Remote Code Execution on a Facebook server - <AUTHOR> https://blog.scrt.ch/2018/08/24/remote-code-execution-on-a-facebook-server/ <comment><USER2> Hey, developer of Sentry here. We're submitting a patch that prevents showing any settings on this DEBUG page.

I'd like to mention that we never suggest running Sentry in DEBUG mode, nor do we document how to do this. Sentry does use Django, so it's pretty easy to put pieces together and figure out how to do it.

So while we can help obfuscate this specific issue, running in DEBUG mode always has the potential to surface insecure information due to the nature of it.

Our patch to suppress this information entirely can be found here: [https://github.com/getsentry/sentry/pull/9516](https://github.com/getsentry/sentry/pull/9516)

</comment><comment><USER3> This is why you (looking at frameworks) should never use a format that may contain code to store data, especially when the client has control over that data (even if signed). The same vulnerability has occurred in almost every language/framework that does this, including Rails and Java-based ones. Just use something like JSON, which completely avoids code execution vulnerabilities like this. Except of course for the early JavaScript JSON parsers that just used eval for parsing...

<comment><USER4> Yes, Django realized this 7 years ago [0], and JSON has been the default for the past 5 years[1], it's just that facebook was using an old version of Django, and probably not the default.

[0] [https://groups.google.com/d/msg/django- developers/YwlZ9m9k1b...](https://groups.google.com/d/msg/django- developers/YwlZ9m9k1bE/P-bJqoatgH8J)

[1] [https://github.com/django/django/commit/b0ce6fe656873825271b...](https://github.com/django/django/commit/b0ce6fe656873825271bacb55e55474fc346c1c6)

<comment><USER5> Sentry still requires Django 1.6:

[https://github.com/getsentry/sentry/blob/ea8fe10d117f5325f9e...](https://github.com/getsentry/sentry/blob/ea8fe10d117f5325f9e457f4ca727c82c4d63557/requirements- base.txt#L14)

<comment><USER6> Whoa, really? Django 1.6 has been out of extended support since April 2015, if I read [https://www.djangoproject.com/download/](https://www.djangoproject.com/download/) correctly...

<comment><USER7> We maintain our own patches. We want to upgrade but because the migration framework we use does not support newer versions of Django finding a good upgrade path has been suboptional. It's likely we're going to just make the migration framework compatible with newer Djangos (work is under way).

</comment></comment></comment></comment></comment><comment><USER8> This is a great concrete example why you should never run debug mode on a public server. Django can only do so much for redacting private info. This is also a great example of how insecure pickle is!

<comment><USER9> I know this is going to get some jeering, but that's one nice thing about .Net's machine.config <deployment retail="true" />, you designate the machine itself as a non-development environment and tracing, debug output, and so on are disabled for all .Net/ASP.Net applications.

That might not work for all edge cases, but broadly there's a lot of machines which are only for non-development/production code, and a system-wide setting makes you a lot safer.

<comment><USER10> Just a thought. This might actually be trivial to implement in a unix environment from the administration side of things. I'm not 100% sure but all child processes inherit the env vars from the parent correct? So setting `environment=production` high up in the process tree should make it available to all processes.

There's still chances of this getting overridden down the line and all apps have to conform to one style but at least it's possible?

<comment><USER9> Absolutely. But none of the major players are looking for it, and they all have unique ways of designating the machine that way.

There's no specific technological challenges, this is entirely political, getting half a dozen or more different projects with different priorities to check the same variable for the same purpose.

</comment></comment></comment></comment><comment> cc-d Facebook joins Patreon in the "why somebody should make sure our python web framework debug mode isn't enabled in prod" club.

<comment><USER11> Patreon's screw-up was a lot more embarassing though - they apparently left an actual Python shell exposed to the web for at least a week _after_ someone warned them about it, and their entire user database was exfiltrated and posted on the net as a result.

<comment><USER12> Yep. Every company will face security issues; it's unavoidable. But what happened to Patreon should make people seriously question trusting them with your personal information or money. (They probably use a 3rd party payment processor who has much better security practices, but still. Also, that 3rd party doesn't do you much good if an attacker with control of your production web/application servers or CDNs is intercepting credit card form data before it's sent off.)

Facebook has had vulnerabilities and exposures, but nothing like that.

</comment></comment></comment><comment><USER13> Some surprising takeaways for me; Facebook uses a Django app in their infrastructure. That app was in debug mode, revealing server secrets. That app was also configured to use the Pickle based session storage, leading to one of the few serious RCE vulnerabilities in Django.

I'll have to remember this next time I think an exploit scenario is too unlikely.

<comment><USER14> Facebook runs the largest deployment of Django in the world -- Instagram.

[https://instagram-engineering.com/web-service-efficiency- at-...](https://instagram-engineering.com/web-service-efficiency-at-instagram- with-python-4976d078e366)

</comment></comment><comment><USER10> Nice job! I also really appreciate the lack of memes and very concise format of this blog post

<comment><USER15> Also the title. Clear and concise without being click-bait (such as Facebook RCE for fun and profit, all your Facebook belong to us, etc...)

<comment><USER16> Those kinds of titles are really tired, but clickbait is unfair. "X For Fun and Profit" can be found in g-files back to the late '80s, a time well before clicking.

[http://www.textfiles.com/phreak/](http://www.textfiles.com/phreak/)

<comment><USER17> The point is, "for fun and profit" is such an overused and utterly boring cliché. Meaningful titles are pleasant to read and shows that the writer has put some effort to bring clarity into what they're trying to convey. (As someone who sits on a major open source conference talk panel, I _cringe_ when I see one of these clichés slapped into the title without much thought. I politely suggest to rephrase to convey more "signal" in the title.)

<comment><USER16> I'm in absolute agreement. Nerd-culture has been on autopilot for decades and needs to find its next level.

<comment><USER18> This is a really interesting topic to me, because I've felt a pull toward things like this myself and seen it for decades. For example, the top of the README in my Zephyros project[1] was very playfully done, and very well received too.

People are naturally more lighthearted and organic than the sterile software and documentation we tend to write, and we're more social too, wanting to connect with others even if it means through a simple in-joke or catch phrase.

[1] [https://github.com/sdegutis/zephyros](https://github.com/sdegutis/zephyros)

<comment><USER17> I am not saying to not be human and take all the zest out of the writing.

FWIW, I suggest the book _On Writing Well_. William Zinsser has valuable advice on how we can still retain humanity in our writing without being dull and lackluster when dealing with dry and "sterile" topics like software.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> > _Quoting the Sentry documentation, system.secret-key is "a secret key used > for session signing. If this becomes compromised it's important to > regenerate it as otherwise its much easier to hijack user sessions."; wow, > it looks like it's a sort of Django SECRET-KEY override!_

One wonders why that is even there. Was Django's own session code not good enough?

<comment><USER7> `system.secret-key` is a value from the options system that gets propagated to different parts. It actually just sets the `SECRET_KEY` value in the settings file for all intends and purposes which has different consumers.

This abstraction exists because some options can be set from the admin UIO.

</comment></comment><comment><USER20> So, summarily we have:

1\. Enabling debug mode in production

2\. Running publicly-accessible app with publicly-accessible crash screens without any monitoring system noticing it's happening

3\. Relying on auto-cleaning in debug facilities to sanitize security information (never works)

4\. Using over-powered serialization protocol which allows for code execution for storing user-accessible data

5\. Thinking that merely signing content prevents abuse of (4)

Not bad.

<comment><USER21> Note that 5 is true though. Using a secret to sign or encrypt a cookie does normally work, and it's a common practice. Usually the impact of the secret leaking is that you can impersonate anyone, not that you can run arbitrary code, but the practice of using a session secret is common and not a bad practice nor broken inherently.

3 as well I think is unfair. That isn't something facebook implemented or is relying on; it's just the default behavior of django's debug stack. That's entirely on django to do that and lull people into a false sense of security in some cases (though it also probably helps in many cases too, so it might be okay).

The real issues are 1 (leaving debug mode on by accident), 2 (not noticing 1), and 4 (which is a django issue I think, not a facebook one).

<comment><USER20> > Using a secret to sign or encrypt a cookie does normally work

If the secret key is not compromised. So you have to ask yourself - why you send to the user some info that is so sensitive that needs signing? Why not just keep this info to yourself and send an opaque ID instead? Yes, I know there are issues with it too, but at least _this_ issue is not there.

> 3 as well I think is unfair. That isn't something facebook implemented

I didn't say it's Facebook fault - though ultimately, of course, it is as much as if you run certain software on your servers and do not configure it properly, it's your fault. So there's a fail in having security key in a place that's so easily accessible that debug mode dumps it without even asking. Not necessarily a direct Facebook fail, but a fail.

<comment><USER22> See JWT. You can make stateless apps easier without worrying about a trip to the database to grab session info

[https://12factor.net/disposability](https://12factor.net/disposability)

If you want disposability with the ID method you need some sort of datastore or cache to contain session info

</comment></comment></comment></comment><comment><USER23> This is a good example why you need regular pentests in big companies. Everyone (should) know that using pickle is insecure and everyone (should) know that django debug should be False in production. Still, if the numbers get large enough someone will miss something.

<comment><USER24> The use of Pickle isn't uncommon for session cookies in Python apps, from what I've seen. Pickle isn't really a problem unless you end up unserializing untrusted data... which a sign+encrypt scheme is supposed to ensure doesn't happen. You just can't leak the secret key or you're in trouble.

Though, there's no excuse for leaving Django debug on in production.

<comment><USER20> I'd say it's a bad idea anyway - why you need to trust the user with anything that needs pickle (as opposed to much more primitive format) to unserialize? If you ever have a reason for non-opaque-id cookies at all, it should be very simple. If you stuff very complex objects that require native serialization into user-side storage, it's probably bad idea regardless of security implications.

</comment></comment></comment><comment><USER25> Great article. Big frameworks like Django are nice to get an app started quickly, but if you use them long-term it really pays to study how they work under the hood, read some source code, etc. Although "don't run debug mode on production" is probably in the first page of the tutorial :)

</comment><comment><USER26> Congrats on the bounty payment! That has got to be one of the most concise blog posts too.

</comment><comment><USER27> The fact that the machine has a hostname "*.thefacebook.com" doesn't imply that it also runs software of the "Facebook" social media software. So not sure how much impact this exploit would have had.

<comment><USER28> I don't think anyone will ever know how much impact, but it implies that Facebook is not good at security.

<comment><USER29> No one talks about the working parts of security. Like, in this case, having the application on a separate box, and having that box separated by vlans from important things.

<comment><USER28> I don't think the solution is to put things you don't care about behind vlans and having applications on separate boxes. This box is/was an attack vector. It was holding secrets. Secrets provide other attack vectors.

<comment><USER29> It is - it is defense in depth. The application should be secure, and there should be steps to secure it. Especially because a secure application can protect a less secure network setup.

But on the other hand, the server or the network should not trust the application to be secure at all. The infrastructural setup should assume the application to be an <exec($_POST['do_me']);>. And that's why the application should be isolated on a system level, on a network level, and as much as possible. That's the good part I mean - the part that worked.

</comment></comment></comment></comment></comment><comment><USER30> He got $5k for an arbitrary remote execution bug? What a rip-off.

<comment><USER31> He should have gone to the black market, better yet sat on it. How long did it take Facebook to come forward with its user privacy violations?

<comment><USER32> What would you guess the going rate on the black market would be for an RCE on some error-log collection box that happens to be in use by Facebook? My guess is "less than $5000".

<comment><USER33> The only code they executed was "sleep(100)" If they started dumping env variables/snooping around they would have done a lot more than $5000 worth of damage.

<comment><USER34> How are you quantifying that?

</comment></comment></comment></comment></comment><comment><USER35> > scanning an IP range that belongs to Facebook (184.108.40.206/24)

ping -4 facebook.com

results in 188.8.131.52. Maybe, author used some other way to get those IPs. Can anyone throw a light on this?

<comment><USER36> Facebook, like many large internet companies, buys their IP blocks outright, so they show up under their AS number [0]. Facebook seems to have 3 AS numbers [1,2,3] and that IP appears in [3]

[0] [https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%...](https://en.wikipedia.org/wiki/Autonomous_system_%28Internet%29)

[1] [https://bgp.he.net/AS32934](https://bgp.he.net/AS32934)

[2] [https://bgp.he.net/AS63293](https://bgp.he.net/AS63293)

[3] [https://bgp.he.net/AS54115](https://bgp.he.net/AS54115)

</comment></comment><comment><USER37> Wow, a fix in <24 hours, that's pretty impressive.

<comment><USER38> I mean the fix is toggling a single environmental variable from True to False, on a system that isn't normally accessed by customers, so the risk is really small in rolling out the change.

<comment><USER39> Sometimes you're lucky if a company reads your report in this time but of course I would expect and we generally see much better from the likes of Facebook etc

<comment><USER38> You're right, being able to read, triage and act on something in such a massive system is quiet the accomplishment.

</comment></comment></comment></comment><comment><USER40> Great article...

One suggestion: You use "However" quite a bit. Not sure if you intended to show your thought process as it evolved, but that is the feeling I got.

</comment><comment><USER41> So they were pickeling EXECUTABLE objects in the session and storing it in the users browser cookie? Interesting. Nice find.

<comment><USER42> There is no such thing as non-executable pickle. Pickle is not safe and must not be used for anything, ever.

<comment><USER41> Wow. I have to look into it. That sounds wildy unsafe

</comment></comment></comment><comment><USER43> > Pickle is a Python module used to serialize data, but contrarily to JSON or > YAML, it allows to serialize objects properties but also methods. In most of > the cases, this is not a problem, but one can also serialize an object with > code in the __reduce__() method, which is called when the object is > unpickled.

Why does it run __reduce__?

<comment><USER44> if it exists, __reduce__ is run when pickling the object and returns code that will be run when unpickling. It allows to completely customize how the object is re-created on the other side, which might be needed e.g. when the type is defined in a native extension (at least the docs name this use case).

</comment></comment><comment><USER45> Other than fixing the Django source code , is there any OS level mitigation techniques that can detect and prevent such security vulnerabilities?

I am thinking something like selinux, docker or chroot - a bit like internal firewall for Django (or any other webapp).

Any suggestions on the links to latest best practices?

<comment><USER46> Of course. You can lock the process down so that it can't make unexpected system calls. If you deploy in a modern container environment, you can also use container networking to drastically limit what the application environment can talk to on the network. Though it's a less potent mitigation than seccomp and container isolation (and one you get for free once you deploy in a container), you can also limit filesystem access. If you run the application under a non-privileged uid, these mitigations combined can raise the bar somewhat for privilege escalation and pivoting after compromise.

Of course, in a sense, Facebook appears to have accomplished something simpler simply by sacrificing an instance to this application and putting it on a lonely isolated VLAN.

The other responses to your question are pretty weird, since it's obvious that there are things you can do to mitigate the possibility of your Django program literally calling execve or whatever.

<comment><USER47> > You can lock the process down so that it can't make unexpected system calls

Huh, this isn't something I've ever come across before.

Off the top of my head, I guess it would be possible on Windows using a kernel mode driver, but that's pretty hardcore, and really easy to get wrong.

I know you can easily _audit_ syscalls on Linux with auditd, but haven't seen preventing them before.

Is this an option on both Linux and Windows, and is it commonly used? Interested to know more!

<comment><USER46> The Google search you're looking for is [seccomp docker].

(Docker is the most typical way this gets deployed but not the only way.)

</comment></comment></comment></comment><comment><USER35> > I found a Sentry service hosted on 22.214.171.124

I do not remember on top of my head now but I think there are few scanning software to find all the running apps on a remote machine. If you are aware then please share

<comment><USER28> [https://builtwith.com/](https://builtwith.com/)

<comment><USER35> Shoot. It did not strike me. I thought it was good only for web apps and not in-background running processes like Pickle (a binary protocol )

</comment></comment></comment><comment><USER48> Great hunt!

</comment><comment><USER49> Great, concise article! But the real question is how much did they pay you for the bounty??

<comment><USER50> Article has a timeline specifying $5000.

</comment></comment><comment><USER51> I can get remote code execution on an Amazon Server (AWS). Do I get a cookie?

</comment><comment><USER52> So, this was simply taking advantage of a crash-prone webapp running on a debug-enabled Django instance using Pickle session serialization, and more specifically this was only possible because __Django didn 't redact the stored secret key used to sign serialized inputs out of the crashdump information!__

Did the author tell Django about this yet, or is this a (possibly unintentional) 0-day?

Besides the above interestingness, the morals of this story I get are

\- Stay persistent and leave your scanners running; you never know what new things will turn up.

\- Crashdumps _are_ interesting

\- Yay, $5,000!

\- Middleware and frameworks will always clash in useful and interesting ways?

<comment><USER53> Maybe I misunderstood the article, but I thought it said that Django _does_ strip this information, and the Sentry app went out of its way to store the secret key in the SENTRY_OPTIONS payload. This custom, non-Django code effectively circumvents Django's protections, making the bug the responsibility of Sentry, not Django.

<comment><USER52> Ah. You're right, I completely got this bit wrong. Thanks.

Wait, so that means Sentry kind of has a vulnerability.

<comment><USER7> Sentry does secure `DEBUG` mode. It's for development only and must not be set by customers. That said, we will try to make it less easy to set by accident: [https://github.com/getsentry/sentry/pull/9516](https://github.com/getsentry/sentry/pull/9516)

</comment></comment></comment></comment><comment><USER54> In contrast, I submitted a bad vulnerability in Facebook's password reset feature yesterday that lets attacker's send password reset PIN numbers to email addresses the user doesn't necessarily control. The security team said to works as designed so they're not going to fix it.

Basically if someone requests a password reset on your account then the PIN number gets sent to all email addresses associated with your account, not only the primary one. This is an issue because many people have one locked down email address for things like registering accounts, but others they use to talk with people, delegate to their staff, use with CRM apps, etc. (But you still need your everyday email addresses linked to your account so that people can find you by email, see your email on your profile, etc.)

The FB security team just says that delegating your email address isn't secure so it's not their problem. Like no shit, that's why it's a vulnerability. But for some reason the FB security team thinks it's a good idea to let anyone immediately bypass 2FA and hijack your account.

<comment><USER55> I tend to agree w/ the FB security team here. Don't list email addresses owned by an adversary in your account. :-/

<comment><USER54> > Don't list email addresses owned by an adversary in your account.

I mean if you're delegating your email address, your staff aren't adversaries. But they shouldn't be able to, say, drain all your retirement accounts either.

Just because I want people who search for firstname.lastname@example.com to be able to find my Facebook account doesn't mean I want password reset requests sent there. It wouldn't be at all unreasonable to send them there if that was explained in the UI, but just immediately sending a password reset pin to a non-primary email address without any warning is crazy. At least wait a few days if the user doesn't take any action after it's sent to their primary address.

<comment><USER56> Even if they changed it so that you could select where to send the password reset, rather than having it go by default to all accounts, that still means anyone with delegate access to the email address could go and request a reset on your behalf.

<comment><USER54> > that still means anyone with delegate access to the email address could go > and request a reset on your behalf.

That's how it should work. You shouldn't have to remember which email address you signed up with in order to request a password reset. But that's fine as long as the pin number only gets sent to an account that's locked down to a degree that's appropriate relative to the assets under protection.</comment></comment></comment></comment></comment>


Simple contact form generator in pure HTML - <AUTHOR> http://flipmail.co

<comment><USER2> I have a few friends with static sites that will LOVE this. It's hard to explain to them that they can't just "put" a form on their site, they need some sort of back-end code to "process" the form. This solves their problems, so good work.</comment>


Show HN: Video of Using the Sort-of-DIY Sit-Stand Treadmill Desk - <AUTHOR> http://peterarm.tumblr.com/post/37062008057/working-while-walking

<comment><AUTHOR> From the original discussion at <http://news.ycombinator.com/item?id=4860729> there were two questions I want to address:

1\. Is this a replacement for exercising or taking a break from work?

No! It is a replacement for me sitting on my ass when I do work. Exercise and taking breaks are good things and I should do more of both!

2\. Surely you can't type reliably?

My wife took this video on my phone, to show that I can type and mouse reasonably comfortably. (No, I don't usually have five Emacs buffers filled with Hipster Ipsum text; this is a stand-in for actual code.)

Finally, note that there is a video of me transforming the desk to sitting here, so you see how easy it is: [http://peterarm.tumblr.com/post/37062068688/transform-to- sit...](http://peterarm.tumblr.com/post/37062068688/transform-to-sitting)</comment>


Ask HN:Finding a Break - <AUTHOR>

Hi, I've been looking to get into programming (as a job) for a while now. I even moved abroad to pursue this idea, but that didn't turn out so good. I am...ancient. 26 in April.
I have set up www.freecoder.co.uk to attract some attention. Basically, I have discovered I lack intellectual self confidence (rightly or wrongly) so short of hacking my mind I would really like to work with a bunch of smart people for free for 3/6/9/12 months and just see how it goes.
I have considered working in open source, but would prefer to have people physically around.
Am I completely barking to even attempt this?
Everyday is filled with self doubt. <comment><USER2> I have been an ER/Critical Care nurse for the past 15 years. I went to nursing school right out of high school, because it was "a good steady job and you can help people." I administered narcotics to a patient before I could drink legally.

I had always wanted to be an engineer, but I believed people that told me I wasn't smart enough.

I remember writing QBasic when I was 9 years old. I begged my father for a modem for our computer for two full years. And, finally, when I was 14, he got me a 2400 baud Hayes smartmodem. After weeks of mucking about with the configuration and connection settings, I was at long last able to connect to my first BBS. I thought I was in heaven.

I mucked around a bit on that BBS for an hour or so, only to have my father try and make a phone call while the modem was connected. That's when it all came crashing down. He was furious and forbade me from ever using the modem again. I still don't know why it upset him so much. I think it had something to do with the movie War Games that had come out a few years earlier. I think Dad was scared I was going to hack into NORAD or something.

So, for years, I gave up on computers. I'd day-dream about being an engineer, only to have people around me tell me I'd regret it, that I would hate it, that I was too much of a "people person" and that my life would be a complete waste if I spent it in front of a computer screen.

But, when I was 30, I finally decided to get back in touch with my inner geek. I went back to school two classes a semester for 5 years. My work schedule as a nurse constantly changed from nights, to days, to evenings, to weekends, which forced me to go to school online. I kept plugging away at it and after 5 long years, I finished the engineering program at the University of Maryland this past May. I still have some General Ed. credits to take, but I finally finished the classes I'd need for their CMIS/software engineering degree.

This June I started to pick up web development and Django. For several months, I thought I really sucked at, and I thought it all might have been a huge mistake, because I could never get things to work right with Django. It wasn't until 3 months later, when I went to DjangoCon, that I learned that the release of Django that I had been working with for 3 months had been broken in the lead-up to the 1.0 release.

Eight weeks ago, I cut down to part-time at work, so I could focus on boot- strapping startups. If all goes well, I plan to release my first web app in a couple of weeks. My plan is to keep bootstrapping startup after startup until something takes off.

It's been a long, hard road, and I still have a long, long way to go and a lot to learn. I've thought many times that I wasn't smart enough, or too old. Things never really go according to plan. I get discouraged and frustrated a bunch. But, the only thing that can really stop me from chasing my dreams is my deciding to give them up for dead.

<comment><AUTHOR> Definite kudos to you. Thank you for posting. suerte.

<comment><USER2> Gracias. Y a ti tambien.

</comment></comment></comment><comment><USER3> Don't be afraid to ask for money. Money often means respect and with respect comes self-confidence. If you are free, it means that you consider yourself so bad at programming that people will not even consider you. You'll learn nothing. You'll always be the "free guys" that everyone will laugh at. The one that gets to debug stupid things or have to work on impossible projects. If you don't need that money, give it to a charity but please, ask for money.

<comment><USER4> To add to this, remember people want your services. They want to feel warm and fuzzy when they finally pay you and their product is working exactly how they imagined (or how they require). If they never pay you, they will take a long time to be satisfied.

<comment><USER5> Yeah, people usually want to pay for services they think are valuable. Right now, I'm getting tutoring in one of my classes. My tutor was nice enough to offer to do it for free, but I definitely wanted to pay him. He was doing something for me that I considered valuable, and even though I'm a college student who does not have a whole lot of money, I wanted to compensate him for the tutoring.

</comment></comment></comment><comment><USER6> You should look for small web development firms that might offer internships. Right now I'm doing an unpaid internship. I don't have a car and the place is 10 miles away, so everyday I take the bus for 5 miles, bike the other 5 miles, then do the same thing coming home. It's a ton of work for an unpaid job. The work is stressful. But I'm learning the best practices of coding, how to scale applications accordingly, and my work actually benefits the company. This has been such an ideal opportunity, because before coding was just a hobby and so I hadn't been challenged. But now that I've found a good community of programmers and designers, I learn new lessons everyday and build up confidence in my skills.

</comment><comment><USER7> A spoonful of medicine to help overcome self-doubt here => <http://ub0.cc/0l/12> and here => <http://ub0.cc/4J/1j>

<comment><USER8> Amazing. Instantly reminded me of Dean Kamen's robotic arm.

<http://blog.wired.com/gadgets/2008/05/dean-kamens-rob.html>

</comment></comment><comment><USER9> Don't work for free.

Try finding a smaller software company (like under 10 people, perhaps a startup) and working for them in any capacity they need people. Running ad campaigns, managing forums, tech support, whatever. Once you have a job with the company, you can then start helping out with programming to whatever degree you are able.

</comment><comment><USER10> WOW, you are selling yourself WAY short.

You are more than qualified for an entry level developer job FOR PAY.

Its a programmers market out there, if you can communicate half decently and have a java cert from sun, you will be able to find a job no problem. Just delete that webpage and keep sending resumes out.

</comment><comment><USER11> Hmm, I'll be 27 in a few months.. And I thought I was stil young!

Geez, now I think I'm old too..

<comment><AUTHOR> oops. sorry if my anxiety has proven infectious... The panic started to set in when I realised I was rounding up to 30 and not rounding down to 20... Thanks to everyone for their comments.

<comment><USER12> I can still round down to 20.... Thank god. I will be rounding up though this year..

Can you guess how old I am. lol

</comment></comment></comment><comment><USER13> Yeah, working in close physical proximity to quality people is hard to beat, but you can learn a _lot_ even working remotely on a pre-existing project. So go scratch an open source itch.

Also there ain't no such thing as a free lunch^Wprogrammer.

</comment><comment><USER14> I like your idea, I cant help you per se but if it helps your selfdoubt then I think you will do fine, based on your courage to try such an unconventional path. And whatever you do, keep learning on your own time ... that never gets old!

<comment><AUTHOR> Thanks for your support. I think the continual learning point is particularly pertinent.

</comment></comment><comment><USER12> I will hire you for free.

Ill give you experience to work in the real world and work with you.

A few months down the road after the projects we have worked on together start making money, you will then become a paid programmer.

If this is a serious inquiry, get in contact with me. We can work something out. I only work in asp.net and C# and will accept vb.net so you have to want to learn...

I am a one man team with the help of one other guy working on a few websites ideas I have.

</comment><comment><USER15> Self doubt is healthy.

Getting depressed and/or discouraged because of self doubt is not.

And your situation is by no means unique. It is VERY hard to catch your first break as a professional programmer.

That is just how the industry is, the best way to get around that, is to do what you're doing.

You don't HAVE to work for free but if there's no other way it's OK.

Work, produce code, make it open source, bring a sample of of your code to your next interview.

</comment><comment><USER16> Maybe you should try working on some open source projects and or your own projects while working in a shared space with other programmers, allowing you to bounce ideas off them.

<http://en.wikipedia.org/wiki/Coworking>

</comment><comment><USER17> if you want to work for free...why not find something simple and do a startup around that? Then release more and more apps as you learn more skills

</comment><comment><USER18> I am willing to hire any and all free coders.

<comment><USER19> It'll be worth every penny.

</comment></comment><comment><USER20> I got my first paid programming job at 25. I've never found age to be a problem.</comment>


Overview of reactive programming - <AUTHOR> http://blog.hackhands.com/overview-of-reactive-programming/

<comment><USER2> After watching the video, I've got more questions than I did before watching the video. This concept of reactive programming seems like something that would have already been thought of; not only that, but it also seems like it'd be extremely difficult to implement, with little benefit. How is something like this implemented? How would it be implemented relative to the language it's written in? Or can it really only be implemented well in certain languages?

<comment><USER3> I think one of the most important points of Reactive Programming Jafar brings up is that data can be pushed to a consumer and operated on when it is ready, instead of being stored and then fetched by a consumer later. This is important when you are trying to process real-time transactions and analytics; so you can keep data "moving" through its transformation process instead of "pooling" data in different stores (storage is a common point of back- pressure).

Also, as the producer now controls the workflow, the it can determine when to "dial-up/down" resources based on what its latency looks like; as well as better handle supervision of consumers -- if fault-tolerance is your thing ;)

Regarding the concept of Reactive Programming; it is not necessarily new, but more tooling is coming out that makes it easier to build in the general sense. Erlang with OTP has been commonly used in the past; Scala/Akka is becoming quite popular now along with GoLang paired with a queueing system such as 0MQ. In fact using Java with a JMS system such as HornetQ can be quite effective as well.

At the end of the day, think about having work being passed on to someone who can do it when it is ready, instead of placing work on someones desk and waiting for it to be done. With the former example, if no one were available to do the work when it is ready, being able to take an action right then and there (e.g. spin up a new node/actor/goroutine, etc.) when you know you need to can help reduce latency.

Hope that helps.

<comment><USER2> This makes more sense; to me, it just seems like it's not something that's a big discovery in the field of programming; it just seems like a specific paradigm for programming, and not something worthy of note. Maybe I'm still not understanding it well.

Edit: After looking at the other comment, I can see that it is a big paradigm shift. My bad.</comment></comment></comment>


Flixster Uses Message Bots To Trick Their Users into Logging In - <AUTHOR> http://www.flixster.com/friends.do?displayComments=&friendsUserId=549716000 <comment><USER2> That's evil. Why don't the founders use their profiles with a bot. At least that way new users know there is a busy, real person behind the canned message.

</comment><comment><USER3> Pretty funny. Either someone did that on purpose to make it seem like Flixster uses bots or the coder is lazy, probably underpaid too.

<comment><AUTHOR> Small team. I'm pretty sure its an official bot. My account got the same thing. It's no secret that they're "aggressive" in their marketing. I think they've crossed over into doing evil though.

</comment></comment><comment><USER4> The least they could have done was to code a better Bot.</comment>


Google's Schmidt: NSA Spying on Data Centers 'Outrageous' - <AUTHOR> http://blogs.wsj.com/digits/2013/11/04/googles-schmidt-on-nsa-china-and-north-korea/ <comment><USER2> I have trouble sympathising with Schmidt when he's earlier said that Internet privacy is an illusion, even though he's suffered from intrusive reporting.

[http://news.cnet.com/8301-13860_3-10413473-56.html](http://news.cnet.com/8301-13860_3-10413473-56.html)

> _" If you have something that you don't want anyone to know, maybe you > shouldn't be doing it in the first place."_

[https://www.eff.org/deeplinks/2009/12/google-ceo-eric- schmid...](https://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmidt- dismisses-privacy)

> Unfortunately, Schmidt's statement makes it seem as if Google, a company > that claims to care about privacy, is not even concerned enough to > understand basic lessons about privacy and why it's important on so many > levels -- from protection against shallow embarrassments to the preservation > of freedom and human rights.

> Gawker was quick to point out the personal hypocrisy of Schmidt's dismissive > stance, noting that for about a year, Schmidt blacklisted CNET reporters > from Google after the tech news company published an article with > information about his salary, neighborhood, hobbies, and political donations > -- all obtained from Google searches. Techdirt noted additionally that > Schmidt's statement is painfully similar to the tired adage of pro- > surveillance advocates that incorrectly presume that privacy's only function > is to obscure lawbreaking: "If you've done nothing wrong, you've got nothing > to worry about."

<comment><USER3> Of course that has absolutely nothing to do with the issue at hand (what on earth does sympathy have to do with it, especially for Eric Schmidt? _it 's user data_ the NSA is copying)

Meanwhile, I'll point out once again the rest of what he said, in which he warned everyone of the dangers of cloud computing due to the powers enabled by the Patriot Act. But no, no one wanted to talk about that. Too easy to go for the sound bite.

> _Q: "People are treating Google like their most trusted friend. Should they > be?"_

> Schmidt: _" I think judgment matters. If you have something that you don't > want anyone to know, maybe you shouldn't be doing it in the first place. But > if you really need that kind of privacy, the reality is that search engines, > including Google, do retain this information for some time. And it's > important, for example, that we are all subject in the United States to the > Patriot Act. It is possible that information could be made available to the > authorities."_

<comment><USER2> He made a business out of making user data easy to grep, in order to serve ads.

I guess when he started he (along with everyone else) didn't think the NSA would be quite so blatantly illegally slurping data. There's a big difference between having to hand over data because a judge has approved a valid legal request, vs having a weird secret court forcing a black box onto your network.

But still, Google is chock full of smart people and if any company is able to sort out easier encryption it's Google, and they haven't done that. (Although I accept what tptacek says here [https://news.ycombinator.com/item?id=6641483](https://news.ycombinator.com/item?id=6641483) )

<comment><USER4> the problem is, as far as anyone with the power to do anything about it is concerned, what the NSA did was completely legal. They also claim the power to not explain to us why it's legal. Or to explain the rules by which they decide what is legal. But the end result is the same: they have effectively proven that voting is a waste of time.

</comment></comment></comment></comment><comment><USER5> I remember that report (one of the earlier ones) that said that Google hosts hardware provided by the NSA.

So his outrage is even more hypocritical than the EU's leaders'.

Also, if he was really "outraged", he'd band together with the other tech giants and actively and visibly fight the NSA:

If somebody has the power and reach to get the public behind a cause, it's the tech giants. As long as they don't fight the NSA and do it in a manner that's transparent for the public and honest, I call:

Pure PR bullshit as usual.

<comment><USER6> > I remember that report (one of the earlier ones) that said that Google hosts > hardware provided by the NSA

Any link for that?

<comment><USER5> I read it in another Guardian article at the time, but: [http://www.theguardian.com/world/interactive/2013/nov/01/pri...](http://www.theguardian.com/world/interactive/2013/nov/01/prism- slides-nsa-document) slide #3:

"Collection directly from the servers of these US Service Providers: Microsoft, Google, Yahoo, Facebook, PalTalk, AOL, Skype, Youtube, Apple."

"directly from the servers of these US Service Providers" means " _with help from_ these US Service Providers"

<comment><USER7> Or, it means they tapped the lines between servers.

This assertion of meaning without evidence is a waste of time. Please make sure to replace "means" with "causes me to think" in the future.

</comment></comment></comment></comment><comment><USER8> What strikes me is that this time, Microsoft seems to not be mentioned in relation to this type of spying. Just Yahoo and Google. I can't imagine NSA finding Microsoft datacenter traffic less interesting. Does Microsoft have better encryption between data centers?

<comment><USER9> I bet Microsoft is just much more cooperative with the government so they don't need to do that kind of spying.

</comment></comment><comment><USER10> Too bad he isn't in charge any more. Been downhill for Google since he left the position ...

</comment><comment><USER11> Did Google lose business over the fiber spying? Their reaction is similar in its hypocrisy to German chancellor Merkel.

</comment><comment><USER12> I got the impression that Schmidt was the most privacy-concerned guy in the Google management triumvirate, reading Steven Levy's Google book. So his thoughts might not be an accurate reflection on how the company will react.</comment>


Show Me the Data: Using Graphics for Exploratory Data Analysis - <AUTHOR> http://www.insightdatascience.com/blog/eda-and-graphics-eli-bressert.html

<comment><USER2> They linked to the Anscombe's code, but I wish they also linked to the code that produced the rest of the analysis. Looks cool and I wish I could run it myself!</comment>


South Korean law to punish boosters passes in the National Assembly - <AUTHOR> https://dotesports.com/overwatch/news/south-korean-law-to-punish-boosters-passes-in-the-national-assembly <comment><USER2> Having not done much gaming in the last 5 years or so, and never having been particularly competitive, I'm wondering if someone might be able to give a description of what 'boosting' is, and how it benefits a player? My point of reference is something like having a friend grinding away on Starcraft for you until your profile achieves a certain status in the ladder. Ultimately wouldn't that all be for little if you then play consistently against much better players than you, and lose continually until your profile reaches equilibrium again?

<comment><USER3> > I'm wondering if someone might be able to give a description of what > 'boosting' is, and how it benefits a player?

Bragging rights as far as I can tell.

There are a few games where boosting helps (helped?) you gain higher tier items. In WoW TBC my team would sell spots on our teams. The buyer would stand around in a corner while my 2s/3s partner and I would play 2v3 win maybe 8-9 out of 10 games, and the buyer would then be rewarded with in-game currency used to buy items they wouldn't be able to get on their own. Eventually Blizzard patched the game and changed the rules so that it was not possible to boost without account sharing, so we stopped.

But, as far as I can tell that's usually an exceptional situation, and most of the time it's exactly what you describe - bragging rights that would quickly disappear if you tried to play on your own, because you'd tank your rating.

<comment><USER4> to follow up, while blizzard has "cracked" down on real money exchanges a few favored guilds can still pull it off. the method is to charge a large amount of gold in game. this of course if paid out in gold bought from blizzard nets them a lot of real money so it benefits the company.

example, recent highest difficulty full carries, where your character basically just dies at the start of each encounter so you don't screw up the mechanics, was going for more than ten million gold. With blizzard tokens returning about 110k/200k US/EU in gold that adds up unless the player has amassed that. There are end runs on the in game gold with very scripted in game conversations and money exchanged outside of game.

usually the reward is better gear but many do it for the achievements; these have become a cancer in my opinion in the gaming world; to special items like mounts and titles only obtainable to those who can do the content and do it in a timely manner.

<comment><USER3> Oh to be clear, we only ever did this for arenas, and only charged in-game gold. But even that became impossible when they changed the ranking system. I never did anything but arenas so I can't comment on pulling someone through raids.

We couldn't pull anyone past top 5% or so 2v3, so mounts were infeasible.

I totally believe that a lot of people would be doing that for real money though.

</comment></comment></comment></comment><comment><USER5> The South Korean government's obessession with regulating video games is quite interesting.

<comment><USER6> I have heard some complaints about South Korea being a geritocracy - even by the standards of the US. I don't know the fine details but that sounds consistent with some of the other stuff like the porn ban. If they really are being run by a bunch of old men. I don't know nearly enough about the culture or context to know how true or widespread the perception is but it does sound consistent.

<comment><USER7> > South Korea being a geritocracy

Isn't that the case of most countries, at least in the West? If you look at the median age of most public officials (ministers and all), they are usually more likely to be in their 50,60s and 70s in some cases.

<comment><USER8> There is old in age and old in customs, opinions and close-mindness.

</comment></comment></comment></comment><comment><USER9> Url changed from [https://www.polygon.com/2018/12/9/18133391/south-korea- boost...](https://www.polygon.com/2018/12/9/18133391/south-korea-boosting- esports-league-of-legends-law), which points to this.

</comment><comment><USER10> So does this make selling accounts illegal too? Isn't the workaround simply to not play on someone elses account, but to play on your own account and then sell it to that person later?

<comment><USER3> In SK your game account is usually tied to your national ID, no?

<comment><USER11> How dystopian. Why would anyone accept such a restriction?

<comment><USER12> Because there is real money at stake? Athletes in other sports compete under their real identity (and presumably have to prove it at some point in their career) after all.

<comment><USER13> I can think of no other country that says "license and registration, please" before playing a game or sport of any sort. South Korea is undeniably dystopian and backwards in this situation.

</comment></comment></comment></comment></comment><comment><USER14> If it is a game that permits players playing as proxies, won't this just be outsourced to Cambodia with this law? These proxy players don't have to come into your house to do this, afterall.

<comment><USER15> Maybe but boosting requires real talent, and the vast majority of the players good enough to do this are in SK.

</comment></comment><comment><USER16> Good things die soon or live long enough to be ruined by nosy lawmakers.

</comment><comment><USER17> Everone knows that they really should have banned camping instead.

</comment><comment><USER18> when i was a kid, i thought the stuff about freedom in rhetoric about america was silly and nebulous, but as i get older it seems more true. don't get me wrong, i hate the surveillance panopticon, drug war, and permanent security state as much as anyone else, but at least the government doesn't put you in jail for cheating at video games.

<comment><USER19> From where I live (not in the US) the US doesn't look particularly good as far as civil liberties go. Not that my country (Australia) is great either. We're just messed up in different ways.

<comment><USER20> None of the countries look particularly good, because we're on a backwards trend globally. But US still looks better than pretty much everybody else.

<comment><USER20> People who disagree with this should bear in mind the context from the parent comment - we're talking about _civil rights_ specifically, not whether one country is better than another in general. I don't think there's much room for debate on whether US has the most expansive freedom of speech protections, for example. Many people would argue that it doesn't do a good job of balancing those rights with other matters of importance, but that is a different conversation.

</comment></comment></comment></comment><comment><USER21> Off-topic question: What output does deleting the "I'm OK with being tracked" node give the site? The only possible answer here is "Yes", so does deletion mean null? But whatever, the site is usable after that, so hey.

<comment><USER22> The newspeak/doublespeak for cookies is such that placing users under surveillance without prior consent is fine, you just have to tell them after you start doing it. And after you tell them, you can just keep doing it, and they can leave if they have a problem with it. No one ever has to stop tracking anyone else, even if people ask nicely or tell you they aren't okay with it. The only option is to close the window, clear cache and never come back.

Meanwhile, this has given way to lots of "dialogues" where the dictatorship asks you to mark a check box for how you feel about being tracked, which is of course tracked. The deception being that even when you reply "NOT OK" there is no real effect. The pixels are there. The cookie is there. You are on camera, being recorded for QA purposes. This call will be reviewed for training purposes.

This differs from opting out of mailing lists, where they stop emailing you. Opting to respond with disdain for tracking does nothing to change whether you get watched.

<comment><USER21> Yes, I get that.

But I am curious about what shows up in their log.

I'd love to send "fuck no", but have no clue how one might do that. And I'm guessing that "yes" is the only possible value.

<comment><USER23> Joke's on you. That widget never gets logged. It's a placebo.

More likely, duration of stay, IP and cookies cross-referenced from other sources are the only things they look at.

Instead of recording your response as to whether you enjoy getting kneecapped, they just let you scream into a sound-proofed vacuum. But hey, at least you're not bound and gagged.

<comment><USER21> Hey, thanks.

I did look at the code, but over my head.

<comment><USER23> Vote with your feet. The longer you stay, and the deeper in you click (url to url), the more implicit your assent.

<comment><USER21> Well, only my Mirimir persona uses this VM, with this VPN chain and exit IP. And I have Firefox delete all cookies at exit. So they don't get much from me, no matter what.

<comment><AUTHOR> Any advice on economical methods for persona-specific VM chains? E.g. 5 personas times $X/month for a commercial VPN adds up quickly, not to mention the inconsistent reliability/transparency of VPN providers.

<comment><USER21> I use pfSense VMs as VPN gateways, so VPN chains are virtual networks. But you could do the same thing with physical routers. Given that most providers allow multiple connections, you just need a few accounts.

Let's say that you have accounts with two providers, VPNA and VPNB. So you always connect first to a VPNA server, and then through that to a VPNB server. Given that each provider likely has many servers, there are likely hundreds of possible chains. Not all of them will work well, for whatever reasons, but enough to be useful.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment> time-domain0 I don't understand: is this paying or convincing other higher ranked to help a lower ranked player?

What action(s) is/are specifically outlawed?

Assuming there's direct evidence, how would this be legally-enforced?

What's the recourse for lower-ranked players who are kicked out based on this law but didn't do anything for gain, say a spouse who was invited to participate for social reasons but doesn't play very often?

Do we really need a law?</comment>


I've started posting interesting domain names that I find - <AUTHOR> http://allyournames.com

<comment><USER2> How are you finding these?</comment>


Does the MySQL Fulltext Index Scale? - <AUTHOR> http://epsilondelta.net/2006/05/05/does-the-mysql-fulltext-index-scale/ <comment><USER2> We're looking at Solr where I'm working. It seems pretty nice as it gives you all the 'extras' to make Lucene that much more attractive.

</comment><comment><USER3> Craigslist uses MySQL FULLTEXT indexing, so it definitely "scales". For all my big-time searching needs I use Xapian.</comment>


How Astrid Lindgren was forced to pay a tax of 102% of her income - <AUTHOR> http://everestlancaster.wordpress.com/2009/06/02/pomperipossa-in-monismania/

<comment><USER2> What does a poorly-translated fable about Swedish tax policy in 1976 have to do with HN today?</comment>


Ask HN: Why doesn't YC build a web browser? - <AUTHOR> The world needs one. To keep the internet alive. Now that Microsoft has given up, a company with reliable income, access to good devs, and a long-term interest in the open web should come along and do this.<p>And Firefox is slooow. (For me, anyway.) <comment><USER2> YC doesn't take on many large technical projects itself, but would be happy to fund a startup to build a better browser if there's a sustainable business model.

The problem I want a browser to solve: I don't mind paying for content, but logging in to paywalls is a hassle. Ideally I want the Spotify model, where I get all the content for a flat monthly fee that gets apportioned among all my content sources. Brave seems to have ambitions in this direction (and it's my current main browser) but they don't have enough deals yet.

</comment><comment><USER3> Forgive my ignorance, I may not understand what the problem is, but I was under the impression there are numerous browsers, chrome, firefox, brave, etc

Why does the world need another one?

</comment><comment><USER4> Implementing a full featured web page renderer is a massive task. Correctly handling HTML and CSS and JavaScript and Canvas and animations and etc, etc, etc...

Then test is against the top 1,000 websites and ensure that yours renders the same as the popular existing browsers, otherwise people will complain and stop using yours because it is different. Then maintain it as new standards constantly evolve over time.

Finally your will have a codebase that you cannot sell because browsers are free! Even Microsoft have given up and Microsoft Edge is going to switch from their own renderer to using the open source one from Chrome.

</comment><comment><USER5> > _a company with reliable income, access to good devs, and a long-term > interest in the open web should come along and do this_

That sounds like a nonprofit. In fact, it perfectly describes Mozilla.

</comment><comment><USER6> Until/unless you find what you're seeking, check out The Classic Browser ([http://theclassictools.com/](http://theclassictools.com/)). I just found out about it today and it's fast.

</comment><comment><USER7> Why don't you apply to YC with the idea?</comment>


History of Lisp Editing - <AUTHOR> https://github.com/shaunlebron/history-of-lisp-editing <comment><USER2> Took another try for discussion to get started - find it here: [https://news.ycombinator.com/item?id=14641658](https://news.ycombinator.com/item?id=14641658).</comment>


When James Baldwin wrote about the Atlanta child murders - <AUTHOR> https://www.newyorker.com/books/second-read/when-james-baldwin-wrote-about-the-atlanta-child-murders <comment><USER2> I didn't know JB wrote a book about this! His prose is def in my top 5. Groundbreaking for the time. This article mentions him as a "big name" but I'd argue he should have been more famous

<comment><USER3> Here's the review of the book from 1985:

[https://www.chicagotribune.com/news/ct- xpm-1985-10-20-850311...](https://www.chicagotribune.com/news/ct- xpm-1985-10-20-8503110680-story.html)

</comment></comment><comment><USER4> Baldwin was really a fascinating person. He traveled quite a bit around Europe, too, and wrote some of his most known work in Istanbul, which I always found an interesting juxtaposition to the way he is usually portrayed. I agree with his thought that's it's easier to view America from the outside. IIRC Fitzgerald wrote most of Gatsby while in France, which seems to confirm the idea. It's a shame Baldwin isn't more well-known.

[https://www.theguideistanbul.com/james- baldwin/](https://www.theguideistanbul.com/james-baldwin/)

<comment><USER5> It has also been my experience that it's easier to view America from the outside. Though I find this excruciatingly painful to convey to folks that I know who have never lived any where else.

<comment><USER6> I've found this holds true for me as well. My entire view of America shift after I spent only a _semester_ abroad in Ireland, and it was all from being able to sit back and view it from a distance.

I've also found that this holds true for smaller levels as well. My hometown is fairly rural and in a high poverty county, yet people don't want any better. Since I moved out, I realized that's because it's all they've ever known; they don't really realize there is a difference than living there, doing the same things as adults they did as high schoolers, etc. It's just a vicious cycle, as that mindset gets passed on to their kids as well, and fosters quite a bit of anti-intellectualism in the mix (which I see as a teacher there now, though I don't live there).

</comment></comment></comment><comment><USER7> Same case featured in season 2 of Mindhunters on Netflix.

<comment><USER8> I was incredibly disappointed they didn't film in Atlanta. Though most of the season takes place in the Atlanta metro, it's very obviously filmed elsewhere. None of the filming locations actually resemble Atlanta. As an Atlanta resident, I found it uncanny and jarring.

It's doubly strange considering Atlanta has generous film subsidies and tax breaks, making it one of the nation's top filming locations. They might have saved money shooting here. Stranger Things and a host of other Netflix shows are based here.

I don't normally nitpick about something like this, but it frequently took me out of the story.

<comment><USER9> Several people who worked on the show are on the Pennsylvania Film Industry Association Board, and it was filmed in and around Pittsburgh. Maybe that had something to do with it.

That said I believe I read an article suggesting that Netflix plans to not film in Atlanta because of a variety of conservative laws passed in the state of Georgia. That was post the 2018 filming of Mindhunter season 2, but it may affect future shows and films.

<comment><USER8> All the production companies threatened to leave, which we all thought was paradoxical. Why pull blue votes out of a nearly purple state? Don't concentrate the blue.

Georgia courts overthrew the heartbeat bill, as was predicted. The executive branch is shopping around for a district to pass an abortion law, fight it in court, then elevate it to the supreme court. That should terrify everyone. They think they can win at the highest court.

Before covid-19, there were over 30 big ongoing productions. Netflix, Disney, HBO, and Amazon all have major shows filming here:

[https://www.11alive.com/mobile/article/entertainment/televis...](https://www.11alive.com/mobile/article/entertainment/television/programs/the- a-scene/what-tv-shows-and-movies-are-currently-filming-in- georgia/85-926ce138-f763-453c-a446-3715ad81c527)

<comment><USER10> > That should terrify everyone

No, some of us on HN are adamantly against abortion. I'm far left on almost every issue except that one.

<comment><USER11> I don't share your opinion, but thanks for listing it (please do so wherever you can). The left need to remember people like you exist.

<comment><USER12> People often express that left should remember right, be nice and understanding to them. The opposite expectation is rarely stated.

It is kind of interesting.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> For anyone interested in learning more about Baldwin, _I Am Not Your Negro_ is a documentary about him that was nominated for an oscar back in 2017.

</comment><comment><USER14> One of my favourite quotes from The Evidence of Things Not Seen:

"The dream of safety can reach culmination or climax only in the nightmare orgasm of genocide."

There's a preamble to it, but it's an incredibly powerful idea to me. We live in a radically unsafe universe and our death is inevitable. Safety is a delusion.</comment>


Discussing censorship on HackerNews does not make sense - <AUTHOR> HackerNews is not the right place to have conversations about censorship, such as this one, presently the top post: https://news.ycombinator.com/item?id=9716783.
Free speech is not allowed here - it is strictly censored and the moderators follow a policy that is their own preference. This place is about as far away from allowing free speech as you can get. It is, quite frankly, closer to the curated North Korea than to the wild west that is the USA. And that's a fact.
The links are good though, we can all agree on that.
Also: It is sensical to discuss censorship here, as long as we are discussing the way this place is censored. <comment><USER2> It's hard to answer such a generic charge. I could say "no we don't", but that's not much better than "nuh uh". If you'd like a substantive answer, we'd need to see links to specific posts that led you to this view.

I'm glad you like the stories at least!

</comment><comment><USER3> Only people who think and express themselves within HN's borg-like ideological parameters can coexist here. If you say or believe something not in harmony with The Borg, you'll soon be talking to yourself only.

I fully expect to be hellbanned (or downvoted into oblivion and then hellbanned) for expressing this view.

<comment><USER2> It's a measure of how false your first paragraph is that I can't guess which way your imaginary Borg leans. We see roughly the same number of comments denouncing HN for being libertarian as socialist. As far as I can tell, most HN users are neither of those; rather these perceptions are distorted by what one might call ideological enemy bias.

<comment><USER3> There is a culture-fit that HN users must measure up to. If they don't, they are gone.

Just admit it: HN is a clique. An exclusive club of like-minded people. Outsiders and people who don't agree with you are out.

<comment><USER2> I certainly wouldn't put it that way. But since you sound sure, I'll ask the same of you as the OP: please provide links to specific posts that convinced you of this view. From my point of view it's hard to imagine what those would look like. But perhaps I'm missing something important.

HN doesn't seem to me to consist of like-minded people. If it did, I wouldn't have to spend so much time asking users not to berate each other.

<comment><USER3> Hey, as long as people agree with you and don't stray outside the HN filter bubble, they'll be fine. I'm sure about that.

</comment></comment></comment></comment></comment><comment> anti-shill great links...but as for what you mentioned...no comment</comment>


Ask HN: Have any of you left a startup that was selling snake oil? - <AUTHOR> Hi all,
I am in an interesting situation. I thought I'd ask you all to see how you've handled similar situations.
A few months ago, I joined an 'AI' start-up. Most of my experience lined up well with the company vision, and I thought 'why not?'. They gave me what I was looking for in terms of salary and have funding to run for the next year.
The company is really just a consulting firm that deploys custom solutions for clients: this is totally fine by me, because it's really interesting and fun. But, the CEO is going to investors pitching the fact that we've built/are building some deep learning engine that can be applied to all problems. Investors are starting to do due-diligence on us, and I've repeatedly told him that there is no 'engine'; we're a consulting company. All problems we face are unique, and we provide a solution. There's no magic ML algorithm that works for all problems. This logic falls on deaf ears.
I feel that it's best to move on from here eventually - I may give it another few months to see what happens.
Any of you have any interesting takes/similar stories? I'd be curious to hear how you handled it. <comment><USER3> Your story sounds too familiar. I worked at a snake oil startup for almost 2 years, essentially a "Theranos" for food (google "vegan mayo scandal" to get the incredible whole story).

The CEO dramatically changed the focus and pitch of the company on a dime multiple times just to impress potential investors. The pitch at many points included "AI" (scientists using R to run regression models). Later it evolved into claiming we'd be in the "cellular agriculture" space before anyone else. At best, he was exaggerating and extrapolating minor discoveries. At worst, it was full blown fabrication, total vaporware. And to make things even more frustrating, he was brazenly uninterested in the science (and the input from the actual experts in the room). Everything was about a compelling sales pitch and continuing to buy the company time and funding.

I watched multiple waves of incredibly talented scientific and technical staff be sold by the vision then run for the hills after a year or two of working there. My advice is - if your ethics are being compromised, get the hell out of there.

<comment><USER4> I googled "vegan mayo scandal" and here's a quote from the first result - "He notified Hampton Creek's two outside board members, from Khosla Ventures and Horizons, that he suspected Tetrick was misrepresenting the company's finances. Both firms stuck by the CEO, and the board launched no formal investigation."

The quote is from a Bloomberg article - [https://www.bloomberg.com/features/2016-hampton-creek- just-m...](https://www.bloomberg.com/features/2016-hampton-creek-just-mayo/)

It's just astonishing to read that an company executive told board members that something seemed wrong with financials and the board members didn't immediately look into it. If the people who are supposed to be doing the due diligence aren't doing it, who do they think is going to do it?

<comment><USER5> I was at a party a while back. A friend has friends whose families are all pretty wealthy. Friend asks an old buddy what he is doing since college. He responds "I'm a board member now!... Dad says I just have to not ask any questions."

I thought it was a joke, it was not.

</comment></comment></comment><comment><USER6> What you are describing doesn't sound so far off from say "IBM Watson" ;)

There are so many companies doing real work in AI. NVidia for example. Or Waymo. You could even start a GPU Cloud services business. Or seek an advanced degree in academia. Best of luck!

<comment><USER7> Worked out OK for the Autonomy founders as well, according to HP.

</comment></comment><comment><USER8> I would leave sooner rather than later. Maybe read a few articles about the Theranos debacle if you can't readily grasp why.

Lying to investors goes by an ugly F word: Fraud. It can involve jail time and it can hint at a willingness to do worse things.

/personal opinion, not based on actually having worked for such a company

<comment><USER9> Right. Lying to users is one thing; growth must be prioritized or the business might fail so lying to customers is excusable. But, lying to honorable(i.e. wealthy and charitable) investors is morally corrupt.

<comment><USER10> The OP only mentions misleading investors, and my impression from the OP is that the clients themselves are getting the consulting services that they're being sold on.

<comment><USER11> without judging the original situation, misleading investors is _bad_. Customers know what they are getting and can accordingly choose to extend or cancel the existing business relationship. That's easy. Investors rely on management's communications to understand how their money is being used - <USER2> management is misrepresenting, how are the investors supposed to know if they should invest further in this company? Shit like this is the entire reason the SEC was founded.

</comment></comment></comment></comment><comment><USER12> I was hired on to a company in midtown looking to build out an HPC environment for analytics. I live pretty low in the stack, so my time was spent head down building a system with filesystem and network performance to the lead dev's spec.

The CEO had experienced a _major_ exit in dotcom v1, and was funding the new venture himself. Lead dev was one of CEO's generals from the bubble win. Money was basically unlimited.

This meant we were building a _hoss_ of a system with a latest-gen infiniband fabric, the most ram per-core Intel could give us, and some really high end IB connected storage.

The lead dev's requirements kept getting heavier and heavier despite blowing gobs on leading edge hardware.

Eventually we had an all-hands meeting where someone in sales did a mockup of our product in Excel.

They went to a customer in our target demo and loaded up the full dataset in Excel, and got the answers the customer was looking for. Sales had successfully implemented the product our customers wanted with no absurd HPC systems, but only Excel and a MacBook Pro.

I was reaching out to prospects before my first beer made it to me at the bar that night.

</comment><comment><USER4> >But, the CEO is going to investors pitching the fact that we've built/are building some deep learning engine that can be applied to all problems.

Are you directly involved in the meetings the CEO is having with investors? Do you have first hand knowledge of how the investors are reacting to what the CEO is saying? Is what you are saying based on your experience in those meetings, or from other conversations with your CEO? Remember that your CEO may have conversations with you that don't, in any way, reflect the conversations they are having with investors.

The world of business and money is filled with hype, painting pictures, "vision for the future", etc. Startups, Big and Small Tech Companies, Non-Tech Companies, it's all the same if you're trying to get VC money or budgets. What's comfortable for CEOs,VCs, and marketing may not be comfortable for somebody in a technical role. The people investing the money or approving the budget need to do their due diligence properly.

Rather than asking about your CEO, ask yourself if your own sense of morality is being violated. I've been in a similar situations before, where the company I worked was using consulting hours to sell a terrible (in my view) Data Science product. The "Product" did more to satisfy the person signing the purchase order than anybody who actually had to use it. That being said, all the consultants were sincere and the customers were really happy with the work we did, even if they had to buy that terrible product to get more time from the consultants.

If you are enjoying the work and doing right by your customers, then let yourself enjoy it. If your CEO is saying you are doing cutting edge cancer research with your product and you are running the models for a active clinical trial, find another job!!

</comment><comment><USER13> Isn't this kind of what a startup is? In the early 2000s I worked for a 5 man band company that rode the pre-smartphone mobile wave to a 500 million pound valuation and 400 employees, sounds cute now I know, and our first days were similarly seat of the pants.

Our CEO could sell anything, and then we built it.

If you're not defrauding customers but leaving them with a useful solution, where is the snake oil?

Sounds like the engine is you guys :)

<comment><USER14> > where is the snake oil

Doesn't the original post describe a CEO lying to potential investors about a product that doesn't exist? Maybe that doesn't map perfectly to the 'snake oil' analogy, but it's close enough.

Not everyone is comfortable with dishonesty. If it's a necessary part of doing business in this field, fine, maybe the OP needs to hear that. But lies are lies, even if sometimes they work.

<comment><USER15> isn't deep learning engine a set of scripts to solve some problems anyway? Are they trying to build PyTorch and TensorFlow? If they are proving solutions for customers, it does exist. Sometimes developer don't see the value of things because they are dealing with it everyday. For us it is scripts, for other people, it could be magic.

<comment><USER16> Quoting OP:

> the CEO is going to investors pitching the fact that we've built/are > building some deep learning engine that can be applied to all problems.

> If they are proving solutions for customers, it does exist.

From the perspective of a client with a particular project, provided the client's needs are met at a reasonable price, they are happy. It does not matter if their needs are met by application of some state of the art proprietary general purpose AI tech, or by application of standard open source technology and a lot of hours of consulting/professional services work.

From the perspective of an investor, there is a huge difference between a company that has state of the art proprietary AI tech, and a company that merely offers professional services using the same tech than any competitor has access too.

The former company has a much bigger competitive advantage / "moat" and is likely a far better long term investment.

Claiming that you have proprietary tech to potential investors when you don't is fraud.

Claiming that you are planning to build such tech is perhaps not fraud if you are indeed planning to build such tech, it'd be up to the investor to evaluate how likely that endeavour is to succeed.

<comment><USER13> Actually, I agree.

Pitching this to investors is fraud if you don't have it or are not planning to build it.

I misread, and was more thinking of it from perspective of a customer buying a solution, and getting an AI solution in the end.

</comment></comment></comment></comment></comment><comment><USER17> This is lots of companies I've worked at. Producing vaporware solutions for problems that may or may not be defined via user requirements (if defined at all). I'll just tell you about the worst one I worked at:

Under the hood, the company was down to 4 engineers (we sold the company as a team of 30 engineers). We were basically doing Ponzi-style SOWs promising time to clients over time another had paid for, etc. Lots of our 'solutions' were just white-labeled third-party software bundled up into a shitheap. We didn't have any actual IP because all of the stuff we made was licensed by the hosted providers we used. We actually stopped really acquiring any new tech or updating or methodology maybe a year into me working there. My boss shifted focus onto social media (blog posts about cloud shit, tweeting about cloud shit, facebook about you guessed it--cloud shit.) He even went as far as to spend ~20,000 on high end production and recording/streaming equipement and software to start doing live webinars about more, yes, cloud shit. The content of the webinars was whatever the engineers could manage to scrape together at 2am after finding some time in their massive stack of actual work to do. Our boss never learned how to set up the shit, the webinars barely ever streamed successfully, and the social media best I know never made a mark.

I've been gone a while but last I heard the CEO is still hellbent on being the most widely visible adopter of the cloud in the world.

</comment><comment><USER18> Get out! If you don't feel comfortable with CEO, then it will be very hard to feel good about your work.

A while ago, I worked for a consulting company that specialized in e-commerce with fulfillment. Soon I realized that their clients are mostly MultiLayer Marketing companies. MLM is legal but very unethical industry. Our clients referred to their customers as idiots or bored housewives. Some of my coworkers tried to quite their concise by convincing themselves and me that these people are lazy who are trying to get rich quick. So they deserve to lose their money. They would say it is a cheaper than business school.

I tried to tell myself that I am just a worker, just following orders. It was a good job with a lot of benefits but it was very soul crushing. Leaving that job was the best ever thing. My mental health improved the minute I handed my two weeks notice.

</comment><comment><USER19> You seem to have a capable CEO that is able to bring in the funding. Unless he is blatantly lying I'd say what you are experiencing is pretty standard. Throwing in some buzzwords is not selling snake oil. It used to be "big data", now it's "AI", next it'll be "blockchain".

<comment><USER20> > the CEO is going to investors pitching the fact that we've built/are > building some deep learning engine that can be applied to all problems.

> there is no 'engine'; we're a consulting company.

This is pretty close to fraud. There's a huge difference in return to investors between skilled data scientists doing one-offs, and an engine that does the work on its own. If they're not even trying to build a generic AI engine, it's over the line.

> Unless he is blatantly lying I'd say what you are experiencing is pretty > standard.

I would say that he is lying, if the description of the situation is accurate, and that "what you are experiencing is pretty standard" isn't _really_ true. But it's not far wrong either. And that's unfortunate.

<comment><USER21> > There's a huge difference in return to investors between skilled data > scientists doing one-offs, and an engine that does the work on its own

This is kind of the crux, right? If the investors believe that there is a future roadmap to essentially automate what the team is doing ... That's one thing. If they are investing today because the CEO is saying "Look! It's automated!", then that's pretty much on them.

That said, these investors have literally millions of dollars to complete due diligence, and if they miss on something like that, it's on them. Investors are putting so much money into these companies on "demos" and without really looking under the hood. So if they complete their due dilligence, their essentially saying "we are investing in your current product and our current understanding of it". I don't think there's going to be a fraud lawsuit here.

Theranos was changing the output data that the investors saw, not just saying "we do blood tests better!". That was straight up fraud because the data reviewed in due diligence was false.

</comment></comment></comment><comment><USER22> "The company is really just a consulting firm that deploys custom solutions for clients: this is totally fine by me, because it's really interesting and fun. But, the CEO is going to investors pitching the fact that we've built/are building some deep learning engine that can be applied to all problems."

Sounds like IBM Watson.

</comment><comment><USER23> I detect that from the beginning now. In your case it can't become big because consulting doesn't scale. As they are into AI, they won't even think at trying to scale consulting.

Next time, negotiate nothing less than cofounder at least to get a control over the purpose of the company.

<comment><USER24> > consulting doesn't scale

IBM disagrees

</comment></comment><comment><USER15> I think it is CEO's job to keep investors hope high. A engine doesn't work like magic anyway, you are always going to customize it. Thinking TensorFlow as a engine. I don't see anything wrong with that. Anything can be boring, and CEO has to make it exciting. I have this experience with my recent project that I am in charge of, the team facing a lot of doubts and pushes because I didn't draw the picture sexy enough for management. CEO takes on the task of making sure investors are happy to keep the company going and making sure team members are happy as well. What you see is 80% of the value of your company, and the CEO sees 120%, that's the difference and it is the right thing to do.

<comment><USER25> Lying to investors is not okay, and OP describes a CEO who they believe is flagrantly lying.

This is a kind of "excitement" no company needs.

<comment><USER26> > This is a kind of "excitement" no company needs.

Citation needed? It would be good to have a (probably impossible to perform) study that compares the performance of companies where CEO is lying vs the ones where they're only telling the truth. From my personal experience, I've seen a lot of success built on lies.

<comment><USER27> It's questioning the ethics of lying, not the production advantages of being unethical.

The two of you have different priorities. You are both right and both wrong.

It's not really the kind of thing that requires a citation. However it's trivial to Google and see there are a whole range of opinions on the matter.

</comment></comment></comment></comment><comment><USER28> It doesn't sound like snake oil. It does seem like you are actually building AI solutions, and guess what, you said it yourself:

"this is totally fine by me, because it's really interesting and fun"

The founder needs to do what he has to fund the dream while it is still amorphous. Once you've done enough consulting, hopefully you will be able to re-use some of what you've done over time, and start focusing on a single problem area and building that 'engine' \- that is, if you stick around long enough for it to be realized (and dont run out of money first)

<comment><USER14> > The founder needs to do what he has to fund the dream while it is still > amorphous.

Meaning, lie about the product? Maybe this is normal; I'm not part of that world, so I wouldn't know. But hiding it behind fuzzy phrasing seems like doubling down on dishonesty.

<comment><USER29> Agreed. If a founder is willing to be dishonest to investors, he/she are also likely to be dishonest to customers and employees. There's a fine line between marketing fluff, which is ugly but acceptable, and outright lies, but if you feel uncomfortable, it's likely a problem.

</comment></comment></comment><comment><USER30> I think what you'll find as you get further in your career is that sales- orientated individuals (revenue sales or investment-as-sales) tend to over- represent their capabilities to the people they are selling to. If you quit every company where you find that "sales is selling things that we can't build" there will not be many companies left to work for.

</comment><comment><USER20> If the CEO doesn't deliver something either (a) very much like an engine that can scale the business without hiring data scientists for every job, or (b) some other very exciting thing, he's going to have a tough time.

Maintaining investor confidence is almost as critical to a CEO as raising money.

</comment><comment><USER31> If the business seems to be doing well and growing, I'd reconsider if what he's doing is really that bad. This is the reality of "AI"/ML - there's no magic bullet, but naive people want to be fleeced into thinking there is one.

</comment><comment><USER32> That's pretty much all startups, sorry to tell you.

</comment><comment><USER33> Your CEO's job is to build vision and hype. He's supposed to look toward the future - the eventuality of what you guys are working towards.

This is so facepalm/cringe and typical of engineers who think they know better and everyone is an idiot lol.

<comment><USER5> Theranos agrees!</comment></comment>


Ask HN: Snap's road show video has vanished, where can I find? - <AUTHOR> With Snapchat changing there focus and trying to court a broader audience I am trying to locate the video shown during their pre IPO road show.
It isn't available on their site nor is it on youtube.
I want to see how they presented Snap's future then compared to what they are doing now.
Anyone have the video? <comment><USER2> Try the Wayback Machine at archive.org</comment>


Feynman Quotes/Anecdotes - <AUTHOR> http://curi.us/blog/post/1298-some-of-richard-feynmans-wonderfulness

<comment><USER2> One way I've thought of to make people not care about my judgment is to be arrogant. Then I can both gratify my ego and keep people from regarding me as a genius at once:D

Plus, what I've said will stay in their mind since my arrogance will bug them, and if it's worth anything it'll resurface at a later point. If I'm lucky, they'll think it is their own idea, making it even more effective.

Wins all around. This is probably what smart arrogant people tend to think anyways, and they've stuck it in my mind through their arrogance:)

<comment><AUTHOR> Do you think I'm arrogant?</comment></comment>


Ask HN: Facebook Safetycheck for Brussels - <AUTHOR> Hello,
Has somebody a contact at Facebook who can activate the safetycheck? Thanks.
Bilal <comment><USER2> It seems to be active now.

[https://www.facebook.com/safetycheck/brusselsexplosions- marc...](https://www.facebook.com/safetycheck/brusselsexplosions-march2016/)</comment>