Programmer to Manager - <AUTHOR> If you are moving from developer to manager at very young age, like after 2-3 year in starting of your career phase. Is it good? or should leave the job to find another challenged job which provides challenging technical work. <comment><USER4> I'm a manager these days, and I think it's two very different roles. While I was never the best developer (and probably will never be), the managerial role is kind of awesome because it's about amplifying others' ability to be great.

Management is much more of a service role (and much less of a directly creative role), but I've found it to be a good fit because you get to serve a bunch of wicked smart people, which is super fun.

Good management is all about reducing total cognitive load for your engineers: keeping stakeholders off their back, taking heat when things go awry, being a crap umbrella for the team so they can work, etc. Done right it's immensely rewarding, but definitely not in the way programming is.

Also - in my experience the number one thing you want to look for in vetting a 'good' management job is the quality of the executive you'll be reporting to. Are they a strong, fair leader? If yes, go for it. If no... you're gonna have a bad time.

</comment><comment><USER5> I did more or less exactly this - after two years working as a developer, I pushed myself into a "team leader" position, managing a team of half a dozen people in one location and semi-managing a few others in a different location. I did this for about 18 months for a large (and fast growing) organisation.

I managed to negotiate about 25% of my time for development (some of it quite high-level architecture, but often still writing actual code); the rest was personnel management, planning and organisation, liaising with sales and project management, sometimes attending sales pitches, and training other teams. I actually had a great time, met people from all over the organisation, got some travel out of it, and learnt a hell of a lot, almost all of which has been beneficial to me later in my career.

Personnel management was definitely a real challenge - in ways I absolutely had not predicted (we had some, shall we say, "interesting" characters on the team, and I got to know the HR people very well by the end of it).

After 18 months, I moved to another company to take a role which ostensibly should have been similar but ended up migrating back into a more-or-less pure development role as a technical lead. The skills I learnt then - <USER2> anything to do with personnel, sales, and planning - are still extremely useful to me as a software consultant / small business guy today.

I don't know if this route is for everyone - I was already naturally pretty confident and articulate, and for developers who aren't especially born that way, I think a lot of management tasks and managerial expectations are probably scary and unpleasant. But for me, at least, I enjoyed it and have few complaints.

</comment><comment><USER6> I've never been a manager, so I might well be completely wrong about this.

Anyway, I think that, even as a manager, you have the option of being involved in the _design_ aspect of things, even though that heavily depends on the kind of developer you are. If you're anything like me, you love designing new features and writing specs that are as detailed as needed. That's something I've been doing quite frequently, to the point where, for the project I've been assigned to, I do most of the design of new features besides helping turning them into working code. I sit down and think through the problem at hand, jotting down ideas in plain text files and commit them to a dedicated folder in our project's source code repo, iterating over them as I think of more efficient/elegant/fast/simple ways to implement the feature and taking into account inputs from the other guys in the team. Again, I've never been a manager, but I think one could retain at least part of this role, provided she can cut through all the bullshit that working for a company entails (meetings where you decide nothing, chiefly).

OTOH, if management is not your thing it's not your thing, I guess. Then again, why not give it a try? Give it some time and see how that works out for you. If you like it, great. If you don't, you can always quit and the best that can happen is that your resume will look more interesting.

If I had to hire someone, I would give bonus points to someone who knows about managing and communicating with _people_ , not only machines.

</comment><comment><USER7> Every manager of programmers I've known who was not themselves a competent programmer caused more harm than good. Take that for what you will.

<comment><USER8> I was sitting nodding me head with that, but I did have a manager who was a trained engineer. He was good. Knew enough to know what to ask you, but didn't assume that he knew enough to implement something - so left the fine details to the developers.

Now I have a team leader and group leader on top of that, who are in my opinion junior to intermediate level programmers who have gone for the management option early. They are annoying because they _think_ they know how to solve a problem. Their requests come in the form of half though out solutions. "We need a new table in the database with these fields" as opposed to "I want to track this information and see it here". I have to translate these to higher level requirements, then work out the implementation details myself, as often their "solution" has flaws - we actually need two related table, or an additional field in an existing table - not the new table they have suggested.

<comment><USER7> Your second example is exactly what I had in mind. It reminds me of the final group listed in this quote from General Kurt Von Hammerstein-Equord:

"I divide my officers into four groups. There are clever, diligent, stupid, and lazy officers. Usually two characteristics are combined. Some are clever and diligent -- their place is the General Staff. The next lot are stupid and lazy -- they make up 90 percent of every army and are suited to routine duties. Anyone who is both clever and lazy is qualified for the highest leadership duties, because he possesses the intellectual clarity and the composure necessary for difficult decisions. One must beware of anyone who is stupid and diligent -- he must not be entrusted with any responsibility because he will always cause only mischief."

</comment></comment></comment><comment><USER9> I think taking on team leadership roles (where you're still >=60% technical) is fine that early.

I wouldn't make a jump into pure management that early. I would fear that it would do two things, both bad:

1\. Prevent you from developing the necessary technical experience, instincts, and judgment that will serve you well later in your career.

2\. Prevent you from "tasting management" and deciding whether or not you like it. Many don't, and that's perfectly OK. I am in the category of "initially reluctant managers" which makes me both good and bad. Good because I'm not in it for the power or title. (Managers who are can be incredibly corrosive.) Bad because there are some parts of managing that are necessary but distasteful to me and so I naturally deprioritize them or am less than good at them. Things like figuring out something personal about someone on your team and figuring out how to motivate them or how to help them break through what's blocking them. Those can be a struggle for me, as I'm a natural engineer, not a "people person". I see some of my peers who got into management out of desire, and while they're not nearly as strong technically, they appear effortless when dealing with people and their idiosyncrasies.

Being able to "try on" managing a team at your current role is possibly great. If you like it and are good at it, you learned something, but you still should proceed slowly with the transition.

If you don't like it and decide to stay technical, there's no harm whatsoever in giving that up (at your current or next job). I hear in interviews pretty regularly, "they were pushing me into management and I like to stay technical". When I have a technical role (which is always), that's music to my ears.

</comment><comment><USER10> It depends what you want to do but as a manager I'd like to say a few things I found making the move:

1) It's obviously very different. It's primarily about organisation and co- ordination - you need to understand all the moving parts of a project, know what's important, what might need your attention and what can be left alone. You might want to ask yourself whether after 3 years experience you feel you're equipped to do that - some people have a feel for it and are, others need more first hand experience of projects. More importantly you want to think if you're going to be happy doing that.

2) There is a temptation to think when you're a programmer that the reason things aren't going well are that the manager is doing his job badly and you're going to do better. This may be the case but in my experience that's often not the case. Organisational cultures and how projects are run tends to be driven from the top of the organisation down and you may find that the things ultimately causing the problems are far higher up the chain. Where things are bad for programmers they're often bad for managers (or at least middle managers) too. Moving into management because you think you can fix the world is probably misguided.

3) Following on from that, you'll probably have a lot less power / authority than you think. It's best to think of managing at this middle level as working with programmers but doing a different job rather than them working for you. Generally, as when you're a programmer, you're a middle man turning the wishes of those above you into reality. Yes you might get a say / some influence but probably not anywhere near as much as you'd like. People will tell you to do stuff, you'll do it.

4) Learn to delegate. This is key. When you're given things your first instinct will be the one you have now - to do it yourself. That approach is going to kill you. You need to learn to give other people work.

5) If being friends with the people in your team is important, you might want to think twice. That's not to say you can't be friends with someone who works for you, just that there is always the potential for problems. If your friend starts coming in late are you willing to pull them up on it and risk the friendship?

6) It is hard to go back. Some roles keep you hands-on to an extent but once you're not coding at least 20 hours a week, you've got a year, maybe two at most, before your skills have significantly atrophied at which point moving back will be a problem.

7) With regard to skills decay, you also need to understand this is happening when you're making decisions on the project. You may be the best programmer in your team but if you spend 0 hours a week programming and the graduate entry level guy spends 45 hours, how long before he knows more than you do?

<comment><USER11> Completely correct on all points. When I was a programmer, I would sit and stew about the decisions management made. I was deluded into thinking "I would do this different". Moving into management and realizing that it is a totally different role of planning, organization and coordination - all of which isn't really in your control.

After having been a manager for a few years now, I realize my tech skills have degraded. So I do side projects programming things I want to do, the way I want to do it to keep my skills up to date.

The other thing I think I'm realizing is that being a manager is sort of generic role. Most career paths forward at this point look rather boring and mundane. Even if it is a new project - some sort of skunkworks effort - <USER3> some new tech and solving really cool problems - managing that isn't much different than managing a team maintaining a 10 year old system. Maybe morale is easier to manage.

Think about what your next position would be after taking a management role - your options become limited. Other companies may see you as "manager" and not as "developer" regardless of skills, perhaps thinking subconsciously that "if I hire this guy, he is going to want my job".

<comment><USER10> Yep, development manager / development project manager is actually an odd half way house. It's still basically a delivery role, working closely with developers and the product, but it's the last time that's really true. Beyond that when you start managing managers, things start becoming somewhat more abstract and that's where things really change.

</comment></comment></comment><comment><USER12> I had roughly 6 years of experience before I made the transition. I had spent a considerable part of those 6 years thinking about all the things I'd do if I were the manager of my team. Whenever I interviewed for an IC role, I made my intentions clear that I wanted to get into management long-term. I was offered a management role 5 months into a job and I took it. All those years of thinking about management enabled me to transition nearly smoothly.

Looking back, the 6 years I spent coding were extremely valuable. The only way I'd have become a manager after 2-3 years was if I had had a good mentor. My advice would be to spend the next 3-5 years building a lot of things and observing your leaders closely. Read about what great managers do and don't do and play out scenarios in your head.

</comment><comment><USER13> I am actually in the same spot as you are - 2,5 years into programming and there is this opportunity to switch to another role. All the good managers I ever met or had the pleasure of working with were form a technical background - but they were working as the programmer for over 6-8 years each. It does stand for something.

It really boils down into one point: how happy would you be doing whatever you choose to do - there is nothing worse than a manager that hates his job or a programmer that doesn't feel the "drive" and passion to work.

Personally, I do not feel equipped to switch into management just yet - I am not confident enough I would make the best decisions, and I am leaning towards staying in my role a while longer, just to be totally sure I acquired all the necessary skills.

</comment><comment><USER14> I guess it all boils down to your long term goals. Think about where you want to be in the next 2-3 years. Does this current switch to manager role makes sense then. Think.

Im doing a bit of management part time coz my team is small. I manage multiple products and i code on one product one week and the other product the next week.. sometimes it depends on the priority levels. We might have a release due in some product where extra hands are required. Then i go do that. So!

Will you love it? If you want to go work for apple or start your company or something, it always helps to have a bit of management in you. So instead of a full switch to management, ask your company if you can work on code 50% of the time.

</comment><comment><USER15> IMO, 2-3 years is too soon. You might be pigeon-holed as a manager for future jobs. I guess you can always craft a resume to emphasize your hands-on technical experience though.

Maybe management is what you want? If so go for it. But your tone suggests you have reservations about this, so I'd suggest you ask to remain engineer and then after 5-10 years doing that, re-evaluate your desire for management.

Also, I'd be inherently skeptical of a place that moves you to management after 2 years of experience. That means they generally have non-technical managers. I think managers should be the senior engineers who also have people skills and like managing.

</comment><comment><USER16> From my experience every developer I know who ended up early as a manager, where not really happy with that. Most of them had the impression of being taken apart of technical challenges, and wasting their time in endless meetings.

<comment><USER17> To some extent I think this type of experience is almost a rite of passage as developers become increasingly senior. I've had experiences along these lines as have most of my more seasoned colleagues. Management sounds OK from a distance, but when devs realize the kind of petty idiocy that will now dictate their daily life, it's normal to start running back to the compiler.

This may not be true in companies where engineers make up the upper echelons, but it invariably seems to occur in other types of companies. Management is a fundamental game change, and it's not about programming, and it's not about organization or efficiency. It's not about how good a manager may or may not be at getting things done. It's about psychology, the psychology of the people higher or lateral in the structure more than the psychology of a manager's direct downline (though both require cultivation).

The number one rule of management, and employment in general if you want to rise through the ranks, is ABC: Always Be Campaigning. If this doesn't sound good to you, you don't want to go into management, and you probably don't want to be a normal employee for very long either, because if you aren't doing it, you're going to pay sooner or later.

Everyone tries to tell themselves that _their_ employer is different for reasons X, Y, and Z, but it's very unlikely to be true, no matter how nice you think your company is. I've even experienced the ramifications of not adopting ABC just in the last few weeks at _another_ company that I swore was _different this time_ and is lead by an old-school computer engineer who has been working since the 80s, and I'm not even trying to do any management-type stuff there, as I'm still reeling from last time I tried my hand at that.

It's hard to come out of these experiences without a massively pessimistic view of everyone else. Any time I try to allow myself to become optimistic and think, "Nah, _these_ guys aren't like _that_ ", and no matter how much evidence I think I have, it all comes back to people being people and heavily favoring typical pre-programmed people responses, even if those responses may not be well-considered or well-informed. Biology is hard to override.

It seems if you want a different employment experience, you must compromise such that you are always campaigning.

<comment><USER18> Thanks for this post. Can you drill into a little bit what you mean by "campaigning" though? Do you just mean constantly lobbying people in your organization to gather support for process changes, new programs, initiatives etc. that you want to sponsor?

<comment><USER17> No, the problem is believing that it's about important things like programs, processes, and initiatives. The reality is most people can't and don't want to understand that type of stuff. That doesn't just apply to MBAs, it applies even to most of the people in your department. You'll become their enemy if you go in there and start advocating all but the most minor and gradual changes (even this is dangerous). Consultants are paid to operate outside of the political structure, not employees. If you want to recommend changes and get ignored, do it as a consultant because you'll be better paid and have less stress in doing so, since you'd be ignored as an employee too but you'd also be collecting personal political enmity.

If you want to be an employee, you have to play politics. You have to be campaigning for yourself. As an employee, you are your product, your brand, and you're supplying it to the customer, your employer. For the same reasons that front-line customer service representatives for retailers and phone companies have to go all day biting their tongues, you also must do so as a front-line representative of your personal brand. It doesn't matter what you think. It doesn't matter what is or isn't better or worse. Nobody wants to hear it and nobody cares. Some people may say they're hiring you for your opinion on things like that -- those people are lying, don't believe them. They just want you to coo gently to them and give them whatever they want, or a close enough approximation thereof that they can't really tell the difference.

You have to always be the nice, self-sacrificing guy who doesn't make any waves but is just so grateful for anything and everything and always go the triple-extra mile to help out. The guy who is always taking his co-workers to lunch because he appreciates them _that_ much. The one with the "charisma", the "flair", and the "charm". In short, the sycophant, just barely non- obviously. That is how influence is aggregated.

As an employee, your productive output is secondary to successfully running a personal campaign. You do all the schmoozing, make all the power plays and all the disingenuous convenience connections you would if you were running for a real political office, basically the whole shebang except the posters. As long as you kinda-sorta look like you're doing some actual work somewhere under the covers, it doesn't matter if you actually are or not. What matters is that you become that guy. If you are employed, your _real_ job is selling yourself to your colleagues (mostly superiors, the further up the chain you can get known and get positive attention the better). Devote 75% of your energy to this task and 25% or less of your energy into whatever you were actually hired to do and you'll go far.

This is geared toward employment in general, but it's 50x more important if you're in a management or leadership position, because at that point you don't really have a real job to divert any energy toward anymore anyway.

There are some companies where this is so expected that your continued employment is jeopardized if you don't do it (like my previous employer), and other companies where you'll just be passed up for advancements and go unnoticed if you don't do it (like my present employer). There's not really a third type of company excepting very small startups, which is usually not the kind of place someone looking to be employed would wind up.

</comment></comment></comment></comment><comment><USER19> If your career is set on going down the managerial path then of course this would be a good opportunity. If your heart is in tech, however, I'd stay low level. My own personal anecdote is that I thought I was having a blast going down the leadership path for about five years, until I realized that I actually wanted to stay technical.

At the point I made this connection, I had lost several years of progress, skills had depleted, and technologies had moved on a lot. I'm still catching up! Consider that a cautionary tale. :-)

Just my 2¢.

</comment><comment> bulte-rs I combine stuff at my job. Development and Management is split 50/50 a.t.m.

This of course might change to more management if that part of the jobs demands more time.

Nothing wrong with becoming a manager if that's your thing. But I love the fact that I can still do some research (/poc development).

As we say in Dutch: A Developer in Heart and Kidneys ;-)

edit:

Additionally, I think it might actually help in becoming a good manager if you are a good developer, still being able to 'relate' (i.e. not looking down from your ivory management tower).

</comment><comment><USER20> Please read this article that talks about a software engineer changing into a managerial role:

[http://michaelochurch.wordpress.com/2014/07/13/how-the- other...](http://michaelochurch.wordpress.com/2014/07/13/how-the-other-half- works-an-adventure-in-the-low-status-of-software-engineers/)

also read the hackernews discussion:

[https://news.ycombinator.com/item?id=8033051](https://news.ycombinator.com/item?id=8033051)

</comment><comment><USER21> It really depends on your medium/long term career goals. If you want to become a manager it's better sooner than later. At least you'll have the time to learn the job properly. The managers I liked the most so far were the least technical, but also the least opinated about how techs do their job, trusting our time estimates and other things that should be the developers/architects to decide.

</comment><comment> UK-AL Lots of interesting Management material to learn about. To be a manager it's good know a little about a large number of things. Learn about the theory of constraints, lean, product management, finance, psychology, visual management etc

Lots of cool things to learn, don't think your leaving interesting knowledge behind.

Being a manager is about getting the right resources, the right people to do things at the right time.

</comment><comment><USER22> Is it because someone has identified you as having leadership potential or because no one else wants to be the manager?

If the former, thank them for the assessment and leave to start your own company, even a tiny one. You will learn more about management and less about impedance matching the (dys)functions of existing organizations.

If the latter, leave to work elsewhere in a technical role, preferably under a good leader.

</comment><comment><USER23> I think if you are good technically, you should aspire to grow on technical front rather than aspiring or actually moving to managerial role. There are technical managers but in the long run the management part of the role tends to eat into the innovative,experimenting technical side of your personality. If you think you can balance it well then no harm in becoming a technical manager.

</comment><comment><USER24> It Depends !

Ok, to be more specific:

Do you prefer wrangling bits and bytes or people?

Do you like your current company? Is there an appealing career track for you?

Do you like being challenged technically? Or would you just prefer to earn a comfortable salary?

My observation is that once you get settled into the management track it is hard to go back to development. Even if you do side projects, that doesn't really put you back on the tech track.

<comment><AUTHOR> I like to work that is challenged technically, salary is second preference for me. I like my company as i come in very starting members of company, so its tough for me to leave this company. i am doing management but somewhere i still want to write code and live that life.

</comment></comment><comment><USER25> In my experience existing in the middle ground of being a manager of 3-5 resources and being expected to produce your own work with no managerial experience (only 6 years dev experience), added on that unrealistic client expectations has been the greatest challenge I have faced so far. To whomever finds themselves in a similar position I wish you the best of luck.

</comment><comment><USER26> I took a position as a team manager when I was offered, and I absolutely do not regret it, but it made me realize that what I really wanted to do was to be a developer.

Try to find out what you really want to do, and be aware of that it is not straightforward to go back to a position as a developer in the same company after you've become a manager.

</comment><comment><USER27> If you're starting to do technical management after only 2 or 3 years working as a coder, I would say that's a bad move. Project management, people management - all fine, but it's extremely unlikely you have the depth of experience required to be providing technical direction for any kind of a large project

<comment><USER28> And with only 2 years of programming its unlikely that you will have developed enough soft people skills.

<comment><USER29> I'd argue that these skills are only tangentially related. Despite what others experiences are with MBA types, one of my best managers ever was a _very_ smart recent MBA grad with no programming experience.

He cared deeply for the team, set up growth paths for everyone that wanted them, acted as a crap umbrella when shit hit the fan, praised publicly and provided very constructive criticism in private.

<comment><USER28> was this a proper MBA ie 35 or so with a decade or more of work experience before doing their MBA.

A lot of people seem to do BS/BA->MBA with no work experience prior to the MBA as away of dodging immigration hassles

<comment><USER29> Straight out of school. Hour was at least a year younger than I was.

</comment></comment></comment></comment></comment><comment><USER30> I usually don't get these types of questions. I you like engineering you stay as engineer, if you don't you try to find something else. If you just want more money try to find another engineering role.

If it's good or bad it depends on what you enjoy doing, nothing more nothing less.

</comment><comment><USER31> I wouldn't do it. Just let me have fun with my code editor :)

</comment><comment><USER32> NEVER!</comment>


Show HN: Nanoblog open source microblog with buffering and Twitter crossposting - <AUTHOR> https://github.com/nanoblog/nanoblog <comment><AUTHOR> Hey HN, we created Nanoblog because we wanted to keep our users up to date on our progress but found long-form blogging too time consuming. Nanoblog supports automatic posting from a buffer and crossposting to Twitter so it's easy to write posts in batches.

We'd love for you to check it out, and give us any suggestions for improvements. Thanks!</comment>


How Air-Traffic Controllers Sound When They Have to Close the Airport - <AUTHOR> http://www.theatlantic.com/national/archive/2015/03/how-air-traffic-controllers-sound-when-they-have-to-close-the-airport/386971/?single_page=true

<comment><USER2> I used to be an ATC (in Australia, 7 years), and there is definitely stress there, but its like being in an insane asylum - you don't recognise that you, and everyone else, is mad. There is also significant peer pressure to excel at your job. Not just be good, but to competently handle everything that comes. The regulations state that the purpose of ATC is to provide for the "safe, orderly and expeditious operation of aircraft movements." They apply that religiously, and in that exact order. Mistakes in even the simplest procedure,or even phrasing of comms, are not tolerated. Mistakes are seen as evidence of failure to cope with the stress, and result in operators being swapped out ASAP.

I remember it took about 2-3 months, after I resigned, before I felt free of the stress. I consider knowing how to recognise stress growing within me to be the most valuable thing I took from that part of my career.

As an aside, it is possible there is a similiar mindset, or skillset amongst controllers. I remember very clearly the selection process was very focused on 2 things

\- maths and logic

\- multitasking

The hardest test in the selection process was a combined map course plotting task, where you had to accurately plot out a course of about 15-20 waypoints, but every 60 seconds the examiner would read out a logic problem "if Jane wears blue on Tuesdays and green on weekends, what would she wear on the day before Monday ?" \- stuff like that. You had to focus on plotting, correctly, as many map points as possible, AND correctly answer the puzzles being read out. That was the most directly relevant skill to the actual job of being an ATC, awareness of the task in front of you, and the ability to understand and act on the 'buzz' going on around you. They select for people who can perform accurately for multiple inputs, with time and cognition pressure. JM2CW

<comment><USER3> Thank for providing these insights! I used to play a neat little terminal game named "atc" in Linux (it's a part of "bsdgames") which I thought simulated air traffic controller's job to a decent level of accuracy. It was fun to start off with but I just couldn't cope up for more than 30 minutes. There were just way too many variables to hold in my working memory. E.g., an incoming plan that could potentially miss landing; a plane which is low on fuel, collisions and what not!

Given the amount of stress levels I'd imagine ATC operators are rotated frequently; say once every hour or so?

<comment><USER4> > I used to play a neat little terminal game named "atc" in Linux

there is a pretty cool "train control" game on ipad as well, where you guide trains across a bunch of crisscrossing train-lines. you control the lights at these intersections etc., overall game-play has a let's-solve-this-puzzle kind of feel, using minimal number of stoppages for all the trains etc. pretty nice overall...

<comment><USER5> I don't suppose you remember the name of that game? It sounds fun...

<comment><USER4> here is the game i was talking about: [https://itunes.apple.com/in/app/train- control/id888290929?mt...](https://itunes.apple.com/in/app/train- control/id888290929?mt=8)

</comment></comment></comment></comment></comment><comment><USER6> There is a fundamental nature to aviation which I experience as a pilot, but is also very true for controllers. Planes can't just stop. If you decide you're in a bad situation, or overloaded, or just can't cope, there is no reset button. You have to get the planes onto the ground, one by one, over the minutes or hours it takes. This need breeds a sort of trance-like calm in successful controllers, even in the most stressful conditions.

<comment><USER7> Every time my stress has gotten really bad over any number of things (certainly none as critical as a plane's safe landing of course), at a certain point it does seem like a mental defense to just semi-accept that BEING stressed isn't going to help and things turn into a very calming feeling of "ok break this down as reasonably as possible and start fixing the problem"

<comment><USER8> If I am by myself I find it fairly simple to "turn off" my stress and focus on the task at hand, employing the same rationale that you mention: being stressed isn't helping anything so let's focus our energies on fixing this problem.

One of the biggest obstacles I find in a working environment, however, is other people's stress. If someone is relying on me to fix a problem and they are very clearly stressed out about it, I find that their stress can impact me greatly. There is also the aspect that if I am able to be calm and focused during the stressful situation, while they are clearly stressed, it can be perceived as me lacking concern or having a blasé attitude toward the problem at hand, in comparison.

</comment></comment></comment><comment><USER9> Similar recording of the BA crash at Heathrow. I am always impressed how professional they do things: [https://www.youtube.com/watch?v=cCK62U6Fob0](https://www.youtube.com/watch?v=cCK62U6Fob0)

Another one of an engine failure at Manchester - the response of the ATC within 1 second of the mayday call is plain amazing: [https://www.youtube.com/watch?v=9KhZwsYtNDE](https://www.youtube.com/watch?v=9KhZwsYtNDE)

<comment><USER10> Slightly better audio of the Heathrow incident at: [https://www.youtube.com/watch?v=qcGA3vRwzuE](https://www.youtube.com/watch?v=qcGA3vRwzuE)

</comment></comment><comment><USER11> I had an opportunity to visit the Chicago regional center a few years ago to meet some of the controllers and learn how their systems work. Everything about the space is meant to keep these guys calm and focused on their job. It literally feels like being in a bit of a cocoon. Dark lighting, very large screens at each workstation, some physical controllers to quickly modify their on screen views. Their training also focuses quite a bit on constant recall of what they're looking at (in the event their systems suddenly die, they need to always know what planes are in their sequence and where generally they are) and of course stress management.

I'm glad The Atlantic has highlighted ATC in this instance. They are definitely an under-appreciated workforce.

<comment><USER12> _> Their training also focuses quite a bit on constant recall of what they're looking at (in the event their systems suddenly die, they need to always know what planes are in their sequence and where generally they are) ..._

That seems brutal. Wonder why they don't do something like a continuous print instead.

<comment><USER13> Many ATC facilities do use backup printers for the good old flight progress strips. Basically a continuous roll of strips coming from the printer that usually goes directly into a garbage bin.

</comment></comment></comment><comment><USER14> Being able to deal with a stressful situation calmly is a mark of solid training and a work culture that emphasizes level headedness.

In addition to training though I wonder if those working in ATC all share similar personality types.

<comment><USER15> I think what is impressive is not just their ability to maintain their composure but how readily they enter "emergency mode" from what was most likely a boring, normal day. Their ability to context switch AND maintain a level-head through it and afterwards is commendable.

<comment><USER16> Well, there are multiple levels here.

One very important one is the ability, when the tower is told "runway 13 is closed" with just very bare-bones information, to just accept that and start doing what needs to be done to close it down. The human tendency is to want to know more about what's happening, what needs to be done down on the ground, the condition of the aircraft and the passengers and crew, etc., but the trained-in response is to automatically trust that _someone else is taking care of that, so stop thinking about it and do your job_.

So the controller goes immediately from talking to the car that reported the crash, to issuing go-around orders, not knowing how bad the crash is, how long it's going to take to clear up, just trusting that "OK, I handle the planes that are still in the air, they'll handle the one on the ground".

</comment></comment></comment><comment><USER17> Those of you who have english as your first language, do you clearly understand everything they say? Goddammit, I was barely able to understand the number 1999 for the first flight mentioned in the article...

<comment><USER18> Even native English speakers have trouble understanding ATC comms. The sound quality is poor and it's a very specialized vocabulary. But with practice it becomes much eaier because there is a very limited repertoire of things that the controller is likely to say, and once you know what those are it becomes a lot easier to decipher.

</comment></comment><comment><USER19> I just listened to the audio of US Airways 1549 today. Sullenberger reports both engines out like he just told his wife they're out of milk. I guess the training works. [https://en.wikipedia.org/wiki/US_Airways_Flight_1549](https://en.wikipedia.org/wiki/US_Airways_Flight_1549)

</comment><comment><USER20> Very cool article and job well done by liveatc. Cool service that works well especially in these types of situations. Inspiring to be able to hear these professionals keep their cool under duress.

</comment><comment><USER21> I flew into LaGuardia from Knoxville last Sunday. A plane ahead of us landed safely but reported that the runway was slick. They closed the airport to take care of it while we were in a holding pattern for 20 min or so (in clouds/fog). Then we approached LaGuardia again only to be put into a holding pattern again.

Although circling in zero vis was unsettling (I was a passenger on a UsAir/American flight- I am not a pilot), the calls very well may have saved my life.

</comment><comment><USER22> TDIL: Air controllers would probably make great consultants for many startups.

</comment><comment><USER23> there is a detailed report of the accident on the excellent [http://avherald.com/h?article=482b659f&opt=0](http://avherald.com/h?article=482b659f&opt=0)

</comment><comment><USER24> Pedantic alert: ATCs don't close the airport. They can take a runway out of service, but they can't close the airport, that's the airport authority's job.

<comment><USER25> Less pedantically, I thought it was interesting that the call to close the airport came directly from "Car 100" aka the ground crew. No stopping to report the incident to superiors or waiting for confirmation about what to do. The guy on the scene just says "OK, airport's closed now" and ATC immediately makes it happen.

That's pretty impressive in its own right, from an organizational point of view.

<comment><USER26> I thought the same exact thing. I wonder if maybe it's a trick of the audio (someone else actually came on the line), or if that was actually what happened. It was pretty surreal if so, just like you said.

<comment> jon-wood It sounds similar to manufacturing's authorisation for anybody to stop the line in the case of defects - its better to delay things for a short while and make sure everything is ok than it is to compound the problem by letting things continue. I imagine in the case of an airport with a plane stuck on the active runway this is even more the case, since the problem can quickly escalate into hundreds of people dying.

<comment><USER27> My glider club just had our annual safety meeting, and one of the things we repeat every year is that it doesn't matter how new or inexperienced you are, if you see something that looks unsafe, call it out or put a stop to things if you think it's necessary. Doesn't matter if it's your first day at the airport, speak up.

I imagine the same thing would be true here. If you think the airport needs to be closed, then close the airport. Doesn't matter if you just got hired five minutes ago for the lowest position in the whole place, if you think the airport is no longer safe then shut it down.

</comment></comment></comment></comment></comment><comment><USER28> I can't help but be reminded of Die Hard 2. [http://en.wikipedia.org/wiki/Die_Hard_2](http://en.wikipedia.org/wiki/Die_Hard_2)

<comment><USER29> More like Pushing Tin, a movie about ATC [http://www.imdb.com/title/tt0120797/](http://www.imdb.com/title/tt0120797/)</comment></comment>


Ask HN: I want to make an open hardware RNG, but I need driver/crypto partners - <AUTHOR>

I want to create an entirely open hardware and open software device to replace built in random number generators that we can't verify trust for.
I have a good understanding of how noise works. However, I know very little of cryptography. In order to do this, I'd need a partner capable of writing the driver, and ideally someone to validate my assumptions about randomness.
I've seen some stuff out there, but I'd really like to see something that is cheap and entirely open hardware and software.
My naive implementation would be to take a 10Mohm resistor across an instrumentation amp with high common mode rejection at 1MHz and use that to generate a digital representation of the johnson noise across the resistor (positive/negative). This is opposed to using the LSB on an ADC due to the speed issues.
Johnson noise increases in magnitude at higher bandwidth, so sampling faster is great, plus better for the computer.
I can also imagine a scenario where based on the bit you have a variable delay before sampling the next bit, which would defeat trying to bias it with strong fixed frequency external sources.
It seems that in firmware, the good hardware random number generators do things like hash the values, test them for randomness, and encrypt on the way to the computer, but that is all over my head (except maybe the hashing if it's a standard library).
So, if anyone has any ideas or knows a ton about this and would enjoy poking holes in my naive implementation described above, please do so! Low noise electronics is a huge hobby of mine, so I love geeking about the weird sources. I've built several EEGs and similar stuff for very high frequencies, and find it really intellectually engaging. If you'd also be interested in collaborating, maybe we can put together a kickstarter to try to make a fully open and transparent hardware platform and make them for others as well =) <comment><USER2> [http://www.fourmilab.ch/hotbits/](http://www.fourmilab.ch/hotbits/)</comment>


KONG Architectural choices: the API layer for microservices - <AUTHOR> http://blog.mashape.com/kong-architectural-choices-the-api-layer-for-microservices/

<comment><AUTHOR> A little bit more insight into KONG and why it's being built as a completely open-source project.

To be remembered that KONG is what has been driving Mashape [1], the marketplaces for API developers and consumers, forward.

The github repo is here [2] if you haven't seen it, please do contribute, comment or leave your feedback

[1] [https://mashape.com](https://mashape.com) [2] [https://github.com/Mashape/kong](https://github.com/Mashape/kong)</comment>


In Defence of WordPress - ezequiel-garzon https://ma.ttias.be/in-defence-of-wordpress/ <comment><USER2> I like PHP.

Right, yes, I know, that makes me crazy, but modern PHP is a fine language. HHVM, Hack, Composer, Packagist, the PSR standards: all of that comes together for a nice development workflow. PHP's shared-nothing architecture by default makes horizontal scaling an exercise in simplicity.

But: I don't like WordPress. Yes, it can autoupdate -- and that's certainly better than how things were prior, however WordPress' core code is horrendous. There's a reason why security issues are consistently found.

The bigger issue is the sorry state of most plugins; the bulk of vulnerabilities that end in compromise of WordPress sites are not from the core itself, but the plugins. An autoupdater for those certainly exists, but it doesn't help you if the people writing the plugins to begin with have no clue how to write not-insecure software.

These days, I avoid WordPress like the plague. When I do have to work with it, I've dragged it kicking and screaming into 2015: It lives in a Docker container, is fully 12-factor, completely managed through Composer (including Wordpress' core itself) and all code that I write for it is proper unit tested, PSR-4 autoloaded namespaced classes; this allows me to avoid crappily written plugins and rely on battle-tested libraries instead.

If and when it gets compromised, I can restore the Docker image within seconds, or lock it down as straight HTML by exporting it as a static site temporarily. WordPress can be decent if forced to be, but it's a lot of work and I'd much rather use something that doesn't have so much cruft clogging it up.

I mean heck; you still can't run the latest version of WP on anything other than MySQL, despite technically having a DBAL. Absolutely crazy, considering we have Doctrine or Propel!

<comment><USER3> Knowing about WordPress and the typical use case, what do you use instead?

<comment><USER4> Most people would be fine with a static site generator like Jekyll and a third-party commenting system like Facebook or Disqus. As a bonus, it costs pennies to host such a thing on S3.

<comment><USER5> > _Most people_

We in technology are not "most people".

<comment><USER4> Anyone who can manage a WordPress install should be able to get Jekyll working, but I'd like to see it get a user-friendly GUI that takes care of the grunt work.

</comment></comment></comment></comment></comment><comment><USER6> A lot of people here are talking right past each other.

Is it good that WordPress has automatic security updates? Yes.

Is it bad that WordPress vulnerabilities are still so common? Yes.

Are Drupal, Joomla, or Magento better at this? It sounds like the answer is probably no.

Does that excuse WordPress because it is better than other frameworks with marginal track records? No.

For such a widely used framework, WordPress' security record is dismal. Automatic updates are a great feature, but they don't replace the need for the framework to be a lot more secure.

For someone hosting their personal blog on a $5/month VPS this is probably good enough. For a bank to run WordPress is borderline professional negligence at this point [1]. A lot of the comments seem to be assuming that because the update was rolled out withing a few hours, that their window of exposure was pretty small. The window of exposure to WordPress vulnerabilities isn't from the time the patch is released until you are updated, it is from when an attacker discovers the vulnerability and you are updated.

[1]: [http://ma.tt/2015/04/a-bank-website-on- wordpress/](http://ma.tt/2015/04/a-bank-website-on-wordpress/).

<comment><USER7> Someone should do a study on where these security bugs are coming from. Are they in new features? Introduced from refactors of old code? Are they due to the plugin infrastructure? Is it all in old code?

<comment><USER8> The bugs are coming from everywhere.

In my view, the worst ones are the ones coming from core. They've come from old code (i.e. the comments XSS due to overly large comments) or from including other libraries (i.e. genericons vulnerability).

I think this sort of stuff is bound to happen since WordPress is slowly becoming the kitchen sink trying to keep up with all demands of the users.

The good part is:

* They are increasing their unit tests coverage.

* With auto-updates, the huge amount of sites that use WordPress are not left in the dark. So I consider it a feature even if it comes at a price. When the software is being used at the scale that WordPress is, it is a needed feature.

</comment></comment></comment><comment><USER9> So, your website can auto update itself. Know what that infers? A compromised WordPress instance can also update itself, to be whatever the attacker wants it to be. Hey, look, DB credentials as well, in an executable file (which can be "updated" right alongside the rest of Wordpress).

And how do these updates happen? Via a cron system, built into WordPress. It also has its own storage system (whose functionality can be altered at runtime by plugins), dynamic content management (via PHP (!) stored in the DB), its own networking stack, and more abstractions than you could shake a branch at.

Hell, I can't even figure out how to turn off cron requests (despite explicitly setting DISABLE_WP_CRON in wp_config.php). I block those at the nginx layer, but the noise is aggravating.

So many vectors of attack, so few ways to protect yourself.

<comment><USER10> > A compromised WordPress instance can also update itself, to be whatever the > attacker wants it to be

By this point, you're already on the other side of the airtight hatchway.

[http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...](http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/592350.aspx)

is a good example of this point.

The goal here is to avoid the compromise in the first place, so the attacker stays on the correct side of the hatchway.

There are plenty of logical reasons to hate wordpress, but I don't see that this is one of them.

<comment><USER9> > By this point, you're already on the other side of the airtight hatchway

Not really. Having the ability for a web process to write its to files which it then executes actually opens up whole new vulnerabilities. For example: one popular PHP exploit is writing a PHP file, then executing it on the remote system. Can't write a file? Can't execute the exploit.

Reading and executing PHP out of the DB, and also writing user input to that same database? Same problem. Triggering system-altering actions based on an unsigned token? That's a vulnerability.

Letting an application be able to do more on a system than is absolutely necessary to operate is a great way to give control and information over to others.

<comment><USER2> _> Not really. Having the ability for a web process to write its to files which it then executes actually opens up whole new vulnerabilities. For example: one popular PHP exploit is writing a PHP file, then executing it on the remote system. Can't write a file? Can't execute the exploit._

You're definitely correct, but there can be two different contexts to execute PHP; with differing permissions. If I was to rebuild how WordPress does it's autoupdating, I'd get rid of the god-awful HTTP "cron" crap, and have a proper PHP CLI that can do the updating, that runs on the server and is never exposed outside of it, and then WordPress itself, with the core outside the webroot and the uploads folder with zero executable permissions.

Still not perfect, but it'd be a hell of a lot nicer than how it currently runs.

<comment><USER11> Replacing the self-updating with an external updater does eliminate the problems with self-updating, but it's not a viable option for wordpress's primary deployment target of terrible shared hosting.

</comment></comment></comment></comment></comment><comment><USER12> Nice!

As much as Wordpress gets bad pub, there is certainly the open ways in which security is handled and patches are distributed. Far better in most ways to commercial CMS (and even some open source) where systems seem to run unpatched until a system upgrade or a security incident.

<comment><USER13> clearly some folks are downvoting because unpopular opinion.

Come on, folks.

<comment><USER14> Seriously! It's not even civil dissent, most of it is mean grandstanding.

Wordpress is ubiquitous. There are more technically challenged users than technically inclined. So here are your options - auto updates, or I'm guessing millions of outdated, incredibly vulnerable sites sitting on shared hosting boxes out there. I like my Webfaction account, I'd prefer the other tenants on my server to be as up to date as possible.

Just such unnecessary snark. The guy wrote a blog post. He's being skewered for it.

</comment></comment></comment><comment><USER13> Ok, I'll be the devil's advocate here. I hate Wordpress, I really do. But there is a reason it's so successful.

Show me another similar CMS (if that's what you want to call it) that's as easy to install and use, in any language or platform.

Django and DotNetNuke are the only ones I can think of that come close, and neither of them are as easy to install and work with as Wordpress. That's why it's so popular.

Sure most HN visitors are developers working with better stuff and wouldn't be caught dead using WP but if you're a non developer business person looking for a quick solution it can't be beat!

We should all be working on an easy to use, yet more secure alternative.

</comment><comment><USER15> People always beat up on software that has security vulnerabilities.

The thing is, the auto update feature is not an affirmative defense for the criticism. There are probably plenty of legitimate defenses out there - developing secure software is quite obviously something that is hard to get right.

But offering auto-updating is only a defense against arguments claiming that updating WordPress is a pain in the ass, not people claiming that the codebase has lots of security flaws.

You also can't use other software being garbage as a defense for why some other piece of software isn't garbage.

You have to evaluate the actual merits of WordPress in regards to the code quality, chance of being exploited, etc. It updating automatically when exploits are made public is not the same thing as not being vulnerable to frequent exploitation, nor are other frameworks failing in some other way exoneration for any failings WordPress might have.

To be clear: I don't care about WordPress, and do not have a stance on whether or not it's great or awful. All I know for sure is that it is certainly quite popular.

But this article is built upon a shaky premise and lots of logical fallacies. If you want to write about how awesome it is that WordPress auto-updates, then write about it. Just don't try to use that as a defense for criticism about other aspects of the codebase.

</comment><comment><USER16> I was never a big a fan of WP, but… I agree the ease of updates is an extremely important feature, especially for non-technical users. I'm working on a small conversion project migrating content from a Joomla site to Wordpress. The original site was running on Joomla 1.5 (Support for this version ended in Sept. 2012!). The upgrade path was too cumbersome so the clients just "took the risk". It was compromised several times but "cleaned up as best we could". Needless to say, we're ditching that server.

Still not a fan of WP self-installs, but hosted on WPEgine with smart tech support, automatic daily snapshots with the option for non-technical people to back up or revert the whole thing with a single-click is super simple. For added security and performance we'll be using cloudflare DNS, applied a plugin to hide any evidence of wordpress use and use just a few well-known and maintained plugins. Nothing is perfect, but ease of use, ease of upgrades and ease of maintenance go a loooooong way. It's mighty budget-friendly too.

<comment><USER17> What plugin are you using to "hide" Wordpress?

<comment><USER18> It doesn't matter because it won't help much, if at all. The script kiddies are running scripts that check for known files in several popular CMSs, so unless the plugin makes major changes to WP's behaviour, WordPress will still be findable.

<comment><USER19> Hell, I even had a non-important, BS Rails app get shut down on shared hosting (Webfaction) because someone tried random WP exploits on it (some plugin that accepted a POST and could be exploited via the payload). Rack stored the payload in a temp file and Webfaction saw the tmp file as a new file I didn't upload and suspended the app.

The first time it happened, I just deleted the file and went forward. The second time, I just deleted the app. I know I could write a script to deal with this, but it was just a test, playground type app. All it did was make me say I needed to move my "blog" off WordPress and stop trying to host Rails apps on Webfaction.

PS: The domain the Rails app was on had never hosted a WP site ever before. WP is just so ubiquitous that that they were just trying to hack any site -- even one that had like 3 organic visitors ever.

</comment></comment></comment></comment><comment><USER20> WordPress's code is badly designed and written in a language that I no longer believe serves the best interests of the Internet in general.

WordPress as a globally managed app is FANTASTIC. Automattic does a superb job of keeping on top of just about everything that comes its way. They do great work over there, and I'm really proud of that whole team.

<comment><USER21> > _WordPress 's code is badly designed and written in a language that I no > longer believe serves the best interests of the Internet in general._

It's 2015. This is not your grandparents PHP.

Besides PHP serves the largest website on Earth (Facebook) and a good 20% or more of the rest (via Wordpres, Drupal et al).

<comment><USER22> > Besides PHP serves the largest website on Earth (Facebook) and a good 20% or > more of the rest (via Wordpres, Drupal et al).

Popular != good. None of those points mean anything, PHP is still a badly designed language that lacks consistency and makes language designers feel like puking. It's a collection of hacks more than a language.

<comment><USER21> > _Popular != good._

That maybe so in pop music and matters of taste.

In the context of software, popular as in powering half of the web means stable, reliable and battle-tested.

That it doesn't satisfy some ideological purity doesn't mean much.

All languages have crappy parts, especially the more popular ones. C++ has a pile-on-kitchen-sink design, and yet it powers 90% of the desktop software world. C has horrible safety mechanism, and it rules in systems programming. Javascript, the other web darling, I won't even get into that. Java has all the legacy SDK crap and the needles boilerplate ceremony, and it just got closures like yesterday.

Sorry, but the world isn't built on Haskell and CL, and even less so in Dylan or whatever exotic thing you have in mind.

<comment><USER22> > In the context of software, popular as in powering half of the web means > stable, reliable and battle-tested.

No, it doesn't, it merely means popular.

<comment><USER22> Additionally, context is never relevant, popular doesn't mean quality in any context. Something can be both popular and quality, but popularity doesn't make something quality.

</comment></comment></comment></comment></comment></comment><comment><USER23> Let's ask one question: what CMS, CRM, programming language, operating system, etc doesn't come out with major security flaws every once in a while?

All of them, even OpenBSD. Software has bugs, and security flaws. It is not how buggy they are, but how well we patch them from a larger scale and that, WordPress does extremely well.

<comment><USER24> One of the biggest strengths of Wordpress is also a fatal flaw - <AUTHOR> flexibility of its plugin system, and how easy it makes finding and installing plugins and themes. Each is its own self-contained web application that runs with the same permissions as the application itself.

Yes, this applies to any open source application, but given how huge Wordpress' plugin landscape is, it's a big problem even if you assume the core application itself is secure (for the sake of argument.) Almost nobody pores over every line of code in every plugin before they install it (much less each update) - at best they just check to see if it has a high rating.

</comment></comment><comment><USER25> The article and many commenters miss a critical flaw: wordpress only auto- updates minor releases. 4.1.0 will be updated to 4.1.x, but not 4.2.x or beyond.

I built a WP site about 6 months ago on 4.0.x (current at the time), since then it has required 2 manual updates to get to 4.2.x.

As many others have noted, plugins are a bigger problem. They often break on new major releases and update less frequently. There is a lot good about wordpress, but the update cycle and security problems are a huge maintenance issue.

</comment><comment><USER26> What's up with this nag? [https://i.nyr.es/Captura-de- pantalla-2015-05-15-a-las-3.07.3...](https://i.nyr.es/Captura-de- pantalla-2015-05-15-a-las-3.07.37-CQGEkbBxnP.png)

Your site is a simple WordPress blog, I'm sure you can perfectly host it for $1/month.

<comment><USER14> Seems unnecessarily snarky, unless I should have read some implied smilie emoticon...

<comment><USER27> Not snarky at all. That popup was an unnecessary annoyance.

<comment><USER14> I feel like there's something about a mousetrap and a mouse here.

</comment></comment></comment></comment><comment><USER28> Updating plugins often breaks things. For instance, I updated our AD plugin for a company blog a few days ago and no one could log in. I had to do some research and eventually the plugin was rolled back from backup.

Can't wait to see what auto update breaks.

Not a fan of Wordpress. It's a lot more work than it's worth.

</comment><comment><USER27> So your point is that it does not matter that WordPress is a huge mess as long as it updates automatically?

<comment><USER29> No, my point is that not everything that WordPress does is _evil_.

Its auto-updates protect a very large part of internet-facing websites of getting hacked. And it's not something a lot of other CMS's have integrated.

<comment><USER9> Self updating requires overwriting its own files (or access to your FTP credentials). Enabling this goes against almost every website/server hardening guidebook out there.

It also requires allowing loopback HTTP requests in response to every incoming request to implement a pseudo cron system.

There's a good reason most other CMSes don't implement automatic updating.

<comment><USER10> If an attacker has code execution, I've already lost. Whether they have to inject it every time or can write it to the filesystem isn't really the point.

The current system is better than no automatic updates.

One that uses a separate user that has write access would be superior, but many users don't actually _have_ a separate user to cron that job as.

<comment><USER30> If the webserver can write to the web root, that means an vulnerability that allows arbitrary writing can be escalated to code injection.

In a same environment, the web user wouldn't be able to write to the file system at all, much less the web root.

Sanity being rate doesn't really justify only offering auto updates to the insane.

<comment><USER10> They created something that makes the most common sort of deployment more secure.

This is a net improvement and therefore entirely justified.

<comment><USER9> > This is a net improvement and therefore entirely justified.

The first does not imply the second. "Our bank is secure because we change out the locks every few days. To facilitate this, all of the locks have their screws on the outside - it was too much work to have someone around to open the doors for the locksmiths all the time."

Interested in hearing how many recent vulnerabilities in WordPress were prevented by not allowing arbitrary writes, whitelisting URLs, and blocking a whole mess of WordPress set headers?

All of them which have occurred in the last year. We've kept up-to-date with our updates, but every security vulnerability which has triggered a major or minor update was prevented not by WordPress updates, but by sensible system security.

<comment><USER31> I don't think anyone is suggesting that you should compromise your security to enable auto-updating. Automatic updates are never better than correct file permissions.

The point here is that a large number of WordPress sites _are_ running with file permissions such that the web server can write to the web root.

By trying to auto update, those sites with poor file permissions get a minor security benefit (shorter time between patch release and patch application) while all of the installations running with safe file permissions are entirely unaffected.

There's no downside to a secure site having the automatic update code. There's a small upside to an insecure site having it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> So what happened to Wordpress? Their slogan used to be "Code is poetry" and today they are the punchline of every bad code anecdote told.

<comment><USER33> The only projects that nobody ridicules are the ones that nobody uses.

</comment></comment><comment><USER34> I think Wordpress gets a lot of unfair blame. I often see the size of its code-base touted as one of the reasons to avoid its use. It seems the general consensus amongst a lot of developers out there is that Wordpress isn't OOP. Seriously when was the last time someone building a Wordpress website had to do anything outside of the wp-content folder? I have been working with it for like 8 years now. I used it before it even had half the CMS features that it has now. Making Wordpress completely OOP isn't going to make it any better than it already is, nor will it make more people visit your website or make you breakfast in the morning.

I don't care if the Wordpress code-base is a mixture of procedural and object- oriented PHP code, I use the hooks/actions system to change things, I never have a need to go into the wp-includes folder unless I am trying to work out how a new feature works that isn't fully documented (which is extremely rare). I also see people calling PHP a bad language because of the way Wordpress was built on-top of it, like some can't make the distinction between the language and the prolific CMS built on-top of it.

When a Wordpress website gets hacked, you know who should also shoulder the blame? The developer that set it up and or the server admin that setup the server. If you're setting up Wordpress on a server that doesn't have the appropriate folder permissions set, the wp-config file moved back one level from root (and thus not publicly accessible), you're using the default "wp_" database table prefix and you use FTP to move files to and from the server because setting up SSH access intimidates you, then it is your fault as well. A properly secured Wordpress installation is very difficult to attack. Sure it doesn't protect you from all attack vectors, but it goes a long way. Making sure your username in Wordpress isn't admin always goes a long way. On all Wordpress sites that I monitor I see numerous brute force scripts being run trying to guess the password for a user named "admin" jokes on them, no such user even exists, so they just instantly IP banned (which is annoying because some seem to cycle through thousands of IP addresses). Running an old version of Wordpress and you get attacked, is it Wordpress' fault or your own?

People love to bash Wordpress, but you want to know the harsh reality? There is no better alternative (trust me, I tried looking once, I legitimately spent weeks trying alternatives and found nothing better). Wordpress is the number #1 CMS because it is the best, regardless of its code-base, nothing else compares. Some people will try telling you to use Drupal, but they generally don't know what they are on about. "Oh, don't use Wordpress it gets hacked all of the time" \- no, it doesn't. Your lack of technical competency is the reason you get hacked all of the time. A bad workman blames his tools.

My personal blog gets 3k hits per day, I see numerous attempts to hack my site and in the 5 years I have been running Wordpress on my personal blog alone, I have never been successfully hacked once. Because I don't just set Wordpress up using the default settings, I use strong passwords, I use unique usernames, I lock file and folder permissions, I move credentials out of the root directory.

Wordpress is slightly cursed in that it has a low learning curve, it makes it incredibly easy for just about anyone to setup their own self-hosted Wordpress installation. While exploits are not the users fault, a lot of the most common hacks you see on Wordpress were in part due to the fact the user kept a default setting or set something up incorrectly.

The auto update functionality is great in Wordpress, I don't think this feature alone is a big selling point for the CMS. The auto-update functionality in Wordpress doesn't always work, but it is better than nothing. As the author points out, particular Drupal and Magento are both so complicated (even though they have clean code-bases) that they make it difficult to perform updates or do basic tasks people take for granted in Wordpress.

Compared to the number of times I have been infected with malware and viruses over the years as a Windows user (many times due to my own fault), Wordpress does not even register on the Richter scale of insecurity and annoyance in comparison.

Lets start taking responsibility for our own actions, developers. We can't blame PHP and Wordpress for all security issues. Somewhere along the line you need to make some effort and not assume a CMS or framework has your best interests at heart or has covered every possible angle.

</comment><comment><USER35> Yawn. More excuses for using a big old pile of spaghetti code with no testing or dependency management. Auto-updates? big deal, any decent framework can roll out updates on composer.

<comment><USER29> Yet here we are; \- Drupal 7: manual updates, or funky drush commands \- Magento: requires running shell scripts (!!) to patch at the CLI \- Joomla: no auto updates \- Typo 3: no auto updates \- ...

Composer helps, but it helps developers. It does not help the average user that has no clue on how to apply those patches.

People download a CMS from the internet, throw it on a cheap host and expect it to work. Updates? What are those?

<comment><USER35> And that's the problem they shouldn't be doing that. Hosting a website is not a fun weekend project you get from Target/Walmart as a DIY kit.

People wouldn't be happy if I started building my own car to just drive around where ever I felt like, making it 'easy' and 'safe' to just throw up a website anywhere is an excellent way to get hacked.

<comment><USER21> > _Hosting a website is not a fun weekend project you get from Target /Walmart > as a DIY kit._

Why? It's not like most websites are mission critical.

Heck, even if a major business website went down for a couple of days, it wouldn't be that much damage anyway compared to other things that can and regularly do happen to the supply chain or market...

> _making it 'easy' and 'safe' to just throw up a website anywhere is an > excellent way to get hacked_

Yeah, and so? Getting hacked is the end of the world?

<comment><USER35> For Mummy-blogger's site about how awesome her kid is? Probably not the end of the world, expect that now her site is sending spam and hosting malware. You'd be pissed if your neighbour left their house unlocked while they went on holiday and it turned into a crack-den.</comment></comment></comment></comment></comment>


ShowHN : Blib (pre-alpha); A privacy friendly media library in the making - <AUTHOR> https://register.blib.us

<comment><USER2> Nice Photo Album demo.</comment>


Vue vs. React - <AUTHOR> What is your favourite framework for tackling frontend web development projects - Vue or React? <comment><USER2> Vue is easier to get started with. React has more jobs [0]. They are both good choices and have a lot of community support.

[0] [https://www.hntrends.com/2020/may-big-drop-developer-job- pos...](https://www.hntrends.com/2020/may-big-drop-developer-job- postings.html?compare=React&compare=Vue&compare=&compare=)

</comment><comment><USER3> I picked Vue because I didn't care for JSX. Vue and React seem very similar conceptually but I don't have a ton of experience with React. I think they're both good choices. Vue has gained a lot of traction with Laravel developers which might influence your choice if you decide to use PHP and or Laravel.

</comment><comment><USER4> Started with react but never got into it enough to finish anything production- ready. Then get hooked up with the Vue and now working with it for like 4 years now.

I've even wrote a note about it: [https://lukaszkups.net/notes/thanks-to- vuejs-ive-found-front...](https://lukaszkups.net/notes/thanks-to-vuejs-ive- found-front-end-development-fun-again/)

</comment><comment><USER5> I personally found vue to be much easier to pickup compared to React so I would pick vue. But React is good enough as well I am sure.

<comment><AUTHOR> nice - thanks for the comment!

</comment></comment><comment><USER6> Used both for years in production. Maintain several core Vue libraries. Honestly I am happy with both - much of a muchness really.

</comment><comment><USER7> React, but that's a fluke. I learned it first. I don't see much advantage for me personally going and learning Vue.

</comment><comment><USER8> Expand your search. Our team evaluated react and Vue a year ago . We ended up choosing Svelte. We love it.

</comment><comment><USER9> Recently I've really been enjoying Vue. It feels lightweight and I feel like I have finer control over application state, flow, and UI. I like React too but I feel like the component lifecycle is a little more opaque and some bugs slip through. React hooks have certainly alleviated some of this.

</comment><comment><USER10> I like both, seriously. I have done projects in both. I would say the learning curve is steeper in React so if you have to pick one to get up and running fast maybe Vue is the better choice.

I liked learning Vue, but not so much learning React. But once it clicked with react it became my favorite.

<comment><USER11> Is either one any easier when migrating an existing web?

<comment><USER12> Vue is much easier in that sense. You can just import the library using <script src"<<vue cdn addr>>"></script> and you can start using vue right there.

</comment></comment></comment><comment><USER13> A matter of taste, but I really enjoy vuejs state management with vuex.

</comment><comment><USER14> I prefer vue because I'm not a fan of JSX in React and it's not made by Facebook. But it's pretty much the same.

</comment><comment><USER15> React - the era of Hooks.

Vue - not very used to the template syntax.

</comment><comment><USER16> react and vue.

<comment><AUTHOR> haha thanks</comment></comment>


Ask HN: How can I motivate my talented dev to give a shit? - <AUTHOR> I've read a dozen articles on motivating developers. I give him lots of space to work, freedom to pick his own features to work on. I've read "Peopleware" cover to cover.
We are a small distributed team (2 devs and myself, product owner + design work). He and I work in an office together. He has no real set hours, just that he gets stuff done.
Lately it's been more and more time on facebook/twitter even though we have a release in less than a week.
He has no equity stake in the company, but a slightly above average salary for our area. He is a recent college grad.
He's a very talented developer when he works, but I'm getting maybe 50% from him.
What can I do? <comment><USER2> I'm part of a remote team, and have had my share of difficulties with motivation.

As best I can, I've listed broad categories of what demotivates me:

First, lack of clarity of what the next task to be completed is, and a perplexing reluctance to simply ask.

Second, a task in front of me that is too large to attack at once and for which I haven't found an angle from which to attack it.

Third, something else is temporarily much more interesting/threatening than work. Facebook and Twitter can be interesting, but I find if I'm spending hours on them it's to avoid something, not because I'm enjoying it. So it's unlikely something temporarily interesting.

Fourth, there's that "wait a second, we're doing this wrong" feeling, which if it's leading to a drop in productivity is probably followed either by "I don't know what the right approach is" or possibly "the right approach is so different from what we're doing now that soon we'll be screwed." The developer senses an impending technical dead end.

Finally, there's disillusionment with the overall goals of the job/company. A "we're doing it wrong" but on a more fundamental level, followed by either "there's no way I can convince the company to do it right" or "I have an aversion to the core business we're in". The developer senses a dead-end job- or lifestyle-wise.

Regardless of which flavor of problem it is, I think mcherm pretty well nailed the solution.

EDIT:

Another possibility is that your developer has been assigned something he hates and is hoping that by avoiding it long enough it will go away. This is a particularly easy and self-destructive (usually) pattern to fall into.

</comment><comment><USER3> Different techniques work with different individuals. If I were that developer, then "level with me" would probably be the best approach. "Hey, Michael: lately you've been spending lots of time on Facebook/Twitter and we have a release in a week. I'm worried. What's up?".

<comment><USER4> I am a developer and I definitely agree with the above.

The reason your programmer is not motivated anymore is because he doesn't care. This does not mean that he will never care, just that he does not care right now.

So how do you get him to care? Talk to him directly. Be clear about what you want (his commitment to the work that you are paying him for) and find out what he wants. Then, assuming he is being reasonable, find a way to get him what he wants provided that he is providing you with quality work.

What motivates me personally? Learning new technologies, interesting projects, financial rewards for good work, and knowing that my employer cares.

I start to lose motivation when I've learned the new techs that my job calls for, when the projects begin to get stale/repetitive, when I start to feel like a cog in the wheel of a machine, and when raises come too slow.

There could also be something wrong in his personal life or maybe he has a new obsession (girlfriend, video games, new social circle).

I hope this gives you some perspective. Good luck.

<comment><USER5> There are all sorts of possibilities - in the past I've had trouble with motivation when my employer has insisted on doing things in a stupid way for no reason, or when their development methodology boils down to "I don't know what I want... but that's not it! work harder!"

Bottom line is that your dev isn't happy. Why isn't he happy? That's for you and him to find out - and be prepared for it to be your fault.

</comment></comment></comment><comment><USER6> You describe yourself as the "product owner". And the dev has no equity. Maybe he feels he's doing all the work and you gain all the benefits. You should offer him some equity, ownership is a great motivator.

<comment><AUTHOR> I tried offering equity and a slightly lower salary (20%-range lower), and then an option for no-equity but higher salary. He took the higher salary option, though I was hoping he would take the equity option.

I could revisit this with him...but I have a feeling it's not super important to him, money doesn't seem to be a huge motivator.

<comment><USER7> You offered him 20% less money and some percentage of nothing? Are you really shocked he didn't take it?

If it wasn't your company, would you "spend" $15,000 on the equity you offered?

<comment><USER8> Exactly. Every startup I've worked for the owners have this weird attitude that their equity is worth something. It's not. It's worth jack shit until the company is worth something. It doesn't pay bills. It doesn't let me buy the new shoes I want. It's essentially an investment. Usually if someone is in the position to invest, they don't need to work a day-job to cover bills.

<comment><USER9> Ahem, it's not a "weird attitude" to offer less salary in return for equity. Of course equity is worth something.

</comment></comment></comment></comment></comment><comment><USER10> I'm suffering from a quarter life crisis (I'm 20.) I think a lot of people do. They just never talk about it.

It takes different things/approaches to motivate people. For me, inspirational speeches work really well or knowing that your manager is actually interested in your work.

However, it does sounds kinda odd that he didn't take the equity... He might just be an immature person that doesn't want to take responsibility. And this could be for various reasons completely outside the work environment that you have very little control over.

I think that just talking to him and asking what's up and what's going on is the best solution. Maybe he just needs a wake up call? The sincere, "I'm worried. What's up?" usually works pretty well?

<comment><USER11> It's sloppy thinking to equate taking equity and showing responsibility. There are plenty of reasons to turn down equity in favor of a higher salary, and many of them have nothing to do with a lack of responsibility.

That said, I agree that talking to him is the best solution, at least for a first step. If nothing else, it shows that his output is noticed, and that what he does is important. Even if he doesn't give you a solid answer to the ? "What's up?", he knows that you've noticed his output tailing off. This gives him a good chance to self correct, and can avoid a more difficult conversation down the road. Plus, these conversations are far cheaper than an equity grant or a raise. Talk to the kid and see if things clear up in a couple of weeks.

</comment></comment><comment><USER12> You say that he has "no real set hours, just that he gets stuff done": is he getting stuff done?

If he isn't getting the expected stuff done, then that is the discussion you need to have.

If you aren't happy with the amount of stuff you are expecting then discuss that.

Some days are productive and some days aren't (and I find unproductive days tend to follow really productive ones). Try and view it purely from an output point of view, and not what his method is.

</comment><comment><USER13> \- Put some rules on twitter/facebook. For example (I think) PG has a separate computer to browse the web. He has to seat in another chair to do that.

\- Understand why he is having trouble focusing. Does he have impediments and he avoids them by going to twitter/facebook ?

<comment><USER14> "Putting rules on things" is the path to the dark side - aka corporate proxies.

<comment><AUTHOR> Exactly...I don't mind facebook or twitter at work. Heck, I spend a good 30-45 minutes a day there. That's normal.

The problem is when it's 80% of the day, and that's where we seem to be at this week.

</comment></comment></comment><comment><USER15> Have you tried putting some deadlines on his tasks? Get him to commit to some deadlines for his tasks, obviously made with his input.

It's my experience that a lack of deadlines and a bit of interest from someone monitoring the progress, can lead to a state where a task seem unimportant. It's a bit weird, and I can only guess at what process is at play, but I have seen this effect in otherwise great developers.

<comment><AUTHOR> We do essentially weekly sprints and he presents at the end of each week the progress made.

<comment><USER16> Just because you have weekly sprints doesn't mean the developer can't show their work more often (you just don't have the right as the PO to interrupt a developer).

I think at PivotalLabs, they have the PO's sitting near the developers.

Also, perhaps, during your iteration planning meetings, try and break the stories into tasks that feel like they are less than a day.

Also, listen more carefully during the daily standup/meeting. If the "what I am doing" is not one of the tasks or on the current log, maybe ask why. Whatever they are doing, add it to the tasks (if that really should be done).

If the answer to "what is inhibiting you" is "nothing" but the "less than" one day tasks are not complete then there is something inhibiting the developer(s). It is your job to make sure that whatever is causing the developer to fail meeting the commitments is fixed. Could be bad estimation on everyones part, could be that tasks feel overwhelming (as other people pointed out), could be the developer(s) are just not interested.

All of those are fixable.

</comment></comment></comment><comment><USER17> It has been my experience that most college grads still need some basic rules and guidelines. Fresh out of college, you think you know it all, right? It's a generation Y thing, which asks for a little adaption on both sides...

<http://en.wikipedia.org/wiki/Generation_Y>

</comment><comment><USER18> I think the best thing you can provide is something you can't actually provide.

The feeling of being part of something. If I were a rockstar hacker I would want to feel this project was something that could blow up, otherwise it would simply be a stepping stone for better things.

Best thing you could do personally is have a chat with him.

Best of luck.

</comment><comment><USER19> If you want him to 'really care' give him some equity or stock options. If he is as talented as you say he is then he can probably make more money elsewhere. If, however, he has equity then he actually has something to gain by working hard instead of simply not losing his job.

</comment><comment><USER9> I've done a "developer poll". Email all developers: what's the best and worst thing about your job right now?

Then fix his worst thing, and have a talk with him about how much you appreciate this work.

</comment><comment><USER20> He's probably suffering from a quarter life crisis. A common thing in generation Y.

</comment><comment> no-go-mojo He isn't enjoying certain aspect of the job.

</comment><comment><USER21> If your developer is not motivated to do a good job he is not talented. being a good developer is more then just having the ability to comprehend the principles behind software design its about being able to make those principles manifest themselves in working product. I think the real problem you have is a poor developer that has convinced you he is good.

<comment><AUTHOR> No he's good. I've hired/fired devs before...I have no plans on firing him. I just need to tweak....something.</comment></comment>


Why Game of Thrones Episode 8.3 Was Objectively Bad - <AUTHOR> https://retina.ai/blog/game-of-thrones/ <comment><USER2> I have a simple argument and the time will show if it is true.

The streaming wars are comming and HBO desperately needed Game of Thrones franchise - prequels, spin stories etc. GoT had been driving subscriptions of HBO.

Unfortunately producers have droped the ball in the last seasons and alienated many many GoT fans judging by reactions. [1][2]

This is simply significantly diminishing the value of HBO.

[1] [https://www.change.org/p/hbo-remake-game-of-thrones- season-8...](https://www.change.org/p/hbo-remake-game-of-thrones- season-8-with-competent-writers)

[2] [https://www.economist.com/graphic-detail/2019/05/17/how- unpr...](https://www.economist.com/graphic-detail/2019/05/17/how- unprecedented-is-the-decline-of-game-of-thrones)

<comment> ga-vu Oh yea... D&D should have just passed the season to new producers and move on to other projects. They effectively killed GoT and HBO at the same time. And I expect fans to sabotage their Star Wars films as payback.</comment></comment>


Ask HN: If you work in Bay area, how much time do you have to pick up new tech? - <AUTHOR> For example, deep learning. I think everyone I know has the intention to eventually pick up machine learning (which nowadays is deep learning pretty much exclusively). But MOOCS and random blogs, with cloning repos to look at them, rarely gets you there.<p>I guess the main problem is that most people don't have time. Could you dedicate 10hrs per week to this? 20? Would your coworkers or founders think you are slacking if you devote this much time to something other than making the company you are at win? <comment><AUTHOR> I ask for Bay area, because in mostly any other location people work shorter hours and 10-20hrs/week outside work picking up say deep learning may even go unnoticed (Eg EU). In the Bay area, mostly everyone is working at peak conditions, right?</comment>


Alan Kay – millions of people had already seen what Xerox PARC showed Steve Job - <AUTHOR> https://www.quora.com/What-was-it-like-to-be-at-Xerox-PARC-when-Steve-Jobs-visited?share=1 <comment><USER2> Its time Xerox gets the credits it deserved. Turns out Apple is a great copy cat company with just the best marketing there is.

<comment><AUTHOR> I think the point of the quote is exactly the opposite.

Out of the millions who were aware of the innovations at xereox parc, only Apple took those ideas and made them into a product that consumers wanted to buy.</comment></comment>


Ask HN: How to gather early adopter customers for mobile project?  - <AUTHOR>

Hello,
I will soon start work on a side-project that involves building a app to allow users to share messages about a specific "vertical" with each other. ( I know this is a pretty vague description - I plan to present it to hacker news after getting it to beta stage).
Challenge: How do I make the app popular? Specifically, how do I get the initial adopters? I believe that once we get critical mass and power users on board, then network effect will take care of ensuring that more customers come on-board.
But how to get the early adopters? Any suggestions?
There doesn't seem to be a clear answer about how instagram accomplished it: http://www.quora.com/How-did-Instagram-get-so-many-users-so-quickly http://www.quora.com/Instagram/How-did-Instagram-get-its-first-25-000-signups
Thanks, Dhar. <comment><USER2> A good starting point is to make sure that your app is optimized for App Store SEO. Here are a few articles I would recommend:

[http://searchenginewatch.com/article/2169475/4-Ways-to- Help-...](http://searchenginewatch.com/article/2169475/4-Ways-to-Help- Consumers-Discover-Your-Mobile-App)

[http://searchenginewatch.com/article/2152859/App-Store- Optim...](http://searchenginewatch.com/article/2152859/App-Store-Optimization)

[http://techcrunch.com/2012/02/28/aso-app-store- optimization-...](http://techcrunch.com/2012/02/28/aso-app-store-optimization- is-the-new-seo-and-heres-a-tool-to-do-it/)

<http://www.slideshare.net/kolinko/app-store-seo-tutorial>

</comment><comment><USER3> Look through these: [http://www.ideaoverload.com/Find-ideas/Finished- ideas/Media-...](http://www.ideaoverload.com/Find-ideas/Finished-ideas/Media- about-sales-marketing/)

(including: Kevin Rose - Taking your Site from One to One Million Users)

</comment><comment><USER4> Contact people in that niche and ask them for their input. Maybe have a list of credits and offer to put their name in there.

Feed into their ego, make them feel special and they'll be more likely to spread the word when you tell them it's done.</comment>


Meritocracy: Mission Accomplished? - <AUTHOR> http://chronicle.com/blogs/innovations/meritocracy-mission-accomplished/27660

<comment><USER2> As someone who has spent three years working with kids who grow up in economically disadvantaged situations, I have to say that it takes more than parental encouragement and talent to be able to qualify and successfully complete a high level academic degree. There are so many obstacles for kids growing up in economically depressed areas. Anyone who survives the environment of growing up very very poor is ten times more valuable as a member of society over someone who was "legacied" into a university.

When people like the Obamas or any of the other successful people who grew up in disadvantaged situations actually make it, they inspire many more people who are currently struggling to keep fighting until they accomplish their dreams.

A big motivator for me to get off my couch and chase my dream was because of my experiences working with these kids. Many of them are so talented and work so hard in spite of the difficulties they face. It made me realize that I had no excuse to just sit by and watch somebody else build my idea.

</comment><comment><USER3> "On the math and verbal SAT (a 400-1600 scale), the least socioeconomically disadvantaged student is expected to score 399 points lower than the most advantaged."

Many people that are successful have a successful mindset as well. Did they also look at the disadvantaged student's home life? Do they have two parents at home encouraging them to succeed?

I would also be interested to see what their education was like. If they want to a terrible public school, they will most likely score less on the SAT.</comment>