The Tenacity of Tech Recruiters - <AUTHOR> http://www.mattfriz.com/#/outbursts/recruiter-email <comment><USER2> The tenacity of blog posts about tech recruiters

\--

Dear hackernews/reddit/socialmediathatsslightlyoffthemainstreamsoicanappearedgybutstillconnectwithmytargetdemographic

My name is Person McPerson. Here in MajorTechHubCity where there's so many work opportunities, i get so many work opportunities that it actually annoys me so much that I'll spend all of 30 seconds to write a blog post about getting so many work opportunity emails. Once, I was offered a job in a programming language that hasn't been mainstream for at least 4 months! That language was ruby for all those interested. Ruby! Don't make me spit out my own coffee in indignation. I obviously tracked down the person that wrote the email and gave them whatfor. Well, actually I just pressed the "I don't know this person" button.

It's a difficult life, and i hope you empathize with my plight. It really is, as the beatles put it, a hard day's night answering all these linkedin messages. I don't actually answer them though. That's for suckers. You're not some kind of ruby using sucker are you?

Sincerely yours, Person McPerson. (available for remote work, 3 days a week due to my digital nomad lifestyle, please email me)

<comment><USER3> Thank you.

(disclaimer: not a recruiter)

I like HN, but the attitude towards recruiters here is so ugly and smug and superior. We get it. You are so annoyed by all these companies who want to hire you. You have the power to merely pick up the phone and work at Google tomorrow if it pleased you. You drive a Tesla and have a supermodel girlfriend too. Great. Congratulations. You're awesome.

For the rest of us mortals, it's nice to have someone reach out and offer to put us in touch with someone looking to hire us. This is a LUXURY not available to the vast majority of workers in the world. Be a little grateful for a change. Sure, a lot of the jobs might be "bottom of the barrel" type jobs but you never know, and it never hurts to be civil and treat these folks with a little empathy.

<comment><USER4> I do understand your sentiment, I was flattered when I first moved the to bay area, with all the recruiters sending me emails, and I would politely reply telling them that I'm not available (because of my immigration status).

But, the problem is that it's the same template, and most of the recruiters haven't even bothered to check the message that they sent (I think they are using some software to send these emails).

My name has an apostrophe in it, when the email starts with

        Hi Ala',

I know that he didn't check anything, and he is not interested in me, but in anyone.

When the email contains a lot of false statements, like

        Your experience in Python is impressive.

given that I don't use python, and my knowledge in it is very limited.

When you are receiving these emails 10 times a week, it becomes annoying.

<comment><USER5> Yes, I had my university project on my CV - which was comparing Perl, PHP and Java for a task. I didn't do any of the PHP code, yet I was constantly sent jobs for PHP because it obviously hits their keyword search.

</comment></comment></comment></comment><comment><USER6> Here's the other end, recruiters hoping to sell you candidates:

\----

I emailed you about your opening last week. I'm just checking to see if you are still searching for great candidates.

If so, I can help! I have a great candidate who you may want to interview.

If not, let me know what positions you are looking to fill and I will get to work.

CyberCoders is a pay for performance, nationwide recruiting firm that focuses on exceptional local candidates who meet your needs.

Best part? We stand behind all of our candidates and will replace them if for any reason they do not work out.

\-----

That sounds nice, doesn't it? Except that I don't have a position open at the moment, nor did I last week, and how exactly are they representing "a great candidate" when they don't even know what we're looking for?

Naturally I wrote back saying that this was great and they should send me the resume immediately. They haven't responded...

<comment><USER7> I'm generally much more pro-recruiter than the crowd here at HN, but I filter anything from Cybercoders directly to the trash, both as a candidate and a hiring manager.

<comment><USER8> CyberCoders and their overposting siblings is why I don't bother with LinkedIn job ads anymore.

<comment><USER9> i recently had an exchange with 'Bill' from Cybercoders.

'found your resume, looks fantastic, check out this job posting' \- oh, i think i know the company, would love to work with them, let me know

two weeks later - 'found your resume, looks fantastic, check out this job posting' \- don't you remember me? there was a similar posting, and you didn't get back to me, ok, no matter. 'can i call you on friday'

didn't bother calling. a week later starts leaving daily voice mails. i mistakenly answer, lie, and told him i just started at another job

a week later 'found your resume, looks fantastic...'

</comment></comment></comment></comment><comment><USER10> Recruiters get put on my autoresponder list. The automatic response says "This is an automated response. Your message was caught by a filter and automatically archived" right at the top, followed by an explanation that I don't work with third-party recruiters. About once a year I check what messages were caught by the recruiter filter and I always discover a few recruiters who have responded (apparently manually) multiple times to my autoresponder, receiving the same response every time. Their messages are usually something like "I understand why you feel that way but we're not like other recruiters, we think you'd be a really good match for X company working with a decaying technology you haven't worked in for 10 years". It's "tenacity", but I can't imagine conversing with autoresponders is very effective.

<comment><USER11> > It's "tenacity", but I can't imagine conversing with autoresponders is very > effective.

Particularly at the bottom end recruitment can be a scummy industry (just like anywhere that's sales and commission led, I suppose).

Back when I worked at a ~100 person company as a hiring manager I had recruiters pull all kinds of crazy. Recruiters submitting fake resumes to find out what positions are open, waiting for me outside the office to shove resumes into my hands, get genuine resumes from candidates not working with them, send them to me, and then claim to represent them...and that's before you get onto the black market for leads and the like.

</comment></comment><comment><USER12> It's shameful. I had to make my Instagram private, because I had a recruiter texting me and noting I was at Disneyland, suggesting I could get in touch while in line for rides.

<comment><USER13> That is simultaneously both awesome and creepy.

<comment><USER14> I'm struggling to find the "awesome" part.

I've been harassed on Instagram by people asking me to update an open source project I let go of five years ago. While it may seem neat and flattering, the reality is that it's incredibly disturbing.

<comment><USER13> I think awesome depends on the sensibilities of the person being stalked, and the sweetness of the opportunity. I concur that the creep factor likely trumps the awesome factor. Still, if a recruiter popped out of my closet with a million dollar opportunity, there's nothing to say that I can't take the opportunity, and then call the cops.

</comment></comment></comment></comment><comment><USER15> My impression is that those on the bottom of the recruiter rung do the really desperate stuff like hounding you with several weeks of emails every few days, calling you at your office, etc. If you're so unlucky to be a dead ringer for a position and have a rookie recruiter thinking they can wrangle you in, hold on to your seats.

I'd highly recommend folks read "Gurus, Hired Guns, and Warm Bodies: Itinerant Experts in a Knowledge Economy", great perspectives given from all three parties involved in this land of recruitment. Also covers some history that may no longer be well known why the state of affairs is as such.

</comment><comment><USER16> Boo hoo, you have people knocking on your door to give you a comfortable job. I wish I had that problem.

<comment><USER17> Tech recruiters at cold-call end of the Talent Acquisition Funnel aren't offering you a comfortable job, though.

They're searching on LinkedIn and offering you to throw at a company with Similarly Aligned Keywords to see if you stick.

I want to believe that there are higher-quality recruiters out there, ones who understand employee fit from both sides, but I haven't had the privilege of meeting one.

<comment><USER18> Any job with a paycheck on a regular basis is a high quality job, for me at least.

<comment><USER19> With the tech job market right now, most tech workers can find jobs that pay the bills easily, so they'll tend to raise their level of discrimination a little. So they look for the one that pays a little more, is working with some neat technology, and basically works with their schedule (Or whichever other list of nice-to-haves).

When you can afford to be picky, "high quality" takes on a different meaning.

<comment><USER20> Exactly. But the point is that is a luxury for most people. Having recruiters chase you and being irritated by it lacks some awareness of how hard it is for some people to earn a living. It is hard to sympathize with people for having to ignore a few emails every day.

<comment><USER19> That part of it isn't lost on me. Although, I think being _irritated_ by people (recruiters) harassing you is natural, but complaining about it to someone vying in a less-lively job market is insensitive, and I wouldn't expect that person to sympathize in the least.

</comment></comment></comment></comment></comment></comment><comment><USER21> the desperation/amount of the recruiters is inversely proportional to the available housing surrounding the hiring company. Hence, most recruiters are all working for companies in or near SF, or Palo Alto: of which we've heard from 100s!

Despite there being ample software companies in the east bay/tri-valley area, I haven't heard from a single recruiter, recruiting for a position in the tri- valley area - I imagine their doing just fine with their hiring.

If companies are serious about hiring talent, they're going to need to start relocating to areas that candidates can get to/live in.

<comment><USER22> This is so true. I live in an affordable area two hours from a minor tech hub. I get plenty offers for that hub, but next to nothing nearby. I have a good enough job so I have no interest in moving. Maybe 1/10 are interested in remote work, so I tend to at least hear them out.

</comment></comment><comment><USER23> My favorite recruiting emails are the ones where their name-replace code broke and left in {{first_name}} or something similar.

Ah, yes, I must be the _perfect_ fit for your role!

<comment><USER24> Why thank you {{recruiter_name}}, I realize that {{spammy_recruiting_company}} is great and that you really go the extra mile for your prospects, I'd love to hear more, but I'm really happy where I am, and as I just started am not actively looking.

</comment></comment><comment><USER25> Repost: [https://news.ycombinator.com/item?id=10319428](https://news.ycombinator.com/item?id=10319428)

</comment><comment><USER26> It's missing a bit about how the job is in a city that you last lived in three employers ago.

I'm continually having to tell cold-contact recruiters that I don't live in Austin anymore, having moved to Houston twelve years ago.

<comment><USER24> Yeah... getting called from a resume/profile over a decade old isn't much fun.

</comment></comment><comment><USER27> I'd write these emails all day every day for the money recruiters make.

<comment><USER28> Do they make a lot? How comparable is it to engineer salary?

<comment><USER29> Their fee is typically a percentage of the first year's salary for the role their candidate fills. I've seen them request up to 30%, but in my experience they settle for 10-15% depending on the situation.

For a skilled recruiter, this can accrue pretty quickly; at the rate of one role filled per month, they're bringing in equivalent to an average engineer's salary. Of course I'm ignoring overheads there, and if they're working for a recruitment firm they'll be personally receiving commission rather than an individual fee. But my experience in the UK was that there were a few powerful and well-connected independent recruiters who had most of the good candidates and interesting companies on their books - I imagine it could add up pretty quickly!

<comment><USER7> It's much like the real estate business (in the US, at least). There are a handful of people who can do extremely well, and then a long tail who think it looks like easy money but end up making very little.

</comment></comment></comment></comment><comment><USER30> Needs to mention that they were 'looking through my GitHub'

<comment><USER31> Oh, look! A couple of stolen Javascript (it's always Javascript) frameworks, as well as a fork of TensorFlow!

<comment><USER32> I've _starred_ the FB's fastText on Github. This was enough to start getting emails from recruiters looking for AI developers in my area.

Sigh...

</comment></comment></comment><comment><USER33> Today I got an email sent to my work email (which they must have guessed, it's not public) that asked how I liked working at a company I left years ago. That was a fun one.

<comment><USER34> Judging from my experience, the next one will be to place you at the company you already are.

</comment></comment><comment><USER35> I had a funny one where during the AWS S3 outage a recruiter reached out to me saying that I most likely had free time due to the outage and i should use it talking to him...

</comment><comment><USER36> A recruiter contacted me a while back with a similar act, just completely clueless. I put out ridiculous terms and informed him of a handbook I've written to help him improve. He responded by saying he was interested but only if it had data driven facts (which it doesn't). I created a coupon code to give him a free copy of the book, he never cashed it in. Recruiters are all bullshit, assume everything they say is a lie.

</comment><comment><USER37> It's too easy to bash recruiters on HN. They exist because people want jobs and employers give them money to find people.

<comment><USER29> I appreciate the value in theory, but practically tech recruitment seems to be a bit silly. Recruiters have a habit of cornering the market; if they have all the best candidates on their books, employers are almost obliged to indulge what's effectively rent-seeking behaviour. Ideally it would be much better if qualified candidates speak directly to employers and lose the go-between, who doesn't add a huge amount of value (though they can to some extent take a bit of the work out for the candidate, and possible negotiate salary and benefits more forcefully).

To me the much bigger problem in tech recruitment is the difficulty of finding permanent staff rather than contractors. I don't know what the state of the market is in the US, but in London good permanent staff are becoming as rare as hens' teeth. The natural outcome of a seller's market, I suppose.

<comment><USER38> They have potential to add huge value for candidates. I.e., if I looked for a job, I'd appreciate somebody to take the annoying part - scheduling, initial talking/pitching, resume sending, introductions, filtering out obvious mismatches, negotiating good terms, etc. - and only do the actual interviewing and deciding. But from what I hear, most recruiters are underqualified to do that, and/or prefer to play simple numbers game - spam enough people and you may get lucky.

</comment></comment></comment><comment><USER39> Pro tip: Annoying me is _not_ the most effective way to get me to do what you want.

</comment><comment><USER40> shit, if there were an actual company with real use for Merovingian numismatics, i would work there in a heartbeat

</comment><comment><USER41> My LinkedIn is completely blank - no bio, no picture, no skills, no education info, nothing about where I work, about four connections to former coworkers. I get emails almost every day from recruiters nonetheless. It's like the epitome of r-selection.

<comment><USER42> I have a picture, my education listed (CS B.S. degree from top 30 university), prior internship (with short description), and my current position at a huge company in Silicon Valley (also with a short description). On average 1-2 recruiters look at my profile without contact. What the hell am I doing wrong?</comment></comment>


If the moon were only 1 pixel - <AUTHOR> https://www.joshworth.com/dev/pixelspace/pixelspace_solarsystem.html <comment><AUTHOR> There's a lot of space out there. We're all living on a speck of dust</comment>


Elm 0.8 released – Improve Everything - <AUTHOR> http://elm-lang.org/blog/announce/version-0.8.elm/

<comment><USER2> I thought this was about <http://en.wikipedia.org/wiki/Elm_(email_client)> after all these years, what a dissapointment! :-)</comment>


Any alternate DNS systems on the horizon? - <AUTHOR>

Given the recent seizure of 70 host names by the US Government and no end in sight for these shenanigans, I was wondering if there are any alternative distributed DNS or DNS like systems being proposed?<p>While the chances of such a system gaining acceptance for all sites is slim to none at least in the short to medium turn, it could at least solve this censorship issue for a broad number of sites that the RIAA, MPAA, USA, etc. want to go after. <comment><USER2> Hosts files. Given that storing megabyte-sized data is no problem, it can work even for individual users. Update your hosts off your peers in a web'o'trust fashion.

But DNS is the easiest thing to circumvent and hence, there will be pressure to create stronger control methods.

<comment><USER3> Storing isn't the problem... I believe updating it is</comment></comment>


Ask HN: Bootstrapping a Startup Alone - <AUTHOR>

For reasons beyond the scope of this question, I must move to the Salt Lake City area within the next 3 months. I'm looking forward to this move, but it puts me in an interesting situation, and I feel the HN collective will have some interesting insight and advice to offer.
First, a little background about me so we have some context: I am not a US citizen. I will have a green card in about 18 months, but meanwhile if I work, the employer must sponsor me for a visa.
This makes me nearly unemployable. The number of employers willing to deal with the visa process is vanishingly small, consequently there are very few -- if any -- jobs available to me. An additional complication is that I am "too experienced" for many jobs. I have a Masters degree (Software Engineering) about 12 years experience working on commercial software products. In recent years my career has been focused on management/technical leadership roles. That's no accident. I wanted that experience because I have a strong entrepreneurial streak and want to involved in the business side of things. I love that stuff.
However, I'm also passionate about building web products. I code for fun. I'm a geek, and I get a kick out of building cool stuff. I have no interest in being a middle management drone. I'd much rather starve and build something cool with a group of passionate people. I think a lot of people on HN are like that.
I'm thinking my unemployable status might in fact be an opportunity. My wife will be making enough money that we can get by with just her salary. She is happy to support me if I decide to invest my time into building something that has the potential to be turned into a startup when I am legally permitted to.
I always have a few ideas that I'm thinking about, working on, etc and now is no exception. I'm thinking this might be an opportunity to iteratively build prototypes and get market/customer validation for something that I can then really launch once I have a green card.
My questions: Is this something that's viable to do, in your experience? I don't have a professional network in Utah, so at least initially I will be alone on this - and in fact will have to be, since I cannot legally start a business. Also, does anyone have any advice as to how I might build a professional network of like-minded people when I'm in a situation like this? I have the social side of things covered (I participate in a lot of outdoor sports).
 I'm happy to elaborate further, I just wanted to keep this question short and to the point. <comment><USER2> So you like challenges?

You definitely want to talk to a business attorney and pay for some professional advice on the best way to set this up. You really don't want to put the next year of your life into this and then end up in a fight with the U.S. government over it.

You might consider incorporating in Nevada. Nevada and Texas have protections for businesses against piercing the corporate veil, as well as some protections from the IRS. Your business just needs a contact in Nevada, and there are a number of businesses that provide this as an affordable service. If any legal trouble comes up, you can "hide" behind your Nevada contact; the courts have supported all but one case of this, I think.

Make sure you cover yourself for taxes and all the other paperwork. I have no idea how not being a citizen will affect your tax situation.

Be aware that you may be endangering your marriage. Although your wife can support both of you, it would be natural for some amount of resentment to develop if she isn't able to see clear, regular progress on your project, even if she's an amazing person. On the other hand, it may take you weeks of frustration and dedication to produce anything that looks like progress, depending on what you're doing.

Be sure that you have the motivation and self-discipline to spend 8 uninterrupted hours per day on your project, at a minimum. You should clock in, and clock out, and otherwise treat it just like a full-time job. Set goals: at the end of the week, you'll have X done. At the end of the day, you'll have Y done.

Depending on what you're doing, it can also be one of the most challenging things you've ever done -- maybe even grueling. Or, maybe it'll be easy. Easy would be good, because you'll have enough legal, tax, and business challenges as it is.

I boot-strapped a small business, by myself, with no savings, a few years ago. It's not a "startup" in the HN sense, but it's been making money since the beginning, and it's doing really well now. That said, some masochistic streak within me makes me go out and do the hardest things I can find, and this has been the hardest thing I've ever done, by far. The stress from it has resulted in a few minor health problems, and I now have chronic sleeplessness. I have an indescribable amount of gratitude for the help I got recently in the form of a girlfriend that likes me and likes my projects.

So, help is good. "Alone" is not fun. Try to have help.

<comment><AUTHOR> Thank you, these are exactly the sorts of things I need to know. It's especially helpful to hear it from someone who has "been there".

</comment></comment><comment><USER3> Just to be clear; your wife can support both of you while you're waiting for your green card to come through?

This seems like the perfect opportunity to try to make something to me, as long as she's on-board with the plan.

<comment><AUTHOR> Yes, that's correct. I agree it's an opportunity - albeit one with a few challenges. But, challenges are part of what makes it fun!

</comment></comment><comment><USER4> I've been in Park City (30 min from Salt Lake) for a year and half and have been pleasantly surprised at the vibrancy of the SLC startup community. A couple things to check out:

www.launchup.org - startup "barn raising events", excellent networking opportunity. I met a designer presenting at one of these and we went on to form a company that was contracted to build a Twitter app that eventually sold for 6 figures. Exciting!

Funding Universe's CrowdPitch events. Great for networking even if you go as a spectator.

www.boomstartup.com - Accelerator; you'd need to find a cofounder and not sure if the visa issue would exclude you, but there will probably be networking events around this.

www.siliconslopes.com

BYU Web Entrepreneurs Group

There's a lot more, too. Informal meetups, overlap with social media events (sometimes--other times these can be painfully dull) . . . overall I've found founders here, big and small (and yes they do get big here), to be very approachable and helpful. Get on Twitter and search for some entrepreneurial types here and you can check out the Twitter lists they are on to find more.

I'd offer to meet and help, but I'm moving to Los Angeles in a few days and can only hope I find it as startup-friendly as Utah.

<comment><AUTHOR> Excellent resources, thanks! I too have been quite impressed with Utah's tech industry. There's a lot more interesting things going on than I think most people would suspect.

</comment></comment><comment><USER5> Check with a real immigration lawyer. I suspect that you can leverage your wife's work status, but IANAL.

I'm thinking that she can start a biz even though she's employed. You don't take a salary, she takes money out of the biz just like every other S-corp/LLP and puts it into your joint account. Community property can be your friend....

</comment><comment><USER6> Check out <http://webstartupgroup.com>

These guys are based in Utah and have frequent events at Brigham University. Mixers are great for meeting your future employees, partners or collaborators. Get in involved and definitely start building a personal/professional brand from day one.

In Toronto, we have the MaRS Discovery District. Which is a mix of private and government money funding startups, hosting entrepreneurship classes for free, office spaces, mixers, cash prizes for app. competition, keynote speakers etc. Outsiders may also find the content useful <http://www.marsdd.com>

It shouldn't be hard to locate a similar program in your region.

Good luck

</comment><comment><USER7> This is the kind of time where you build something larger than the minimal viable product. Something you may want to consider is building an open source project, then charging commercial support once you get a green card.

<comment><AUTHOR> That's an intriguing direction I hadn't thought of. Hmmm... could be some possibilities there.

</comment></comment><comment><USER8> Well since you are not a US citizen maybe you can incorporate somewhere else, if you really have to. A UK limited might be an option.

</comment><comment><USER9> You can own a business but you cant work for it unless you have a visa. If you write a business plan and can get some funding you would be able to get a H1 for yourself. This is obviously not easy but people have done it. And in a down market, its much easier to get a H1 as the bigger companies arent using up the supply.

<comment><USER9> Just to clarify, you would need the funding or letters of intent from customers to prove to the USCIS that your business would actually be viable and for them to issue the H1.

</comment></comment><comment><USER10> If all you're building is web products and you can afford to live for a few months, just start building!! You don't need to have a 'business' to do this. Please don't pay for legal advice or try to incorporate. You can do all of that later when it actually makes sense.

<comment><USER2> This is terribly bad advice, unless you plan to give away your labors for free.

Things get complicated as soon as you start making money.

<comment><USER10> But he's not likely going to make any money in the next several months, so for now he should just build. If he starts making substantial revenue, he can deal with the legal stuff at that point.

<comment><USER2> I respect where you're coming from -- just concentrate on building, make it awesome, and everything else can wait -- but that's a good way to end up in an ugly situation, especially since he's a non-citizen. I don't know the rules around non-citizens starting a business in the U.S., do you?

Also: if the business is starting to make money, then that's the ideal time to really concentrate on it. Iterate, iterate, iterate. It's hard to do that though if you have to step away and deal with the legal stuff instead; it becomes a distraction at exactly the wrong time, and you don't even know ahead of time how long it will take to deal with.

There's a reason that YC helps their startups incorporate, even before they have a product to sell. It's best to just deal with that immediately, get it out of the way, and then get to work on the product. (This is also the advice of most of the books I've read on starting or maintaining a business.)

I did it your way, actually, and this year I have a tax bill that I cannot afford. You might say that I should have handled that when I knew that the business had grown that much, and you'd be right, but the problem was that I was too busy making money and keeping up with demand to slow down and deal with the legal and tax stuff. Now I have a much larger problem than I would have had if I'd taken care of this in the beginning.

And I'm a U.S. citizen. I have no idea how it would work for someone who isn't.

<comment><USER11> You can file a tax extension. It defers your taxes by 6 months. You pay 5% annual interest on it.

<http://www.irs.gov/formspubs/article/0,,id=98155,00.html>

<comment><USER2> You can defer filing your tax forms for 6 months, yes; however, any amounts that you owe must be paid by April 15th. From the link: "Please be aware that an extension of time to file your return does not grant you any extension of time to pay your tax liability."

It is possible to file an application for a payment plan with the IRS. IIRC, you can only do this once every 5 years or so; having done it anytime in the last five years disqualifies you from being eligible for a payment plan. You must also show that you can't actually afford the amount owed. You're able to choose your own payment plan -- $/month for N months -- but the longer you stretch it out, the uglier it gets, due to interest. If you default on the payment plan for any reason, there are some pretty serious fees and other interest added on (so said my CPA).

The big lesson for me here is that there is a 15% self-employment tax for sole proprietors and partnerships, and that it's assessed against your AGI, no matter how low your AGI is. I was confused about this and hadn't bothered to figure out my tax situation ahead of time because I was certain that my AGI would put me below the usual poverty line. But, there is no such thing for those that are self-employed. Oops.

I would have saved myself quite a bit of money if I'd taken care of this earlier last year, rather than waiting until the deadline was too near.

</comment></comment></comment></comment></comment></comment><comment><USER12> Definitely viable!

There's nothing to say you can't be a share-holder in a company - or a director of one you create yourself. You just can't be an employee without a work permit. (although if you incorporate overseas, I think you should be able to pay yourself through that and declare it as income earned overseas. I'm unclear on US law, but that seems universal in most countries I've lived.)

I think you're in the ideal place to take a few of your ideas to market and see if you can gain traction. Good luck with it!

</comment><comment><USER13> Why 18 months to get your green card? Is yours a recent marriage? Is your wife not a permanent resident? Not sure why a spouse-sponsored permanent residence process is estimated at 18 months for you.

I'm going through this with my wife right now and so far USCIS has been very quick. We're just entering month 4 of the process and it looks like we may have it all wrapped up by month 6.

<comment><AUTHOR> My wife's employer is sponsoring us for the green card. She is in a category that used to be processed quickly, but is now taking much longer. Meanwhile, she is on H1B, which of course has no provision for allowing the spouse to work.

<comment><USER9> If your not Indian/Chinese and your wife is EB2 then you should be able to apply for a "EAD - Work permit" as soon as your wife files for the 3rd stage of the green card. Using this you can work. Wiht the present system I dont think it should take more than 4 months to get to the 3rd stage.

Your wife's employer will have a lawyer working on all these cases and they will answer your questions for free (its their job!).

If your indian/chinese/mexican/philipino or EB3 category your basically screwed and the best way would be to put together a business plan + funding, incorporate and then try to get the USCIS to give you a H1 to work on your own company.

When I didnt have a g.c I could never really solve this problem (as my visa was employment based and not marriage based) and that makes it even more difficult. Its a toughie. But since yours is marriage based, you have a better shot at solving this.

</comment></comment></comment><comment><USER14> Like others have commented here, I believe you can start and own a business in the U.S. even if you are not a citizen. If being an employee of your business is the problem, you may be able to work around that by issuing shares to yourself and paying yourself in dividends. You definitely do not have to be a citizen to own shares in a U.S. corporation.

<comment><USER9> You can own shares, you can pay yourself BUT you CANNOT work for it. No selling, no programming - nothing.

<comment><USER13> yep..I'm in the middle of immigration process with my wife. Fortunately, the one place the USCIS and IRS do not look is on your home PC to find out if you've been programming for the startup that probably won't make any revenue until after your immigration process is through.

<comment><USER9> I agree. If you cant get a H1 for yourself, at least learn everything there is to learn about starting up a company and create a strong network for the future. Talk to founders, talk to VCs/angels.

<comment><AUTHOR> Yes, I consider this to be a big plus of at least just getting something going.

(PS: Can someone please mod keeptrying back up, I meant to click upvote but instead accidentally clicked downvote. Argh. Sorry about that.)

</comment></comment></comment></comment></comment><comment><USER15> Might be looking for a CTO with software project mgmt experience to lead a new product development effort around the Google Earth engine. AR with local content. Equity for brilliance and execution. Interested? Ping charlie dot mchenry at gmail.

</comment><comment><USER16> Check with a lawyer, but I'm pretty sure foreigners can start and own businesses in the u.s. (e.g. toyota, hyundai, ...) You may just not be able to be an employee of said business. Build your network online. Go for it and good luck.

</comment><comment><USER17> In terms of building your professional network, when you get to Seattle, look up @littleidea (he's also littleidea here on Hacker News). He's awesome.

</comment><comment><USER18> non citizen will be the problem.

This is an Ask Jason on This Week IN Startups question..

I would submit this to this week in startups as I believe Jason would skype cal you during the podcast to get the question answered.</comment>


Show HN: Big List of Naughty Strings for testing user-input data - <AUTHOR> https://github.com/minimaxir/big-list-of-naughty-strings <comment><USER2> Most of what I do involves the messy world of text, and I think this is a great resource. I wish the software I depended on tested against it.

I can think of a few more cases that I've seen cause havoc:

\- U+FEFF in the middle of a string (people are used to seeing it at the beginning of a string, because Microsoft, but elsewhere it may be more surprising)

\- U+0 (it's encoded as the null byte!)

\- U+1B (the codepoint for "escape")

\- U+85 (Python's "codecs" module thinks this is a newline, while the "io" module and the Python 3 standard library don't)

\- U+2028 and U+2029 (even weirder linebreaks that cause disagreement when used in JSON literals)

\- A glyph with a million combining marks on it, but not in NFC order (do your Unicode algorithms use insertion sort?)

\- The sequence U+100000 U+010000 (triggers a weird bug in Python 3.2 only)

\- "Forbidden" strings that are still encodable, such as U+FFFF, U+1FFFF, and for some reason U+FDD0

People should also test what happens with isolated surrogate codepoints, such as U+D800. But these can't properly be encoded in UTF-8, so I guess don't put them in the BLNS. (If you put the fake UTF-8 for them in a file, the best thing for a program to do would be to give up on reading the file.)

<comment><USER3> Bi-directional text is probably another one. All the bidi control characters, especially. Probably really all Unicode control characters in general.

<comment><USER2> Sure, but there's already a lot of bidi text in the file.

<comment><USER3> Bah, I only saw mono-directional text. Looking closely I only see one line of with bi-directional text, "הָיְתָהtestالصفحات التّحول"?

<comment><AUTHOR> There are Bidi controller characters in the Trick Unicode. (Doesn't appear in Github rendering, oddly)

</comment></comment></comment></comment></comment><comment><USER4> " # Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. [https://news.ycombinator.com/item?id=7665153](https://news.ycombinator.com/item?id=7665153))

/dev/null; rm -rf /*; echo " That's a little aggressive for testing no?

<comment><USER5> Some would argue that if you're testing on a system you can't recreate easily/quickly, you're doing devops wrong.

<comment><USER6> And I'd agree, but this would be a pretty disproportionate punishment for the crime of doing devops wrong :P

<comment><USER7> It's two crimes: doing devops wrong, and having a huge security hole.

</comment></comment></comment></comment><comment><USER8> One fun (and very interesting) string is EICAR[0]. I worked for an antivirus company once and we had the EICAR string for testing but couldn't check it into source control because it triggered the AV software which we dogfooded...

Is it naughty to include it here?

        X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

[0] [https://en.wikipedia.org/wiki/EICAR_test_file](https://en.wikipedia.org/wiki/EICAR_test_file)

<comment><USER9> Aw, Sophos on OS X doesn't think it's a threat.

<comment><USER8> Without giving too much away, I was sufficiently surprised by that that I downloaded the Sophos for Mac Home Edition. It does recognise it.

Here's what I get: [http://i.imgur.com/JQzVsQf.png](http://i.imgur.com/JQzVsQf.png)

This was picked up by the on-access scanner and a manual scan. The Web Protection doesn't complain about the text in a page (rightly or wrongly).

Are you using a centrally managed version (i.e. not Home Edition)?

<comment><USER9> Interestingly, I found what caused the false-negative. If I used Vim to create the file, it was picked up. If I "echo ...EICAR > text.txt" it doesn't get picked up, at least not immediately!

<comment><USER8> The on-access scanner intercepts requests to open files, and scans them. Echo just writes to the file and closes it. It doesn't try to open it again once the EICAR string is in there. I'm speculating here, but Vim probably writes the file/buffer, flushes, and then tries to obtain a file handle to it. At that point an on-access scan will occur, and it will find the EICAR string.

A scheduled scan would pick this up eventually.

</comment></comment></comment></comment></comment><comment><USER10> Yeah, I would make the SQL injection and command injections test a little less kinetic =). Using a simple SELECT test, like SELECT @@VERSION, would be a little safer... Edit: Forget to say thanks! This is a pretty cool list.

<comment><USER11> You want something that modifies so that you can detect that the SQL executed. But an INSERT would be a much friendlier than a DROP TABLE. :)

<comment><USER10> Not necessarily. If you do a test with good SQL and a second test with SQL Injection and compare the responses that can show SQL Injection exists without having to change the database. This won't work for all SQL injection tests, but I would rather take this approach first.

</comment></comment></comment><comment><USER12> This is good. There are lots of lists like this; you might find additional strings to add to it here:

[https://code.google.com/p/fuzzdb/](https://code.google.com/p/fuzzdb/)

Fuzz lists are to web pentesters what drain snakes are to plumbers.

<comment><USER13> Another good list that incorporates FuzzDB: [https://github.com/danielmiessler/SecLists](https://github.com/danielmiessler/SecLists)

As other commenters noted, strings like DROP TABLES should be used with caution!

</comment></comment><comment><USER14> It's not completely clear to me which encoding the blns.txt file uses. Since this project is all about weird/evil bytestrings, the encoding of the file itself is very important.

Using a newline as a delimiter in that file excludes newlines from being part of the strings you are testing - but newlines are an important "naughty" character to consider. Unfortunately the same is true of basically any other common delimiter character.

Maybe base64-encoding the strings would be one way to solve for this? You could use base64-encoded values in JSON, for example.

<comment><AUTHOR> Fair question. Encoding is UTF-8. This is fine for time being since UTF-8 is ubiquitous.

I had it set as UTF-16 for the two-byte characters when first writing it, but that had caused issues. If there is a demand, a second list can be added.

</comment></comment><comment><USER15> for anyone testing web sites, I built a chrome extension that makes things like this available in the right-click menu [1] the code is on github, so it can be easily extended [2]

[1] - [https://chrome.google.com/webstore/detail/bug- magnet/efhedld...](https://chrome.google.com/webstore/detail/bug- magnet/efhedldbjahpgjcneebmbolkalbhckfi?hl=en)

[2] - [https://github.com/gojko/bugmagnet](https://github.com/gojko/bugmagnet)

</comment><comment><USER16> If I put this into my company's tests, we'd end up with no users... I have a lot of work ahead of me. :/

<comment><USER17> Yeah, the other exploit strings do innocuous stuff like putting up javascript alerts or touching files, but the SQL injection ones aren't innocuous at all. I wonder if there's something better to replace those with. Something like `1'; CREATE TABLE blns ...--` would be more akin to what the shell exploits do.

</comment></comment><comment><USER18> Anyone knows if anything similar exists for telephone numbers?

Edit: Found this two minutes later: [https://github.com/googlei18n/libphonenumber](https://github.com/googlei18n/libphonenumber), seems to be an official Google product and Apache licensed.

</comment><comment><USER19> Unintentionally, this also shows that GitHub is going pretty well when it comes it sanitising user inputs.

<comment><USER20> Thankfully they're not sanitising inputs but correctly encoding outputs.

</comment></comment><comment><USER21> Looks interesting, but the Script Injection, SQL Injection and Server Code Injection sections need a _lot_ more samples to be remotely useful.

<comment><AUTHOR> I definitely agree; hence the open-sourceness. :)

I only added what was off the top of my head for those sections; this list will consistently be updated.

<comment><USER22> Wouldn't it make more sense to define building blocks and automatically generate all sensible combinations? Otherwise I don't think this list can be managed by hand, especially not in a volunteer project.

</comment></comment></comment><comment><USER23> Nice "in the beginning..." hebrew string:

בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ

<comment><USER24> Full context, this is the beggining of the bible.

<comment><AUTHOR> Yes, I'm lazy. :p

<comment><USER25> You'd do better with "הבה נרדה ונבלה שם שפתם אשר לא ישמעו איש שפת ראהו" (Genesis 11:7) That's God saying he will make multiple languages to confuse everyone...

</comment></comment></comment></comment><comment><USER26> The list seems to be missing the simplest naughty string of all: The empty string!

(Well, the text file has empty lines separating the comments and example strings so it _technically_ includes the empty string, but it's not in the JSON file.)

<comment><AUTHOR> There is a pull request pending that fixes this.

<comment><USER7> I also submitted a pull request with an infinitely long string, but it's still pending...

</comment></comment></comment><comment><USER27> Is the scope just well-formed strings or would you consider adding binary nasties like null bytes, mal-encoded characters, or even just newlines on their own?

What about XML billion laughs strings, or parser-busting very long runs of parentheses?

<comment><USER28> I've definitely seen NUL bytes in what's supposed to be a text string break many tools.

</comment></comment><comment><USER29> Nice; sort of a programming complement to Shutterstock's _List of Dirty, Naughty, Obscene, and Otherwise Bad Words_[0]. So helpful to have a bunch of minds working on useful lists like this. Good to see that GitHub passes this test!

[0] [https://github.com/shutterstock/List-of-Dirty-Naughty- Obscen...](https://github.com/shutterstock/List-of-Dirty-Naughty-Obscene-and- Otherwise-Bad-Words)

<comment><USER30> I doubt the value of this repository. The first naughty French word "allumé" can't be considered naughty, dirty, or bad, like, at all. And many others are not naughty under too many circumstances...

Except very few swear words, word filtering is pretty much useless.

<comment><USER31> Alternative source: list of reddit usernames...

</comment></comment></comment><comment><USER32> Great list. A few questions:

* How could this be used to test 'corrupt' characters? Isn't the process of savign the file itself as UTF-8 un-corrupt...the file?

* Is there some recommended way to group these into "strings that should pass validation" versus "strings that should fail"... or is that too application-specific?

</comment><comment><USER33> If you really intend this for use in testing, I'd suggest making the injections less nasty. I could easily see a junior dev slapping this in and deleting some important stuff.

I'd also add more invalid UTF encodings and embedded null bytes, etc. The JSON format would be preferable to plain text for that though.

<comment><USER34> Thankfully, there are no strings invoking Cthulhu :)

<comment><USER35> lol! You must be referring to the ICFP contest 2015. [http://icfpcontest.org/](http://icfpcontest.org/)

<comment><USER34> I was actually inspired by the concept that lovecraftian horrors can be accessed and interacted with programmatically, prominently featured in Stross's Atrocity Archives: [https://en.wikipedia.org/wiki/The_Atrocity_Archives](https://en.wikipedia.org/wiki/The_Atrocity_Archives)

</comment></comment></comment></comment><comment><USER36> /dev/urandom can also be used as a source of random and unusual input data, as it contains by definition all 256 byte values and 65536 2-byte values, 16M 3-byte values, etc., and should eventually output every possible string.

<comment><USER37> > and should eventually output every possible string.

"Eventually" being the key word here. Fuzzing with purely random inputs will take eons to actually reveal non-trivial bugs...

</comment></comment><comment><USER38> I absolutely love strange unicode strings. It's handy if you ever want to find out what a server's running. One time, I put a bunch of emoji's in a GET param of a Google site, then got a big Java error page. I had no idea Google ran Java.

Edit: Another one that tends to be fun is [] in the param, like [http://example.com/?get[]=[]](http://example.com/?get\[\]=\[\]).

And you can things inside, like [http://example.com/?get['"%05<!]=[%FE%FF]](http://example.com/?get\['"%05<!\]=\[%FE%FF\])

</comment><comment><USER39> For more great examples of "naughty" strings see the Twitter @glitchr_ account. [https://twitter.com/glitchr_](https://twitter.com/glitchr_)

</comment><comment><USER40> Complete AI is no the hardest problem in CS, parsing text is. Joking aside this reminded me of that CSS vulnerability that allowed attackers to read peoples mails: [http://scarybeastsecurity.blogspot.com/2009/12/generic- cross...](http://scarybeastsecurity.blogspot.com/2009/12/generic-cross- browser-cross-domain.html)

</comment><comment><USER41> I don't deal with user input validation, but any resources for reading about handling various inputs like the ones in blns?

</comment><comment><USER42> I don't recall exactly where this was, but I know I've worked with an API before that sometimes dropped requests, and it was because some randomly generated data included 'naughty text' like 'xxx', or profanity. I was expecting a dataset intended to catch this problem...

</comment><comment><USER43> OT but is there a way to see projects with the most stars on github?

This one seems to be skyrocketing.

Oh here we go, and lookie who is at the top: [https://github.com/trending](https://github.com/trending)

<comment><USER44> [https://github.com/stars?direction=desc&sort=stars](https://github.com/stars?direction=desc&sort=stars)

<comment><USER43> Well that is for your account, I meant overall for the system and the trending report does that...

</comment></comment></comment><comment><USER45> Should be 1 long string, then if something fails use bsection

</comment><comment><USER46> This should be really handy for fuzz testing, nice work!

</comment><comment><USER47> Bookmark</comment>


Big Landlord Blocks Deliveries After Deluge of Packages - <AUTHOR> http://www.wsj.com/articles/package-gate-big-landlord-blocks-deliveries-after-deluge-of-parcels-1445333401 <comment><AUTHOR> It would seem that if this becomes a trend that delivery companies would need and be in their right to assess a charge to any packages destined for certain residential addresses (they already do charge more at least at retail for residential deliveries) in order to compensate the buildings for the added labor needed to handle the packages. While it's reasonable to expect some package deliveries, it's not reasonable for a building to have to handle the volume that this article claims are currently delivered.

Likewise the person placing the order shouldn't balk to much at having to pay a $1 to $2 charge for having their packages handled (per package) despite what rent they are paying except in the cases of true luxury buildings.

<comment><USER2> How much are the fully loaded benefits for a full time mailroom/receiving employee at $15/hour? Seems reasonable for a complex over a certain size.

</comment></comment><comment><USER3> "Each package results in about 10 minutes of lost productivity, Camden executives estimated."

I'm gonna have to take that estimate with a grain of salt.</comment>


Destroying your hard drive is the only way to stop this super-advanced malware - <AUTHOR> http://www.pcworld.com/article/2884952/equation-cyberspies-use-unrivaled-nsastyle-techniques-to-hit-iran-russia.html

<comment><USER3> The government used to accept overwriting a hard drive several times with random bits as an acceptable wipe. Then they changed to insisting destroying a hard drive was the only solution. Now we know why. ;)

<comment><USER4> Suddenly, the order for the Guardian to destroy everything with a microcontroller makes sense. It's funny because to mere mortals, that is a ridiculous thing to do, but to people in the spying world, it's routine.

<comment><USER5> Not just that - they have _some_ kind of attempt at an implant against all of those, with varying success. (In a way, it actually leaked their capabilities!)

</comment></comment></comment><comment><USER6> Heh. Or just use SAS (Serial Attached SCSI) disk drives. Heck, my boot drives are hidden behind an el-cheapo LSI board that mirrors them, even experts find it _very_ difficult to talk directly to those drives (a perhaps unique case for this 200x board/chipset family).

On the other hand, my next system will almost certainly include flash drives, and I gather the inefficiencies and imperfections of ATA don't matter so much with them, and staying in that ecosystem is of course cheaper. But maybe like their true enterprise magnetic disks, SAS flash drives are better.

It's quite interesting to witness such a dramatic and quick change in how we build systems, but I'm glad circumstances forced me to build my current systems before using flash drives was safe enough (for me).

<comment><USER4> Flash drives are way worse. They are overprovisioned to allow for wear leveling, which means they already contain a ton of extra shadow storage that the controller is already programmed to make invisible. At least with a regular HDD, the owner could notice that some space is missing.

<comment><USER5> Wrong: actually, hard disks also have some unallocated sectors on the platters for both bad-sector replacement and firmware storage, and this is also completely masked out from the (S)ATA interface.

Bearing in mind I don't have a proper sample - IRATEMONK does not _seem_ to be engineered to try to persist through a hard drive firmware flash, via software or via serial/JTAG. So, if you really are actually affected by this - <USER2> save your drive for analysis!_

Presumably such events are _very_ rare - seriously, when did you last update your hard drive's firmware? Except for SSDs, did you even know that you could?

I wonder if the SSD version - I _know_ one exists, I've seen the intern project to port it to the Indilinx Barefoot - tries? I'm guessing - speculation - probably not, that's the kind of thing they'd probably want to handle manually - they've definitely got the budget to keep them updated across revisions, and maybe losing persistence is _probably_ preferable to accidental bricking exposing their RAT, although that doesn't account for the occasional fuckup - and well, thinking about it, people kind of _expect_ hard drives to die on them on occasion, don't they? Still, a pattern of failures of a model would stick out.

<comment><USER4> By seen the SSD intern project, do you mean the der speigel document?</comment></comment></comment></comment>


Achilles and the Tortoise – Solving Zeno's Paradox with Quantum Physics - <AUTHOR> http://whatblag.com/2011/10/19/achilles-and-the-tortoise-quantum-physics/ <comment><USER2> Planck's constant is not the smallest unit of distance. It's not a unit of distance at all.

You're thinking of the Planck length. It is indeed proposed that the Planck length is the smallest meaningful length, but this is by no means proved.

<comment><AUTHOR> Ah, sorry, you're right, it's the Planck length.</comment></comment>


Black Bird Image Optimizer: one of the most powerful i have encountered - <AUTHOR> http://blackbirdcleaning.com/imgoptim.html <comment><USER2> Why should I use that over this? [http://nikkhokkho.sourceforge.net/static.php?page=FileOptimi...](http://nikkhokkho.sourceforge.net/static.php?page=FileOptimizer)

<comment><AUTHOR> well i would advice do actual comparision, take 5mb file and compress it using brutul method in Backbird, it will reduce it in kbs. If yours can do better then even i'll start using yours :)</comment></comment>


Show HN: SciZone – Embed scientific datasets and phenomena on the web - <AUTHOR> http://sci.zone <comment><AUTHOR> Author here - I've been working on this add-on for some time. SciZone allows you to paste little 'snippets' (urls) onto web pages. Any user who has the add-on can hover over the link and see the data.

For instance, if you have the add-on, you'd be able to hover over this link: sci.zone/#9LeYO and see the weekly number of nuclear arms the US and Russia have had over the years since the Cold War. If I wanted to pop in a definition of the Dunning-Kruger Effect, I can: sci.zone/#LNcSk. (There may be an issue with Hacker News changing up my links)

It is my hope that SciZone will help make discussions on the web even more informed and backed-up with hard data. In some sense, it acts as a citation; except now the citation is interactive!

The project has a long way to go and I could use all the feedback I can get. Just be constructive. Thanks.

<comment><USER2> This seems pretty cool, and being able to display charts easily is a valuable thing to have. There doesn't seem to be any fallback for people to view charts if they don't have the extension installed, however. Even just a link to something like the landing page, with the chart they're looking for in place of the US/Russia Nuclear stockpiles chart.</comment></comment>


AppHarbor (YC W11) launches scaling - <AUTHOR> http://blog.appharbor.com/2011/08/29/application-scaling-now-in-beta

<comment><USER2> Good work guys. I'm glad to hear that you're still making good progress on this. I still have my checklist of things that are keeping me on Azure, but I'm definitely keeping an eye on AppHarbor.

<comment><USER3> Is there any way we could get a peek at that checklist? Feel free to drop me a line at mf(at)appharbor.com

</comment></comment><comment><USER4> Good news. I've tried AppHarbor and it's really easy to deploy your .Net site. One quick suggestion though: don't make me log in to see your documentation.

<comment><USER3> Which part of the docs have your found to require login? The Knowledge Base does not require authentication: <http://support.appharbor.com/kb>

<comment><USER4> My bad, yes I don't need to log in to view the docs if I go directly to support.appharbor.com. But from the main page, when I click "Support", it forces me to log in.

<comment><USER3> Thanks for noting that, will fix.

</comment></comment></comment></comment><comment><USER5> Congratulations!</comment>


Microsoft reveals its server designs and releases open source code - <AUTHOR> http://arstechnica.com/information-technology/2014/01/microsoft-reveals-its-server-designs-and-releases-open-source-code/

<comment><USER2> >> _" We also expect this server design to contribute to our environmental sustainability efforts by reducing network cabling by 1,100 miles and metal by 10,000 tons across our base of 1 million servers."_

It's cool how you can save a lot on small things when stuff get so big.

<comment><USER3> 10'000 tons is 10kg per server. That does not seem like "small things" to me.

<comment><USER4> It depends on its density 10kg of copper versus 10kg of aluminum would be quite different in bulk.

</comment></comment></comment><comment><USER5> This is great news.

In the same way that openly shared and critiqued communication protocol specs are a boon for incredibly performant, efficient and secure services, so too can cracking the black box on data center hardware be for building even more powerful server farms and the like.

It's cool to see Microsoft join with Facebook in being a disruption to a closely kept branch of system design. The designs are open source -- any of these threatened companies can take, learn from, and extend them.

If opening up designs like this is a threat to wages or jobs (I think the argument might be "why pay a system designer if I can grab these specs") it's the same threat presented by any technology advance. Innovate or die, as they say.

Though, it would be nice that if a company is going to pay a team to design a custom box, then open source that design, the least they could do is prominently credit the team of engineers.

</comment><comment><USER6> I feel this trend could really hurt Dell, HP, etc. Isn't the value in their server business the server designs? There is no margin on manufacturing the hardware.

<comment><USER7> You don't cross out maintenance and support by having more efficient hardware. Those giants, by my understanding, make a lot of money from support or directly from taking care of servers/datacenters.

<comment><USER8> At scale, self-support and self-warranty is also cheaper than a support contract from HP/Dell/Lenovo.

</comment></comment></comment><comment><USER9> Some previous discussion from 1-2 months ago:

[https://news.ycombinator.com/item?id=7134764](https://news.ycombinator.com/item?id=7134764)

</comment><comment><USER10> But still no Age of Empires source code Q_Q

</comment><comment><USER11> With all these companies reporting, anyone have the cheat sheet on the rankings of the size of the owned clusters by company? I suspect NSA is tops but we'll never know (just like claims that Putin is the richest man in the world :-)

<comment><USER12> _eyeroll_ You can lose the NSA's largest datacenter in a corner of any Google, Facebook, Microsoft, Amazon, or Apple datacenter. Even their OMG-gigantzor datacenter in Utah includes a mere 100k square feet of computer room floor area. Given government overhead and inefficiency, a 100k sq-ft NSA datacenter is probably the equivalent of a 10k sq-ft commercial datacenter.

By comparison, one of Apple's datacenter buildings is over 300k sq-ft, and Apple is at best a minor also-ran in the datacenter business.

The NSA's computing facilities are insignificant compared to commercial facilities.

<comment><USER13> That's because the commercial facilities are doing all the heavy lifting for the NSA. Facebook does all the analysis, NSA gets the finished reports.

<comment><USER14> You realize NSA has a lot more signals interception programs than just PRISM, right?

</comment></comment></comment></comment><comment><USER15> Nice to see them joining Open Compute. I find the whole open compute thing pretty interesting, having gotten the 'Google story' where the question "Why should I pay for this sheet metal that only gets in the way of me fixing a machine?" started an avalanche of other questions, to the whole "Why do we put things in RELAY RACKS anyway?"

The current tension between 'colo facilities' and 'EC2/CE/Azure' is almost palpable at times. I look forward to the first "OpenCompute Ready" hosting facility that just needs you to plug in your server or storage boards.

<comment><USER16> Seems like an obvious thing to do (either bare metal rentals, or space for cages) in Bonneville (where you can be dirt cheap in power and pretty cheap on bw) and a few other locations.

</comment></comment><comment><USER17> Another open compute project, another day where I cry I don't manage enough servers to get involved!

</comment><comment><USER18> Can someone elaborate how much extra value this creates to the project?

As Facebook and others already joined, i'm curious how much added value a big company like Microsoft brings in.

<comment><USER8> The MS servers are less weird than the Facebook servers, so they may appeal to people who are just starting to get into Open Compute.

<comment><USER19> Define "less weird"

<comment><USER8> They use standard racks and standard power.

</comment></comment></comment></comment><comment><USER20> This and android office365 sdk. Glad to see Microsoft making a move towards the open web.

</comment><comment><USER21> What is the motivation behind doing this? To my wary eye, I think this is another way to depress wages.

<comment><USER2> How would this depress wages?

<comment><USER22> Commoditizing servers gets rid of the extra profits Dell/HP/IBM used to make off server sales. They're basically just killing off the server industry for companies at the scale of Microsoft/Facebook.

<comment><USER23> It's already dead. I'm not sure it was ever alive. Companies like Google started building their own servers long before present scales were ever reached.

</comment></comment></comment></comment><comment><USER24> I wonder if it can handle paths with more than 254 characters.

<comment><USER25> ...but, why would you need it?

Once your path gets longer, aren't your essentially just stuffing your file name with metadata which should belong in the file in the first place?

<comment><USER24> Wow, surprised at -4 downvotes. Handling long paths is necessary when working with Node.js, for example.

</comment></comment></comment><comment><USER26> Microsoft and open compute, what a circus. Microsoft and "open" don't go together.

If you want to see how open Microsoft likes it, check out M$ Secure Boot.

<comment> mkr-hn Had to double check and make sure I wasn't on Slashdot in 1998.</comment></comment>


Ask HN: Can we stop linking to subscriber only content? - <AUTHOR>

Why is it that submitting content that requires a Google or Facebook sign in is so frowned upon, but linking to subscriber only content is perfectly acceptable. The most common case of this is The New York Times, as seen in this link that is currently number 10 on the front page.
Screenshot: http://i.imgur.com/gxR2Ma6.png
Thread: https://news.ycombinator.com/item?id=6111352 <comment><USER2> For New York Times articles, I have started to use viewtext. It works everytime and I just get the text

[http://viewtext.org/api/text?url=<nytimesurl>](http://viewtext.org/api/text?url=<nytimesurl>)

Edit: How about all New York Times articles get redirected through the viewtext route? Or would that be just too much

</comment><comment><USER3> Firefox and Chrome have a cookie whitelisting feature. You can let non- whitelisted sites set whatever cookies they want, but have them cleared on browser exit.

<comment><USER4> There's also the ability to open a URL in a new private window. I suspect circumvention of cookie-based blocking is the second most used reason for "private browsing" after looking at porn.

</comment></comment><comment><USER5> You're probably the only one to visit the New York Times 10 times. I'm still at zero.

<comment><USER6> The pay wall only appears after 10 views? I was so confused because I never see the paywall and I see people complain.

<comment><USER7> If they haven't changed their policies lately you get a certain number of free articles daily as well (five, I think, but they might have removed that).

</comment></comment></comment><comment><USER8> This is your question:

> _Why is it that submitting content that requires a Google or Facebook sign > in is so frowned upon_

A New York Times article does not require a sign-in. The article in question is not subscriber only-content. You do not need to sign-in nor be a subscriber to read this article.

The NYT allows 10 articles a month to be read for free. So your question should be phrased as: "Why does HN allow links to sites on which I have exceeded the amount of free content that I am personally allocated?"

But you don't even need to go that far. You can turn off the JavaScript in your browser, which, for many of FB-login type websites, would not work.

<comment><USER9> To summarize this for you OP: no, fuck you, do it yourself.

#HN

<comment><USER10> I've noticed a pattern. People who sneer at HN—of whom there are more than a few, it's quite a thing now—always think it's other people who are the assholes.

To reply to zombio: it's probably that NYT and WaPo are such major publications that a site that wants to link to the best content can't very well exclude them. I agree it's annoying. What I do is visit the URLs in an incognito browser window.

<comment><USER11> What do I do when incognito doesn't work? Why can't posters link to real content?

<comment><USER10> When incognito doesn't work, you can usually get the piece by Googling the title. Google almost always returns a link that bypasses the paywall.

Posters post these links because the content is unavailable any other way. HN would be poorer without any stories from the NYT and WaPo, inconvenient as this all is.</comment></comment></comment></comment></comment>


What the world would look like if light traveled slowly (interactive simulation) - <AUTHOR> http://realtimerelativity.org/downloads.html

<comment><USER2> Light travels "as fast as it can." If light travelled slowly, then, by the momentum equation of special relativity, we'd still ramp our energy limits long before we saw this sort of stuff. In fact, if things took so much more energy to move about, macro-scale creatures such as ourselves would probably not have developed.

I think the author meant "what if light travelled at only a fraction of the speed it physically could?" which is a much more ridiculous question, but with even more interesting implications, especially if you don't also scale down the speed of gravitational transmission et all to match.

<comment><USER3> I remember looking into the question of gravitation transmission before. As far as I could amatueurly determine, gravitational transmission is an unanswered question. This is to say, if the sun "dissapeared" would the Earth feel it straight away (because spacetime had been altered) or would it take as long as the time for light to reach us because gravitrons (if they exist) could only travel as fast as the speed of light?

I'm aware of the whole limit on information transmission so I assume the latter, but I thought it was still unanswered.

<comment><USER2> I think the real problem with that question is deciding exactly what you mean by "disappear." If you blow the sun up, it still has all its mass, it's just spreading apart, and the effect this has on Earth can be graphed continuously. Likewise if you just move it somewhere else really fast (because you can't move it faster-than-light.) If you convert it completely into energy, by the mass-energy equation, it _still_ has all its mass.

Thinking about gravity becomes a lot simpler when you realize that every one of those particles of the Sun is quantum-entangled with all the particles of the Earth. If you want to "remove" the Sun, you have to decide what that means for the decoherence of the configuration subspace consisting of (what was previously) Sun + Earth.

Configurations only evolve toward more definite subsections of themselves, not completely "new," remote amplitudes. Also, as far as we can tell, decoherence is computable from the completely _local_ neighborhood of the amplitude-mass in question. Thus, gravitational transmission has to take _some_ amount of time, in the same way that one domino can't knock down another across the room instead of going through the dominos in-between.

The interesting thing is that _some_ of the particles of the Earth (analogously, the intermediate dominos) would be immediately affected—but it would take Au/C before enough of them were affected that that decoherence would become _detectable_.

<comment><USER3> Wait so gravity is quantum entanglement?

I've never been given that view before. If I understand you correctly, gravity does have an effect faster than the speed of light but there is no detectable effect faster than the speed of light?

</comment></comment></comment></comment><comment><USER4> I think the purpose of this application is to teach the theory of relativity and show what it would feel like _if_ matter (the space ship) could travel at the speed of light. Of course the only way to do this is if the speed of light was slower, and not the max speed of the universe. I guess you'll get to see how buildings will compress, and time will slow down.

I just happened to be on Windows 7 64 bit on boot camp on my mac and it didn't work. Required some dll file called d3dx9_37.dll. So I downloaded it and put it into windows system folder and it ran.

It's pretty trippy. It's like at 3d game where you control a spacecraft except when you start moving forward it's like you're on drugs.

</comment><comment><USER5> It's Mr Tompkins!

<http://en.wikipedia.org/wiki/Mr_Tompkins>

</comment><comment><USER6> Why does it require installation? Do they know that YouTube is available for years already?

<comment><AUTHOR> It's an interactive simulation, like the title says. You can fly around a cityscape at speeds approaching c.

</comment></comment><comment><USER7> No linux version?

<comment><USER8> Maybe just as well. On the Mac version it seizes the cursor so you can't get to the menu bar and won't quit with Command-Q despite flashing the menu to say "Yeah, I know you want out. Piss on you.

If the UI is that impolite on the machine known as the "fairy princess of user interface", then on Linux it would probably leave smelly food in your fridge and reorder your DVD collection.

<comment><USER9> dll errors under windows. Oh well. Let's hear it for shit engineering.</comment></comment></comment>


"At Least I F***ing Tried" - <AUTHOR> http://andysparks.co/

<comment><AUTHOR> Posted this a minute ago with the whole 'F __*ing' in there not edited and got pulled from front page. Whoops! Sorry if I offended (not really).

<comment><AUTHOR> Pretty sure I just got taken down again lol

</comment></comment><comment><USER2> My sentiment is more extreme. I'd rather die as a failed enterpreneur face down in the mud with mouthful of kicked in teeth than to live a cozy life as someone elses employee.

<comment><AUTHOR> Love this.

</comment></comment><comment><USER3> Short and to the point. Keep trying, man.

<comment><AUTHOR> Thanks, man. Much appreciated.</comment></comment>


AudioGO use DMCA to demand takedown of a 404 link - <AUTHOR> http://adactio.com/journal/5405/ In a Kafkaesque use of the Digital Millennium Copyright Act, the UK audiobook company, AudioGO, demand the removal of a web site that links to ...nothing. <comment><USER2> OK but what you do is you send a DMCA counter-notification saying that there has been no infringement, after which AudioGO has the choice of dropping the matter or taking it to court, where you they will be laughed out of the courtroom.

</comment><comment><USER3> Does someone in the UK even have the legal ability to send a DMCA notice to someone in the US?

<comment><USER4> A notice of infringement has no force in and of itself. It's just a notice. Anyone can send out. Anyone could send one before the DMCA existed as well.

What the DMCA creates is protection from liability for infringement carried out by a user of your internet service if you take down the material in response to a notice. It's this protection, afforded by the US law, against lawsuits in US court, that a US recipient would want... regardless of who sent the notice.

</comment></comment><comment><USER5> There is definitely a whole lot of stupid in that DMCA takedown request.

<comment><USER6> There's plenty to go around. This isn't the only guy sending out automated DMCA notices. They've infamously been sent to networked printers, which were misidentified as part of a torrent swarm by some bot.

There are also more than a few people who fill out Google's DMCA form and list the infringing work as their own work, which is pretty weird too. One time I saw, it might have even been intentional, as the guy appeared to be trying trying to remove his own logo from Google images.

You might be surprised how much you can learn about what's going on on the web if you trawl through the Chilling Effects list of DMCA notices.

</comment></comment><comment><USER7> _Whatever infringing material may have once been located at the end of the link is long gone …and yet AudioGO Ltd are still insisting that the Huffduffer page be removed!_

Actions like this make me think of <http://www.youtube.com/watch?v=Lzpk5dMhVE4>

I wonder if you've talked to them directly. The absurdity of the situation makes me wonder if something's being lost in translation via Rackspace.

</comment><comment><USER8> I couldn't help but send an email to info at audiogo.co.uk asking why they were asking for a 404 to be taken down! Interested to see if they respond.</comment>


How Steep Is That Sidewalk? A Digital Map for People with Disabilities - <AUTHOR> https://www.yesmagazine.org/people-power/app-seattle-disability-digital-map-20190821 <comment><USER2> This is one of those things that now you've seen it you'll start to notice just how bumpy the world is! I know I didn't give any of this stuff a second thought until quadriplegia meant I became a full-time wheelchair driver.

Ramps on the front of buildings and internal step free access in modern buildings is absolutely wonderful, but unless every metre of a journey from where I am now to where I want to go is accessible then none of it is accessible.

The signal cannot carry.

For example where we used to live it was impossible for me to turn left out of my house at the beginning of any journey, it did not matter how much I tried to reason with thay nine inch high curb just would not smooth out. And that is it, that whole part of my neighbourhood was cut off because the engineers putting in dropped curbs have not seemed to fully grok the reason for dropped curbs.

This kind of mapping is absolutely invaluable and has to be kept in the open source world I think, that does not mean people should not make money from it but this is one of those things where crowdsourcing could really speed up the process considering we are all carrying around incredibly sophisticated geospatial mapping devices containing accelerometers, GPS and all the other bits and bobs needed to quickly map an area.

Hit me up if any of you want to collaborate on a project like this in the UK.

<comment><USER3> I feel the same way, I've been meaning to do a similar project for France for a long time, a sort of accessibility index for sidewalks that would be added to a weighted sum to give cities an accessibility score. I feel that's where projects like wheelmap fail since they only map buildings.

I don't know how it is in the UK but I'm not convinced by crowdsourcing in this case, there are so few of us and out of the few how many can be reached and convinced to participate. In most places I've worked or been to I've always been the only handicapped person there and most places I wanted to go to that I checked on wheelmap were not mapped. I feel a solution could be the automatic treatment of aerial photography like you get on google maps' highest zoom settings. It'd be somewhat easy to detect poles in the middle of sidewalks, broken sidewalks, tree roots, etc... and I feel it might be possible to estimate curb height and sidewalk steepness doing some clever processing. So far I'm stuck gathering data, I've found a government website with UK aerial data but was unable to download it and it seemed the coverage was very sparse. Either way I'd be interested in hearing more about your ideas and potentially collaborating even though I'm not in the U.K.

On a related note, I talked briefly with someone who worked in public infrastructure, particularly on "walkability" and he told me to look into Microscale Audit of Pedestrian Streetscapes (MAPS), that might be of interest to you.

</comment></comment><comment><USER4> [https://www.accessmap.io/?region=wa.seattle&lon=-122.3426173...](https://www.accessmap.io/?region=wa.seattle&lon=-122.3426173&lat=47.6115177&z=14.5)

Github: [https://github.com/AccessMap](https://github.com/AccessMap)

</comment><comment><USER5> There is (was?) a similar project in Germany based on OpenStreetMap: [https://wiki.openstreetmap.org/wiki/DE:Rollstuhlfahrer- Routi...](https://wiki.openstreetmap.org/wiki/DE:Rollstuhlfahrer-Routing)

The idea was awesome: make the routing algorithm take steps and other impediments into consideration for wheelchair drivers.

I don't know how far they came, but when I read about it I thought that OpenStreetMap is the perfect tool for this.

<comment><USER6> This has a wheelchair routing profile (implemented by some folks at the Heidelberg University): [https://maps.openrouteservice.org](https://maps.openrouteservice.org)

Would love to evolve this and integrate it into [https://wheelmap.org](https://wheelmap.org) one day!

It's also based on OpenStreetMap, but I am not sure how good the coverage of pavement quality and curb cuts are in diffewrent parts of the world.

</comment></comment><comment><USER7> I recently landed myself in a wheelchair for several weeks and this is a _huge_ issue. I went from surfing and skateboarding (what got me into the wheelchair) to suddenly mortally afraid of leaving my house, which is on a hill, because the wheelchair is so difficult to control. My wife and I tried to go for a walk around the block once. Exactly one once. Won't do that again.

</comment><comment><USER8> There's also [https://wheelmap.org/](https://wheelmap.org/) which focuses on tagging accessibility issues with shops and other buildings on OSM.

<comment><USER6> Thanks for the mention! Co-founder of Wheelmap here. Happy to see people here find it useful as well.

</comment></comment><comment><USER9> One of my questions is what do we as regular people in order to advocate for greater accessibility?

For example, my morning commute includes a walk over a sidewalk. At one point there was some construction where I guess some really heavy machinery was sat up on the sidewalks, leaving several of them so cratered that even a regular person could easily twist their ankle because of the severity of the dip in the walkway. Essentially, a perfectly accessible sidewalk is now completely inaccessible due to damage. I don't even know who to contact about this issue, though.

<comment><USER10> I guess either the company doing the construction or your municipal government. They are required to make accessible detours, there's a lot of construction around my area and all of the sites have set up ramps and walkways around the construction zone.

</comment></comment><comment><USER11> Not for wheelchairs, but this reminds me of one of the steepest city streets I've encountered that actually has a lift for bicycles: [https://slate.com/human-interest/2014/12/trampe- cyclocable-t...](https://slate.com/human-interest/2014/12/trampe-cyclocable- the-bike-lift-in-trondheim-norway.html)

</comment><comment><USER12> The data on how to access a location with a wheelchair is also valuable for drones

<comment><USER13> That would actually be a great way for delivery drones to contribute!

Let's say construction has begun at a location. The on-street parking at that location has been marked 'TEMPORARY NO PARKING' during construction hours. The signs for this are on A-frames, places on the sidewalk.

Depending on the width of the sidewalk, the A-frames may have turned the sidewalk into a wheelchair-unfriendly place. If a delivery drone travels the sidewalk and discovers this, it would be great if that information could automatically be contributed to a place like the Open Street Map!</comment></comment>


Yes, Some Companies Actually Want to Be Regulated - <AUTHOR> https://www.axios.com/why-some-companies-are-practically-begging-to-be-regulated-e09cd71e-4071-477b-9f8e-464b0f790d79.html <comment><USER2> In general, big companies love regulation because they have the attorneys to comply with it while their smaller and startup competitors do not. This is why top tech firms are always happy to volunteer for new regulations. It keeps the little guys out of the picture.</comment>


The Truth About Pricing - <AUTHOR> http://www.gobignetwork.com/wil/2008/9/30/the-truth-about-pricing/10270/view.aspx <comment><USER2> "[There's] a group of consumers that are willing to pay just about any reasonable price for the product, and a group of consumers that won't ever pay a penny."

Thank you for pointing that out.

</comment><comment><USER3> GoBig usually drives me crazy, but this is really good advice.

<comment><USER4> Except they don't really explain how to "try everything". Common advice is that you can't change pricing too much or too often or people will get wise/angry.

<comment><USER5> The easy way around that is by "grandfathering" people who are already paying what you thought they should pay for your service/product; then charging people who have never seen your service before the new price.

<comment><USER4> That's easy for 1 price switch. It get's pretty crazy if you're doing constant experimentation.</comment></comment></comment></comment>


Top Imprudent Internet Acquisitions - <AUTHOR> http://bell-wether.blogspot.com/2006/11/top-10-worst-internet-acquisitions.html

<comment><USER2> I'd say that AOL/TW was the best internet acquisition ever, not the second worst -- given that AOL bought TW, not vice versa.</comment>


DARPA Races to Create a "Firebreak" Treatment for the Coronavirus - <AUTHOR> https://spectrum.ieee.org/the-human-os/biomedical/bionics/darpas-firebreak-treatment-for-the-coronavirus <comment><USER2> There's a recent HN article that describes how E-64d & Camostat prevent the two known pathways that lead to infection. So, that would be a prophylactic of yet unknown safety, dosage and duration, not a vaccine and not a cure.</comment>