Fixing Engineering's Loyalty and Longevity Problem - <AUTHOR> http://firstround.com/review/fixing-engineerings-loyalty-and-longevity-problem/ <comment><USER3> Point one: if you want me to want to stick around, your company has to have challenges I want to work on over time.

Point two: do not underpay me. I will tolerate a fuzz around market rate, and I will adapt to market conditions. I will quit as soon as I can if you systematically undervalue me (see point one: my value _will_ go up).

Point three: build a company designed for fifty years, to deliver use and value, and you might get people looking to stick around for fifty years.

<comment><USER4> Are these hard rules for you? Do certain harder (more challenging) challenges make up for lower pay? Are there culture benefits or actual benefits that can make up for lower pay?

I ask because I hear things like this all the time, and there seem to be two schools of thought: 1) intangibles matter, 2) tangibles (money) is all that matters.

If the latter is true for you (or anyone in a position to be making as much as SV engineers make, excluding those with debts like children's schooling and loans), that makes me really sad. Jumping to the opportunity that will pay more solely because they pay more seems like a shortsighted, materialistic view of life.

I'm not saying you see it that way, but there are certainly a not insignificant amount of people who view money as more important than challenges. Thats not wrong, of course, just saddening to me.

<comment><USER5> I think the logic train the parent is espousing goes like this.

Works on challenges (intrinsic) --> gets new skills + generates increasing value for the company

Repeat this cycle for many moons and the worker now has a significantly upgraded skillset that has and continues to produce significant value for the corp. All that is asked is that the salary grows with respect to the skill set being utilized and the value being produced for the company.

If you end up in a situation where skill sets and value are increasing substantially but compensation is stagnating, you end up in a situation where people will eventually take a look around at the market and realize other people with similar skillsets who provide similar value are getting offers at a substantially higher rate (even assume inflation increase of 3-5% for several years, that adds up). Yes, the work might be challenging and the worker might enjoy the work intrinsically but extrinsically they're now asking whether pursuit of the intrinsic challenge is worth it given the disparity in how they're valued compared to their peers.

Pay isn't necessarily about the tangibles but more about how the company values you (scorecard). If your salary gets out of line with market by a substantial amount relative to skills, experience, and value generated, that indicates the company doesn't necessarily value you as much or isn't willing to expend the capital necessary to keep their employees satisfied.

The other angle one could take with this argument is that while intangibles are nice, they cannot offset the increase in price of other things like housing, and food. Without pay raises over time, the percentage increases in basic cost of living will eat into the paycheck more and more. Induced pressure from external sources can undermine intrinsic motivation, especially if there are dependents, and increase the importance of the paycheck amount.

<comment><USER3> > Pay isn't necessarily about the tangibles but more about how the company > values you (scorecard). If your salary gets out of line with market by a > substantial amount relative to skills, experience, and value generated, that > indicates the company doesn't necessarily value you as much or isn't willing > to expend the capital necessary to keep their employees satisfied. The other > angle one could take with this argument is that while intangibles are nice, > they cannot offset the increase in price of other things like housing, and > food. Without pay raises over time, the percentage increases in basic cost > of living will eat into the paycheck more and more. Induced pressure from > external sources can undermine intrinsic motivation, especially if there are > dependents, and increase the importance of the paycheck amount.

Wow, that said it better than I did.

</comment></comment></comment></comment><comment><USER6> The author makes some good points about hiring and working, but what's with this fixation on diversity? If you're a small start up (i.e. 5 or 10 people in his words), your goal should be to build a product and get it to market. And if you happen to be a 30s something white male workaholic who knows a few other 30s something white male workaholics who will work with you to get it out, why shouldn't you just throw diversity out the window and work with what you have to get a project to completion.

<comment><USER7> Diversity is very useful because companies pivot and having a diverse* team allows you to better consider more options.

Note: By diversity I don't mean a team of 30 year old workaholic that graduated from Stanford and then worked at Google/MS for a few years that happen to have different skin colors. I mean a diversity of experience, fresh college student, a 60 year old near retiree, and someone that just spent six months backpacking in South America etc. It might seem like having a bind person on your team will slow you down, but plenty of dumb products get created because everyone has the same exact background and can't see just how tiny the market is.

PS: The world has ~7 billion people and most of them are not like you.

<comment><USER8> Nice theory, but optimizing for the pivot over the running state is not a great strategy. Even if it was you do not need the kind of diversity you mention on the team as much as in their network.

The benefit of having a particular life experience and point of view is not something you need 24/7\. You need it, if at all, at decision points.

<comment><USER9> The obvious rejoinder is that those decision points make the difference between a failed startup and a multi-billion dollar company.

As empiricists, though, it's worth asking if there are any real examples of companies exploiting hidden market opportunities thanks to a diversity of viewpoints. A lack of examples wouldn't be quite damning--maybe there's just not enough diversity at all to rise above the noise level--but it'd be a useful test of how valuable diversity actually can be.

This all stands apart from moral and ideological reasons to try to foster diversity, which are in my view more compelling but are understandably less effective when it comes to influencing decision makers.

</comment></comment></comment></comment><comment><USER10> In a situation where companies underpay, and the only way to get a raise is jump shit, how could you not expect a mercenary culture?

<comment><USER11> I kept scanning this article for talks about money, but there were none. It isn't even about underpaying - it's that changing jobs supplies one of the best sources for engineering pay raises.

There are evolutionary flows through the work force that don't require this (moving into leadership positions) but as they mentioned, generally hiring into the top levels comes from a tight circle of people, having gone to the same school, or some other such limitation. So if you didn't go to Stanford, what's your play?

I could understand why someone running a company wouldn't want to address this, but paying your engineers solidified salaries while company profits rise, and possibly with limited amounts of share in the company, is a good way to guarantee that they'll have to jump ship at some point, just to keep up with inflation.

<comment><USER12> But then you deal with the wage problem -- managers (especially ones without a tech background) are often of the "my reports make less than me" school of thought. More money = more power = more respect. So when a manager who makes $90k/yr is talking with a 30yo who wants $150k/yr, he might be insulted or put off. And let's not forget that a lot of developers probably should be in the 200-250 range.

The only thing to look for in a company, in my eyes, is how well they pay their employees. They can glad-hand all they want about open workspaces and ping-pong tables and catered lunches, but none of that matters. Show us the money.

<comment><USER13> Your manager should make more - because nobody should be a manager of software devs who is not a software developer himself and should be able to command more than a young engineer.

You shouldn't get to be an officer unless you were first enlisted.

<comment><USER12> That would be nice, huh? I've worked for plenty of places where the dev manager was a glorified scrum master and PM

</comment></comment></comment></comment></comment><comment><USER14> Companies will never value employees as much as employees value themselves.

If programmers can get a promotion and a 20% raise by switching employers, and a 3% raise by staying, why would they stay?

I find it funny that startups would expect to attract "missionaries" when most of them lack missions of any substance.

<comment><USER15> I've always found this market inefficiency fascinating. It's conventional wisdom (not just in the software industry) that the best way to get a big raise is to switch jobs, but your employer "should" be aware of the market rate for your work, and have the most information about your value and the most incentive to keep you around. I've always wondered if new employers are overvaluing new hires, or whether current employers fail to keep up due to some sort of bureaucratic issue.

<comment><USER16> Alternatively, if new employers were not paying a premium, they would have a harder time attracting talent, so they are willing to pay more to fill the slots they really need to fill.

And employees have a switching cost, if you're getting paid 5% below market, that's probably not enough to get you to jump ship by itself.

</comment></comment></comment><comment><USER17> "Your goal, as a hiring manager, is to find the people who want to invest in their careers, who are aiming for mastery and not just looking to make more money or build a shiny resume."

Why are these two concepts mutually exclusive? Experience, money, and mastery are just a few of the side effects of a successful career.

<comment><USER13> Yeah, that made me see red. Just money? Money is food in my mouth, money is attention from a qualified doctor in a good hospital when I get ill, money is a good place to live in a nice and safe area, with heating that turns on in the winter, money is a car that starts when you turn the key, with a tank full of gas. Money is fucking important.

<comment><USER16> In the context of software engineering in silicon valley, money isn't the difference between being able to afford a car that starts or not, it's mostly about how much money you have sloshing around in a rainy day fund.

<comment><USER13> Okay lets change it then: more money is how long you can do without a job and still have all those things.

</comment></comment></comment></comment><comment><USER4> With all due respect, I think the author has to be careful not to be jaded. While burnout and echo chambers are a real problem in the valley, an engineer who genuinely enjoys short sprints and hackathons, or staying up all night occasionally to prototype something they're excited about is not necessarily a bad hire.

Some of my fondest memories are of building something alone, or with colleagues, all night because it was time-sensitive or something we were really passionate about. That does not inherently make me bad at thinking strategically, working "normal" hours, or building long-term successful projects.

They are different skill sets, but one person can be great at both. The author seems to imply that's not true, which is a common misconception, IMHO.

<comment><USER18> Some people just like to work like that, and that's ok. What's wrong is when you _require_ people to work like that or when people who work like that get ahead disproportionately.

</comment></comment><comment><USER19> My lord, I just don't agree at all with this article. The author parrots his source, who seems to think the entirety of the problem is "engineering culture".

It is absolutely not. That assertion - seemingly the crux of the article, if you take the perspective of the primary source - is total nonsense. There are definitely issues in engineering culture, and some good ones are mentioned. But the actual, and most material problem, is in the business culture - <USER2> paying employees their actual market value, consistently, and then balking at those employees when adjustments are asked for.

</comment><comment><USER20> the problem is more on the money and product/marketing side than on the engineering side.

while working on banks that would hold true. a engineer was worth revenue per month while the system was up.

on silicon valey, the engineer is worth a lot as soon as the product is live, but then that means IPO or something and now he is worthless. Remember that most companies in the valley do not even have the concept of revenue...

And when the company does have revenue, then the issue shifts from the money to the product side. The engineer is the guy building the factories. and product can use a better or new factory because they have the talent to build it. but there is nothing they want to build, because, well, they have revenue with the old one, so why bother?

now, when you see all that, it is easy to understand why the engineer VPs on the top drive them to exhaustion. because they know in the end the short term in a engineer work life is all that matters to his financial/product peers.

</comment><comment><USER21> Is it legal to not hire someone because they aren't planning to stick around for more than eg 2 years?

<comment><USER22> It's certainly legal. But short of expecting you to sign a binding 2-year contract, what exactly are they going to do about it? "I believe in this company and want to be here for the long haul" has got to be one of the most commonly told lies in job interviews.

<comment><USER23> I don't think it's a lie, it's just a statement with a big IF before it.

IF (this company is as great as you say) && (I'll be doing interesting work) && (the culture is good) && (the pay/benefits is fair)

THEN I believe in the company and will stick around.

</comment></comment></comment><comment><USER24> In long run, company culture and employee loyalty wins. But I have yet to find one.</comment>


New York Times Eliminates Director of Information Security Position - <AUTHOR> https://twitter.com/runasand/status/1186775481615605760 <comment><USER2> As a former NYT dev I was upset at this but after digging deeper seems like this isn't the NYT shelving info-sec but just consolidation (hired Erinmichelle Perri as CISO in August). It's always sad when talented people leave.

[https://www.nytco.com/press/erinmichelle-perri-joins-the- tim...](https://www.nytco.com/press/erinmichelle-perri-joins-the-times-as- chief-information-security-officer/)

</comment><comment><USER3> This is alarming, because the job of "newsroom security" isn't the same as the corporate security job. Smart organizational security teams rely on a meta- strategy of collapsing user behavior down to a smaller set of activities that they can track and deploy countermeasures for; this works well for employees ("get everyone on the same ad-blocking Chrome extension that we can vet"), but doesn't account for the journalist threat model. Journalists work in the field and deal with sources, who can't (and wouldn't, regardless) comply with corporate security directives.

What you're hoping a newsroom security practice is doing is building source protection systems, like secure dead drops, while also serving an advisory and harm reduction function for the journalists themselves, so that they can safely open attachments and follow URLs and communicate over social networks. In that environment, you can't just say "no, don't do that, do this other secure thing instead", like you can with company staff.

It's a specialized skillset, and one that security teams are not generally good at.

<comment><USER4> I didn't read the article, but perhaps they don't need a Director for this function.

</comment></comment><comment><USER5> I got curious about why the NYT would do this and did a little googling, and I think her boss still works there ([https://www.linkedin.com/in/billmckinley](https://www.linkedin.com/in/billmckinley)), so, per other comments, it doesn't look like the NYT is giving up on security or anything crazy like that

It does seem like they might be cutting staff, though, which doesn't feel all that much better

</comment><comment><USER6> I don't know it's fair to criticize this without knowing the internal circumstances and motivations for such a move.

As others with knowledge of the matter suggest, this may be purely organizational. A title being 'eliminated' doesn't necessarily mean it's function disappears.

Not very relevant, but I interviewed with their product team recently. They seemed very competent and thoughtful.

<comment><USER3> The tweet itself directly addresses your concern.

<comment><USER6> No need for a dedicated focus is nowhere near enough information to take away "this is not important to our company anymore". It is management speak for you are not doing that here anymore.

You would have to know the exact responsibilities this person had, how much time/energy they took, whether or not there was duplication of effort elsewhere, etc.

It is important to know the facts, from both sides. In my mind, at least.

For example, they are hiring a PM on this same team right now. It's very possible they just saw this position as an unnecessary level in the hierarchy.

</comment></comment></comment><comment><USER7> "Why do we need a Security Director? Our security is fine, there's no problem, so why spend the money?"

There's this weird dynamic in Information technology where professionals doing their jobs really well result in there being no problems. When there is no problems there's not much attention and the lack of problems is devalued by management.

Management value teams and managers who heroically solve big problems and issues.

This is why companies can sometimes decide that their best people are not needed cause "all is so quiet" and fire them.

<comment><USER8> This is where having someone on the executive team with technical experience can be such a boon. I know I'm lucky with this, but our exec (chief admin. officer) spent years in the IS ('s' is for services) department at our company -- starting as a VB dev back in the 80s. Luckily leadership is fairly forward- thinking for a nonprofit and we've been doing Angular and C# for years now. She consistently goes to bat for our director and has managed to get our CEO to understand the great difficulty involved in keeping an IS operation running smoothly.

I mean, think about it. Hospitals wouldn't fire the surgeons for consistently executing error-free operations.

<comment><USER9> When I worked at Discovery Channel I remember a call where the CEO admitted they have no idea what they're doing with regards to tech. Made my decision to leave seem smart looking back now that they've shut down Rev 3 (where I worked for a while) and the other division doing R&D. Was pretty frustrating to build stuff that would never see the light of day.

TLDR; execs that know something about tech is super important.

</comment></comment></comment><comment><USER10> Future headline: NY Times reporter gets phished. Confidential sources' identities and quotes made public.

Worldwide we are seeing an attack on journalism and the free press. Cutting security resources as a short term profit-boosting exercise can have disastrous consequences. Many people all over the world risk arrest or even death for sharing information with journalists. If they can't be sure that the journalists have an excellent security apparatus backing them, it will be too risky for them to come forward.

<comment><USER11> I don't know if american journalists seriously need opsec anymore, as nobody in the legit press is writing anything that could threaten the institutions they'd need to protect themselves from. Anyone doing anything dangerous today isn't going to depend on the protection of their newspaper. The only people with skin in the game are actual activists, short selling hedge funds, and maybe some edgy podcasters.

There is this odd dynamic where if you need the additional legitimacy of an old media organization to get your story out, there must be something fishy about it. Like it's a palace gossip leak, and nothing with real consequence or risk.

If your story is really worth your safety, there is the much greater risk that editors will spike it, the way they did with pretty much every major whistle blower story of the last decade. Hollywood was protected for years, intelligence leaks were regularly spiked, and often journalists themselves were complicit actors in the official retaliations. I'm sure the NYT will still have a security role of some sort, but the idea that it could actually equip reporters at a corporate level with the tools to do the kind of opsec you need to facilitate stories at the level of the Intercept, Wikileaks, and other insurgent media seems unlikely.

<comment><USER12> One of the most annoying things in hacker news is people downvoting any opinion that doesn't match their world view.

I don't necessarily agree with the poster above, but it is obviously not an instance of trolling, also it is not offensive or damaging to anyone.

<comment><USER13> Declaring that journalists today aren't writing anything of importance is a pretty trolling assertion.

<comment><USER12> Ironically, someone downvoted you. Which is a shame. Even not agreeing with what you said about it, I really appreciated the opportunity to present my counter-points to you.

<comment><USER13> I appreciate your lengthy response.

</comment></comment></comment></comment></comment></comment><comment> shaki-dora It's really impossible to pass judgement on this decision without hearing the reasons.

Reading between the lines (and using common sense) suggests that the NYT does have a security team, only that its focus is larger than just the newsroom. One scenario therefore would be a consolidation of security roles. The "Head of Newsroom Security" position would no longer exist, even if there is/are dedicated people with that portfolio.

<comment><USER14> From a PR perspective, it is possible to pass judgement. The clear judgment here is that this move, in the way it was handled, created a PR problem for the NYT at a really poor time for it to have this sort of PR problem.

It may be that the new NYT CISO feels that newsroom, journalist, and source defense is a) critical and b) better handled by eliminating this role.

Every security person would agree with a). Given the visibility Runa had and the positive PR she created around this unique need, b) is not the outcome one would predict.

There is always more to the story than the headline, but as the NYT knows the headline is important in its own right.

Here, the NYT wrote the wrong headline.

</comment></comment><comment><USER15> Tidbit - they have a post on /r/netsec for application security engineers (so they are at least growing the team)

[https://www.reddit.com/r/netsec/comments/dc9zia/rnetsecs_q4_...](https://www.reddit.com/r/netsec/comments/dc9zia/rnetsecs_q4_2019_information_security_hiring/)

</comment><comment><USER16> July 2018 NY Times article about the person who just lost her job:

[https://www.nytimes.com/2018/07/24/insider/meet-runa- sandvik...](https://www.nytimes.com/2018/07/24/insider/meet-runa-sandvik- security.html)

</comment><comment><USER17> I've worked for one of the NYT's subsidiaries and personally witnessed how their security posture changed (for the better!) after they were acquired by NYT. I was told that these downstream changes were due to policies laid out by Runa and Runa's team.

NYT will come to regret this decision. Hopefully, for their employees/readers/journalists/sources/etc. sake, it's only because of the bad publicity.

</comment><comment><USER18> To anyone thinking "that's such a bad move that it makes no sense", it's not you: my entire Twitter timeline of security professionals and journalists reacted the same way in unison.

[https://twitter.com/SarahJamieLewis/status/11867779666063400...](https://twitter.com/SarahJamieLewis/status/1186777966606340096)

[https://twitter.com/fugueish/status/1186779963975843842](https://twitter.com/fugueish/status/1186779963975843842)

[https://twitter.com/Pinboard/status/1186781483031089152](https://twitter.com/Pinboard/status/1186781483031089152)

[https://twitter.com/mik235/status/1186781955183874049](https://twitter.com/mik235/status/1186781955183874049)

[https://twitter.com/dangoodin001/status/1186780837750046721](https://twitter.com/dangoodin001/status/1186780837750046721)

[https://twitter.com/osxreverser/status/1186779010073858048](https://twitter.com/osxreverser/status/1186779010073858048)

[https://twitter.com/mshelton/status/1186784191427465216](https://twitter.com/mshelton/status/1186784191427465216)

[https://twitter.com/josephfcox/status/1186778165798166531](https://twitter.com/josephfcox/status/1186778165798166531)

[https://twitter.com/0xabad1dea/status/1186785548746346496](https://twitter.com/0xabad1dea/status/1186785548746346496)

[https://twitter.com/a_greenberg/status/1186786727530323970](https://twitter.com/a_greenberg/status/1186786727530323970)

[https://twitter.com/evacide/status/1186786743774658562](https://twitter.com/evacide/status/1186786743774658562)

[https://twitter.com/str4d/status/1186787004635205632](https://twitter.com/str4d/status/1186787004635205632)

[https://twitter.com/count3rmeasure/status/118677928069453004...](https://twitter.com/count3rmeasure/status/1186779280694530049)

I think this tweet by Runa just yesterday is a perfect example of why her role was fundamental to the NYT's mission.

[https://twitter.com/runasand/status/1186206876381384704](https://twitter.com/runasand/status/1186206876381384704)

<comment><USER19> How many people are still under the CISO at NYT? I'm getting spidy-senses tingling that there was bloat in that part of the org, not some insane "we don't need security" type of angle.

EDIT: it looks like NYT hired a CISO around August [https://www.google.com/amp/s/www.csoonline.com/article/32040...](https://www.google.com/amp/s/www.csoonline.com/article/3204008/security- executives-on-the-move-and-in-the-news.amp.html)

<comment><USER20> How do we know the stated reason is the real reason?

The one thing I don't see being raised anywhere is that it's incredibly common in civil society for folks who are "shrill" (supportive of equality for all races, gender identities, etc) tend to be pushed out for "lack of cultural fit".

<comment><USER21> One of the problems is that a lot of people who are nominally "supportive of equality for all races, gender identities, etc" are actually openly hostile to cishet white men with money.

I think it's possible to separate those two things and I have this hypothesis that you will get further if you are careful to do so and are less likely to be called "shrill" and pushed out.

</comment></comment></comment></comment><comment><USER22> Wouldn't wanna jump to conclusions from a single tweet, without hearing the other side of the story. Like i have no idea how NYT internal security organization is structured and what the bigger picture is.

Employees that send out critical tweets on the day they are let go are typical in an emotionally driven mode. So, I'm sure we will hear more soon.

</comment><comment><USER23> This whole thread is a bunch of people reading into a situation we know nothing about. The truth of corporate structures is that they vary widely, and we can't really read much about NYT's commitment to infosec through this move, especially since it came from a party who was personally impacted.

</comment><comment><USER24> Very weird, there are much less prominent and less targeted corps with ciso's lol. Their loss,lady is a freaking legend.

Bit of a perspective: Companies sometimes keep security staff but have them report under a director of some IT department. Companies are also horrible just horrible about how they perceive the value of an infosec position, the ROI is you don't get pwned. Period. No money savings,no contribution to the bottom line. Not dissimilar to a good insurance policy. I partly fear because it's up to the whims of some exec or some catch phrase they hear somewhere that changes their perception of what value we bring to the table where as engineers build,admins run systems and fix breaks.

<comment><USER25> [https://www.nytco.com/press/erinmichelle-perri-joins-the- tim...](https://www.nytco.com/press/erinmichelle-perri-joins-the-times-as- chief-information-security-officer/)

Yeah, NY Times agrees with you. They have a CISO.

</comment></comment><comment><USER26> One has to wonder if there's political reason for this decision by the NYT, given Ms. Sandvik's early involvement with Edward Snowden. Surely this must have made for an interesting dynamic at such a newspaper.

<comment><USER20> Why would they dislike someone affiliated with Snowden if they published based on Wikileaks data?

[https://en.wikipedia.org/wiki/United_States_diplomatic_cable...](https://en.wikipedia.org/wiki/United_States_diplomatic_cables_leak)

(CTRL-F "New York Times")

</comment></comment><comment><USER27> Oh no. Just a few days I reported a vulnerability in their billing system which has privacy implications.

I am still waiting to hear back from them.

</comment><comment><USER28> One shouldn't jump to conclusions and assume the security function is being eliminated.

Positions can be eliminated for a number of reasons. Reorgs, personnel issues, and redundancies are just a few possibilities.

Putting your former employer on blast publicly is a good way to show future employers you might lack judgment.

</comment><comment><USER29> I just saw Runa speak at kawaiicon (kiwicon) in New Zealand, giving the keynote speech, and it was quite evident she not only knew what she was doing but applied it skillfully in the context of an internationally investigative journal. They no doubt have nation-state actors working against them and to infiltrate, and in the light of the both present and coming tsunami of security issues, I cant begin to guess what her employers are thinking in eliminating her role. She will fair far better than the NYT in this decision, that's certain.

</comment><comment><USER30> Management by Spreadsheet: Look! +140K added to the bottom line!

</comment><comment><USER31> The mainstream media is like a Diebold voting machine... it's easier to not measure what you're not going to fix.

PSA to future anonymous whistleblowers: don't engage the NYT or you are now more likely to be unmasked.

</comment><comment><USER32> Interesting orginization. The "just a Newspaper" cover is getting old though.

[https://gawker.com/here-are-some-top-n-y-times-editors- and-s...](https://gawker.com/here-are-some-top-n-y-times-editors-and-staff- joking-a-1713336525)

</comment><comment><USER33> Information security is as unnecessary as a public editor.

[https://www.politico.com/story/2017/05/31/new-york-times- pub...](https://www.politico.com/story/2017/05/31/new-york-times-public- editor-239000)

edit: /s

<comment><USER34> The reasoning for eliminating the public editor was that today, social media does a far better job at it than anyone in-house ever could, especially considering the widespread view that it's impossible to independently criticise one's own organisation.

<comment><USER35> Which is, of course, ridiculous. The public editor (or ombudsman at WaPo) served a crucial role in giving official "news" status and internal information about drawbacks in their own reporting - neither function which can be filled by randoms on social media.</comment></comment></comment>


Show HN: Plot Shift – Collaborative Storytelling - <AUTHOR> http://plotshift.com

<comment><AUTHOR> I'm not posting this on HN because it contains some fancy new technology, or JS library, or because it's some revolutionary idea. Plot Shift is just a fun side project I've been working on for the last few months. It's the first site I've "launched" so I am eager to get feedback on the concept, implementation, etc.

It doesn't have nearly all of the features I'd like it to have, but in the spirit of lean/bootstrap/agile, I just wanted to get it out in front of people ASAP and I plan to implement features as needed.</comment>


Ask HN: How do you get started learning Python? - <AUTHOR> Hello,
Recently (within the last year), I've been exposed to the data science field, and found myself for the first time really being faced with the utility of being able to code. After doing some research on which language I think would be most beneficial in exploring the data science field, and remaining flexible to learn things in fields like machine learning and AI, I landed on Python. (That may not be the best, but its the conclusion I came to after some time) There are currently such a crazy amount of resources out there that it is hard to decide where I should be starting. Does someone with a weaker math background, require that type of groundwork first before diving specifically into the language? Is it learning the basics, and then setting a goal specifically to what I want to accomplish with the language?
This seems like a broader question about learning, and specifically how one learns to code effectively.
Any resources or advice would be appreciated. I've only ever lurked on here, but recently I've been pushed to really begin exploring the field. I hope this is the right format for this type of question. Feel free to remove if it is incorrect. <comment> massimo-nazaria Read "How to Think Like a Computer Scientist", at least the first chapters and see if it works for you:

[http://openbookproject.net/thinkcs/python/english3e/](http://openbookproject.net/thinkcs/python/english3e/)

Good luck with your learning.

</comment><comment><USER2> Do a project in Python.</comment>


Remote Code Execution in apt/apt-get - <AUTHOR> https://justi.cz/security/2019/01/22/apt-rce.html <comment><USER2> Discussion from 18 hours earlier: [https://news.ycombinator.com/item?id=18968370](https://news.ycombinator.com/item?id=18968370)

</comment><comment><USER3> If this were one of those bugs that do the full PR bullshit run and use a catchy name and a landing page, I'd propose it be called "Inapt"</comment>


Real time ray tracing - <AUTHOR> https://directtovideo.wordpress.com/2013/05/07/real-time-ray-tracing/

<comment><USER2> Real time ray tracing is also my dream since 1994. I'm very glad that IQ launched ShaderToy.com recently. That inspired me to give real time ray tracing another try, and I'm really happy that you can trace 1000 mirrored spheres in real time today. Have a look here: <https://www.shadertoy.com/view/lds3z8></comment>


Atmospheric Scientist on the CA Fires - <AUTHOR> https://www.nytimes.com/2019/10/28/us/california-fires-getty-kincade-tick-sonoma-county.html <comment><AUTHOR> I've submitted this article for the section at the end which is titled "The best scientific answer to what's going on …"

 _Adam Sobel, an atmospheric scientist and director of the Initiative on Extreme Weather and Climate at Columbia University, gives an explanation:_

This increasingly awful fall fire season follows hard on the previous two, in 2017 and 2018, both of which were worse than any in recent memory. Some of the same regions, and people, are being affected repeatedly in quick succession. Psychic trauma is surely compounded significantly for these residents, not to mention the firefighters on the front lines.

How should California residents think about the future, when the present is, suddenly and persistently, not only far outside their prior experience, but also, in its scale and velocity at least, beyond what science had predicted?

It's an increasingly common experience, occurring with other kinds of events as well. Heavy rain events are becoming heavier around the world, but known climate trends can't explain the repeated 500-or-more-year floods that Houston has seen in the last few years.

In the case of the increasingly frequent wildfire disasters in California, I argued the other day that they have multiple causes: poor maintenance by PG&E, expanded human settlement at the margins of fire-prone woodlands, and global warming. But I don't think any of them explains either the suddenness or the persistence of the change that Californians have experienced in the last three years.

When it comes to the weather, and the climate, my views here are strongly informed by discussions with my colleague Park Williams, an expert on wildfire and climate whose research is directly relevant. That research shows that the area burned by fires each year in the summer months has increased drastically, and this is consistent with the influence expected from global warming.

But, as explained by Mr. Park in his recent research article, and in The Times on Friday, the headline-making fires of the last three years have all occurred in fall. In that season, temperature has a role, but other factors are likely to be more important — first and foremost, the dry Diablo and Santa Ana winds.

Those are mainly fall and winter phenomena, and clearly critical factors in the recent and current fires. But these winds are actually projected to occur less frequently as the climate warms (with no clear trend yet apparent in the observations). So the fires may be attributable to weather, but the most critical aspect of the weather isn't directly attributable to human activity — nor, as far as I can tell, to any other, identifiable, larger cause. So what is going on?

My guess is that the best scientific answer goes something like this. The sparking might have gotten worse over time. But more important, in the last three years, it has encountered the hot, dry downslope winds markedly more often. And global warming is probably making those winds a little hotter, but the wind events themselves, the most important proximate causes, may well be only explainable, ultimately, as "natural variability." That means they are inherently unpredictable. Bad luck, in other words. If this is true, it would suggest a decent chance that next year shouldn't be as bad.

Or maybe the causes are in principle knowable, but current science just doesn't know them. Maybe climate change is proceeding more rapidly and dangerously than we understand.

But it's still good to understand what the limits of our knowledge are. That should keep us humble about our place on the earth.</comment>


Ask HN: Immature email addresses and job interviews - <AUTHOR>

<comment><AUTHOR> As claimed by this guy, <http://9gag.com/gag/a8LrMpV> , does immature email addresses matter while hiring candidates ?</comment>


What Did Ada Lovelace's Program Actually Do? - <AUTHOR> https://twobithistory.org/2018/08/18/ada-lovelace-note-g.html <comment><USER2> Holy shit. I got shivers the moment I realized Sinclair actually finds and fixes a bug from the very first program written in 1843.

      In her "diagram of development," Lovelace gives the
      fourth operation as v5 / v4. But the correct ordering
      here is v4 / v5.

1843!

I was recently at the _Musee des arts et metiers_ in Paris, and they have several original Pascalines on display. So many marvels packed into a very tight space, it is one of my favorite in Paris and I would highly recommend it. I'm not sure what they have on Lovelace, I'll admit I was pretty overwhelmed with the collection. Their computer collection alone is a museums worth, and they cover much, much more than just computer history (a lot of mechanical engineering for starters). If they don't have this algorithm on display, they absolutely should.

A leather-bound first edition Lovelace including this algorithm recently sold for about $120,000. That actually seems like a bargain when you think about the level of the accomplishment. [1]

I agree with OP that most likely the bug is in the transcription and not present in the original manuscript.

[1] - [https://www.theguardian.com/books/2018/jul/24/ada- lovelace-f...](https://www.theguardian.com/books/2018/jul/24/ada-lovelace- first-edition-pioneering-algorithm-program)

<comment><USER3> What else would you recommend checking out in Paris by way of museums?

<comment><USER4> The National Museum of Natural History is unlike any other I've been to. It is fairly worn out but is great. It is displayed in a very different t format to what I'm used to. [https://en.m.wikipedia.org/wiki/National_Museum_of_Natural_H...](https://en.m.wikipedia.org/wiki/National_Museum_of_Natural_History_\(France\))

Quiet and completely excellent, The Museum of Heritage and Architecture. [https://www.unjourdeplusaparis.com/en/paris-culture/musee- ci...](https://www.unjourdeplusaparis.com/en/paris-culture/musee-cite-de- larchitecture-et-du-patrimoine-paris)

The Army Museum is worth a visit - it is interesting to see a less Anglo centric view of the wars, particularly WW1. The paintings are deeply grim - not ideal if you have young kids. [https://en.m.wikipedia.org/wiki/Musée_de_l%27Armée](https://en.m.wikipedia.org/wiki/Musée_de_l%27Armée)

The Museum of the Middle Ages is currently being renovated but is well regarded. [https://en.m.wikipedia.org/wiki/Musée_de_Cluny_–_Musée_natio...](https://en.m.wikipedia.org/wiki/Musée_de_Cluny_–_Musée_national_du_Moyen_Âge)

Probably a candidate for best museum in the world, the Louvre is a great way to completely waste a day with massive crowds, sore feet, food and water shortages, closed exhibits, intense heat and even more crowds. Get a map ahead of time and check that the things you want to see aren't closed before you go.

<comment><USER5> If you want to see an outstanding collection of art without having to face the Louvre crowds, try the Musée d'Orsay: a vastly more pleasant experience, IMO. [https://en.wikipedia.org/wiki/Musée_d%27Orsay](https://en.wikipedia.org/wiki/Musée_d%27Orsay)

</comment></comment></comment></comment><comment><USER6> Great article. In some ways it reminds me of Jonathan Blow's presentation titled "Truth in Game Design" [1]

The author is saying that Ada deserves the title of first programmer both because she did publish an elaborate algorithm and because she understood the potential of the Analytical Engine better than Babbage and Menabrea.

Jonathan Blow's presentation is more about that second point and how computers (or rather, sufficiently complex dynamical systems) can "give you something back that you didn't put in".

System theory is nothing new so it might not be exact equivalent of thinking about engines that can compose music in 1842, but it seems to me that it is not a widespread and well-understood concept as it should be, and that the public opinion is re-discovering it mainly through Deep Learning advancements.

[1] [https://www.youtube.com/watch?v=C5FUtrmO7gI](https://www.youtube.com/watch?v=C5FUtrmO7gI)

<comment><USER7> Modesty by the creator is not due to lack of foresight, it is due to the exact nature of their understanding.

</comment></comment><comment><USER8> Just for anyone curious there is attempt to build Babbage's Analytical Engine started by John Graham-Cumming's Plan 28 project[0]. Currently there is a lot of fragmented knowledge to be collected from the vast Babbage's writings. To understand the size of the project here is the excerpt from their blog[1]:

>in the context of manufacturing methods Babbage calculates that the total number of teeth to be formed for a store with 1,000 registers would be 1,800,000.

[0] [https://plan28.org/](https://plan28.org/)

[1] [http://blog.plan28.org/2018/05/spring-2018-report-to- compute...](http://blog.plan28.org/2018/05/spring-2018-report-to- computer.html)

</comment><comment><USER9> The "C translation" of the program by the article author:

[https://gist.github.com/sinclairtarget/ad18ac65d277e453da5f4...](https://gist.github.com/sinclairtarget/ad18ac65d277e453da5f479d6ccfc20e)

It's definitely far from being trivial!

Also note the use of floats in the C version. A lot of simpler CPUs didn't and still don't have floats.

Fascinatingly, the Analytical Engine's number representation was 40 digits (and later: 50)(!) base 10 (but not "floating" but "fixed" point):

[https://www.fourmilab.ch/babbage/authentic.html](https://www.fourmilab.ch/babbage/authentic.html)

Moreover, a lot of simpler CPUs also don't have the "division" in the "instruction set", the Engine has it!

Given the emulator already existing, maybe somebody will now create the cards from Lovelace's program, and run it as intended?

[https://www.fourmilab.ch/babbage/emulator.html](https://www.fourmilab.ch/babbage/emulator.html)

<comment><USER10> In case anyone missed it, these last two articles were written by John Walker. Founder of Autodesk, Inc. and co-author of AutoCAD.

</comment></comment><comment><USER11> This is really a very gripping piece, and I'm not actually a programmer. It's also interesting mathematically and just as general history, for lack of a better term.

<comment><USER12> I'm a programmer and respected Ada Lovelace simply because of her having the title of the first programmer. Now I think she deserves more recognition because she also envisioned the modern use of computers in everyday tasks. Amazing.

</comment></comment><comment><USER13> There is a very lucid graphical explanation of the hardware of the difference and analytical engines functions in a lengthy appendix to The Thrilling Adventures of Lovelace and Babbage. I really love this book and I can't recommend it enough. I wish it were adapted into animation! It is historical fantasy of the highest calibre.

[https://en.wikipedia.org/wiki/The_Thrilling_Adventures_of_Lo...](https://en.wikipedia.org/wiki/The_Thrilling_Adventures_of_Lovelace_and_Babbage)

</comment><comment><USER14> This is a great article, and I also found myself shuddering to think what would happen if the world ever saw the first program I ever wrote (whatever that was).

<comment><USER15> For me, that's no big deal:

10 PRINT "HELLO WORLD"

Even the horrible crap I wrote as an novice is probably less embarrassing to me that the stuff I wrote as a journeyman who shoulda known better.

Thankfully, the most embarrassing things are, like, spending 2 days configuring postfix and not realizing that I could just read the log files and it tells me specifically what isn't working. A valuable lesson, but embarrassment has its cost.

<comment><USER16> Hahaha, mine:

        mov ah, 2
        mov dl, 7
        int 21
        int 20

Discovering that I could write my own programs with debug.com was earth shaking. Picked up some decade old book on it at Half Price Books (which went well with my decade old machine -- an 80s model IBM with integrated monochrome green screen) and never looked back.

<comment><USER17> I can smell your program. All that new hardware around me. The smell of dot matrix ink.

<comment><USER18> Yes! I remember my first experience with a PC in the 80s was with a Robotron 8086 PC. It did emanate a smell and I could hear interesting mechanical sounds from inside. The motherboard was huge and it had a small 14 inch monochrome green monitor on top of it.

</comment></comment></comment></comment></comment><comment><USER19> > she made groups of operations and in the text of her note specified when > they should repeat.

Does anyone know what "should repeat" means? Was the machine capable of repeating or does this mean the human operator needed to do the repeating?

<comment><USER16> You can see the exact 'program' here [1].

It's really just a series of mathematical steps with a store of values in between. Notions that would have _clearly_ taken it from being a series of mathematical steps, to a program, such as branching, looping, or jumping are left completely unspecified. So her 'loop' was specified literally as "here follows a repetition of operations 13-23".

In other words, "should repeat" is left an as exercise to the reader.

[1] - [https://i.imgur.com/HSWjbUl.jpg](https://i.imgur.com/HSWjbUl.jpg)

<comment><USER20> It's easy to be dismissive from today's perspective, but I think it adequately conveys the algorithm. As I don't think Babbage ever published an instruction set I'm not sure it could have gone a lot further.

</comment></comment></comment><comment><USER21> Amazing article! There's a bug in it though. The LHS of the sum of cubes formula ends in n^2 instead of n^3.

<comment><USER22> There is an error in the squares formula as well. The correct formula is:

        (n*(n+1)*(2*n+1))/6.

<comment><AUTHOR> Thanks a lot for pointing these out! I've corrected them.</comment></comment></comment>


Product Management in a Startup - <AUTHOR> http://subrataalpha.wordpress.com/2009/03/11/product-management-in-a-startup/

<comment><USER2> I disagree strongly and I have worked with some pretty good product managers. The customer interaction, usability, and functionality are not something to hand off to someone who is essentially a marketing technician. If the founders are going to produce an outstanding product, they need to be deep into the customer facing issues. If they can get the help of an outstanding designer, go for it, but a manager doesn't add much.

<comment><AUTHOR> It is essential that someone in your company thinks from the perspective of a customer. The author of this article/post is suggesting that that person's title is "Product Manager" (although they wear different hats).

He is NOT suggesting AFAICT, that you dump financial resources into a do- nothing "manager" as you are implying. I've heard time and time again that you NEED product management in a startup.

Think of a new name if you find the title misleading.</comment></comment>


Failure to Act: America's Infrastructure Problem - <AUTHOR> https://www.strongtowns.org/journal/2017/3/20/failure-to-act-like-professionals <comment><USER2> Toll roads, toll bridges. Return 100% of infrastructure obligations to the states and give them the gas tax money, no need to bring it to Washington so it can be skimmed for pork projects.

<comment><USER3> Except it is of national interest to have a working highway system and for all the states to have a roughly similar economic outlook. "Pork projects" are a good surplus recycling mechanism.

</comment></comment><comment><USER4> It seems like putting a halt on new infrastructure for certain period would encourage higher density development along existing infrastructure.

It also seems like the kind of thing that is unlikely to happen.

<comment><USER5> This is an awful idea that has been tried before.

[https://en.wikipedia.org/wiki/Municipal_disinvestment#Planne...](https://en.wikipedia.org/wiki/Municipal_disinvestment#Planned_shrinkage)

<comment><USER4> To be clear, I wasn't talking about not maintaining existing infrastructure which seems to be what the wiki entry you linked is about. I was talking about a freeze in new infrastructure specifically to allow for existing infrastructure to be better maintained and better utilized.</comment></comment></comment>


Study: Sponsored Content Has a Trust Problem - <AUTHOR> http://contently.com/strategist/2014/07/09/study-sponsored-content-has-a-trust-problem-2/

<comment><USER2> Best line:

"respondents rated branded content as more trustworthy than Fox News"</comment>


Ask HN: How do you research large appliances? - <AUTHOR> I'm in the market for a new washing machine and dryer but I've found that online research doesn't yield much insight.
I'm looking for appliances that work well, are reliable, and will last a long time.
How do you research large appliances? <comment><USER2> Read lots and lots and lots of reviews.

Eliminate really bad ones. E.g. discovered one of Consumer Reports' recommended gas ovens had problem with handles breaking off, causing potential fire hazard.

Then, hope for the best.

</comment><comment><USER3> In the past, I have asked family, friends, and coworkers for their recommendations... in addition to looking online at count and average of reviews.

I also search on the internet to find out if there are problems with the particular model number of product line I'm looking into. (I do the same for buying cars.) Look for product recalls, too.

Best of luck!

</comment><comment><AUTHOR> It seems to me that most appliances are essentially disposable these days.

I'm considering Speed Queen for the laundry because they have a solid warranty and proclaim to be built to last.

</comment><comment><USER4> wait till black friday deals if you can. the price difference is huge!</comment>


The Natural Number Game - <AUTHOR> https://wwwf.imperial.ac.uk/~buzzard/xena/natural_number_game/ <comment><USER2> I'm getting a blank page ... I assume that's not what's supposed to happen?</comment>


Vacations and Fingerprint Scans - <AUTHOR> http://markgamache.tumblr.com/post/47330843224/vacations-and-fingerprint-scans

<comment><USER2> There's one other way to complete this puzzle that isn't mentioned in most walkthroughs:

1\. Go back to Kennedy space center

2\. In the museum, go to the third room, containing the "first monkey in space" exhibit

3\. Wait about 30 seconds until the big hawaiian shirt guy and his family leaves

4\. Pick up the taxidermied monkey

5\. Go to Seaworld

6\. On the screen to the left, pick up the electric eel from the aquarium and place it in the giant water flask you bought from the guy at the beach

7\. Return to Disney World

8\. Remove the eel from the water flask, and place it behind the guard's chair. He'll be distracted by the eel's thrashing about and start panicking about what to do

9\. Use the taxidermied monkey with the fingerprint scanner. Your ticket will be marked as "validated"

10\. When the commotion dies down, show your ticket to the guard, and he'll let you in

<comment><USER3> Is this some kind of twisted eulogy for LucasArts?

</comment></comment><comment><USER4> I'm pretty sure this would be illegal in the EU. Most people are disgusted enough by the practice of being fingerprinted upon entering the US.

<comment><USER5> Here in Brazil the government just fingerprints everyone when they go make an ID card, which they need for everything. No one makes a fuss.

<comment><USER6> Europe still remembers the 20th century.

<comment><USER7> Most people in the UK were happy at the idea of ID cards. There was a vocal group opposing them, but it wasn't a huge group.

The thing that finally killed ID cards in the UK wasn't privacy or technical limitations, but the cost to anyone who wanted one. At £30 most people didn't care. At £100 the scheme died.

<comment><USER6> Point noted. I guess 'Europe' is a blanket term. This is different to the attitude in Germany & France I feel, but I may have a skewed view, mostly interacting with hackers when I am over there.

</comment></comment></comment></comment></comment><comment><USER8> Well, while I'm sure this might raise eyebrows among those that are protective of their personal data, I was just happy to see there was no shitstorm after requesting a no-fingerprint entrance --- I think it's good that that is a "oh, no big deal" option.

I don't understand though - why the fingerprint? So that you can exit and re- enter the park?

<comment><USER9> >I don't understand though - why the fingerprint?

Disney first started using the biometric turnstiles about 10 years back to stop people from sharing season passes, and then a few years later they added it for plain old multi-day tickets.

It used to be that there were folks lingering in every Denny's and IHOP parking lot on International Drive in Orlando, buying and selling partially used multi-day theme park tickets. The marginal price increase for adding an additional day drops quite a bit for every day you add to a ticket - so you could have bought a 10 day ticket for not all that much more than a 5-day, used half, and sold the rest to someone else.

The fingerprint scan is done so that the ticket is biometrically locked to the person who first uses them, thus killing that secondary market for partially used tickets.

<comment><USER10> I'm guessing they did that because most kids don't carry ids with them? Otherwise requesting an id seems simpler?

<comment><USER11> But less efficient as it probably takes more time to check an id…

<comment><USER12> I'm guessing an automatic ID reader is a lot cheaper than a fingerprint reader. Most long-distance buses around here have them, so you don't have to bring a ticket (just book with your id number).

It might be easier to spoof an ID reader, but I bet it would be hard enough to seriously hamper the second hand market for day passes at least.

</comment></comment></comment></comment></comment><comment><USER13> Disney also uses facial recognition:

[http://www.wired.com/geekmom/2012/02/geeking-out-with-the- di...](http://www.wired.com/geekmom/2012/02/geeking-out-with-the-disney-dream- part-4-disney-biometrics/)

<comment><USER14> One has to admire Disney's use of technology in this area, mostly because they seem to have a very balanced approach to this kind of work.

One one side, you're trying to streamline the customer experience (like this facial recognition feature mentioned above) and on the other you're trying to maximize the amount of cash extracted from each and every visitor for every minute they're on the grounds (such as letting your room key serve as a charge card while at park stores).

I'm sure Disney has a master plan that involves this kind of transparent biometrics everywhere, someday. It's just being used in bits and pieces until it gets efficient enough to use everywhere.

People have raised the privacy concerns before, such as the recent fight between CEO Iger and US Rep Ed Markey. Iger's response was basically: "We're not that stupid to jeopardize kids, and you don't have to visit us if you choose not to".

[http://www.insidethemagic.net/2013/01/disney-ceo-bob-iger- st...](http://www.insidethemagic.net/2013/01/disney-ceo-bob-iger-sternly- replies-to-congressman-markeys-letter-addressing-magicband-privacy-concerns/)

<comment><USER13> >you don't have to visit us if you choose not to

True. I choose not to visit any place that is harvesting biometric data simply to increase profitability.

</comment></comment></comment><comment><USER15> Some details are provided in this old article from 2006:

[http://newsinitiative.org/story/2006/08/14/walt_disney_world...](http://newsinitiative.org/story/2006/08/14/walt_disney_world_the_governments)

> But Disney's Prunty downplayed privacy issues, saying the scanned > information is stored "independent of all of our other systems," and "the > system purges it 30 days after the ticket expires or is fully utilized." > Visitors who object to the readers can provide photo identification instead > – although the option is not advertised at the park entrance.

</comment><comment><USER16> Why would a theme park do this? Does the government supply a terrorist- fingerprint database?

I would understand if a private company does ID and (maybe) fingerprint checking for visitors of their research facilities. I had this a few times, although most of the time they maybe write down your name and address and thats it. The only facility that took it really serious was the ESA tech- center in Noordwijk (not to be confused with the little theme park they have near by). They needed passport-numbers beforehand, those passport scanning keyboards they have at airports, the software on the pc also looked similar and guards openly carrying big guns (you seldom see that in Europe). But well, its a space research complex there is probably a ton of military secrets around.

But at the admission for a F'kin theme-park... Why?

<comment><USER17> They do it to curb sharing of multi-day tickets, which is prohibited by their terms & conditions. It's a relatively quick way to check that the person who first used the ticket is the same person who returned with it, rather than someone they sold/rented it to. Selling or "renting" multi-day passes for some fraction of their days is a common way to make money in the areas around theme parks (and a common way for people to try to save money getting in). I don't think this is all that sinister.

I personally would rather have thumbprint scans than have to wait as each guest's photo ID is checked every time they enter.

<comment><USER18> i'm surprised they even bother with fingerprints...face recognition cant be that far off

</comment></comment></comment><comment><USER6> I love France. I arrived there internationally and didn't even have to fill out a form. They looked at my passport and stamped it. I do not recall them having a scanner for the passport. This was 2-3 years ago. But this is the way it has been through most of the 20th Century. What happened to change all of this else where in the world?

Once you are in the EU Schengen area, you can cross numerous borders and travel to many different jurisdictions, all without a single checkpoint or identification required.

It sounds harder to get into Disney World than France.

</comment><comment><USER19> Far as I am aware form previous visits and discussions Disney delete the fingerprint record when the ticket expires.

Also the level of fingerprint scanner we are talking about is not even close to say the one UCIS use when you come into the US. UCIS having my fingerprint is actually pretty handy as it speeds up border processing with new passports etc.

Busch Gardens use a hand size device which is just weird.

</comment><comment><USER20> I think his 1 million visitors a day to Disney quote may be off. From some Googling, the number appears to be around 17M/year (approx 50K/day). In any event, that's a lot of fingerprints (foreign and domestic) potentially being piped right into the NSA and any other 3 letter agencies who may care for such data.

</comment><comment><USER21> How can you be sure the government doesn't have a deal with the hotel you stayed at to have the maids lift fingerprints and DNA samples from your room?

Edit: /s

<comment><USER22> Actually the bigger point is: what privacy protection do Disney visitors have?

Is it allowed for Disney to e.g. correlate their fingerprint or ID database with a federal database for wanted people? Is it allowed for the FBI/NSA/CIA to go to Disney and demand a full list of fingerprints of visitors?

<comment><USER14> Since you're on their private property, probably not as much protection as you're inclined to believe you have on public grounds.

That being said, if it was ever discovered that Disney was sharing visitor information with outside groups you're guaranteed a huge public backlash, both in the media and in the park visitor count. Disney is the type of organization that avoids this kind of conflict, especially when a huge percentage of their clientele are children and their parents.

<comment><AUTHOR> Google complies with 88% of government data requests. Where's the outrage?</comment></comment></comment></comment>


List of Seattle Startups - <AUTHOR> http://www.startedinseattle.com

<comment><USER2> This is great, I'm considering moving up to Seattle when I graduate from college, so knowing the startup culture there is alive and kicking is awesome.

<comment><USER3> Do it! The scene here is amazing, and if you move I can definitely help to get you plugged in. Send an email to firstname.lastname@example.com and we'll do what we can!

</comment></comment><comment><USER4> This is probably a paid promo site, I'm sure there are many more startups in Seattle then those listed. Also, most of them on this site are pretty lame.

<comment><USER3> Hey Sean,

Just an FYI, this isn' a paid promo site, it's a community project powered by sponsorship. The only requirement is that the company was in fact started in Seattle and that they're working on it full time. In regards to them being lame, that's a matter of opinion. :)

</comment></comment><comment><USER5> The link re-directs to [http://seattle.started.in](http://seattle.started.in). Moreover, 'started.in' has a trademark over it.

Isn't it true that domain '.in' is supposed to be used in context to India?

<comment><USER6> Yes. And .io means Indian Ocean, .ly is Libya.

</comment></comment><comment><USER3> If you want to bring started.in to your city, click here! [http://seattle.started.in/contact-us/](http://seattle.started.in/contact-us/)

</comment><comment><USER7> I just noticed that decide.com just recently got bought by eBay and is shutting down the entire service. How very sad, yet typical.

</comment><comment><USER8> That's a lot more than I thought. Proud of my city!

<comment><USER3> We're just getting started. There are over 700 startups in the city, and there's more popping up every day!

</comment></comment><comment><USER9> It's still 'Day One' at Amazon.

</comment><comment><USER10> love started.in. great idea!!</comment>


I Gave Up Too Early - <AUTHOR> http://www.jameskennedy.ie/2013/12/13/i-gave-up-too-early/

<comment><USER2> Giving up is always giving up too early.</comment>


Fork is not my favourite syscall - <AUTHOR> http://sircmpwn.github.io/2018/01/02/The-case-against-fork.html <comment><USER2> He misses the main problem with fork which is poor interaction with threads. Amongst the things you cannot do between the fork and the exec is malloc: another thread in the parent might be in the middle of malloc, might have grabbed a lock needed by malloc, then that thread disappears after fork but the lock is still held by the new child process which deadlocks in malloc.

This and other things are a massive cause of trouble for libraries that need to run subprocesses but need to also link to main programs that might use threads (such as libvirt).

<comment><USER3> This sounds incredibly bad.

For most more complex programs and libraries, you have no control over when they malloc(). If you spawn a thread and run any library function in it, it may malloc().

Doesn't this mean that any program written in any programming language that supports multiple threads and spawns subprocesses is broken (it is racy for deadlocks, if the spawned process also wants to malloc)?

( _EDIT: I misunderstood what the parent said, so it 's not so bad. See my comment below._)

Is this problem discussed anywhere? Are there known ways how people handle this problem?

<comment><USER4> > Doesn't this mean that any program written in any programming language that > supports multiple threads and spawns subprocesses is broken (it is racy for > deadlocks, if the spawned process also wants to malloc)?

Yes.

> Are there known ways how people handle this problem?

The usual way is to ensure that after forking you only execute async-signal- safe code. Which includes exec(). So if you have more complicated logic which cannot be made async-signal-safe, you exec() an executable which performs that logic.

This is a massive pain though. For example setenv() is not async-signal-safe so if I want to exec() something with specific env vars then I have to go through /usr/bin/env. Sigh.

<comment><USER5>
      if I want to exec() something with specific
      env vars then I have to go through
      /usr/bin/env. Sigh.

Why not use execve[0] to set up a specific environment for child processes?

0 - [https://www.freebsd.org/cgi/man.cgi?query=execve&apropos=0&s...](https://www.freebsd.org/cgi/man.cgi?query=execve&apropos=0&sektion=0&manpath=FreeBSD+11.1-RELEASE+and+Ports&arch=default&format=html)

<comment><USER6> Maybe a tangent, but I never really understood how the memory pointed to by _envp_ is supposed to be managed. Does fork() copy the allocator state such that you can just do malloc(), fork(), then free() in the parent process, then execve() blows away the whole memory map in the child?

<comment><USER5> Yes, the flow you describe is pretty much how it goes. The OS will "overlay" the fork'ed child process if exec succeeds in loading the program specified. If not, errno is set and typically the child process reports the problem (using something like strerror_r[0]) then exits.

In either case, the parent process can free the memory allocated for the execve call once it returns.

0 - [https://www.freebsd.org/cgi/man.cgi?query=strerror_r&apropos...](https://www.freebsd.org/cgi/man.cgi?query=strerror_r&apropos=0&sektion=3&manpath=FreeBSD+11.1-RELEASE+and+Ports&arch=default&format=html)

</comment></comment></comment></comment></comment></comment><comment><USER7> The concept of Fork was not designed to "spawn new programs", it was created to allow parallelism on a single program with several processes collaborating on the same task. It's even in the name (i.e. you _fork_ the program in two, not _spawn_ a new process).

For this purpose, the choice to start with the same data structures and the same execution point is quite sensible - it's essentially what happens when you create a thread nowadays. So, the hypothetical discussion where someone decided to copy the address space in order to launch new programs, would never have happened.

The day where someone decided to _reuse_ the existing fork code to launch processes for new programs, that one must have been worth to watch.

<comment><USER8> > it's essentially what happens when you create a thread nowadays

I'm not familiar with the guts of threading libs, but AFAIK the syscall that spawns threads is clone(), which takes a function pointer and a stack pointer, so it very much does not start "with the same data structures and the same execution point".

<comment><USER9> You're talking about the C library function clone(). The actual system call "clone" on Linux doesn't care about functions, or stack pointers, it just sets a flag like the system call fork did. Everything else is implemented in the library by checking the return code.

This is all fine, there are two scenarios, neither of which is the imagined "race" described above:

1\. "Fork-and-exec" Our new execution context will actually run a different program. We immediately do so, the new program doesn't care about most of the state of the old program, it throws that state away, including locks that were held by the old program's allocator.

2\. "New Thread" Our new context will share all the state, if another thread has a process-wide lock for some reason, it can and _should_ apply to us too. If it took a thread-specific lock, we're not that thread, so we already don't care.

<comment><USER8> > You're talking about the C library function clone().

Huh? I saw that the manpage for clone() is in section 2, which AFAIK means it's kernel API, whereas C library functions are usually in section 3. Am I mistaken?

Even syscalls(2) refers to clone(2) in its list of syscalls.

<comment><USER9> Yeah, no.

You are correct that the manual section 2 is "for" system calls, but in practice today these are just the lowest level of the C library, and not the actual system calls.

My copy of the clone(2) manual page hints at this by commenting /* For the prototype of the raw system call, see NOTES */

and more explicitly in its body text by saying "The main text describes the wrapper function; the differences for the raw system call are described toward the end of this page."

Other modern stuff is the same way, the section 2 documentation is describing what an ordinary C programmer needs to know, but if you're say, implementing the C standard library or writing a compiler for a language that runs on the bare metal you need to read the kernel documentation which is not provided as manual pages.

</comment></comment></comment></comment></comment><comment><USER10> My favorite part of fork+exec is the _temporary_ exhaustion of virtual address space on a heavily loaded system, where the parent process is using a shitton of memory. 50G forked is instantly 100G of virtual address space, even if it is followed by an exec. Couple this with sysadmins not configuring swap files means that virtual address space == physical address space. On a heavily loaded system, high memory using processes can't even launch simple utilities w/o incurring the wrath of the OOMK. Configure swap, even if it will never be used, it still affects the size of your virtual address space.

<comment><USER11> That really depends on your overcommit settings. It seems that you describe an overcommit = 2 case, when the total VIRT for all processes will not exceed swap + memory * overcommit_ratio%. But that's not default mode (default is overcommit = 0). And you can mitigate this issue in other ways (as enabling swap can lead into some very bad situations when _physical_ memory gets exhausted):

\- set overcommit = 1, OOM now comes only when sum(RSS) exhausts swap + memory

\- just increase overcommit_ratio if you want to stay under overcommit =2

</comment></comment><comment><USER12> Another person's favourites list is more extensive. (-:

* [https://www.cloudatomiclab.com/antisyscall/](https://www.cloudatomiclab.com/antisyscall/) ([https://news.ycombinator.com/item?id=15998828](https://news.ycombinator.com/item?id=15998828))

* [https://www.cloudatomiclab.com/prosyscall/](https://www.cloudatomiclab.com/prosyscall/) ([https://news.ycombinator.com/item?id=15998344](https://news.ycombinator.com/item?id=15998344))

</comment><comment><USER13> I'm just going to drop this here: [https://gist.github.com/nicowilliams/a8a07b0fc75df05f684c23c...](https://gist.github.com/nicowilliams/a8a07b0fc75df05f684c23c18d7db234)

</comment><comment><USER14> " _Fork is the direct cause of the stupidest component I've ever heard of in an operating system: the out-of-memory (aka OOM) killer._ "

Well, technically, no.

Originally (1st Edition?), IIUC, fork() would fail if enough memory to copy the process wasn't free. Then, when fork() was changed (4th Edition?) to read- only share the address space, that wouldn't happen, but the exec() might fail if there wasn't enough space to set up the child. But those were all doing segmented memory so they're completely irrelevant to modern systems.

The OOM-killer comes with (IIRC) BSD's paged virtual memory. Some bright spark (yes, I have hated this design since I first tripped over it in the early- to mid-'90s) had the brilliant idea of supporting sparse matrices by not requiring allocated memory to be backed by valid pages, either RAM or disk.

If you don't require allocated memory to be backed, you can allocate a giant block of memory; if you never touch most of it, everything will be copacetic. It's good, I was told ca. 1992, for scientific programs in, like, FORTRAN. Yay. Unfortunately, lots of programs started using the feature, including the X server.

(Why do I hate with the fiery passion of a thousand suns the perverted genius who came up with this? AIX 3.2.5/4.1. Running the machine out of memory (remember, allocations don't fail, everything chugs along until some proggie touches an address and the OS can't realize the page) would kick off the OOM- killer, which would immediately hit inetd in the head with its little silver hammer, resulting in a machine that would still be working, -ish, sort-of, but unless you were logged in somewhere already to reboot it, you would have to go visit the physical console.)

Turning off the OOM-killer and overallocation policy was possible, but not advised, since many programs, including the X server, would suddenly use a truly atrocious amount of memory.

TL;DR: Memory overcommitment doesn't have anything to do with fork()/exec(), but rather is a deliberate design decision made with the addition of paged virtual memory, to support a limited class of applications, that probably didn't work very well even for that class.

<comment><USER10> The proper selfish thing to do is lock all of your pages immediately after allocation.

[https://linux.die.net/man/2/mlock](https://linux.die.net/man/2/mlock)

</comment></comment><comment><USER15> I see a few people complaining about oom killing. Allow me to make a case for it. I think oom killing is a very pragmatic solution to deal with low memory. Without overcommit you don't need the oom killer. But just simply disabling overcommit will make your system unusable during low memory situation just as much. Imagine that one job ate all your memory. How do you restore your system? You cannot allocate more memory so you can no longer start up a new shell to kill the bad process. So you are just as stuck with an unusable system. I wrote about this here: [https://superuser.com/a/984715](https://superuser.com/a/984715)

What I really want is to have an always responsive system. You cannot get this easily on linux because it doesn't allow to disable all paging (executable pages are still paged out even with swap disabled). This means you can easily lock up your machine if you use a lot of memory (even without swap -- I don't use swap). The above post contains a 20 line C program example that will break your system that you can only cure by applying the oom killer. I mean what other options do you have you have 0 free memory? Could a kernel hacker reading this add such an option to linux to a poor sysadmin like myself?

</comment><comment><USER16> "What if we copied the entire address space of the program into a new process running from the same spot"

This was actually the cause of 1-2 second blocks in our Node event loop. We were spawning a clamd scan asynchronously, from a process with several gigabytes of RSS. I never would have imagined that fork would blindly copy gigabytes of RSS every invocation. I should have known. It took a few months to track down.

The kicker is that Node calls fork from the main event loop thread and not from the thread pool, in order to hack around the GC, if I understand correctly.

See the relevant Node issue here:

[https://github.com/nodejs/node/issues/14917](https://github.com/nodejs/node/issues/14917)

<comment><USER17> fork() doesn't copy the blocks -- they're CoW -- but rather the time it takes is in setting up the CoW table. You can mitigate this if you tell clone(2) that the only thing you are going to do right after creating a new process is execve(2) so don't bother actually creating that. I see that mentioned at the end, but with the question of whether the setup is also combinable (it probably is).

<comment><USER18> I'm not quite sure, but I think I remember reading that CoW (Copy on Write) was not there in the earliest Unixes. Might have been implemented at Berkeley some time later. Seem to remember reading this some years ago when reading about fork, because without CoW, fork's copying was expensive, particularly if you were going to exec another program in the child just after forking.

</comment></comment></comment><comment><USER19> Imho what the author is either missing on voluntarily ignoring is the context in which the original Unix was developed: as an unofficial, simpler version of Multics, after the Multics project had failed.

So my guess is that Thompson and co basically went with a "worse is better" approach and delivered a model that performed worse but was a lot simpler to implement and reason about.

Also... It's easy to criticize designs 40 years after. That time was a time of proposals an research. Despite this, the original Unix design, no matter how flawed, stood the test of time.

</comment><comment><USER20> I have always wondered about Linux's overcommit feature, which BTW I dislike -- Doesn't ISO C require that if malloc returns a nonzero pointer, it has to backed physically (need not be RAM, could be swap on disk or some other thing). I have been told that the OS is allowed to overcommit but space obtained through malloc needs to be backed, if it has to comply with ISO C. Apparently AIX and ISO committee got into some argument about this when AIX's malloc implementation allowed for overcommit, anyone remembers this ?

<comment><USER21> You can always disable it using 'sysctl -w vm.overcommit_memory=2' or have more control with vm.overcommit_* various sysctls. In the general case, I found that overcommit is usually more useful than strict accounting, but I agree that for more industrial cases it can be the opposite (but then you can spend time tuning it).

<comment><USER20> Oh! of course. I was seeking comments on whether it is true that this behavior is not ISO C compliant.

I understand why this behavior is default, if you __have__ to support fork() this perhaps the more pragmatic default.

</comment></comment></comment><comment><USER22> If it doesn't exist already, there should be a "standard spawn stub" that, in absence of spawn it creates a new spawner process at the very beginning of an application start up, so when you do spawn, the spawner process is the one that forks with none of the copied memory and open file descriptors.

> That this nearly 50 year old crappy design choice has come to this > astonishes me.

That makes me feel old. For me Unix was always invented 30-something years ago...

<comment><USER10> Hopefully Unix will be 100 years old someday.

</comment></comment><comment><USER23> fork has two uses. One is to run a bunch of child processes that the parent can control and hand work to. Think web workers in apache2 with the parent accepting connections and the children processing the requests.

The other is to start unrelated programs. Think bash which can start vim.

I think for the first use case, it is stupid to have to reap the child process or else it gets inherited by init. Instead you should be able to mark that process as a worker from the get go. It doesn't make sense for apache2 workers to keep running if the parent process died.

In the latter use case, I agree with the OP. I'd rather set up the structure of what I want to happen, then start that process as a completely independent thing. spawn seems like the way to go for this.

The good news is that we can totally have all those options as long as we keep fork as is at least for the next 50 years :)

</comment><comment><USER24> Really POSIX should just acquire CreateProcess and have done with the problem. It's the API you generally want when starting a new, unrelated program. Probably for POSIX you'd want to allow specifying which handles become the new process stdin/stdout/stderr, since Windows handles consoles in a stranger, less convenient way.

[https://msdn.microsoft.com/en- us/library/windows/desktop/ms6...](https://msdn.microsoft.com/en- us/library/windows/desktop/ms682425\(v=vs.85\).aspx)

<comment><USER25> What happens if you want the child to inherit other fds? Or set other attributes such as the session, euid, egid etc?

The elegance of fork() is in avoiding the complexity of requiring every attribute of the process to be explicitly stated in order to create a new process. We simply inherit our parent's attributes and if that turns out not be desirable it is fixed in the child with the usual syscalls.

EDIT: s/And/Or set/

<comment><USER26> I'm not positive that it's elegant. It may also be considered an ugly hack (not sure either), and I'm pretty certain it's been responsible for many security holes.

It would be interesting to see in what ways Unix (especially shell scripts) would be different if processes would not inherit all the baggage by default.

<comment><USER27> There's a very, very fine line between an elegant solution and an ugly hack.

<comment><USER26> It may be not fine (your sarcasm was noted) but I still don't see it in this instance.</comment></comment></comment></comment></comment>


Noam Chomsky: American hates its poor - <AUTHOR> http://www.salon.com/2013/12/01/noam_chomsky_america_hates_its_poor_partner/ <comment><USER2> I'm seeing an influx of those social justice posts, and even straight-up American politics. Apart from the whole off topic issue, they're not very good.

For example this post. Your vote doesn't matter because of maths, not some evil Republican plot. There's too many of you for any single vote to have much sway. Same with those impediments to voting, in pretty every civilised country you have to show an ID to vote. I personally don't like the whole "here's your number, here's your ID, without it you may as well not exist" and certainly you won't be using any modern amenities but this is the reality of mass society.

<comment><USER3> Looking at your submission history, you certainly have no problem posting articles about politics and things that are off topic.

\- On Swedish Billionaires (National Review)

\- Why Not Protect Workers from Customers? (Library of Economics and Liberty)

\- The War of Rape (Washington Monthly)

\- Why climate change is good for the world (Spectator)

\- US laissez-faire serves a greater global good (Overcoming Bias)

<comment><USER2> It seems that way because you only skimmed the titles. For example, the one on Swedish Billionaires is a factual correction of an article that was popular on HN earlier but wrong.

The War of Rape is neither about war, rape nor politics. Funnily, it's about false stories never being corrected later.

<comment><USER4> Wha? The war of rape is about Jamie Leigh Jones, specifically about rape, and contains gems like "The best official estimates suggest that between 8 percent and 10 percent of all rape claims are false"

</comment></comment></comment></comment><comment><USER5> For me, what I dislike about Chomsky's analysis is that he conflates things that might reasonably be called class war (like campaigning for lower taxes for the very rich and for lower welfare, or various kinds of rent seeking by big businesses) with things that are just the free market, like outsourcing jobs, and paying market wages.

</comment><comment><USER6> IIRC Puritanism connected being "unlucky" with being a sinner/touched by the devil so everybody tried to work as hard as possible and consequently those who didn't were seen as infectious. Couldn't this still play a role in modern every-day life in USA?</comment>


Offline-First lands in Chrome Canary - <AUTHOR> https://www.youtube.com/watch?v=Rr2vXDIVerI

<comment><AUTHOR> From the video: "This is the most significant change in the web since XHR." I would tend to agree and I'm watching this spec very closely. IMO this, more than anything else, puts web in a position to finally supplant native for a lot of users.</comment>


What should first time managers know? - <AUTHOR>

I'm putting together a course for first-time managers of software development.  two questions:
1. if you've ever made the transition from primarily coding to managing, what do you wish you had known when you started?   what were your biggest questions when you started the job?
2. as developers, what are the top two or three things you wish new managers could be taught (be nice, now)?
OK, that's three questions.  thanks in advance.   Joe <comment><USER2> Really smart people can be quite dense about money. If you want to make people happy and pay them less money here is what you do:

Give them the highest salary you think is reasonable and no benefits. No 401K match, no health insurance, no company presents like ipads or what have you.

Here is why:

We pay pretty well but it is spread out over all of the above. You might have a base salary of $150K but then we pay for 100% of your $35K/year health insurance with a top rated PPO (that's for a family of 4, we cover everyone 100%), we throw another $33K into your 401K, and we bonus you another $45K.

Total comp: $266K. What the engineer will think he makes: $150K.

If I wanted to maximize profits, rather than look out for the best interests of my people, I could pay that engineer $200K (with no benefits) and he would think he makes more. Most people seem to be like that, the year end stuff doesn't count when they think about how much they make.

</comment><comment><USER3> When I made the switch to Engineer to Management, the hardest but most useful skill I learned was to let people fail. This may sound odd, but as a manager your job isn't "To Do", its "To Delegate(manage)". Everyone fails at some point, and remember that your a manager, you shouldn't be coding, spinning up servers, or anything else like that. Your job is to hire competent people that work well together and with you.

When I talk with our techs about their tasks and work loads, ALWAYS say what do you need from me. I make it clear that I expect the deliverable to be done right and on time. It is their responsibility to speak out and say I am having problems with X, or I am unable to complete Y because of Z. A managers job is to get your employee's the resources they need, or to find a suitable alternative if that's not possible. My job is NOT to jump in the trenches and start coding unless its to prevent the companies certain demise or to save my employee's sanity during an unexpected surge of work.

This was my hardest challenge when a manager, and in hind sight, what I wish past managers would have known. My best manager knew this and is where I learned this from.

<comment><USER2> +1

I worked with a guy who got promoted to manager at Sun and the first thing he did (while we were all laughing at the idea of the idea of him as a manager) was to walk into our office and say "Hey, dude, you are working for me now. It's gonna be fun. What stuff do you need to get more shit done, I'll get you that."

We all stopped laughing because we all needed stuff. He got us that stuff. Great guy.

</comment></comment><comment><USER4> 1) Don't underestimate the Human Connection factor. You've got to learn how to take your peoples emotional temperature and deal with it. Recommend Stuart Diamond's Getting More >[https://www.youtube.com/watch?v=ZOZo6Lx70ok](https://www.youtube.com/watch?v=ZOZo6Lx70ok)

2) In dealing with individuals Competencies & Skills, wish I found the FYI Book much earlier: [http://www.amazon.com/gp/product/0974589233/ref=x_gr_w_bb?ie...](http://www.amazon.com/gp/product/0974589233/ref=x_gr_w_bb?ie=UTF8&tag=httpwwwgoodco-20&linkCode=as2&camp=1789&creative=9325&creativeASIN=0974589233&SubscriptionId=1MGPYB6YW3HWK55XCGG2)

<comment><AUTHOR> the FYI book rents for $60 on amazon and sells for over $100. looks great though. thx.

<comment><AUTHOR> ...and $3.60 on thriftbooks. Win to thriftbooks...

</comment></comment></comment><comment><USER5> I've had a development background and then became Producer at a small indie game studio.

I was always wondering

1) What exactly I should be doing while development is happening? (Hint: QA/generating issue-reports) And am I micromanaging too much?

</comment><comment><USER6> I definitely recommend reading and learning from pg's _Maker 's Schedule, Manager's Schedule_ \- [http://www.paulgraham.com/makersschedule.html](http://www.paulgraham.com/makersschedule.html)

I'm definitely a Maker type of person (I score 22% Fast / 78% Slow on this Pace Indicator I use [1], which is similar) so a mid-afternoon team meeting can ruin my day.

[1] [http://www.inside80performance.com/](http://www.inside80performance.com/)

</comment><comment><USER7> Remove obstacles for your team (don't be the obstacle) Let your team know you have their back - defend them from ridiculous requests and protect them from burn-out.

A good manager can step away from their team for a few days without things falling apart.

The hardest thing to learn is to address problems early - nip it in the bud. Learn to delegate and plan for / foresee future problems before they impact your team.

</comment><comment><USER8> I received some advice when I first started managing folks, that has proven very valuable to me:

"If someone does a job 70% as well as you would do it yourself, you should approve their work."

It's sometimes referred to as the 70% rule.

</comment><comment><USER9> I saw a good quote re (1) the other day. "It's not a promotion, it's a career change."

I'd recommend treating it as such.

</comment><comment><USER10> Just list down the things you didn't liked about your Managers and don't do that..</comment>