From PhD to Data Scientist: Tips for Making the Transition - <AUTHOR> http://insightdatascience.com/blog/from-phd-to-data-scientist.html

<comment><USER2> Sweet, according to his list I'm over-qualified. Interesting to think it would be so easy to make the transition to data science. Except I can't imagine wanting to work on less important problems than the ones I work on now.

Global food security vs. social network analytics. Yeah, fuck the money.

edit: calling all data scientists - why not consider becoming a computational biologist? We have hard problems, real outcomes that affect people's lives, and not much money.

<comment><USER3> I am graduating phd bioinformatician, most likely going to transition into industry. It's very easy to be caught up with the self importance of academia because you are essentially in a bubble. It's great to be passionate about science, but I really dislike religifying academia. It's almost expected of aspiring academics to live like monks and just to be okay with shitty pay and long hours. That's bullshit and academics take it while constantly assuring themselves that "it's important and they love it". I am sorry that I am coming off as extremely cynical, but I really don't think propagating the idea that pursuing pure science is somehow more virtuous than other professions helps with the situation.

And in my opinion, as inexperienced as it might be compared to more established scientists, computational biologists are ready for biology, but biologists are not ready for computational biology.

<comment><USER4> > shitty pay

I can see this complaint in _humanities_ academia, but pay in the sciences past the PhD student level is pretty reasonable. You could probably make more elsewhere, but it's not like you're scraping by on ramen noodles as a bioinformatics professor or anything. Postdocs typically make $50-60k, and professors start at something like $90k at the minimum, easily up to $120k, $150k, or more after tenure, especially if you're in a hot area like bioinformatics, have made a name for yourself, and can get a position at a top-30ish place. Unlike in tech, those salaries often come in places with a lower cost of living than SF, too (at least if you want them to). Six figures goes pretty far in Atlanta, Austin, Urbana-Champaign, Ames, or Raleigh, for example.

You could beat that in industry, but either way you're making solidly in the top 10% of U.S. salaries. And if you really need more money, most universities will let you do 20% consulting time, or do a spinoff startup. There are admittedly other reasons not to go into science academia (the list is pretty long, actually), but fear that you'll have to take a vow of poverty doesn't seem like a strong one.

<comment><USER5> This response tells me you've never been in the science trenches. I've never heard of a postdoc making anywhere close to 60k, even at elite schools in high COL areas. The financial opportunity cost is staggering.

<comment><USER4> Well, you'd be incorrect, since I'm currently a science academic. Have you checked what Stanford, or Georgia Tech, or UT-Austin pay postdocs with machine-learning or data-mining experience, in the past 5 years? There are definitely areas that pay less, but bioinformatics, if by that you mean people with serious computational skills, pays above the norm.

<comment><USER6> Getting a postdoc at Stanford has the same probability as playing in the NBA. Only you get paid $60K instead of $60M.

<comment><USER4> If you have strong machine-learning experience and a few good publications in the current market, getting a postdoc at a top institution is nowhere near NBA odds. I don't know what the odds are specifically for Stanford, but if you apply to whoever has openings among top schools, there are many each year. If you know _something_ about biology and _a lot_ about machine learning, labs might even recruit you rather than vice versa.

<comment><USER7> This has certainly been my experience as a recent PhD in computational biology. I pretty much have my pick of Post Doc positions - I was getting offers before I even graduated. I was also able to negotiate 50k without much trouble, but I'm definitely worried about the opportunity cost. Giving up 100+ k for more than a year or two seems like a poor decision.

Also a Post Doc from a top lab directly correlates with how much $$ you can make in industry.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Technical skills aside, the best piece of advice in the article is "show them that you want it."

I've conducted countless interviews / hires where it basically went: candidates P & Q are the best on paper and in person, but candidate P said x, y, z or did a, b, c, and seems to really want this job and work in our company

x, y, z was sometimes as simple as enthusiasm, and other times was in describing what he/she did in their spare time. a, b, c was usually a project for work, school or fun that was highly relevant.

Intellectually, I think I know that "enthusiasm" is a poor / weak predictor of success. But, emotionally, it's a go-to tie-breaker.

<comment><USER9> Should I start putting every substantial R/Python script I write, even if they are based on some tutorials, on the Github/Personal-Website? Is that how I "show"? I missed the Github bus for all my previous projects.

<comment><USER10> What do you mean you "missed" the github bus? If you still have the code saved somewhere, you can just create a new repo and put it up there.

</comment></comment></comment><comment><USER11> I'm currently finishing a PhD in economics and have spent a lot of time learning the exact technologies he suggests (Python, SQL, a bit of R). Working as a data scientist would be an awesome opportunity. But are most companies _really_ in need of so many data scientists, or is it just a trend?

<comment><USER12> I think it's a new name for an old thing, lots of jobs through the last century had things like "analyst" attached to them. Business has been about measuring things for a long time, look at Taylorism or Gosset at Guinness in 1899 for example.[1][2]

A few little 1% gains from some A/B tests, or looking at geographic breakdowns of customers from IPs or addresses add up.

[1][https://en.wikipedia.org/wiki/Scientific_management](https://en.wikipedia.org/wiki/Scientific_management)

[2][http://www.umass.edu/wsp/statistics/tales/gosset.html](http://www.umass.edu/wsp/statistics/tales/gosset.html)

</comment></comment><comment><USER13> "Recursive programming"... as in, programming using recursion? Why would this be important to "data science"? Surely loops are just as effective.

<comment><USER14> Are you serious? How would you iterate over a set of rules and a big data volume, without using recursion?

<comment><USER15> A loop? Can you please explain?

<comment><USER16> 'Explain'?

<comment><USER17> I assume the "explain" refers to the most important thing you can learn about recursive programming: that it is often but not always the least efficient strategy when compared with looping.

So the claim that recursive programming is the only or primary method of iterating over large data sets requires some explanation...

</comment></comment></comment></comment></comment><comment><USER18> Any possibility for a dev-minded MBA (finance) to make the data science transition? I was pretty good back in the data with respect to R

<comment><USER19> There is no magical set of qualifications to become a data scientist. Just learn enough linear algebra, probability. Show people you can code. Maybe setup some github projects. It is not like people in tech are doing something magical with all these fancy data scientists. A little bit of math, a slap and dash of code.

<comment><USER18> Are data scientists whom are in demand today dealing with neural networks and machine learning, or are a large majority still working with large sets of data and running correlation analyses/regressions? Your response above seems to indicate that it's not overly complicated.

<comment><USER19> It depends; I personally haven't used neural networks since graduating. Standard machine learning algorithms get used. I work with large data sets all the time. Sometimes correlations, regression things. The point is that 95% of the stuff that gets used on a day to day basis is not hard to learn. Especially if your background in linear algebra, probability and statistics is good. The five percent that delves into more complicated things can be figured out on the job.

<comment><USER18> Thank you for you candid and thoughtful answer :)

</comment></comment></comment></comment></comment><comment><USER9> Should have studied harder in undergrad. All the current "Fellows" are from top tier schools :(

</comment><comment><USER20> For those looking to make the transition to data science, another option is Zipfian Academy ([http://www.zipfianacademy.com/](http://www.zipfianacademy.com/)). No PhD required.

<comment><USER21> No PhD required, but you're expected to pay 14k in tuition. In contrast, Insight pays you.

If you want to pay money for experience, why not get an actual degree from an accredited institution?

A more realistic alternative to Insight is to do a (paid) internship at a tech company. This is the path I took.

<comment><USER22> Often advanced degrees at universities are much more expensive ([http://datascience.berkeley.edu/admissions/tuition-and- finan...](http://datascience.berkeley.edu/admissions/tuition-and-financial- aid/)) than an intensive program such as Zipfian and take much longer. I hope that private education institutions (such as GA, Hackbright, Dev Bootcamp, etc.) can coexist happily with traditional universities, as they each fill a different niche. Universities are in the business of training researchers and professors (and do a great job at that) while alternative educational companies aim to produce industry practitioners (similar to trade schools).

I highly recommend internships and they are wonderful if you can get one. Unfortunately not everyone can be so lucky, either due to lack of experience/technical abilities or an advanced degree (not everyone goes to college). I believe these alternative educational routes are democratizing such industries and many of them offer scholarships and tuition assistance programs.</comment></comment></comment>


Pokemon GO the biggest mobile game in US history - <AUTHOR> https://www.surveymonkey.com/business/intelligence/pokemon-go-biggest-mobile-game-ever/ <comment><USER2> This spam brought to you by surveymonkey.com...</comment>


Ask HN: Is there any GitHub based/supporting gamification service out there? - <AUTHOR> Such service should have daily, weekly, monthly quests. Some kind of achievement tracking would be nice. Github commit streak counter was funny to check every once in a while but now it's lost too.<p>Disclaimer: I asked it only for personal use. I strongly discourage using such services at the work place. <comment><USER2> We (me + a couple of buddies) were in the process of building such a service. Unfortunately due to the circumstances, we had to stop working on it but I firmly believe such a service can benefit professional development teams to improve. So I don't fully agree about not using such a service in your work place.

Anyhoo, we did find that such a service exists[1]. I haven't looked at it of about a year, but at the time it seemed interesting though a little lacking in features. They do seem to have improved over the year. You might want to check it out!

[1] [https://getbadges.io/](https://getbadges.io/)

<comment><USER3> Yeah, I agree with using it at work.

I'd be lying if I said that ensuring the box for a date was "green" on my GitHub contribution graph hasn't motivated me to get some shit done that i've been putting off, or hitting a star milestone on a project hasn't motivated me to pick it back up and check off some of the TODOs i've been ignoring.

It might be stupid, it might be "pointless", but it works for me. And while every single one can be gamed or "hacked", if you are working with someone that can't help but cheat a game like this, how can you trust them to actually do any work?

As for getbadges.io, that's a bit too "gamey" for me. I'm looking for a more "professional" kind of profile or badge or card that displays this information, the cheesy little "defeat the monster by closing issues!" turns me off more than motivates me. But slap a different UI on that and I really feel it would do wonders for me!

</comment></comment><comment><USER4> Not GitHub based, but StackOverflow nailed gamification for Q/A - despite the fact that it attracts a lot of hate in HN they managed to build a great resource using a self-moderated community. Far from perfect, but who is doing it better?

There is a chat feature and I've used it to give free 1:1 consulting/support.

There are lots of answers linking github issues and code playgrounds like jsfiddle and codepen.

<comment><USER5> Relative to the alternatives that existed when StackOverflow started, it's been a significant improvement. And relative to its initial gamification efforts the current version is better aligned with its current goals (but questions like "Best Programming Joke" were consistent with the gamification needs around growing the site). But I don't think it has completely got it right because I think right would have a bit more room for treating people kindly and currently StackOverflow gamifies bad behavior toward people asking "homework" questions and this in-clique versus out of clique behavior is one of the things StackOverflow was intended to gamify away.

</comment></comment><comment><USER6> Personally, I use Habitica for task tracking and habits. The nice thing is it's open source with a wide variety of extensions.

I use the Github plugin myself where each time I push to repo or create/close an issue, it triggers a +1 on a habit (which results in Gold and XP) so indirectly, perhaps you might enjoy it?

I always forget about it then an pleasantly surprised to see a heap of gold + level ups later that day

</comment><comment><USER7> > I strongly discourage using such services at the work place.

Thank you for saying that.

<comment><AUTHOR> Using it without the knowledge of your boss, or as a boss by not evaluating points earned from such tools as performance metric, it may be safe to practice such tools though. :)</comment></comment>


Google disables compression for OpenSSL in Chrome - SSL exploit coming? - <AUTHOR> https://chromiumcodereview.appspot.com/10825183 <comment><USER2> Yes.

See: <http://security.stackexchange.com/a/19914>

<comment><USER3> Is my understanding correct that the attack described there requires all of 1. cookies associated with the target, 2. the ability to monitor the length of requests to the target, and 3. the ability to send requests to the target (e.g. JavaScript injection, malicious website)?

I guess this is actually an instance where those Hollywood "guess the password one character at a time" animations would make sense.

<comment><USER2> You need three things:

1\. To know the format of cookies used for the web site you are targetting. Specifically, whatever cookie contains authentication.

2\. The ability to injection a request to the target web server while someone is connected (such as with JavaScript, an XSS, or plug-in).

3\. Ability to monitor the SSL connection is it is transported across TCP.

Would have been fun if they called this the CPE1704TKS attack instead of CRIME: <http://www.youtube.com/watch?v=NHWjlCaIrQo>

<comment><USER4> To expand on your second point, if you have 3, then in many cases you also have the ability to intercept and modify non-encrypted traffic. Meaning, if the victim is using a secure web site and a non-secure site at the same time, the MITM can infiltrate the non-secure site and use it to generate requests to the secure site.

<comment><USER5> I think you're correct here but how would you manipulate the cookies being sent when sending XSS requests from a different domain?

<comment><USER4> For CRIME, I don't think that it's necessary to control the cookies. Having control of other parts of the request should be sufficient (e.g., using request headers, request body, etc).

As for manipulating cookies from the MITM perspective, here's one clunky way to do it: redirect the victim's browser to the plain-text version of the target web site, intercept that request, and set a new cookie (pretending to be the plain-text version of the target web site). The next request to the secure version of the target web site should contain the injected cookie. As tptacek mentioned in another comment, this approach would not work with a site that uses HTTP Strict Transport Security.

<comment><USER6> The attack as Pornin outlines it does not involve controlling the cookie header, but rather on being able to get content into the client's TX stream that happens to match the cookie header; think in terms of things like query args and post data.

I think all three comments in this little subthread might be saying the same thing. Go nerddom!

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I think it's time for me to write a blog post entitled "on the provable security of spiped".

Seriously, we know how to build secure cryptographic protocols. Unfortunately, step #1 is "don't try to be backwards compatible with the horribly broken things people were doing in the 1990s".

<comment><USER6> What, compressing before encrypting?

<comment><USER7> Yes. There's absolutely zero excuse for including compression as part of a cryptographic protocol.

<comment><USER6> Can you point to an instance where you said anything like that, here or anywhere else, before last week?

It's easy for me to believe that you've internalized "minimize data-dependent branches in crypto code" and thus wouldn't have designed a compressed encrypted transport.

It is very hard for me to believe that you would have spotted this flaw immediately had anyone pointed out to you that TLS supported compression.

There is well-regarded (though not by me) crypto advice _recommending_ that people compress before encrypting, to destroy structure in the plaintext.

<comment><USER8> This paper published in 2002 does discuss this attack. <http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091>

"... both the SSH and TLS protocols support an option for on-the-fly compression. Potential security implications of using compression algorithms are of practical importance to people designing systems that might use both compression and encryption."

<comment><USER6> Yep. Great paper. Thanks for finding this.

</comment></comment></comment></comment></comment></comment><comment><USER6> You think you have a handle on how hard it is to get crypto right. Then you get a result like this. As an expert (not me; I'm not smart enough to say this) would put it: "if attacker data is mixed with defender data, none of the branches in the cryptosystem code can depend on the content".

<comment><USER9> I think crypto is possibly the best example in all of software development and/or computer science of how dangerous "unknown unknowns" are, and how a little knowledge is a dangerous thing (although threads are a serious competitor for the latter trophy).

I've studied cryptography theory, and I've implemented various ciphers and attacks, and the more I learn the more certain I become that I would never, ever use any of my own crypto code in production.

</comment></comment><comment><USER10> Reading the title, I thought that Chrome was turning of gzip based compression for HTTP bodies when using SSL. According to <http://security.stackexchange.com/a/19914> (linked above by jgrahamc), it is in fact header compression that is TLS specific. So a giant sigh of relief from me.

<comment><USER11> Thanks for noting this. I also got this wrong on the first reading. Having to drop gzip compression of the content would be terrible. I fathom that header compression helps if you have many requests (polling etc), but for most websites it is much less influential in bandwidth usage.

</comment></comment><comment><USER12> Problem 1 in Stanford's crypto class [1]:

Data compression is often used in data storage or transmission. Suppose you want to use data compression in conjunction with encryption. Does it make more sense to

A. Compress the data and then encrypt the result, or

B. Encrypt the data and then compress the result.

Now we know the correct answer is Neither.

[1] <http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/hw1.pdf>

<comment><USER6> If you're encrypting and storing files, the answer is (A). The question is, in light of this result, frustratingly imprecise.

</comment></comment><comment><USER13> Relevant: <http://www.ekoparty.org/2012/juliano-rizzo.php>

<comment><USER14> _"The good news is we've got working patches for most of the issues. The bad news is some of them might contribute to global warming"_

Disabling compression could certainly contribute to global warming in a relatively small way...

</comment></comment><comment><USER15> Colour me stupid, but is there something to prevent inserting indeterminate padding while sending headers? e.g. imagine a request like

        GET / HTTP/1.0
        X-Pad: GET / HTTP/aaaaaaa

Where X-Pad randomly repeats previous bytes, and perhaps 0..8 bytes of random/repeating variable-length data. By randomizing the effectiveness of the compression, surely this attack can be generally prevented by the browser?

You could argue that given enough samples the noise could be filtered and the attack still remains, but the same could be said the same for many successful patches over the years (TCP sequence number randomization, Kaminsky's DNS issue, etc.), and the number of samples required would be pretty infeasible.

<comment><USER16> I'm fairly certain this could be defeated with a little differential cryptanalysis. Similar approaches to defeating side-channel attacks on smart card power usage have been tried and defeated :/

</comment></comment><comment><USER17> Doesn't look like this has anything to do with an exploit. It is because some older web servers who don't support TLS also don't support compression.

See:<http://code.google.com/p/chromium/issues/detail?id=31628>

<comment><USER18> No, I doubt that something closed in early 2010 has much to do with a new patch that has a rationale disabled from public viewing which implies it's a security emergency.

<comment><USER17> You are correct, I misread the code commit. The link to the 2010 bug was removed from the code, not added to it.

</comment></comment></comment><comment><USER19> While this is probably security related, disabling compression is actually a good practice for clients which make a large number of SSL requests (like a browser). OpenSSL allocates alot of memory per connection for compression/decompression. See [http://journal.paul.querna.org/articles/2011/04/05/openssl-m...](http://journal.paul.querna.org/articles/2011/04/05/openssl- memory-use/) for a great discussion of why SSL_OP_NO_COMPRESSION might make sense for you.

Even if you don't have direct access to the library code creating SSL objects, there are still some tricks with ctypes, ffi, dlopen that have the same effect.

</comment><comment><USER20> Does the attack apply to SPDY as well?

<comment><USER21> I think it does, although not precisely as described in the SO post above: in SPDY the request headers are compressed separately before any TLS compression would apply, so the attacker would have to put her guess of the cookie in the request headers or the URL (as the URL is sent as a pseudo-header in SPDY).

</comment></comment><comment><USER4> It would be interesting to know if there were any changes in the SPDY implementation. It too supports compression before encryption and may be affected by the same problem.

</comment><comment><USER22> So, to summarize for the laypeople, if the user has Javascript and/or cookies disabled, this exploit will not work?

<comment><USER23> Hidden <iframe> elements would probably work just as well.

It might even work with JacaScript turned. Have a page with nested iframes. Serve each one from a different IP address and have the server not answer right away. The server answers with the first iframe having a chosen URL while Eve snoops the wire. Eve tells the server which URL to use for the next iframe body that it sends. Repeat until the cookie is deduced. The server can use a nested tree of iframes to avoid having a bazillion iframes in the top level document.

</comment></comment><comment><USER24> Is this a disabling of compression on both ends? No DEFLATE on either requests or responses?

Will a site using HTTPS be able to serve compressed assets (like javascript & css)?

If not, we'll urgently need a way for site devs to whitelist precomputed (and thus immune) static assets for compression.

<comment><USER25> It's a disabling of the optional compression at the TLS layer. HTTP content compression is not affected.

<comment><USER24> So what, exactly, is no longer compressed? Merely the headers themselves, and the content is not affected?

<comment><USER25> Pretty much, yes. With the proviso that if you _didn't_ have HTTP Content-Type compression for your content before, then it might still have been compressed at the TLS layer, and won't be now.

</comment></comment></comment></comment><comment><USER26> CRIME researcher says 4 request are enough to decrypt: <https://twitter.com/julianor/status/245943430570704896>

<comment><USER23> To decrypt _each byte_.

</comment></comment><comment><USER8> man sshd_config.

Compression: Specifies whether compression is allowed, or delayed until the user has authenticated successfully. The argument must be "yes", "delayed", or "no". The default is "delayed".

I don't know why they chose "delayed" as default, but this seems to prevent this attack.

<comment><USER6> The SSH protocol is nothing like TLS. The SSH security model is nothing like the TLS security model. Pornin's guess about Thai and Juliano's attack does not break the TLS authentication model; it breaks the confidentiality guarantees TLS makes to the application layer. If you authenticated TLS with certificates the way SSH authenticates with keys, you wouldn't worry about the compression attack.

So, not so much.</comment></comment>


"Google is wrapping knowledge up in answer cards and not sending traffic" - <AUTHOR> http://blog.sweetiq.com/2014/10/five-takeaways-from-danny-sullivans-qa-at-smx-east-2014/

<comment><AUTHOR> Interesting convo here: [http://www.reddit.com/r/technology/comments/2jt0n8/every_fac...](http://www.reddit.com/r/technology/comments/2jt0n8/every_fact_google_knows_about_it_knows_from/)

</comment><comment><USER2> Is there a generic list of defense techniques against scrapers, including but not limited to Google? E.g. move some content behind a login wall?

<comment><AUTHOR> In theory, you can disallow crawlers and bots via robots.txt. It's not a hard defense per se because crawlers can ignore it.

</comment></comment><comment><USER3> Interesting, but the title is confusing. Better to use the original in this case.</comment>


U.S.-China Trade War Portends Painful Times for U.S. Semiconductor Industry - <AUTHOR> https://spectrum.ieee.org/view-from-the-valley/semiconductors/processors/china-trade-war-portends-period-of-pain-for-semiconductor-industry <comment><USER2> Trump had a point, for example, to put tariffs on steel to protect the US steel industry.

Tariffs are common. Europe, for example, has huge tariffs on Brazilian meat (was 230% don't know how much today) and 42% percent on Chinese bicycles. So Trump simply had to put tariffs where tariffs are reasonable (does his dictionary contain the word 'reasonable' ?) and never use the words 'trade war'.</comment>


Nervous system manipulation by electromagnetic fields from monitors - <AUTHOR> https://www.google.com/patents/US6506148 <comment><USER2> Seeing patents like this disappoint me. It's very reminiscent of people scooping up domain names and just _sitting_ on them, hoping that someone _else_ makes them valuable at some point.</comment>


Batteries made out of gold nanowires and electrolyte gel last 400 years - <AUTHOR> https://www.good.is/articles/nanobatteries-last-forever <comment><USER2> Any advances in energy production or energy storage make me very excited because I consider those are the most important challenges for human race survival, because we are destroying the climate using fossil fuels. Advances in energy storage would allow us to make better use of solar and wind energy production.

I also can't help but dream with how advances in energy technologies could maybe put us close to building self-replicating robots to explore and colonize other planets!

</comment><comment><USER2> Any ideas if it would be expensive to produce batteries using this technology?

<comment><AUTHOR> Well Materials doesn't seems that different from what we currently use for electronics, so I don't think has big impact in price.</comment></comment>


As a web designer I get asked how I know what looks good. So I wrote a blog post - <AUTHOR> http://www.trich.me/blog/web-design-tips/

<comment><USER2> The example websites all had 'obviously' bad design. They look like they're from 2000. I'm more curious about the subtle things that affect design; how to go from good to great.

<comment><AUTHOR> That is more advanced and deserves another blog post (which I plan to do). It is also dependent on what style your site is trying to achieve. The same general guidelines still apply but with even more emphasis on following those guidelines precisely. As I said in the post, 5px is 5px, not 7px. All the small things will add up to generate a visually appealing whole.

</comment></comment><comment><USER3> Good tips, but it would be nice to see some "good" examples next to the bad ones.</comment>


How the World's First Computer Was Rescued from the Scrap Heap - <AUTHOR> http://www.wired.com/2014/11/eniac-unearthed/

<comment><USER2> The notion that ENIAC was the First Computer is really open for debate. Atanasoff's machine at Iowa State[1] had DRAM and binary logic in the late 30's. Zuses[2] machines in Germany during WW2 were similarly advanced. In the article they specify the 'first programmable' computer, but when you're moving wires around, that's hardly a distinction imo.

[1] [http://en.wikipedia.org/wiki/Atanasoff%E2%80%93Berry_compute...](http://en.wikipedia.org/wiki/Atanasoff%E2%80%93Berry_computer)

[2] [http://en.wikipedia.org/wiki/Konrad_Zuse](http://en.wikipedia.org/wiki/Konrad_Zuse)</comment>


Texas Pickup Truck Crash Shuts Down the Internet (2007) - <AUTHOR> https://it.toolbox.com/blogs/it-management/texas-pickup-truck-crash-shuts-down-the-internet-011813 <comment><USER3> > emergency crews shut off power to rescue the truck driver without notifying > Rackspace, the double whammy that the company had never planned on: the > double power outage within the 30-minute chiller up-cycle. Oops.

Wow, what a design fault.

I used to do data center electrical/mechanical commissioning, which means putting equipment and systems through their paces to prove things work and so the vendor can get paid. We had a fairly standard process that we applied to validation - but every once in a while we'd have to skip/tweak a test because of something specific to the datacenter. Usually, this was a good thing, like an extra layer of redundancy - but sometimes it was a glaring assumption that we had to run-with, despite our objections.

I remember one DC had spec'd their cooling based off of power needs and climate of the area. They had balanced things out to very thin margins - <USER2> was in some ways very efficient. But... they didn't factor in global warming. Come summer Some days they could only load to 50% capacity because they couldn't keep things cool enough. Ended up redoing much of the DC to support beefier cooling.

Single points of failure can take many forms and occur at many points along a redundancy plan. The industry has oodles more examples to pull from. But now that i'm nerdier, the better approach is to be able to tolerate DC failure in your topology than try to prop up unicorn buildings. IIRC, google doesn't even have backup generators, because utility is good enough.

</comment><comment><USER4> I'll never forget the phone call after the truck crash. It was about noon, and I was scheduled to start a support shift at 2pm. My team lead called and not long after, I was in Datapoint along with every other available racker, ansewering the phones.

The way Rackspace respondrd to that incident has forever shaped my perspective on what makes up an acceptable level of customer service.

Fanatical Fuckin Support.

<comment><USER5> Does your username reference the incident somehow?

<comment><USER4> Not the event, but the team I was on at the time.

-subs</comment></comment></comment>


My project about BDD tests to Living Documentation - <AUTHOR> Hello, I'm working on the small project which dedicated to convert BDD tests to Living Documentation. I know there is similar projects, but i want to concentrate not on quality of tests, rather than how your product works.
I'm on the very start stage, but you know when you work on something that you feel cool, you always can't wait to share it.
Here few links: How Reek's documentation looks - https://documentation.world/public/projects/2
P.S. If you have BDD tests, and want to try don't hesitate. <comment><USER2> Would have loved this tool for JVM! At the moment we use PicklesUI for (Living) documentation, quick and easy.

</comment><comment><USER3> Love the idea to generate docs from BDD tests, as this can help with document driven development.

Since this is a tool for engineers, if you put install and usage examples in code in the docs, then it's gonna help new users see how to get started quickly and how to use the features. Right now, it looks like a nice way to list features and see a green if the test passes, but it's not helping the reader/user of the docs to use those tested behaviors from their perspective.

if the test code were automatically snippet'd inside those test blocks, then the reader who wants to use some behavior, can find that section, click on the test, and look at how you wrote the code to test it. Then all we have to do is write the test code the same way the user would write their code to use a service, and the docs will automatically have usage examples (the test code snippets)

A search box can help to filter the behaviors, especially since they're nested, because nesting can reduce visual clutter but force you to spend time expanding many sections. Links to the repo code for both the tests and the implementation can help us jump into the process faster.

Cool project keep it up!

<comment><AUTHOR> Thank you for ideas. Yes, search box and tags are going to be implemented in the next release.

I love that idea, about snippets, and it may works as 'fork this project into my account'.

anyway, thank you

</comment></comment><comment><USER4> BDD is a great idea in theory. In practice, the tests often become deeply nested in contexts, rely on shared state and can be very difficult to read. xUnit style tests are not perfect but the best choice for readability and maintainability

<comment><AUTHOR> I have not used xUint, and can't compare, thanks for mention I will look. But there is always some ways to improve messed tests, like page objects or page components and so on.

BDD methodology in opinion serves to business goals. And it is not only about syntax, but about whole way to make projects.

<comment><USER4> I don't think BDD scales well with complex requirements, the end result gets quite messy in my opinion, here is an example [1]. xUnit tests usually have a method per test, much easy to reason about. Not to put you off, just that has been my experience and I usually try and steer people away from BDD test frameworks

1: [https://github.com/cloudfoundry/cloud_controller_ng/blob/mas...](https://github.com/cloudfoundry/cloud_controller_ng/blob/master/spec/integration/v2_perm_spec.rb)

<comment><USER5> While I agree that BDD doesn't scale well I don't understand how xUnit (which is a unit tests framework hacked into BDD if I understand correctly) can help with that ?

BDD is BDD regardless of the framework, you want to use the same syntax</comment></comment></comment></comment>


Mozilla just can't catch a break - <AUTHOR> https://www.dropbox.com/s/b70uugc2ydycvyd/_20140405_131618.JPG

<comment><USER2> I don't know whether this is a joke or not, but what do you expect? Proposition 8 passed. A majority of people were in favor of it. You think those people would just rule out applying the same sort of pressure on mozilla that worked so effectively?

This is why, despite supporting gay marriage, I think it is abhorrent that Brendan Eich was effectively forced to resign. He donated privately to a campaign that was supported by a majority of people, but somehow that makes it ok to destroy his career because we don't agree with his stance. I don't particularly want to inhabit a society where that is the norm. It makes me very uneasy.

<comment><USER3> I don't want to live in a society where people with bigoted and regressive views are merely considered as a difference of opinion. Human rights are absolute.

EDIT: So many downvotes, wow.

<comment><USER4> What about the human right to hold your own beliefs? Are you saying I am no longer allowed to believe what I want, I have to believe what you tell me is right?

<comment><USER5> Nobody is saying that. But if you for example believe that slavery is right because Bible says so, well, we have a problem here, don't you think?

Actually I'm starting to wonder about the whole idea that you can't fire someone based on their religious beliefs (at least I understand this is the law in the US).

What if I discover one of my employees donated to a political group that is trying to bring back slavery. I definitely wouldn't want someone like that working for me. But I can't let them go because their religious book says slavery is fine and their religious views are protected?

Crazy world.

</comment></comment></comment></comment><comment><USER6> This was the fairly inevitable conclusion of forcing him to quit. Nobody has come out of this looking good.

<comment><AUTHOR> I agree. The whole episode has been a disaster for Mozilla's mission.

</comment></comment><comment><USER7> They're trolling, right? this is a joke, right?

Please tell me this is a joke.

Edit:

There's nothing on the page in the image: [http://www.catholicvote.org/?s=firefox&submit=%C2%A0](http://www.catholicvote.org/?s=firefox&submit=%C2%A0)

So i assume this is indeed just a joke.

<comment><USER8> Not a joke. See [https://twitter.com/CatholicVote/status/452108584126410752](https://twitter.com/CatholicVote/status/452108584126410752).

They should be free to speak their mind as the opposition, correct?

<comment><USER4> No no, it's already been clearly established in these threads. The pro-gay- marriage side is the only side that gets to speak their minds, because they are the side that is right.

That's how freedom of speech works, after all. Only the person who is right gets it.

<comment><USER9> You are free to say what you want, and free to deal with the repercussions. Everything can be framed as having two sides, but society at a certain point decides there isn't two sides.

The "pro-interracial-marriage" side is the only side that gets to speak its mind these days, because they are the side that is right. Try coming out as against interracial marriage and you will be run out of your company on a rail, as you should be, rinse and repeat for gay marriage.

<comment><USER4> They aren't really the side that is right, they are just the side that has 99% of people. Gay marriage is contentious because it's practically an even split right now.

<comment><USER9> 61% of young Republican leaning Americans (18-29) support marriage equality. The issue is settled, the trajectory is clear, it is just a few years until it will all be shaken out and boring and stats about people being against gay marriage will be treated with awe and shock.

In 1986, only around 30% of Americans "approved" of interracial relationships -- now about that number have a family member IN an interracial relationship. Things move faster now, and in just a few years, the idea of being against same-sex marriage will seem just as insane about being against interracial marriage.

</comment></comment></comment></comment></comment></comment><comment><USER10> Freedom of speech goes both ways...

<comment><USER11> I probably shouldn't even bring this up. This whole thread will be knocked off the front-page shortly anyway... but I just had a heated debate with a coworker that's an Eich-supporter and found his logic disturbing and ethically broken when it expanded to views on racism, sexism, homophobia. But for all those people who support Eich and keep saying freedom-of-speech goes both ways even for "unpopular opinions":

How would you define Hate Speech. Do you think it's okay? Do you think Google is right for not allowing Hate Speech on youtube?

I'm only asking because I want to know if these Eich-supporters have a limit somewhere; where speech becomes harmful - from just expressing yourself to inflicting a tangible negative effect on others who do not wish it. While I'm not accusing Eich of hate speech, I believe his donation to an effort to make a law which forces his belief on others - something that has nothing to do with how he lives his own life - is similar.

[http://en.wikipedia.org/wiki/Hate_speech](http://en.wikipedia.org/wiki/Hate_speech)

 _> >In law, hate speech is any speech, gesture or conduct, writing, or display which is forbidden because it may incite violence or prejudicial action against or by a protected individual or group, or because it disparages or intimidates a protected individual or group._

Am I crazy for thinking that prop8 disparages the love between two men or women that want to get married? Isn't the core of prop8 based on people who cannot accept the LGBT community and want to keep marriage for themselves? Shouldn't society squash this kind of thing out of law?

<comment><USER12> You'll note in that wiki article you linked, the Supreme Court has found hate speech restrictions to be unconstitutional.

There's also the case where the ACLU defended the right of neo-nazis to march in a town with a heavy Jewish population. [http://en.wikipedia.org/wiki/American_Civil_Liberties_Union#...](http://en.wikipedia.org/wiki/American_Civil_Liberties_Union#The_Skokie_case)

Hate speech is often despicable, but Freedom Of Speech has traditionally been taken very, very, VERY seriously in the US.

Personally, I feel it's a dangerous mistake to start policing hate speech, and I don't want to see it happen. I think the freedom to express whatever position you want on an issue, no matter how reprehensible, is crucial to the ideals of the nation.

If that means fringe groups say awful things, so be it. For me that's infinitely better than the alternative.

<comment><USER13> This.

</comment></comment></comment></comment><comment><USER14> Thankfully, they can switch to a "straight browser". Something like Google Chrome or Apple Safari. Oh, wait, both of them donated money to defeat Prop 8 because they both favor gay marriage. Google even has a whole page about it: Legalise Love: LGBT Rights Are Human Rights: [http://www.google.com/diversity/legalise- love.html](http://www.google.com/diversity/legalise-love.html) Maybe they could switch back to Microsoft Internet Explorer. Oh, wait, Microsoft was lobbying for gay marriage to be legalized in Washington state back in 2012 and has included gay marriage in their advertising.

Sorry, folks. All the major browsers are gay.

</comment><comment><USER15> That situation around B. Eich harmed LGBT group in third-world countries. For example, in Russia people is afraid about gay rights. They think if gays will have equial rights with straights, they starts to hunt anybody who are not pro-gay. And that situation with B. Eich proofs that.

<comment><USER16> Russia is a 3rd world country now? Putting away the pedantic definition of 1st-2nd-3rd world, even by the 'modern' conniption, Russia isn't a developing economy.</comment></comment>


Show HN: Vnlog – a toolkit for manipulating data in an ASCII table - <AUTHOR> https://github.com/dkogan/vnlog <comment><AUTHOR> On some broad level, this is similar to csvkit, but a core design principle is that the toolkit is very light, and mosly wraps standard, exising tools. Powerful tools with a very friendly learning curve result.

<comment><USER2> The title of the post doesn't work because it doesn't "scratch an itch" as in it doesn't suggest how it makes life easier for common problems.

Titles are hard. "Light wrapper for manipulating structured data" is ok but it still sucks because you aren't showing the destination. I'll think about it</comment></comment>


Show HN: TiDB Playground, writing SQL in a Golang Database in WebAssembly - <AUTHOR> https://tour.tidb.io/ <comment><AUTHOR> This is a demo site to show how you can use TiDB-Wasm to run TiDB SQL statements your browser.

[https://github.com/pingcap/tidb/pull/13069](https://github.com/pingcap/tidb/pull/13069)

Known Limitations:

\- TiDB-Wasm includes TiDB server only. TiDB is the stateless MySQL component of the TiDB platform (check other components in the TiDB Architecture). Compiled to Wasm, this tool is only suitable for experimenting with SQL and testing out TiDB compatibility with MySQL queries.

\- The Wasm binary file is close to 70 MB and compressed to 13 MB. The database and the data you create in TiDB-Wasm are written to memory, and therefore consume a lot of memory resources.

\- TiDB-Wasm does not support most of the web browsers on mobile devices yet.

\- The tool currently cannot demonstrate multi-node TiDB deployments. This means you can't play with TiDB's titanium-solid resiliency, test doing rolling updates, or online scale-out and scale-in.</comment>


Why The Price Of Coke Didn't Change For 70 Years - <AUTHOR> http://www.npr.org/blogs/money/2012/11/13/165046113/episode-416-why-the-price-of-coke-didnt-change-for-70-years

<comment><USER2> When I saw the title, I was thinking the "$100/gram" movie coke (cocaine) price. (which dropped over time in real terms as it became more common in the US in the 80s/90s, and then dropped in nominal terms as well)

<comment><USER3> Odd--it seems to me that US cocaine use didn't really take off until the 1970s.

<comment><USER2> It would be interesting to read more about "traditional" drugs in the 1945-1968 period. I've only read about the rise of LSD and such.</comment></comment></comment>


Is Microsoft Giving Up On Vista? - <AUTHOR> http://www.cnn.com/2009/TECH/01/08/microsoft.ballmer/index.html <comment><USER2> They're giving up on Vista like Apple gives up on previous versions of OS X. Which is to say they aren't, they're just moving on and improving upon the base OS.

Which is a good thing in my opinion, as the old methodology of releasing an OS and then waiting 2-5 years for a follow up is not going to work anymore. I've long looked at Apple's strategy of charging roughly $130 for each new version (not matter how small the changes) every year as superior to selling a $200-$200 license every few years and releasing new features and updates for free.

</comment><comment><USER3> Its better for them to give up on the crappy product before their customers give up on them.</comment>


OpenBSD for 1.5 Years: Confessions of a Linux Heretic - <AUTHOR> https://www.youtube.com/watch?v=oTShQIXSdqM <comment><USER2> For a desktop use, openbsd feels super sluggish compared to the same hardware running linux. I love the way things are configured in openbsd, it is very straightforward. But the fact that it is noticeably slower than linux is what made me go back to linux. I wish we could have a linux distro with the same configuration philosophy as the BSDs. I recently started using gentoo and I'm enjoying having bare tools to configure the system, and having no systemd is a plus IMHO.

<comment><USER3> You should make sure that you disable "hyperthreading" on the Linux side for a like-for-like comparison. OpenBSD famously removed support for "hyperthreading" at the time of a "Spectre" vulnerability that you may have heard of. (-:

Linux tried the same approach, but it had a severe impact upon Linux performance. So "hyperthreading" got enabled by default again.

* [https://email@example.com/msg99141...](https://firstname.lastname@example.com/msg99141.html)

* [https://theregister.com/2018/11/20/linux_kernel_spectre_v2_p...](https://theregister.com/2018/11/20/linux_kernel_spectre_v2_patch_slowdown_intel/)</comment></comment>


FTP Client for Google Drive now included in Neutron Drive - <AUTHOR> https://neutron-drive.appspot.com/blog/ftp-client

<comment><USER2> Love Neutron Drive and this FTP Client rocks. It is awesomely fast.</comment>


How to become a freelance web developer - <AUTHOR> http://ryanwaggoner.com/2010/10/how-to-become-a-freelance-web-developer/ <comment><USER2> What is the sales cycle like? Do you take on more than one client at a time? If so, on average, how many? Are you looking for new gigs even while in the midst of implementing something for a given client?

Should my blog be about tech-related stuff only?

Do you always sign a contract before taking a gig?

Is fixed-price or hourly-rate work harder to get? I always see professional freelance devs using hourly rates, but I really prefer to take fixed price gigs (with payment milestones if I don't know the client well).

I occasionally see contractors complain that they have to much work. I'd love to be subcontracted for some of that work (seems like a pretty straightforward proposition - I'll do your extra work for a bit cheaper and you can keep the difference), but would that hurt me long-term because I wouldn't develop relationships with end-clients? Is this even a reasonable strategy for getting work?

<comment><AUTHOR> I'll elaborate more in part two, but briefly:

 _What is the sales cycle like? Do you take on more than one client at a time? If so, on average, how many? Are you looking for new gigs even while in the midst of implementing something for a given client?_

2-4 weeks to land new gigs. 1-3 clients at a time. Yes (see sales cycle answer).

 _Should my blog be about tech-related stuff only?_

Only if you want it to be. My clients say they feel like they know me better after reading my blog.

 _Do you always sign a contract before taking a gig?_

Usually, but not always. Probably always should, but there's really little recourse if a client in Kansas stiffs you for a $5k job. A contract won't help.

 _Is fixed-price or hourly-rate work harder to get? I always see professional freelance devs using hourly rates, but I really prefer to take fixed price gigs (with payment milestones if I don't know the client well)._

Most clients seem to prefer fixed-price. Just make sure you have it spec'ed out well and you are clear that scope creep isn't going to happen.

 _I occasionally see contractors complain that they have to much work. I'd love to be subcontracted for some of that work (seems like a pretty straightforward proposition - I'll do your extra work for a bit cheaper and you can keep the difference), but would that hurt me long-term because I wouldn't develop relationships with end-clients? Is this even a reasonable strategy for getting work?_

I think it's a fine strategy, but I'm personally wary of giving work to someone because if they fall through, I'm on the hook. I might make an extra couple thousand a month doing that, but if I have to do the work and end up jeopardizing my other clients because I don't have time to focus on them, I lose more than I gain. Plus, I think the time managing that subcontracting process is a lot more than you think. I did teach my little brother to program over the last couple years and he's paying his way through private university by doing subcontracting for me. Family is a little different, though.

<comment><USER3> "I think it's a fine strategy, but I'm personally wary of giving work to someone because if they fall through, I'm on the hook. "

That's my feeling too, though I'm (currently) in the camp of "too much work."

I'm reluctant to farm any work out that's going to ultimately have my name on it, but being over-busy means I'm turning away work, missing out on potential stable business, and staying coupled to too few large jobs.

What do other people here do? How do you arrange to subcontract?

<comment><USER4> I too have more work coming in than I can take on. If I know someone who can do it, I'll recommend them on directly rather than letting them go through me. I don't gain financially but it generally breeds goodwill. I _could_ take a referral commission (some acquaintances seem to do this), but again I fear I'd be somewhat on the hook if the other person screwed up. Plus, if customers refer me other customers, they don't take a cut either.

<comment><USER3> That's what I've been doing. I don't like to leave people hanging, so I try to find someone who can take care of them.

I also like that people feel they can come to me as a first point of contact when looking for a developer, that if I'm not available I'll (hopefully) point them to someone who is.

</comment></comment></comment></comment></comment><comment><USER5> This sounds like good advice to me.

BTW, "Build something first, even if it's just for fun." doesn't just apply to freelancing. You should do this even if you are applying to work for a company. Having something to show means A LOT in an interview.

And if you're in college and haven't done that yet, you're wasting time. Get on it. Have something ready for when you graduate.

<comment><USER6> That is absolutely true. I once got a job offer because I could speak at length about a custom news-scraper I simply wrote for myself so I could read the news easier in the morning. Have something built that you can explain - including the challenges and why it is important.

<comment><USER7> Showing practice trumps showing theory (e.g a degree), because in showing great practice, people know you have great theory too.

</comment></comment></comment><comment><USER8> I've only been freelancing for 6 mo. but I have about 10 years of experience as a software developer in the same market. Right now I'm totally saturated with work and it's come entirely through contacts -- I haven't talked to one recruiter or answered a single ad. So far it's been a blast, but not quite as lucrative (yet) as working full-time for a salary.

In my opinion, the two major reasons I've had success finding good work are:

1\. I'm specializing in a popular niche and, backed by my experience, I can claim I'm an expert. This also means I can charge high rates.

2\. I've always been a nice person to the people I've worked with and have remained friendly with previous bosses and co-workers. I've developed a reputation as a capable programmer who's easy to get along/work with. (Conan O'Brien, last spring, attributed his success to being passionate about what he does and being a nice guy. I think this is really true.)

I'm still struggling with a couple of things. I basically always get my time estimates way wrong. I have trouble focusing and switching contexts from wheeler-dealer (finding jobs and managing contacts) to h-core coder to my personal life. To that end, I tend to work from my clients' offices quite a bit and I'm considering renting a cube somewhere. Finally, being a nice guy has it's downsides--I almost never get paid promptly and clients often times don't provide as much support as quickly as I need (like when I need to work w/ a client API and I need documentation/time with their engineers to move my work forward).

<comment><USER9> If you're fully saturated with work and you're not making as much as your salary, you're probably not charging enough.

Freelancing's risk is that projects come and go, so you need higher rates compared to salaried jobs to provide more of a buffer zone for yourself.

On the other end, your clients are saving from not having to provide benefits and having efficient resourcing (both in that they can ramp up the work when needed, and the fact that if you're billing per hour, you're actually doing work as opposed to someone just hanging out at their 9-5 job)

<comment><USER8> Thanks for the tips. Perhaps I could raise my rates, but I think I lose money more by a) not properly estimating timelines and b) becoming idle while waiting for client feedback/help/etc. As I said, I'm only 6 mo. into it, so I'm still learning how to better handle these things. I'm finding that when I go into a client's office to code, they are more inclined to provide me the resources they need and I feel ok billing them for the hours, even if they've left me idly waiting for their input.

<comment><USER10> Here's a rule of thumb: your hourly rate is roughly comparable to your yearly income.

Here's why: you'll probably have about 1,000 billable hours in a year (because not all of your work is billable, there will be some dry periods, vacation and sick days are unpaid, etc.). If you charge $90/hr, your income is $90,000.

But this is definitely not equivalent to a $90k salaried job. You are taxed at a higher rate. If you set aside 40% for taxes and 10% for a rainy day, only 50% of your income is spendable. So $90/hr gives you $45,000/yr of spendable money (and you still have to pay for your benefits like health insurance).

So don't be shy about charging more, but do make sure that your customer is getting what they pay for (quality code in a timely fashion with good customer service).

</comment></comment></comment></comment><comment><AUTHOR> Someone yesterday posted a question about where to find freelance work, and I've been fairly successful at this, so I thought I'd write up a few of my thoughts on transitioning to the freelance thing.

</comment><comment><USER11> "My method for trolling through Craigslist is to grab RSS feeds for all the major cities where I'm interested and setup in Google Reader"

I built a quick app a few years ago that helped out with this tremendously. I would feed the app a list of craigslist cities I wanted to watch, and it would grab the RSS of the web/info design section for that city. It would parse the feed and dump the jobs into a database. It would load new jobs with a cron that ran a few times a day.

The dashboard page showed a list of jobs that hadn't been acted on yet. You could easily eliminate a job with an [X] button, or move them into a "save for later" area. You'd have to act on every job, but it was quick to do so. Then the app had a built-in responder that allowed me to initiate the conversation from within in the app.

After putting this thing together, I got a total of 2 good jobs off of CL. I quit looking for freelance jobs shortly after but may start up again once I'm done with my masters.

<comment><USER12> It might not be worth the effort but you might want to consider making this available to the public as a service for freelancers.

<comment><USER11> I had mostly forgotten about it until I saw this post. I think it would be a good idea to give to freelances and may revisit it in the near future.

</comment></comment></comment><comment><USER13> The gigs board on craigslist is generally a huge waste of time. Maybe a little better in the bay area than any other city, but even if you do spot a decent project chances are if they are posting in the gigs board, the client isn't that committed. God knows how many useless meetings with flaky idiots I've taken through CL gig board ads.

My approach to CL is let them come to me, unless I'm desperate. That means post your resume, put an ad up in the services section, keep A/B refining it until you get hit with good emails.

One of the best approaches to finding local clients (that I rarely do and should attempt more) was actually cold-emailing local businesses that conduct a lot of web dev work. Back in 2004 I moved to the bay area with no clients whatsoever, and did 2 things - posted CL resume listings, and cold emailed every design agency I could find. At the end of a week, I had enough clients to last me the next 3 years.

</comment><comment><USER14> So about 30 minutes ago I decided it may be a good idea to look into (local) consulting, for businesses or people who don't know much more than "I want a website". Has anyone done this/any advice?

I figured to start with (aside from occasional freebies) maybe $500 for 3 hours. No idea where I came up with that number but it gives me something to start at.

But maybe I'm not set on what I _do_. My plan was to walk them through options, advise whether they need something custom built or hacked wordpress or use a hosted shop. Then take it from there/work with them to find developers (or do it myself).

Good? Bad? Any tips would be good.

<comment><USER15> Depends on who the client is and what you want. If it's just about making some cash, find some local businesses (restaurants, etc), charge $400, then set them up with a wordpress blog with a theme from theme forest, woo themes, or ??. Spend an hour customizing it and your done.

If you want to build a more sustainable web development business, find some larger corporate clients, and do basically the same thing but instead of the off-the-shelf theme, pay a designer $500-$1500 for a custom theme then charge $5-$10K per site. Get an intern or temp worker to do the data entry.

Also, I've found that "I want a website" type people really like to work on their own website once they have it. So don't be scared to let them have a go at the Wordpress (or whatever) backend. Just be ready to clearly explain the limitations when they inevitably make ridiculous requests.

<comment><USER16> How have you had success finding larger corporate clients? I've been working at 20 person agency as Director of Engineering for 5 years, but we generally run $500k+ year long webapp builds in Rails, not $12k corporate sites. I'm trying to catch up on some debt, and have the client and team management experience to put together some "mini-agency" projects like, but am not sure how to go about finding the sort of client who needs this type of site.

<comment><USER15> Thinking back, I realized that all my larger contracts have been with companies where I had an inside contact (friend who was working there). Also, look for companies in fields outside of internet technology. They certainly won't be spending $500K on webapps, but do want a modern presence online.

I'd recommend asking friends/family if there company is unhappy with their current website or other technology services. The market rate for design agencies is probably $15-50K, so an individual who can do it for slightly less than that and in a friendly manner is highly attractive.

<comment><USER17> Have you been able to grow beyond the "inside contact" deals? And by "look for companies in fields outside of internet tech" can you give some examples?

</comment></comment></comment></comment></comment><comment><USER18> I think sending your cover letter to hundred of employers is just a bad idea (may be I'm wrong or these are just my thoughts).

I prefer to read the freelance job description and check if I'm ready to do it and it's a good match. If so, I'll take 15 or 20 minutes to write about it. I'll mention ideas, suggestions, my skills... something really made for that ad.

I won't send hundred of emails a week, but instead 3 or 4 and pick carefully the jobs I chose. If the buyer didn't take the time and spent 30 or 20 minutes to write the ad, his job is probably not worth checking.

</comment><comment><USER19> > Assuming your projects function correctly, 95% of clients at this level are > going to judge your web development skills based almost solely on the design > of your sites. Unfair, but true.

Not sure about this, we have had a steady stream of clients since we got going without a particularly attractive website (<http://gastownlabs.com>)

I'd say the percentage is 95% but the metric isn't your web design but references from previous clients.

<comment><USER10> All you need is color. Your site's design is definitely good but it screams, "We're afraid of color!" ;)

I started my blog design with a black-and-white theme thinking it would look sharp and sophisticated but it actually just looked bland. So I threw some saturated colors into my blog and it breathed life into it: <http://techiferous.com/>

Here's a good tool for choosing color palettes: <http://colorschemedesigner.com/>

<comment><USER20> I agree about the lack of color being a problem. In my mind, it links you with mimes and aloof Mac designers who think they're better than you. Maybe that's what you were going for, though!

</comment></comment></comment><comment><USER21> I generally reply to less than 2% of CL ads - choosing the ones that I feel I have the best chance to win. I never send a resume, I only reply with links to other projects I have already completed that are pertinent to the job request. I also mention that references are redily available, which they are, although no one usually checks on them.

I find that answering the job ad specifically, explaining how I would work on the problem, and mentioning how I have done something similar in the past gets me the best success rate to speak with the client directly. Even if you don't have exactly the same project under your belt, you can reference other web work and explain how portions of the project are the same.

</comment><comment><USER15> I agree with most of the article. I am primarily a web programmer, but most of the projects I work on have or already had excellent designers work on them, which makes my portfolio projects that much more appealing.

However, I find your work-acquisition strategy a little shallow. The best thing I can recommend is to spend a decent amount of time crafting your message (even if its as simple as "I make websites for small businesses"). Consistency and clarity is key here over specialization.

Once you have a clear consistent message tell everyone, especially non- technical folks. As the article said, its a numbers game. By doing this, I have found clients through friends of friends who talked about me, twitter, and my mom even picked up a project for me at her book club.

If you can manage your own projects, I would branch out from just working with firms that already hire/manage designers/devs (freelance or not). There's an endless supply of businesses that hire contractors without having technical managers and then end up extremely unhappy (at the least). If you're competent, a good communicator and transparent with the client, you'll easily wow them over and over again. Further, these clients will pay consulting rates (min $100/hr) rather than designer/developer rates ($50-$75/hr).

</comment><comment><USER22> The more I think about freelance work, the more I come to the conclusion that we all need to start specializing.

Every business needs a set of unique attributes, and many people are creating freelance businesses. How can people possibly compete effectively without becoming _very_ good at least part of their job description?

I know that many of us like to think of ourselves as capable of tackling everything, but in reality it's very difficult to wear five different hats.

I'd like to see networks develop which allow developers and specialists to effectively work with each other in more specific capacities without needing to form permanent business structures.

I'm fairly certain that this is the way the labour market is headed - but Ip think it would be useful to be able to make the process of partnering with other freelancers more democratic.

<comment><USER23> You mean something like DB experts working with server experts working with programmers working with UI designers?

<comment><USER22> I do, yes.

In the future, I think there's a strong chance that we're all going to end up as specialists - I'd like it if there was a network / site / application that allowed these informal working arrangements to function well.

</comment></comment></comment><comment><USER24> ho hum.

you're always competing with the person who'll try to "copy facebook for $15/hr"

once you've got more than one customer you'll inevitable get in the situation where, if you were honest, you'd have to tell Customer A that his project is late because you've been working on Customer B's project. If you are honest, Customer A will freak out and odds are 50% or so that he'll dump you right there.

I joined the project management institute, and one day looked at the code of ethics I signed onto and I realized I'd be violating it all the time if I was doing typical freelance work for the typical freelance client.

So I won't.

<comment><USER25> I rarely find this an issue. I've found I'm more likely to be waiting for a client to be getting back with some sort of feedback, and therefore using my time to be working on another project.

This may be down to handling client expectations at an early stage. If you make it clear that as a freelancer you will be working for several people at any one time, and give them a time estimate for when progress will be made, I've found most clients are fine.

This does mean I have to make sure I'm progressing enough on each project to keep each individual client happy, but I've found for a lot of people, as long as they see some progress and you're keeping up communication with them - which can be as simple as a 'here's a quick update' e-mail - then they're happy.

If you get a client who wants you to work solely on their project, this can be more of a problem. As I've been freelancing a while I'm in a position to say I can't work that way, and know that I'll find other work if they then do not want me to work for them. When I was starting out and work was thin on the ground, I couldn't be so picky. Then again, I didn't have as much work to juggle either.

</comment></comment><comment><USER26> How did your rates evolve over the last four years? (from when you were a beginner with no experience, until now)?

Was it tough justifying high rates with little experience?

<comment><AUTHOR> I started at about $50 / hr and now I charge about twice that for smaller projects. For longer-term or larger chunks of work, I give discounts because it saves me time looking for work.

The high-risk, high-reward stuff is fixed-price gigs where I charge a set price for the whole project. I've taken a bath on some of these, though never lower than $50 / hr. On the flip side, the good ones have worked out to high hundreds per hour. Stressful, though.

<comment><USER27> Do you ever get work through recruiters? Do you find their rates to be less? Whenever I get contacted by a recruiter and I tell them my rate they freak out. They say "The customer has a stretch budget of $40/hour for this contract" like that's some huge amount.

<comment><AUTHOR> I've landed two gigs with recruiters at about $75 / hr, and I've made it clear that I'll be raising my rates after several months, assuming things are working out. I think it just depends on the type of work you're doing. I would imagine iOS, Rails, Django, and anything other than PHP would probably be more.

<comment><USER26> are you doing php only?

</comment></comment></comment></comment></comment><comment><AUTHOR> Just posted part 2, which you can find here: <http://news.ycombinator.com/item?id=1767620>

</comment><comment><USER28> I've been making a good living as a freelance web developer for the last three years and never once have I had to inquire for work. If you do a good job on your client's sites, create a lot of public side projects, and network well within your local community of developers, you'll have more work than you'll possibly be able to manage.

</comment><comment><USER29> Have you considered outsourcing the initial client contact (numbers game/craigslist posting and replies) part of the process?

<comment><AUTHOR> No, because I only do this a few times a year, and then I have enough work to last me several months at least. And now that I've been doing this for several years, I only have to do it maybe once or twice a year. I get enough repeat work, referral business, and long-term contract gigs that finding work isn't the problem it once was.

<comment><USER30> several months? What kind of jobs do you typically apply for? And if you do this only a few times, how do you stagger the client work ?

</comment></comment></comment><comment><USER31> Does anyone else see this at the end of the post?

> "Hello there, fellow HN user! If you like this post, I'd really appreciate > an upvote." [1]

I'm not sure how I feel about it, but I am curious how it's done.

1: <http://i.imgur.com/gu47C.png>

<comment><AUTHOR> It's WP Greet Box and it's fairly controversial here [1]. I may remove it. I'm not entirely sure I see the problem with reminding HN users to vote for a piece of content if they found it interesting, but it's not a big deal so if people are going to boycott me over it, I'll dump it.

1\. See discussion here <http://news.ycombinator.com/item?id=1738183>

<comment><USER32> I liked it, and prompted me to finally get around to registering, so the win is clear for HN as well.

</comment></comment></comment><comment><USER27> If you primarily do Rails or Django applications (i.e., complex web applications including database design) do you still call yourself a "web developer"?

I associate "web developer" with graphic design or dinky brochure sites. I've been calling myself a freelance programmer. Thoughts?

<comment><USER33> You need to think like your customer. If you are a subcontractor and your customer is a shop that is buying code, perhaps you can call yourself a coder. If you are selling directly to customers, who are buying websites, you may need to call yourself a web developer.

And, yes, that means that customers will expect the whole package. They don't know how to draw the lines between how the site looks, how the UI works, how the backend works, and how the hosting and the maintenance workflow will work. Those lines can be hard to draw even for experts, and drawing them is _your_ job. Organizing that, and explaining it to them in their terms, is much of what they pay you for. So you'll need to learn to do some graphics and front- end work, or you'll need to learn how to subcontract that, or you'll have to become a subcontractor yourself or otherwise join up with a network of people who can band together to accomplish all the subtasks needed to build and run a site.

</comment></comment><comment><USER27> How do you handle just choosing the closest cities to you in Craigslist? Most of the web developer jobs can be done from anywhere so it doesn't seem like it would matter where the clients are located. Have you thought about searching all craigslists?

</comment><comment><USER34> What kind of projects/jobs do you get usually? I mean, do you do facebook apps, iphone, customize WP/drupal, or code websites from scratch, or...?

</comment><comment><USER35> Have you been badly burn by a client? (ex. doing a lot of work without getting paid). What's the ratio of good client vs bad ones?

<comment><USER25> In my experience (seven years as a freelancer), most clients are good. You need to build up your sense of who is good and who is bad so you can weed out the bad ones early on. Things to look for are:

* Have they fallen out with their previous developer / team

* Do they start off saying they have no budget

* Have they decided it's a short job but have no noticeable idea of how long things will actually take

* They only want to pay at the end of the job, when they've received everything

* They won't sign a contract

On their own, none of these is a deal breaker (apart from the last one.) However, if you start hitting two or three points, that's real warning signs that they're going to be a bad client.

In the UK, I and a lot of other developers and designers ask for some money up front (for new clients, long running clients not so much, it depends what they're like.) I started doing this from advice from another freelancer, and it's the easiest way of weeding out bad clients. People who argue about paying 25% to 30% up-front also tend to be the ones who pay late or argue about paying the whole amount.

By not working for clients who won't pay a deposit, I've actually saved myself hassle in the long run by not having to chase for payments.

The most I've been ripped off for is £300, but I've some freelancing friends who are owned thousands of Pounds by various clients.

To mitigate risk, if you're doing a lot of work for a client it's best to break it down in to milestones and bill frequently - at least monthly. That way if they haven't paid a previous bill you can stop working until it is paid, and you have less to lose.

[Edit - trying to format list]

</comment></comment><comment><USER36> Huh... what's freelancing? Oh.. working for other people's companies? Why do that?</comment>


Up to 48M Twitter accounts may be bots - <AUTHOR> http://www.msn.com/en-us/news/technology/as-many-as-48-million-twitter-accounts-arent-people-says-study/ar-AAo9e16?li=AA4Zoy&ocid=spartandhp <comment><USER2> Came across one the other day, just by mentioning in a post "blue plaque", got instant like and retweet.

This started me thinking of a little game - what post with the limitations of 140 characters could you post that would trigger the attention of the most bots for automatic retweets/likes?

It's on my to do list, when bored, but I'd imagine others have had comparable thoughts and may of already had a go.

Anybody got any other examples?

<comment><USER3> #maga

the trump astroturfing army is aggressive

<comment><USER4> Is that an acronym?

<comment><USER5> "Make America Great Again" \- Trump's election slogan

</comment></comment></comment></comment><comment><USER6> Better title: "Up to 48 Twitter accounts may be human"

Snark aside, there is no way around this. Followers in digital public spaces are representative of social status, the demand for appearing popular will never go away and so neither will the bots.

<comment><USER7> Confirmed identity with the service would resolve this.

<comment><USER8> And result in a rich trove of rich identities to be stolen.

<comment> brian-armstrong This isn't necessarily true. If world governments could use their records to create an OAuth-like service, you could uniquely verify citizenship without giving away personally identifying information

<comment><USER9> Shall I go ahead and start the over/under pool on how long it would take before it was hacked? I think it's a compelling idea, but it would probably be the most-interesting target in the world.

<comment><USER10> I think a singular, required identity service on the Internet is one of the greatest threats to free speech.

<comment><USER11> how about a voluntary one? Let people be authenticated and let people see how many followers are authenticated or not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> While automatic control of computerized interfaces should surprise no one, "bot"-like behavior is not limited to computers and isn't new. One should always be skeptical even when something comes from humans: for instance, a "customer review" could be a paid reviewer, or someone talking on the nightly news could be essentially controlled by the puppet strings of their organization and not really voicing their own position. Ideally no one ever puts too much faith in what they hear from a handful of people because that is not statistically significant (there are literally hundreds of millions of people in the U.S. alone, billions in the world; sample sizes must be gigantic).

Where "millions" of accounts become dangerous is when trying to determine if even a "statistically significant sample size" is legitimate. I seriously doubt that most organizations ever come close to finding a large enough sample in the first place before reporting a finding. And yet, if they _primarily_ look at online postings instead of actually talking to people, it's likely that even a large sample is totally messed up. That should concern everyone.

</comment><comment><USER13> And one of them is mine. It recommends an event once you tweet to her. It is actually a service that many people appreciate. So in summary, bot != bad.

<comment><USER14> #notallbots?

<comment><USER15> #botlivesmatter

</comment></comment></comment><comment><USER16> To compare, I looked up the estimates[1][2] on Facebook and if we use 170 million out of 1.4 billion, that's ~11.7%. That is in the ballpark of Twitter's 15% (48m/319m).

I guess if you make a popular service that doesn't require a credit-card payment or phone SMS text as a test for human verification, you should expect >10% of fake accounts even with state-of-the-art heuristics detection.

[1] not sure why Huffington Post is top google link about it but the other news sites say the same 170M: [http://www.huffingtonpost.com/james- parsons/facebooks-war-co...](http://www.huffingtonpost.com/james- parsons/facebooks-war-continues-against-fake-profiles-and-bots_b_6914282.html)

[2] 2015 1Q user count: [https://www.statista.com/statistics/264810/number-of- monthly...](https://www.statista.com/statistics/264810/number-of-monthly- active-facebook-users-worldwide/)

<comment><USER17> You can look for proxy / hosting IPs. These bots are most likely running on servers.

<comment><USER18> So wouldn't it be relatively simple to block AWS/Azure/etc ip blocks AND duplicate accounts from single addresses? Wouldn't that be a large drop in bots right there?

Corollary: I once played a large MMO that intentionally inflated user numbers right before they were acquired via content updates that encouraged the creation of multiple bots per actual player. I'm sure at some level executives are aware that bots are good for business and allow them to persist.

</comment></comment></comment><comment><USER19> Heh, personally, it feels like 80% of twitter are various "Social Media Automation Tools" following and retweeting each other.

<comment><USER20> This reminds me of the Onion Talks episode, "Using Social Media To Cover For Lack Of Original Thought"[0].

[0]: [https://www.youtube.com/watch?v=CK62I-4cuSY](https://www.youtube.com/watch?v=CK62I-4cuSY)

</comment></comment><comment><USER21> This is a result of what I call "audience economy". People want an audience and are willing to pay for it. Audience likes to see a prior audience. Bots enable prior audiences. Platforms like fiverr enable bots.

 _Get 5000 twitter followers for $5_

Those 5000 fake followers make you look good to people that come across you, and they flow.

So it's all about an initial audience.

<comment><USER22> It feels very discouraging to start out in this space once a given platform reaches a certain level of maturity. For instance, Insta now seems littered with these local service/small-business accounts spamming the most optimised hashtags with inspirational quotes on stock photographs; most engagement seems to come from bots and scripts being used by these same accounts. (Maybe I'm playing the game wrong.)

Does buying 5k followers really help in any way? Won't the more sophisticated users (ideally those whom you'd be targeting as followers) see through this based on your engagement rates, or does having a certain number of followers hold some weight with the algos which leads to your stuff attracting more engagement, followers, etc. in some kind of virtuous cycle?

<comment><USER21> Unfortunately no. When a social platform becomes "big" as in, reaches early majority, spam finds a way in. No algorithm can stop it. Quantity kills quality. The "sophisticated" early adopters lose it.

Look around. People will do whatever it takes to get to "front page", "top stories", and such.

Medium obsesses about quality, but their top stories, fueled by recommendations from "the common man", are full of junk. Same with LinkedIn. Twitter. Facebook.

HackerNews is saved simply because it's small.

<comment><USER23> > HackerNews is saved simply because it's small.

lol

</comment></comment></comment></comment><comment><USER24> I'm thinking that this is not as `black&white` as said.

There are accounts which actually are used by people/companies, they post authentic content but do some automated actions.

E.g. a company account which tweets authentic content for their field but on the other hand has automated retweets on certain hashtags in order to gain their authors as followers or to come up as related to other accounts in same field.

Also to mention that there are services such as IFTTT which actually can help you to automate such actions and make bot-like behavior.

I guess the same would apply to Instagram, Pinterest, Reddit, etc.

</comment><comment><USER25> Does it really surprise anyone?

<comment><USER26> I figured it would be higher, since there's not much there to hold it to some upper bound.

<comment><USER25> Guess you're right

</comment></comment></comment><comment><USER27> The USC researchers own research says there's a 57 percent chance @realdonaldtrump is a bot

[http://truthy.indiana.edu/botornot/?sn=realdonaldtrump](http://truthy.indiana.edu/botornot/?sn=realdonaldtrump)

<comment><USER28> Have you read it? It sounds the like output of a Markov chain text generator. Sad!

<comment><USER10> There's a method to that madness. Whether he is actually aware of it or not (I lean more towards the former), that stream-of-consciousness styled rhetoric is incredibly magnetizing to a large percentage of people. In my research on AI- driven political engagement, I found that while intensively complex generated argumentation can engage relatively sharper audiences without arousing suspicion, it is more computationally expensive, and those people do not have as much flex in opinion. The use of simpler, "like output of a Markov chain text generator" styled tools help separate the wheat from the chaff in terms of pliability.

</comment></comment></comment><comment><USER29> Of the 48M, somehow 31.6M of them are inexplicably One Direction fans

</comment><comment><USER30> This won't suprised anyone that uses twitter. In fact I rely on 2-3 bots to retweet my tweets and so get more coverage. They have a place, it's not all bad.

<comment><USER31> The article said that.

</comment></comment><comment><USER32> There is a recent trend in anti-Twitter chatter. I seem to remember msn-bots being all the rage once upon a time.

</comment><comment><USER33> I'd ask for my money back if I'd been marketing on Twitter.

</comment><comment><USER34> There's really no legitimate reason why twitter allows follows via their API[1]. I'm not sure if they see some benefit from allowing spam-follow bots to run wild or what they could possibly be thinking.

[1]: [https://dev.twitter.com/rest/reference/post/friendships/crea...](https://dev.twitter.com/rest/reference/post/friendships/create)

<comment><USER35> There's also no reason to believe that botting is done via API in most cases. I would think it's easier to detect + ban that way. I don't know how it's done in the majority of cases, but I know it's not particularly difficult to write a bot that drives an actual browser and emulates human mouse behavior.</comment></comment>


Ask HN: Would it be possible for the NSA to watch through our phone cameras? - <AUTHOR>

<comment><USER2> Yes, they could call you on Skype.

Close to your question:

[http://arstechnica.com/tech-policy/2013/04/fbi-denied- permis...](http://arstechnica.com/tech-policy/2013/04/fbi-denied-permission- to-spy-on-hacker-through-his-webcam/)

Maybe you should worry about these first:

[http://arstechnica.com/tech-policy/2010/02/school-under- fire...](http://arstechnica.com/tech-policy/2010/02/school-under-fire-for- spying-on-kid-via-webcam-at-home/)

[http://arstechnica.com/tech-policy/2013/03/rat-breeders- meet...](http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet-the-men- who-spy-on-women-through-their-webcams/)

After all, ordinary hackers don't need search warrants.

</comment><comment><USER3> One reason to keep an eye on your idle/use times. They can probably make the "bandwidth" consumed "disappear", but as far as I know they don't yet have a way to replace the energy consumed.

\----

P.S. Of course, depending upon your system, they might make it falsely report a crappy connection as an explanation for a drop in these values.

Down a rabbit hole... ;-)</comment>