FCC fines Swarm $900K for unauthorized satellite launch - <AUTHOR> https://reuters.com/article/amp/idUSKCN1OJ2WT <comment><USER2> It feels to me as though the mantra of "move fast and break things" wasn't meant to apply to _laws_. Purposely ignoring laws, regulations, or seeing vague ones that didn't expect your crazy idea, and then hoping you can work it all out later after you've made lots of money- this is becoming more and more common in tech startups. And I personally don't like it.

Uber and AirBnB are the classic examples (and it's worked out wonderfully for them). In Toronto, Car2Go told customers to just park anywhere- don't worry about getting parking tickets, we'll handle it. (They didn't). Swarm was told that their satellites could not be launched, so they just did it anyways hoping no one would notice. (Someone did). RobinHood announced checking accounts without checking if there were laws around such things. (There are).

Governments would be better to be ready for disruptive ideas and have flexibility in regulations to try them out. And we should all be voting and supporting candidates who want to see such changes happen. But until they do, it seems wrong to purposely break laws in order to make money.

<comment><USER3> Unfortunately, laws are unlikely to change without a bit of violation.

Alcohol prohibition in the US didn't end because everyone stayed good and sober.

<comment><USER4> > "Laws are unlikely to change without a bit of violation"

The flaw with that argument is that something like 99 of 100 laws exist because, basically, they should. They benefit society, so essentially the whole population wants them.

Someone will disagree with almost every law, and some subset of them will violate it in protest. No single person knows which law is the 1 in 100 that shouldn't exist - even someone who thinks they know. Often, the people who so passionately think a law shouldn't exist that they're willing to break it are actually the least representative of society.

(I'm completely ignoring whether space launch access is or isn't a worthwhile law; it's moot.)

<comment><USER5> > The flaw with that argument is that something like 99 of 100 laws exist > because, basically, they should. They benefit society, so essentially the > whole population wants them.

That's very much debatable. It's not even clear how to count the number of laws, even if we are only considering Federal law in the US. (see [https://fas.org/sgp/crs/misc/R43056.pdf](https://fas.org/sgp/crs/misc/R43056.pdf) )

Certainly there is no one who knows all the laws, and unlike in coding, there's no commitment to DRY or modularization, which leads to very common unintended consequences.

You're arguing the 99/100 case, but I'm sure it would be easy to find someone to credibly argue the 1/100 case.

<comment><USER6> This is not even a law, it's a regulation from an agency that tries to assert itself as a regulator of communication satellites. This has strategic implications for US and it's probably a good idea anyway from a space collision point of view - but nonetheless is a regulatory land grab from other international bodies.

As a general rule, these type of moves can only be controlled by breaking them and testing then in court. The agencies have a strong incentive to go for a maximal interpretation of the relevant statues and increase their influence and funding.

<comment><USER7> Governments have a mandate to regulate what happens in their own country. It's how the entire world functions. And so it makes no sense that enforcement should be considered a land grab from other international bodies.

And we don't control crimes like murder by allowing people to break the laws and then testing them in court.

<comment><USER6> > And we don't control crimes like murder by allowing people to break the laws > and then testing them in court.

I usually err on the side of constructive conversation, but I have to say that is a ridiculous straw-man - and you know it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > _FCC Commissioner Mike O'Rielly said the size of the penalty "is probably > not significant enough to deter future behavior, but the negative press > coverage is likely to prevent this company and others from attempting to do > this again."_

To me, this reads like they're abdicating their responsibility. I'm sure their goal is to punish the company without destroying it. But if even the regulator doesn't believe the fine is going to serve as a deterrent, why do we even have a regulator for this arena?

<comment><USER9> I read that as "the _financial penalty_ is not significant enough on a standalone basis to deter future violations, but that perhaps the fine combined with the press coverage may prevent it."

If you're a VC or company backer now, how willing are you to put your money behind some company that's liable to be the _second_ intentional violator of these regulations?

<comment><USER8> Yes, I read this the same way you did, but I came to a different conclusion.

If the regulatory agency will tailor-make your fine to make sure that it's not too stiff, I don't see why any startup would follow the rules the first time around. Compliance has costs.

If you ignore compliance and your project doesn't work, then you spared yourself the time and money needed for compliance, and you won't care about the fine.

If you ignore compliance and your project does work, then the fine will not kill you, and you'll know it's worth coming into compliance.

I don't think I'm more "move fast and break things" than the average HN'er; this just seems like the logical outcome of fines that are intentionally too small. What am I overlooking?

<comment><USER3> I don't think you're overlooking anything, that sounds eminently reasonable.

New companies with new ideas can get their first projects off the ground cheaply. As they become established and do more projects, they abide by the rules. There's only a small number of "rule-breaking" projects, and plenty of scope for innovation.

Where's the problem?

<comment><USER10> Let's start a new LLC for every launch. After all, launches are expensive, and LLCs are cheap. FCC will only penalize us a little because it's always the first launch.

A little later: the FCC said we couldn't do that with LLCs that we own or are directed by people who work for us, so let's hire a series of unconnected LLCs, one per launch. We'll have to pay a bit more, but it's always the first launch. We just sell them satellites and connect them with buyers.

A little later: oops, Ajit Pai is doing community service for the rest of his life. Let's find a new loophole.

</comment></comment></comment></comment></comment><comment><USER11> So if Swarm wasn't a US-based company they wouldn't have gotten this fine? They launched the satellites from India and tested them from Georgia (the state in the US or the country? The article isn't clear).

Seems to me that future companies that want to do this sort of testing just need to do it in other countries or from off-shore platforms. _Then_ apply for your FCC license so you can charge US customers without having to worry about getting sanctioned (and losing your ability to process credit cards and bank in the US).

When I started reading the article and read about all these international launches my first thought was, "why does the FCC have a say in any of this?" Now I'm thinking, "perhaps we need a better international framework for this sort of thing."

<comment><USER2> We do have an international framework, of sorts. It's that each country must regulate satellites launched by their companies. A US-based company must comply with US laws regarding satellite launches and get permission to launch them.

In this case, Swarm lied to the Indian government and said the US had approved it (which made sense as they are a US-based company), while trying to hide the existence of the satellites from the US Government. Frankly, I think a $900k fine is too small.

<comment><USER12> My first thought when I saw 900k was "Oh shit, now everybody will do it".

<comment><USER13> Yes 900k seems like for some companies that kind of fine would be worth it to get their stuff in space and even if you made it 5 times higher seems like you could account for all of that in your budget. I think a more severe penalty would be ground them from future launches for 6 months(or other number maybe 6 months is too short), and failure to do that would have them sanctioned from the US and it's allies. The article states they are hoping the negative exposure from this fine is enough to deter the company, it is not even about the money.

</comment></comment></comment></comment><comment><USER14> Fun fact, Swam now has a job open for "Regulatory Engineer". I wonder why they would need that...

[https://jobs.lever.co/swarm- technologies/437b187b-26f9-4da7-...](https://jobs.lever.co/swarm- technologies/437b187b-26f9-4da7-ae6e-b0be64ce0bbc)

<comment><USER15> I feel bad for whoever ends up in this position. The FCC has required Swarm to designate someone to be responsible for regulatory compliance. That means someone with knowledge and experience with FCC regulatory compliance. _Not_ an engineer who happens to be tasked with work an attorney should be doing. Whoever takes this role isn't going to be compensated nearly enough for the personal risk they're about to undertake and is being set up to fail. They need a lawyer, and they need to listen to the lawyer, not an engineer.

<comment><USER14> Yeah, definitely not a job I want. I am an engineer who has worked on an application for FCC license for a different smallsat company. It was already a terrible experience dealing with the FCC. I can't imagine trying to do it when the FCC is already pissed off at your company.

</comment></comment></comment><comment><USER16> "Earlier this month, SpaceX launched three more satellites for Swarm on a Falcon 9 rocket after winning FCC approval."

This feels like a pretty important point - Swarm got slapped for their mistakes with that launch, but they're already back on track if the FCC already granted permission (what must have been months ago) for their most recent satellites. I wonder if it was just down to confusion on Swarm's part on how the rules applied.

<comment><USER14> I am pretty sure that Swarm knew that they were breaking the rules. They submitted an FCC license, were notified that the license was rejected, and decided to launch anyways.

I think part of the reason that they were able to still get licenses approved is that they agreed to more oversight from the FCC. Also, after launching the satellites Swarm was able to show the FCC that they were able to track the satellites, which was the original reason that FCC denied the license. So it seems like the FCC had to say "we were wrong, but you still broke the law so here is a fine and then we will continue on with life."

</comment></comment><comment><USER17> I'm not well-informed on the topic, but why does the FCC regulate who's allowed to launch satellites? Shouldn't there be an international authority for this?

<comment><USER18> It's hard to co-ordinate that kind of thing, so we might see it in the future but I wouldn't hold my breath.

The FCC regulates the radio spectrum usage in the US, which means if you want to talk to your satellite you need to get permission from them. They use that to try and make sure everyone in space gets along and don't crash into each other.

If the company only ever used base stations not falling under FCC jurisdiction they might have been ok, but my guess is that as long as they were operating in the US they'd probably run into issues trying to get around the FCC.

<comment><USER19> As a US company, even launching an inert block of metal would've still made the US liable for any mishaps they caused (say, by running into another satellite or hitting someone on the ground with it) under the Outer Space Treaty and the Space Liability Convention.

Evade the FCC and _someone_ with enforcement powers is still gonna be grumpy.

</comment></comment></comment><comment><USER20> negative press coverage? I can't believe people still don't get that there is almost never such a thing as negative publicity, especially for a new ventur ( with exceptions, within reason, of course )

<comment><USER21> > with exceptions, within reason

Well, how about applying those, then?

I also think you're misunderstanding the sentiment. It's not so much about negative coverage serving as additional punishment in this case, but about the coverage putting future would-be offenders on notice, and effectively preventing any profession of ignorance to serve as a mitigating factor.

</comment></comment><comment><USER22> Swarm Technologies Inc Advisors: Julius Genachowski Former Chairman, FCC (2009-2013)

good advice Mr Genachowski..

</comment><comment><USER23> I can see a Sealand 2.0 spring up around the launching of rockets from international waters. It also looks as if the bulk of the regulatory reason here is the use of the radio spectrum and not the actual launch.

<comment><USER19> Sealand was an abject failure, wasn't it?

The UK basically rolled their eyes the same way they'd ignore a kid declaring their backyard tree fort to be sovereign territory. If they'd started launching rockets, that might've been different.

<comment><USER23> I think if HavenCo had been a success the eye rolling would have rapidly stopped and we'd have seen whether or not copyright will be enforced with guns if it comes to it.

<comment><USER24> Or just cut their network access. You can figurative be an island on the high seas but a business needs to ultimately interact with others in various ways and those interactions are vulnerable.

</comment></comment></comment></comment><comment><USER25> $900,000? I wonder how this was calculated. It doesn't sound like much of a deterrent. The next rouge satellite launching company can just work that into startup costs.

<comment><USER21> It sounds like a pretty hefty fine for a small startup. It's also a fine, not a tax. Meaning this does not establish a price that you can consciously factor in when breaking the law.

The next one would surly be treated much harder, considering it would be hard to claim ignorance. And fines would also rise proportional with the size of the offender, not to menation repeat offenders.

<comment><USER26> That sounds reasonable, but do you have anything to back up any of what you said? It's just as likely that $900k is the statutory limit for this infraction.

</comment></comment></comment><comment><USER27> 900k is almost chump change in the world of aerospace, sats, and space tech.

This isn't a deterrant, it can be framed as the cost of doing business.

The fine is far too small.

</comment><comment><USER28> This isn't large enough. The fine should include the cost to remove the satellites from orbit.

<comment><USER29> If you're OK with waiting a while, the "removal cost" is zero. Those satellites are in 490km orbits which should decay in 50 years or so.

<comment><USER28> In the mean time they can hit the ISS and damage other satellites.

</comment></comment></comment><comment><USER30> I can't wait to see the first private pirate/rogue satellite launch :)

</comment><comment><USER31> This article reads as sponsored content. The outcome was a $900k advertising bill with the FCC telling everyone that Swarm has got tech up and working and that they're moving forward with the approval of the FCC... "YOU WON'T BELIEVE WHAT WORKOUT SUPPLEMENT NEARLY LANDED THE ROCK IN JAIL"

</comment><comment><USER32> I go back and forth on government regulation in the domains of the FCC. On the one hand, you have the BBC, which seems to produce interesting TV when compared to all the fluff on US TV, however, it also banned airing certain things back in the day. The BBC does well here where it can be chosen, but the Brits didn't have much choice. I remember visiting my cousins in Ireland and England in 1984, and my cousin in England only had three or four channels. Some could argue that FCC regulation led to what we have today (not Netflix and other variants) on broadcast television. I found this podcast interesting on the subject of the FCC:

[https://www.libertarianism.org/podcasts/free-thoughts/sad- hi...](https://www.libertarianism.org/podcasts/free-thoughts/sad-history-fcc- thomas-hazlett)

</comment><comment><USER33> At first I thought this was SwarmApp by Foursquare, and they wanted to track the location of every human on earth.

</comment><comment><USER34> I'd modify the fine by adding: $1m/per month while your stuff is polluting the space orbit.

</comment><comment><USER35> It's not related to Swarm, by FourSquare, right?

<comment><USER35> Was this really so horrible?

</comment></comment><comment><USER36> Was there an option to use an anti-satellite weapon to blow these things out of the sky? These rules have been pretty firm since the 1970s so pleading ignorance just looks bad.

<comment><USER37> The complaint by fcc was these objects were too small to be tracked (which was not true in the first place). How would turning them in to many more smaller pieces of debris in orbit help?</comment></comment>


Ask HN: How do I report a possible spammer/hacker - <AUTHOR>

So in the wake of the Facebook post w.r.t. email addresses showing up in google searches, I decided to google my email address and see if it comes up.
It didn't come up in a search for facebook listings but I did find my email address on this one site. I clicked on the link and turns out its a list of email addresses that someone's possibly selling to spammers.
Upon further poking around, I saw a file (there could be more of such files) having CC numbers and some tools to carry out SQL injections.
Is the Internet Crime Complaint Center the way to go? <comment><USER2> Do a WHOIS query on the IP's netblock to get the abuse address and send them an email. BTW it looks like the IP (220.127.116.11) is registered to Sparkstation, which is in Singapore (APNIC). Their address is: firstname.lastname@example.com

<comment><AUTHOR> I contacted the host (theplanet.com) about the abuse but haven't heard back from them as of this moment.

I'll email Sparkstation if I don't get a response from the host. Thanks a lot.

</comment></comment><comment><AUTHOR> oh forgot the address of the site: <http://nambua.com/>

It's registered to someone in Miami and hosted with theplanet.com

<comment><USER3> Hmm. aff.txt contains what looks like credit card credentials, complete with likely-looking cvc numbers and challenge question/answers.

I would usually start with a phone call to theplanet.com, but that's me. These days though it's hard to get ISPs to care.

EDIT: Yipes. Careful accessing this site. I can't be positive but accessing /fl/ appears to be doing something really oddball; might be trying browser exploits.</comment></comment>


Ask HN: What are the lockdown *factual* impacts on your job? - <AUTHOR> There is a lot of buzz around the current and future impacts of the lockdown on the economy. Everything looks mostly macro-level guess play. How has the lockdown impacted your own company business, and how has it impacted your own job? <comment><USER2> Engineering got 5-20% pay cuts, (50-100% at VP level and above), all perks cut, all the contractors got laid off, as did anyone low-skilled in Ops who has been there less than 2 years.

We are the UK arm of a US fintech.

The market is in trouble.

<comment><USER2> > The market is in trouble.

To elaborate on this,

1) Banks are worried people won't pay their mortgages/loans/cards and they will crash 2) Banks therefore don't buy our stuff, or will seek to pay less for it. 3) We therefore look to cut costs

Everyone is taking the cuts, because there aren't any other firms recruiting right now.</comment></comment>


LeEco in deep water after failing to meet debt payment deadline - <AUTHOR> http://www.globaltimes.cn/content/1057467.shtml <comment><USER2> Call me nuts, but before this I never even heard of the brand. So, uh, no surprise they're going under I guess?

EDIT: Great site, 504 Gateway Timeout, yum: [http://www.leeco.com/cn/](http://www.leeco.com/cn/)</comment>


Why Do Women Bully Each Other at Work? (2017) - <AUTHOR> https://www.theatlantic.com/magazine/archive/2017/09/the-queen-bee-in-the-corner-office/534213/?single_page=true <comment><USER2> It's about power, control, fear, and envy. I doubt bullying is totally a gender specific thing in the workplace.

My worst ever bullying experience was from a tech illiterate woman CTO. She treated most of the tech team like utter crap. I think because I was a woman she saw me as an intruder on her turf, and got it worse than the others.

I quit as fast and soon,as I had another job lined up.</comment>


Hacking CSRF Tokens using CSS History Hack - <AUTHOR> http://securethoughts.com/2009/07/hacking-csrf-tokens-using-css-history-hack/

<comment><USER2> Damn, seems so obvious in hindsight. When I learned about the CSS history information leakage in the first place I was alarmed enough. I clear history several times a day because of this leakage problem (and other reasons anyhow) but that's really not often enough.

I personally don't like whitelists to solve general browsing problems but noscript does allow you to only trust certain sites with possibly attaining your history information by limiting their ability to run JS. I _like_ seeing new sites with JS magic though. In general, I am leaning towards using a separate browser entirely just for things I log in to and fully trust -- this is just another log on that fire.

</comment><comment><USER3> Interesting attack, but it only works for CSRF tokens included in a URL. If you instead place your tokens in hidden form fields (which I recommend, since you should only need to protect POST requests) this attack won't affect you.

<comment><USER2> The problem is not applications you code, it's ones that you use. Do you stop using a webapp once you see a session token in the URL?

<comment><USER4> Do you notice all the other crazy bad things that the applications you use do? This is not a particularly virulent attack.

<comment><USER2> Sure. And I noticed the tokens in URLs but did not usually care that much since they are over https which doesn't reveal the parameters. Now I do care.

</comment></comment></comment></comment><comment><USER5> Why would you attach a CSRF token to a GET request? GET requests shouldn't do things, so they shouldn't need to be protected against CSRF.

(I see this is mentioned in the comments there.)

<comment><USER2> Putting session keys in a GET URL happens a lot (whether it "should" or not :-)). It's an authentication scheme for access to the URL: your GET may or may not actually have "side effects" regardless, that's orthogonal.

</comment></comment><comment><USER6> Read the comments on this one - there's some good feedback and interesting links.</comment>


How Developers Use Dynamic Features of Programming Languages: Smalltalk [pdf] - <AUTHOR> https://users.dcc.uchile.cl/~rrobbes/p/EMSE-features.pdf <comment><USER2> Here's a trick I miss from Smalltalk. (VisualWorks in particular.) While stopped in the debugger, you can easily write a script to search all existing strings for a match, even a regex match. Then you can very easily ask a string you're interested in for its "owners," inspect those objects and browse their code.

You can write code very complex conditional code for debugging, without the tons of roadblocks an environment like VisualStudio will throw in your way. Then your conditional debug code can find a particular instance and tell that specific instance to change its class to a special debugging subclass.

There are many other tricks, but the combination of just those two tricks give you debugging "superpowers."

<comment><USER3> There's so many nice things like this that Smalltalk offered. Fundamentally, they were inspired a lot by systems thinking / theory and related fields like biology. They seemed obsessed (in a good way) with allowing deeper understanding. Powerful debugging is def. a key thing here!

<comment><USER4> > they were inspired a lot by systems thinking / theory and related fields > like biology

How's that?

<comment><USER5> The objects are "alive", even the ones in the debug stack. You can "talk" to them and get their state, ask them to evaluate an alternate flow etc, for any line in the stack.

In fact, the stack itself is just a normal property of the system that shows up when the system encounters something it does not understand, and asks you to provide an answer.

Smalltalk is absolutely weird.</comment></comment></comment></comment>


Coming Soon to a Battlefield: Robots That Can Kill - <AUTHOR> https://www.theatlantic.com/technology/archive/2019/09/killer-robots-and-new-era-machine-driven-warfare/597130/ <comment><USER2> I wonder if we could ever get to the point where it would be a 100% machine vs machine war because the battlefield would be too dangerous for any humans? Humans would be more like puppet masters. The other question is could it ever get to that since the goal of a war is to stop the human opposition so the point is to always chace the human controllers?

If we ever got to the point where only machines fought that would make an interesting future. This is where SciFi writers could really enlighten us on what that future might look like.</comment>


How Silicon Valley Utopianism Brought You the Dystopian Trump Presidency - house9-2 https://www.wired.com/2017/01/silicon-valley-utopianism-brought-dystopian-trump-presidency/ <comment><AUTHOR> I didn't even want Trump, but the people on the left gave me no other choice. Many people like me are just sick of the political correctness and the vindictive racism from the left that is marginalizing anyone that isn't a minority.

Instead of cleaning your wounds and learning from your mistakes, you double- down on what caused the anger and divisiveness in the first place.

The mainstream press was caught red-handed when they colluded with the DNC to first destroy Bernie Sanders and then take aim at anyone against Hillary Clinton (which happened to be Trump).

Instead of being outraged by this, we blame the messenger, which could have been Russia or any disgruntled person angry at the fact that the press and the DNC can do as they please with impunity.</comment>


You Can Judge a Book by Its Cover, and People Do - <AUTHOR> http://bobsutton.typepad.com/my_weblog/2009/07/the-accuracy-of-first-impressions-an-amazing-old-study-about-thin-slices-of-behavior.html

<comment><USER2> The article says that because there's a strong correlation between ratings by people who have only seen 30 second clips and ratings by people who have been in class all semester, that first impressions are very accurate.

The alternative explanation is that we make snap judgments easily, and have a hard time letting go of them even after several months.

<comment><USER3> If the judgments are about whether we're going to like something, is your alternative explanation actually even different?

</comment></comment><comment><USER4> Not sure why the result is so surprising. If you are warm and confident, you are likely to appear as such in a 30 second video. If not, then not so likely. I'm not sure of all the criteria one would use to judge professional, but surely dress and appearance play a large part, and you can judge that just from a still image.

Competence is certainly harder to tell from a short clip, but I think people's impressions, both long and short term, for competence are a function of the more immediately apparent characteristics. If you wear an inside out t-shirt and have dishevelled hair, your competence rating is probably going to take a hit, even after a long term exposure.

</comment><comment><USER5> It's important to note that the study didn't actually measure objective values such as competence, rather it measured perception (and student's perception, at that) of such traits.

I'm curious as to why the author was impressed that in three 30 second samples, a student's perception of traits correlated with students who had more time (albeit several months) to develop that perception. Did they think that the instructor would act noticeably different? Or, did they think that for some reason the several month experience would develop more than perception, and actual knowledge?

Now, for a more interesting study, I'd be interested in seeing how well the student's perception correlated to a professional psychological profile, analytical review, and other _objective_ measurements of the teacher.

</comment><comment><USER6> Headline: s/It's/Its/

<comment><AUTHOR> ech, thanks

</comment></comment><comment><USER3> Isn't this just called "experience"? When you've been through 13-16 years of schooling, you learn what good teachers look (act, talk, stand, etc.) like.</comment>


A Regular Expression Matcher (2007) - <AUTHOR> http://www.cs.princeton.edu/courses/archive/spr09/cos333/beautiful.html <comment><USER2> I have a re.c file in my best-of collection of code examples locally - but I can't seem to find the original source quickly - nevertheless it was written by Russ Cox[0] and he's spent a lot of time making regular expressions accessible and elegant, his articles are a great resource.

[0] [https://swtch.com/~rsc/regexp/](https://swtch.com/~rsc/regexp/)

</comment><comment><USER3> It's a nice piece of code. I like to use it to explain how to turn interpreters into compilers through staging/specialization: [https://scala- lms.github.io/tutorials/regex.html](https://scala- lms.github.io/tutorials/regex.html)

</comment><comment><USER4> I got the guided tour of this code from bwk back in... 2006?[1]

I wasn't sure I wanted to deal with computers on a day to day basis when I took the course. The lecture blew my mind, and I started looking for programming jobs the next day.

[1] COS333. Memories... man, I'm getting old.

</comment><comment><USER5> I'm impressed.

The code lives up to its goal of being a good example of programming. As Kernighan says, it shows the value of handling special cases early and of recursion. (It's also a good example of how pointer-arithmetic and nul- terminated strings should be used, but the less said about that, the better).

Students are likely to not notice the tail recursion, so converting this to an iterative version is probably a nice exercise.

But notice that explaining _regexps_ is a non-goal of this example. There is an underlying state-machine here (encoded in a combination of the instruction pointer and the `text` variable), but it is not very obvious. For that, Russ Cox' articles are the go-to.

<comment><USER6> > (It's also a good example of how pointer-arithmetic and nul-terminated > strings should be used, but the less said about that, the better).

Why the less said the better?

I'm always disappointed when people say C is bad at string manipulation. The "character at a time, no allocations needed, stop when you hit the end" style demonstrated here and elsewhere have always resonated deeply with me.

<comment><USER7> > _I 'm always disappointed when people say C is bad at string manipulation. > The "character at a time, no allocations needed, stop when you hit the end" > style demonstrated here and elsewhere have always resonated deeply with me._

The main reason is that C doesn't really offer many primitives for string manipulation beyond pointer manipulation. All you really get is the stuff in `string.h`, which isn't much, and most of those functions are deeply flawed in one way or another:

* strcpy() can easily lead to buffer overflows if the destination array is not large enough to hold the entire string

* strncpy() will not nul-terminate the destination string if the size of the source string exceeds _n_

* ditto for strcat()/strncat()

* strtok() is not re-entrant, and therefore not thread-safe. The C11 standard is explicit that strtok() is not required to avoid data races with other calls to the function.

* You're not allowed to modify the result of strerror(), yet the function returns a regular ol' char* and, as such, the type system can't prevent anyone from doing so.

And perhaps the biggest problem of them all:

* strlen() potentially diverges (i.e., it can loop indefinitely or overflow the buffer, which causes undefined behavior[0]), making it _literally impossible_ to reliably validate a C string in standard C without knowing the length of that string _a priori_. It is also the case that the length of a string is not necessarily equal to the size of the buffer it is stored in, which means you now potentially have a _third_ thing you need to know _a priori_ (the buffer size).

The small size of C's string library means you get to roll a lot of your own string functions, including the kinds of primitives you'd expect. Even QBasic has a larger (and arguably better) string library. Alternatively, you can just forgo the functions and write loops through strings everywhere, but then as soon as you want to support some other character encoding (or multiple character encodings), you're in for a boatload of fixes throughout your codebase.

The nature of C strings being represented as arrays of characters rather than an abstract string type means that it brings you the joy of manual memory management _everywhere_. You need to constantly be allocating space for strings, deallocating buffers, keeping track of ownership, copying strings between buffers, etc. Of course, since the length of the string isn't included in the string itself, if you want to use the safe string-handling functions, you need to keep track of the lengths separately. This usually means returning a `size_t` for the length of the string, while the output of the string functions goes to a pointer ("sorta pass-by-reference") "out" parameter.

Strings that rely on sentinel values are themselves pretty flawed. Continuing the note above, it's safer and more convenient to use strings that are somehow bundled with their length. With sentinels only, reasonable things like nul- padding the strings for alignment purposes can also be a pain in the ass, since C considers the end of the string to be the _first_ nul character it encounters. An abstract string type would allow you to store the length of the string _and_ the size of the buffer in the same package as the pointer to the buffer (and possibly even the buffer itself). This can have advantages other than easier handling of padding as well, allowing you to grow or shrink the string within the same buffer without (re)allocating memory and can potentially save some copying. If you can sacrifice a byte, you can retain interoperability with functions expecting C-style strings while enabling better string handling by including the nul-terminator _in addition to_ bundled the length (Lua does this, for example). A common complaint is that this places an upper bound on the length of a string, whereas a sole sentinel value does not. This does not have to be the case if a varint[1] is used to hold the length.

C strings are also woefully inadequate for dealing with character encodings larger than 8 bits, but that's another can of worms.

In short, C's standard strings are fine, really, but they _could_ be _so much better_ with a touch of abstraction. Fortunately, it's possible to make some improvements from within C itself, but unfortunately that's often a mild pain in the ass, and not all programmers bother to do it.

\---

[0]: Of course, once your program enters undefined-behavior territory, it's off the chain and can do anything it wants, regardless of what you intended it to do, _even if your program is 100% correct in cases where there is no undefined behavior_.

 _If you 're lucky_, a buffer overflow will cause the program to crash and die _immediately_ , due to segfault or something. If you're unlucky, it'll go haywire and run amok. If you're _really_ unlucky, it'll continue to operate with no outward signs of problems, silently doing something horrible and nasty without any indication to the contrary.

[1]: [https://en.wikipedia.org/wiki/Varint](https://en.wikipedia.org/wiki/Varint)

<comment><USER8> strncat() is not like strncpy() - it _always_ nul-terminates the result.

I think your strlen() issue is a bit overblown. Either you get the string from a function that explicitly produces valid strings, in which case you know that it's a valid string already; or you get it from a raw bunch of bytes which tends to come with a size attached, giving you all the information you need to either check if it's a valid string or append a nul-terminator yourself.

<comment><USER7> > _strncat() is not like strncpy() - it always nul-terminates the result._

Yes, you're right. That's what I get for trying to speed-read the C standard at 3am...

> _I think your strlen() issue is a bit overblown. Either you get the string > from a function that explicitly produces valid strings, in which case you > know that it 's a valid string already; or you get it from a raw bunch of > bytes which tends to come with a size attached, giving you all the > information you need to either check if it's a valid string or append a nul- > terminator yourself._

Usually, yes, but neither of those things are guaranteed, unfortunately, and thus we wind up with the perennial buffer overflow exploit.

</comment></comment></comment></comment></comment><comment><USER9> I found I didn't hate, loathe and detest unbraced blocks any less when it's Rob Pike code

        if(x) {
            do_y();}

2 characters, no vertical space difference. Unbraced blocks only feature is they introduce bugs - they have no legitimate use. But man do you feel like a tough, macho- _man_ "I'm such a hard man I leave my blocks un-braced."

Is there a list of languages that repeated this C idiocy (an optimization of syntax for the parser rather than the programmers?) I sure hope those languages that would like to replace C, ie D, go, Rust etc. Haven't repeated it this far into the 21st century.

<comment><USER10> I keep one-line blocks unbraced when possible and my reasoning is definitely not to feel like a tough macho man. It's more like a mild form of OCD where any syntax that's not necessary just bothers me if I don't omit it.

<comment> jake-low Reductio ad absurdum: I assume your variable names are single-letter, your Python is indented only one space per block level and every C program is a one-liner? You should check out the Code Golf stackexchange; you'd do well.

Kidding aside, I can appreciate your feeling of OCD (I fight that urge too) but remember that most syntax is for humans, not machines. Using braces communicates intent to the reader; omitting them offers an opportunity to stumble.

<comment><USER11> Nah, humans go by indentation anyway. Just use whatever brace style you like, but make sure you have a linter / formatter that makes sure your indentation agrees with your braces.

</comment></comment></comment></comment><comment><USER11> Automata make for good regular expression matchers. Another interesting approach is via derivatives: [https://www.mpi-sws.org/~turon/re- deriv.pdf](https://www.mpi-sws.org/~turon/re-deriv.pdf)

</comment><comment><USER12> [http://doc.cat-v.org/bell_labs/structural_regexps/se.pdf](http://doc.cat-v.org/bell_labs/structural_regexps/se.pdf)

</comment><comment><USER13> I appreciate that he acknowledges me at the end. Thanks Rob!

<comment><USER14> it's brian who acknowledged you. rob only wrote the code.

exegesis is a nice word to have in one's vocabulary. brian is a good exegesist (or is that exegesisticist?)

<comment><USER15> Exegete.</comment></comment></comment>


Why Singapore is so good at English - <AUTHOR> https://qz.com/1441113/why-singapore-is-so-good-at-english/ <comment><USER2> English is an official language in Singapore. It's like asking why the Irish are so good at English. Pretty condescending.</comment>


The cyborg tech that Elon Musk says he'll do if no one else does – Recode - <AUTHOR> http://www.recode.net/2016/6/2/11837544/elon-musk-neural-lace <comment><USER2> Maybe he should focus more on not dicking over his own employees:

[http://www.recode.net/2017/1/26/14401452/tesla-lawsuit- chris...](http://www.recode.net/2017/1/26/14401452/tesla-lawsuit-chris-urmson- sterling-anderson-autopilot)</comment>


Ask HN: Do you need a Google Alerts for jobs? - <AUTHOR> If your dream company doesn't currently have a job listing that matches your skills, you're forced to continuously check back. And if you find the posting after a long period, it might be too late. Would you use a tool that scrapes your favorite job sites to notify you of new listings? Or, do you have some way of managing this problem already? <comment><USER2> Indeed does this. [http://www.indeed.com/alert?l=&radius=25](http://www.indeed.com/alert?l=&radius=25)

<comment><AUTHOR> ahh nice. thanks for this. it looks like it's maybe broad keywords, rather than company specific?

<comment><USER3> I also have indeed alerts set up, and you can receive alerts when a company you like posts a new job.

<comment><AUTHOR> hmmm. this might be just the tool I was looking for. thanks!

</comment></comment></comment></comment><comment><USER4> I use my own google custom search engine for this. You index the main job sites you are interested in and you just need to run a periodic search using your own search engine using the keywords you are interested in. It is best also to add the year of interest. Haven't figured out a way yet to filter out old archived job ads.

</comment><comment><USER5> I like [http://sitestalker.net](http://sitestalker.net)

Enter URL where you expect the job listing to show up, some keywords and you get notified via email when the job gets published</comment>


Little Stories Told with Numbers - <AUTHOR> https://github.com/postlight/account <comment><AUTHOR> My favorite line in the documentation:

> Paragraphs were a wasteful orthographic indulgence by lazy monks and we > don't allow them here.</comment>


Ask HN: Is front-end engineering ever going away? - <AUTHOR> So I was thinking if there would be a time when the world wouldn't need front-end engineers and it would be better to be a full-stack software engineer to be more flexible in the future. <comment><USER2> Uh.. I was full stack engineer and I would rather stay mostly backend than touch front end.

It's just wild wild west when I was still a full stack dev.

There was these clientside rendering framework emberjs, angular, knockoutjs, etc...

What the hell man, now the flavor is fluxjs and reactjs or whatever.

This is on top of html and css being more of an art then a science. Then came along the grid system to fix most of the warts but cross browser compatibility, etc...

I don't believe front end engineer is going away because there is just so much stuff in front end and back end to be for one person. You can be a fullstack but you can't be a master of all of it unless you got no life, no family, etc..

<comment><USER3> I do a little bit of everything, front-end, back-end, databases etc., and man, the front-end feels like such a janky disaster to me. I really miss the simplicity of the "old" internet that I had growing up (I'm in my 30's). I'm with you, I'd much rather be writing code on the back-end and spend my time solving interesting problems. My front-end problems are almost invariably styling/ display issues, etc. The kind of problems that are just labor to solve, not interesting.

</comment></comment><comment><USER4> I really hope for a standardized universal UI to emerge, maybe something like the futuristic screens in Deus Ex games. There just needs to be something like a hypermedia-api on a server, some semantic content markup, and all consumers (browsers, terminals, ...) handle everything else.

As a developer I just want to provide an data/api endpoint and say somehow "this is an universal UI app".

No, Basic HTML isnt enough, and wiring together data into presentable forms over and over again isnt particular fun or exciting after a while. Except you learn a new frontend framework for every project... :)

<comment><USER5> I think the front end guys are thinking, I really hope for a standardized universal back end to emerge, maybe something like HAL or a Siri that works.

I'm joking, of course. But I think front end and full stack developers are safe for a very long time.

</comment></comment><comment><USER6> Um, no. If you're asking about JavaScript, be warned: it's invading the backend.

<comment><USER7> I prefer the term "infesting".

<comment><USER8> Devistating and consuming memory and executing it off the stack

</comment></comment></comment><comment> et-al If you're talking about just constructing new JS views, creating templates, and styling them, yes I think that will be relegated a WYSIWYG editor for a designer to weld.

I know people said this was going to happen when Dreamweaver came out, but the languages were still clunky. CSS had barely come out and layouts were done by nesting tables within tables. The machine-created code was shit _and_ browsers were wildly inconsistent. Now we have decent browser consistency between Firefox/Chrome/Safari, CSS grids are arriving, and React component web views are gaining more traction. So in 5-10 years, why can't we have an editor that does all this for you?

Yes, there will always be a need for custom interfaces. So a small amount of front-end folks will remain hand-crafting artisan components (and perhaps selling them on a Wordpress-like market place), while other people will either need to move into design/UX roles, or further down the stack.

</comment><comment><USER9> Depends what you mean by front-end engineer. If you are interested in front- end work I would focus on brushing up on your UX and design skill. I have no particular need for someone who only knows how to implement a front end based on an exact spec, I would however love to have a developer on my team who can actually both come up with and implement a good looking, easy to use front end.

<comment><USER10> This is not realistic. UX, design and HTML/CSS/JS(this one's a beast)

Have all become complex such that it's rare to find someone who can handle all aforementioned roles efficiently. Web UI's are becoming complex everyday, and rightly so as the world has demanded more from the web.

It is very unrealistic to handle all roles or find someone who does.

<comment><USER11> It's not that unrealistic if the team is willing to let go of the idea of finding someone that's perfect in all three: UX, design and front-end.

Teams just have to find a person that's effective given their existing team and their immediate goals. I have broad skills across all three but double- down on whatever vertical the team I'm working with needs the most help with and this does not require me having to handle all three roles perfectly.

</comment></comment></comment><comment><USER12> I don't think so. There would always be a need for specialists.

Maybe full-stack engineers would have an easier time finding employment(as requiters keep on piling up those needs-to-know requirements), but some shops will always value someone who's shit-hot at one specific thing in particular, as opposed to merely competent at a lot.

</comment><comment><USER13> There is still a demand for front end devs since there are so many frameworks that are coming out and so many to maintain. I would still go for full stack roles as it would give you better job security. Plus, it would gives you a better view of how the system works.

</comment><comment><USER14> Since we're heading towards a AI-driven applications, perhaps front-end has plateaued. However, would full-stack still be so relevant if front end is no- longer a concern?</comment>


The Hijacking of a $100M Supertanker (2017) - <AUTHOR> https://www.bloomberg.com/features/2017-hijacking-of-brillante-virtuoso/ <comment><AUTHOR> [http://archive.is/xOEF9](http://archive.is/xOEF9)</comment>


Beginners' Guide to Linkers - <AUTHOR> http://www.lurklurk.org/linkers/linkers.html <comment><USER2> _Wherever the code refers to a variable or function, the compiler only allows this if it has previously seen a declaration for that variable or function—the declaration is a promise that a definition exists somewhere else in the whole program._

The notable exception here is implicitly declared functions, but they were dropped in C99 anyway.

<comment><AUTHOR> Indeed. After reading the OP and finally getting a handle on how linkers, assemblers, compilers, etc. work, I asked myself why functions weren't just implicit. Turns out K&R thought the same, but the solution sucked because it assumes an int return, which may not be what the function actually returns.

</comment></comment><comment><USER3> The `static` keyword in C is too confusing. It's hard to explain to beginners. Especially if these beginners come from Java, where it has even more meanings. I don't understand why we have to use the same keyword over and over again.

<comment><USER4> In C it only has two meanings, both of which make sense if you think of them this way:

1\. " _sta_ tic globals _sta_ y in the same file they are defined in."

2\. " _sta_ tic locals _sta_ y allocated even when the function they're defined in is not being executed."

</comment></comment><comment><USER5> Helpful for readability:

var style = document.getElementsByTagName('body')[0].style; style.width = '800px'; style.margin = '0 auto'; style['font-size'] = '19px';

<comment><USER6> Alternatively, just resize your browser window/tab.

</comment></comment><comment><USER7> Understanding the linking process is a big part of understanding a lot of the problems you'll run into with C--it's great seeing somebody going over this information!

</comment><comment><USER8> Thank you, was actually needing a refresh on this!

</comment><comment><USER9> Did someone call!?</comment>


I was an entrepreneur for two weeks. Here's what I learned. - <AUTHOR> http://www.johnfdoherty.com/entrepreneur-for-two-weeks/

<comment><USER2> "You can't really learn creativity"

false. the more you immerse yourself in a creative environment and surround yourself with creative people, the MORE creative you become.

</comment><comment><USER3> > _Error establishing a database connection_

I guess they teach Cloudflare in week three...

<comment><USER4> [http://www.johnfdoherty.com.nyud.net/entrepreneur-for-two- we...](http://www.johnfdoherty.com.nyud.net/entrepreneur-for-two-weeks/)</comment></comment>


Ask HN : Please Suggest a Real Time Web Analytics Tool - <AUTHOR>

For some time I've been using Clicky for my real time analytics. But now that free period is expired, i have to buy a pro version.
Before buying I thought it would be better if I  could get some opinion on other alternatives as well.<p>Please share your experience with real time analytics. <comment><USER2> I mean this in the nicest possible way: if your time to learn a new analytics tool is cheaper than the $100 or so it costs for Clicky for a year, I would reevaluate whether you need real time analytics. Are you sure staying glued to a constant stream of updates is a productive use of your time at this stage in your startup's life?

</comment><comment><USER3> Mint has not let me down: <http://haveamint.com>

It's a self-hosted solution, and you can see how people are coming in via referrals, SERPs, etc. in real-time.

<comment><USER4> We use Mint and GA. GA for goals and long-term trend planning and all that stuff; Mint purely to see the source of traffic spikes and search keywords that are driving traffic. I've been told that there's good stuff in Peppermill, but haven't been bothered to investigate. (Avinish is pretty insistent that you don't try to track the same stuff with different programs, otherwise you'll go mad trying to reconcile.)

</comment></comment><comment><USER5> I would stick with Clicky. If your traffic is under 100,000 pageviews / day, I haven't found a better one.

The founders are very responsive and there's a good community built around it. I use their REST API to actually integrate popularity into my site. Works great.

Sign up here: <http://getclicky.com/27959>

</comment><comment><USER6> You can signup for a free beta for the product I have been developing: <http://www.wingify.com/>

In addition to real time analytics, it provides built-in behavioral targeting and multivariate testing (website optimization) capabilities.

Mail me at email@example.com if you are interested

</comment><comment><USER7> We're working on <http://mixpanel.com> right now. It's centered around tracking user behavior & interactions, which makes it a great complement to GA.

Signups are open. Feel free to email me at email@example.com if you are interested & have questions.

</comment><comment><USER8> <http://chartbeat.com> is super duper awesome

<comment><USER9> ...unless you hit the upper limit of 5,000 simultaneous users on your site. Then, it's only sort of awesome.

<comment><USER10> And how many sites would that ever apply to? Like, 10 total sites?

<comment><USER9> It applies to us. Maybe it's a bigger problem than you think.

(Edit: I just looked at clicky. It's great, and looks like it has a lot of features that we'd use, but your most expensive plan isn't even close to the capacity we would need.)

<comment><USER10> I dont think it's a big problem :) Justin.tv is certainly amongst the top 1% of sites in the world, in terms of traffic. If you have a site that has more than 5,000 simultaneous users, you are a very very large site. There are very few sites that can claim that kind of traffic.

There aren't many products meant for tracking a site like that, and the ones that do cost thousands per month. You are paying just $10 for chartbeat. They are probably losing a lot of money on your account just on the bandwidth consumed.

I mean in the nicest possible way, but we don't have any desire to track sites that big. The largest we allow is 500,000 daily page views, and sites that big are paying us at leat $100 per month.

</comment></comment></comment></comment></comment><comment><USER11> I created this page for you, it might help to collect and rate all your options and reasons here:

[http://alpha.crowdmind.com/decision/62_What_Is_The_Best_Real...](http://alpha.crowdmind.com/decision/62_What_Is_The_Best_Realtime_Web_Analytics_Tool_Or_Service)

<comment><USER12> One comment on your page: you _don't_ need a spare server for mint. It's just javascript, and resides on your site. It's no sweat at all to install.

<comment><USER11> The installation points out that you need Apache and MySQL server. I wouldn't want to run this on my production server, so if I was to use Mint I would prefer another server.

</comment></comment></comment><comment><USER13> Been using Clicky Pro for a year now and I like it. I use both it and Google Analytics.

<comment><USER14> +1 I'm still on the 30-dray trial and I'm considering paying for it.

</comment></comment><comment><USER11> I paid $60 for Clicky for 12 months ($5/month). This is the best service out there, I switched from Google Analytics to Clicky and I've been so happy and its 60 bucks well spent!

</comment><comment><USER15> I liked Woopra when it first came out - <http://www.woopra.com/>

</comment><comment><USER16> Are there any generic event tracking services?

I'd like to be able to log generic events (either serverside or clientside) and then aggregate and display the information in a useful format.

Most of these sites seem to be based on browser sessions.

</comment><comment><USER17> I used to use <http://www.w3counter.com/> and never had any problems with it. I honestly don't know how it compares to the rest mentioned here, though, as I have never used them.

</comment><comment><USER18> antirez' thing is here: <http://lloogg.com/> \- looks like it's still in closed beta, but I bet he'd let people from here have a crack at it.

<comment><USER19> I like lloogg. My biggest complaint is that if you refresh the console, you lose the aggregate statistics, which is annoying. I haven't used it in a few months though, so maybe that's been fixed.

</comment></comment><comment><USER20> <http://reinvigorate.net> has been great for me. I am curious what else is out there though, thanks for bringing up the topic.

<comment><AUTHOR> But Reinvigorate is in Beta mode and one needs a key for registering on it. Moreover is there any daily limit on page views it can track?

</comment></comment><comment><USER21> We use Woopra for realtime web stats. It now handles HTTPS and has a pretty neat desktop client. We've yet to dive into it's API, but it's available.

</comment><comment><USER10> You basically have four real options for real time analytics, and they all either cost money, or are in beta and soon will cost money.

1\. Chartbeat. $10/month. Pretty slick, honestly, especially if you only care about "right now".

2\. Woopra. Free while in private beta. Getting accepted into the beta typically takes several weeks. Used to see tons of complaints about bugs and inaccurate stats. Seems to be less of an issue these days.

3\. Mint. $30 per site. Self hosted / installed. Plugin system to add custom functionality.

4\. Clicky. My personal favorite. Over 100,000 sites use it, so it must be at least pretty good, right?

Disclaimer: I made Clicky.

<comment><USER11> Great job and a great product! I do have one concern which is that the site is very slow and the scripts on our pages take considerable milliseconds to get. on an average twice as much as Google Analytics. Any reason for this? Also, if we make it so that the scripts load after the page has loaded, will this cause any issues?

I guess I should post this on support

<comment><USER10> Unlike Google, we are a small company and don't have millions to throw at hosting data centers all around the world on insanely fast connections. So it is very understandable that our code loads a bit slower. It is certainly a high priorty that our service has as little effect as possible on third party sites, but competing with Google is tough business!

<comment><USER11> What if you put the scripts on Amazon EC2 (S3 or CloudFront), this will alleviate your server load and put it on Amazon's backbone.

My startup uses Amazon EC2 for hosting etc, and so far I've been very happy. We are not big either, actually we are a two-man team and definitely smaller than even you guys :) But Amazon seems affordable.

Just a thought, but no worries I think the service is still tremendous. Keep up the great job!</comment></comment></comment></comment>


Developer Auction Hires 19 Year Old Thiel Fellow As COO - <AUTHOR> http://techcrunch.com/2013/01/21/developerauction-sujay-tyle?hacker=news

<comment><USER2> I think this is an interesting model and Sujay definitely seems like a talented fellow, however, am I the only one repulsed by the name "Developer Auction"?

It makes me think of another kind of auction of human labor — Slave Auction. I don't like the objectification of talented engineers or humans in general.

<comment><USER3> Auctions are the most efficient way to do price discovery for unique or difficult to price assets. I'd sure rather be a "unique and difficult to price asset" than a commodity, cog, etc.

<comment><USER2> I'm not arguing about the semantic validity of the name. Brands are about more than their semantic meaning, namely, the perceptions they generate. Developer Auction makes me think of Slave Auction. That's not good.

</comment></comment></comment><comment><USER4> Feedback on the Developer Auction site:

Why does it insist on me creating a profile for me to navigate around the site? I'd like to figure out how it works before I commit to creating a profile.

Secondly, if a profile is created, why are "Why are you interested in new job opportunities?" and "When are you available to start a new full-time job (if the right opportunity comes along)?" required fields?

There is no indication on the profile creation page who will actually view this data and because of that, I will end up closing the browser and moving on. To raise conversion, it would be more beneficial to allow people to create a profile and then put themselves on the market at a point that they decide.

Just a thought...

<comment><AUTHOR> > To raise conversion, it would be more beneficial to allow people to create a > profile and then put themselves on the market at a point that they decide.

That is exactly how it works, although it sounds like we did not do a good job communicating it.

\- first you create a profile, and submit it for review (not visible to ANYONE except for site admins at this point)

\- receive an invitation to participate in an auction

\- opt-in to the auction

\- only then, when an auction starts, your profile will visible (and only to pre-approved employers during the course of the two week auction)

Thanks for the suggestion - we need to communicate this more clearly during the signup flow.

<comment><USER4> I understand that's exactly how it works. I was just pointing out the friction points.

The example that I pointed out is a major cognitive leap for an user and you'll see a high drop off rate at that point. For an user like me, I'm happy with my current position for the moment and I haven't thought about what time frame I am looking to make a jump but I may be willing to make a jump if the right opportunity comes along. The question of "When are you available to start a new full-time job?" is a major turnoff for me because I haven't made the cognitive leap to actually apply for a job.

DeveloperAuction should be in the position of collecting as many highly qualified people as they can whether or not they are actively looking. Over time, you can use this database to raise conversion by tempting/teasing the people in your system. Example: "Hey, XYZ, I know you said you aren't currently on the market, but there are these 8 companies that are looking for your EXACT skillset, might you reconsider?" What you'll find is that top talent are never actually "looking" but rather a better offer comes their way.

Also, I'm on the belief that registration forms should not turn people away (via required fields/errors) but rather encourage people to provide more information to gain more functionality (ie "Please tell us these information to submit your profile for review" or "You're 90% of the way there, provide this information to get closer to completing your profile.")

Anyways, just a thought. Best of luck to you guys.

</comment></comment></comment><comment><USER5> Honest question, because I'm confused and still don't understand HN completely:

Why was Sujay's age added to the title of the submission when his age isn't even mentioned _at all_ in the original article?

<comment><USER6> I tend to automatically flag posts with a title like this one, usually devoid of any content worth reading.

See this recently killed post: [http://vishnumenon.com/2013/01/21/im-35-months-old-and-i- mad...](http://vishnumenon.com/2013/01/21/im-35-months-old-and-i-made-this- cool-app/)

HN discussion: <http://news.ycombinator.com/item?id=5093365>

<comment><USER5> Thanks for that, looks like I missed it.

</comment></comment></comment><comment><USER7> Sujay is a good friend and top knotch guy. Developer Auction is lucky to have him.</comment>


Ask HN: Best Book for learning about Operating Systems, especially windows? - <AUTHOR> My wife is a physcist who works with .NET. We sometimes talk about operating system, and she wanted to learn more.<p>She's a .NET dev who would ideally like a book focused on Windows that she can learn from. I didn't paticularly like or hate my textbooks in school, but what would be best for her? <comment><USER2> Sometimes it might be too technical, however, I would strongly recommend "Modern Operating Systems 4th edition by Andrew Tanenbaum". (Chapter 11 is about Windows in particular). It provides a great technical overview of most common operating systems as well as hardware and the connection to operating system on the low level.

</comment><comment><USER3> "Windows Internals" 7th ed. part 1 and 2 by Mark Russinovich would be the definitive current reference on how Windows itself works but assumes knowledge of how operating systems in general work already.

For general OS knowledge, I second the other poster's recommendation of Tanenbaum's "Modern Operating Systems"</comment>


Survey: Do small businesses use social networking? - <AUTHOR> http://news.cnet.com/8301-1023_3-10374886-93.html?part=rss&subj=news&tag=2547-1_3-0-5

<comment><USER3> The problem with social media outlets like twitter and Facebook is that they're too broad for small businesses to use. For example, ppl don't just go to Facebook or Twitter to connect with small businesses.

<comment><USER4> I think you're broadly correct about the broadness, but that does depend on 2 things -

1) The industry, because some promote more consumer engagement than others - <USER2> could see people becoming a Fan of their architect or Following the great interior designer who did their friends' place because they might do the same next year.

2) The brand the business wants to develop, because some brands are designed to be more engaging. I was tempted to use 'a butcher' as a counterpoint to the example in 1), but then I realised I would probably become a Facebook Fan of my butcher if he had a page. He remembers our names, always waves when we go past, etc etc - that works for his business, not all in his industry, so some social media might work for him and his brand as well.</comment></comment>


Married to someone with anxiety (2016) - <AUTHOR> https://www.psiloveyou.xyz/married-to-someone-with-anxiety-d5bab822ba2d <comment><USER2> If you're suffering from anxiety, cognitive behavioral therapy (CBT) really can help you. That's where I'd point first if I knew someone with mild to moderate anxiety who needed help.

From experience, anxiety fades as you choose to face the things that make you anxious, over and over and over again. Over time, you'll develop processes that will help you manage your anxiety. You'll become more resilient, more open to new experiences, and much happier.

I liken it to this quote of Marcus Aurelius:

 _" The impediment to action advances action. What stands in the way becomes the way."_

<comment><USER3> harder part of CBT is step one: identifying the bad behaviour.

usually doctors (or partners playing doctors as the case of the article) is too eager to move to action that they completely misses the point and the patient spend years just changing the background. for example, as listed in the article (not saying it was the case there), she wasted years retraining for a job change, when the trigger might have been the job putting her in a situation that triggered childhood trauma. nothing says that the new job won't put her in the same situation trigger but with different ambiance... the immediate improvement may just be the lack of 4 hour commute, which kills even non-anxiety sufferers.

<comment><USER3> not saying it is wrong or bad. but please, think trhu before any life change. while keeping in mind that at some point a significant life change will be necessary.

</comment></comment></comment><comment><USER4> > We took control by joining a new doctors surgery — one that we'd researched > and knew they had a good range of doctors who specialised in mental health > in some form.

What does this sentence mean? Did she get surgery? As a non-native speaker, I find this hard to parse.

Also, it appears to me that the author is trying to guilt trip people into spending their life with somebody who is mentally ill. While I applaud him for his patience and support, I'd like to point out that from an utilitarist view, it is sometimes preferrable to be happy alone than to be miserable together.

<comment><USER5> In the UK at least a "doctors' surgery" is synonymous with a doctors' clinic, practice, or plain office - just a place where you'll find a concentration of general practitioners.

<comment><USER6> Native American English speaker here - I don't think I've heard of this one.

<comment><USER7> In Britain, a surgery is the doctor's office. The BBC has a short explanation:

[http://www.bbcamerica.com/anglophenia/2011/09/if-a- british-d...](http://www.bbcamerica.com/anglophenia/2011/09/if-a-british- doctor-invites-you-to-surgery-should-you-be-worried/2)

</comment></comment></comment></comment><comment><USER8> Married to someone with anxiety | [https://news.ycombinator.com/item?id=13037164](https://news.ycombinator.com/item?id=13037164) (Nov 2016, 198 comments)

The previous discussion almost a year ago has a lot of great advice, including this (confirmed by several):

>physcab: _[do] not take on the role of mental health professional in your relationship_

>Broken_Hippo: _I should have insisted on some therapy for myself as well_

Mental health issues carry such a stigma even though there is usually some degree of a hardware/physical problem involved.

</comment><comment><USER9> This sounds like my wife and I three months ago. I had never personally experienced extreme anxiety, and when it came on to her full force I felt so helpless. It was completely debilitating, she couldn't just _be_.

We came to the conclusion that the root of her anxiety was work related, even though she had a mostly stress free job that paid well. Her boss was also very understanding of her situation, allowing her extra sick time, work from home, etc. I was reluctant to agree to let her quit, but quitting was the best decision we made.

This experience really shed a light on how shitty mental health resources can be. We live in Austin, and I couldn't believe how difficult it was for her to get an appointment that wasn't a month out and took our insurance. When you are suffering the last thing you want to hear is denial over and over again when trying to see a doctor. Thankfully we found someone through a family friend. Her quitting coupled with therapy has helped tremendously, we are in a much better place now.

<comment><USER10> 1 month, lol. I had to wait for 9 months to get an appointment.

<comment><USER9> Wow that's insane!

<comment><USER10> Pretty normal here. Getting an appointment for anything physical takes 1 day for the usual stuff, cardiologist between 1-3 months, psychologist 9 months to a year. So good luck with your mental health, your professional appointment is only a year away!

</comment></comment></comment></comment><comment><USER11> My wife has some crippling mental issues (severe PTSD, anxiety, depression, etc.). I've found supporting her through it has pushed me to be better at everything I do in life.

</comment><comment><USER12> From the same boat, I concur with everything in TFA. Funny detail to me, I've been at this exactly twice as long as the author. Ten years together for my partner and I, now two married on top of that.

I'll add my experience in the hope it helps others. We should form a meet up, or at least a mailing list. I bet there are a lot of us here.

The Absolute Best Thing You Can Do in this situation: Learn to recognize and manipulate your own emotional states. Take control over what you bring into the room.

On the worst days, your partner will have little no of this ability themselves. Pick up that slack and things get better faster.

Read Covey, Carneige, and Cialdini for starters. They will together persuade you that you're much more susceptible to the emotion of a moment than you thought you were. And, you'll learn to see how others have controlled the emotions you've felt in the past, to drive your behaviors. It feels like magic, like cheat codes, when it clicks. And that click is the beginning of a real empathy for what you're seeing in them.

You'll also learn how to get someone talking effectively about emotions in a way that loosens the hold, and gets the logical part of the brain re-engaged.

Reading and talking are great, but there's so much more. Find a hobby or group that forces your hand to work nonverbal communication skills. You need somewhere to practice reading others' cues and responding with your own.

Work that long enough, and you'll start to see impending anxiety before your partner experiences the brunt of it. You'll also see the anxiety states they weren't telling you about, some of which they didn't recognize as anxiety either.

At that point, you've leveled up your own emotional awareness you can start leading your partner (mostly nonverbally, sometimes in detailed conversation) to raise their own. That inspires confidence. Confidence is what you want, it's the long con (ha), and a few victories in a row will let the both of you reach for new goals: things that seemed impossible months or years ago just aren't anymore. IMHO, that's the best life.

<comment><USER13> Also look into meditation. Not to the degree that it causes anxiety, but just as something to play around with.

Despite recent posts to the contrary, there's decent evidence that it works, and the (real) risks of it causing further problems seem to only be an issue when you get serious about the whole thing (retreats, 1h+ sessions).

But even just the basic stuff like taking a walk for 30 mins and practicing the quieting of your mind, or even just five minutes of doing so, might help immensely and AFAIK carries no risks.

I can highly recommend the Headspace app, but really I'd say at least at first it's pretty simple: just go for a walk, or sit somewhere, and look around. Watch the clouds or any life around you. Or something like that. When your mind goes places far away from your direct environment, acknowledge that, acknowledge where it went and, if you want, mark it as something to think, analyze, and/or obsess over at a later time (why did I go there? does it matter? am I just being anxious? I should be less anxious. what can I do to be less anxious, etc.)

It's not solved my problems, in part because it's damn hard to even just do this. But it's achievable, and whenever I do I wonder why I didn't start earlier. Because even that tiny bit of time where I manage to 'just be', it's a reminder of how _nice_ the company of my own mind can be, that it doesn't have to be a constant struggle, and that there's good stuff worth struggling for.

</comment></comment><comment><USER14> Did anyone else find the tone of this article just a touch self- congratulatory?

When I want to hear about mental disease, I want to hear about it from the actual sufferer.

Otherwise, even someone willing to try to do the work is somehow a hero because the ill person is a burden. Focusing on the supporter takes away from how mental health is harder for the sick person, not the person who supported them (until it wasn't for me!).

If I heard people talk about a partner with cancer or MS this way, I don't think this would be a nice article anymore.

</comment><comment><USER15> I'm bipolar 1. I'm not sure how my wife does it. She's amazeballs.</comment>


Publicly funded science should be open science - <AUTHOR> http://online.wsj.com/article/SB10001424052970204644504576653573191370088.html?mod=googlenews_wsj <comment><USER2> I was hoping that this article would restrain itself to arguing for open, publicly-readable journals. Baby steps, folks. Gotta walk before you run and all that.

Mandating open journals is practical. Convincing the current community of, say, biologists to share their raw data is not. I don't think molecular biologists would literally poison each other rather than divulge their sequence data prior to its publication in a major journal, but they'd consider it. The system of funding and promotion is going to have to undergo a very big shift before this dream comes to life. (Although I suspect it _will_ come to life, eventually.)

<comment><USER3> Biggest factor left out: laziness.

I have no philosophical objection to sharing all my raw data just on the offchance somebody wants to look through terabytes of wavefunction data. But it'd take _time_ and _effort_ to organise it all. It's enough trouble for me just to get the relevant and important bits ready for publication, I don't want to sort through all my raw data as well.

<comment><USER4> Lazyness because there is no incentive. Again, the open source analogy comes handy: I usually write hugely embarrassing code for my projects, but if i had to open source it, not only would i write better, i might actually discover errors hitherto undetected. Equivalently, people would triple-check their data to avoid being embarrassed. That would also signal a shift from the "publish or perish" madness to "just publish good", which is huge.

</comment></comment></comment><comment><USER5> This would be very difficult in biology. Any single experiment isn't evidence of much, and once I do get a notion that I am on to something, if I slap that up on the web, I'll probably get beaten to the punch by someone that has more resources and/or is better positioned. It would also be tough to argue that my early experiment was critical or even necessary to get there. So I would do a lot of work, and gift it to someone else. Of course, I know that this is the point, but it's problem enough that grants are basically over-hyped sales pitches. Good science is methodical and rigorous. Until funding is less results-based, you need to show big results. It's crazy to think that it's enough to fund promising evidence. Promising evidence is even more subjective. More hyperbole is not what we need.

We need to fund the process first. Then people, then results.

</comment><comment><USER6> True story: I grabbed the URL and started to email Michael Nielsen.

Nice work, dude. :)

<comment><USER4> He is an HN regular too, i think ; certainly the most esteemed scientist i 've seen in here.

</comment></comment><comment><USER7> If you want to change a system, understand its motivations.

The article supplies a half-truth in this regard:

"If you're a scientist applying for a job or a grant, the biggest factor determining your success will be your record of scientific publications."

That's true, but the larger story is "IP"

A friend of mine has spent the past 8 years barely scraping by earning a PhD in Chemistry and working as a post-doc.

His motivation for the investment of time and energy is entrepreneurial: he plans to start a business using his discoveries.

Protecting his business interests means patents, means a closed system, means secrecy until it comes time to publish and he can be assured prior art status.

Beyond that an enormous part of Universities funding comes from IP royalties.

<comment><USER8> "Protecting his business interests"

Who funds his research? If he is funding it out of his own pocket then yes, I think it would be fair for him to have some joint ownership of the IP. However, if it was funded by someone else (e.g. the public) then my view is that everyone who contributed to funding that research should have the ability to access and use the results.

<comment><USER9> It is not really clear-cut. Typically a graduate student in the US does many things (from teaching to building a lab's basic equipment), and gets paid very little. I would not have a problem if a grad student claims that she did enough work for the money she is paid and her "discoveries" are the outcome of things she has done in her spare time. She is expected to publish of course, but there is already a remedy for not publishing: You cannot get a job in academia, and your advisor will not get further funding.

The funding provides the raw materials and the equipment in addition to the grad students' salary, so it is not unreasonable for the funding agency to require some open access to the outcome of the project. But this has to be said in advance, so people can decide whether to live on a low salary for many years while doing highly qualified work. If you want full access to my findings, so I would not be accumulating intellectual capital during my grad student years, then I would like a decent salary.

</comment></comment></comment><comment><USER10> I wrote about something similar here:

<http://news.ycombinator.com/item?id=3161027></comment>


Ask HN: What a are good questions for a first meeting with a startup lawyer - <AUTHOR>

I managed to get some time with a few startup lawyers in NYC (Wigins, Reitler, Goodwin Procter). I'm at the very beginning of my project with few real customers, no revenue, no incorporation and no outside capital. What questions would solicit meaningful answers for a startup at this stage? <comment><USER2> 1) What are your fees and fee arrangements? (Some firms accept equity or have special arrangements for accepting payment to accomodate startups.)

2) Who will be working on my issues? (I bring this up because larger firms usually have associates do the actual grunt work.)

3) Given my situation, and my goals [which you will describe to them], what is the best structure for my company for (a) legal purposes? and (b) tax purposes?

4) Same as 3a) and 3b), but _for you._

5) Ask them about IP issues. (You haven't provided enough info to provide a sample question.)

6) Ask them about employees/labor law issues, especially as it relates to co- founders, hiring your first employee, and compensation. (You haven't provided enough info to provide a sample question.)

7) Ask them about compliance/paperwork/etc. associated with maintaining the structure you will use. (It can very from a little to a lot.)

<comment><AUTHOR> That's great advice. It wouldn't have occurred to ask about personal finances.

<comment><USER3> DO NOT exchange equity for legal services. Obviously legal fees can be expensive, especially in NY and CA. Therefore, if your start-up does not have sufficient funds allocated for legal fees or the Firm offers to provide the legal services in exchange for equity consider alternative options.

For example, most law schools will have in-house small business clinics, where law students, who are generally given special permission by the State Supreme Court to practice before being admitted to the Bar, provide free legal services under the supervision of a professor licensed in the State.</comment></comment></comment>


Learning operating system development using Linux kernel and Raspberry Pi - <AUTHOR> https://s-matyukevich.github.io/raspberry-pi-os/ <comment><USER2> If you are looking to learn operating system concepts using RPi there is a new textbook by Prof. Vanderbauwhede, under ARM textbook initiative [1].

I think for educational purposes it will be very interesting and useful if someone develop from scratch a simple System V UNIX for RPi based on Bach's description in his seminal book on "The Design of the UNIX Operating System" [2]. The book also covers multi processors topic as supported by modern platforms such as RPi.

[1][https://www.arm.com/resources/education/books/operating- syst...](https://www.arm.com/resources/education/books/operating-systems)

[2][https://github.com/suvratapte/Maurice-Bach- Notes/blob/master...](https://github.com/suvratapte/Maurice-Bach- Notes/blob/master/README.md)

<comment><USER3> Is the ebook of the textbook a regular PDF/epub/mobi or is it only viewable in their viewer apps? The page doesn't say, and I don't want to spend money on it and then realize it's not a real download.

<comment><USER4> I was curious about that as well. The official ARM site doesn't list one but another distributor lists the related ISBN as epub.

[https://www.vitalsource.com/products/operating-systems- found...](https://www.vitalsource.com/products/operating-systems-foundations- with-linux-on-the-wim-vanderbauwhede-jeremy-v9781911531203)

<comment><USER5> The "book" you download from this website is _not_ an epub. You must use their apps to read it.

</comment></comment></comment></comment><comment><USER6> Might be a bit controversial but I found writing drivers for Linux on my raspberry pi helped me understand kernels, virtual memory etc. I used Linux Device Drivers (ldd3) which is free online. The book was written for the 2.6 kernel but someone on GitHub updated the code for the latest kernels.

<comment><USER7> I've never written a driver myself, because all my hardware is supported. But I've certainly added new PCI IDs to existing drivers, and done that kind of low-level learning.

I expect if I found a random piece of hardware that was close to an existing one that adding the driver, or updating things so that it worked on the new hardware would be possible. It's just not a situation I've come across.

What I found useful/educational was writing a simple linux security module.

1\. LSMs are essentially isolated. 2\. They don't care about hardware. 3\. You can do lots of things with them. Even horrid evils things.

For example I put together the following module in which the kernel calls back to userspace every single time you execute a binary, to decide whether it should be permitted or not:

[https://github.com/skx/linux-security-modules](https://github.com/skx/linux- security-modules)

(And yes, I appreciate that is almost exactly as horrid as it sounds! So much fun to hack around with though.)

<comment><USER6> You can just write char drivers that operate a slab of kernel memory, and implement all the syscalls like open, read, write on that piece of memory.

</comment></comment></comment><comment><USER8> The offical Raspberry Pi distro of Linux is already called "Raspberry Pi OS":

[https://www.raspberrypi.org/downloads/raspberry-pi- os/](https://www.raspberrypi.org/downloads/raspberry-pi-os/)

<comment><USER9> Renamed from "Raspbian". Perhaps the article was written before the name change?

<comment><USER10> Yeah the github repo ( [https://github.com/s-matyukevich/raspberry-pi- os](https://github.com/s-matyukevich/raspberry-pi-os) ) shows it as being created just a little under 2 years ago

</comment></comment></comment><comment><USER11> In terms of teaching fundamentals of operating system theory and systems programming, is there such a thing as an operating system kernel written in Python or some language which is meant to be easy to hack on for educational purposes? I wonder how useful that would be for a CS student, taking the complexity of C, C++, or Rust out of the picture and just running a kernel in a VM for educational purposes.

<comment><USER12> An OS course taught in Python is really just a data structures and algorithms course. When you ignore the hardware aspect, topics like scheduling and virtual memory management are about selecting an algorithm with the appropriate trade-offs.

My OS course was hacking on x86 Linux in C. The C wasn't really the difficult part. Honestly, neither was the assembly, as most of was boilerplate: here's how you configure to registers for a system call, here's how you trigger the interrupt for the system call, here's how you get the return codes, etc.

I don't think the class would have been nearly as valuable if C were replaced with Python. At that point, so many of the interesting details would be hand- waved away that it wouldn't really be all that different from the other programming classes I took.

<comment><USER13> If the language is boilerplate and the algorithms/data-structures derive from the physical constraints, was the OS course you completed mostly about hardware ?

As to the inciting question, there is a Stonybrook OS course [0] designed around a java simulator that students implement modules for. Springer published M Kifer's book [1] about this OSP2 system. (The binaries are accessible via the link 'Students: Software Download'.) I'm of the impression that the course involves examining the trade-offs of each module. So the thread section spawns a bunch of request events per process for a module to deal with, whether with round robin or priority queues or whatever.

[0] [https://www3.cs.stonybrook.edu/~kifer/Courses/cse306/](https://www3.cs.stonybrook.edu/~kifer/Courses/cse306/)

[1] [https://www.springer.com/gp/book/9781846288425](https://www.springer.com/gp/book/9781846288425)

</comment></comment></comment><comment><USER14> I want to learn about firmware development. I have been playing with rpi gpio and arduino i2c but have no idea how to start with firmware development. please throw at me references, i'm very fragile but i'll take it and learn from.

</comment><comment><USER15> I just wanted to say thank you. The resource is really really good. I learned a ton during the first two chapters alone

</comment><comment><USER16> Is there a similar tutorial that support rpi 2 ?</comment>


Silicon Valley Fight Club - <AUTHOR> http://sports.espn.go.com/broadband/video/videopage?videoId=3361421

<comment><USER2> Could be a good way for YC to pick its investments. I would be willing to bet that the winners would exhibit above average survival in the business world.

<comment><USER3> Not so - the best way to survive a war is to let somebody else fight it.</comment></comment>


Startup Offering Free Space Trip - <AUTHOR>

Friends of mine have put a lot of work into a groupon like startup for travel, Tripalertz.com.  They got really lucky with some partnerships and are giving away a free space trip from XCOR. Check out the site you could win a free trip to space for your time.  Comments on the site would be much appreciated.
http://tripalertz.com/space
P.S.  I debated posting this to HN since it is my first post, but I am interested in what people think of the site and I thought this crowd would be interested in winning a trip to space. <comment><AUTHOR> clickable link <http://tripalertz.com/space></comment>


Ask HN: How do I train myself to be more ready to work at a company? - <AUTHOR> I'm a self taught developer, so I've never had to do things like unit tests, git repo management (dreaded merge conflicts!), code reviews, etc.<p>Aside from writing good clean code, what are some processes or topics that I should be competent at before trying to join a team? <comment><USER2> I'd say just make sure you have some practice using a version control system and know the basics of making and merging branches. You don't have to be experienced with handling merge conflicts, when you're on a team a more experienced person can always help you with tougher cases like that.

I'm assuming you have some projects at home since you're self taught. Whenever you find yourself manually checking something works on these projects, consider writing a test. If your compiler/build system doesn't have a test framework built in, you could just write a little command line program that prints pass/fail at the end. Test frameworks are easy to learn later. The skill to develop here is knowing how to write testable code--i.e. if you can't test something without running half your code base, figure out how to decouple the thing you want to test from everything else.

Companies all have their own quirky processes for things like code review, and very few are actually following best practices, so for this you'll learn how to do things when you get there.

More important than anything I've written above though, is have some experience reading other people's code. Writing code does not necessarily make you good at reading it. I'm self taught, and I used to have a pattern of downloading an open source library I wanted to use, trying to do something in it that went past the basic examples, and then giving up because the documentation was awful. When you work for a company, you're usually surrounded by code you didn't write that has little to no documentation, so you're gonna have to learn how to read code to answer your questions in order to be effective. If you don't know how to practice this, consider downloading a little open source game you like, and try making simple changes to it. Navigating a big code base you didn't write is pretty overwhelming at first, but it's an important skill to develop.

</comment><comment><USER3> Companies that don't value these practices exist. They're everywhere. That's no excuse not to sharpen your skills, but hopefully it'll help you rest a little easier.

That said, the best medicine is practice.

To practice unit tests (or TDD when you feel like you're ready), do some katas. There are plenty of popular ones, and sites like [http://www.codewars.com/](http://www.codewars.com/) offer great challenges.

As you're working through your katas, make sure you check in to source control as you go. Learn the basics well, and pick up the rest as you go. You can always Google the more advanced stuff if you need it (most of the time, the basics are all you'll need).

For code reviews, read code. Read your own, certainly, but also read others. Hit up github. Find a repo you like, and then hit the 'commits' button. Read through the list of changes, and then write down what you think.

In real life, code reviews will be a little more tricky. You'll have to navigate a social structure and determine what is and isn't okay to say in a code review. Some groups are ruthless. Some are academic. Most, however, will be regular developers who are proud of their work, and the ability to criticize constructively will be of great value.

Two other suggestion come to mind for new team members. The first - be an apprentice first. Ask questions and learn. Especially in the beginning, your #1 job is to understand your environment - the people, processes, patterns, and practices that compose the overall work.

The second, take a shower. Nobody likes smelly teammates.

</comment><comment><USER4> Workplace culture is fucking baffling. You may need strategies to deal with bad bosses or bad colleagues. ("Hope for the best, but prepare for the worst")

Watch _The Office_ (UK) -- this is for some people uncomfortably close to their real work environment. _Office Space_ \-- ditto.

 _Better off Ted_ , _Corporate_ , and _Silicon Valley_ are somewhat more light-hearted, but there's a bunch of truth in them.

If you can stomach Dilbert there's a bunch of early Dilbert cartoons that do a good job of describing culture.

But good luck! I hope you enjoy it!</comment>