Ask HN: Quitting Job to Launch a Startup - <AUTHOR> I am learning Python. I want to quit my current job and start a business. I have a few ideas.
I am looking for your advice on how not to fail, learn and launch a profitable startup.
What are your advice, and good  sources of learning?
In short, how to start a successful startup? <comment><USER2> Top things I learned doing this successfully:

1) Find a customer. Don't worry about your website and your logo and blah blah blah. Find a customer and solve a problem for them. Then worry about the other stuff. The best way to find customers early on is connections and taking to people, not google ad words or search or whatever. Call someone you know and solve their problem.

2) The initial problem you solve might not be the problem you end up solving. That's ok. Keeping solving problems for people and eventually you'll hit on one that works.

3) Have happy customers. Do everything you can to make your customers happy. Don't worry that what you're doing doesn't scale. If it's totally manual that's fine, but make them happy. Answer their calls. Connect with them. Your first customers are everything. They establish your reputation.

4) Don't do it for the money. Do it because you want to do it. Maybe you'll make a bunch of money. Maybe not. Starting a business is not about money. It's about the experience.

5) I actually didn't have my business going before I quit. That's pretty common advice, but I didn't follow it and I'm glad I didn't. Trying to balance a job and a startup is really hard. If you can get your living expenses low and you don't have dependents, I'd suggest just quitting and throwing yourself off the deep end. That way you basically have no choice but to get things going. Even if your business isn't making enough money yet, you can pick up consulting work to make ends meet.

6) Decide what you want to make it. You don't need to raise VC money and make billions. If you had your own business that paid you, say $150k/year, that's success. Maybe one day you could scale it, and make millions, but pick your metrics of success. Don't feel like a failure because of money.

Good luck! It's hard. Keep going.

<comment><USER3> No 4 really annoys me. You should absolutely do it for the money. The main objective of starting a business is to make money. Other objectives like "making the world a better place" or "be your own boss" are just bonuses.

<comment><USER4> Honestly, if you really rationally break it down, starting a business rarely makes financial sense when factoring in the risk. If you want to maximize guaranteed lifetime income, having a job w/ a high demand skill (That can remain in high demand) is probably the way to go.

</comment></comment></comment><comment><USER5> Your first sentence:

        > I am learning Python.

Your second sentence:

        > I want to quit my current job and start a business.

Later in the thread:

        > I am not good at sales. Should I learn selling...?

Advice - pick one thing, get really good at it and take things slowly. You can't go from having no engineering experience, no business experience and no sales experience to all of sudden doing all three successfully.

</comment><comment><USER6> 1) Start your business BEFORE you quit your job

2) Make sure you are good at sales BEFORE you quit your job (and that you've sold stuff)

3) MOST businesses fail because they don't have enough revenue, not because of product or people.

Resources/ books:

* The E-Myth

* All the stuff written by the Basecamp guys

* Jim Collins books

* Creativity Inc

<comment><AUTHOR> I am not good at sales. Should I learn selling or hire someone who is excellent at selling things?

<comment><USER7> From [http://paulgraham.com/ds.html](http://paulgraham.com/ds.html) —

"There are two reasons founders resist going out and recruiting users individually. One is a combination of shyness and laziness. They'd rather sit at home writing code than go out and talk to a bunch of strangers and probably be rejected by most of them. But for a startup to succeed, at least one founder (usually the CEO) will have to spend a lot of time on sales and marketing. [2]"

...

"[2] Thanks to Sam Altman for suggesting I make this explicit. And no, you can't avoid doing sales by hiring someone to do it for you. You have to do sales yourself initially. Later you can hire a real salesperson to replace you."

<comment><USER8> This advice is great not just for bootstrapping your own startup, but for selling yourself in life (interviews, dating, etc).

</comment></comment></comment></comment><comment><USER9> Maybe don't quit your job just yet.

Start trying to build your ideas with the coding skills you have. It probably won't be the thing you build, but working on a project to learn to program works better in my opinion, as you'll work to achieve something tangible instead of learning in a void.

0\. Read Cal Newport's "So Good they Can't Ignore You":

Book: [https://www.amazon.com/Good-They-Cant-Ignore- You/dp/14555091...](https://www.amazon.com/Good-They-Cant-Ignore- You/dp/1455509124)

"Talks at Google": [https://www.youtube.com/watch?v=qwOdU02SE0](https://www.youtube.com/watch?v=qwOdU02SE0)

Newport addresses career change strategies, how to build good careers, etc.

1\. Read Marc Andreessen's Archive:

Link: [https://pmarchive.com/](https://pmarchive.com/) HN commented collected links: [https://news.ycombinator.com/item?id=19739943](https://news.ycombinator.com/item?id=19739943)

It is a collection of tweets made in a nice format, then an ebook.

Andreessen addresses a lot of topics.

2\. How to Start a Startup:

Link: [https://startupclass.samaltman.com/](https://startupclass.samaltman.com/)

3\. Startup School (CS183F): [https://www.youtube.com/watch?v=5ZXU84_sGXo&list=PLoROMvodv4...](https://www.youtube.com/watch?v=5ZXU84_sGXo&list=PLoROMvodv4rNpMrTeeh-627Lajh6uSUgY)

The list is last uploaded on top position, so first video is on the bottom " _How and Why to Start a Startup_ ". Haven't watched the series except for the ones on " _How to Find Product Market Fit_ " and " _How to Build a Product II_ " and some of " _How to Build a Product_ "

</comment><comment><USER10> You should gain more experience in programming before quitting your job.

Instead, during your free time implement one of your ideas and break down the feature set into a simple MVP. Come with a timeline, implement, learn, and see if you can stick with the plan. Once you end up building the product, next you will have to work on finding users (sales, marketing) and convincing them to keep using your product and pay for it.

If you have persevered for this long and also maintained your job, you really have the passion and discipline needed to build on your vision. A lot of times I have noticed my friends (FAANG) talk about various idea, get excited for a day/week but never build it out.

PS: I quit (ex-FAANG) a few years ago to travel, relax, learn foreign languages and now currently working on some SAAS side projects. My 2 cents, you need to have a lot discipline along with tons of motivation, and inspiration to keep fueling the energy to work on your ideas.

</comment><comment><USER11> Lots of good advice from a wide spectrum of HN. I am currently going through this as we speak. I am at the very early stages of Customer validation phase. I have mouths to feed and and hence need my job to keep me alive while I go through the whole startup phase. If you can get your hands on these two books, can't recommend them enough; Ready Fire Aim- teaches you the mantra about selling first right from the get go. Also lays down actionable strategies to find your customer, how to sell them, how to price your product. Running Lean- Ash Maurya. Think of it as an amalgamation of Lean startup by Eric Ries and 4 steps to Epiphany by Steven Blank. Again the emphasis on customer development aka idea validation. You need to solve a problem that is worth solving. If you don't have a problem that a customer wants solved, you don't have anything to sell. Simple. The guy offers a lean canvas which you can use to develop your business model. Worth checking out.

Beyond these books, a few resources worth following are GetLatka, product habits by Hiten Shah and anything by Patio11 who was doing SAAS way before SAAS was even a term. One of the very early advice that Ash Maurya gives in his book is tat all the early stages of the startup phase can be done while being fully employed. ESP, the product/solution fit. Once you have validated the problem after countless customer interviews, you can start working on the actual solution to the Problem that you just validated and iterate on the build, measure learn loop. By the time you get to this stage, you are already a team of 2-3 early cofounders working out of an office space and ready to take in some external funding. When you get to this stage you can confidently quit! Good luck. EDIT MVE- minimum viable employment. Find a place that can employ you for your existing skills, pay market which provides you with the necessary resources(time) while you are involved with customer validation(problem/solution fit).

</comment><comment><USER12> "how not to fail"

Don't do this to yourself. You cannot guarantee immediate success when starting out especially when you have no prior experience running a business. The first thing to keep in mind is that failures don't matter as most likely you will fail at a few things anyway. The important thing is to learn from failures and keep moving forward. This is not a motivational speech but the facts of business. So if you keep a defensive attitude, you will be disappointed.

Mindset is hard to change but you need to work on it. Don't think about failures but only look at how you can keep working towards your goal of a business. Not my quote but for every 3 pointer that Michael Jordan scored, he missed 100s others which no one will remember. So it is ok to fail but use the failure as another step towards success if you believe and work towards it.

Ok now some more practical advice :)

\- Learn to Sell. If you cannot learn how to sell, you cannot run a business. Forget about everything else. To learn how to sell, learn how to listen to people's problems and issues and see if you have a solution for that. Start with anyone you know. Selling is not just making money but convincing someone.

\- Do you really want to quit your job or can you start this on the side ? I personally would favor going all in but only when you are ready to an extent. Are you really ready for going cold turkey ? Perhaps not yet. Can you start on the side ?

\- So you have a few ideas. Ok that is a start. But ideas need execution. And to execute, you need to identify your target market/customers. It may take a lot of trial and error to understand your specific target market. You need to start looking into validating the idea by starting small and executing the hell of out it.

\- Start with a niche. Very focussed. If you try to sell to everyone, you will sell to no one (and no, amazon did not start that way. it took years before they become the amazon of today).

\- Are you willing to risk it all at some point ? Are you scared of failing ? If yes, you may want to reconsider being in business.

I hope this helps you.

</comment><comment> q-base Don't quit your job. Work on your project in your spare time. First of all your idea will probably take minimum 3-4x longer to gain traction than your most pessimistic guess. If/once it gains traction it will probably take significantly longer to be profitable than your most pessimistic guess.

Work on your project in your spare time and only think about quitting your job once the idea is verified by actual customers. I spend 3-4 years burning through savings without getting any traction. I have since started another project which will be done in my spare time. Having to deal with both money and start-up related issues at the same time is not preferable.

</comment><comment><USER13> Keep learning, ideas are easy it's about executing on your ideas and making sales.

Keep your day job and keep learning, start a small project you can complete with your current programming skills and learn selling, marketing.

Check out the StartUpsForTheRestOfUs.com podcasts, start in the archive. Lots of good info on stair stepping with small projects up to a SaaS.

Follow your dream but keep your day job for now.

Also check any agreements you signed with your employer regarding IP who owns what you work on outside of work. Don't work on or even visit websites of your projects from work. Don't share your dreams with co-workers/employers.

</comment><comment><USER14> I developed a working product as a side project, and I am now trying to sell it by working on it part-time and keeping my full time job (actually tring to keep find of strict 9 to 5).

There are positives and negatives about my situation:

\+ no risk for my family (except I am very busy)

\+ I can actually experiment my product at my current jov (kind of customer 0)

\+ my employer (large european corporation not in the IT business) was actually surprisingly willing to let me work on a side project, and did not bother me with IP.

\- So far, I did not manage a single real customer (though company only started 2 months ago). I may have a better result if I was full time.

</comment><comment><USER15> [https://www.startupschool.org/](https://www.startupschool.org/) is a good place to start.

</comment><comment><USER16> My advice to you is to keep your job. Work on your startup as a side project and gradually build it. If it takes off and starts to generate as much as your day job, then make the transition.

Survivorship bias will skew the success of startups. Success is far less common than what I originally thought.

Take a look at the $100 Startup book it has some good points to consider.

</comment><comment><USER17> [https://www.amazon.com/Disciplined-Entrepreneurship-Steps- Su...](https://www.amazon.com/Disciplined-Entrepreneurship-Steps-Successful- Startup/dp/1118692284)

Give this a read. Literally a step by step to get a successful company off the ground.

</comment><comment><USER18> Unfourtanly we developers think often we can build something and they will come and use our software. The truth is pretty harsh, it is mainly about selling your software. You need to get comfortable talking to people, reaching out, cold emailing/calling them.

</comment><comment><USER19> _> In short, how to start a successful startup?_

and

 _> advice on how not to fail_

don't go together.

You're going to fail. Boy, you're going to fail. Again and again.

But that's fine. Only charlatans will say you can go from zero to success in a straight line.

The most important thing you can do is anticipate this in advance and keep going. Each failure is an opportunity to be less wrong, and that's when you will begin to see success.

So practical advice:

1\. It takes a day or so to build a webpage that communicates your idea and collects emails. Do that and publish it to the usual places. Ask for and measure the feedback. Listen to what people say.

2\. The technology does not matter. The value you bring does. I mean don't choose something awful but also don't get caught up in the minutia of what framework to use. As long as it works, nobody cares, least of all your customers who depending on the business may not even know (and certainly don't care) what an _if_ statement is.

3\. Think in systems. Online business is like lego: you connect a lot of systems together and, voila, you've (hopefully) built something of value. Write down what your systems are - backend, frontend, customer support, payments, customer acquisition, monitoring. Write down how your business operates as if you were going to wake up with amnesia tomorrow. It's important.

4\. Go to Producthunt and look at the sea of new apps released today. Dozens. Hundreds maybe. If you can't at least match them in design or value, don't start. The days of Bootstrap themes are over. You need good design. Luckily you can simply inspect element and copy what works.

5\. Marketing matters. Find out where your potential customers hang out and show them how you're going to solve their problems. Reddit, Youtube, Quora, Twitter, wherever....search them out and give them your product for free. Take their feedback and iterate. You're looking for the first person who says "I love this". Once you hear that, you know you're onto something.

6\. Work hard. Your evenings and weekends belong to your business now. You've just given birth to a baby with a bleak chance of survival - do everything in your power to nurture it to good health. It's going to be exhausting and demanding but you're a parent with responsibilities now, that's irrelevant.

Good luck.

</comment><comment><USER20> indiehackers is a community for people with exactly this interest. the podcast is a great place to start; i always recommend this episode: [https://www.indiehackers.com/podcast/043-pieter-levels-of- no...](https://www.indiehackers.com/podcast/043-pieter-levels-of-nomad-list)

</comment><comment><USER21> Rule of thumb, don't move before either: * 1K users for B2C (and high enough growth) * 3 big clients for B2B</comment>


How a job is created - <AUTHOR> http://markmaunder.com/2010/how-a-job-is-created/

<comment><USER3> This is a tremendously simplistic analysis of the situation:

a) The sentence "You create jobs by helping grow existing businesses and helping create new businesses." is practically a tautology.

b) "Creating jobs" is a complicated issue in the first place. If I start a new company with fifty employees but drive a competitor who used to employ sixty employees out of business, have I created any jobs?

c) "Creating jobs" is not the problem. "Creating good jobs" is closer to the problem. You could easily create jobs by cutting welfare and offering all of it's former recipients government jobs paying $50/day to dig holes, but this would not be a positive outcome.

d) Creating good jobs in the long term is largely a problem of improving productivity. This means investments in education and infrastructure, and reducing drags on efficiency.

e) He's got a line in there arguing in support of bankers. Banking, like tax preparation or law is a a field that is more "administrative overhead" than a productive industry. Unless we are providing these services to foreigners these fields provide little benefit to the country.

In conclusion I'm not really sure what the point of his article is to do except complain that the government isn't helping him enough.

<comment><USER4> Also, let's not forget that there's a huge class of people who aren't old enough or wealthy enough to retire, but whose current jobs are going away quickly. Those folks aren't going to be working as programmers at startups in the brave new world.

Creating "good" jobs then becomes something more like _"creating good jobs that can can keep the current population employed"_. I don't hear many people talking in those terms anymore.

<comment><USER3> I suspect we'd be better off if we invested in education for these folks and retrained them to do something people actually want nowadays.

They might not be working as programmers at startups but there's still a lot of worthwhile tasks we could get these people doing with the right preparation and support.

<comment><USER4> _"I suspect we'd be better off if we invested in education for these folks and retrained them to do something people actually want nowadays."_

Problem is, evidence suggests that retraining doesn't work very well.

Here's a heartbreaking series of stories about furniture workers who were laid off when their factory outsourced their jobs. The reporter followed them as they took a community college training program, and tried valiantly to get jobs at the Google data center opening nearby:

[http://www.npr.org/templates/story/story.php?storyId=1215161...](http://www.npr.org/templates/story/story.php?storyId=121516133)

[http://www.npr.org/templates/story/story.php?storyId=1215673...](http://www.npr.org/templates/story/story.php?storyId=121567306)

[http://www.npr.org/templates/story/story.php?storyId=1215767...](http://www.npr.org/templates/story/story.php?storyId=121576791)

Unsurprisingly, virtually none of the people got jobs at Google, and the ones who didn't ended up doing things like working at WalMart at much lower wages.

It's a myth to pretend that we can re-educate enough blue-collar workers to make a dent. We're going to have to find another way, and my suspicion is that it's going to involve a resurrection of trade barriers until older workers can retire.

<comment><USER3> Thanks for the articles.

I'm not sure, however, that the examples cited within them are entirely fair - they took middle aged furniture workers and tried to get them jobs at Google after a few years retraining. Of course a guy who's had six weeks of classes in Linux isn't going to get a job at one of the most technical companies in the world.

What I was thinking was more along the line of retraining them to do useful blue collar jobs - for example HVAC maintenance - which can't be easily offshored and still is useful to society.

 _It's a myth to pretend that we can re-educate enough blue-collar workers to make a dent. We're going to have to find another way, and my suspicion is that it's going to involve a resurrection of trade barriers until older workers can retire._

I'd be reluctant to do this, as it's essentially a tax on everyone else to support them and essentially surrendering to the fact that we can get very little value out of these workers.

<comment><USER4> _" Of course a guy who's had six weeks of classes in Linux isn't going to get a job at one of the most technical companies in the world. What I was thinking was more along the line of retraining them to do useful blue collar jobs - <USER2> example HVAC maintenance - which can't be easily offshored and still is useful to society."_

Well, yes...the story is tragic because they never had a chance. But I wouldn't be quick to assume that this is a story specific to Google. You'll note that a lot of these people end up doing menial work, even after their re- training program. One presumes that if it were possible to find better jobs, these people would have found them -- they certainly sound like dedicated workers. Instead, they're working double-shifts at WalMarts and prisons.

 _"I'd be reluctant to do this, as it's essentially a tax on everyone else to support them and essentially surrendering to the fact that we can get very little value out of these workers."_

That's one way of looking at it. Another way of looking at it is that we've consistently exploited cheaper labor markets to undermine our own, without building non-US markets for our own products. Moreover, many of these foreign labor markets have been playing currency games to ensure that US workers can't possibly compete. It's a system that's rigged against US production, and taxing it is one way of reintroducing balance.

<comment><USER5> _One presumes that if it were possible to find better jobs, these people would have found them -- they certainly sound like dedicated workers. Instead, they're working double-shifts at WalMarts and prisons._

I suspect if it were possible to find better jobs in Lenoir, N.C (Pop. 16,000), they would have found it. In fact, they probably would have found better jobs anywhere in the Hickory-Lenoir-Morganton statistical area (Pop. 360,000).

On the other hand, there are plenty of data center technician jobs in Newark and other parts of northern NJ. I don't see any reason to believe the people in this story made any effort to seek them out.

<comment><USER4> If you read the articles I posted, you'll find that they talk about that point. The comments also discuss it extensively.

The problem with that argument is that while you're almost certainly right, there are a lot of reasons that people get stuck in one place -- poverty, houses they can't sell, sick family, etc. -- and it's fundamentally unrealistic to expect everyone to move to find a job at a data center. Few work forces are as mobile as a 20-something programmer with no kids.

Also, given that the cost of living is quite a bit higher in New Jersey than Lenoir, North Carolina, one has to carefully examine the risk/reward of the decision to move. Maybe it would work out, but for a lot of these people I suspect they'd be no better off than working at WalMart in Lenoir.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Oh, come on. Saying that a job is created by "growing existing businesses" or "creating new businesses" isn't insightful or useful; it's a tautology. It's like saying that winning a war is simply a matter of killing more people than the other side. Easy as pie.

I know that we all like to get huffy and pretend that our favorite ideology is the one that has all the right answers for making jobs, or eliminating poverty, or creating world peace, but ultimately, _adults_ have to acknowledge that there are going to be problems in the world that politicians can't solve.

Obama can't make your startup succeed. Congress can't make someone want your product. But they _can_ do more basic things, like making sure that you won't starve to death when you fail, or ensuring that falling ill while starting your company won't bankrupt you (or kill you). They can make sure that the lights turn on, that clean water comes out of your faucet, and that you're reasonably safe at home and work. You've got to take it from there.

<comment><USER6> Absolutely. Creating a better safety net WOULD really help innovation -- being terrified of not having health insurance is a huge barrier to joining startups for many people. And the current government has so far done nothing to help that, and the republicans even less.

<comment><USER7> What a strange fear -- being afraid of not having health insurance. I haven't had a "real job" or health insurance for about a year now, and I don't care at all. If something bad happens to me, I'll put the bill on my credit cards. I doubt anything will happen though. I'm young, healthy, and don't get into car accidents by being stupid. Statistics are on my side here, and I feel completely comfortable living without health insurance for awhile.

Unless you have some kind of condition, is there any situation in which the fear of not having health insurance is actually justifiable? I mean, if you want to avoid paying off a huge hospital bill over time, then ok... but come on, if you're starting a startup, gambling a 0.001% chance (or whatever) that you might have to pay 4-5k off over a few years seems like an insanely good bet.

Also, I heard from a friend (who is very probably wrong about this) that you don't actually have to pay off a hospital bill. It won't count against your credit score. Is this true? I would never do something like that, but... if not paying the bill doesn't count against your credit score, then I can see why people might not pay it.

<comment><USER8> I take exception to most of this statement. My story: At 25 years old, I took every penny I had in savings (about $300k) and started a company. I "created" 7 well-paying jobs. I put every single penny I had into my company. I had "major medical" insurance, which I paid about $600 a month for.

Two years later, we were doing about 2 million a year. Still, I poured every penny I had into the company "creating" additional good-paying jobs. Then I had a stroke. Yes, at 27. Because the doctors could not find a "reason" for my stroke, the insurance company paid a grand total of $2700, mostly for the ambulance and the care I received in said ambulance.

I was left with a bill of $67,000. Yes 3 zeros. Because of how long I was in the hospital and recovering, and because my business was based on relationships with my clients, the business faltered, and I eventually shut it down. I am now paying off every cent of what I owed on the business, as well as that $67k in medical bills.

Moral of the story: don't think you're invincible because you're young, or because you don't have a pre-existing condition. Also, I can absolutely assure you that medical debt DOES affect your credit.

Here's the crazy part. I'd do it all again in a heartbeat, and I will.

<comment><USER9> I'm assuming you did not have group insurance at some point so it was deemed preexisting? Otherwise, how did they get out of paying for it?

</comment></comment></comment></comment></comment><comment><USER10> > _"I'm trying to create jobs so hard that I work without a salary. Not only > that but I invest my life savings into the cause of creating jobs. I also > work harder at my job of creating jobs than most people work at their normal > job."_

I found this bit quite disingenuous. Yes, he is a business owner, and yes, he is part of the demographic of job creators - but "job creation" is not his title nor his primary intent (unless I've grossly misunderstood his startup idea).

Founders are in it to create a product and get rich - some have higher-order ideals for what they want to do on their road to riches, but to pretend that you are not acting out of your own self-interest is disingenuous.

Maybe I'm reading this all wrong, but that bit sounds to me like trying to appear as a populist folk hero when you're really not.

<comment><USER11> "Maybe I'm reading this all wrong, but that bit sounds to me like trying to appear as a populist folk hero when you're really not."

Cut him some slack. He's from Seattle, it's a common attitude there. Having lived up there for a while, the start-up scene seemed to mostly focus on it's "we're not from San Francisco so nobody respects us" inferiority complex.

<comment><USER10> Actually, I live here - but I'm not in a startup ;) People here are nice enough - distant, antisocial, but nice.

<comment><USER11> Don't get me wrong.. I actually liked a lot of Seattle .. At least the coffee shops, donut shops, and cupcake shops (Seattle is good at foods which cater to seasonal depression eating!).. Plus I met my two favorite Hacker News users there (troyd and carlcoryell).

But beyond that, Seattle as a place for start-ups is just strange. At every happy hour, startup meetup, startup coffee event, whatever, invariably the theme always turned into this self-righteous "Seattle is just as important as the Silicon Valley, why don't we get the same respect? I mean we have Microsoft, Amazon, Boeing, and .. uhm .. that other company".

</comment></comment></comment></comment><comment><USER12> I'm always wary of founders that say "we want to be the next [ _large company name_ ]". It immediately identifies them as followers rather than leaders and shows their focus is on making money or achieving status above solving problems for customers.

No wonder he's asking for a handout.

<comment><USER13> I don't think that was his point. His point was just, "Hey, government, you know who created a whole bunch of jobs? Google! I'm trying to also grow into becoming a giant company like Google did."

In this context, saying "I'm trying to be the next Google", is just like an NFL team saying, "We're trying to be the next New Orleans Saints." All it really means is, "I'm trying really hard to succeed."

<comment><USER12> What more important to him though - growing as big as Google or creating something so good that his company might get that big? The way he frames his goal is a classic "tell" regarding his focus.

</comment></comment></comment><comment><USER13> How to eliminate the need for more jobs: Use 10 different colors of text in your article, causing half of your readers to kill themselves.

Seriously, 1 accent color is more than sufficient.

<comment><USER14> He's creating jobs for graphic designers. :)

<comment><USER15> Or eye-care professionals.

</comment></comment></comment><comment><USER16> It's not a matter of creating or destroying jobs. It's a matter of productivity. During the past 200 hundred years, employment rates have stayed more or less the same (compared to the revolutionary improvements in standards of living we have accomplished). What has gone up is our producitvity. Sometimes improved productivity creates jobs (through new business) and sometimes it destroys them (people become redundant) but for society overall it's a net win.

</comment><comment><USER17> It is not the responsibility of the US federal government to guarantee employment. They are being treated as they should.

</comment><comment><USER18> Cringley had a similar article few days ago: [http://www.cringely.com/2010/02/the-cringely-2010-not-in- sil...](http://www.cringely.com/2010/02/the-cringely-2010-not-in-silicon- valley-startup-tour/)</comment>


How We're Wrecking Our Feet With Every Step We Take - <AUTHOR> http://nymag.com/health/features/46213/ <comment><USER2> I bought some Vibram Five Fingers recently, and I have to admit that they are ridiculously comfortable, despite being essentially toe-socks with a thin-but- strong sole. I've been walking around inner-city Saint Louis in them, over broken glass and gravel, and my feet hurt less than when I was wearing my previous lightweight walking shoes.

It's honestly a little weird, getting rid of all those things like arches and padding that seem so necessary, and discovering that they're actually doing nothing for you.

Edit: Of course, in a few weeks I'll have to switch back to big waterproof boots for the winter. Alas.

<comment><USER3> Have you ever considered how necessary the "toe" aspect of them are? If the problem is the sole, well fine wear something with a thinner sole. But then you'd really feel like you're just wearing flip-flops or ballerina flats for men. The genius of the Vibram Five Fingers in particular over all other alternatives that meet the same end of improving your gait is that they look ridiculous (read: distinctive). That's why they get all the press mentions (possibly in addition to having a good PR firm) and that's why people wear them: they start conversations. I'm not discounting the value you see in them, but I'm curious if there were other similar products that you considered, and if you find any particular value in the toe-sock nature.

<comment><USER4> Quite important, actually, I'd bet. They keep your toes from toeing-in like essentially every shoe does. Just look at how many people have bunions - they're almost _exclusively_ caused by shoes, plus some genetic causes which typically start _much_ later in life.

There's also a _very_ big difference in toe strength from having them be able to move separately, and I've had a noticeable improvement in balance from wearing them. And I'm pretty stable anyway. When your toes are stuck moving together, they don't develop any ability to do so, and toes are pretty important to walking / balancing.

(edited for toes instead of bunions, as I think it makes a better case)

</comment></comment></comment><comment><USER5> _"... One of the lead researchers, Dr. Bernhard Zipfel, when commenting on his findings, lamented that the American Podiatric Medical Association does not 'actively encourage outdoor barefoot walking for healthy individuals. This flies in the face of the increasing scientific evidence, including our study, that most of the commercially available footwear is not good for the feet' ..."_

Lots of expert & product placement in this article. I call a Sub ~ <http://paulgraham.com/submarine.html>

<comment><USER6> Same here. This at least the third time I've seen this kind of article in the last couple years, and that same brand of shoes has eventually been mentioned each time. (I remember the articles because those shoes are _really ugly_.)

It's sneaky, because by even bringing the issue of running barefoot up, they get to look like the pragmatic choice, unlike all those members of _the Evil Shodding Conspiracy_.

<comment><USER2> This article is from back in 2008, and does go through waves of popularity, so you might have seen the same brand of shoes each time because it's this same article each time. :)

<comment><USER6> You're right - I missed the date. It's been different articles before, but the time sounds about right.

</comment></comment></comment></comment><comment><USER7> I remain skeptical of anyone trying to tell me that I'm suffering from a horrendous disease for which there are no symptoms. The whole thing smacks of pseudoscience.

Back problems are very common. Digestive problems are very common. Foot problems? Not so much. Most old people have feet which are still perfectly functional and comfortable, and the shoes they wore most of their lives are less comfortable than shoes are now. Even women who have spent most of their lives in high heels do not, for the most part, seem to suffer from serious foot problems.

So where's the horrendous downside, that I seem to be missing, of shoes?

<comment><USER8> The argument you give could easily be made about cigarettes or any other well known health hazard. "I can't see what's bad about X, many people X all their lives and they seem fine".

<comment><USER7> Not really, the increase in lung disease due to cigarettes was very noticeable.

These supposed foot problems which supposedly 80% of 40-year-olds have are apparently invisible and symptomless. How is this different to someone telling me that my aura is misaligned or that I have too many body thetans?

<comment><USER8> Huh,

The increase in lung disease is not noticeable in the sense that you could not connect cigarettes and lung disease without scientifically studying it. In the 1920's, you'd find claims cigarettes helped the lungs.

I'm not certain about the direct shoe-body-misalignment thing. But I know physical therapists can measure habitually shortened or stretched muscles in people and this is a condition that will often cause physical problems as a person gets older even the person doesn't notice anything at the moment of measurement.

See: [http://www.amazon.com/Muscles-Function-Florence-Peterson- Ken...](http://www.amazon.com/Muscles-Function-Florence-Peterson- Kendall/dp/0683045768) The standard reference for physical therapists.

And do people get up votes these days on HN for taring any opponent with over- the-top New Age rhetoric?

</comment></comment></comment></comment><comment><USER9> Single page: <http://nymag.com/print/?/health/features/46213/index1.html>

</comment><comment><USER10> I find it curious that it's impossible to find simple leather moccasins to buy. Most of these "barefoot" shoes seem way overengineered and overpriced.

<comment><USER2> Moccasins certainly do meet many of the same goals as these shoes. But the area they're missing in is having enough of a sole to feel confident while walking through an urban area. There's enough random broken glass on the ground that I wouldn't entirely feel comfortable knowing that there's just leather between me and it.

I'll agree that the "barefoot" shoes are on the more expensive side, but I'd expect that's a function of being in a relatively niche market.

</comment></comment><comment><USER11> I started running regularly in VFFs. Previously I didn't run much at all. After a couple months I started running in my old sneakers (I forgot the VFFs when traveling). The transition back was unpleasant (ie knee and ankle pain), to the point where I kicked off my sneakers and ran barefoot on the treadmill, which stopped the pain. This doesn't imply the VFFs are better for me, as the reverse transition could have caused pain as well. FWIW I'll probably buy another pain though.

</comment><comment><USER12> I had a similar experience as the guy who began to play tennis barefoot. In the 80's I was a long distance runner, had innumerable injuries running with best running shoes money could buy, and expensive orthotics.

Finally, i began to run barefoot and never had an injury again. Barefoot running also encourages you to land your feet softly on the ground, in addition to the major benefit of not weakening tendons and ligaments etc by supporting/raising them.

</comment><comment><USER13> Barefoot walking is great. But I live in a climate where we get a snow or two most winters, and enough cold weather even without snow that a Zulu might be willing to risk his pedal health and put on shoes. I live in city that has broken glass on its concrete pavements, and plenty of stones on its park trails. I think I'll keep my shoes for now.

<comment><USER14> If you haven't do try to walk barefoot in the snow, just a couple of steps.

After that you will be glad you did it, and you will be glad that you have a pair of shoes.

<comment><USER15> Why do you shoes need to have soles though, vs being something like a moccasin?

</comment></comment></comment><comment><USER16> I spent this spring and summer walking about an hour a day, first in Vibram Five-fingers. I have a funny twist in my step on the left side which wore holes in a couple toes in the first 30 miles, so I switched to cheap Wal-Mart sneakers (it's hard to find ones with no arch-support), and eventually flip- flops. Once I got used to the flip-flops, I started taking them off on a smooth asphalt road that climbs a gentle hill near my house. I keep an eye out for obvious dirty spots, and figure several hours of Eastern Washington summer sun probably kills most of the really nasty stuff. Once my feet toughened up a bit, I added another stretch of asphalt that's quite a bit rougher.

My feet feel better than they have in years, and I now seem to have arches! Both feet were pretty flat, but I now have a nice arch on the right side, and some on the left.

</comment><comment><USER17> For what it's worth, I think MBTs are great. I first tried them a few years ago, before they were trendy and available in mainstream stores, while I was having some therapy for a recurring knee problem. My physio had suggested that the cause might be turning out more with one foot than the other, and since MBTs encourage a better walking action, they seemed like they might help.

I can't say whether it was the specialist physio exercises or the MBTs that did more to help my immediate problem at the time, but I can vouch for many of the claims that MBT marketing tends to make. They do reduce that nasty impact on each step (which you probably don't notice until you have another problem, but then you _really_ do). They did encourage me to walk with both feet aligned properly, and on the odd occasions that I've had a similar problem again over the years, switching back to MBTs for a while has rapidly cured it. You definitely feel the more active use of certain muscle groups when you first switch to them, but in my case I found that after using them for a few days, all kinds of minor irritations that might be explained by relative weakness/imbalance in those muscle groups started to clear up.

They _are_ expensive shoes, but if the pairs I've had are at all representative, the quality means they last way longer than expensive-but-not- that-expensive regular shoes anyway. I always have at least one pair in good condition now, and at the first sign of any irritation in my legs (usually if I haven't been doing much physical training for a few weeks and I'm getting out of condition) on they go.

The only major downside I've found is that because of the curved sole, MBTs aren't particularly comfortable to stand around in for extended periods. These shoes are made for walking, not standing (or running/sports).

For the record, I have no commercial interest related to MBTs, I'm just a very satisfied customer.

</comment><comment><USER18> as someone who switched to vibrams 6 months ago, and not having been an avid runner before (I do play soccer a lot) due to knee and ankle pains from heel- strike running, I've noticed distance running has become infinitely more enjoyable than it used to. That aside. I think people are missing the point of this article. The point is more about the WAY we are walking/running than what we are wearing. The solutions out there (thick soled running/walking shoes) are merely trying to alleviate the pressure caused by this poor WAY of walking (heel strikes, etc).

The fact is, when we were kids running around barefoot, we ran on the balls of our feet, because that is the instinctual way to run.

<comment><USER19> _The fact is, when we were kids running around barefoot, we ran on the balls of our feet, because that is the instinctual way to run._

Funny, I belong to some autism boards. "Toe walking" is considered indicative of ASD -- ie it is viewed as pathological. Makes me wonder if that view is partly a product of a culture where we are so used to shoes that we simply don't know how to walk/run without them. My oldest son sometimes runs the trash down barefoot -- roughly a quarter of a mile -- and he runs on the balls of his feet when he is barefoot. I have read this is the norm with barefoot runners.

<comment><USER18> well is toe walking like walking on your tip toes? thats not the same as walking on your balls of your feet/forefoot.

interesting though, i'd never heard of a link between autism and "toe walking," but i suspect you are right, this is one of those situations where society has shoe-style-walking so heavily ingrained in our minds that we see something else (even if its natural) and think something must be wrong.

<comment><USER19> Oh, I'm sure it _can_ be indicative of something. But I have two ASD kids and they are doing well in part because I was careful to not pathologize every little thing they did. Lots of things "normal" people do get viewed as pathological once someone qualifies for some label or other. I think that is extremely harmful.

I really can't say for sure what they mean by "toe walking". I filter out a lot of what gets said as "noise".

</comment></comment></comment></comment><comment><USER20> A Terra Plana store opened up near me so I went in to try the vibro barefoot shoes, since I needed new footwear.

I bought a pair as soon as I tried them on because they are so immensly comfortable; it feels less like a shoe and more like a snug, high-tech sock. Any health benefits are a bonus. (It may have improved my posture slightly, but I never paid attention to this before so can't be sure)

</comment><comment><USER14> And if you don't wear shoes, you end up with cuts from glass and stones.

Pick the less of the evils.

<comment><USER7> Glass and stones, thorns, various disgusting substances, surfaces that are too hot, surfaces that are too cold, and my personal favourite, bees.

Too much time spent walking outside barefoot as a kid led me to step on a lot of bees. Get stung by enough bees and eventually you'll probably develop a bee sting allergy, like I have. Now, the next bee I step on could kill me.

Anyway, there's a lot of things on the ground which suck in one way or another. Our ancestors invented shoes for a reason, and it wasn't because Nike marketing told them to.

<comment><USER21> > Our ancestors invented shoes for a reason, and it wasn't because Nike > marketing told them to.

Agreed, but only partially. Our ancestors invented shoes because they provided a benefit, and continued using shoes because of that benefit. What they didn't (and couldn't really) know was the cost that came along with it. Now we have the science to find out exactly what that cost is. Ignoring that cost isn't going to make it go away.

That being said, if, with full knowledge of the costs and the benefits, you decide to wear shoes anyway, then that's your choice and I can respect that.

</comment></comment></comment><comment><USER22> Long article. Would've liked to see video clips showing, "walk like this", and, "instead of this".

</comment><comment><USER8> I got a pair of super-flimsy canvas shoes for $20 from Payless Shoes on Market street two weeks ago. I've noticed that my calves aren't sore anymore and I have generally more energy.

So the solution can be pretty easy.

<comment><USER7> Counterpoint: when I walk six hours in my flimsy canvas Converse, my feet hurt a lot. When I walk for six hours in my fancypants Saucony running shoes, they don't.

I could try walking around for six hours in my bare feet, but I'm pretty sure I'd slice my foot open on something.

<comment><USER23> I'm not sure how flimsy Converse are, actually. The top of the shoe is canvas and flexible, sure, but bending the sole (at least on mine, which are relatively new) is pretty difficult, and that's what impedes "proper" foot motion. I get pain if I walk a long time in Converse, as well, but for me I'm pretty sure it's because the toe box in them is rather narrow and doesn't let me spread my toes enough. When life calls for sneakers, I usually pick other shoes -- but sometimes, vanity wins.

For a really flimsy canvas shoe, I'm imagining something along the lines of the cheapest Keds.</comment></comment></comment>


Arq / Amazon Drive Outage Resolved - <AUTHOR> https://www.arqbackup.com/blog/arq-amazon-drive-outage-resolved/ <comment><USER2> > Yesterday, as part of responding to a security incident, the Amazon Drive > security team temporarily disabled API access for Arq as well as some other > apps.

Wondering what was this about. Is it related to the rclone being banned from the Amazon Cloud Drive[1]?

[1]: [https://forum.rclone.org/t/rclone-has-been-banned-from- amazo...](https://forum.rclone.org/t/rclone-has-been-banned-from-amazon- drive/2314)

<comment><USER3> My guess is maybe it had something to do with this[1].

[1]: [https://www.reddit.com/r/DataHoarder/comments/6bi5p5/amazons...](https://www.reddit.com/r/DataHoarder/comments/6bi5p5/amazons_reply_about_the_acd_cli_issue/)</comment></comment>


A Clear Look at the Great Panic - <AUTHOR> http://www.thegatesnotes.com/Learning/article.aspx?id=114 <comment><USER2> An even more clear look would perhaps perceive the event as the collapse and bailout of a massive and complex Ponzi scheme.</comment>


Private equity firms now control many hospitals, ERs and nursing homes - <AUTHOR> https://www.nbcnews.com/health/health-care/private-equity-firms-now-control-many-hospitals-ers-nursing-homes-n1203161 <comment><USER2> Many of them were family owned but the children did not want to take over. So they were sold to private equity firms and taken over.

Like this one: [https://mgmhealthcare.com/](https://mgmhealthcare.com/)</comment>


Excess Catered Food in San Francisco? Donate it to FoodRunners - <AUTHOR> http://www.foodrunners.org/ <comment><AUTHOR> We just started using this service at GoDaddy/Locu and had our first pickup today. It was painless, felt good, and made me want to make sure the rest of the local tech community knew about them.

</comment><comment><USER2> What happens if someone gets really sick off our leftovers? A caterer of an old employer told me they didn't donate food to shelters because of the legal liability.

<comment><USER3> I've had a student startup working doing this exact same thing for the past 2 years in the PHX area - they get this question all the time. Legally they're covered by good samaritan laws, but they do take several steps to ensure food safety (temp measurements and controls in the app, avoiding certain types of foods, etc...)

<comment><USER4> Are they still active? What's the startup's name?

</comment></comment></comment><comment><USER5> I used Food Runners for close to a year at my old company and was continually impressed with their service. Even when something went wrong, they were quick to correct and improve each week. They began small but are growing. It felt good to donate the food rather than compost it.

</comment><comment><USER6> We started [http://communityplates.org/](http://communityplates.org/) a few years ago to help with this issue. Our goal was to use volunteers + technology to help with the logistics for getting the excess food to the people that needed it. Proud to say we will rescue over 3M pounds of food this year from grocery stores, restaurants, farmers markets, etc.

We are in Fairfield County, CT, Albuquerque, NM and Columbus, OH, but looking to grow.

(By the way, if anyone is looking to donate some app development time to a good cause, we'll gladly take the help)

</comment><comment><USER7> This is amazing! I used to actively participate in a group that made and delivered food to the homeless a long time ago (about 11 years ago) and that is something I miss doing. I think that organizations like this one, who are doing what they are doing for no other reason (religious, political, ideological or otherwise) than to help those who need help the most are very inspiring. I wish them all the best and hope that they eventually start expanding to other cities like Tampa and Orlando.

</comment><comment><USER8> Wish this could be done in the UK -- was giving a talk at a conference over here; hanging around back stage at the end of the night, it was quite disheartening to see that all the food trays (one of which hadn't even been started) were shovelled into black bags; the caterers said they weren't allowed to give the food to charity :(

<comment><USER9> > the caterers said they weren't allowed to give the food to charity

Smells like BS to me. Just an excuse to not have to do the logistics.

</comment></comment><comment><USER4> I was just at a conference two weeks ago ... right at the Embarcadero. Looking at some street folks in the park. Wondering what happens to all that extra food, and whether I could sneak some out. Thanks for posting this.

</comment><comment><USER10> Feeding the hungry without inquiring why they are hungry can enable self- destructive and anti-social behavior such as drug addiction. Do the food banks and homeless shelters in San Francisco help the homeless turn around their lives?

<comment><USER6> It's not just the homeless that are hungry. There are kids where the lunch they get in school is their primary source of food for the day. There are people working minimum wage jobs that have little money left over for food after they pay the rent, utilities, etc.

</comment></comment><comment><USER11> Isn't most catered food inedible by the time an event is over? If foot sit out for some number of hours (4?) then you have to trash it.

<comment><USER6> There are some safety issues around temperatures, but typically you can only save what hasn't been served yet and this food is usually in a warming tray in the kitchen.

</comment></comment><comment><USER12> This is an excellent idea. I hope they'll expand to the Peninsula.

<comment><USER13> Check out this: [http://www.peninsulafoodrunners.org/wp/](http://www.peninsulafoodrunners.org/wp/)

</comment></comment><comment><USER14> Anyone know if there is anything like this in New York City?

<comment><USER15> [https://www.cityharvest.org/](https://www.cityharvest.org/)</comment></comment>


A book about Git, hosted on Github - <AUTHOR> http://github.com/progit/progit <comment><USER2> <http://progit.org/book/>

</comment><comment><USER3> Dup - <http://news.ycombinator.com/item?id=726023>

</comment><comment><USER4> I've read this book last summer to learn git and I pretty enjoyed it. Mainly because it's succinct and because the author does a wonderful job explaining why _he_ really like git.

However, I don't get why it's on HN front page...?

</comment><comment><USER5> <http://github.com/schacon/git-reference>

An HTML version(ish) of the book

</comment><comment><USER6> That's a fairly nice book, but has a couple of errors. For example:

"The major difference between Git and any other VCS (Subversion and friends included) is the way Git thinks about its data. Conceptually, most other systems store information as a list of file-based changes." ... "Git doesn't think of or store its data this way. Instead, Git thinks of its data more like a set of snapshots of a mini filesystem."

I'd say he's got that completely wrong as far as Subversion goes. From a conceptual point of view, the easiest way to think of Subversion is in fact as a snapshotted file system. Here's how I used to explain Subversion to people when we moved from CVS to Subversion.

1\. Think of it as a special filesystem. It's much like a Samba filesystem, in that it's stored on a server. However, instead of mounting it on your desktop, you access it through the svn command. You can copy stuff from it and to it.

2\. What's special about it is that (a) changes are atomic, (b) copying is cheap in terms of time and space, and (c) special IT fairies watch over it, and whenever you make a change they first make a snapshot of the pre-changed filesystem. Most svn commands let you refer to those snapshots.

Sure, Subversion doesn't actually STORE the repository as some kind of snapshotting filesystem, but it makes it look like one as far as the user is concerned.

<comment><USER7> SVN: file-based, delta-storage

Git: content-based, snapshot-storage

The systems are completely different.

<comment><USER6> Yes, under the hood (although the distinction between file-based and content- based doesn't seem to be all the important from the conceptual model point of view--you generally access the content of blobs in Git via file-based interfaces).

The point is he's talking about how the systems appear conceptually. Conceptually the model that best describes Subversion from a user point of view is a file system that stores a snapshot of all prior states of the filesystem.</comment></comment></comment>


Fascinating Debug Report About a Scary Hidden Backdoor in Intel Processors - <AUTHOR> https://www.theregister.co.uk/2019/03/29/intel_visa_hack/ <comment><AUTHOR> full slide presentation + video is available here: [https://github.com/ptresearch/IntelVISA- BH2019](https://github.com/ptresearch/IntelVISA-BH2019)</comment>


Apple public beta for iOS9 - <AUTHOR> https://beta.apple.com/sp

<comment><USER2> So this is basically the insider-like program that Microsoft is running. I wonder if they'll also have slow and fast rings too so people can sign up for the faster updates or the more stable ones. I did not see any specific hardware requirements for devices supported by this program.

<comment><USER3> The 'fast' ring is surely the releases that are made available to developers - just that they're not free. You need to enrol in the Apple Developer Program for it.

</comment></comment><comment><USER4> This is absolutely crazy. Apple is taking a stab at Microsoft's new founded ideas. This is great. Let's the war rage.

<comment><USER5> Apple is learning that their recent iOS releases have gone very badly until the first patch or two and is taking steps to fix it. Open betas are nothing new, they're just new to MS and Apple.</comment></comment>


Google open Omaha (Google Update) - <AUTHOR> http://code.google.com/p/omaha/

<comment><USER2> This has been open source since April 2009.

<comment><USER3> Yup, I was going to say the exact same thing... [http://www.h-online.com/open/news/item/Google-Update-open- so...](http://www.h-online.com/open/news/item/Google-Update-open- sourced-741147.html)</comment></comment>


Soros-Founded Graduate School in Hungary Threatened with Closure - <AUTHOR> http://www.npr.org/2017/04/03/522503837/soros-founded-graduate-school-in-hungary-threatened-with-closure?utm_campaign=storyshare&utm_source=twitter.com&utm_medium=social <comment><USER2> At first I though they meant the language and I thought that was pretty harsh.</comment>


WW2: If planes are back with no damages on the tails, add armor on the tails...  [pdf] - <AUTHOR> http://cna.org/sites/default/files/research/0204320000.pdf

<comment><USER2> Where do you see such a conclusion in this document?

From Page 88 (emphasis added):

> "This analysis of the hypothetical data would lead to the conclusion that > the plane is _most vulnerable to a hit on the engine area if the type of > bullet is not specified_ , and is most vulnerable to a hit by a 20-mm cannon > shell if the part hit is not specified. The greatest probability of being > destroyed is .534, and occurs when a plane is hit by a 20-mm cannon shell > _on the engine area_. The next most vulnerable event is a hit by a 7.9-mm > machine gun bullet _on the cockpit_..."

<comment><USER3> The received wisdom here is that if an aircraft is capable of returning from a mission with heavy damage in a particular area, that area probably has enough strength/redundant structure already, and adding armour isn't going to accomplish much beyond adding weight.

If, however, aircraft rarely or never return from a mission with significant damage to a particular area, it's probably a good indication that damage to that area is not survivable (which is why the aircraft are not returning).

One needs to pay attention to the data that aren't present, or at least wonder _why_ they aren't present.

<comment><USER2> I understand... the survivor bias... Just couldn't understand what the OP was trying to say with the title.

</comment></comment></comment><comment><USER4> Previous discussion: [https://news.ycombinator.com/item?id=1748979](https://news.ycombinator.com/item?id=1748979)

But I swear I saw it a week or two ago as well.

<comment><USER5> You did:

[https://news.ycombinator.com/item?id=7851927](https://news.ycombinator.com/item?id=7851927)

</comment></comment><comment><USER6> This is an interesting application, and dogged mathematical derivation, of survival analysis. We would do the same calculations today with standard Kaplan-Meier curves. Do you see the survival functions, S=1-F, in the first few pages? They also state a hazard rate, all without reference to stochastic variables. It's like seeing the mathematical version of a 1943 automobile.

</comment><comment><USER7> Two weeks ago I tried to explain this idea to an ex-Air Force tour guide as we were standing next to the waist guns in a B17. He said I was full of shit and that the planes flew with basically no reinforcing armor. It was kind of embarrassing.

<comment><USER8> > It was kind of embarrassing.

I would be cringing at this scene, mostly at you.

<comment><USER7> Me too.</comment></comment></comment>


How To Safely Store A Password - <AUTHOR> http://codahale.com/how-to-safely-store-a-password/ <comment><USER2> I disagree wholeheartedly. The article is based around the fallacy we've seen time and time again, of throwing more cryptography at a problem that cryptography alone cannot solve. In the end, a crappy password is a crappy password. Successfully discouraging your users from using a crappy password has much better repercussions (for the user, for you, and for the web in general) than switching from a hash-based authentication system to bcrypt. Use bcrypt for additional security, but do not use it in an attempt to solve the problem of crappy passwords that the article falsely claims bcrypt solves.

To be more technical, bcrypt, like PBKDF2 and other schemes of that nature, add a significant amount of additional computation by iteratively applying a primitive, but still maintain a relatively small circuit size (in comparison to the primitive itself, which is usually designed to fit onto smart cards and the like). Creating and using algorithms which are "memory-hard" or require larger circuits reduces the number of circuits one can place on some area of silicon and drives up the cost of an attack. In other words, mounting an attack on bcrypt or PBKDF2 is still cheaper and potentially much faster than we'd like it to be (which is the reason those algorithms are "tunable"--you scale the number of iterations up as computers become faster). This, along with some example memory-hard functions was the topic of Percival's paper, "Stronger Key Derivation via Sequential Memory-Hard Functions," which correctly cites Bernstein as the source of emphasis on practicality in measuring an attack not by computational complexity, but the cost of launching the attack. See [http://www.bsdcan.org/2009/schedule/attachments/87_scrypt.pd...](http://www.bsdcan.org/2009/schedule/attachments/87_scrypt.pdf) if you're interested in reading further.

<comment><USER3> I'm familiar with cperciva's scrypt, and I think it's a great solution. That said, I've only seen C and Ruby bindings for it.

I'd love to recommend its use over bcrypt, as memory constraints are much more expensive than computational constraints, but recommending something most developers don't have access to would result in more weak hashing schemes in production.

<comment><USER4> In any language with sane FFI, scrypt is pretty easy to write new bindings for. At my previous job I wrote a complete scrypt plugin for Openfire in a weekend, and only a couple hours of that was for writing the JNI bindings.

<comment><USER3> Toss it up on GitHub, man.

<comment><USER4> I wasn't able to convince my boss to let me open-source it.

<comment><USER3> Awww. :(

</comment></comment></comment></comment></comment></comment><comment><USER5> But wait. What if I use a _64 bit salt_ and then AES-encrypt the password with a key I store half on my server and half in a cookie I send to the user and then they'd have to _break AES_ to get my passwords? How about _that_ , Coda Hale?

<comment><USER6> Only experts should be allowed to innovate in the security domain. Passwords on lolcats are serious business!

We certainly don't want people in the software engineering industry to come up with new ideas, implement them, and see how they work in real life. That could lead to advancement in the field, and that would be bad, because I might have to learn something new. Shudder.

<comment><USER5> For a significant portion of users, the lolcats password is equivalent to the gmail password, which is game over. But don't let that get in the way of your learning experience, which is simply going to converge on bcrypt anyways.

<comment><USER6> I know. Don't make anything cool, because someone might misuse it.

</comment></comment></comment></comment><comment><USER7> I am a crypto noob, so please excuse me if I sound stupid. But why not force your users to pick a password that is at least 8 characters and contains at least one digit, one capitalized letter, one lowercase letter and one special character, then gen a 16-byte salt and run it through SHA-512? The examples given in the article are for 6 lowercase alpha-only characters, which has always been relatively trivial to crack.

This brief article I found from 30 seconds in google shows my example at the bottom ('96 characters'): <http://www.lockdown.co.uk/?pg=combi>

I acknowledge that bcrypt seems like a simple safeguard against password attacks, but I don't doubt a hacker's ingenuity in developing a method to make attacks against it reasonable - especially if it becomes widely adopted. And I think once you've lost your password database you're already completely fucked, in one way or another.

<comment><USER5> Once you go down the road of "not doubting a hacker's ingenuity", you might as well give up and stop applying OS patches. In any case, with "16 byte salts and SHA-512", you're pitting hackers against the folk wisdom of PHP developers. With bcrypt, you're pitting hackers against the IACR. You can't know everything, but you can pick the right battles.

<comment><USER7> Folk wisdom of PHP developers? I think the creators of crypt() are _probably_ smarter than this.

Password hashes are part of a way to mitigate a particular situation: deciphering a login credential when the password database has been exposed. Shadow files are locked down to root-only because you should never trust people with your password hashes. If somebody has the hash, it's just a matter of time. I don't assume time is on my side.

If bcrypt() somehow makes it near-impossible to brute force password hashes in a "reasonable amount of time", we'd no longer need our shadow files to be root-only. We could give our bcrypt hashes out to the world and say, "Ha! TRY to crack this!" But you don't do that. Because you know deep down in your heart, once that hash is out in the open, the game is over. It's possible someone will crack it so you cannot trust it.

And if someone got access to your locked-down password database, someone is deep enough in your system to have at least read-only access to your password database. Whether or not they can decode the password they probably have other ways of getting whatever it is they really want, which is rarely just an account credential.

I will, however, agree that bcrypt appears to buy you much more time in the event that your password database is exposed. I am skeptical of how much more time that would be under the right circumstances, though, and the potential consequences of CPU exhaustion in the event of some kind of small DoS on the authentication layer.

Also: can you please comment on the original point of my post, which was using a complex password in addition to a fast salted hash? When compared to bcrypt and its purpose/results, is this still an inadequate technical solution, and why?

(edited to make 3rd paragraph not retarded and add request for clarification)

<comment><USER3> You're asking about the relative merit of two hash functions, one of which allows your attacker to test a candidate password in 1 _millisecond_ , the other of which allows the same in less than 1 _nanosecond_. Using the latter provides your attacker with a 1,000,000x productivity boost. Personally, I'm not that generous.

As far as CPU exhaustion, there are some _huge_ sites which use bcrypt (like, in the top 10)[1]. It is not a problem, provided you choose your work factor carefully.

As far as complex passwords, use them. Try to get your users to use them. But it's an orthogonal concern: your attacker will still be able to work their way through the gigantic keyspace of your monster passwords at 1,000,000x the rate of what they could do if you'd have used bcrypt.

[1] Just looked this up. Not the top 10, but the top 15 for sure.

<comment><USER8> Where did you get a list of how the top 15 sites on the internet hash/bcrypt/whatever their passwords? That sounds like some interesting information.

</comment></comment></comment></comment></comment><comment><USER9> So say we tone it down to a more feasible 0.01 seconds per hash, or to put it another way, 100 requests per second. That's only 4.8 months to crack that password. There'll certainly be future hardware advances, plus GPUs could be used to bring that down. And you can be sure someone used "password" or "123456".

Moral of the story: use long and multiple passwords.

<comment><USER5> I'm not even checking your math, because that's 4.8 months to crack _one user's password_. A spectacular win compared to "salted hashes".

<comment><USER10> I'm sorry if I'm completely misunderstanding, but couldn't a hacker generate a rainbow table once - of all the common passwords, say - and then, once they get a copy of the database in which the password hashes are stored, simply compare them? In the same way that md5 rainbow tables exist, which greatly reduce the computations required when looking for passwords?

Unless, of course, you salt them (which would turn it into 4.8 months to break all the common passwords in a table, building a rainbow table with the salt taken in mind - the only situation in which you're spending 4.8 months per user is if they're each salted differently, for example with the username)- but the article doesn't suggest salting bcrypt, so I'm ignoring that.

<comment><USER5> No. Bcrypted passwords have nonces in them, just like "salted" hashes. You don't have to think about it. You just use bcrypt.

<comment><USER11> Complete noob. Can you explain this more. if you bcrypt(12345) isn't the result always same ? If the hash varies then what does the inbuilt nonce depend on ?

<comment><USER5>
       >> BCrypt::Password.create("hi,mom", :cost => 10)
       => "$2a$10$L/c.1uoZSh3oaU1fLrnYK.yyU4PiJXsIAzN22qnbU41liyLn5/of  2"
       >> BCrypt::Password.create("hi,mom", :cost => 10)
       => "$2a$10$3F0BVk5t8/aoS.3ddaB3l.fxg5qvafQ9NybxcpXLzMeAt.nVWn.NO"
       >> BCrypt::Password.create("hi,mom", :cost => 10)
       => "$2a$10$VEVmGHy4F4XQMJ3eOZJAUeb.MedU0W10pTPCuf53eHdKJPiSE8sMK"

Despite the pages and pages and pages and pages of conversation about how to select and format "salts", adding random nonces to hashes is not one of the world's great CS problems.

<comment><USER11> I don't understand it still. The cost factor and the string remains the same but different hashes are produced. So if a user inputs "hi,mom" and the app generates a hash, how is it going to be the same as the one in DB ?

Or did you make a mistake and the cost factors are supposed to different ?

<comment><USER5> Just do what the library tells you to do to check passwords and trust me that bcrypt hashes already have nonces built into them.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I haven't seen this link on this thread yet so here we go:

<http://people.redhat.com/drepper/sha-crypt.html> Ulrich Drepper's implementation of a work factor in SHA password hashing. He addresses a popular article on bcrypt() and how using SHA allows one to follow NIST guidelines and still have the advantage of a time-consuming algorithm.

      me@myhost ~/ :) time perl -le'print crypt("some-password","\$6\$rounds=900000\$myrandomsalt")'
      $6$rounds=900000$myrandomsalt$O4u/Z5FRNBi3fw6YhAM1V1hC1LAawq9Ri65Kx77GchzOWieXeRs6w83bYqotyqBcz.WE29NygNli93dBDAbpt/

      real    0m3.996s
      user    0m3.990s
      sys     0m0.005s

If someone could comment on this in comparison to bcrypt I would appreciate it. Why should we use bcrypt if this exists in modern crypt() implementations?

</comment><comment><USER12> A nice post, but it could use some more explanation about designing password hashes.

For example salt + iterative hash works extremely well too, that's what is done in the OpenPGP format (<http://www.ietf.org/rfc/rfc4880.txt> \- 188.8.131.52 Iterated and Salted S2K).

</comment><comment><USER13> We implemented http digest authentication (<http://en.wikipedia.org/wiki/Digest_access_authentication>) in our application for the following reasons: \- We needed to securely authenticate users connecting with browsers and rss readers without ssl. \- We needed an encryption algo that we could implement in javascript so as to provide reasonably secure login without ssl.

Is there any way to do the above while storing bcrypt passwords on the server? Does using bcrypt in these scenarios force you to use https and pass full text passwords to the server?

</comment><comment><USER14> What is the difference, then, between using bcrypt and iterating MD5 10^6 times?

<comment><USER15> Presumably, bcrypt is something that has been vetted by crypto experts, whereas your idea is just some random thing you thought up. Maybe you _personally_ are a crypto expert and know for a fact that your plan will work, but the vast majority of people aren't. A packaged solution like bcrypt that doesn't give the developer enough rope to hang themselves (and their users) is a much better idea.

The idea is a developer will just do:

      passwd_str = bcrypt_string_from_password(passwd);
      db_store_password(userid, passwd_str);

and just be done with it, rather than having to decide between ROT13 (kidding), hashing, salted hashing, HMAC, etc. A couple years ago I thought applying SHA1 to a password before storing it in the DB was perfectly fine. Later I discovered that it was better to use a salt. More recently I've discovered that both of those approaches are flawed. Fortunately I've never written a large-scale application that deals with storing passwords, but I'm sure there are many application developers like me who would write much safer password storage routines if they didn't have to be the one to select an algorithm.

Now, I'm not saying bcrypt is the answer (I know nothing about it beyond what I've read on HN), but that's the general problem with your hypothetical proposal.

<comment><USER16> _whereas your idea is just some random thing you thought up_

He might also have got the idea from one of tptacek's suggestions not long ago.

The difference between doing the iterations and bcrypt is.. well.. not massive in a practical sense. You could do either (if your already MD5'ing passwords once [hmmmm], for example, then it is a quicker solution)

<comment><USER5> There's a difference: bcrypt (and moreso scrypt) were designed to be hard to speed up, while SHA1 was designed at least in part to be easy to speed up.

But in practical terms, "stretched" SHA1 is fine. I won't bitch at anyone for using it.

</comment></comment></comment></comment><comment><USER17> The problem with using a scheme designed to be computationally intensive is that it doesn't scale. How can I justify 0.3 seconds of computation time if I'm dealing with tens of thousands of connections per second?

<comment><USER18> Make the client's computer do the work.

<comment><USER16> That defeats the point of the hashing :)

<comment><USER19> Actually, it doesn't.

<comment><USER20> In this case, it does. If the client's job is to hash the password then send it to the server for comparison, you've basically got plaintext passwords. They may be quite long, but we're at that place where things don't scale anymore.

<comment><USER19> Derive a 256-bit key from your password, then send that 256-bit key to the server. Nobody is ever going to perform a brute-force search against the 256-bit derived keyspace, so any attack will need to run the KDF against a list of likely passwords in order to get a list of likely keys.

<comment><USER20> "Never", huh? Seems to me like an extremely strong statement for a security officer for a major operating system to be bandying about.

Your proposal also treats a 2-way cryptographic function as a 1-way cryptographic function. That is, optimistically, a questionable thing to do.

<comment><USER19> I am perfectly willing to stake FreeBSD's security on the belief that nobody will ever perform a brute-force search against a 256-bit keyspace.

For that matter, Microsoft, Apple, RedHat, Debian, and Ubuntu all make the same or (usually) even weaker assumptions in their respective packaging and/or updating systems.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> It probably still makes sense to salt before hashing. It might take months to crack a password using bcrypt, but is there something preventing a database of bcrypt hashes being built? (serious question)

<comment><USER3> The bcrypt algorithm has salting built-in.

</comment></comment><comment><USER22> The article is using a definition of "store" of which I was previously unaware. If you'd like to store passwords (eg, in a keyring or password manager), use GPG.

<comment><USER23> The article is talking about the problem of storing passwords in a database in order to authenticate logins. This is for people writing web-apps, not users looking to secure their own passwords.

<comment><USER22> The passwords aren't being stored, though; a value _derived from them_ is. In a properly designed system, it is computationally infeasible for an attacker to obtain the original password given the derived value.

<comment><USER24> > In a properly designed system

Proper design of such a system is the subject of the post. If you're a developer who doesn't want to think about the design of such systems, that's fantastic! Just use bcrypt.

</comment></comment></comment></comment><comment><USER25> This is one of the most useful posts on HN in my opinion. It is both very practical and informative.

</comment><comment><USER26> from the bcrypt page: _the other [bit of terrible advice] recommends reversible encryption, which is rarely needed and should only be used as a last resort._

Why is reversible encryption a terrible idea for passwords?

<comment><USER27> Because it means with <single piece of secret info>, your entire customer base's worth of passwords is now decrypted.

You've now gone from "Even if we get attacked, we've chosen a provably difficult / secure storage method. The damage should be negligible." to "If we get attacked - I hope like hell they don't get <single piece of secret info>."

An attack is an attack. If they can get in and steal your password database, what's to say that they can't get access to the key that decrypts your reversible database?

</comment></comment><comment><USER28> _How? Basically, it's slow as hell._

Is that it? bcrypt is good only because it is slow? In that case, why don't we use whatever we like (MD5, SHA1, SHA256, SHA512, SHA-3, etc) and add a _sleep(500);_ just before the call? It is guaranteed to keep up with Moore's law as well!

<comment><USER29> Did you read the article? The problem is that someone trying to bruteforce your MD5 hash won't add that sleep(500). Bcrypt is slow by design.

<comment><USER28> I thought the attack was against the application. The article talks about the security of the raw data in the database. I missed that on my first read. Sorry for that.

</comment></comment></comment><comment><USER30> I really don't want to use this word, but this is _retarded_. Something like RFC 2898 would be a good starting point for explaining why. <http://www.ietf.org/rfc/rfc2898.txt>

<comment><USER3> I'm guessing you haven't read Provos and Mazières' USENIX paper. In the design considerations, they say:

 _In general, a password algorithm, whatever its cost, should execute with near optimal efficiency in any setting in which it sees legitimate use, while offering little opportunity for speedup in other contexts._

PBKDF1 and PBKDF2 both rely upon general-purpose hash functions, which are _much_ faster in dedicated computing environments such as FPGA or GPU clusters. The Eksblowfish algorithm at the heart of bcrypt is _extremely_ resistent to optimization.

This is crucial for password storage, since if a CUDA implementation is 3-4 orders of magnitude faster than the implementation your application uses, you've just chipped off a huge chunk of the advantage offered by your hash function.</comment></comment>


Seth Godin on ad blocking - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2015/09/ad-blocking.html <comment><USER3> He makes some excellent points, particularly this one:

> _And so, in the face of a relentless race to the bottom, users are taking > control, using a sledgehammer to block them all. It 's not easy to develop a > white list, not easy to create an ad blocker that is smart enough to merely > block the selfish and annoying ads. And so, just as the default for some > advertisers is, "if it's not against the law and it's cheap, do it," the new > generation of ad blockers is starting from the place of, "delete all."_

It also slightly reminds me of what happened with NSA's mass surveillance. The NSA wasn't content to just spy on dangerous targets. It decided that if it's easy enough and cheap enough to just _collect it all_ , then they should just do that.

Now that people are finding out, the government's "encryption kills children!" argument is falling on death ears (as it should). Now people want not just encryption, but _end-to-end encryption_ that make it impossible to do mass surveillance anymore (which is _really_ what they're pissed off about - <USER2> have plenty of other means to do targeted surveillance by hacking people's devices so E2E encryption putting a stop to their legitimate investigations is a lie).</comment>


Cosyan – Transactional RDBMS with multi-table constraint logic - <AUTHOR> https://github.com/gsvigruha/cosyan <comment><USER2> It isn't really clear to me how this differs from usual database integrity constraints? However, I'm not familiar with what typical SQL databases provide.

The database I work on has had sophisticated integrity declarative integrity constraints for a decade now, so it seems surprising that this would be considered something new.

<comment><AUTHOR> Interesting, which DB is that? The ones i checked only have constraints on one table at a time (besides foreign keys).

The idea here is that constraints could span across multiple tables via chains of foreign keys. It might not be a new idea but i haven't seen any implementations yet (unless you count triggers).

<comment><USER2> We've had that for at least a decade in the LogicBlox database (which is based upon Datalog and not SQL). So you could say write

transfer_table(id, user, src, dest, amnt), amnt > 10000.0 -> auth_table(id, man), managed_by_table(user, man).

If you wanted to express that for a transfer involving more than 10,000 dollars that it must have been approved by the user's manager. Basically any logical formula can be used as a constraint. It's also possible to express basic temporal constraints like

+user_pass_table(user, pswd1), user_pass_table@prev(user, pswd2) -> pswd1 != pswd2.

So that says if the user's password has changed, and the user had a password in the previous transaction, they cannot be the same password.

<comment><AUTHOR> Thanks! I will check Datalog out, i have never used it (though i know Prolog a bit).

So the main difference is then that my version is SQL based: alter table transactions add constraint c_amount check (amount > 10000 -> auth.name = user.man.name) # or something similar, where you refer to other tables via a chain of foreign keys.

Another extra feature is that you can use aggregators in constraints in case of a one to many relationship: [https://github.com/gsvigruha/cosyan/blob/master/src/main/res...](https://github.com/gsvigruha/cosyan/blob/master/src/main/resources/doc/rules/32_reverse_foreign_keys.md)

<comment><USER2> I'm not sure why you need to restrict constraints between tables to be based on foreign keys. I guess maybe that is a limitation inherent to SQL?

We also allow constraints over aggregations. Though our syntax does require giving the result of the aggregation a temporary "table" name so that it can be used as part of the constraint.

<comment><AUTHOR> I dont need to, thats a design choice i made for the moment for various reasons, one being to stay close to SQL concepts.

It seems like your DB is basically a Datalog version of what im trying to do in SQL.

</comment></comment></comment></comment></comment></comment><comment><USER3> I've wanted multi table foreign keys and join indices for Postgres. What exactly is the design here?

<comment><AUTHOR> Probably the easiest if i link some of the doc to show some examples of usage: [https://github.com/gsvigruha/cosyan/blob/master/src/main/res...](https://github.com/gsvigruha/cosyan/blob/master/src/main/resources/doc/rules/31_foreign_keys.md) [https://github.com/gsvigruha/cosyan/blob/master/src/main/res...](https://github.com/gsvigruha/cosyan/blob/master/src/main/resources/doc/rules/32_reverse_foreign_keys.md)

</comment></comment><comment><USER4> Interesting concept. Triggers can get close to the same effect in a traditional DB.

<comment><USER5> That's a shame we have triggers as the only tool for this job, because e.g. CHECK constraint "cannot contain subqueries nor refer to variables other than columns of the current row"[1]. Triggers are very low-level thing actually, I'd consider them an assembler of RDBMS. So the questions like "Do the triggers and constraints outlined below actually cover all the bases, or is it still possible to add/modify data in such a way that the result would be inconsistent?"[2] are raised too often (usually they are _not_ raised at all, and that's even worse). And the obvious answer[3] is application-level consistency checking - which is exactly me personally consider a shame for current state of RDBMS, especially in the light of Codd' ideas (referenced above), considering the more than half of century history of RDBMS industry.

[1] [https://www.postgresql.org/docs/devel/static/sql- createtable...](https://www.postgresql.org/docs/devel/static/sql- createtable.html)

[2] [https://stackoverflow.com/questions/27191677/how-to- maintain...](https://stackoverflow.com/questions/27191677/how-to-maintain- cross-table-consistency-with-triggers-in-postgresql)

[3] [https://www.postgresql.org/message- id/m3iq57gcn9.fsf@passepa...](https://www.postgresql.org/message- email@example.com)

</comment></comment><comment><USER6> It's not clear to me why this would get you faster development cycles or better performance than application-level checks? And I'm not really sure what "dependency tracking" is supposed to mean?

<comment><AUTHOR> Yes you're totally right i need to write the readme properly. You get faster development cycle by skipping the app layer altogether. It's a few sql statements vs java code/release/deploy. Performance: you don't need multiple queries for a constraint plus you can optimize from info within the DB. Dependency tracking: no need to figure out yourself which table/operation can break which constraint.</comment></comment>


Even Google now slamming ACTA - <AUTHOR> http://news.cnet.com/8301-13578_3-20004450-38.html

<comment><USER2> I'm surprised you headlined it "even" Google. Google's policies are better aligned with hacker ethics than any other large tech company. (E.g., open source Android and Chrome, GSoC, efforts to free spectrum, Data Liberation Front)

<comment><USER3> More to the point, Google doesn't actually create any content and does make a lot of money from reproducing (in occasionally iffy ways; see the millions of copyright-infringing clips on youtube) other people's content.

If Disney and Universal start objecting to it you can use the word "even".

</comment></comment><comment><USER4> > The Motion Picture Association of America called ACTA an "important step > forward" that deserves to be adopted.

If the Motion Picture Association says its an "important step" forward, you know it really has got to be 2 "important steps" back.

</comment><comment><USER5> ...I don't get the use of "even" either. Google has been acting against ACTA for months.

</comment><comment><USER6> ACTA is megalomanic masturbation of the political and business elite.</comment>


Ask HN:  How would you promote a jobs board? - <AUTHOR> We recently set up a jobs board and we're having trouble getting it off the ground, we have tons of people to actually show the jobs to but finding people to post them is proving a lot harder than we thought.
Any suggestions? <comment><USER2> Without wanting to be negative for the sake of it, many many MANY people have tried to build job boards to compete with the established players. Few if any have succeeded even when well funded. What is it that made you feel that yours would be an different to the legions of others who have thrown themselves against the rocks of the established market leaders. I ask not to be facetious or mean, it's a real question - why is yours different? Honestly, it seems a little ill-advised to be "building a new jobs board".

<comment><AUTHOR> It's not so much to compete with anyone, we just happen to have 1000s of game developers using our platform and thought it would be a nice supplement.

</comment></comment><comment><USER3> I run a small site[1] that links to most of the popular developer job boards, and I browse most of them intermittently. Even a site like StackOverflow Careers only gets a few posts per week for a location like Boston.

Are you charging money to post? Do you have any incentives for developers to sign up (like email notifications) or is it a chicken-and-the-egg problem?

[1] <http://careers.sh/> (no ads or referral links)

<comment><USER4> Nice. How does one go about getting our site <http://www.hackerjobs.co.uk> added to your list?

<comment><USER3> I'll be happy to add a UK section.

</comment></comment></comment><comment><USER4> Welcome to my world my friend.

A few things I've learned in the short few months hackerjobs.co.uk has been live:

* Blog often

* Twitter is your new best friend

* Don't be afraid to email/call people your target market if you see them advertising on other sites

* Free job listings for a limited time is a brilliant way of attracting advertisers

* Have stats at hand at all times. Daily uniques, time on site, etc.

* Use case studies. Got a decent company advertising on your site? Tell the competition.

* Are you allowing recruiters to use your site? If so, email individual recruiters to let them know. Recruiters go crazy for new job sites that may give them an edge in the market.

* Finally, and this is a big one, when posting questions like this on HN, include a link. Hacker News is a massive source of traffic.

As others have mentioned, the biggest challenge is differentiating yourself from other job boards.

<comment><AUTHOR> Thanks for all that.

</comment></comment><comment><USER5> Here's what worked for me (for CoderStack[1]):

1) Cold-call sales

2) Advertising on Linkedin

3) Sponsoring & speaking at events

[1] <http://www.coderstack.co.uk>

</comment><comment><USER6> What makes your job board better than all the others?

Reach out to people posting jobs on other boards telling them about your site. Reach out to tech recruiters telling them about your site.</comment>