Ask HN: How does a 3 man consultancy land projects, not just contracts? - <AUTHOR>

The short version is : We're in a situation where we have no problem landing short term contracts, but are having trouble finding a project that will let us scale, ideally we'd like to have a revenue stream that lets us dedicate a good portion of our time to building a product.
I'm sure a bunch of you have been in similar situations and I'd love to know what else we could be doing to move to the next level, in addition to trying to leverage our network (which is good for short term projects but not larger ones) currently we're:
Building useful things and releasing them for free : https://chrome.google.com/webstore/detail/trello-card-dependencies/ddhnhdoghhfoeceiohphmjkcemlkkock Lecturing at local universities Sponsoring and organizing a local meetup Talking to people who have done this
This is an extension of the last point, I'd like to hear from anyone that has insight. I can't find a sort of job board but for small contracts of this type, is there a name for agencies that would know of these types of engagements etc?
Thanks in advance ! <comment><USER2> I'm going to assume web consultancy here.

The main influence on the kind of contracts you can get is the way you market yourself.

Don't market yourself as a 3 man team, market yourself just as a consultancy, don't explicitly state the size. Have a nice portfolio and people will just see what they want to. If you can complete the work asked for then I wouldn't see this as an issue, although some people would.

Some good contracts to start with (at least in the UK), are small government tenders. I don't know where you're from or what the system is like there.

Also try target more upmarket clientele. Law firms etc. Instead of charging a large fee for the work, charge a smaller fee but have a recurring monthly support cost. If they want the site updated do that, if they have some small feature to add, add it (within reason, some clients will try take advantage of this).

<comment><AUTHOR> You sound like you've actually done this and yes we're in the UK (London), my email is in my profile so if you're interested I'd like to chat with you

</comment></comment><comment><USER3> Sorry, this is a long rant ... and I dont really have time to finish it but thank you for sparking things...

I am in a similar position, (although the "no problem getting contracts" is a bit of stretch), a few miles south of you in Kent.

I have a vision, of an eco-system of small independant Open Source developers building, integrating and supporting local and central government software. (Yes, government)

I have a tiny campaign site at www.oss4gov.org/manifesto and there is a community of OSS developers but the love they get from the billion dollar government market is tiny.

Why .gov? I do not want to write another website for some marketing agency, I want to write actual software, and I want to write software that has an actual impact on my community.

For example, West Lothian wants an "Election Management System" (#). This is basically to take the poll register and do everything from orgnise rotas of poll-helpers, send out the voting cards, and so forth. Its pretty boring I suspect but it is clearly something that only governments need. Is there an Open Source version? Not that I can find. Is it possible to persuade West Lothian to pay for the development - well I am trying but they state right up front - must already be in use in another council, tried and tested. THis is for software that runs _elections_ \- what the hell are proprietary software companies doing in there? If any code should be public and open it is code that runs elections.

There are thousands of government services that have no or terrible IT, that do not interoperate and yet GDS states that the government _prefers_ OSS, that GCloud is for open, small businesses. The rhetoric is good, the reality of risk-averse tenders is much much different.

Somewhere along the line we can see governments stop pouring our money into proprietary code that only serves public uses and start seeing small local consultancies, feeding on a eco-system of open source code and delivering great custom services to government that just keep getting better, for a decent living wage. (well hopefully better than that)

Bugger it, I am going to release my best shot at an election management system, and force it into the cracks. There is a lot of money and a lot of worthwhile projects behind that wall. Despite the 30% cut in services.

It is a project with real possibilities

\- International elections ([http://aceproject.org/today/feature- articles/open-source-sof...](http://aceproject.org/today/feature- articles/open-source-software-and-the-electoral-assistance))

\- There are organisations doing _something_ like this ([http://blog.openelections.net/](http://blog.openelections.net/))

(#) [http://www.publiccontractsscotland.gov.uk/search/show/Search...](http://www.publiccontractsscotland.gov.uk/search/show/Search_View.aspx?id=MAR170132)</comment>


Scramble.io: secure email for everyone - <AUTHOR> http://dcposch.github.io/scramble <comment><USER2> Another week, another Javascript cryptography project. See:

[https://news.ycombinator.com/item?id=6637915](https://news.ycombinator.com/item?id=6637915)

[https://news.ycombinator.com/item?id=6420739](https://news.ycombinator.com/item?id=6420739)

[https://news.ycombinator.com/item?id=6353137](https://news.ycombinator.com/item?id=6353137)

[https://news.ycombinator.com/item?id=6317685](https://news.ycombinator.com/item?id=6317685)

(That's just the last few weeks).

 _We are also developing a browser extension which will verify the Javascript loaded from the server. (Until then, an attacker who gained control of a server could tamper with the JS to steal a user 's credentials the next time they log in.)_

Baffling. If you're going to build a browser extension, _put the crypto code in the extension_. This still isn't a great solution, but it's better than trying to "verify the Javascript code". How exactly do you plan to do that? Surely you realize you can't just digest the JS asset files.

<comment><AUTHOR> Yeah, I read your Matasano post, "Javascript crypto considered harmful", and I agree-- Javascript crypto is hard!

But it's not impossible.

The reason I chose that route is because I want to make it as easy as possible for users to try out and adopt. Just testing it out? No installation required.

I think that security is at least equal parts a technical problem and an adoption problem. The status quo is that nearly all email is searchable plaintext as far as strong adversaries are concernd. I want to fix that.

> If you're going to build a browser extension, put the crypto code in the > extension.

The hard part is running known, trusted JS. Simply packaging the same HTML/CSS/JS as a browser extension was certainly my first impulse! The issue then is that you can never ship an update--users must proactively upgrade-- unless you have an auto update mechanism for the extension (eg, Play Store) at which point you're again at the mercy of the server, no better than a web app.

Once you get trusted code running on the client, you can bootstrap. The system I envision is as follows: you, a power user, download the browser extension. You verify the signatures. There are multiple signatures--not just my own--so that no one party can release a tampered client. A set of independent, trusted organizations around the world must sign each release. Let's call them the Signature Committee.

The browser extension simply contains the public keys of each member of the signature committee, and a small bootstrap loader. When you run the browser extension, it gets the latest assets from the server, along with a signature file---and it checks that enough members of the signature committee have signed them.

You know have trusted code, but the developer can still--with the consent of the signature committee--push out updates.

I think that the Signature Committee concept has very cool properties. Currently, even security-critical client applications--for example, the Tor Browser Bundle--are usually only signed by a single organization--in that case, the Tor Foundation. Given that governments have shown themselves willing to coerce organizations to conspire against their users, and to do so in secret, we need something better. I envision a future where Scramble keeps improving continuously, but no one organization--not even any one country--can unilaterally ship an update.

Thanks for your feedback!

<comment><USER2> It is impossible. The features required to make browser Javascript safe for crypto aren't even on the roadmaps of browser vendors.

Your reason for using browser Javascript for crypto --- here, Recurity's JS PGP implementation --- is the same as every other JS crypto project's reason: doing everything in the browser makes it easier for users to adopt your project. You are not the first person to point this out and you won't be the last.

The problem is, you acknowledge one side of this design ("it's super easy for users") and ignore the other (" _it 's fatal to security_").

Here, you even acknowledge that there was a simple mechanism available to you that might have marginally improved security (packaging the whole application as a Chrome extension). But that made your life too hard! So you abandoned that idea and just made all the crypto downloadable from the server on HTML pages!

<comment><USER3> Perhaps I'm ignorant, but I've read your "JS crypto considered harmful post" and I disagree with the key points.

1\. Browsers, at least the ones that matter, provide window.crypto (with a CSPRNG). This makes generating IV's for CBC "safe," makes generating RSA keys "safe," makes generating random keys "safe." Or am I missing something? Assuming the JS crypto code itself is actually sound, the PRNG seems to be the missing link...or at least, it was.

2\. Packaging the _entire app_ as an addon (assets, javascript, views, _everything_ ) means the app can be signed and verified. No in-app code updates. If you want an update, download the latest extension. The article assumes that people will do what OP is doing: downloading code and running it dynamically. I agree this is a no-no, even if verifying.

Is there some sort of attack vector I'm missing? I think it's fair to assume the browser is an attack vector, just like hardware is, just like the OS is, or whatever language VM you're running on, etc...but that seems tangential to the process of packaging/signing an entire javascript app and distributing it as an add-on. I also know about the unsafe memory stuff, but this just brings browser encryption down to the level of Python/Ruby/etc. I'm not dismissing this concern, I'm saying that if you're attacking javascript for having this vulnerability, you must also attack any GC language (which you do in the article).

How is in-browser encryption so different from any other java/python/etc app when packaged/signed? I'm not talking about replacing SSL, I'm talking about encrypting data via AES/blowfish in a browser extension with a key generated from a password, and if the data leaves the browser, using SSL on top of that.

What makes it impossible to do this and gain the same level of security as any other language/platform?

<comment><USER2> We are not talking about crypto done in browser extensions. We're talking about a project that knows about extensions, knows how to package their project as an extension, but _refuses to do so_ , because that would cost them users, who generally don't want to install extensions.

<comment><USER4> Let's try to keep things friendly, or at least correct. We haven't refused anything. Everything is on the table.

<comment><USER2> Your partner, just upthread, explained why you tabled the idea of using a browser extension to house all the logic for your app. I think your argument is with them, not me.

<comment><USER4> You falsely accused us of refusing to offer a browser extension for fear of losing users. Again, that is false.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> It's nice to see so many projects attempting to solve this problem. I have a question specific to the documentation on the main page:

 _Private keys are stored on the server in encrypted form. The key derivation function used is as follows:_

         K = scrypt(Passphrase, Username)

I'm going to skip the "JS crypto is bad".

What I'd like is clarification of the _Zero Knowledge_ section that the keypair is decrypted client-side only and the passphrase is never transferred to the server for any reason. This is important because a state actor or other person with sufficient influence--such as a big wrench--could intercept this via code installation on whatever servers perform this work.

There's still the issue of JS being modified by the same evil actor (which you mention), and I'm not sure if signing with a browser extension is much insurance (that's just replacing code that can be modified in transit/on update with other code that can be modified in transit/on update), but with so much attention being paid to this problem as of late, an adequate solution will be discovered (if it doesn't exist already).

<comment><USER6> Even with the brute protection provided by scrypt, it's very worrying that you can assume the encrypted private key will A) Be available to authorities via (secret) court order B) Captured and stored by NSA types. The security of the key could only be assumed to be as high as the weakest passphrase ever used by the user. With what we know about most user's password security (especially the type not already capable of using GPG, which would seem the target market of this) this seems like a very bad idea.

Why go through all the trouble of attempting strong client side crypto, only to store the private key secured only by a passphrase on the server?

<comment><USER2> Because only a subset of possible users has clientside storage available for keys, and this project doesn't care about security, it cares about maximizing the number of users it can obtain.

<comment><USER6> This whole thread makes me sad...

</comment></comment></comment></comment><comment><USER7> I understand the attraction. You want to solve this problem as if it was just a straightforward hack. I spent a few days looking at this same problem (harpomail.com) and abandoned it because, in then end, It seemed like I could only provide a false sense of security to people who could conceivably lose their lives because they trusted me.

If it had just been a technical risk or a financial risk to myself I would have pursued it, but some risks are heavier than others.

</comment><comment><USER8> Cool, this was the architecture I sketched in my head for a user-friendly PGP app, although I would have offered to sync the private keys between device clients, rather than doing it all in browser (that way, someone can opt out and keep a key just on their phone or whatever.)

I had a damn good name, too, but good job someone else did it so I don't have to! :)

</comment><comment><USER9> Encryption done in the browser?

Why would you take that risk and not encrypt in a client using GPG?

</comment><comment><USER10> Fantastic. Tighten up the user interface and this should gain traction. Checking out the Github repo now.

<comment><USER11> Working on it! New interface should be out in the next few weeks. Check out the "frontend-makeover" branch if you are interested.

<comment><USER10> Sounds great. I'd love to contribute to something like this.

</comment></comment></comment><comment><USER12> so, you want to send someone a message. you don't care if someone sees you sending it. but you don't want anyone to know whom you sent it to, or what the message contains.

      requirement 1. message integrity and security

      1a. use public-key cryptography
        - step 1. Person A writes a letter to Person B.
        - step 2. Person A encrypts a message using Person B's public key.
        - step 3. Person A sends encrypted message to Person B.
        - step 4. Person B receives and decrypts the message using Person B's private key.

      requirement 2. clandestine recipients

      1a. coded messages
        - con: coded messages are usually broken after enough messages pass

      1b. steganography
        - not difficult to detect if messages sent often

      1c. dead drops
        - pro/con: MITM has to monitor the drop box to determine recipient

      1d. peer-to-peer message passing
        - can still determine recipient using statistical analysys

i think if you took the tor model for private services and removed the open circuits, and added a more evenly-distributed constant stream of garbage messages sent to random peer addresses, it would be much less likely that any one message could be linked to any two nodes with certainty. this would hinge on the premise that all nodes are constantly receiving messages (mostly garbage) at random. this would probably be a horrible thing for network bandwidth, but luckily most e-mails are very small.

<comment><USER4> Yes, we're on the same page! We have an idea for how fake messages would be passed around fake friends, and how to grow this "dark" network organically. Let's collaborate!

<comment><USER12> I think you're going to be disappointed. The only way this could work is based on network participants, and that's highly subjective. But here's an idea that might be plausible.

You have four nodes in your network: B, C, D, E. B wants to send E a message, but doesn't want anyone who might be observing the whole network to know.

B sends garbage messages all day at random to _all active peers on the network_ , or as close as possible. We'll assume an even distribution of these random messages. When it comes time to send the correct message, it gets delivered just like all the others. This really only works if each message is received by a real peer.

What you get is a constant stream of communication at random, in which case you know 99.9999% of it is junk, and maybe 0.0001% is real. At this point the observer will start drilling down into everything possible to increase the probability of detecting the authentic message. You'll have to prove none of their methods would be able to improve that quality, but an actual cryptographer would be a better person to ask about that.

<comment><USER4> What do you mean by "The only way this could work is based on network participants, and that's highly subjective." ?

<comment><USER12> If you design based on trusting other nodes (committee and/or trusted peer groups), you have to inherently trust those nodes, and they have to be highly reliable/available, which is kind of ridiculous if you're trying to account for things like oppressive nation states.

If you design based on anonymous communication, it's still subject to analysis of network traffic. Even if the messages you're sending are secret, and you have some peers in the middle storing and handing things off, you can still tell who is sending something and who is receiving something and tell with a high probability if the two events are linked.

If you design based on the premise of hiding amongst a bunch of nodes, or wandering randomly through a maze of lots of nodes, you're dependent on lots of nodes and their expected behavior. The number of nodes may diminish, or their routes may be controlled, or their behavior changed, depending on the influence of the observers/controllers of the networks.

I'm of course only speaking about the delivery mechanism. The encryption of the message on either end is the easy part. It's getting it over there secretly that's really hard.

<comment><USER4> I see. We can't provide secrecy, but I think we can provide some level of deniability, and also make it a pain for those who are surveilling.

I'm not aware of any application that provides secrecy besides BitMessage. Are there others?

</comment></comment></comment></comment></comment></comment><comment> brown9-2 _Users don 't have to manage and back up their keys---or even know what a key is. Scramble does it for you._

As a user, why would I want to delegate my key management to you? Encrypting the email I want to send to a person with their public key is what gives me a sense of trust that what I am sending is encrypted and only readable to that person.

 _However--as the example of Tormail and others show us--the server cannot be trusted to serve uncompromised client-side code, even if the organization behind it is well intentioned._

So then why am I trusting you with my PGP keys?

<comment><AUTHOR> > As a user, why would I want to delegate my key management to you?

The beauty of it is that Scramble encrypts and signs whenever the recipient is also a Scramble address--automatically. The goal is to protect even users who don't know what a "PGP key" is.

(Don't get me wrong, we're planning improvements for power users as well--for example, we want to make it easy to use Scramble over Tor. But the goal really is "Encrypted email for everyone".)

> So then why am I trusting you with my PGP keys?

No, as explained in the writeup, the server stores your private key _encrypted with your passphrase_. The server never sees your passphrase, or your private key.

We've used a good key derivation function (scrypt)---this makes it difficult to brute-force the password.

In short: Yes, the server stores things so that you get the Gmail experience, sit down at any computer and it just works. No, the server never sees your plaintext private key.

Thanks for the feedback! If I get a chance, I'll paraphrase your questions and add them to the upcoming FAQ.

<comment><USER13> > No, as explained in the writeup, the server stores your private key > encrypted with your passphrase. The server never sees your passphrase, or > your private key.

The only place a private key belongs to is the users machine (preferably somewhere without internet access).

</comment></comment></comment><comment><USER14> Code: [https://github.com/dcposch/scramble](https://github.com/dcposch/scramble)

</comment><comment><USER15> Whenever I see a site with the fixed background images and scrolling content panels (where the background image is periodically visible again), I spend more time trying to figure out what's contained in the background images through those gaps than I do reading the content.

<comment><USER16> It's a bright night sky: [http://dcposch.github.io/scramble/img/night_sky_bright.jpg](http://dcposch.github.io/scramble/img/night_sky_bright.jpg)

</comment></comment><comment><USER17> What articles have you / your team had published in crypto journals? Where did you / your team study cryptography?

The logo is a Rubik's cube. That's not a great logo for a cryptographic app because Rubik's cubes are trivially solvable.

</comment><comment><USER18> I'm glad to see more projects taking off with the goal of secure email.

I found it really annoying that this service has xkcd style password requirements. My 9-character password with non-alphanumeric characters should be sufficient.

</comment><comment><USER19> Unvetted cryptography is worth 1 cereal packet sekrit decoder ring.

<comment><USER5> Precisely which vetted, client side, JS crypto library would you prefer the authors use to satisfy your concerns? I haven't looked at the code, and only recently started paying attention to the JS-Crypto space. I'm aware of implementations where scrypt was compiled to target the asm.js subset, however, this doesn't really mean the resulting JS running on platform x, in browser y is as secure as the resulting binary on the platform/OS it was targeted for.

 _Scramble has not been widely vetted, so don 't rely on it to protect you just yet._

The authors put the above line as part of the very first bit of marketing you encounter. Until the JS has full (vetted, industry standard) crypto functions designed to be secure for the each target platform, vetting this kind of crypto is going to be hard. The addition of a cryptographically sound PRNG is a big move in the right direction. That said, I believe the authors got it right with what is currently available: Inform the user in such a way that there is no confusion, open source the code so others can participate in vetting, get some attention to the project so others are motivated to participate in vetting, and continue to improve as problems are discovered. That's really the best you can do, IMHO. In security, the author of a library needs to be correct 100% of the time while an attacker needs to be correct only once.

<comment><USER19> This is like printing "may contain arsenic" on candy.

</comment></comment></comment><comment><USER20> Now the question is -- why doesn't Google do this with Gmail?

<comment><USER2> Because it would be deeply irresponsible for them to do that.

<comment><USER21> Why?

<comment><USER3> You can't serve dynamically-loaded crypto code. What happens when someone hacks gmail and replaces crypto.aes.js with crypto.plaintext.js and suddenly every gmail user who thought they were sending encrypted mail are just sending plaintext messages?

Crypto code needs to be packaged/signed/verified and cannot load in code dynamically without running the risk of completely compromising its security.

This is why it's just not possible to _securely_ serve code that does crypto in a web app. Browser extensions are the next step up, but they also have to be careful to never load code from any external locations (among other considerations they have to make when running in a browser environment).

</comment></comment></comment></comment><comment><USER22> nice. secure end-to-end encryption with a good browser-based UI is kind of a holy grail.

They say it's open source, but I can't find links to the source anywhere. Anyone?

<comment><USER23> I have to disagree. I'm not sure that is the "holy grail"...i think its not even possible with common browser runtimes.

<comment><USER22> Yes, I agree; the fact that it's unclear if it's possible is what makes it the holy grail, it's unclear if the holy grail actually exists, but lots of people really want it. :)

</comment></comment></comment><comment><USER24> how do I create/add the public key of a contact?

<comment><USER4> We plan to add functionality soon! As well as exporting your public/private key.

<comment><USER25> Soo... there's no way to actually send/recieve encrypted emails right now?

<comment><AUTHOR> All email from one Scramble address to another is encrypted+signed.

We'll add compatibility with existing PGP soon!

</comment></comment></comment></comment><comment><USER23> If you just expose your service as an API then you don't have to worry about users trusting code given to them by the site. Then use a native client app that doesn't suck to interact with the service...all of the encryption is done client side with all of the messages being encrypted end to end.

JavaScript encryption just isn't really valid in browsers...the browser runtime is to blame. Its funny that people have to all learn the same lessons over and over again...it's a worthwhile goal...keep at it, just try a different approach.

<comment><USER5> _Its [sic] funny that people have to all learn the same lessons over and over again_

That pretty much defines what the field of computer security _is_. From DES to AES, we learned the same lesson: As things designed to be secure are put out in the real world, with sufficient enough time, they're broken. It's important not to make the same _mistakes_ again and again, and that's nearly impossible to do with JS-Crypto since there are so many permutations of platform X on implementation (browser) Y. As long as the numbers of platforms is large and the numbers of browsers are large, having one implementation that works properly in all platforms isn't practical.

However, a specific implementation targeted at a specific browser/platform could be vetted provided the JS engine handles random numbers in a cryptographically sound manner. Ideally, the browsers would expose ways to call vetted cryptographic APIs directly via JS.

<comment><USER4> That's already happened w/ the crypto.getRandomNumber function, which openpgp.js uses/

<comment><USER23> That really doesn't change the equation. That's only if you can trust the client code...and it just isn't feasible with JS sent to you from a 3rd party.

pgp works because it transfers data and not code.

</comment></comment></comment></comment><comment><USER26> It prompts you if you try to send an email to someone without using their public key. I dig it.

Edit: Also links you to xkcd if you pick a crappy password: [http://i.imgur.com/TJ3QPP7.png](http://i.imgur.com/TJ3QPP7.png)</comment>


Going Freelance - <AUTHOR> http://www.rodrigoalvesvieira.com/freelance/

<comment><USER2> Great decision. I also spend almost 2.5, 3 hours daily just to get to office, and back. Move closer to office is not what I want, but going freelance, just like you is what i want.

<comment><AUTHOR> Great! It is quite different in the beginning, getting used to work at home and all. I recommend you have a nice space for work at home.

Good luck!

<comment><USER2> At home, i have one room just for myself, this is my working room and is temporary in the phase of renovation. I want this room to be great for working, nice and calm and without too many distractions. My main concern are clients and how to find them. I have few clients now, but this is not too much job for now (which, on the other side is not bad because I have more time for my personal projects) and not too much money, which isn't that great :D.</comment></comment></comment>


Don't "Hire by Keyword" - <AUTHOR> http://www.michaelrwolfe.com/2012/01/16/dont-hire-by-keyword/ <comment><USER2> This is an example of an article that does a great job of identifying the problem (seriously -- I think it's great), but it has limited impact because it doesn't offer concrete steps towards a solution. It _is_ hard to interview for intangible keywords -- how does the choice of keyword change that? Is the advice here just to take risk in hiring? That's not going to be received well...it can be just as damaging to make a bad hire for non-technical factors as technical ones, and I suspect this is why so many companies rely on terrible technical interviews.

The broken part of tech interviews isn't that they ask technical questions, it's that no one on the hiring side looks at their process and asks "what is it that this part of our process is measuring?" and "does that factor matter in making a hiring decision?" Asking brain teasers and CS "fundamental" questions is _fine_ as long as there is a good answer to those two questions, but instead everyone does cargo-cult interviews because Medium says that's how Big Tech does hiring.

<comment><USER3> _Is the advice here just to take risk in hiring?_

Yes, that's exactly what we should all be doing more of.

Hiring is always a risk, and the "accepted" risk-mitigation strategies (hiring by keyword, brainteasers, etc.) have been shown to be stubbornly non- predictive. At best they apply a misleading veneer of certainty on an inherently uncertain process, and if I'm going to take a risk I'd at least prefer that I not fool myself about it.

So yes, accept more risk in hiring. You're already taking risk, but by accepting the _feeling_ of more risk you'll at least be more deliberate about it.

<comment><USER4> Thresholds seems to be a huge missing component to this stuff. Syntax, obscure trivia, brainteasers, etc are generally terrible predictors. However, if you ask someone to find say the average (mean) value in an array and they can't even get close that's a problem.

IMO, this comes from the mistaken assumption that you want to most technically competent person possible. Instead basic competence is a minimum barrier and everything else combined is more important.

<comment><USER5> Google et al aren't asking to find the average value in an array. They're asking questions that boil down to "do you know the Boyer-Moore string search algorithm?" or "Can you correctly identify this problem as a rephrasing of the boolean satisfiability problem?" which, in the context of an interview, correlate only weakly with whether you're a good software engineer and instead correlate most strongly with how frequently you took or refreshed your Data Structures and Algorithms courses.

<comment><USER6> >>instead correlate most strongly with how frequently you took or refreshed your Data Structures and Algorithms courses.

It is well known that this companies test for this knowledge. They even tell you about it during their process so you will be ready for it. At the very least, it tests that you can learn this things from study. If you fail at them, you either did not prepare in the way they told you to, which is a failure to follow instructions, or you tried to study and it wasn't enough, which is a failure of ability to learn. There are probelm with this; the conext on which you are evaluated is vastly different than the environemnt wher eyou will ahve to apply it. But that doesn't mean the assesment is completely random. It tests for some qualities that will be important on the job.

</comment></comment></comment></comment></comment><comment><USER7> I think the author's message is spot on, but I disagree with some of the details. Mainly:

> _Industry experience is often a negative, not a positive_

I can see why someone would say this. If you looking to innovate, you don't want employees always saying, "This is just the way we've always done it." At the same time, people with industry experience can avoid novice pitfalls.

Also, I cannot stand all the emphasized keywords. I get why he did it, but it's so jarring to read.

<comment><USER8> What the hell is wrong with this industry that experience in the industry is considered a negative? For every other skill the more you do it the better you get, yet the logic here is that the more one works with tech the worse one gets at it.

The only comparable jobs are high impact sports. An older boxer or football player is assumed to have accumulated injuries that make them a worse value proposition. Are devs the same? Am I slowly accumulating the equivalent of career ending sports injuries the longer I am stuck in a job living like a Dilbert comic?

Probably not. It is really just ageism, and my work history doesn't matter to these hiring managers as long as I'm over 30.

<comment><USER7> I think you're missing the point. From the article:

> _We ran circles around competitors who had teams of B and C players with > security expertise but little else going for them._

He feels experience is negative (I'm guessing) because the experienced candidates _only_ have experience. It is implied that they have no other team skills - just their knowledge of the area. It doesn't matter if you hire the world's foremost expert; if they don't mesh with your team, everyone is going to have a bad time.

<comment><USER8> Then experience isn't a negative. It is merely insufficient without other requirements like team compatability.

But all other things being equal are you still suggesting that experience is a negative?

<comment><USER7> No. I never said experience is a negative, but I can see how it was implied. I understand where he's coming from, because there are people who are stuck in their ways. That's not an experience issue - that's a people issue.

<comment><USER8> No problem. I reread your first reply and I think we agree. I've met plenty devs who believe their 10 repeated years of the same experience entitles them to shout down younger devs.

Problem is, now that I am older I really don't want to be stereotyped as one of those dinosaurs.

</comment></comment></comment></comment></comment></comment><comment><USER9> THIS. After learning a few languages and paradigms, I find that I often have a 2 week ramp up for any given programming language.

If you already know Java and Javascript, you'll get Scala / Kotlin in no time. If you're experienced in Python and Django, RoR is a few weeks away. If you're experienced in C++ and Python, it won't take long until you're good to Go.

I get that companies want someone who's productive from Day 1, but they're missing out on a lot of great candidates that might only be productive from Day 15, but they'll be a lot more productive over time.

<comment><USER10> > I find that I often have a 2 week ramp up for any given programming > language.

I agree that a competent, experienced developer can do this. What's worth noting, however, is that it takes two weeks to cross the bar of "can contribute code in this language that produces deliverable results". But two weeks cannot get you across the bar of "can contribute robust, maintainable code in this language".

Even though you are not a beginner to programming, you are a beginner to the language and its ecosystem and so will still make some significant newbie mistakes. Ruby on Rails is a good example of this: half of being good at RoR is being a good programmer, the other half is memorized knowledge of the idioms and patterns of the framework and community.

<comment><USER11> > But two weeks cannot get you across the bar of "can contribute robust, > maintainable code in this language".

Unfortunately, this is so true and yet so difficult for people to realize and understand.

I've seen in real life wherein somebody hired at a supreme decision-making authority comes in and says "We'll rewrite everything in language X". Existing folks in the team quickly start ramping up on the language and simultaneously writing _production code_. Much of the code thus written tends to be pathological.

</comment></comment></comment><comment><USER12> Tokenadult isn't around to chime in here, so I'll take his place today. Hunter and Schmit did a meta-study of 85 years of research on hiring criteria. [1] There are three attributes you need to select for to identify performing employees in intellectual fields.

      - General mental ability (Are they generally smart)
        Use WAIS or if there are artifacts of GMA(Complex work they've done themselves) available use them as proxies.

      - Work sample test. NOT HAZING! As close as possible to the actual work they'd be doing. Try to make it apples-to-apples comparison across candidates.

      - Integrity. The first two won't matter if the candidate is a sociopath.

This alone will get you > 65% hit rate. [1]

[1] [http://mavweb.mnsu.edu/howard/Schmidt%20and%20Hunter%201998%...](http://mavweb.mnsu.edu/howard/Schmidt%20and%20Hunter%201998%20Validity%20and%20Utility%20Psychological%20Bulletin.pdf)

</comment><comment><USER13> As a PHP programmer, I picked up Node.js really quickly. I mean, sure, I already knew JavaScript, but Node is a very different ecosystem and has its own tools. After a week I was already productive and after a month I was already bored with it.

I bet I could be a perfectly fine RoR developer, given a little bit of time. I don't know Ruby, but I pick up languages quickly. Or, I mean, you could just keep the position open for a few months and just screen for keywords. It's really your choice.

<comment><USER14> The problem that I see is that employers don't want to spend the time to train people, or even wait for them to train themselves. They figure, if they can get someone who can hit the ground running, why would they waste time waiting for someone like you who needs to learn the language, regardless of how long it actually takes?

<comment><USER8> What they don't realize is that they it takes longer to find the perfect candidate than to train a good enough candidate. It might take a month or so to train someone on whatever web framework if they have similar experience. Yet the position could stay unfilled for six months or more waiting for that perfect candidate.

<comment><USER15> You have identified one reason we have a "talent shortage".

</comment></comment></comment></comment><comment><USER16> The author is mocking keyword stuffing, but promoting "cultural fit" as "more impactful keyword". Sorry, but replacing technical keywords with some vague buzzwords does not improve your ads.

<comment><USER17> I think the wording is a bit unfortunate. I'm sure he doesn't mean you scan resume's for keywords like team player, communication, cultural fit, etc. Instead you should focus on these skills during the interview process, more than specific technologies or previous employers.

As others have said, the article identifies a big problem in hiring. However, it doesn't give you a lot of handles to solve anything.

<comment><USER16> So what is "cultural fit" then? If one didn't wear skinny jeans and don't enjoy playing foosball, he's out of luck? "Cultural fit" is one of the most offputting keyword for me, because as far as I've seen, it has one of two negative meanings: a) there's a monoculture inside company (usually "hipsters"). b) they creating a bubble around them and do not accept any other attitude than fanatically following their idea(s) which often leads to another overhyped bullshit-that-nobody-needs.

<comment><USER18> Being a "cultural fit" just means that the person will fit in well with the process and people at a company. Whether the "culture" in question is a specific type of culture is irrelevant. If you approach it from that perspective, you're probably taking the term at face value and missing the point.

The idea being expressed here is that if you bring in a new employee, even one that has no previous experience with the technologies being used, they will perform best if they are naturally in tune with the company's ideals and methodology, and can quickly develop camaraderie with the existing crew.

On the other hand, if you hire someone that knows all the necessary tech, but is constantly at odds with how things are done, alienates their coworkers, or manages to clog up the process in other ways--in those scenarios, everyone loses.

It has nothing to do with a cultural hive mind; it's just a matter of keeping a team synchronized and efficient.

<comment><USER19> Looking for people who will work well with the existing team is understandable and probably a good thing. The problem is that you have to be vigilant to not allow this to become looking for people who are _similar_ to your current people. It's quite possible for a reasonable goal (finding candidates who will work well with existing employees) to have negative consequences (finding candidates who only fit a certain racial, cultural or gender expectation).

See some related HN submissions and threads: Inside the Mirrortocracy [https://news.ycombinator.com/item?id=7930430](https://news.ycombinator.com/item?id=7930430) ; Guess Who Doesn't Fit in at Work [https://news.ycombinator.com/item?id=9789928](https://news.ycombinator.com/item?id=9789928)

<comment><USER20> Just a heads up that your first link doesn't seem to exist anymore.

<comment><USER19> The semicolon used to be a part of the URL; issue with HN's URL parsing. I fixed it a bit ago, it works for me now. Does it still not work for you?

<comment><USER20> Looks like it's fixed now, thanks.

*Edit: Okay, I read both of the articles, and they were fairly interesting, so thanks. I do have a pet peeve / complaint though: Both of the articles purported to link to research, but neither actually did. the first article linked to a list of slide decks and the second article linked to a summary of research. I've read enough bad summaries now that I am working on becoming a primary sources junky. Do you know of any research on this issue that's been done?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> What about hire by questionnaire? We used to ask for resumes only, but we ran into the same issue as OP where qualified candidates wouldn't have key items in their resume, and unqualified candidates would have lots of things but end up failing during the coding interview. So we just started asking people up front what we wanted to know.

For example: [http://goo.gl/forms/YICrUuz7XNjiTcId2](http://goo.gl/forms/YICrUuz7XNjiTcId2)

Here's one of our software engineering forms. It's worked extremely well at filtering for technically qualified candidates. But we worry that we're still missing people because [https://imgur.com/RIamYIZ](https://imgur.com/RIamYIZ)

<comment><USER22> > _But we worry that we 're still missing people because > [https://imgur.com/RIamYIZ](https://imgur.com/RIamYIZ) _

Eh, that's a pretty reasonable questionnaire. If it was pages and pages, it'd be too much, but there's only 12 questions here (including the citizenship and email address questions) and I'm assuming you don't expect an essay for each of these. Someone who's indignant at the idea of filling this out is probably not worth working with.

I have to say, I find the SSH question at the bottom odd. Who is this screening for? Are there people who hit all your other requirements but don't know how to use SSH? Would you actually eliminate someone for this, as opposed to spending 5 minutes introducing them to SSH (or 30 seconds sending them a link)?

</comment></comment><comment><USER23> In my opinion, the many emphasized words make this post difficult to read.

<comment><USER24> Yep. I was going to make the same comment.

</comment></comment><comment><USER25> This is mostly right, but using "cultural fit" as a criterion is the road to "hire people like us," which is as unproductive and keyword-based hiring just in a different way. In fact all the criteria cited in the article as good have significant weaknesses. Even "expertise" need some explanation, since one would hope that's not the keywords listed under "Expertise." Having an applicant write some code and defend they way they did it, and/or bring some code they wrote, would be a much better gauge of expertise.

</comment><comment><USER26> Finally, someone who also thinks in a sensible way on hiring.

In Toronto, I keep seeing all these job posting of companies that need people with 10 years in social media experience, or 10 years in mobile app development and it's quite laughable how they are able to hire those people.

I'm curious how those people can actually perform.

<comment><USER27> Fake resumes. Indian tech shops specialize in this (I'm Indian btw). Fake resumes are extremely common among Indian tech workers. I was asked by one IT body shop to write 7 years of Java experience even though I had none. I routinely run into resumes where people sometimes write more years of experience with a package than the number of years the package has existed.

<comment><USER28> I'm interested in how that kind of thing prevails. Is it because the purpose of the lie is just to get past HR screening, and after that competent people just learn the language they lied about on their CV? I can't imagine that would work though, I mean how does someone get past a technical interview with a fake CV?

<comment><USER29> That will get you a job in the short term, but isn't great for a career that will last until retirement.

But as far as I can tell, the candidate crams for the tech screen, learns the basics between offer letter and start date, and picks up the rest as they work. The dirty little secret is that nobody actually _needs_ any specific experience to do the job. You just need a decent brain and an Internet connection, and just enough people skills to fake it until you make it.

But it probably works better in larger organizations, where none of the people who would be able to detect the deception are involved in the interview process. You don't need to fool your peers if you can fool your boss.

It never would have worked in any of the smaller companies that I have interviewed with, as they have all (perhaps coincidentally) been ultra- paranoid about resume frauds, for some reason.

<comment><USER28> _The dirty little secret is that nobody actually needs any specific experience to do the job. You just need a decent brain and an Internet connection, and just enough people skills to fake it until you make it._

Very true, and this is why these keyword searches are so absurd. It wouldn't be difficult to setup the entire hiring process (applications as well as interviews) around that dirty little secret.

</comment></comment></comment></comment></comment><comment><USER30> Just in case anyone else had trouble concentrating on the article:

javascript:document.styleSheets[0].insertRule("strong%20{%20font- weight:%20normal%20}")

</comment><comment><USER31> Excellent article. Especially love the call outs on "must have 5 years experience using {technology ABC}" when it's only been around for 5 years.

<comment><USER32> Sometimes you want to hire the creator of such technology. ;)

</comment></comment><comment><USER33> The reality is that resume must be filtered out, either by tech keywords such as "clojure or ruby on rails" or social keywords such as "culture fit or team player".

No one hires by keywords, they filter resumes by keywords. If you're smart enough, you will load up your resume with keywords if that's how your target company is filtering resume by. You just want to get to the next base which is getting an interview.

How do you get hired after an interview? Some companies will give you tests, puzzle, white board coding, all conversation/culture fit, etc. You likewise have to be a fool not to adjust accordingly. If you want to join Acme corp so bad and they require you wear a suit, wear a freaking suit. If they are laid back and cargo pants and t-shirt will do, you have to be an idiot to go in with a suit. If they are big on whiteboard coding, then practice so and do load's of exercises prior to your interview.

game theory 101, people will always look for ways to maximize their outcome.

</comment><comment><USER34> Altogether nice article, excluding the sad appearance of "cultural fit" as hiring criteria. Cultural fit, begone.

</comment><comment><USER35> Exactly my train of thoughts.

I cringe when a recruiter wants to know which language I program in and he/she does not get it immediatelly when I reply "any that you like" or "what ever the customer wants".

Keyword based job match is however the only automatic solution, all other are to work intensive so that it makes economically sense.

<comment><USER36> Even worse is keyword technology and version. "I need someone with X version 5.12" kinds of job ads. Really, you intend to avoid upgrading for the rest of time?

<comment><USER37> There exist job ads which have the explicit purpose of not finding a qualified candidate. It tends to be a result of things like H1-B visas, union contracts, and other frameworks which provide 'first dibs' on an opportunity to a subset of the global labour pool.

</comment></comment></comment><comment><USER38> Everybody knows one shouldn't Hire by Keyword, but they still do it. Why ? I think this is the CYA principle in play. "I hired a $keyword specialist, it clearly says so in his resume. I am limiting any blame I get if they don't work out !"

<comment><USER39> I've worked at a company where this philosophy was compounded on during the "down" days, where the company I was at was in a sharp decline.

When the VPs and execs panicked, they started at the hiring level... They made a plan to "stop hiring junior level" employees, and our team became full of Senior level people. Then they said we need more PhDs... because a PhD is prestigious and we need prestige. There was even a brief mandate to high an industry celebrity type, basically just for show. It all started with a "hiring by keyword" mentality and pretty much led to a massive decay of passion across the entire team.

</comment></comment><comment><USER40> The key takeaway, for me, is:

* outsiders can bring some fresh thoughts and challenge ideas that everyone inside keep as status quo and unchallenged;

* people who define themselves as e.g. 'Ruby on Rails dev' (or JavaScript dev or whatever) might have hard time adapting if the landscape changes, or they need to do something outside their comfort zone;

* specific technical skills (programming language, etc) are usually easier to develop than soft skills such as leadership, teamwork, communication.

Of course, it's not unconditional. Sometimes you _really_ need someone who has deep knowledge of some niche, or is really a master at some technology. It's just probably not as common as one might believe.

</comment><comment><USER41> Devil's advocate: I like it when ads have the technologies as keywords. Preferably listed explicitly & directly. I have arbitrary preferences like Apache Camel v Spring Integration & Ansible v Puppet. I'm not on the market looking, but I do occasionally peak to see if there are dream jobs available on Craigslist/StackOverflow.

Even if I can quickly grok the equivalent, I'd get frustrated after a months/years of solving problems using my less preferred stack. The stack can also tell you a lot about the philosophy of the shop: flexibility vs. convention/readability, stability vs. cutting-edge.

</comment><comment><USER42> The truth is that those kind of companies have very little money and so they want to hire people that can be productive from day one. Of course this is utopia but that will not stop them.

</comment><comment><USER43> Do they actually end up hiring based on the criteria in their postings? I often find that the typical listing is unreasonable. Who actually gets the job? Is it worth applying to anyway?

<comment><USER44> In my experience, I've seen direct hiring tends to focus less on "x years of experience" but recruiters, especially larger firms with junior staff doing screening, is absolutely terrible with obsessing over it.

<comment><USER45> Some postings go way overboard on skillset. You must be a master at everything. I've heard that this is done sometimes so that they can't find the talent locally and then can outsource for that specific role.

Some recruiters, not all, are basically no better than a robot. I don't have a B.S. but I have an A.S. plus 10 years of experience now. Give a recruiter a req of "B.S. or equivalent experience" and they will turn me away without a phone call because I don't have the degree. When 10 minutes on the phone is all I would need to convince them I have the experience they need. I've basically given up on interviews for awhile. It drains so much energy just to get canned responses back.

</comment></comment></comment><comment><USER46> I think it's weird that the IT industry hires based on technologies you know. It seems much more relevant to hire based on whether you've completed similar kinds of projects to those that will be done at your new workplace.

It's like aiming to hire someone to build a high-rise out of wood and going "We need someone who can use a hammer and nail". Not really wrong, but it's kind of an odd emphasis.

</comment><comment><USER47> We should probably add (2012) to the title, I was confused by the comment on social media being "barely 5 years old" until I saw that.

</comment><comment><USER48> A few years ago I built some .NET components to service a node front end. I used to get so many people contact me about Angular and node contracts. I tweaked my CV to say Microservices instead of components and replaced node with java script SPA and now I get far more relevant enquires from agents.

</comment><comment><USER49> Bullcrap. Just look at the examples of hires he has in mind: co-founder of a startup, VP of marketing, CEO, "Could Hollywood execs have started Netflix?". This guy is a fly-high investor. Unless you're in a similar position, his advice is useless.

</comment><comment><USER50> I agree to the article in general. But most of the keywords in job description are put up to set some expectations or if you have a project that needs people who already know things.

</comment><comment><USER51> I don't think companies are hiring by keyword. It's the clueless tech recruiters filtering out candidates by keyword.

<comment><USER15> Perhaps the companies you deal with aren't but non-software companies are pretty bad about it, with non-tech companies being the worst.</comment></comment>


The ghost moose, the drone and the search for a winter-tick cure - <AUTHOR> https://thenarwhal.ca/ghost-moose-drone-search-for-a-winter-tick-cure/ <comment><USER2> You must choose, predators or parasites. Is always the same.

You don't allow predators to clean the populations, you will have parasites and diseases. Either one or the other.

The unwritten laws of this planet are clear about it: Herbivores must be controlled. They are a menace for the entire ecosystem built over plant's activity.

Predators are often the right option in terms of people security. Ticks will send more people to the hospital than wolves. And not all people attacked by diseases carried by ticks survive at middle term.

So, the idea is smart, amateurs are welcomed, but a professional would knew better because the solution here would lie probably more in terms of removing moose than saving moose.

<comment><USER3> Expanded hunting or culling the population by wildlife officers are another option.

</comment></comment><comment><USER4> This is real problem back in Maine where I'm from.</comment>


Avast's Shutdown of Jumpshot Will Harm the Web and the World - <AUTHOR> https://sparktoro.com/blog/avasts-shutdown-of-jumpshot-will-harm-the-web-and-the-world/ <comment><USER2> If everyone whose data was collected really did opt in as this article explains (I wouldn't know, as I don't use Avast products), then I agree that they didn't do anything wrong.

However, I don't think a great case was made that Jumpshot shutting down is actually harmful to the web and the world at large.

<comment><USER2> Ah, apparently most people did not opt in.

According to Vice, anyway, Avast only put that opt-in page into their AV product after they got caught spying thought their browser plugins (which led to the removal of those plugins from the Chrome and Firefox stores until they updated them to stop the spying).

So, I think that Avast still looks pretty dirty here.</comment></comment>


Ask HN: why are some (political in nature) posts censored while others are not? - <AUTHOR>

I recently posted a well written piece about Prop 30 (via Pando Daily) on HN: http://pandodaily.com/2012/11/13/proposition-30-yet-another-way-california-screws-entrepreneurs-over/. It was quickly censored by the mods.
I then looked at the HN guidelines which stated that most "political" articles are considered "off-topic." I considered it to be "on-topic," since it directly affects entrepreneurs and their companies based in CA. But fine, their forum, their rules.
But how is this TC article on Ron Paul any different (which has rec'd 100+ upvotes)? http://techcrunch.com/2012/11/16/ron-pauls-farewell-address-the-internet-can-stop-big-government/ <comment><USER2> Are you sure you were censored? Perhaps you just submitted the exact same URL that I submitted six days ago, here (which, incidentally, you commented on):

<http://news.ycombinator.com/item?id=4781004>

When you submit the exact same URL as one that's been submitted before, the previous article gets a point, but a duplicate entry isn't created.

To get the article to show up again, you'd have to do something with the URL to fool HN into thinking it's a distinct submission. I wouldn't recommend doing this except under rare circumstances - perhaps years have passed and the old article has become suddenly quite relevant due to current events.

</comment><comment><USER3> Here is the deal with politics on hn, as I understand it... As _hackers_ , we like to learn about complex systems and figure out how they work. Politics can be very complicated and there's a lot going on behind the scenes. Any story that explains how something works as opposed to advocating for a political position will probably not get censored.

Of course there are exceptions. Anything related to the technology of politics, patents and topics of interest to the tech community (like net neutrality). To answer your question specifically, Ron Paul is personally popular with many members of the tech crowd. He's a big deal on reddit and with many members of our community, so he kind of gets a pass.

<comment><AUTHOR> I personally think Ron Paul is bad*ss, but that was what I was implying...(him getting pass while others don't)!

</comment></comment><comment><USER4> Like startups, the vast majority of HN submissions will fail to gain traction. Even those that gain a little may get squashed by flagging. All get squashed by time.

The rise of the Ron Paul submission is an unusual data point - as is that of the current one implying that Republicans are rejecting copyright. I suspect social media campaigns are being tested. HN is somewhat of a hardened target. During application cycles, however, its moderators might be preoccupied.

The important point is that when a crappy submission gains traction, it doesn't lower the bar in general to justify other crappy articles.

The way to contribute is by submitting good content unlikely to be encountered elsewhere. California politics probably doesn't make that cut.

</comment><comment><USER5> Flagging can be done by anyone with enough karma, so there's an inherent lack of consistency.</comment>


Ask HN: Anyone using Amazon's SES & if so are you liking it? - <AUTHOR>

Thinking about integrating this into an app of mine. Anyone have any experience using it? And has it been working well for you? <comment><USER2> Yes. Loving it. It's ridiculously fast. Like 1-2 second delivery time. Feels essentially free because pricing is so low.

Absolutely essential that you add SPF/Sender ID DNS TXT record for your domain or everything will go to SPAM. That's not SES specific though.

The throttling system they have worries me a bit, but so far hasn't been an issue.

<comment><USER3> Do you add DKIM signatures to your emails?

<comment><USER2> I don't, but if it ends up helping deliverability I'm definitely going to.

</comment></comment></comment><comment><USER4> We're using it at my startup to send emails to users (welcome, password reset, etc.) and have been happy with it. It's worked as advertised, has been reliable, and is dirt cheap.

We used the django-ses app which is great: you "pip install django-ses", set your AWS key and EMAIL_BACKEND and that's it. And it comes with a nice SES dashboard.

<comment><USER5> Can you share a screenshot of the dashboard? I can't seem to find one in any blog posts

</comment></comment><comment><USER6> The biggest problem is the inability to authorize a domain for sending mail. This is something they've been interested in adding for a while now, but have yet to do so.

If you plan on sending emails using a dynamic FROM field (like email@example.com) and then parsing replies, then you'll likely have to use something else.

<comment><USER2> Does setting Reply-to solve that?

<comment><USER6> I never tried, but as I researched the issue, it seemed others tried various approaches (including reply-to), and nothing worked.

</comment></comment></comment><comment><USER7> Yes, we are using Amazon SES together with Bouncely (<http://bouncely.com>) that I built to track bounces. However, Amazon SES still lacks many features.

</comment><comment><USER8> I'm using it. It definitely works well for me.</comment>


Icon Fonts FTW (A comparison of Icon Fonts vs Sprites) - <AUTHOR> http://peruvianidol.github.io/icon-fonts-ftw/icon-fonts-ftw.pdf

<comment><USER2> <http://peruvianidol.github.io/icon-fonts-ftw/> looks like ass if you have "Let pages choose their own fonts" turned off.

Much like every site that uses icon fonts. Ho hum.</comment>


It's Opus, it rocks and now it's an audio codec standard - <AUTHOR> https://hacks.mozilla.org/2012/09/its-opus-it-rocks-and-now-its-an-audio-codec-standard/ <comment><USER2> Before someone chimes in with that XKCD strip:

 _How does Opus compare to other codecs?_

 _Opus is distinguished from most formats for high quality audio (AAC, Vorbis, MP3) by having low delay and it is distinguished from most low delay formats (G.711, GSM, Speex) by supporting high audio quality. It meets or exceeds existing codecs' quality across a wide range of bitrates, and it operates at lower delay than virtually any existing compressed format. Further, the Opus format itself and the reference implementation are available under liberal royalty-free licenses, making it easy to adopt, compatible with free software, and suitable for usage as part of the basic infrastructure of the Internet. See the Opus comparison page for more details._

[http://wiki.xiph.org/OpusFAQ#How_does_Opus_compare_to_other_...](http://wiki.xiph.org/OpusFAQ#How_does_Opus_compare_to_other_codecs.3F)

Which is to say, this isn't (okay, isn't _just_ ) a case of having "too many standards"; Opus is legitimately impressive from a technical standpoint. Oh, and it's unencumbered by patents. That's cool.

EDIT: And here's the coolest part of the article that completely took me by surprise:

 _"The IETF recently decided with "strong consensus" to adopt Opus as a mandatory-to-implement (MTI) codec for WebRTC, an upcoming standard for real- time communication on the web."_

<comment><USER3> There is no such thing as "unencumbered by patents". Unless you have a technology that has already been tested thoroughly in the courts, which is the only way you can really determine whether something would be deemed to violate a patent or not, you simply can't know.

<comment><USER4> Even if it was tested by the courts, you can appeal. And even after the appeal, you can appeal to a higher court, all the way to the Supreme. And even if was tested there, congress can pass a law that allows it. And even if that happens the Supreme court can strike down the law. And even if that happens, the public can mount a revolution and tear down the legal system.

But, practically speaking, Opus has extremely good guarantees for being unencumbered, as much as is possible - the people working on it have given licenses to use it, and experts in the field have had a while to go over this stuff. Nothing is 100%, but this is as good as it gets.

<comment><USER3> No matter how many times I'm downvoted, it's still not unencumbered. It's simply not in the nature of our patent system that something this complex can be unencumbered, unless it's with respect to an expired patent.

I know my position causes a lot of cognitive dissonance with people, because it implies that the system is fundamentally unfair. Well, you can either take the red or the blue pill.

<comment><AUTHOR> Come on, it's only 45kloc. Do you go around insisting every non-trivial piece of software on hacker news is encumbered?

And in most those cases people were not making a special effort to avoid being effectively encumbered, while Opus was.

<comment><USER5> if its a non-trivial peice of software, it almost certainly is encumbered, don't forget about idiotic patents like 1 click, there are likely millions.

</comment></comment></comment></comment></comment></comment><comment><USER6> These comments answer some questions I have concerning FLAC...

starwed wrote on September 11th, 2012 at 1:29 pm:

 _Isn't FLAC_ __already __* open and royalty-free?*

Dusk wrote on September 11th, 2012 at 1:40 pm:

 _FLAC is a lossless codec — it typically generates output at a bitrate_ __orders of magnitude __* higher than lossless codecs such as OPUS, and there's no way to "dial it down".*

natermer wrote on September 11th, 2012 at 2:30 pm:

 _You want to archive audio with 100% quality using Flac.

Opus is for were you are willing to give up some amount of audio quality for the ability to massively increase compression ratio. Using low bit rate Opus may yield a 3MB file for a song, were as FLAC may end up being 150MB for the same audio.

What I do for audio is to store it using flac, but encode it on the fly using other codecs for streaming for transfering to devices. That way I always get the best audio quality possible to go along with the best compression possible._

<comment><USER7> > Using low bit rate Opus may yield a 3MB file for a song, were as FLAC may > end up being 150MB for the same audio.

3MB will get you POTS-quality audio though. Lossless codecs usually compress audio to half the original size (so a 150MB FLAC file — for music — will correspond to ~300MB of raw bitstream). Lossy compression to something worth listening to will usually be around 10x compression, so ~30MB for an original 300MB bitstream.

A 35mn song compressed in 3MB probably won't be worth listening to.

<comment><USER8> If you were using AAC (or anything else that's more advanced than MP3) a 3MB file would actually be listenable for a short song.

A 150MB FLAC file would be about 20-30 minutes long (based on a typical bitrate of 700-1000 kilobits per second).

<comment><USER7> > If you were using AAC (or anything else that's more advanced than MP3) a 3MB > file would actually be listenable for a short song.

Even mp3 works for "a short song", that's not the context of my comment though, its context is a 150MB FLAC file (~300MB bitstream) recompressed to 3MB with Opus.

> A 150MB FLAC file would be about 20-30 minutes long

A point I noted in my comment.

<comment><USER8> Oops, I misread your comment quite heavily. Apologies for the extremely redundant follow-up!

</comment></comment></comment></comment></comment><comment><USER9> I'm not an audio guy. Can anyone explain like I'm five why this new codec was needed? How does it affect me as a consumer of audio? Who out there was saying "Gosh, I want to do X, but it's really tough because existing codecs force me to choose between high quality and low delay"? What is an example of "X" in that sentence?

<comment><USER10> X = {voip, videoconferencing}

Say you wanted to write a live audio chat app to talk to your friends. If you'd chosen the Speex codec, then voice would come over fine, but trying to show off your new guitar skills would fail because what they heard would sound horrible.

If you'd chosen the Vorbis codec, then everything would sound great, but there'd be a weird "lag" between participants, as if one of them were on the moon. Also, adding too many listeners would severely strain your internet connection's capacity.

Opus has latencies as good as Speex, and can be high-, medium-, or low-quality depending on bandwidth needs.

</comment></comment><comment><USER11> I expect Firefox and Chrome to adopt this within months, but IE10 is coming out soon. Does it mean it won't have it? And then we'll have to wait another year or more for IE11 to implement it? Not to mention IE9 and IE8 will probably never get it.

I also assume WebM will replace Vorbis with Opus very soon?

<comment><USER4> > I expect Firefox and Chrome to adopt this within months,

Firefox already adopted it (it's in nightly builds). Chrome seems to have WontFixed it,

<http://code.google.com/p/chromium/issues/detail?id=104241>

<comment><AUTHOR> It's actually in Firefox 15, not just nightly. People on Reddit are saying chrome's position has reversed but I don't have a link. Works in Opera already if you have gstreamer's opus plugin, and they've apparently said they'll ship it.

<comment><USER4> The chrome bug just changed from WontFix to Available.

</comment></comment></comment></comment><comment><USER12> I'm not familiar with Opus. Can someone tell me if it is able to dynamically adapt quality based on available bandwidth? If it loses packets in the stream, do we get a 'skip' in the audio or does the quality go down?

<comment><USER13> > Can someone tell me if it is able to dynamically adapt quality based on > available bandwidth?

Depends on what you mean. It is a variable bitrate codec, and the encoder can easily adjust the bitrate of the stream. But you would need a way to discover the available bandwidth and communicate it to the encoder - Opus is just a codec, not a container or streaming protocol.

> If it loses packets in the stream, do we get a 'skip' in the audio or does > the quality go down?

The standard doesn't mandate a specific way to deal with packet loss, but the reference implementation tries to handle this gracefully. [1]

Some properties of the encoding facilitate this: for instance, packets can optionally include a reduced-bitrate encoding of the previous packet to provide redundancy. [2]

[1] <http://tools.ietf.org/html/rfc6716#section-2.1.8>

[2] <http://tools.ietf.org/html/rfc6716#section-4.4>

</comment></comment><comment><USER14> How does Opus compare to Celt, its direct predecessor?

<comment><USER15> The final version of libcelt is bit-for-bit compatible with Opus. Unlike SILK, there was never a "stable" version of CELT (we routinely broke the bitstream on almost every commit), so CELT development continued after the two codecs were merged, right up until the Opus bitstream was frozen.

That makes Opus a strict superset of CELT, and we've stopped maintaining libcelt, so any existing users should switch to libopus.

</comment></comment><comment><USER16> Relevant - Hydrogenaudio listening tests (530 tests) scored Opus higher than HE-AAC

<https://people.xiph.org/~greg/opus/ha2011/> <http://listening- tests.hydrogenaudio.org/igorc/results.html>

</comment><comment><USER17> MP3 is getting very long in the tooth, not to mention the fact that it's encumbered by patents. A new codec would be nice, but hardware adoption of the codec will take a while. Long enough, dare I say, to kill it dead in the water.

<comment><USER18> Why would you say that?

Most "hardware" decoders are DSPs that run software loaded onto them at runtime. This goes for anything with an OMAP, Tegra or Samsung (Samsung's own decode block) SoC in (that I know for sure) and probably almost everything else. Tegra3 and OMAP4 can decode WebM in hardware, for example.

<comment><USER19> The problem is that they never develop firmware updates so if those DSPs don't support yet another open codec on release day, they never will.

<comment><USER18> I'm pretty sure Tegra2 got firmware updates during its lifetime, and I know that TI do updates for OMAP.

Those updates might not make it through to consumer devices, but that used to be the case for things like GPU drivers too. Google pushed an updated SGX driver for the Galaxy Nexus with 4.1, and Apple pushes updates to their own drivers every release.</comment></comment></comment></comment>


More on AOL's Disc Strategy - <AUTHOR> http://techcrunch.com/2010/12/28/aol-floppy-disk/

<comment><USER2> One of my friend actually used AOL dialup for free several years, simply by asking to terminate his contract at the end of the free trial period. He successfully got several additional free periods, then resigned for good when they wouldn't provide any additional free time, only to sign up again for a new free trial under his girlfriend's name, etc.</comment>


Mdast.js – AST-based parser for GFM/(Common)Mark(down) - <AUTHOR> https://github.com/wooorm/mdast <comment><AUTHOR> A well-implemented contester/alternative to the official commonmark.js AST- based implementation. Started as a fork of marked.js, but with a solid plugin architecture for parse tree manipulation.</comment>


Freshdesk permanently stores contact information, including deleted users - <AUTHOR> https://support.freshdesk.com/support/discussions/topics/5495

<comment><AUTHOR> Not sure how many other companies do this, but it seems really bad for user privacy.

Any time you email the support system of a company that uses Freshdesk to manage tickets, your information gets stored in their system permanently, with no way to delete.</comment>


The Diaspora that wasn't, and the way into the walled gardens. - <AUTHOR> http://decafbad.net/2011/02/08/the-diaspora-that-wasnt-and-the-way-into-the-walled-gardens/

<comment><USER2> See [https://github.com/appleseedproj/appleseed/blob/master/_docu...](https://github.com/appleseedproj/appleseed/blob/master/_documentation/quicksocial.txt)

</comment><comment><USER3> This cannot be stressed enough.

However, developing open protocols is not _sexy_. Developing a Facebook clone with privacy controls upfront is more so.</comment>


Rails 3.1: Release candidate - <AUTHOR> http://weblog.rubyonrails.org/2011/5/22/rails-3-1-release-candidate

<comment><USER2> I am using Jammit for asset management and Barista for compiling coffeescript on the fly with a Rails 3.0.7 project.

Any comparisons between Jammit and Sprocket will be welcome.

<comment><USER3> So far, it looks like the only real differences are:

* jammit uses config/assets.yml, sprockets uses inline requires

* jammit loads individual files in development, sprockets concatenates

* sprockets compiles coffee with :bare => false by default. I don't know what barista's default is

<comment><USER4> for large js projects, sprockets is a nightmare. trying to add a breakpoint in a 5,000 line javascript file is really really frustrating.

Would love to see a workaround in sprockets (to make each js file included separately in dev mode), but until then I'd say Jammit is the way to go.

</comment></comment></comment><comment><USER5> Kudos for bundling a simple BCrypt-based authentication.

<comment><USER6> I'm new to Rails and am currently working through the tutorial at railstutorial.org. I'm a PHP/CodeIgniter dev so a lot of the features are new but many concepts are familiar.

Browsing the linked GitHub code on the OP's link relating to the new secure_password stuff - does this make the authentication code used in the above tutorial obsolete - the commented example on GitHub indicated included BCrypt based password storage/authentication method ... ?

<comment><USER7> The SHA2 digest approach in the Rails Tutorial book is still the standard in many applications and authentication plugins, and is fine for most applications. The basic techniques you'll learn in the current 3.0 version are still useful. That said, I am working on a new version of the book that uses bcrypt.

</comment></comment></comment><comment><USER8> Notice this in the new rake 0.9.0:

* _Incompatible_ _change_ : Rake DSL commands ('task', 'file', etc.) are no longer private methods in Object. If you need to call 'task :xzy' inside your class, include Rake::DSL into the class. The DSL is still available at the top level scope (via the top level object which extends Rake::DSL).

<http://github.com/jimweirich/rake/blob/master/CHANGES>

<comment><USER9> I ran into this bug today in a fresh install of the latest Rails/Rake. If your rake tasks are currently exploding due to Rake 0.9.0, making your Rakefile look like this will fix it:

<https://gist.github.com/4b4e24877b107b00bcba>

<comment><USER9> On second thought, don't do this. Add rake 0.8.7 to your gemfile and bundle update. Rake 0.9.0 is insanely broken.

</comment></comment></comment><comment><USER10> Anybody know how easy it will be to upgrade a 3.0 Rails app to 3.1? Especially in regards to changing it to use jQuery.

<comment><USER11> I just upgraded an app from 3.0.7 to 3.1.0 rc1

I use Devise and Mongo Mapper. The Mongo Mapper for Devise gem depends on Devise 1.1.x, and this causes a bunch of deprecation warnings, but it works. I don't know if the latest Devise has this fixed, as I can't run it due to the Mongo Mapper for Devise dependency.

Some hand editing of development.rb to remove the debug_rjs setting and some editing to change my use of stylesheet_tag and my app ran ok

I'm not using the cool new asset pipeline yet, but my app runs with 1 hour of work.

<comment><USER12> Did you just point the gemfile to newer version and did hand editing as you went along or is there a command for the upgrade?

<comment><USER11> I've had trouble with Mongo Mapper and Devise.

I've upgraded Mongo Mapper to 0.9.1 to take advantage of it's Rails 3 integration, and it works with Devise 1.3.4 which removes the deprecation warnings.

To do this, I had to pull down the devise-mongo_mapper plugin to avoid version conflicts - it works with the newer code with no changes.

Mongo Mapper 0.9.x has a new configuration hookup that I had already written myself, so that code had to get a small change.

Joint, a Mongo Mapper plugin, doesn't work. I was going to replace Joint anyway for my own needs, now I need to do it today instead of next week.

Now I'm 2 hours in, and still not working on the Asset pipeline work I want to do, but my app is running except for the Joint bits

</comment></comment></comment></comment><comment><USER13> Kind of a bummer that "HTTP streaming" only works with Ruby 1.9.2. I'm not against upgrading to Ruby 1.9.2, it's just that Puppet doesn't support it yet.

</comment><comment><USER14> Will this make all my latest Rails 3.0 books worthless?

<comment><USER15> No.

edit: Your printed technical book was essentially worthless the moment you bought it, given how fast most software evolves these days. But, I'm guessing you mean: 'will this make my book so outdated as to be worthless in terms of learning.'

The answer is still no. All of the major new features are, essentially, optional, with the exception of jQuery, but hopefully you were already using that anyway.

The Asset Pipeline, SCSS and CoffeeScript are major new features, but you'd likely need to read up on SCSS and CoffeeScript separately anyway. The Asset Pipeline can probably be understood with a couple good blog posts.

HTTP streaming: same thing. Also, it's—again—an optional feature.

<comment><USER14> Thanks.

I was thinking how long it took for "Agile Web Development with Rails 4th Edition" to come out and now 3.1 is on the way. Luckily guides like railstutorial.org update along with new Rails releases.</comment></comment></comment>


Slaughter at the bridge: Uncovering a colossal Bronze Age battle (2016) - <AUTHOR> https://www.sciencemag.org/news/2016/03/slaughter-bridge-uncovering-colossal-bronze-age-battle <comment><USER2> > Before the 1990s, "for a long time we didn't really believe in war in > prehistory," DAI's Hansen says. The grave goods were explained as prestige > objects or symbols of power rather than actual weapons. "Most people thought > ancient society was peaceful, and that Bronze Age males were concerned with > trading and so on,"

Is that really true (that "we" didn't believe in war in prehistory)? It seems like a case of taking an absurd null hypothesis, not finding any evidence to refute it, and then deciding that your null hypothesis is probably true. We have plenty of evidence of pre-literate societies engaging in organized warfare, so why would prehistoric Europe be any different?

<comment><USER3> It's true enough that in the early 2000s one of my poli-sci professors devoted most of a course to the book _War Before Civilization_ and kept hammering on the idea of prehistoric war being widespread and common as some kind of huge revelation and surprise.

I found such intense and sustained focus baffling, since the point seemed obvious (though the evidence was interesting, at least). I've since come to understand this as some "inside baseball" grad-level anthropology leaking through to the undergrad curriculum. We newbies didn't need to be convinced because we'd never strongly held the contrary view in the first place, but the field (and related ones) had only recently convinced itself so thought it worth spending a lot of time on.

<comment><USER4> It should be a revelation because war is a civilizational concept - it's a form of organized violence, 'organization' being the keyword here.

If you're living in scattered, small tribes, then at most you can get into small tribal scuffles and vendetta ... but war requires planning, organization, support, possibly diplomacy, marshalling of resources - so it's hard to have proper war without the mechanisms in place to support it.

So maybe it's not quite so obvious.

<comment><USER5> Indeed, the article itself says

> We had considered scenarios of raids, with small groups of young men killing > and stealing food, but to imagine such a big battle with thousands of people > is very surprising

So it's not so much the violence itself that's the surprise, as it is the scale of said violence

</comment></comment></comment></comment><comment><USER6> This article was impossible not to read all the way through. I really hope to be able to write in such a compelling way at some point in my life. Admittedly, the subject matter of an epic battle is probably intrinsically more interesting than what I'll typically write about in my career, but still, the author tells such a vivid story by diving into minute details only to zoom back out to a broader context.

<comment><USER7> Go for this book, it changed my life: "The Elements of Style was listed as one of the 100 best and most influential books written in English since 1923 by Time in its 2011 list"

</comment></comment><comment><USER8> More details: [https://en.wikipedia.org/wiki/Tollense_valley_battlefield](https://en.wikipedia.org/wiki/Tollense_valley_battlefield)

</comment><comment><USER9> Same battle as in this recent article [https://www.sciencemag.org/news/2020/09/warrior-skeletons- re...](https://www.sciencemag.org/news/2020/09/warrior-skeletons-reveal- bronze-age-europeans-couldn-t-drink-milk)

<comment><USER9> Also this one [https://www.nationalgeographic.com/history/2019/10/puzzling-...](https://www.nationalgeographic.com/history/2019/10/puzzling- artifact-found-tollense-europe-oldest-battlefield/)

</comment></comment><comment><USER10> Lindybeige did a great and relatively short video on this [https://www.youtube.com/watch?v=xoYj4BZdB1w](https://www.youtube.com/watch?v=xoYj4BZdB1w)

<comment><USER11> As much as I enjoy Lindybeige, I would take his analysis with a grain of salt. There's a rather infamous case where Lindybeige released a video filled with bizarre and misleading claims about the MG34 and MG42 German machine guns (which he bizarrely conflated with each other and incorrectly dubbed the "Spandau") and their relative merits with the Bren, followed by a rather substantial rebuttal from Military History Visualized, to which Lindybeige issued a defensive counter-rebuttal, the comments of which contain further commentary from Forgotten Weapons. If you don't really want to get invested in an argument between three youtubers, fair enough—my takeaway is that while Lindybeige often has _some_ idea about the topics he presents, he also has strong biases and gaps in his understanding that often result in him confidently pontificating well past his actual expertise.

</comment></comment><comment><USER12> Discussed at the time: [https://news.ycombinator.com/item?id=11383601](https://news.ycombinator.com/item?id=11383601)

<comment> c-smile I did not realize that Hacker News is that old ...

<comment><USER13> I don't know exactly when HN was founded, but it was quite large when I joined.

<comment><USER14> [https://news.ycombinator.com/item?id=1](https://news.ycombinator.com/item?id=1) looks pretty plausible as the actual first post, though I can't remember whether postings always had ids (most pageviews used to have URLs with random names that pointed at expiring Arc closures).

</comment></comment></comment></comment><comment><USER15> The pictures are staggering.

</comment><comment><USER16> The article claims something I found surprising -- that the written word was not common near Germany until about 1000 AD.

<comment><USER17> Even being able to write your name was uncommon through the 1600's. Literacy has changed a lot in the last 200 years.

In 1500's(14?) Spain, being able to read and write got you better than "I'm a computer programmer in 2000" prospects. Being able to read _silently_ , without even moving your lips(!?!), got you rumors of deals with the Devil. Now you get to graduate primary-school, and eventually learn programming. Before the recent vast expansion in programming jobs, lots of science phds were driving cabs. Veterinary masters clean cages in zoos. Minimum viable education has been seriously escalating. Even with everything still being taught very _very_ badly. If education tech ever dramatically improves... that'll be interesting.

<comment><USER4> The question isn't about common literacy, it's about literacy among the nobility, chieftains, clerics.

Much of that, among many other things like basic education, architecture, so many materials and methods, didn't happen until Latinization/Christianization of that part of Europe.

</comment></comment></comment><comment><USER18> Cmon, a guy with a sword as the first graphic? This is the Bronze Age - a club is a better weapon at that point...</comment>


Show HN: Feram finds and fixes bugs in your commits - <AUTHOR> https://feram.io <comment><USER2> > _With Merged Patches in Projects of: Apple, Dropbox, Facebook, Google, NASA_

Can you share the links to the merged pull-requests?

<comment><AUTHOR> Normally you can find them with following GitHub search: "committer:feram-bot @dropbox". However, I can't locate them right now. Not sure why they are not in the index anymore. I guess should have linked them right away .

</comment></comment><comment><AUTHOR> Hi, I'm Adrian - one of the cofounders. We've been working on this over the last 1.5 years and we'd be happy to hear your feedback and questions!

<comment><USER3> Are you trying to push folks to the free plan?

I could see a lot of people being willing to pay for this, then seeing they need to contact you first, and going without.

<comment><AUTHOR> Yeah, actually I'm not happy about this either. We were working with sales folks and they wanted more flexibility to adapt the price to the customer they were talking to. But this hasn't worked particularly well and I don't like it anyways. Expect some changes here soon. For the time being all plans are free - we're more interested in your feedback!

</comment></comment></comment><comment><USER4> > With Merged Patches in Projects of: Apple, Dropbox, Facebook, Google, NASA

I was skimming the site and the meaning of this phrase was unclear to me.

<comment><AUTHOR> We just wanted to point out that even big IT companies with their own software quality teams don't have mechanisms in place to prevent all of the bugs Feram can find.</comment></comment>


Node.js Tools for Visual Studio (free) - <AUTHOR> https://channel9.msdn.com/Blogs/Seth-Juarez/Nodejs-Tools-for-Visual-Studio

<comment><AUTHOR> I hope folks don't mind me posting this new video here, I think a lot of people don't realize that we here at Microsoft have free Visual Studio Community with tools for Node.js development with our IDE. Its a cool story and a hard working team, so I'd love for a wider community to know that it exists as an option for them. Heck it even has remote Linux VM remote debugging of Node.js :)</comment>


Woobius: Online Collaboration for Architects and Engineers (useful tools review) - <AUTHOR> http://www.usefultools.com/2009/06/online-collaboration-for-architects-and-engineers/

<comment><USER2> I'd love to use Woobius (I think) if the price were lower. I work at an engineering firm with around 100 projects averaging 1 GB each. We can do some archiving, but the time it takes to be careful about that sort of thing across even a small organization is nontrivial. At their current prices, this would cost us $1500/month, which is at least twice as much as we'd pay.

It does appear to fill a need I feel acutely on a daily basis.

<comment><USER2> Also, the name "Woobius" is definitely not conducive to boss approval. To me, "Woobius" says not "secure, reliable CAD vault," but something closer to "fuzzy owl."

</comment></comment><comment><USER3> Prices for storage could be cheaper. CAD files sprawl pretty quickly compared to your average collaborative project.

<comment><USER4> Most industry collaboration tools cost hundreds up to thousands of dollars a month (or more for really large projects)... If anything, I'd say we're too cheap.

To be fair, this tool is designed for the collaboration that occurs between multiple companies, often with drawings (often as PDFs) rather than raw CAD files.</comment></comment>


Show HN: OOTB Code-Server, Easiest "VSCode on Browser" + HTTPS and GitHub Auth - <AUTHOR> https://github.com/nullpo-head/Out-of-the-Box-CodeServer <comment><USER2> Great! How does this compare with Theia[0]? I've recently set up an installation for Go and JS development[1] and been happy so far ;)

[0] [https://theia-ide.org/](https://theia-ide.org/) [1] [https://pojntfx.github.io/felix-pojtingers- theia/](https://pojntfx.github.io/felix-pojtingers-theia/)

</comment><comment><USER3> What's the use case for code server? I'm sure there is on I just don't see the advantage of running my IDE through the browser instead of locally. I could see maybe if I wanted to have a customised IDE ready to access from any computer. But isn't this a temp container that disappears when you shut it down

<comment><USER4> I use it a lot. It's really nice having one environment if you use different dev machines from time to time (in my case a PC and a laptop), develop on the target OS (I don't have Linux installed on all my computers but only develop in Linux), the cost is negligible and performance pretty much like a local vscode.

Not being able to code without internet is the only disadvantage but I usually don't do that anyway.

<comment><USER3> Sounds like a solid use case. Is lag an issue?

<comment><USER4> No it isn't. I have it on a machine about 5ms away, never experience lag.</comment></comment></comment></comment>


Ask HN: Has any website startup sold for more than YouTube's $1.68bn? - <AUTHOR>

<comment><USER2> [Broadcast.com](<http://en.wikipedia.org/wiki/Broadcast.com>)

<comment><AUTHOR> "$5.7 billion in stock." Nice, thank you.

Broadcast.com turned into a few Y! services, including Launchcast.

<comment><USER2> It also became the most expensive redirect/domain parking in history.

While YouTube has become one of the most utilized new services in web history. YouTube, as I am sure everyone is aware, effectively brought video convergence to the internet (en mass).</comment></comment></comment>