How to Build a Unicorn and Walk Away with Nothing - <AUTHOR> http://heidiroizen.tumblr.com/post/118473647305/ <comment><USER3> I find this article much more interesting as a cultural snapshot than a cautionary tale for founders. $20 million in investment before creating a minimal product, $200 million to find out users won't pay for what you made, and everything propped up by a shell game around online ads. The assumption that the founder of this should have walked away with a fortune is just the cherry on top.

<comment><USER4> I think that's part of the author's point: that valuations are, in a very important sense, largely fictitious, and that other actors in the ecosystem can make your valuation as large or as small as possible to suit their purposes. If you want to build a business, your actions need to actually _do_ that, and you should be aware of and mitigate the implications of any wild valuation swings. Similarly, if you want to get rich (which may or may not be aligned with building a business), your actions should do _that_ , and that also may or may not follow from getting a big valuation.

<comment><USER5> As lot of people are saying that, but the empirical evidence suggests that the valuations, as high as they are, are remarkably sticky. I can only name two web 2.0 duds, zynga and fab, but the rest of the unicorns have either held their value or keep rising. It's not like Uber or Snapchat will become the next friendster and myspace. The failure rate for the $40-90 million valuation range seems much higher than the >$1 billion.

<comment><USER6> Zynga is still worth $2.6B so I would not call them a "dud".

[http://finance.yahoo.com/q/ks?s=ZNGA+Key+Statistics](http://finance.yahoo.com/q/ks?s=ZNGA+Key+Statistics)

<comment><USER7> They've also lost $225 million in the last year. They have a $2.6B market cap but what does that mean if they still aren't making money?

<comment><USER8> Twitter's also losing money, right? LinkedIn, despite all their tactics, makes double digit millions only? Splunk, at several billion valuation loses more and more money, too (enough that killing all R&D _still_ wouldn't make them profitable).

<comment><USER9> Splunk's revenue chart looks great: [https://ycharts.com/companies/SPLK/revenues_ttm](https://ycharts.com/companies/SPLK/revenues_ttm)

When you are still growing, the goal is to invest as much as you can in further growth. Taking profits just means you pay taxes.

The only problem with losing money is if it's not the result of increasing growth (which can later be turned into much bigger profits)

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> And yet nobody sees a problem in creating stupid crap for stupid users and expecting to ~break even~ get rich selling ads.

This reminds me of a recent article [0], where this line stood out:

> "We just introduced an emoji feature and comments are there so you can have > conversations, and there's more stuff in collaborative streaming that we're > going to introduce," he added.

"We found a new niche and Twitter is trying to bully us out of it, but look, we'll have emoji soon. Comments too, and more social stuff. It's going to be great!" Sorry to cherry-pick Meerkat, they're actually an OK bunch, but that quote just stuck with me.

Add to this silliness how much money/interest is garnered by apps like Instagram, Snapchat, WhatsApp (actually, arguably solving a real problem), and it's hard to argue we're not in a similarly idiotic bubble to the previous one. Of course, this also creates valuable stuff (my favourite recently being Slack), but I'd be willing to bet that this huge BS-to-usefulness ratio isn't sustainable in the long term.

0: [http://techcrunch.com/2015/05/06/meerkat-founder-on- getting-...](http://techcrunch.com/2015/05/06/meerkat-founder-on-getting-the- kill-call-from-twitter/)

edit: instant downvote - if you don't just disagree with my tone, please explain why you think I'm wrong

edit 2: I'm not saying I have an answer, but at least I tried to pick something that seemed worth doing (I work at Lavaboom, we're trying to make encrypted email easy to use - with extra privacy sprinkled on top)

<comment><USER11> I think the issue people have with your comment is that you seem to label things you don't use as stupid crap for stupid users. Snapchat, Instagram and WhatsApp solve a very real problem and are very useful for the hundreds of millions of people that use these services multiple times a day.

It seems that you only label stuff as valuable if it solves problems you have (Slack and Lavaboom).

I'm not a daily Instagram user, but some of my friends love it. They're not dumb, they just get more enjoyment out looking at and sharing pictures of cool shit and their friends.

<comment><USER12> _It seems that you only label stuff as valuable if it solves problems you have_

The idea that things that are popular are "solving a problem" is a really bad trend in my opinion. "A problem" is something that has generally identifiable boundaries and detrimental implications if not solved - for example not being able to send someone money is a problem, and one big enough that it warranted the creation of paypal and the like.

I doubt highly that the millions of snapchat users at some point said "If only there were a service that deleted my pictures 10 seconds after I took them."

The major differentiation in my mind between a service that "solves a problem" and another "bullshit service" is whether people are willing to pay for it.

That's not to say you can't get rich off of bullshit, the E! network among others is proof of that, but lets not fool ourselves into thinking these things actually make the world better.

<comment><USER13> "How do I quickly share pictures without having to worry to much about them sticking around" is the problem snapchat claimed to solve (and does a reasonable job of solving, despite obvious limitations).

People might have actually been willing to pay for that, but if you charge money from the beginning for this kind of thing, someone else just offers it for free and tries to monetize it after they got all "your" customers.

<comment><USER12> _" How do I quickly share pictures without having to worry to much about them sticking around"_

See, to me that falls into the "problems I didn't know I had" \- like for example a lack of a terra cotta animal that I can grow sprouts on.

</comment></comment></comment></comment></comment><comment><USER14> Of course terms matter, but the example she gives seems somewhat contrived. Particularly this part:

>> In the deal, Hooli would invest $200 million for equity while in return the two companies would enter into a business development agreement on the side in which Pied Piper guarantees to spend that money in a massive consumer campaign on Hooli's ad platform. They float the magic "B" valuation. Richard goes to sleep dreaming of rainbows and unicorns.

If you take all that money in with a _massive_ string like that attached (basically no freedom at all to spend it except on one thing), I would think you have only yourself to blame for the result.

<comment><USER15> _" If you take all that money in with a massive string like that attached.."_

Not to mention, this happens when you already have outside board members from your previous round of investment. So it's not just one dumb CEO making the deal, it's aided and abetted by (presumably wiser and cannier) prior investors. Yeah... that part rang the most untrue in that whole scenario.

Take that out, and the rest of the story is basically a parable explaining what liquidation preferences mean. Is there _any_ VC that would do a deal without 1x liquidation pref?

<comment><USER16> In fairness, the newish VC needing an apparent success to help raise their next fund back back-story sounds like a worryingly plausible reason for them to be able to overlook the fact that Hoopli should never have been allowed liquidation preferences _in addition_ to a contract guaranteeing they got their funds back through platform spend.

I'd love to know how often this kind of 'instead of giving you free inventory, how about we "invest" conditional on you "buying" from us' shell game actually happens in the Valley though.

<comment><USER17> I am not saying that it's happening or has happened or will happen, but Google, Facebook, Yahoo, etc. would certainly be the sort of investors who are in position to benefit from such an arrangement.

</comment></comment></comment></comment><comment><USER18> Seems to me that the problem here is less one of investment terms and preferences, and more one of _wasting $200M on an unsuccessful advertising campaign_. If you agree to throw that much money at advertising without having any guarantee that the advertising will yield (enough) results, you deserve to walk away with nothing.

<comment><USER19> Unfortunately you can't guarantee results with advertising. However, you can mitigate some risks by taking an iterative approach and testing things before doing a large integrated campaign. You can save a lot of headache by running some targeted facebook ads to see if they resonate with your audience before buying up a bunch of tv or radio points.

<comment><USER20> The point wasn't whether or not the $200m ad spend was well advised or well managed. It was included in this scenario as a stand-in for any number of ways that a company could burn through a lot of cash without achieving a sustainable, defensible product / market fit, let alone solid traction.

If you're focusing on what the fictional company did with the money, as opposed to the very real terms under which it acquired the money, you may want to re-read the piece.

<comment><USER18> _[the $200m ad spend] was included in this scenario as a stand-in for any number of ways that a company could burn through a lot of cash_

Right, and my point applies regardless of the way that the company burnt through $200M: If you burn through that much cash without results, you don't deserve to walk away from the company with anything.

 _If you 're focusing on what the fictional company did with the money, as opposed to the very real terms under which it acquired the money, you may want to re-read the piece._

I read the piece. I disagree with it. I see nothing wrong with the amounts invested or the preferences, and something very wrong with the fact that $200M was wasted.

<comment><USER4> You don't really disagree with the piece - the author would agree with you that the $200M was wasted. The point the author was making is that the terms of Hooli's "investment" basically forced them to waste the money, since the investment wouldn't have happened had they not spent it on ineffective advertising using Hooli's own platform. It was that investment that gave Pied Piper its $1B valuation, hence "valuation isn't everything".

You're probably thinking "I'd never be so dumb as to take an investment with those terms", and you're right: _you_ wouldn't be. You also don't own a billion-dollar company. I would bet that somewhere in Silicon Valley, there is a unicorn whose valuation is based on a deal with similarly bad terms, and it will blow up in their face in a couple years, and then we'll all marvel at how stupid someone can be who ran a billion dollar company.

I read the article as a cautionary tale for founders who see "billion-dollar company" and get stars in their eyes. You are not the target market for it; you already understand the point it is making (though perhaps not that it is making that point). There are many other dumbasses in Silicon Valley - I can see a couple in this comment thread - who do not.

</comment></comment></comment></comment></comment><comment><USER21> There's another way to skin this cat. Assume you are not "CEO material", hire someone who turns out to be a complete fuckup to do it for you because of your self doubt.

I saw this happen to a company that basically invented the concept of hosted phone/communication services for business, back in the mid 90s. Their competitors are worth billions now. The third rate/bully/crook CEO the founder hired destroyed, literally, billions in opportunity.

(In retrospect the whole company was rotten to the core, so I enjoyed watching their competitor ring the NYSE bell, but if the founder had taken on the task of understanding his own business, this outcome would probably have been avoided).

<comment><USER22> Can you at least give a hint as to who either company is?

</comment></comment><comment><USER23> Hm. As an engineer relatively new to the world of entrepreneurship, I find myself not really understanding much of the jargon. (Actually, I think I might understand some - but my confidence in my understanding is low.)

It would be cool if there was like, an annotated version of this explaining some of the accounting/investing jargon.

For example, this passage:

Richard attracts Peter, a newly-wealthy budding angel investor, who agrees to put in $1 million as a note with a $5 million cap and a 20% discount.

I think this means that Peter is buying part of Richard's company for 1 million bucks. He's valuing it at 5 million, so that's 20% of the company. However, there's a discount of 20%... Which is where I get confused. Does this mean that Peter is paying only 800,000, but getting 20%? Probably not, given the context. It probably means he gets 24% of the company, right? (He's getting 1.2M worth of shares for the cost of 1M.)

<comment><USER24> You mostly have it.

The $5MM is a cap, not a price. If the Series A is raised at $5MM or more valuation, then the angel gets his money ($1MM) converted at $4MM ($5MM * 0.8).

If the Series A goes at $4MM, the angel's money is converted at a $3.2MM valuation (4*0.8)

<comment><USER25> The 20% discount confused me too.

Am I right then that the discount is to calculate the equity % based on a future Series A valuation.

if so in the scenrio's you posted above what is the new Equity % for the angel.

Looks like it is 20% once it crosses $5m cap as inferred in the article.

<comment><USER24> You forced me to look it up (thank you for that).

It seems like _either_ the cap xor the discount applies (investors' option), so anything over $6.25MM valuation, the cap would apply and anything under that the discount would apply.

It's too late for me to edit the GP post, so I'll try to correct it here:

At a $5MM priced round, the discount would apply and the investor's note would convert $1MM at a $4MM valuation (25%). I believe that conversion is done pre- money, which means the angel is diluted (like all shareholders) from their initial 25% by the addition of the new money. (None of my angel investments have [yet] raised a priced round, so I haven't gone through this process, though I obviously hope to... :) )

If someone else invests $1MM at $5MM pre-money valuation, all prior investors are diluted by 16.6667%. (Someone who held 10% of $5MM pre-money company will hold 8.333% of a $6MM company post-money. Either way, their position is worth $500K.)

So, to know the angel's ownership in the scenario, you need to know how much dilution happened due to the new money, meaning you need to know not just the pre-money valuation, but also the amount of new investment money. In any scenario where the discount applies, the angel's position will be worth $1MM. In any scenario where the cap is better than the discount, the angel's position will be worth more than $1MM.

</comment></comment></comment></comment><comment><USER26> Great article. Would love a simple, colloquial explanation of the following phrases:

* $1 million as a note with a $5 million cap and a 20% discount.

* senior liquidity preference of 1x to protect their downside since they feel the valuation is rich

* Peter, is stoked that he is getting his $1 million investment converted into roughly 20%

* senior 1x liquidation preference

* the preference overhang of $211 million

* They ask prior investors to recap

* the 'overhang math'.

* senior preference and a 2x guarantee.

* waterfall spreadsheet

<comment><USER27> > $1 million as a note with a $5 million cap and a 20% discount.

This refers to an investment done on a "convertible note." These particular terms mean that the valuation at which their investment will "convert" from what is nominally a loan into equity will be at most $5m, but if a subsequent investor invests in an equity financing at less than 6.25m, their investment will convert to equity at 20% less than the valuation. Read up on convertible notes for more detail.

> senior liquidity preference of 1x to protect their downside since they feel > the valuation is rich

Means that in a sale, the investor will get the full amount (1x) of what they invested before others (i.e. founders, employees) see anything.

> Peter, is stoked that he is getting his $1 million investment converted into > roughly 20%

Since the valuation was > 6.25m his valuation was capped at $5m, whereas the investors who are investing got a valuation of $40m "pre-money" or $50m "post- money" which are much less favorable terms than what Peter invested at.

> the preference overhang of $211 million

Means that if the company is to be acquired, it would take an acquisition offer of at least $211 million for founders and employees to see even a penny. That is because that amount was invested with the "1x" preference.

> They ask prior investors to recap

I think this means they are asking previous investors to lower the amount of liquidity preference they have such that in the event of a sale under $211m the founders would see some return.

> the 'overhang math'.

The wiser employees understand the math that says an acquisition has to be enormous for them to see anything. If they don't think that's likely they will see little motivation to continue working at the company.

> senior preference and a 2x guarantee.

2x guarantee means that they would be guaranteed twice the amount the invested in the event of a sale, possibly ahead of other investors, but I'm not sure.

> waterfall spreadsheet

Indicates how much each interested party would get in proceeds in the event of exits of various amounts. E.g. if company sells for X, investors get Y and founders get nothing. If company sells for Z, investors get X1 and founder gets Z. Etc.

<comment><USER28> Can you please explain how did you come up with the figure of 6.25m?

<comment><USER29> 5 million / (1-0.20) = 5 million / 0.8 = 6.25 million

A "convertible note" is a cash investment that "converts" into an equity investment when the company starts doing equity investments. The have two separate mechanisms for rewarding investors for getting in early.

The "20% discount" means the investor can convert the note into shares paying 20% less per share than later investors.

The "$5 million cap" means, if the company has a valuation greater than $5 million, the investor can convert the note into a fraction of the company as if the company was valued at $5 million.

The investor then chooses whichever of these options is better.

Take the example of a $1 million as a note with a $5 million cap and a 20% discount, when series A funding comes along.

If Series A values the company at $4 million, the investor can choose between taking shares at a 20% discount (they get shares valued at $1.25 million for their investment of $1 million) and taking shares at a $5 million valuation (they get shares valued at $0.8 million for their investment of $1 million) and they obviously choose the former.

If Series A values the company at $10 million, the 20% discount still lets them get shares valued at $1.25 million for their investment of $1 million - but now taking the shares at a $5 million valuation lets them get shares valued at $2 million for the same investment. Obviously they choose the latter!

A $6.25 million valuation is the crossover point, where the 20% discount and the $5 million cap give the investor the same number of shares. At a valuation below that the discount is the better choice, and at a valuation above it the cap is the better choice.

</comment></comment></comment></comment><comment><USER30> I was wondering whether the

      build a waterfall spreadsheet

could be opensourced by this community given that there are lot people here with varied experiences.

PS: I found this blog quite informative and the meta meta ref amuses me.

<comment><USER31> This isn't bad: [https://smartasset.com/infographic/startup](https://smartasset.com/infographic/startup)

Although it's not as clear as a spreadsheet would be, I think it's easier to start with.

<comment><USER32> Thank you for the link. Very informative.

<comment><USER30> I second that. I found other interesting information on the site. Thanks for sharing.

</comment></comment></comment></comment><comment><USER33> The article says that Richard would have personal liability if the sale didn't go through. That doesn't make sense to me - can someone explain?

Edit: the article says both Richard and the investors would have personal liability, but isn't a purpose of a corporation to avoid personal liability?

<comment><USER18> Board members can theoretically face personal liability if they fail to discharge their fiduciary duty to act in the best interest of the shareholders.

And in some states I think claims can also be made against directors for unpaid wages -- I'm not sure how the jurisdictional issues play out for a Delaware corporation with employees elsewhere though.

<comment><USER20> That was exactly the point - the personal liability isn't to the investors, it's to the state, which tends to take a _very_ dim view of unpaid wages. In California, I believe treble damages are standard, so missing a $50,000 payroll can cost you $200,000 in addition to court fees and legal costs.

INALB I'm pretty sure this is what the OP was getting at.

</comment></comment></comment><comment><USER34> If you get $240 million in investments, and then sell the company for $250 million, I fail to see how it was successful (or "building a unicorn") at all.

<comment><USER35> You also take on another dozen millions in additional liability which you have to pay on top of the 240 million.

It was very successful for "Hooli" who basically channelled back their 200 million after investment and got another 200 million after the sale.

<comment><USER36> In even simpler terms, the deal generated 200m in ad sales for "Hooli".

</comment></comment></comment><comment><USER37> Why would the CEO Richard be liable for the wages surely that is the company's liabilities not his personal one

<comment><USER38> Unpaid wages are one of the few ways to pierce the corporate veil. In the US, officers of the corporation can be personally liable for unpaid wages.

<comment><USER37> seems to defeat the purpose of a PLC

<comment><USER39> The US states take unpaid employees very seriously. Think about it from the employee's point of view - if the company can't make payroll one week, you might be tempted to let it ride until next week. If they again can't make payroll, you've put 80+ (120+!) hours into the firm with no payment. I certainly wouldn't be happy in that situation.

<comment><USER40> This also partly aligns with it being very easy to fire people in the US. The government therefore views the employer as having a perfectly reasonable option in the case where they are truly short of money: fire the employees you can't afford to pay before they work the hours you don't have money for (or something halfway, like giving people a non-optional offer to go down to half- time). In most cases that can even be done with no notice, though that isn't very nice. But it is at least seen as more honest than stringing people along ostensibly working for a salary they aren't going to get.

In practice one way to handle this is keep one payroll cycle's worth of liquid cash "locked up" in an account that is reserved for payroll and which you don't dip into for other expenses. So even in the worst case the last paychecks can be sent out before shutting down, if you avoid the temptation to dip into that account "just this once". That does require having a _little_ bit of a cash cushion, but a VC-funded company should be in a relatively good position in that regard.

</comment></comment></comment></comment></comment><comment><USER41> Not sure the last deal would have even been up to the CEO. a deal like that would probably be a board vote, I would think and you may only have 40% of the vote. also, what if it was the only deal on the table and the trial campaign preformed well. Btw, Forbes called they heard about the deal and your going to be on the cover. And let's talk about poor Richard I don't he's managing an Arby's after he ran a billion dolllar company. Probably some kind of senior executive somewhere. Curious if VC would take his calls?

</comment><comment><USER42> Makes me wonder if building a company still is financially wise.

Even if you're successful, a prominent well-established career path will probably balance out an average startup exit(assuming there's one).

<comment><USER43> Was it ever financially wise?

<comment><USER43> I'm not saying not to do it, just saying that there are easier ways to get wealth. You might be in the game for other reasons.

</comment></comment></comment><comment><USER44> An interesting exercise is to think about what would have happened if that $200 million spent on advertisement on Hooli campaign gave a positive ROI.

Than Richard would be really happy right now.

What Richard should have done, is before accepting that $200 million, spend some of his own money on Hooli's ad platform to see what it was like, what kind of return they're looking at. If its good, take the money. If not, walk away.

But of course, it's very easy to make the right decision after already knowing the outcome...

<comment><USER45> Would Hooli would wait calmly on the sidelines with their offer still on the table while you did so?

<comment><USER46> If they wouldn't, what does that tell you about them?

</comment></comment></comment><comment><USER45> Great to see a VC being honest about the business. Richard should have never agreeded to the $200m deal with ad spending strings but I'm sure deals like this happen all the time. The pressure on an entrepreneur in such situations must be immense. I imagine others with much more experience giving advice but with their own motivations in mind. I could easily see founders such as Richard making decisions in the moment which are obviously bad looking back.

</comment><comment><USER12> So what is the reasonable repeatable way to determine or gauge valuation?

From what we have seen it is "Investor A wants X% of B and is willing to pay Z for it" therefore value is the multiple of Z that equals 100%. AkA Whatever someone will pay for it, AkA market prices. Except it's rarely a market in the traditional sense as it's really ever only a handful of buyers and they value it based on god knows what metrics.

Seems flimsy and based on whatever the most recent investor thinks - <USER2> diligence best practices aside.

We need a standard way to determine valuation so that founders and investors alike can point to something that is based in reality and can't be gamed as easily.

<comment><USER47> Demanding a _standard way to determine valuation_ is in some ways like demanding a standard way of coming up with ideas. The reason prices are determined this subjectively is because information is incomplete. That means you need to use a lot more one off judgements that can't be fit into a standard.

If information was better then there would already be useful standards. There are pretty decent standards for companies that demonstrate a lot of consistency, like shipping companies. There are ways for valuing stock. On the other end of the spectrum, valuing a company that is still a work in progress is a different kind of problem. The upside is bigger and the downside more likely.

<comment><USER12> _The reason prices are determined this subjectively is because information is incomplete._

That is every market ever. No entity makes decisions based on perfect information - but plenty have a process that is auditable and lays out the assumptions.

 _If information was better then there would already be useful standards._

I think whatever standard or process we did come up with would be more refined/accurate with more information - but I that doesn't preclude having something that can be audited.

I'm not saying that the process would spit out the "right" valuation, because that is impossible to tell prior to a liquidation event. What I am saying is that the process for determining valuations needs to be 100% more transparent. Like it or not there is a process - maybe it's all in one principle's head, but it's there.

We as founders need to know what that is.

</comment></comment></comment><comment><USER36> All the right things have been said in other comments already, however I'd like to point out that the outcome for Peter, the angel investor is a little unclear from the article. It says:

> Peter, while sad about the outcome, has developed a huge syndication > following on AngelList and has recently benefitted from an early acquisition > that netted him $3 million on a $250k investment. Can't win them all, but > he's at peace.

Assuming the investment was in convertible notes, surely the debt would have converted into shares at the same terms that the VC investment happened, including the liquidation preference. So if the VC gets to take chips off the table so would Peter, I assume?

</comment><comment><USER48> It seems obvious to me that giant valuation means insanely high bar before you see upside. I am a bit skeptical of the idea that it should be as high as possible, since if it's fundamentally ridiculous and there's no way you will ever live up to it I fail to see how this is in anyone's interest.

</comment><comment><USER49> Hypothetically, assume a company whose valuation increases roughly geometrically at first, but then levels off at an asymptote, and assume that during the geometric phase the valuation fluctuates by 50% around its trend. Assume that no one knows where the asymptote is. Periodically, there are funding events, during which the company sells stock at a 1x liquidation preference; assume it sells enough stock so that at each funding event, the sum of the liquidation preferences is greater than 50% of its valuation. Consider a funding event that occurs when the valuation happens to be 25% above trend; therefore the liquidation preferences will be greater than 0.625 of the on-trend valuation, and then the next time that the valuation falls to 50% below trend, the sum of those preferences will be greater than the company's current valuation. At this point, many of those with liquidation preferences (some of whom may have a short time horizon; or may be risk- averse; or may believe that the current valuation will not rise very much in the future) may strongly prefer selling or liquidating the company immediately, which is at odds with common-stock-holders, who would get nothing in such a liquidation and who would prefer to keep going.

Note that in this model, this result occurred not because of mismanagement, but due to the natural and expected fluctuation in market prices, combined with unavoidable uncertainty about which price changes are fluctuations and which are simply 'the new normal', combined with the sum of liquidation preferences being comparable in magnitude to the fluctuations in prices, combined with the bad luck of a funding event happening to occur when the valuation was above trend.

Is this model reasonable? If so, how should management of such a company approach fundraising? It seems to me that fluctuations are inevitable and that the only thing management could control is how much money they raise at once; if fluctuations are 50% around trend, then management needs to keep the amount of money raised small enough so as to keep the sum of liqudiation preferences well under 1/3 of the current valuation (because in that case even if the valuation falls from 50% over trend to 50% under trend, the valuation will still be strictly greater than the sum of liquidation preferences). More realistically, the size of fluctuations would not be known in advance to be 50% but must be estimated. In the article, the valuation fluctuated from $1bil to $250mil, so the fluctuation parameter would be at least (1-x)/(1+x) = 250/1000 = 4 -> x = 3/5 = 60%, and the sum of liquidation prefs "should have" been kept well less than 250/1000 = 1/4 of the current valuation.

</comment><comment><USER50> Is there a good text which would make the meaning of all this clear?

</comment><comment><USER51> It's good to know that the she watched the episode. Has anyone in the valley gone through this or?

</comment><comment><USER52> Talking your book much? This story is so contrived that it hinges on a comically inept founder taking $200M to solely spend on an advertising campaign on the platform of the person investing it. If this is the best example a VC can offer to cram down valuations then I'm pretty sure founders are going to keep reaching toward those unicorn valuations.

<comment><USER53> ever heard of living social? How much of amazon's investment was recycled into purchases (obviously with lower margins than ads) on amazon when they offered a $20 amazon gift card for $10?</comment></comment>


The History, Status, and Future of FPGAs - <AUTHOR> https://queue.acm.org/detail.cfm?id=3411759 <comment><USER2> As a bit of a counterpoint:

One of my prior projects involved working with a lot of ex-FPGA developers. This is obviously a rather biased group of people, but I saw a lot of feedback around that was very negative about FPGAs.

One comment that's telling is that since the 90s, FPGAs were seen as the obvious "next big technology" for HPC market... and then Nvidia came out and pushed CUDA hard, and now GPGPUs have cornered the market. FPGAs are still trying to make inroads (the article here mentions it), but the general sense I have is that success has not been forthcoming.

The issue with FPGAs is you start with a clock rate in the 100s of MHz (exact clock rate is dependent on how long the paths need to be), compared with a few GHz for GPUs and CPUs. Thus you need a 5× performance win from switching to an FPGA just to break even, and you probably need another 2× on top of that to motivate people going through the pain of FPGA programming. Nvidia made GPGPU work by being able to demonstrate meaningful performance gains to make the cost of rewriting code worth it; FPGAs have yet to do that.

Edit: It's worth noting that the programming model of FPGAs has consistently been cited as the thing holding back FPGAs for the past 20 years. The success of GPGPU, despite the need to move to a different programming model to achieve gains there, and the inability of the FPGA community to furnish the necessary magic programming model suggests to me (and my FPGA-skeptic coworkers) that the programming model isn't the actual issue preventing FPGAs from succeeding, but that FPGAs have structural issues (e.g., low clock speeds) that prevent their utility in wider market classes.

<comment><USER3> See it's funny, I (software guy) have recently started doing a bunch of FPGA stuff on the side for "fun" and I find the programming model to not be the biggest challenge.

The tools, yes, because it seems like hardware engineers have a fetish for all-encompassing painful vendor specific IDEs with half the features that us software developers have, and with a crapload of vendor lock-in... but I digress.

I find working in Verilog to be pretty pleasant. Yes I can see that with sufficient complexity it wouldn't scale out well. But SystemVerilog does give you some pretty good tools for managing with modularity.

On the other hand, I've never particularly enjoyed working with GPUS, CUDA, etc.

So I would agree with your statement that the structural issues prevent their utility in wider market classes -- and those really are as you say ... lower clock speeds, cost, but also vendor tooling.

FPGAs could really do with a GCC/LLVM type open, universal, modular tooling. I use fusesoc, which is about as close to that as I will get (declarative build that generates the Vivado project behind the scenes), but it's not perfect, still.

<comment><USER4> I don't mean to belittle your exploration, but are you sure it's an apples-to- apples comparison? This suggests to me that it isn't:

> it seems like hardware engineers have a fetish for all-encompassing painful > vendor specific IDEs

Hardware engineers feel pain just like you do. The reason why they put up with those awful software suites is because they have features they need that aren't available elsewhere. In particular, they interface with IP blocks and hard blocks, including at a debug + simulation level. Those tend to evolve quickly and last time I looked -- which admittedly was a while ago -- the open source FPGA tooling pretty much completely ignored them, even though they're critical to commercial development.

If you are content to live without gigabit transceivers, PCIe controllers, DRAM controllers, embedded ARM cores, and so on, I suspect it would be relatively easy to use the open source tooling, but you would only be able to address a small fraction of FPGA applications.

<comment><USER3> Vivado ships all kinds of "IP" for those things, yes. And once you get past the GUI wizards, drag and drop boxes and lines, and Tcl scripts you find in the end it's just a library of Verilog, all mangled to the point of illegibility.

I wasn't talking about open sourcing. I accept we won't have open source DRAM controllers and the like from them. I understand the licensing restrictions. I just don't like how they force all this stuff to be gatewayed through their baroque and over complicated GUI tools.

I prefer tools that are scriptable, that can work with the build system of my choice, that work properly with source control (imagine that!), where you have your choice of editor rather than having their garbage one rammed down your throat, where there's wizbang features like reformatting and auto- indentation... Hell, even refactoring.

Vivado and Quartus just get in the way. There's no reason to tie all the stuff you're talking about into an integrated tool. They could just ship libraries.

Fusesoc does in fact try to make them behave this way. But you can tell it's a bit of a war to make it happen.

<comment><USER4> Well yes, they shouldn't cram the awful GUI tools down HW engineers' throats, but they do.

I'm glad Fusesoc is fighting the good fight and I'm glad you're fighting the good fight, but as you point out, it's definitely a fight. It was hardly fair to call the desire to avoid said fight a "fetish."

<comment><USER3> I can only assume hardware engineers are asking for this kind of tooling, because I can't imagine why companies would be spending the enormous development effort on them and then giving them away for free if they weren't being asked for?

So many things that could be done in a programatic, testable, declarative, scriptable, repeatable way are done with futzy GUI tools in hardware land. Schematic design _could_ be a matter of declaring components, buses, etc. and letting the tool produce something (and then manually manipulate the visual layout if necessary) ; I mean you could literally describe your board using something similar to Verilog and get the tool to produce the schematic for you... we have these kinds of powers in the 21st century -- Instead it's futz with tools that are vaguely Illustrator-esque, find that half your connection points are not actually connected, etc. Why do people want to suffer like this?

Want to use a DRAM controller in Vivado? Find the wizard, enter into 10 text boxes... and if you're lucky you can find the Tcl scripts it generated and in the future just write your Tcl script... but they certainly won't make it easy.

Vivado project in source control? You're going to jump through hoops for that.

I want hardware engineers to demand better.

</comment></comment></comment></comment></comment></comment><comment><USER5> I am working right now on bare metal websockets implementation on Xilinx Series 7 FPGAs. Currently it's ZynQ SoC, but final product will probably have Kintex 7 inside, so no Linux. The tools make me cry, no examples, application notes from 2014 with ancient libraries. I hope, vendors will fix tooling. But I see, Xilinx has released Vitis, so their scope is elsewhere, no interest in old crap. Using Git with Vivado is already enough pain. So I keep my text sources in Git and complete zipped projects as releases. Ouch!

<comment><USER6> I feel you completely. The Vivado IDE/toolchain is absolutely atrocious and the designers should be shamed for the horrifying bloatware they push as the STANDARD. Sometimes I have better luck doing everything in tcl/commandline there.

<comment><USER7> Vivado is amazing compared with the ASIC counterparts: Design compiler is for RTL synthesis only and you need years of experience to get any decent qor out of it. In ASIC land you have separate tools for every step, synthesis, STAs, PnR, simulation, floor planning, power analysis, etc. Vivado does all that in one seamless tool, and allows you to cross probe from a routed net right back to the RTL code it came from. Try doing that with ASIC tools. So to me it's a matter of perspective, once you understand how difficult the problem of hardware design is to solve, and what some of the existing de facto industry standard tools are like (for ASIC), you come to appreciate vivado for just how well it brings all of these complex facets together. Of course if you come from a SW background you make think vivado is terrible compared to VScode or some other IDE, but that's an unfair comparison. I guess to reframe the question - show me a hardware design environment that is better than Vivado. Also, I separate vivado fron the Xilixn SDK, as they are different tools, and Vivado is expclitly got the HW parts of the design

<comment><USER8> I added one small Verilog file to a Vivado project.

It froze the IDE for _45 minutes_ before I could do anything else.

This was on a beefy machine at AWS too, not some cheap home desktop thing.

That wasn't compiling, no synthesis, P&R, nothing.

There was no giant netlist I'd been working on either. Most of the FPGA was empty.

That was literally just adding a small source file which the IDE auto-indexed so you could browse the contents.

In Verilator, an open source Verilog simulator, that same source file loaded, completed its simulation and checked test results in less than a second. So it wasn't that hard to compile and expand its contents.

Vivado is excellent for some things. But the excellence is not uniform unfortunately. On that project, I had to do most of the Verilog development outside Vivado because it was vastly faster outside Only importing modules when they were pretty much ready to use and behaviorally validated.

<comment><USER7> That's definitely an anomaly, I use vivado with ASIC code reguarly, very large designs and have not seen anything like this. I use vivado to elaborate and a analyse code intended for ASIC use as its better than other ASIC tools for that purpose. Once I'm happy with it in vivado, then I push it through design compiler, etc. Elaborating a deign that is 4 hours in DC synthesis is about 3 mins in vivado elaboration.

</comment></comment></comment></comment></comment><comment><USER9> I wonder if it is possible to add a (small) FPGA to a personal computer that could accelerate any specific software tasks (video/audio encoding, ML algorithms, compression, extra FPU capabilities) _on user demand_.

<comment><USER10> The problem with this will be the overhead of transferring data to/from the FPGA, which once accounted for often causes doing the computation on the CPU to make more sense. It's obviously not a show-stopper, since GPUs have the same problem, but are still useful, but it's hard to find a workload that maps well to this solution.

<comment><USER11> In a DAW, accelerating a heavy VST plugin might make sense. But often those are amenable to being translated to GPGPU code already.

I guess the one place where GPGPU-based solutions _wouldn 't_ work, is when the code you want to accelerate is necessarily acting as some kind of Turing machine (i.e. emulation for some other architecture.) However, I can't think of a situation where an FPGA programmed with the netlist for arch A, running alongside a CPU running arch B, would make more sense than just getting the arch-B CPU to emulate arch A; unless, perhaps, the instructions in arch-A are _very, very CISC_ , perhaps with analogue components (e.g. RF logic, like a cellular baseband modem.)

</comment></comment></comment><comment><USER12> Maybe you will find this article about Large-Scale Field-Programmable Analog Arrays [FPAAs] interesting as well: [https://hasler.ece.gatech.edu/FPAA_IEEEXPlore_2020.pdf](https://hasler.ece.gatech.edu/FPAA_IEEEXPlore_2020.pdf)

</comment><comment><USER13> FPGAs are good at _nothing_ in the scale that can challenge non-configurable silicons...

They are good at a lot of things that are in a smaller scales. Like general prototyping/testing/simulation, telecom, special-purpose real-time computing etc.

The behind-scene logic is that FPGAs can never make things as flexible as software. And flexible software always offset the inefficiency in a non- configurable chips. Just comparing FPGAs and CPUs/GPUs will never teach FPGAs vendors the reality, or they choose to ignore after all...

<comment><USER14> I believe you are incorrect. A counterexample to your claim is the increasing use of FPGAs in the datacenter. And various AI engines are FPGA-based. You'll do better for a CPU in Real Silicon; but a full-featured MPU w/standard peripherals + FPGA for unusual & must-be-fast functions is hard to beat.

<comment><USER13> Tell me how much users are using FOGAs and why xillinx is just a fraction of nVidia's market cap. 5 years ago, nvidia was 2x of xillinx in market cap, now it's 10x.

</comment></comment></comment><comment><USER15> 2 are the main challenges of the FPGA utilization:

\- The first one is the FPGA programming. Now using OpenCL and HLS is much easier compared to VHDL/verilog to design your own accelerators.

\- The second one is the FPGA deployment and integration. Until now it was very difficult to integrate your design with applications, to scale-out efficiently and to share it among multiple threads/users. The main reason was the lack of an OS_layer (or abstraction layer) that would enable to treat FPGAs as any other computing resource (CPU, GPU).

This is why at inaccel we developed a unique vendor-agnostic orchestrator for FPGAs. The orchestrator allows much easier integration, scaling and resource sharing of FPGAs.

That way we have managed to decouple the FPGA designer from the software developer. The FPGA designer creates the bitstream and the software developer just call the function that wants to accelerate. No need to define the bitstream file, no need to define the interface or the memory buffer allocation.

And the best part: It is vendor and platform agnostic. The FPGA designer creates multiple bitstream for different platform and the software developer couldn't care less. The developer just call the function and the inaccel FPGA orchestrator magically configure the right FPGA for the right function.

</comment><comment><USER16> _> Intel, AMD, and many other companies use FPGAs to emulate their chips before manufacturing them._

Really? I'm assuming if this is true it can only be for tiny parts of the design, or they have some gigantic wafer-scale FPGA that they're not telling anyone about :-) Anyway I thought they mainly used software emulation to verify their designs.

<comment><USER17> Many years ago, we had a custom made board with 8 huge Xilinx Virtex 5 FPGAs (the largest available at the time) to emulate a large SOC. Those FPGAs were something like $20K a piece.

We had 10 such boards, good for millions of dollars in hardware, and a small team to keep it running.

These platform were mostly used by the firmware team to develop everything before real silicon came back. It could run the full design at ~1 to 10MHz vs +500MHz on silicon or 10kHz in simulation.

After running for a while, that FPGA platform crashed on a case where a FIFO in a memory controller overflowed.

Our VP of engineering said that finding this one bug was sufficient to justify the whole FPGA emulation investment.

<comment><USER18> The multiple FPGA on a board is generally from Dini Group right? Fantastic boards.

Ref: [https://www.dinigroup.com/web/index.php](https://www.dinigroup.com/web/index.php)

<comment><USER19> Dini's naming schemes are hilarious. They're all named like monsters in B-movies -- their latest system, the DNVUF4A, is called "Godzilla's Butcher on Steroids", for instance.

Also, Dini got acquired by Synopsys a few years ago.

<comment><USER18> Oh I love their humor. There is always something humorous written for their status LEDS.

 _" Although no specific testing was performed, sophisticated statistical finite element models and back of the envelope calculations are showing the number of status LEDs to be bright enough to execute dermatological procedures normally done with CO2 lasers. Contact the factory for more information about this sophisticated feature and make sure an adult is present during operation. These LEDs are user controllable from the FPGAs so can be used as visual feedback in addition to burning skin."_

 _" As with all of our FPGA-based products boards, the DNVUPF4A is loaded with LEDs. The LEDs are stuffed in several different colors (red, green, blue, orange et al.). There are enough LEDs here to melt cheese. Please don't melt cheese without adult supervision. These LEDs are user controllable from the FPGAs so can be used as visual feedback in addition to the gratifying task of creating gooey messes."_

</comment></comment></comment></comment></comment><comment><USER20> IMO the next big application for FPGAs is going to be to serve as a programmable DMA-engine of sorts. Have some a bunch of hard logic like ALUs and/or IO/s strewn about. Like for hw accelerated sql queries, malloc/free, data-specific compressors and the like.

</comment><comment><USER21> I wonder what would be the advantages of using an FPGA to _test_ a CPU design - compared to relying on a (presumably more accurate) computer-based simulation. (I understand the reasons one might want to _implement_ a CPU in an FPGA.)

<comment><USER22> This idea is more than 30 years old. It has been done, and one upon a time companies were built around this idea.

First off, mapping an entire CPU to an FPGA cluster is a design challenge itself. Assuming you can build an FPGA cluster large enough to hold your CPU, and reliable enough to get work done on it, you have the problem of partitioning your design across the FPGA's. Second problem: observability. In a simulator, you can probe anywhere trivially, with an FPGA cluster, you must route the probed signal to something you can observe. (I am not even going to talk about getting stimulus in and results out, since with FPGA or simulator, either way you have that problem, it is just different mechanics.)

The big problem is that an FPGA models each signal with two states: 1 and 0. A logic simulator can use more states, in particular U or "unknown". All latches should come up U, and getting out of reset (a non-trivial problem), to grossly oversimplify, is "chasing the U's away". An FPGA model could, in theory, model signals with more than two states. The model size will grow quickly.

Source: Once upon a time I was pre-silicon validation manager for a CPU you have heard of, and maybe used. Once upon a time I was architect of a hardware- implemented logic simulator that used 192 states (not 2) to model the various vagaries of wired-net resolution. Once upon a time I watched several cube- neighbors wrestle with the FPGA model of another CPU you have heard of, and maybe used.

Note: What would 3 state truth tables look like, with states 0,1,U? 0 and 1 is 0. 0 and U is 0. 1 and U is U -- etc. You can work out the rest with that hint, I think.

Edit to add: Why are U's important? They uncover a large class of reset bugs and bus-clash bugs. I once worked on a mainframe CPU where we simulated the design using a two-state simulator. Most of the bugs in bring-up were getting out of reset. Once we could do load-add-store-jump, the rest just mostly worked. Reset bugs suck.

<comment><USER23> > Reset bugs suck.

Indeed they do. And even if you have working chips you get the next stage: board level reset bugs. A MC68K board I helped develop didn't want to boot, some nasty side effect of a reset line that didn't stay at the same level long enough stopped the CPU from resetting reliably when everything else did just fine. That took a while to debug.

</comment></comment></comment><comment><USER24> The thing with FPGA is that companies when faced with cash and time crunch will opt to use a FPGA instead of designing ASICs. The tools suck but companies will hire someone that will do it. FPGA fit a very particular constraint and still solves very specific problems efficiently

</comment><comment><USER25> The problem that FPGAs have is that they are only good for low-volume solutions that require flexibility and have no power constraints.

That's a really narrow market. Telecom equipment and lab equipment, basically.

If I need volume, I need at least an ASIC. If I need to manage power, I need a full custom design.

<comment><USER14> MicroSemi (now part of Microchip) makes some low-power FPGAs. Xilinx has made the coolrunner CPLDs for years that are mighty low-power (they're not huge, but often are big enough for some needed extra logic.). (Another not care too much about power is Military.)

</comment></comment><comment><USER26> This is really interesting. If a cpu hardware vulnerability like spectre could be repaired by patching an fpga on the SOC that would be incredible. That type of functionality would overtake the entire cloud market in about 3 days.

<comment><USER16> I'm afraid it doesn't work like this. That would only be possible if the chip was using an FPGA fabric for the relevant parts of the design. For example if the L1 cache was implemented as an FPGA you could in theory patch around L1TF. But they wouldn't do that because it would be far slower/larger than implementing it directly as an ASIC.

Or you might imagine a chip that has an FPGA on the side (I expected Intel would ship this after acquiring Altera, but it never happened). But the FPGA would somehow have to have access to the paths that caused the vulnerability, which is highly unlikely, and would also be really slow compared to what they actually do which is hacking around it by microcode changes.

<comment><USER19> > Or you might imagine a chip that has an FPGA on the side (I expected Intel > would ship this after acquiring Altera, but it never happened).

They did: [https://www.anandtech.com/show/12773/intel-shows-xeon- scalab...](https://www.anandtech.com/show/12773/intel-shows-xeon-scalable- gold-6138p-with-integrated-fpga-shipping-to-vendors)

But I get the sense this part was aimed at a few very specific customers. It required some PCB-level power delivery changes, so you couldn't even drop it into a standard server motherboard.

</comment></comment></comment><comment><USER27> inaccel.com is making lots of steps to bring FPGA to 2020

Spark/k8s integration Abstraction of popular cores Python APIS Serverless deployments Etc</comment>


Day 1 of Oracle v. Google trial - <AUTHOR> http://www.groklaw.net/article.php?story=20120416085550303

<comment><USER2> Groklaw is weird. It's one of the sites that I _never_ read, because I don't really understand any of the articles, but I'm _very_ happy that it exists, for some reason, and always click through to the articles (which, as I said, I always fail to understand).

</comment><comment><USER3> Very interesting summary. I've never been on a jury, and I learned two things from that article:

1) The lawyers can say basically whatever they want, but the jurors are "supposed" to only consider actual evidence - stuff shown from the witness stand, with a few exceptions - when making their decision. I guess this is why you want a really good lawyer... he can convince them to interpret the evidence in his way.

2) The different parties can present stuff while talking (like the Lindholm emails) which _aren't_ evidence, and it's basically up to the jury to remember what's what. Potentially very confusing, and again, I guess that's why you want a good lawyer.

If I'm wrong on either of these, I would appreciate it if someone who actually knows something about law would correct me. Very interesting, thorough, and well-done writeup!

<comment><USER4> During opening arguments, the lawyers are not supposed to argue. In other words, they are only supposed tell the jury what the evidence is going to show. However, there is an art to this, and there is obviously an element of persuasion in the way the evidence is presented. Also, for various reasons, the opposing counsel may not object to possibly argumentative statements.

During closing statements the lawyers are free to argue that the evidence should be interpreted a certain way, but you are basically correct that the jury should use their own judgment based on the facts presented. Yes, a persuasive lawyer is worth a lot!

As to point 2, there are exceptions and nuances, but basically the parties CANNOT present things that are not admissible evidence. During opening arguments the parties can use items that will eventually be admitted into evidence, and the email is definitely one of those things. The parties have already argued extensively over whether the email should be admitted, and the judge has ruled that it will. Ideally, the jury never hears or sees anything that is not admissible evidence.

<comment><USER4> Clarification to my reply above: I meant to say "opening statements", and "closing arguments", not the other way around. This is what they are are actually called, I'm not sure why I wrote it the other way. I hope this clarifies my meaning a little.

</comment></comment></comment><comment><USER5> I love Groklaw.

What are people's opinions on the copyrightability of a programming language?

In my opinion, on one hand Java is clearly a creative work, but obviously it takes many idioms from other languages. I don't really see how they could have a valid copyright claim, unless they're claiming copyright specifically on the class interfaces, which is probably a very weak argument. Even then, I would bet that the class interfaces are based on previous works in other languages.

I guess the bigger question would be 'Can you copyright a language?' Programming languages are just a subset of all languages, and I don't believe it would be right to allow someone to copyright aspects of a language.

So I guess my belief would be that the interfaces could potentially be patentable, yet clearly aren't patented because they're based on the interfaces in prior languages, but are not copyrightable because there's no sound basis for copyrighting a language.

<comment><USER6> You mean legally our ethically?

Legally I have absolutely no clue. That's why they're in the court room for. At the end of the day it's up to some random people's opinion.

Ethically, I'm pretty sure it does by far more harm than good. Because of the whole standing in the shoulder of giants, and common as air arguments. That most here are very aware of. The only counter point would be the economic incentive that copyright gives oracle. But that's meaningless because we have mountains of evidence that people will invent great languages anyway.

</comment></comment><comment><USER7> the jury selection process seems designed to ensure that instead of a jury of your peers, you end up with a jury of people completely ignorant about what's involved in the case.

<comment><USER8> You mean because they threw out people who heard of "Open Source Software."

Yeah, that kinda stinks, but there is a bit of logic in having jurors who don't have preconceived notions of what Open Source means (since there's a good chance they're not even accurate).

</comment></comment><comment><USER7> Here's the arstechnica's take [http://arstechnica.com/tech- policy/news/2012/04/oracle-tells...](http://arstechnica.com/tech- policy/news/2012/04/oracle-tells-jury-you-cant-just-step-on-somebodys- intellectual-property.ars)

</comment><comment><USER9> After months of discussion here and elsewhere I still don't understand why Oracle is doing this. Google IS making money off of Android but Java and Java APIs are one part of the whole package (Linux being the other). Google is no threat to Oracle (almost no product portfolio overlapping). On the contrary Google diminished Microsoft's influence in the mobile market and works towards doing the same with the browser (Chrome), Office (Google Docs) and OS (Google OS).

And MS is Oracle's (OK... Larry's :) ) arch rival no.1.

Why is Oracle fighting Google and wants to get a few hundreds of millions (which is not much for the company that big) when they could let Google go its thing and watch how MS gets weaker due to that?

<comment><USER10> Larry and Jobs were close friends - Larry threatened a hostile takeover of Apple back in the day if they did not bring Jobs back. Perhaps that is one reason - to make Android less attractive in the marketplace.

<comment><USER11> Heck, Jobs put him on the board (to a crowd with some people booing) when he came back to Apple.

</comment></comment></comment><comment><USER12> Now I want a Groklaw app for my iPad.</comment>


The rolling shutter effect visualized - <AUTHOR> https://www.youtube.com/watch?v=dNVtMmLlnoE <comment><USER2> Rolling shutters go way back.

[http://www.largeformatphotography.info/forum/showthread.php?...](http://www.largeformatphotography.info/forum/showthread.php?31903-Jacques- Henri-Lartigue-and-his-camera)</comment>


A List of Free Networking courses that offer free certification - <AUTHOR> https://www.helpmegeek.com/free-network-certifications-and-courses/ <comment><USER2> Cisco Devnet has tons of free resources now, I was just using CML2 to build and test typologies. I would be cautious looking at old Cisco content if you do plan to get CCNA/NP/IE level certs since the whole curriculums changed in Feb2020.

Regardless thank you for sharing these links the Fortinet one looks intriguing, esp being on furlough I got enough time on hand.

</comment><comment><USER3> On a tangential topic, do respectable online certifications for product management exist?

Plenty of Udemy courses and the like, but nothing I've found with certification.

Is certification generally reserved for specific technical skills like networking, security, cloud infrastructure, etc.?

<comment><AUTHOR> Actually with Project management the case is a bit different. There is a central body called "Project management institute". They have a selected number of certification options that are recognized globally. You can defnitely attend free courses but only PMI can certify you to be certified Project Management Professional.

<comment><USER4> He said product management, not project.

<comment><USER5> Then Udacity nano-degree is probably best imo.

</comment></comment></comment></comment><comment><USER6> Can anyone comment on which (if any) of these are respected in industry?

<comment><USER7> To me, anything is better than nothing. At the same time, I'd expect that if you put a cert like this on your resume, you can speak knowledgeably about something the cert might cover. (e.g., What's a netmask for? What happens if you get it wrong?)

<comment><USER7> Perhaps I could add that I know little about most of the world's certifications. For example, people from other countries show up with various degrees, sometimes expecting that I'll know about their (to them) famous or even top school. I often don't. (Sorry.) But I generally take them at their word, especially after confirming with some modest probing.

</comment></comment></comment><comment><USER8> The only point of certification is signaling. Right now there is only 1 (Ga Tech's OMSCS) online program that would be a positive signal. On the other hand, including an online certification in most resumes would probably be a negative signal, especially an unknown one.

<comment><USER9> Disclaimer: I work as a dev without a college degree so I'm a biased towards the side of alternative credentials.

I would love to hear other opinions on this subject. Everyone seems to have a different take on adding certificates and online courses to your resume.

Personally, I would see any sort of online course or certification positively as it shows you are learning. Whether or not you can back it up when you get it for an interview is a different matter entirely but having traditional BS/MS doesn't bypass that hurdle either.

<comment><USER10> Although I do have a college degree (though not in CS), I do feel that adding unessential certificates "in lieu of" education works against you. It just highlights the fact that you believe credentials are important (otherwise why did you invest in them) but you still avoided one of the most recognized credentials that exists. If you have extensive work experience this may flip, though (I've been busy working, so while I couldn't go back to college I could invest in meaningful credentials).

Additionally, it's difficult to surmise how certain credentials are viewed. I graduated from a tech bootcamp (i.e. hundreds of hours of instruction) and it weighed negatively on my resume in most cases (and when it was positive it was largely from other graduates, giving it more of a "club" credential vibe than an actual value signal).

In either case, I'd never recommend against obtaining a credential (even if it's not going to go on a resume) as the subject matter will likely be useful. Just be sure to only try to apply a credential when it's relevant, not as an educational stand-in.</comment></comment></comment>


Password Hashing Competition - <AUTHOR> https://password-hashing.net/

<comment><USER2> "The poor state of passwords protection in web services: passwords are too often either stored in clear (these are the services that send you your password by email after hitting "I forgot my password"), or just hashed with a cryptographic hash function (like MD5 or SHA-1), which exposes users' passwords to efficient brute force cracking methods."

If you can't get people to use current crypto hashing techniques like bcrypt or scrypt why would coming up with another one help?

Of course it would be nice to see something with the work factor features of bcrypt that were more specifically resistant to GPU optimized crackers.

<comment><USER3> I'm torn.† On the one hand, it sends a "jury is out" message on modern password hashing in general. On the other hand, developers already handwave about "bcrypt not having gotten enough cryptographic review", as if someone was ever going to publish a cryptanalytic result showing bcrypt to be worse than SHA1.

I'd have liked the jury to have been back on this last decade, but I'll settle for it being in next year.

By the way, the construction you're looking for is scrypt.

† _I'm not really torn._

<comment><USER4> > _"jury is out"_

One advantage of a jury being out is that someday said jury can come back in and return a verdict.

> _as if someone was ever going to publish a cryptanalytic result showing > bcrypt to be worse than SHA1._

SHA-1 has a formal specification, an RFC, a reference implementation, implementation guidance, and comprehensive test vectors published. To date, bcrypt is lacking some of those things.

And yes, bcrypt has gotten pwned worse than SHA-1 as a result: <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2483>

<comment><USER3> Give me a break. That's an application implementation flaw, and one no standard could have prevented. It's like saying that insufficient cryptanalysis is responsible for the OpenSSL RCEs.

Again: I'm not really torn. It's a good thing you're all doing this.

The jury is not really out on bcrypt, though.

<comment><USER4> _one no standard could have prevented_

Then I'm sure you'll have no trouble* finding similar vulnerabilities introduced by implementation flaws of any NIST (or even IETF) defined algorithms.

*Note: sarcasm.

<comment><USER5> How about this: [http://blog.fortify.com/blog/fortify/2009/02/20/SHA-3-Round-...](http://blog.fortify.com/blog/fortify/2009/02/20/SHA-3-Round-1)?

Granted, these were just candidates and not actually NIST defined algorithms, but the point stands that algorithms can be fine while standard implementations have bugs.

<comment><USER4> Those were round 1 submissions, not even close to being "standard implementations". Which proves my point that the standardization process works to minimize implementation bugs in implementations of the standard.

<comment><USER3> NIST standardization sure didn't help SHA2:

[http://mail-index.netbsd.org/tech-security/2009/07/28/msg000...](http://mail- index.netbsd.org/tech-security/2009/07/28/msg000250.html)

You're just wrong about this point, Marsh. You are very smart and often right, but not invariably so.

<comment><USER4> OK, so here's the patch to the bug in question:

[http://cvsweb.netbsd.org/bsdweb.cgi/src/common/lib/libc/hash...](http://cvsweb.netbsd.org/bsdweb.cgi/src/common/lib/libc/hash/sha2/sha2.c.diff?r1=1.17&r2=1.18&only_with_tag=MAIN)

         +	/* The state and buffer size are driven by SHA256, not by SHA224. */
          	memcpy(context->state, sha224_initial_hash_value,
         -	    (size_t)(SHA224_DIGEST_LENGTH));
         -	memset(context->buffer, 0, (size_t)(SHA224_BLOCK_LENGTH));
         +	    (size_t)(SHA256_DIGEST_LENGTH));
         +	memset(context->buffer, 0, (size_t)(SHA256_BLOCK_LENGTH));

The NetBSD code was confused about _which_ algorithm it was implementing. This can hardly be used to generalize about vulnerabilities in specific NIST approved algorithms.

 _You're just wrong about this point, Marsh. You are very smart and often right, but not invariably so._

So even if we allow this example as meeting my test of _similar vulnerabilities introduced by implementation flaws of any NIST (or even IETF) defined algorithms_ I can still claim that this bug that existed in NetBSD only for 3 months in the spring of 2009 is the exception which proves the rule.

It doesn't compare at all in scope to <http://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2011-2483> in terms of the length of time, number of systems affected, or number of credentials created with weak cypto.

EDIT: Sorry, I'm looking at the wrong patch. It appears that at the time indicated in the advisory, a bunch of other stuff was added to the source tree.

Either I'm missing something obvious or there's a bit of misdirection going on. For example, it says: *"The overflow occurs at the time the hash init function is called (e.g. SHA256_Init). The init functions then pass the wrong size for the context as an argument to the memset function which then overwrites 4 bytes of the memory buffer located after the one holding the context." and "fixed: NetBSD-4 branch: Jul 22, 2009"

But the diffs of 2009-07-22 [http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/sys/sha2.h.diff?...](http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/sys/sha2.h.diff?r1=126.96.36.199&r2=18.104.22.168&only_with_tag=netbsd-4) [http://cvsweb.netbsd.org/bsdweb.cgi/src/common/lib/libc/hash...](http://cvsweb.netbsd.org/bsdweb.cgi/src/common/lib/libc/hash/sha2/sha2.c.diff?r1=220.127.116.11&r2=220.127.116.11&only_with_tag=netbsd-4) don't seem to affect the memset call in SHA256_Init() at all or the size of the structure.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> "• The poor state of passwords protection in web services: passwords are too often either stored in clear (these are the services that send you your password by email after hitting "I forgot my password"), or just hashed with a cryptographic hash function (like MD5 or SHA-1), which exposes users' passwords to efficient brute force cracking methods."

That is a huge issue that I wished was made a criminal action.

But when a user forgets there password, the issue of issuing a new one falls down to verifying the user is who they say they are without a password and falls down to the previous details held by that user.

       Be it phone number to SMS a reset code or email to issue a rest code or new password.  It is a hard area that will always have a weakness.

I do wonder if the postal system could step in by offering a service which you could walk in - show your passport or supporting ID and have them issue you with a rest code which you could use upon the site.

Certianly would add to the services they offered and whilst it would not be instant or as easy for many it certainly would be far more robust way to address the issue. A service that until something better comes along that would work for everybodies best interests.

Maybe a good opertunity for a startup to pursue.

<comment><USER7> Hashing data with SHA1 should be a criminal offense? Seriously?

<comment><USER8> It already is. The FCC regulates this sort of thing. If you are a large business with lots of user data and you don't take appropriate steps to protect it they can and will fine you.

<comment><USER3> The FCC has never fined anyone for SHA1-hashing passwords.

<comment><USER8> I'll take your word for it, but I bet that has to do with the fact that once you get big enough for the FCC to care you probably know enough to properly store a password.

They've certainly fined other companies for other transgressions of a similar nature.

<comment><USER3> For instance...?

<comment><USER8> Path just had to pay an 800k fine (though I think that was for coppa violations?).

Twitter & Google have also had very prominent investigations & settlements in the past couple of years.

<comment><USER9> I think tptacek might be using the socratic method or else he is just messing with you but I can't watch it any longer.

The regulatory function you are talking about falls under the purview of the _FTC_ , not the FCC.

 _"Path Social Networking App Settles FTC Charges it Deceived Consumers and Improperly Collected Personal Information from Users' Mobile Address Books

Company also Will Pay $800,000 for Allegedly Collecting Kids' Personal Information without their Parents' Consent"_[1]

[1] <http://www.ftc.gov/opa/2013/02/path.shtm>

<comment><USER3> For the record: I genuinely do not know the answer to the question I just asked, although obviously I'm skeptical about this underlying claim.

<comment><USER9> I am equally skeptical about the SHA-1 claim. I am just commenting that as a general rule customer protection falls under the purview of the FTC. There are certainly corner cases where industry specific regulations introduce additional oversight when it comes to customer information protection, e.g. OCC/OTS/NCUA and GLBA[1], or HHS and HIPPA[2].

[1] [http://www.occ.gov/news-issuances/news-releases/2005/nr- ia-2...](http://www.occ.gov/news-issuances/news-releases/2005/nr- ia-2005-35.html)

[2] [http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachno...](http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/index.html)

Side Bar:

If you are bored and want to get your wonk on search regulations.gov for sha-1[a]. It looks like most of the proposed rules mentioning SHA-1 come from HHS, FRA (Federal Railroad Administration) and the NIGC (National Indian Gaming Commission). However there is one reference to SHA-1 in an FCC rule about the Commercial Mobile Alert System[b]:

      CMAC-digest
         Optional element. The code representing
         the digital digest (``hash'') computed
         from the resource file. Calculated using
         the Secure Hash Algorithm (SHA-1) per
         [FIPS 180-2]. Alert Gateway uses the CAP
         digest element to populate this element.

[a] [http://www.regulations.gov/#!searchResults;rpp=25;po=0;s=sha...](http://www.regulations.gov/#!searchResults;rpp=25;po=0;s=sha-1;fp=true;ns=true)

[b] [http://www.regulations.gov/#!documentDetail;D=FCC-2008-0002-...](http://www.regulations.gov/#!documentDetail;D=FCC-2008-0002-0001)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Given that bcrypt and scrypt have had very little attention from cryptographers, it would be a better to start there than adding even more schemes. Unless there is some reason to believe that the winner of this contest will attract serious analysis. If that's true then they should probably allow the established players to enter.

Diversity isn't necessarily a good thing in security. Look at all the attacks on SSL/TLS that rely on being able to negotiate a cypher.

<comment><USER4> Actually, TLS cipher suite negotiaion has been a lifesaver for mitigating recent attacks. [http://www.phonefactor.com/resources/CipherSuiteMitigationFo...](http://www.phonefactor.com/resources/CipherSuiteMitigationForBeast.pdf)

Unless you're referring to SSLv2 or home-rolled nonstandard downgrade logic invented by browser vendors, modern TLS is pretty good at preventing ciphersuite downgrade attacks.

If a single standard had been specified it would have been some minor variant of AES-CBC-HMAC<SHA>. We know of several ways to attack that combination now.

<comment><USER3> Ah-ah! We know several ways to attack poor implementations of that combination now. AES-CBC with HMAC is still sound.

<comment><USER4> Where "poor implementations" = "just about about all of them, ever, except those patched in the last 24 months".

<comment><USER3> Are you arguing that AES-CBC + HMAC is NOT a sound construction, or are you just augmenting my comment with more information?

<comment><USER4> I'm not sure.

I think I'm saying that a "formally proven sound" construction that is full of poorly understood traps for the implementer on actual machines is not always the best choice in practice.

<comment><USER3> Absurdly intelligent and well-informed crypto people have screwed up CTR mode before.

<comment><USER4> Yep. I think we can go farther than that and say that it's been historically screwed up by protocol designers and/or implementers more often than not (with predictable IVs, timing and length oracles, MAC-then-encrypt, etc)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> No panic, just if you use IE read this: <http://en.wikipedia.org/wiki/Server_Name_Indication#Support>

Real browsers like Opera, Chrome, firefox.... all good

my bad and edited my panic away.

Thanks dchest for being more awake than I.

<comment><USER11> The certificate looks good to my browser. _shrug_

It's a StartCom intermediate certificate, good from 2/5/13 to 2/7/14, and the connection is encrypted with RC4_128. So says Chrome...

<comment><USER6> Yes yoru spot on, just looked into it more and it is TLS 1.0 on chrome and I disabled that upon my IE browser, so may be the issue and explains why. Though as different certificate my initial thoughts are still with some anti IE script of some form - IE gets cert for differnt site and also from same issuing authority.

No panic.

</comment></comment></comment><comment><USER12> While I think it's cool to have a competition to help come up with better, "standardized" methods of hashing, PBKDF2 is pretty good already. The problem seems to be a lack of implementation, not a lack of good options.

<comment><AUTHOR> PBKDF2 is not pretty good: the difference between GPU/hardware-accelerated implementations of PBKDF2 with common hashes and software implementations for CPUs is huge. Plus you can compute it in parallel cheaply. See scrypt paper for details: <http://www.tarsnap.com/scrypt.html>

<comment><USER12> I can't find in that paper how many iterations they put PBKDF2 through and which hashing algorithm they used. Any implementation of PBKDF2 I do uses a very high number of iterations (50,000+) and I use whirlpool, which is amongst the slowest of algorithms.

<comment><AUTHOR> 100ms in table: PBKDF2-HMAC-SHA256 with an iteration count of 86,000; 5s: PBKDF2-HMAC-SHA256 with an iteration count of 4,300,000 (see page 13).

If you're using the slowest possible algorithm/biggest number of iterations, you're still vulnerable to parallel attacks: imagine a huge number of cheap chips bruteforcing passwords. Scrypt tries to maximize the cost of such chips by requiring large amounts of RAM for computation. Again, this is explained in the paper.

<comment><USER12> Thanks.</comment></comment></comment></comment></comment>


Mass Extinction and the Structure of the Milky Way - <AUTHOR> https://arxiv.org/abs/1309.4838 <comment><USER2> (2013)

Original submit, 350+ points:

[https://news.ycombinator.com/item?id=14289212](https://news.ycombinator.com/item?id=14289212)

Here's an excellent interview of Jonti Horner by John Batchelor on this topic (free podcast):

[https://audioboom.com/posts/4827661-mass-extinction-and- the-...](https://audioboom.com/posts/4827661-mass-extinction-and-the- structure-of-the-milky-way-joint-horner?t=0)</comment>


Coronavirus (Covid-19) in the UK - <AUTHOR> https://coronavirus.data.gov.uk/ <comment><USER2> Potential misleading visualization warning:

There's an apparent (and significant) drop-off in the number of daily lab- confirmed cases for the most recent few days (i.e. 2020-04-09 onwards as the graph appears today).

This is due to delays receiving lab test results.

From the 'About the data'[1] page:

"Each day new cases are reported, but the dates from which they originate cover the previous few days. Hence there are few cases reported for the most recent date on the chart, but this does not mean the epidemic is tailing off – the cases for any day will build over the next few days."

It could be possible to use a different colour for days on the chart which are considered 'complete' in terms of data -- or simply omit the most recent days if that's not possible.

[1] - [https://coronavirus.data.gov.uk/about](https://coronavirus.data.gov.uk/about)</comment>


Elon Musk Says Hyperloop Hit a Top Speed of 288 MPH Before Exploding - <AUTHOR> https://www.independent.co.uk/life-style/gadgets-and-tech/news/elon-musk-hyperloop-top-speed-record-virgin-hyperlooptt-a9015381.html <comment><USER2> _"The latest speed record is not only a long way off this prediction, it is also not on the same level as the fastest high-speed trains currently in use in China and elsewhere around the world."_

That is a bit unfair; these machines only had 1.2 km of tunnel to accelerate _and_ come to a stop.

These also are one-off events, more like an Olympic final than like an engineering test, where you can fix things and try again. The Delft hyperloop ([https://delfthyperloop.nl/en/](https://delfthyperloop.nl/en/)), for example, expected/hoped to reach 640km/h, but its brakes activated too early. In an engineering setup, that seems repairable within a day (depending on how the vacuum tunnel worked). In a sporting event, it means losing.</comment>


Kickstarter hacked - <AUTHOR>

On Wednesday night, law enforcement officials contacted Kickstarter and alerted us that hackers had sought and gained unauthorized access to some of our customers' data. Upon learning this, we immediately closed the security breach and began strengthening security measures throughout the Kickstarter system.
No credit card data of any kind was accessed by hackers. There is no evidence of unauthorized activity of any kind on your account.
While no credit card data was accessed, some information about our customers was. Accessed information included usernames, email addresses, mailing addresses, phone numbers, and encrypted passwords. Actual passwords were not revealed, however it is possible for a malicious person with enough computing power to guess and crack an encrypted password, particularly a weak or obvious one.
As a precaution, we strongly recommend that you change the password of your Kickstarter account, and other accounts where you use this password.
To change your password, log in to your account at Kickstarter.com and look for the banner at the top of the page to create a new, secure password. We recommend you do the same on other sites where you use this password. For additional help with password security, we recommend tools like 1Password and LastPass.
We're incredibly sorry that this happened. We set a very high bar for how we serve our community, and this incident is frustrating and upsetting. We have since improved our security procedures and systems in numerous ways, and we will continue to do so in the weeks and months to come. We are working closely with law enforcement, and we are doing everything in our power to prevent this from happening again.
Kickstarter is a vibrant community like no other, and we can't thank you enough for being a part of it. Please let us know if you have any questions, comments, or concerns. You can reach us at firstname.lastname@example.com.
Thank you,
Yancey Strickler Kickstarter CEO <comment><USER2> [https://news.ycombinator.com/item?id=7245349](https://news.ycombinator.com/item?id=7245349)

There are several others:

[https://hn.algolia.com/?q=kickstarter#!/story/last_24h/0/kic...](https://hn.algolia.com/?q=kickstarter#!/story/last_24h/0/kickstarter)</comment>


Mulberry: A Development Framework for Mobile Apps - <AUTHOR> http://rmurphey.com/blog/2011/09/18/introducing-mulberry/

<comment><USER2> I like the concept and the 'innovation' of the Mulberry team. Using Rails-like commands for creating a JS based mobile project is just a small innovation IMO, but the implementation (based on the video) seems well done. I love teams that are able to take an idea, no matter how small or large, and follow- through with it in a complete manner. I love that devs are creating cool new frameworks for the web/mobile space, it is certainly exciting.

With that said, I would like to offer some (hopefully constructive) feedback: * The benefit of adding a Rails-like framework to create what is essentially a UI seems a little much. How do you guys feel this adds to the development time/maintenance/etc of a mobile UI? * I understand that you're trying to address the pain-points of working with Phonegap, and the debug feature looks awesome. Can I get this without using all of Mulberry?

</comment><comment><USER3> How does this compare to Sencha mobile?

<comment><USER4> In a nutshell, Mulberry is more opinionated than Sencha -- by being opinionated, it makes it much easier to get an app up and running without worrying about the underlying architecture of the app.

Mulberry expects that you're creating a content-centric mobile app, and so it expects you to define your application in terms of nodes that have assets associated with them -- assets like images, videos, audios, feeds, and data. Nodes are the building blocks of a single-page application that Mulberry creates inside a PhoneGap wrapper. Nodes are displayed with templates, and templates consist of components. You can use the components that come built-in with Mulberry and write very little code; however, you can also create your own components to add custom functionality to your app -- this is where Mulberry's true power lies (see the blog post for details).

Speaking more generally, Mulberry is aimed at developers who aren't interested in spending time on the low-level architecture of their application -- things like data stores, views, etc. Instead, Mulberry is aimed at developers who want to create their content, create their assets, create their data, and then write simple JavaScript and CSS that presents that content and data in the ways they need.

Hope this helps :)

<comment><USER3> Excellent write up, thank you.

</comment></comment></comment><comment><AUTHOR> Here's a video about it <http://vimeo.com/29127698> and there's more on <http://toura.github.com/mulberry/>

</comment><comment><USER5> Could someone post some demo or example sites built using Mulberry?

<comment><USER4> There is a screencast demo at <http://toura.github.com/mulberry/> \-- the code has not yet been released (soon!) so there unfortunately isn't yet any demo code to share, but a demo will be part of the release when that happens.

</comment></comment><comment><USER6> What is the file size of the JS in the framework, minified, but uncompressed?

<comment><USER4> There is a total of 387k of JS (minified and excluding phonegap.js), but it's important to remember that all of the JS is shipped as part of the native app, so it all lives on device -- none of the JS is shipped over the wire except when the app is downloaded.

We could improve this number, but so far we haven't found that it significantly affects application performance. Mulberry is very conscientious about things that are more likely to affect performance, such as memory leaks as a result of improper component teardown. Apps with incredibly large data sets may experience slowdowns, but there are ways to mitigate that as well. Bottom line: in our year of use of the system, we've been fairly happy with performance, even with 387k of JS></comment></comment>


Characteristics of a Good Software Requirements Specification (SRS) - <AUTHOR> http://www.cavdar.net/2011/10/10/characteristics-of-a-good-software-requirements-specification-srs/

<comment><USER2> That cartoon has been around quite a while and I still chuckle every time I see it. At my previous job, I had requirements training with Karl Weigers (who wrote the "Software Requirements" book from Microsoft Press). I'm not a fan of BDUF unless you've only got one chance to succeed, but it was invaluable as a guide for learning how to communicate requirements. So if you're writing stories and practicing agile, are you being clear and concise?

<comment><AUTHOR> Absolutely. Each time I see it, i laugh a lot. :) In fact, I have a startup company and basicly i follow agile practices mainly beacuse of resource constraints and productivity. I'll write SRS document for my project course in Phd. So, I needed to revise it. I generally emphasis on product rather than documentation. When I'm writing documentation, I make it as simple as possible.

</comment></comment><comment><USER3> I thought the entire point of the Agile movement was that such a requirements spec was, in essence, impossible for precisely the reasons shown in that cartoon?

<comment><AUTHOR> Absolutely. For this reason, they said: "Working software over comprehensive documentation" in Agile manifesto. However, you cannot develop a product without knowing your requirements. You have some kind of requirements or features spec in any methodology.</comment></comment>


Ask HN: Advice on breaking into embedded programming? - <AUTHOR> I have ~20 years of various application programming experience, from desktop, to web, to mobile. I'm primarily a game programmer, and have done optimization work on fairly high-profile mobile games. I'm good at asm, C, optimization, logic, and all things low-level.
For whatever it's worth (?) all my Shenzhen I/O scores are all the way to the left :)
I'm open to relocating anywhere in the U.S. Any advice on how to approach this would be appreciated. <comment><USER2> 1\. Try applying to an embedded programming job. Or a dozen, better yet.

2\. Take an "adjacent" job. I.e. find company that has both embedded jobs and non-embedded jobs; apply for the latter. It's easier to transfer _within_ a company, because they know you and say "oh, psyc is smart, he/she can learn this" as opposed to "who is this psyc person? they don't know embedded". So it's a good way to get into jobs you can't otherwise get.

</comment><comment><USER3> Game programmers are generally quite well regarded in 'physical computing' disciplines, because there's so many moving parts and edge cases to take care of - just like hardware.

Do a couple of real embedded projects for yourself (not just Sketch on Arduino, but grab say an ARM dev board and hack something together) then start applying. Good embedded people are in relatively short supply.

</comment><comment><USER4> A local company that designs embedded hardware and software was looking for a developer last time I talked with them. Email me at com leancoder daniel (reverse and add punctuation).</comment>


Comment Git commits - <AUTHOR>

Do you know any web app (OSS, SaaS, self-hosted) which can be integrated in self-hosted Git server for providing functionality like custom comments on commited code itself?<p>Workflow should be - I open Git history, browse a code for each commit, choose a file, place a comment in any line. Basically like a discussion with collaborators on that project, but related to the code. There should be also email notifications and maybe some other basic features for that kind of collaboration. So, doing-one-thing-well kind of app. <comment><USER2> So basically a code review tool?

Suggestions from [http://stackoverflow.com/questions/131153/open-source- code-r...](http://stackoverflow.com/questions/131153/open-source-code-review- tools-mondrian)

For git only ReviewBoard <http://www.review-board.org/> seems to be suitable. No personal experience, though.

<comment><AUTHOR> Thanks. Something like code review - but not complex like Gerrit. <http://getbarkeep.org> is good example.</comment></comment>