greater.

But still, more or less the same.

Now that I've planted that seed, I'll just go ahead and throw out there that New Mexico has an amazingly cheap cost of living.

<comment><USER20> The average Romanian IT expert/programmer speaks better English than most Americans. You'd be surprised about the quality of a conversation. And I'm not talking about tech...

<comment><USER11> I think you're kidding. And I'm a Romanian, and so are you, I think.

<comment><USER20> No, I'm not kidding and yes, I am a Romanian; from Cluj-Napoca actually. Why would I be kidding? I know few developers which have difficulties with the English language. I know many that know the difference between "who" and "whom" or between "color" and "colour". I can't account for all, of course, that's why I wrote "the average", in an attempt to group them by their skills. Maybe I did exaggerate the part with "most americans", but I've certainly seen enough examples of English being misused.

</comment></comment></comment></comment><comment><USER21> My company (UK) has an office in Romania. There are devs there too and they're pretty good, competent at least.

Unsurprisingly we have no more client help-desk team here in London and it's in Cluj now...

</comment><comment><USER22> No pun so apropos ought go unmade: ClujureConf, Eastern Europe's most eponymous Clojure conference.

<comment><USER16> Thank you for pointing it out: the "j" in the city's name is pronounced much closer to the "j" in Clojure and not like "zh" as the article mentioned. Also, in Transylvania there is a slight tendency to overstretch some vowels so: "kloooo-j" (pour les connaisseurs)

<comment> guard-of-terra I do pronounce j on Clojure as zh. Is it officially wrong?</comment></comment></comment>


Raise the Crime Rate - <AUTHOR> http://nplusonemag.com/raise-the-crime-rate

<comment><USER2> Maybe I'm a grumpy old codger these days, but it seems like the thesis is "increased incarceration has lowered the crime rate outside of prisons, however inmate-on-inmate violence is appalling, therefore we should reduce incarceration". My knee-jerk reaction is "we have improved the first order problem of lower crime in society in general, creating the second-order problem where those inclined towards assault and rape are confined with others of similar mindset and continue this pattern of crime therein... shouldn't we look to preserve the desired result and simultaneously improve law and order within prisons?"

Agreed in advance that a phenomenal rate of incarceration is not the only means of reducing crime (or, as the thesis would have it, of shifting it into the inmate population) - but I'd find it hard to buy that we should turn our back on a working solution without a better one. As the article points out, 70% of released prisoners are rearrested within three years - we are largely not rehabilitating the prison population today, and fixing that would be the means I'd advocate - which would seem to also have the effect of lowering inmate-on-inmate assaults, rapes, and other violence.

I'm a bit at a loss as to why the answer would instead be a vast reduction in prison sentences (without some other substantive change making this viable)...

</comment><comment><USER3> By chance, I just received my copy of n + 1 in the mail earlier this week. To those who appreciate a thoughtful mix of intellectual pieces, I'd definitely recommend subscribing: <http://shop.nplusonemag.com/collections/subscriptions>

It's especially useful to those Bay Area residents like myself who can use a dose of literary snark imported from Brooklyn to counterbalance the homegrown cheer of the McSweeney's mini-empire.

<comment><USER4> I had them in my RSS reader for a long time, but I think in the past 3-4 issues, they've really gone downhill. I admit I'm pretty far from them on the political spectrum, but I appreciate rigorous research and data when arguing. Part of the problem is that I confuse it with H+ magazine (which is basically the polar opposite in view).

It might just be that I'm getting old and crotechty; my former favorite magazine (Foreign Affairs, from CFR) is falling prey to the same thing -- [http://www.foreignaffairs.com/articles/136917/matthew- kroeni...](http://www.foreignaffairs.com/articles/136917/matthew-kroenig/time- to-attack-iran) was inane enough to make me cancel my subscription)</comment></comment>


Digital signatures in browser with MetaMask and Ethereum keys - <AUTHOR> https://cryptonomica.net/eth-sign <comment><AUTHOR> Cryptonomica.net launched a web application for digital signatures (signing and signatures verification) using MetaMask([https://metamask.io](https://metamask.io)) plugin for browsers, Ethereum ([https://www.ethereum.org](https://www.ethereum.org)) keys and Cryptonomica identity verification([https://github.com/Cryptonomica/cryptonomica/wiki/CRYPTONOMI...](https://github.com/Cryptonomica/cryptonomica/wiki/CRYPTONOMICA- Identity-Verification)):

[https://cryptonomica.net/eth-sign](https://cryptonomica.net/eth-sign)

You do not need ETH (ether) to sign or to verify signature, just MetaMask and Ethereum key.

Information about key owner is read from Cryptonomica smart contract ([https://etherscan.io/address/0x846942953c3b2A898F10DF1e32763...](https://etherscan.io/address/0x846942953c3b2A898F10DF1e32763A823bf6b27f)) that keeps information about verified keys.

To store key information in smart contract ([https://etherscan.io/address/0x846942953c3b2A898F10DF1e32763...](https://etherscan.io/address/0x846942953c3b2A898F10DF1e32763A823bf6b27f)) you can verify your identity via [https://cryptonomica.net](https://cryptonomica.net)</comment>


Amazon page for pepper spray - <AUTHOR> http://www.amazon.com/Defense-Technology-56895-Stream-Pepper/dp/B0058EOAUE/

<comment><USER2> This is one of the post passive-aggressive rants I've seen in awhile. Bravo.</comment>


Show HN: Closest Volcano - <AUTHOR> https://closestvolcano.com/ <comment><USER2> It would be nice if there was a way to manually enter location, since the location API on desktop is for me inaccurate by hundreds of miles.

<comment><USER3> Agreed. Actually, I think the default behaviour should be to show a map with a Voronoi diagram so you can immediately see the closest volcano for any location.

Hm. The volcano locations are in a JSON list, and SciPy can do spherical Voronoi calculations...

Edit: Someone already did it for Iceland (though without marking the volcano positions): [https://www.flickr.com/photos/78506020@N00/6807458402/](https://www.flickr.com/photos/78506020@N00/6807458402/)

<comment><AUTHOR> Do you have any experience with the Google Maps API? I would love to implement this.

<comment><USER3> No I don't. All you need, though, is the ability to draw straight lines (well, great circle lines) between points. You could do the region generation once offline, in Python:

        import numpy as np
        from scipy.spatial import SphericalVoronoi

        import json

        with open('volcanos.json', 'rt') as f:
            volcanos = json.load(f)
            #There are some nulls in the data:
            volcanos = [v for v in volcanos if v['longitude'] != None and v['latitude'] != None]

        def longlat_to_xyz(longlat):
            longlat = longlat.reshape((-1, 2))*(np.pi/180.)
            r = np.cos(longlat[:, 1])
            return np.column_stack((r*np.cos(longlat[:, 0]), r*np.sin(longlat[:, 0]), np.sin(longlat[:, 1])))

        #go through set to remove duplicates:
        volcano_longlat = np.array(list(set((v['longitude'], v['latitude']) for v in volcanos)))
        volcano_xyz = longlat_to_xyz(volcano_longlat)

        sv = SphericalVoronoi(volcano_xyz)
        sv.sort_vertices_of_regions() #make the vertices go around each shape

        #find unique edges (they're shared between regions):
        edges = set()
        for region in sv.regions:
            region.append(region[0])
            for i in range(len(region)-1):
                edges.add((region[i], region[i+1]))

        long_min = -30.
        long_max = 330.
        def xyz_to_longlat(xyz, long_min=long_min, long_max=long_max):
            long = np.arctan2(xyz[:, 1], xyz[:, 0])*(180./np.pi)
            long[long<long_min] += 360.
            long[long>long_max] -= 360.
            return np.column_stack((long, np.arcsin(xyz[:, 2])*(180./np.pi)))

        vertices = xyz_to_longlat(sv.vertices)

        #To draw the regions on Google Maps etc., save edges and vertices as JSON and load into JS.

        #To draw the linked map with Matplotlib (very slow for hi-res, and it was fiddly setting up the right conda environment):
        import matplotlib.pyplot as plt
        from mpl_toolkits.basemap import Basemap

        fig, ax = plt.subplots(figsize=(16, 10))
        m = Basemap(projection='robin', lon_0=-200, resolution='h', ax=ax)
        m.drawcoastlines(linewidth=.1)
        m.drawcountries(linewidth=.1)
        volcano_longlat2 = xyz_to_longlat(volcano_xyz)
        x, y = m(volcano_longlat2[:, 0], volcano_longlat2[:, 1])
        m.plot(x, y, 'ro', markersize=.5)

        for edge in edges:
            m.drawgreatcircle(vertices[edge[0], 0], vertices[edge[0], 1],
                              vertices[edge[1], 0], vertices[edge[1], 1],
                              color='b', linewidth=.3)
        fig.tight_layout()
        fig.savefig('volcano_voronoi.png', dpi=600)

<comment><USER4> You have to use "is not None" instead of "!= None"

</comment></comment></comment></comment></comment><comment><USER5> Closest one to me at the moment (in Pilsen, Czech Republic): Alban Hills [1]

"Fun" facts:

\- it less than 30km from Rome, Italy

\- it emits enough CO2 that it occasionally kills livestock

\- last eruption is thought to be around 5000 BCE

\- a magma chamber is believed to be building up 5-6km below the surface

[1] [https://en.wikipedia.org/wiki/Alban_Hills](https://en.wikipedia.org/wiki/Alban_Hills)

</comment><comment><USER6> This is awesome, but the closest volcano it brought up for me is a dormant one. It would be nice to see closest active volcano.

<comment><USER7> I'm curious, when I was a kid we were taught about the active/dormant/extinct distinction, but my understanding has been that more modern thinking doesn't really go for the _dormant_ label, because dormant on a human timescale doesn't really mean much on a geologic timescale.

</comment></comment><comment><USER8> Huh. It's just a black screen with a red "Calculating..." in the upper left corner and a Bitcoin wallet in the upper right. Nothing else. Safari 12.1.2

<comment><USER9> Happens on Chrome as well. Approve location permissions and refresh.

</comment></comment><comment><USER10> Closest to me (in Austin, TX) is the massive Carrizozo Lava Flow in NM. I've actually been there via the Valley of Fires State Park. It's an amazing place, and seems to be usually empty- definitely worth a visit if you're in the area!

</comment><comment><USER11> Currently in a country with some excellent volcanoes: Ethiopia. Sadly this site isn't loading - I assume it is too big a download (not great internet up here in the mountains). A lightweight version would be great:)

<comment><USER12> That's the problem, if you're actually on a volcano your bandwidth is no good.

</comment></comment><comment><USER13> I'm glad of living in a country (Costa Rica) with several volcanos and a lot of them active, so indeed the app shows the closest!

</comment><comment><USER14> ATM this returns an incorrect answer for me (at Strasbourg, yet returning Dôme volcano circus in the center of France, 645km) as the closest volcano is actually the Nideck, a 250'000'000 year old volcano, a mere 35km from here.

(Photos, with geological layout at the end)

[http://www.passion-escalade-et- montagne.com/2018/04/escapade...](http://www.passion-escalade-et- montagne.com/2018/04/escapade-en-terre-volcanique-nideck-m-et- hirschfels-545m-29/04/2018.html)

[http://www.randoalsacevosges.com/2015/03/le-volcan-du- nideck...](http://www.randoalsacevosges.com/2015/03/le-volcan-du-nideck.html)

</comment><comment><AUTHOR> Thank you for the feedback! I am going to collate the inaccuracies and update the volcano database. I am also going to try to fix the errors a few of you have experienced.

</comment><comment><USER15> Devils Tower for much of the east cost US I'm guessing?

<comment><USER16> Does Devil's Tower really qualify as a "volcano"?

<comment><USER17> "Although magma formed Devils Tower, it was probably never part of a volcano." [1]

1\. [https://www.nationalgeographic.org/media/devils-tower- geolog...](https://www.nationalgeographic.org/media/devils-tower-geology/)

</comment></comment></comment><comment><USER9> Looks like volcanos are provided by a giant static JSON file. I'm curious, where/how was this data compiled?

Regardless, very cool.

<comment><USER18> I would query Wikidata for a first try: [https://query.wikidata.org/#SELECT%20%3Fvolcano%20%3Fvolcano...](https://query.wikidata.org/#SELECT%20%3Fvolcano%20%3FvolcanoLabel%20%3Fcoordinate_location%20WHERE%20%7B%0A%20%20SERVICE%20wikibase%3Alabel%20%7B%20bd%3AserviceParam%20wikibase%3Alanguage%20%22%5BAUTO_LANGUAGE%5D%2Cen%22.%20%7D%0A%20%20%3Fvolcano%20wdt%3AP31%20wd%3AQ8072.%0A%20%20%3Fvolcano%20wdt%3AP625%20%3Fcoordinate_location.%0A%7D%0A)

</comment></comment><comment><USER19> Apparently Mono Lake Vol Field is the closest to Silicon Valley

</comment><comment><USER20> No vulcano in Germany? Strange

</comment><comment><USER21> TIL there are volcanoes in Australia

</comment><comment><USER22> > tfw seattle

<comment><USER23> At least we're not Tacoma or Bellingham? Plus, as someone who's always really been into volcanoes since early childhood being able drive two hours and climb multiple volcanoes with exciting fumaroles and weird geology is pretty great...</comment></comment>


Is an App the new Resume? - <AUTHOR> http://www.fastcompany.com/1752283/is-an-ipad-app-the-new-resume

<comment><USER2> Hm. Let me remind everyone of a recent link here on HN: [http://www.mobileinc.co.uk/2011/04/inspired-use-of-qr- code-o...](http://www.mobileinc.co.uk/2011/04/inspired-use-of-qr-code-on-cv/)</comment>


Billionaires Want People Back to Work. Employees Aren't So Sure - <AUTHOR> https://www.bloomberg.com/news/articles/2020-03-25/billionaires-want-people-back-to-work-workers-aren-t-so-sure <comment><USER2> What if, at the tail end of all this, a bunch of people find that they've tried remote work and decided: "Hey - this fucking _rules!_ " In part because they've realized that they can complete their core work duties in less time, with less distractions, and zero commuting.

Maybe - _just maybe_ \- this could be the unplug that helps people prioritize the things that they enjoy over their work.

I recognize that's a viewpoint that represents immense privilege. I'm in a job where I'm capable of working remotely. But it'd be a neat thing for people like me to be able to leverage.

<comment><USER3> I think it's likely the exact opposite will happen. People are being thrown into seriously sub-optimal remote working experiences, and their productivity is likely to suffer for it. This will result in companies being less likely to consider remote working a viable path.

<comment><USER4> Forced working from home while during a pandemic. It's nothing like working from home under more normal circumstances.

<comment><USER5> If productivity turns out to be similar (or better) despite this handicap, I'd be genuinely curious to see how companies respond!

I'm personally very pro-remote (have worked remote at corporate gigs before) and it'd be great to see more companies adopting it. There are some seriously big benefits and, if the tooling keeps improving, I think it could be a real competitive advantage for companies.

<comment><USER6> > _If productivity turns out to be similar (or better) despite this handicap, > I 'd be genuinely curious to see how companies respond!_

It won't. That's the problem. Being forced to do WFH unprepaerd + kids suddenly home + being in an actual pandemic, worried about the future, your family and yourself = productivity disaster. And it unfortunately will end up emotionally associated with WFH.

<comment><USER7> Also, I suspect many companies are going to see reduced turnover, and as a result are likely to shy away from anything that _may_ have contributed, including WFH.

</comment></comment></comment></comment></comment></comment><comment><USER8> I'm using my quarantine time to read Piketty's "Capital in the 21st century". I'm actually pretty sure I'm _not_ going back to work if it risks my health.

And it is obvious that the rentiers of our economy want the non-rentiers to go back to work. The rentiers actually have little to lose. The article states they might get sick, but if we're being realistic, they are very well sheltered against the collapse of the healthcare system when they would, unlike the rest of us.

<comment><USER9> Appropriate disaster reading :-). Others have pointed out how the black plague killed off a lot of serfs and really put a dent in feudalism because of it. It is all well and good to own a thousand hectares of land but without the serfs to work it, its just a nice park to go walking in.

<comment><USER10> Trouble is, that nowadays the serfs are in China. In the Middle Ages, servants would flee a lord that was too harsh. The Church and the towns with their rising merchant class would be another way out.

Instead we have healthcare tied to the job and the tech hiring cartel. Where is the revolution?

<comment><USER9> I see a number of serfs driving around my town partaking in the "gig" economy.

<comment><USER10> Moving from Deliveroo to Uber isn't an improvement, is it? You'll get shafted either way, but you can choose the colour of the shaft!

</comment></comment></comment></comment></comment><comment><USER11> Usually they don't say the quiet part out loud, and yet here we are.

We're incredibly fortunate in tech that we can do a large portion of work remotely, many people aren't so lucky. One would think that we'd value life above profit but lately that doesn't appear to be the case.

<comment><USER12> You're lucky today. Tomorrow isn't so clear.

Ad spends are dropping and dropping fast. Amazon is a retailer. Apple sells luxury goods. Cloud and Microsoft are dependent on big spends from enterprise.

All of this is at risk. Tech isn't independent of the Main Street economy.

<comment><USER13> Nothing is independent from the economy, but somethings are less elastic. Apple might also be doing better than others right now because they have a ridiculously large cash reserve and can probably wait this out.

</comment></comment></comment><comment> munk-a As soon as the CEOs and Board Members are willing to shake the hand of everyone coming back into the building we can resume work.

The rich aren't going to be exposed to risks like the working folk whether they're at the office or not due to their normal distancing.

</comment><comment><USER14> "For the rich it's like the trolley problem but the most important thing is saving the trolley."

<comment><USER15> Not even the trolley, just the shareholders of the trolley company (and not even all of them, just the preferred class).

</comment></comment><comment> twitch-chat There's a reason I like Mark Cuban. I'm glad he spoke against this insanity. For a billionaire, he's always taken great care of his players.

<comment><USER16> Except for the whole sexual harassment scandal a couple of years ago...

</comment></comment><comment><USER17> Elon Musk wanted employees to stay in the factory, working, while he himself ran into hiding. He doesn't want to be stopped, even if it means people will die on the way:

[https://seekingalpha.com/article/4333698-tesla-elon-musk- win...](https://seekingalpha.com/article/4333698-tesla-elon-musk-wins-again)

</comment><comment><USER18> Risk vs. Reward. It's truly sad for those who can't work remotely and have to soon choose between risking their lives (or family members for that matter) vs. getting paid. Now that the stimulus is to be passed soon, I also wonder how many people would voluntarily quit and just file for unemployment. So many uncertainties ahead...

<comment><USER19> Since you can't get unemployment after voluntarily quitting, the answer to that question is exactly zero.

<comment><USER18> Health and safety reasons is one reason you can quit and still get unemployment. I think Coronavirus falls into this category but I might be wrong.

</comment></comment></comment><comment><USER20> There are a lot of factors at play here, and it's highly unlikely anyone has enough information to know the exact optimum response.

From a pure health perspective, physical isolation is taxing both physically and mentally. Not everyone has a home gym; is 6 months of sedentary behavior going to cause more cardiovascular complications than coronavirus in the same at-risk groups?

Economics also has health and well-being effects for the many people.

When we flatten the curve, we extend the length of sedentary behavior but reduce the number of people turned away from the hospital. However, as a previous article [0] describes, if we end up turning 90% of people away anyway, because the virus is just too contagious to control, will sedentary people have weakened immune systems or encounter other complications at a rate that challenges the benefit?

As another person who doesn't really know: if I were the feds, I would be using this time to mass manufacture masks and testing for every single American to wear daily, and once those were produced and delivered, reactivate significant parts of the economy, with voluntary precautions.

The mask culture in Japan may be contributing to the slower spread. It will go down as a great gaffe all the people who shamed others from not wearing masks in the western world.

[0] [https://news.ycombinator.com/item?id=22598009](https://news.ycombinator.com/item?id=22598009)

<comment><USER21> > _is 6 months of sedentary behavior going to cause more cardiovascular > complications than coronavirus in the same at-risk groups?_

Every shelter in place order allows people to leave their homes to exercise, and there are plenty of exercises you can do indoors.

</comment></comment><comment><USER22> Only the fortunate who have nest eggs saved up can say 'I'm not sure I'm ready to go back yet.' They quoted 1 server like he speaks for everyone.

tell that to the people who have families and been furloughed for 2 months or more. Here in Vegas I dont know one person who doesnt want work to start tomorrow.

this article reeks of so much privilege its insane. The billionaires will still be billionaires if nothing happened for over a year.

The rest of us without the opportunity to have nest eggs will be in poverty.

</comment><comment><USER23> Although I don't care much about billionaires (I care about the thousands of people they employ though), I'm pretty concerned about small businesses. Many local non-network non-franchise businesses go bankrupt these days.

</comment><comment><USER24> Maybe this will be the moment when we realize that we actually don't need billionaires or the whole rentier class at all? That we could all be working half the hours for the same standard of living without them? That we are effectively just serfs toiling at their pleasure?

</comment><comment><USER25> Seems like a pretty straightforward reason: billionaires have lots of people working under them, and they understandably want those people to work again for financial reasons. Definitely not a good idea to go back to work now, though; hopefully this quarantine brings people (socially, emotionally, not physically) together, and hopefully it lasts as long as is necessary.

</comment><comment><USER26> Wow, back button hijacked for an ad. Haven't seen that in awhile. What an annoying site.

</comment><comment><USER27> No shit, it's not like we have no slave-owners today for lack of want, either.

<comment><USER28> Own and rent are two side of the same coin.

We have no slaves today because renting turned out to be cheaper than owning with advancement of infrastructure and technology.

We still use convicts as slaves. It's worth it only if someone else (in case of convicts, the government) covers the cost of ownership.

<comment><USER27> > We have no slaves today because renting turned out to be cheaper than owning > with advancement of infrastructure and technology.

Nonsense, I have an embarrassing number of acquaintances who've admitted to wanting slaves and that they'd have them if it weren't illegal.

It's important to keep in mind that there's no shortage of people who'd be slave owners if only it were legal.

What you see in the prison system is a modern variant but only accessible to very few. Conventional slavery was damn near ubiquitous, accessible to many.

We have no slaves because it's illegal.

<comment><USER29> > Conventional slavery was damn near ubiquitous, accessible to many.

[citation needed]

<comment><USER27> For starters, in the early 1700s over 40% of NYC households enslaved people, not even in the south.

[https://en.wikipedia.org/wiki/Slavery_in_the_United_States#C...](https://en.wikipedia.org/wiki/Slavery_in_the_United_States#Colonial_America)

<comment><USER29> I don't know how true that is, considering the link used as a citation for the claim is dead: [https://www.thenation.com/doc/20051107/slavery_in_new_york](https://www.thenation.com/doc/20051107/slavery_in_new_york)

My biggest question is how a "household" is defined. Does it only count landowners? Landowners are significantly wealthier than the average citizen, so of course they would be able to afford more than most.

Also, are you aware that the population of NYC was under 10,000 until 1710? So even according to that stat, 4,000 people in one of the wealthiest cities in the country owned slaves. It doesn't seem like evidence that conclusively proves your point.

Got any other sources?

<comment><USER27> Frankly I find this subject far too depressing to read about for your needs.

I'm sure you're perfectly capable of google searches and reading about the history of slavery on your own if you're so interested.

We were taught this in school, that it was a very common practice with little to no barrier to entry in the early days, and wasn't even racially discriminated until rebellions started. There are even well-documented records of freed slaves becoming slave owners themselves, it was that trivially accessible and generally accepted.

My point was that slavery was accessible to _many_ , contextually in contrast to prisons today, context your quote omitted. Slaves you'd acquire in units as small as an indentured servant, prisons are far more complex with substantial barriers to entry. In an environment of legalized slavery any household could easily get in on it, I can't even begin to imagine how I'd go about starting a prison yet it's presumably legal for me to try.

<comment><USER29> > Frankly I find this subject far too depressing to read about for your needs.

That's what you're going with? So what evidence are you basing your belief of of? Sounds like it's just a feeling.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> And...flagged off the front page with amazing speed! Nothing to see here!

</comment><comment><USER31> How can a billionaire stay rich if we don't go back to work?

Money doesn't grow on trees. It comes from our bodies.

<comment><USER32> They can just exist and not do anything. I can't imagine most billionaires burn rate for daily expenses like food and essentials are beyond like 50k a year, if that.

Proportionally to me, that would be like if I withdrew a dollar from my bank account and lit it on fire once a year to cover all my necessities.

</comment></comment><comment><USER33> have heard these sorts of statements privately, but not publicly yet - interesting that we're now hearing them from US elites just as the US _starts_ to seriously shutdown - makes me curious if other elites making the same sorts of statments in other countries

<comment><USER34> From what I understand by trying to "read the signs between the lines" (which means it can be somewhat off) one of the reasons Germany is reporting much less deaths is some attitude there that only those who didn't have other illnesses and died now are to be reported as Covid-19 deaths (there is even some critique of Italy for reporting their immense surge of deaths as due to Covid-19!).

Of course, the number of deaths that they can't report so will nevertheless go up there too, but they will claim that they are so superior compared to those Europeans southern from them, and they could propaganda their own population that "it's not so dangerous" (by misreporting those with "other illnesses" like hypertension etc) to go back to work as their country and health infrastructure is so superior.

The German main advantage is most of their cities being relatively small, so everything is "spread" more than in many countries, less chance for news like in Spain or Italy where the army had to carry corpses because there are too many. It will be more "a few here" and "a few there" etc.

I can't quote you some specific news, except some articles in French writing about German view, that I remember reading recently (but haven't saved the links) but at least, as one additional example, if I understood correctly, something I've got delivered from somebody I know, there's some German doctor for which is claimed that he is "epidemiologist" who gets more media presence just recently, claiming that "it's not worse than flu" and that the number of deaths in Italy and Spain is only "because they have bad hygiene." Of course he ignores the fact that there was already a peak of flu season in Italy around two months before, and that now there are there 50 _times_ more deaths per week than then, and hygiene certainly didn't get worse 50 times in so short time.

[https://en.wikipedia.org/wiki/File:Is_COVID-19_like_a_flu%3F...](https://en.wikipedia.org/wiki/File:Is_COVID-19_like_a_flu%3F_ENG.png)

So stay tuned, if I get more info, and there's some possibility to comment, I will... Or maybe some other person who reads the European news more carefully (best more than one language) will be able to write more. But as this whole topic is already flagged here, don't expect too much here.

</comment></comment><comment><USER31> I don't understand why this is flagged. I've been thinking about this conflict since Trump said Easter.

<comment> munk-a I'm disappointed in this flagging - there are very vocal calls from some politicians and business folk to "get folks back to work". If we could flag and mute those politicians for spreading dangerous misinformation using unsupported claims that'd be great, but their words are out there and could drastically effect all of our well being.

<comment><USER15> This site is the mouthpiece of billionaire VCs who owe their wealth to lots of people buying into their system.

</comment></comment></comment><comment><USER35> >"The more people are infected, the more likely it is that Blankfein and other billionaires will become infected as well."

May be true, but at the same time

>Billionaires and other members of the elite have the luxury of social distancing while making money.

<comment><USER36> Some of them also have dedicated medical facilities.

</comment></comment><comment><USER37> Okay, so if we let the infection rip, what's their plan to deal with the massive wave of people suffocating on their own phlegm? Dig a trench?

<comment><USER38> I know this won't be a popular take but I haven't seen any compelling data to indicate what we're dealing with is any more deadly than a cold. No one has any idea how many people have been infected by this virus. It is assuredly many many more than current tests have revealed as the only people being tested are healthcare workers and at-risk individuals. I wouldn't be surprised if over a million people in the U.S. have already had it, possibly many more. That would imply a "massive wave" of people in need of intensive care isn't coming. No more than come about during an ordinary wave of other coronaviruses.

<comment><USER39> So the dead piling up in Spain and Italy are apparently not compelling enough? I can't recall a common cold overwhelming medical facilities and emptying nursing homes like this. The thing that seems to elude the "it's just a cold" school of thought is that this is a cold for which there exists zero population immunity, unlike the existing coronavirus strains or even the flu.

<comment><USER6> "Zero population immunity" especially includes medical staff. I don't recall any cold season throughout which a country would be losing its doctors and nurses.

</comment></comment></comment></comment><comment><USER40> The reason why the Spanish flu hit so hard in 1918 is that countries were not willing to quarantine people in fear that it would hurt their wartime economies.

</comment><comment><USER41> Then those billionaires should pour some of their billions into research to find a cure. Even one that is not perfect, like the one we have for HIV/AIDS currently, should do the trick. A HIV positive going treatment still has the virus but the plethora of drugs it takes daily stops AIDS from developing. Just ask Magic Johnson, he's doing it for almost 3 decades now.

</comment><comment><USER42> Some of us look after our employees.

<comment> munk-a Yea, I mean a lot of businesses are terrible, but there are good cases as well, including all those businesses that budgeted and paid for equipment to allow their employees to remote once this became a clear issue in early March.

</comment></comment><comment><USER43> "No one reached out to me and said, 'As a senior citizen, are you willing to take a chance on your survival in exchange for keeping the America that all America loves for your children and grandchildren?'" Patrick said. "If that's the exchange, I'm all in."

This is from Dan Patrick, Texas Lt Gov. who doesn't want to sacrifice their lives for S&P 500?

<comment><USER44> one way to fix the Social Security funding shortfalls...

</comment></comment><comment><USER45> This is a generally unpopular opinion, and I don't know that I agree with it, but it does appear that the billionaires might be logically right from an ethical perspective.

It might cost more QALYs (quality-adjusted life years) to have an economic recession the size of 2008 than to have millions die from COVID-19: [https://medium.com/@benfinn/coronavirus-how-much-is-a- life-w...](https://medium.com/@benfinn/coronavirus-how-much-is-a-life- worth-854570873153)

<comment><USER46> You are making the very false assumption that we have a choice between deaths and economic collapse. Like it or not, we are seeing faster growth rates than Spain. With our awful response, we could be easily heading for 2+ million deaths if hospitals get overloaded as expected. Workers will not show up anyway because it is dangerous for them and their families (this is already happening). This will cause the economy to collapse at least as bad.

Sacrificing grandma to Mammon is not the answer.

<comment><USER47> It cuts both ways though. Mortality rates from unemployment are no joke.

<comment><USER46> That's so plainly a much, much smaller cause of death. I'd encourage you to examine evidence more in the future. Besides, mortality rates actually tend to decline during recessions. While the causes of this are still debated, it has been observed for a century [0].

Besides, as I was saying, we don't have a choice between deaths and collapse. You get collapse and fewer deaths or collapse and more deaths. We are choosing the former.

[0] [https://fortune.com/2019/01/25/economic-downturn- mortality-r...](https://fortune.com/2019/01/25/economic-downturn-mortality- rates/)

</comment></comment></comment></comment><comment><USER48> > Mark Cuban, who owns the Dallas Mavericks, wants Americans to listen to > epidemiologists instead. "Ignore anything someone like me might say," Cuban > wrote in an email. "Lives are at stake."

</thread>

</comment><comment><USER49> That's funny. Individually we don't have a lot of power, but when we work together we have lots of power. If only we had some mechanism to bargain collectively for our interests.

</comment><comment><USER50> This shouldn't be surprising to anyone.

Billionaires are billionaires because of the extreme disproportionate gains by the few at the expense of thousands/millions.

They're used to seeing the many slave away for their interests.

Not seeing that happening now is throwing their view of proper world order into chaos and they're not used to be back in a position without control.

<comment><USER51> Any person or group in the US can start a worker cooperative and run it as they see fit.

<comment><USER28> Are they competitive if they don't exploit their workers like companies do?

<comment><USER51> The idea is to pay the workers out of the profits that would otherwise go to the business owner. This doesn't increase the cost structure of the operation.

There's nothing non-capitalist or non-free-market about a worker collective. There are no laws against it. Nobody will try to stop you. You don't need a change in the government.

What are you waiting for?

<comment><USER28> Company owner can always ditch burnt out workers which is efficient for the company. I'm assuming it's not that easy in workers collective?

<comment><USER51> The workers can run the collective as they please.

<comment><USER28> No they can't because they have their individual self-preservation instincts that they can't disregard. Company owner can do that with ease.

</comment></comment></comment></comment></comment></comment></comment><comment><USER52> I'm a little sad that I'm pointing this out but Trump is maybe the only politician in the entire US with big enough balls to stand up to billionaires (and really mean it) in this sort of situation if he wanted to.

</comment><comment><USER53> Maybe this virus will kill enough baby boomers to balance the social security solvency and transfer wealth up a few generations.

I'd you don't agree with me, than what makes what I said any different than the Topic of this thread.</comment>


Signal-cli: command-line and dbus interface to Signal - <AUTHOR> https://github.com/AsamK/signal-cli <comment><USER2> Is it possible to use this along with the smartphone app (i.e., by "registering" with the same phone number) or does this CLI effectively represent an independent registration which would supersede the one on the phone? The README said something specific on this – so I assume it's the latter?

<comment><USER3> Yes, it's possible to use this from with a smartphone. The README did say something specific, like, how to do it. In the app go to Settings -> Linked Devices -> add a new one. Decode the URL in the QR code, then add it to signal-cli like this:

signal-cli -u USERNAME addDevice --uri "tsdevice:/…"

As outlined in the README under the "Linking other devices" section

<comment><USER2> Thanks. Though the README also says:

> To be able to receive messages signal-cli uses a patched libsignal-service- > java, because libsignal-service-java does not yet support registering for > the websocket support nor provisioning as a slave device.

So maybe you can add a smartphone if you've already registered via the CLI but not the reverse? The wording is unclear to me.

<comment><USER3> That line is explaining why signal-cli doesn't use the real libsignal, but a modified copy of it. They've modified it to support shit like that. However, [https://github.com/AsamK/signal- cli/issues/49](https://github.com/AsamK/signal-cli/issues/49) makes it sound like you may have other issues.

</comment></comment></comment></comment><comment><USER4> How long will this take until Moxie gets this taken down, too?

He's been pretty vocal about preventing others from distributing clients able to use his servers that aren't built by him (and don't transmit usage statistics to him).

<comment><USER5> Well, it's already been around since May 2015, and it's been posted on HN a few times before.

Hopefully moxie will come speak for himself (he's pretty good about that, in my experience), but I think he's mostly interested in preventing naive users from accidentally stumbling onto a client that is insecure because it doesn't auto-update.

Here's his logic for why Signal shouldn't be in F-Droid: [https://github.com/WhisperSystems/Signal- Android/issues/281](https://github.com/WhisperSystems/Signal- Android/issues/281)

I disagree with him about a few things in this space, but if you know anything about him, it's clear that he's more interested in security and privacy for the masses than selling data to make a quick buck.

</comment></comment><comment><USER6> >> "For registering you need a phone number where you can receive SMS or incoming calls."

For registering, is it possible to use a disposable number? If so, after the number is used for registration, is it ever required again, and exactly is it required to do?

<comment><USER7> You can use Wire's API (in alpha) without a phone number, [https://github.com/wireapp/wire-bot-java](https://github.com/wireapp/wire- bot-java) && [https://wire.com/en/privacy/](https://wire.com/en/privacy/)

<comment><USER6> Wire is not Signal, right?

<comment><USER8> Their protocol is derived from Signal's. I don't know how close it is. Maybe just the name, because Moxie does not like independent reimplementations.

Wire also got a favorable audit recently. [https://techcrunch.com/2017/02/10/messaging-app-wire-now- has...](https://techcrunch.com/2017/02/10/messaging-app-wire-now-has-an- external-audit-of-its-e2e-crypto/)

</comment></comment></comment></comment><comment><USER9> Along these lines.. Is there currently a messaging platform that provides secure communication with e2e encryption and also has mobile apps and apis for automating messages and writing bots?

I want to build things like [1] but I don't want my messages being readable by a 3rd party.

I may end up just running an irc server+tls or something like rocket.chat

[1] [https://www.facebook.com/notes/mark-zuckerberg/building- jarv...](https://www.facebook.com/notes/mark-zuckerberg/building- jarvis/10154361492931634/)

<comment><USER10> [https://matrix.org](https://matrix.org) fits the bill.

<comment><USER9> Ah, thanks! I came across that a while ago but had forgotten about it. It seems to have come along quite a ways.

<comment><USER10> Yes, their web & mobile client [https://riot.im](https://riot.im) is very polished now. They are also rolling e2e crypto.

<comment><USER9> It may be a little over engineered for what I want it for, but it does work! I started up the reference server in a docker container and wrote a quick bot using the provided python-sdk and can interact with it using the client on my phone.

The main downside(from my perspective) is that it's a lot of moving parts, and I think I'd be more happy with just irc over tls since I at least know how that works :-)

<comment><USER11> It's mostly a question of mobile support: IRC (over TLS or otherwise) requires a continuous connection, where matrix and signal are designed to support polling a push notification endpoint.

Out of curiosity: what makes you say Matrix is over-engineered?

<comment><USER9> Oh.. maybe not over-engineered, but just more involved than what I need. I mostly just want a way to move messages back in forth. I don't need voice or video calls or anything like that.

<comment><USER10> One of the use cases Matrix was designed for is Internet of Things, so I think it's just fine for you.

Video calls come thanks to WebRTC in browsers, Matrix is just a transport protocol. I think it's quite light.</comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: Do you code in a VR headset? - <AUTHOR> How's it going? <comment><USER2> No, but I do occasionally check [https://www.reddit.com/r/HMDprogramming/](https://www.reddit.com/r/HMDprogramming/) to see what others are doing.

</comment><comment><USER3> I tried, but the resolution of my original vive is not sufficient. Also not seeing your keyboard, mouse and hands (even knowing touch-typing) is quite a hindrance. Overall I don't think VR is going to be there anytime soon. AR has a better chance, but they need to seriously increase the quality / size of the displays.

<comment><AUTHOR> Virtual reality with virtual cues about your real environment could be a solution to the keyboard problem.

Another solution to the keyboard problem would be to get rid of the keyboard altogether to be replaced by a non intrusive brain computer interface.

<comment><USER3> yeah that's not for tomorrow either. Even if they managed to get a brain interface to get as accurate as Alexa's voice recognition (and that is a monstrously GIANT if), that is never going precise enough to work with. Same as people in the 90s thinking soon we'd all use voice recognition to type documents.

</comment></comment></comment><comment><USER4> I would like to, but text is hard to read in VR. Perhaps we need a Minority Report like graphical coding interface to go with the VR headset.

</comment><comment><USER5> Yes. Within the natural simulation of the world that is the phenomenal field (the aggregate sensory datum) presented to consciousness. Why would you want to work within a simulation within a simulation? This VR is guaranteed for life, and without a subscription model (excluding taxes of course) :p

<comment><AUTHOR> Can't program in the parent realm (yet?)</comment></comment>


Bitwarden second security audit report - <AUTHOR> https://bitwarden.com/blog/post/bitwarden-network-security-assessment-2020/ <comment><USER3> It's good to see companies making reports public to provide some confidence that they're having reviews done, but in this case the scoping of this job seems a little odd, not sure if that's a bad reporting template or something else.

Last page of the PDF indicates that they just did an external VA and pentest, but looking at their product set , I'd have expected (at least) a review of the web, desktop and mobile apps and the browser plugins for it to be a "thorough security assessment and penetration test" (as quoted in the blog).

Not to say external reviews have no value, but they're only part of what's needed.

<comment><USER4> The only PDF linked in the blogpost is "Bitwarden Network Security Assessment Report", and it does indeed only cover network related topics. Their earlier report from 2018 covers lots of web/desktop application assessments: [https://cdn.bitwarden.com/misc/Bitwarden%20Security%20Assess...](https://cdn.bitwarden.com/misc/Bitwarden%20Security%20Assessment%20Report.pdf)

So I wonder if they just forgot to mention that this second audit report doesn't cover that, or if there are more reports coming.

<comment><USER5> They did a code audit in 2018, and this is a network/pentest audit. They're two different things, that's all, and both are valuable.

</comment></comment></comment><comment><USER6> What does it cost to hire somebody reputable to perform an audit like this? Its something I want to look into for one of my own projects, but I have no frame of reference for what is a reasonable price for a simple full stack app (way simpler than bitwarden for sure)

<comment><USER7> Pentester for 10 odd years: usually for an external test you would scope it at X days depending on the number of IPs etc. And it should note that an external test really doesn't find much. External is usually £750/day for 1-2 days testing and one reporting. Internal testing (ie. Auditing a domain and all computers attached) is about the same price, maybe a bit more, and takes a bit longer usually. A build review is hardening the server itself, takes about a day and a day reporting. App testing is totally dependent on the app itself (this is where people have a crack at an actual installed web application usually using user accounts etc. And runs a bit more - £800+ per day usually. Specialist stuff (hardware testing, code review (what I used to do), social engineering, hardcore app testing (stuff like auditing bespoke network devices, high frequency trading apps, etc. Etc.)) is typically 1-1.2k a day.

You can get it cheaper but a lot of it - for better or for worse - <USER2> comes down to the skill of the individual consultant. You can pretty much halve these prices, but then you'd end up getting stuff outsourced to India and it wouldn't be any good. Depends if you care about the security of your product or just want a box ticked for some arbitrary compliance and want it done as cheap as possible.

I haven't been a tester/consultant for a few years now, but the prices hold up. That being said one development which has happened since I've left the industry is the advent of crowd sourced pentesting. I know a lot of friends who moonlight with these things and are very good at their jobs, and the rates are lower. The name crowd strike comes to mind, but I'm not 100% sure if that was the company or not. I know a lot of good UK based companies (if it's a web app/remote then the physical testers location doesn't matter) if you needed.

<comment><USER8> Your comment really surprised me as I didn't expect that this was just a pen- test, but after visiting the link, indeed it was!

I think it's a bit sneaky as for a product like this, people expect this to be a code and crypto audit. The "network" part should be emphasised and in the title of the page, instead of just the PDF.

<comment><USER9> In this business the title "External Penetration Test and Vulnerability Assessment" means the auditing company has run qualys/nessus* against bitwarden.com.

* expensive commercial vulnerability scanning tools.

<comment><USER8> Yes, but the title of the page/blog post is "Security Audit Complete".

</comment></comment></comment></comment></comment><comment><USER10> Good to see. Aside from the Apple ecosystem's password management, Bitwarden is what I've been using.

<comment><USER11> Same. They are one of the few open source products with decent support across multiple platforms.

<comment><USER12> And finally pretty usable on mobile, too! I have waited for this and just migrated from 1password (which was very easy, despite I lost my structure... I wish there were an open password database standard which password managers would use)

<comment><USER13> Enpass is another alternative with good cross device and platform support. Under the covers they use SQLCipher[1] which I'm guessing you could build your own interface for.

[1] [https://www.zetetic.net/sqlcipher/](https://www.zetetic.net/sqlcipher/)

</comment></comment></comment></comment><comment><USER14> [https://github.com/bitwarden/jslib/issues/52](https://github.com/bitwarden/jslib/issues/52)

I am astounded to see this missing from the report. Apparently the report was just their external API configuration or something?

<comment><USER15> It wasn't in the scope of this audit, but it's still somewhat concerning... PBKDF2 with SHA-256 (a super fast hash with hardware support) as a key derivation function (which should be slow and difficult and hard to do in hardware)? That doesn't sound right. The answer provided (cross platform compatibility) doesn't sound satisfying.

Was this discussed with the prior audit?

EDIT to add: Here's the 2018 "cryptographically right answer" on password hashing ( [https://latacora.singles/2018/04/03/cryptographic-right- answ...](https://latacora.singles/2018/04/03/cryptographic-right-answers.html) ):

Password handling

Percival, 2009: scrypt or PBKDF2.

Ptacek, 2015: In order of preference, use scrypt, bcrypt, and then if nothing else is available PBKDF2.

Latacora, 2018: In order of preference, use scrypt, argon2, bcrypt, and then if nothing else is available PBKDF2.

You care about this if: you accept passwords from users or, anywhere in your system, have human-intelligible secret keys.

But, seriously: you can throw a dart at a wall to pick one of these. Technically, argon2 and scrypt are materially better than bcrypt, which is much better than PBKDF2. In practice, it mostly matters that you use a real secure password hash, and not as much which one you use.

Don't build elaborate password-hash-agility schemes.

Avoid: SHA-3, naked SHA-2, SHA-1, MD5.

EDIT to UPDATE:

Bitwarden has commented (about an hour ago) that they'll fix this! Cool.

[https://community.bitwarden.com/t/switch-to- argon2/350/23](https://community.bitwarden.com/t/switch-to-argon2/350/23)

[https://github.com/bitwarden/jslib/issues/52](https://github.com/bitwarden/jslib/issues/52)

</comment></comment><comment><USER16> Can someone with security industry knowledge comment on how much weight we should give this? Are these sorts of things something you can just buy and they'll go out of their way to give you a favourable report because you're the client? Is Insight Risk Consulting known and credible?

<comment><USER7> This was an external infrastructure test which carries no real weight for the app itself. It just makes sure that stupid stuff like ssh open to the internet, no public CMS available etc. Hasn't happened. That being said bitwarden do do more in depth security audits but this _particular_ audit doesn't really mean too much.

<comment><USER9> The report itself was automatically generated by one of the popular scanning tools. It's 1 hour to run the automated scan and 1 day to format the PDF nicely for the customer.

The thing is half worthless, verifying that the CDN has TLS and raising warnings about obscure HTTP/CORS headers.

But occasionally it can find some really bad misconfiguration or library with a critical vulnerability in dire need of an upgrade. (Of course they would never publish a report finding issues like that).

</comment></comment></comment><comment><USER17> These audits are reassuring, but I'm hoping someone can speak to a question I have...

I know that encryption primitives are almost never the breaking point in systems like this, but I wonder in situations like this where breaches would allow adversaries to attempt offline attacks whether they are particularly pertinent.

Specifically, while the number of iterations on the PBKDF2 SHA-256 function are high (100,001 on the client), PBKDF2 always felt to me like a footgun when compared to scrypt or argon2 which don't have as many (any?) insecure modes of operation.

The website states that AES is used, but is it in an authenticated mode (e.g. GCM ?)

Finally, their website states that they use "popular and reputable crypto libraries" and that they don't roll their own crypto, but the libraries they use are awfully low-level. Something like libsodium or FilSottile's age would be something I'd be more comfortable with when considering a hosted method.

In the meantime, I think I'll keep using KeePass2 (w/ Argon2 and ChaCha20) and synch'd with SyncThing to minimise my attack surface.

<comment><USER18> I don't see PBKDF2 as a full footgun, but maybe as the minimally still- acceptable method. When I was building my system for E2E messaging (pritact.com) I started out with PBKDF2 but kept mentally revisiting the iteration count before biting the bullet and switching to Argon2.

Actually it looks like Argon2 is being discussed as of just a couple hours ago [https://community.bitwarden.com/t/switch-to- argon2/350/24](https://community.bitwarden.com/t/switch-to-argon2/350/24)

<comment><USER17> Great to see it! It certainly speaks to the positive nature of BitWarden being open-source.

</comment></comment></comment><comment><USER19> Tangential question: What password manager do you guys use?

<comment><USER20> Bitwarden. Works well and the integration with 2FA/TOTP is amazing. I highly recommend to _not_ rely on a single (mobile) device for 2FA. Loosing or breaking it might shut you out of certain accounts forever.

<comment><USER21> > Loosing or breaking it might shut you out of certain accounts forever.

But isn't this what the backup codes are for?

<comment><USER22> Yea, I used to keep my passwords and backup codes in two separate KeePass vaults. Now I use Bitwarden for passwords but still use KeePass for my backup codes.

I use the notes for each entry in Bitwarden to indicate what kind of 2FA I have enabled and whether I have a backup code already stored in the other vault.

</comment></comment></comment></comment><comment><USER23> I love the concept of making this public but I feel like the audit wasn't very thorough if all it suggested was two security headers that a free online scanner could have picked up.

</comment><comment><USER24> I'd like to see a Open Source password vault which relies on open hardware storage for passwords. Clients only get rate-limited amount of passwords when the hardware is prompted to give, e.g. from physical button confirmation on the hardware, finger print. Point being that clients don't hold the passwords, just the usernames.

Problem with Bitwarden etc. is that if your computer or one of the devices gets compromised, then all of your passwords are lost at the same time. With hardware based vault you can mitigate this somewhat, with rate-limiting, physical prompt etc.

I have 1600 passwords, I use perhaps 10 different per week. If I get compromised I loose 1600 passwords, but with hardware based system I potentially loose just the 10 I used within the last week.

<comment><USER25> Throw enough money at Bitwarden and I am sure they would be happy to build out those capabilities. They really don't have extra funds for cool R&D like that.

</comment></comment><comment><USER26> Which password manager(s) would you guys suggest for a team of 10-15?

<comment><USER27> If you don't need to share passwords: KeePassXC.

If you _do_ need to have shared passwords (dev/stage/prod servers and services) why not Bitwarden for Business? [https://bitwarden.com/#organizations](https://bitwarden.com/#organizations)

<comment><USER26> I certainly need shared passwords. I will look at Bitwarden for Business. Thanks.</comment></comment></comment>


Proposed FCC Rules Tighten Restrictions on Annoying Robocalls - <AUTHOR> http://www.eweek.com/mobile/proposed-fcc-rules-tighten-restrictions-on-annoying-robocalls.html

<comment><USER2> Big deal. Note that the _rules_ (not laws!) are proposed, not final, and they "tighten" what appear to be non-existent restrictions on Ann and Rachel and Barbara and Wilford Brimley's sonic clone, and those asswipes that try to tell you that your non-existent Google Business listing is out of date.

Oooh! Look, the FCC is going to tighten up their rules! I'm so glad that tight rules will prevent calls to my do-not-call number.

The only thing that will work on these animals is a little frontier justice.</comment>


Why we're not going to Mars - <AUTHOR> https://e4a-net.org/2017/01/24/why-were-not-going-to-mars-by-timothy-crownshaw/ <comment><USER2> I can't help but think that the author, had he lived in 1600, would have argued a similar point about why we're not going to the Americas.

After all, there are no roads or churches, the place is full of strange animals, plants and potentially hostile natives, and there's no guarantee that proper European crops will even grow there! And how much will it cost and how long will it take for such a colony to become self-sufficient, if ever?

Defeatism. Bah.

</comment><comment><USER3> There are a lot of good points in this article but this comment overlooks one thing:

"I'll admit there still may be an outside chance that some consortium will fund and execute a mission to send a few poor, intrepid souls on a one-way trip to live short lives on Mars in a gruesome experiment, televised for all to watch."

There are people willing to make the one-way trip, and the ethics of this have been discussed at length [1]

But it seems to me that the one thing we would have to probably "let go" of is worrying about "contaminating" Mars.

[1] [http://www.slate.com/articles/technology/future_tense/2015/0...](http://www.slate.com/articles/technology/future_tense/2015/04/death_in_space_the_ethics_of_dealing_with_astronauts_bodies.html)</comment>


New Instapaper bookmarklet with multi-page article saving - <AUTHOR> http://blog.instapaper.com/post/18556429689 <comment><USER2> It's interesting to see Marco change his mind on multi-page saving.

Last year, he defended his decision to not offer that feature: <http://www.marco.org/2011/07/19/siracusa-multipage>

I wonder if the timing with Readability's iOS apps released today is just a coincidence or perhaps the catalyst for offering this feature.

Correct me if I'm wrong, but I don't think Marco has had to compete with a free clone until now, right? Read It Later has a paid app and Spool is still in beta.

PS. FWIW, the new bookmarklet still doesn't stitch together Siracusa's Lion review. Bug or still intentionally?</comment>


Real-Valued Recurrent Neural Networks more Powerful than Turing Machines - <AUTHOR> http://gpickard.wordpress.com/2008/05/30/real-valued-recurrent-neural-networks-more-powerful-than-turing-machines/

<comment><USER2> You mean: equivalent to hyper-Turing machines.

<comment><AUTHOR> Yes; but I only posted the original title.</comment></comment>


Ask HN: How to credibly demonstrate self-taught skills/knowledge? - <AUTHOR> HN - first post here.
I've read a lot of posts here about a Do It Yourself MBA or (more recently) teaching yourself Financial Engineering. While the real prize is the knowledge itself, how do you credibly demonstrate this self-taught knowledge/skill to potential employers? I don't imagine that I can just put it on my resume and have an employer believe me.
For some professions, like programming, simply working on a project or two would suffice. There exists ample opportunity for signaling.  Perhaps there's some analogue for an MBA or MFE? <comment><USER2> I don't quite see the appeal of "Do It Yourself" strategy. Most people in top MBA or MFE programs are also "doing it themselves" on the side but have many more resources to draw upon.

If you know for certain you want to be in business or finance, why not simply attend a top school. It only takes two years, which is nothing in the grand scheme of things. You'll make great friends, expand your network tremendously, and learn a lot, particularly if you go in with a very clear idea of what you want.

Of course, there is a downside -- tuition and opportunity cost. But it doesn't sound like your opportunity cost is that high and tuition, while expensive, is often worth it. I know plenty of people who were earning $40k pre-MBA and $160K after. They are also doing much more interesting work. It's absolutely essential, however, that you know exactly what type of job you want and what is required to get it. If you want to go to McKinsey, you essentially need to attend a top five school. Schools are definitely not worth it if you fritter away your time or decide you don't like the career path you've chosen.

<comment><AUTHOR> Unfortunately, my GPA got hit pretty hard in college because of some choices I made (attempted to double major in fairly difficult fields). While I'm certainly confident in my ability to score well on the GMAT/GRE and perhaps generate a couple of interesting items on my resume, I fear that my GPA would be enough to keep me from getting in. So, this is my way of asking how to get accredited without going to an accredited school.

<comment><USER2> You have two options: try to get accredited enough to get hired directly or try to get accredited enough to get into a feeder program. I suspect that the latter is easier. Many good schools will give you a chance if you signal you have your act together (i.e., by scoring well, getting good letters, have some interesting experience, and maybe getting a few As at some local University). I really depends on the exact job you are trying to obtain though. MFE is very different than an MBA.

Also remember to be patient. You may need to apply multiple times, for instance, or spend a year at a local university taking course work to prove you are capable. But don't forget that 40-65 is a 25 year career, optimize that.

</comment></comment></comment><comment><USER3> DIY MFE: pretty easy, have a 12 month track record on Interactive Brokers.

DIY MBA: most jobs are through referrals, so this is pretty hard. A blog could help, but you could also look like a dilettante if you don't have a track record. The only way to get into, say, McKinsey is through referrals or formal on-campus interviewing.

<comment><AUTHOR> So lets say I go on IB, make a kickass ROI after 12 months, and decide I want to be gainfully employed in that industry. Do I just put it on my resume? Do I write a blog talking about my success? Or, at the end of the day, will I need people to still vouch for me?

For the DIY MBA, I completely agree. No easy way to signal that you have the requisite skills yourself.

</comment></comment><comment><USER4> Here is how I did it:

So in school I majored in poli-sci but taught myself finance/accounting/investing by going to the library and reading books.

When I graduated from college (about a year ago) my ultimate goal was to land a job at a hedge fund. But it was pretty tough because hedge fund jobs are hard to land right out of school. Academically I was unimpressive, and I went to a state school.

Along the way (starting when I was a jr in college) I ran an investment blog where I posted ideas and commentary. I really pushed to put up original content and try to build myself into a brand for my niche in investing. This worked out well - After about a year of doing it I managed to get posts linked to by the NYT Dealbook, WSJ and FT blogs.

The blog helped in two ways. I was able to make a lot of contacts with people who were already in the field, and then with those contacts I was able to come to them for advice. So I would send then investment write ups I was working on to get their take on how to improve my process and make my process more professional. In turn, they shared a lot of professional resources with me. The other way is that it just helped get my name out there, people would use google, find my posts, and e-mail me. I tried to be really approachable to my readers, I was always willing to chat with them on the phone.

Once I got my investment process down, I applied to two investment clubs that are pretty tough to get into -- it is entirely based on an investment idea you submit in your application. I got into both which was really helpful in conveying my investment analysis skills.

Then, I took an unpaid internship with a small fund manager in my home town (I live in the south) who I admired. I got a meeting with him by sending a package to his house with a couple of investment ideas and a letter which described why I wanted to work for him. This was a pretty hands off internship, but it helped again in allowing me to get the criticism I needed to improve. He would assign me a company/industry to look at and in 2 weeks we would meet up and discuss my work for a few hours. I did this for 6 months.

Eventually, I started getting e-mails from people wanting to interview me for jobs. I don't know what quite happened, but something clicked. I never advertised that I was looking for a job, but on my blog I did say that I recently graduated from my university.

In the summer, a portfolio manager at a fund that I never dreamed of being able to work for (most of their employees come straight from Ivy League schools with plenty of work experience, the firm's founder is pretty legendary and widely read) reached out to me to talk. I thought it was just a networking call, but at the end of our conversation he made the offer to fly me out for interviews.

I flew out twice and managed to do well in both rounds. So now I am here in a place that gets a lot of snow, working for a fund that I absolutely love.

When I look back on it I think the keys were really figuring out a way to stand out from the crowd (my blog) and then reaching out to professionals in the field to help bridge the gap from what I learned by reading books and what they learned from their jobs. I had a lot of luck in meeting good helpful people that were much more intelligent than me.

<comment><USER5> This is a very inspiring story. Thanks for sharing.

Would you mind writing a blog post explaining how you got started? You mentioned you went to the library and read books. Which books? Which ones did you start with? What knowledge did you have going in and what are some of the basics that you had to learn and then where did you go from there?

<comment><USER4> I do value investing, to learn that you really have to read a combination of theoretical (books about value investing) and practical (accounting, finance, investment valuation, excel modeling, books about different industries).

After that you need to put the two together and start valuing businesses. If you keep at it eventually you will pick up the right skills. Most people just read about the theory and dont focus enough on the practical stuff. Their analyses tend to be sub-par and unprofessional.

I spent a lot of time reverse engineering old investments by famous people or recent investments by hedge funds.

There was never one book that helped. I read a ton and tried to pick the best ideas from all of them. At school I regularly had about 10-12 books checked out in my name and would jump around, reading what really interested me.

The other day the founder of our fund took me out to lunch, he mentioned that he thinks Keynes offers the best introduction to the theory aspect of investing in Chapter 12 of his book General Theory of Employment Interest and Money. You can read about it here:

<http://en.wikipedia.org/wiki/Keynesian_beauty_contest>

</comment></comment></comment><comment><USER6> Becoming a successful blogger on it? Writing and publishing a book on it? Showing your skills while volunteering for an NGO / organisation that needs/validates your skills? Offering to work for somebody for free for a while? Just some ideas.

(disclaimer, I'm taking the university route myself)

</comment><comment><USER7> 1\. Do something wildly impressive.

2\. Generate a corpus of quality output that is public and can attract eyeballs.

3\. Get someone to believe in you, and use that to launch yourself further.

<comment><USER8> Exactly my current path. Find a problem, solve, then get people to pay for it. Do that enough times and you're bound to eventually create something very valuable.

</comment></comment><comment><USER9> You are not alone! Indeed, I think this is a key issue for all of us to address as globalization becomes more and more of a reality and degrees become less credible predictors of competency. Basically, we think we need a sort of reputation system that scales globally as a solution to this problem. Here are the key components we launched:

-CV/Resume display

-Recommendations from trusted others

-Work display (examples that illustrate your capabilities)

-Transcript that highlights courses completed.

-Reputation points (modeled after HN)

We see this as a crucial element to the future of education and believe that it will become significantly more important as education becomes increasingly open and free. We've posted on it here: [http://ocwconsortium.org/community/blog/2010/09/15/certifica...](http://ocwconsortium.org/community/blog/2010/09/15/certification- with-oer-considerations-and-examples/). You can also see a demo of our solution here: <http://www.youtube.com/watch?v=h7LbSnAG-5s>

</comment><comment><USER10> My impression with masters level coursework is that a lot of the benefit comes from the contacts and networking you can do during the process.

I have a friend who worked with blockbuster while he got a degree in journalism. A year after he finished his degree, he was a regional manager with the company, and being primed to move up again. He started small, and demonstrated a natural ability to handle employees, increase productivity, meet and exceed long-term goals, and otherwise improve the situation of anything he touched in the company.

Perhaps, if you really believe in the practical applicability of the mba coursework, you could try to get a lower-level job while you teach yourself the theory and constantly try to apply it to your position in order to demonstrate practical skill? Eventually you still might need the diploma on your wall, but at a certain point you might be able to get your employer to pay for part of it. I'm not sure how common that is, though

Just a few thoughts

</comment><comment><USER11> I don't know much about Financial Engineering, but most business fields value experience the most, with degrees being a way to get your foot in the door. Startups are much more flexible, and probably provide a better opportunity for someone who's self taught. I don't think you're going to get very far in GE or McKinsey with a Do It Yourself MBA.

If you're trying to get in on the startup scene, launching a business of some sort, even if it fails, will give you experience that other people will probably find valuable. If you've already been through the process of incorporating a business, dealing with lawyers and accountants, handling marketing on a small budget, etc, I'd think you'd be in pretty competitive position.

</comment><comment><USER12> As a corollary, can anyone list people have been successful without going through the normal establishment method of formal schooling and certification? It seems most of these people saying that education is in a state of revolution and how you can learn from OCW and other online resources instead of from Podunk U or Podunk HS haven't actually taken this path themselves...

<comment><USER13> I'll let you know when I'm done.

So far, as a high school drop-out I've figured out how to code, and I can say the years I have had in the field have given me a competitive edge on my peers. ( in terms of qualifications and hourly rate )

But I'm about as happy as an employee as I was being a student. I can do better for myself.

Still have some things I want to learn. I'm focused now on building my own business. As of late the web has become a great resource to learn about this. Things like the LAN startup movement and the recent surge in interest in the four steps to the epiphany have been wonderful.

I'll let you know how it goes when I'm done.

</comment></comment><comment><USER14> I think this misses some of the point of the exercise, which isn't necessarily to impress an employer with your excellent resume. There is nothing wrong with building a resume and working a job, but being autodidactic can open doors beyond the typical work-a-job strategy.

<comment><AUTHOR> Sorry, I suppose I should have clarified this more - I believe that learning is the goal in and of itself. However, when attempting to jump fields there is a very real barriers-to-entry problem caused by a lack of formal accreditation. I'm wondering how people can overcome that.

</comment></comment><comment><USER15> In many areas, there are exams you can take without needing to do an entire course.

I'd recommend this with a foreign language, or with something else that's easily testable. With an MBA? I second wybo's suggestion of blogging about it, or writing some related articles elsewhere.

</comment><comment><USER16> The same way you demonstrate knowledge gleaned from an institution, or anywhere, really.

<comment><USER17> I don't think a framed piece of paper that says "I graduated from The School of Me!" will get anyone anywhere.

</comment></comment><comment><USER18> Write a book and get solid reviews.

</comment><comment><USER19> "Become so good they can't ignore you."

etc. etc.

<comment><USER20> \-- Steve Martin.

</comment></comment><comment><USER21> I wouldn't be able to speak about MFE, but in my experience people with 'real' MBAs respect and admire anyone who has built a successful business of any kind or size. Many times the people doing the hiring at investment banks, money management firms, and management consulting firms look for that in lieu of having the actual degree.

I have a sneaking suspicion that deep down they know the degree itself is kind of bullshit anyway, and want to work with people who actually have run businesses.

The real question is - armed with the equivalent knowledge of an MBA of MFE, why would you want to work for a large firm? That problem is already solved - just go get a Masters.</comment>