Hard Truths about Programming - <AUTHOR> http://anna-oz.tumblr.com/post/158300535300/hard-truths-about-tech <comment><USER3> Who would be peddling the myth that programming is easy? Those who sell boot camps of course but who else?

I like to liken it with playing an instrument. It's easy to make sounds but how long before someone will pay you to play for them? That's programming (and sports, and cooking, and any other craft that is superficially easy but deep and complex crafts to perform professionally)

<comment><USER4> I sometimes do. I understand and agree with the authors point. On the other hand, I feel like I'm well paid in a very comfortable job for doing stuff I already liked doing. I will likely never get fired from this job and have numerous other offers without looking. From that perspective, a job in programming is "easy".

I'm not missing that there are hard things and to be honest, today is a particularly difficult day, but I understand when people say it's an easy career path.

<comment><USER3> Yeah I also think I have an easy life/career but I'm already an experienced dev. That we get paid handsomely to have a comfortable career is, I think, a sign that the job is hard, not easy. Pro athletes live pretty comfortably too - it's getting there that's hard.

</comment></comment></comment><comment><USER5> Edit note: Some of the points in this article are really good so this is mostly just a rant on coding bootcamps from a bitter Computer Science grad who had to work 20 years to get where I am :)

Meanwhile to some of these points... we had a client recently where we built their mobile app. Large app, over $50,000 with a full API backend. Not a simple hello world. And then they hired someone straight from a boot camp to manage their mobile app, API, website, everything. And gave that person a Director title.

Yes, I know, titles are cheap at startups. But I guess you can learn to code in three months and not only get a job but apparently be director level.

<comment><USER6> Amateur mistake ;)

Truth be told: Titles are meaningless, the only thing that matters is the pay.

Giving impressive titles is simply a very cheap and efficient way to make naive young employees feel important and valued, while really they are not.

#ForwardDeployedEngineer

<comment><USER5> Until you have to hire more team members in which case you may have a problem. That is how companies get absurd things like three different technology VPs and a CTO in a 10 person company. (exaggerated obviously)

<comment><USER7> Or your environment is an absolute flaming disaster but your manager gives you a bad review because they don't understand why someone would want to write unit tests to run across distributed databases to confirm consistency and correctness. So, your environment remains in a broken state, reports have wrong numbers, and development moves at a snails pace because of constant issues. And the person that actually knew enough to identify and fix the problem is fired for insubordination.

<comment><USER5> Or that...

</comment></comment></comment></comment></comment><comment><USER8> Some more truths:

People look down on IT people.

Your boss wants to outsource your job.

You'll be mostly doing "plumbing" with data.

You'll make far more money from a dumb audience than a smart one.

<comment><USER9> I specially like your last point, and you will make even more money if what you produce makes them smarter.

It is all the point of IT: increase the human capacities (computation, data handling and understanding, productivity, communication...). People who already master all of that do not need you so much.

</comment></comment><comment><USER10> I was struck by the following passage:

"Job search in tech is extra long and frustrating:

For tech jobs add about 3-5 more interviews + technical tests, online and onsite, if you even make it past the first step because a lot of times you will never hear from a company after sending in your application, or the company will stop responding to your emails at some point in the interview process. The tech hiring process also seems to take about 3 times longer than in other industries. Brace yourselves!"

Sadly this is a very common refrain. And unfortunately this is now true even if you have years of experience. Hiring is just plain broken. Full stop. This is also a fairly recent development in the industry. The hiring process was not broken like this 8 or even 5 years ago.

It's sad that an awful and unprofessional experience is now the norm and something that should be expected. I blame recruiters for much of this unprofessionalism but I also blame the companies that either permit such unprofessional behavior or else are simply unaware at how bad or broken their process is.

Its strange that the industry seems to have whipped itself into such a neurosis about the possibility of "false positives" that it has created a uniquely miserable experience that seems to embrace absurdity and disrespect as a matter of course.

The fact that industry seems to collectively trend hop - Whiteboarding! Take home projects! Hacker Ranks Tests!

This "everyone else is doing it" mentality only serves to perpetuate this.

<comment><USER11> > It's sad that an awful and unprofessional experience is now the norm and > something that should be expected.

That's because there are a lot of awful, unprofessional programmers out there trying to get jobs and we need a way to filter them out. Even then these methods only filters out the worst of the worst, the developers that can solve fizzbuzz level problems. We either have to put up with this or have some sort of industry certification.

>The hiring process was not broken like this 8 or even 5 years ago.

All of this was happening 8 years ago, it was even worse then with "why are manhole covers round" levels of stupidity.

<comment><USER12> _That 's because there are a lot of awful, unprofessional programmers out there trying to get jobs and we need a way to filter them out._

Agree. After being told a couple of times how happy <company> are to finally see a real, competent programmer when I enter the room and just answer simple questions I've come to accept that there must be a few people out there pretending to be programmers in their applications.

 _Even then these methods only filters out the worst of the worst, the developers that can solve fizzbuzz level problems._

Well, the problem is that the sum of these methods (clueless(?) recruiters, keyword filtering etc) often filter out me before I even get to an interview.

The ones who hire me tend to be very happy though :-)

<comment><USER11> > After being told a couple of times how happy <company> are to finally see a > real, competent programmer when I enter the room and just answer simple > questions

One of the more depressing experiences I've had is heading into an interview (on the interviewer side) after seeing someone completely fail a fizzbuzz test. Everyone looks at each other thinking "well maybe if they knock it out of the park during the interview...". It's like dating as an extremely lonely person.

> Well, the problem is that the sum of these methods (clueless(?) recruiters, > keyword filtering etc) often filter out me before I even get to an > interview.

I've never had a problem with this, except maybe lately with angular. I structure my resume to include the keywords but in a format actual hiring managers want to see, eg, Experience with a number of MVC frameworks including ASP MVC, Monorail, Ruby on Rails (ROR). I don't know if that's the reason it's never been an issue for me, but I hope it helps.

<comment><USER10> >"One of the more depressing experiences I've had is heading into an interview (on the interviewer side) after seeing someone completely fail a fizzbuzz test. Everyone looks at each other thinking "well maybe if they knock it out of the park during the interview...". It's like dating as an extremely lonely person."

This is exactly the situation that a recruiter _should_ be preventing. That person shouldn't have made it through door. Your process was broken.. Unqualified people applying for jobs is not unique to the tech industry.

<comment><USER11> The interview was immediately after the technical test, it's either that or you have to schedule people to come in again, which wastes the time of the good candidates.

</comment></comment></comment></comment></comment></comment><comment><USER13> I'm trying to teach myself foot juggling (a.k.a. keepie uppie), fundamentally it's not hard, it just takes a lot of practice. Many of my friends growing up were really good at it. I could never understand how they were so good and I couldn't do it at all.

I'm not sure whether programming is hard or not, but when my friends were practicing keepie uppie in their back yards, I was practicing programming

There are concepts that are hard to understand in the abstract, but one of the things that a good programmer has practiced is how to understand those kinds of concepts

10,000 hours is an overly literal idea, but IMVHO the core requirement for a large amount of intentional practice is the most significant hard truth about programming

</comment><comment><USER14> Hard? I never finished a paid project in Grad school because of a compiler error (PL/I 'copy like' bug).

On my first job they gave me a paper tape containing the binary to control a robot... no source available... and I had to fix a bug that caused the robot to do something wierd (atan 0/0) on a computer with no "developer software" (aka no compiler, libraries, etc. ... just a raw machine with a front panel of switches).

On my second job I spent a couple days trying to figure out how a tape drive delivered duplicate records (worn tapes caused hardware 'reread').

On my third job I spent a week tracking down a memory error in a mainframe memory that caused many crashes on a computer used by over 70 programmers (every crash resulted in hex listing of 4 megabytes of memory (2 ft stack of paper) delivered to me).

On a later job I had to hand-recover a hard drive that contained all of our software when the "extended second drive" died, causing the machine to fail to boot (had to write code to read the raw drive by controlling the electronics).

I was nearly fired because a C compiler contained a bug that took me a week to find (bad code generation). The boss thought I was unable to program and had no idea what a compiler was, only that my project was late.

One boss was newly promoted. She forced me to end a several-year research project, threatening to fire me if I didn't. She was fired for the threat but I still lost the project.

One boss decided to fire me so he lied on my performance report. He falsely quoted comments from other managers. Even when the other managers called HR and gave me glowing reports HR refused to change the result. Prior to that all of my reports were highly rated.

At one job the whole project (fixed cost, 5 programmers for 5 months) ran long (10 programmers 18 months) and they fired all the programmers.

One of my open source projects forked twice in one week over a dispute about goals, with the side-effect of destroying the community.

One of my jobs was to take over code from a programmer that died. He used the GCC -MM option to automatically generates C++ makefiles for code which generated C++ and then generated makefiles from that code. Not a line of comments anywhere.

That C++ code generated classes DURING THE CALL SETUP of a procedure (who knew you could do that?) so classes that occur nowhere in the software "appear" magically at runtime. Again, no comments anywhere.

I spent a day applying the brand-new "Design Patterns" to our software on my whiteboard. The chief designer saw it, got angry, and I got fired.

I was hired to move teaching software (400 Flash Videos) from laptops to the new iPad... and then Jobs announced that the iPad would never run flash. Goodbye job.

I maintain open source software that has run on Unix-based systems since the early 80s... and then stopped working because GCC switched to a "new C standard" that changed the meaning of "inline", breaking the build everywhere.

I was hired to write "pinch zoom" for a touch display and camera setup. The camera driver only worked on Linux, the touch display driver only worked on Windows. Neither manufacturer would port their driver, nor release their driver source code.

My AI project required recognizing lugnuts... did you ever try to find "big data" for lugnut images? Or try to create a "big data" dataset?

I taught Data Structures at a University. At a Google "job interview" I failed to remember the complexity of an algorithm... and never got the job offer.

I have many more "war stories" but they all have one thing in common. Programming isn't hard, in fact it is often the only joy on the job. But being a programmer is really hard for a lot of reasons you won't find in boot camp.

I love programming. I turned down 8 job offers to become a manager (or, as I say, "retire into management"). I love programming. I do it every day. And every day is another day of frustration except for the final hour when it all seems to finally be working... and then back to programming and frustration, bugs, hardware crashes, lost data, impossible tasks, really late nights, and clueless bosses.

But I have done it for 46 years and never once had any regrets about programming. Programming is the easy part.

<comment><USER15> > I taught Data Structures at a University. At a Google "job interview" I > failed to remember the complexity of an algorithm... and never got the job > offer.

The large majority of applicants at the big firms are not hired so this may be entirely unrelated to your outcome. But surely somebody who has taught data structures could analyze an algorithm rather than needing to simply remember the runtime complexity, right?

<comment><USER12> _But surely somebody who has taught data structures could analyze an algorithm rather than needing to simply remember the runtime complexity, right?_

IDK but it sounds like he failed to remember it on the spot and didn't get a chance to analyze it.

<comment><USER14> Yes, I can derive more than just the worst case complexity (which was all he wanted) as I did in class. But the interview was short and the interviewer had clearly just graduated from college where Data Structures was probably his last class. I can't really call it an interview as none of the interviewers bothered to look at my resume despite having brought a copy with them. It was really just a "pro-forma pop quiz" and a waste of time. They did give me a free Google t-shirt as consolation prize.

</comment></comment></comment></comment><comment><USER16> I think the biggest source of confusion is the question of semantics. When people sit down, even here in this thread, there's this distinct undercurrent where neither side has a clear idea what the other means by "hard" and "easy".

Programming is "easy" in the sense that you don't need to be a savant to do it. A lot of software development is built ontop of very well designed tools and abstractions which means you can work (in some fields) with computers without having a college understanding of higher level maths or electrical engineering. Programming is "easy" in the same way any trade is easy. With instruction and practice most (if not all) people can learn to some degree of professional competency. In the same way one might learn to become a plumber or an electrician a student can learn to be a "developer" (this I'd argue is separate from a "computer scientist").

On the other hand programming is "hard". It is "hard" in the sense that it's completely alien from most people's day to day. In the same way most people don't think about what it takes to wire a house to code, operate a lathe, or fix a broken pipe, most people don't ever need to think about SDLC or debugging strategies. Programming is "hard" because if you try to learn from fundamentals you quickly exit the nice tools and abstractions that make the professional world go and into the maths that are considerably less trivial. Programming is "hard" because of a cult of people determined to ignore the above reality and tune interviews to be time intensive and rely almost exclusively on your knowledge of university concepts as opposed to day to day tooling.

I think it's important to remember that the field is still very nacient and the responsiblities under "programmer" still vary widely from job to job and industry to industry. Until this matures, a better jargon is developed for describing roles, and a more realistic attitude is reached in terms about what skills are needed for said roles I don't see how we can avoid sending mixed messages like the ones that frustrate the OP.

</comment><comment><USER17> Is programming really that hard, if you compared it to learning another skill as an adult? Like having to learn to read?

</comment><comment><USER18> I really don't wanna see pretentious here, but does anyone actually think autodidactism is hard?

I have diagnosed and unmedicated ADD and I can still self-learn without too much difficulty.

Again, I don't wanna sound too full of myself, but is any of this stuff really as hard the author implies?

<comment><USER19> As somebody else with diagnosed and unmedicated ADD, what do you do to manage it?

<comment><USER18> The number one tip I always give is to write down everything you think off when you get off topic and start drifting around. I don't know what's happening neurologically, but it trains you to snap back once your train of focus breaks, it might not work for everyone, but I got pretty good results. It's also helped me with forgetfulness.

I use apple's native note application, but evernote looks about the same or better.

FYI: it'll take a couple weeks to start working

<comment><USER12> _The number one tip I always give is to write down everything you think off when you get off topic and start drifting around. I don 't know what's happening neurologically, but it trains you to snap back once your train of focus breaks, it might not work for everyone, but I got pretty good results. It's also helped me with forgetfulness._

Another way that _might_ help some people is to write down whatever you are about to drift into, the keep focus until timebox is finished (pomodoro technique).

The best explanations I have are:

As far as I am aware ADDers tend to have shorter stacks (3-4 compared to 5-7 shortterm memory slots).

(My theory.) Many productive ADDers are keenly aware of this and the fact that if it slips now it might never come back until it is too late. This causes stress and you want to follow the train of thought even if it is unrelated to what you should do _now_.

(I.e.: oops, I see something that reminds me that I _need_ to call <x> today, I know I'll forget it as soon as I focus on my code again. Write one line: call <x> about <y>. Continue work. When your timer finishes: do call <x> immediately after stopping work (somewhat different from pomodoro but adapted for this kind of ADD).

So in short: if you can, write down the interruption, then finish whatever you were doing but use a "timebox" to remind yourself to stop, "snapshot" your work (comments, journal, commit as far as possible) and then take the call, stretch, grab the water or coffe you tried to interrupt yourself with and be on track again.

Of course this is the ideal flow. I have sympathy for people with ADD as it seems they have to work harder and smarter to get the same results as others.

</comment></comment></comment></comment><comment><USER20> I think it's hard, not for me mostly, cause I love it.

But I tried helping out a friend with simple assignments and the concepts are just way off too what someone is used to.

Same with someone doing wordpress, I do the servers myselve. Which is way too much info to share... ( Other OS)

</comment><comment><USER21> I don't know if anything similar exists in other coutries, but in France there is a growing "workshop" trend - which are basically short web curriculums (a few weeks learning Rails, jQuery, Symfony or others) - to turn anyone into a "developer". I've heard many salesmen or others saying "I will learn it". They don't realize how hard it is. You can't simply write any program with pyramids of jQuery callbacks. You need automated testing, fuzzy string matching, automata theory, murky x86_64 assembler and much more.

</comment><comment><USER22> not sure that many of them are truths. Seems more like like millennial speak. "Things are hard!" no...relative to you and your experiences it might be the hardest thing you've gone through, but in absolute terms, they aren't hard. Learning programming has never been easier. Us oldtimers can tell you stories about "Hard".

<comment><USER5> As a millennial I reject that categorization and we need to stop using it. Millennial is too broad. I'm a millennial and I learned to program in the mid 90's from actual paper books. I share almost nothing in common with the people graduating college right now.

Edit: Also, for every "life is hard" millennial I have met many hard working, extremely intelligent, and charitable ones. Some of whom need to work multiple jobs dealing with the fact that our generation has almost no upward mobility unless you do something like learn to code. The fact that a terrible houses cost amounts of money that years ago would get you a mansion (even when adjusted for inflation) and where spending $100k on college does not even remotely guarantee you a job. Where pensions don't exist and retirement is a pipe dream. Every millennial I know over 25 has been laid off, some multiple times.

Edit 2: furthermore, in the United States, my generation has never known a time where we were not at war. And we are the ones being sent to those wars.

<comment><USER22> the categorization is statistical representing common patterns, it's not defining the traits for all individuals.

I don't live in the US... perhaps vote for someone who will help change it to a better system?

<comment><USER5> I wasn't the one generalizing all millennials. The post I was replying to was. My post is specifically about not generalizing.

Also, to think one person (the president) can magically fix decades of compounding problems is naive. It's also naive to think we are isolated from the rest of the world and we can magically unlink our economy from it. With that said, about 50% of millennials voted last election and 83% are registered to vote. So I'd say a large number of us did vote for the person we think will change things.

Edit: and almost without exception the millennials I know who didn't vote did it because they felt neither candidate was acceptable.

<comment><USER22> you were claiming that a generalization doesn't hold for specific cases... which will never invalidate a generalization, because a generalization works "in general" not for specific cases :)

you only get to vote for the president?!

do you live in a democracy where you can vote to get things changed? or perhaps people in america just like it that way.

maybe it is naive, but other democratic countries are moving ahead with more progressive ideas.

<comment><USER5> > you were claiming that a generalization doesn't hold for specific cases... > which will never invalidate a generalization, because a generalization works > "in general" not for specific cases :)

Very true

> you only get to vote for the president?!

We vote for the president, senate, congress, and local representatives. We rarely vote for individual issues (like say Brexit) on a national level, those are usually decided for us.

> do you live in a democracy where you can vote to get things changed? or > perhaps people in america just like it that way. maybe it is naive, but > other democratic countries are moving ahead with more progressive ideas

America is a Constitutional Republic not a true democracy. We don't even get one vote per person. Our votes are broken up into statistical areas that are winner take all. And I can assure you that many Americans don't like it that way but it is very difficult to change in a two party system. Which is why many people (millennials more than any other group) are pushing to end the 2 party system.

</comment></comment></comment></comment></comment></comment><comment><USER23> From the outset, Programming is hard. Anyone who says it is easy is missing the salient point of programming.

That salient point is that you as the programmer have to gain an understanding of the target field you are programming for. Programming is about solving problems for someone, not just writing code to a specification.

A lot of the comments, so far, are talking about programming languages, programming tools, programming frameworks.

These are NOT programming, these are the tools you use to program an adequate solution to your problem. Unless you are continually gaining knowledge in every field that you are programming for, you are staying a novice. This does not mean that you have to be a subject matter expert, but it does mean that you have to gain enough knowledge in that field to be able to provide a solution for the subject matter experts (or others that will be dealing with your solution in that field).

Too often, I have found that "so-called gun programmers" have not only NOT understood the the field they are providing a solution for, they dictate what that field is supposed to "put up with".

I have spent nearly 40 years programming and I have come across many people who can churn out code much faster than I, but many of those cannot provide an adequate solution for the problem at hand. They cannot and have not been taught to think outside the "box".

I have also worked with many who cannot churn out the code but what they do give you is (at the minimum) an adequate solution to the problem at hand. They effectively solve the problem as it actually is.

Many years ago now, I took over the maintenance of a small system that was being used by 6 or so people. By the time I was finished, it was handling 60+ people simultaneously in at least 7 different fields for a single telecommunications project. The reason I tell this is for the following:

The base system in use was that venerable old girl, MS-Access 2000. This was one of the constraints of the system.

The original programmer was a highly paid foreigner (British) who basically told the subject matter experts that this was how they would have to work.

Part of the process I undertook was to find out what and how they needed to work and rebuilt the system to do it appropriate to the needs of the project. The satisfaction and appreciation was very encouraging.

Once this was seen, each of the other functional areas wanted to get on board. The application was then expanded to include these additional groups.

I got various complaints from various people about how hard some of their tasks were because MS-Access could not do want they needed. They had been told this by management. Finding out what they needed became the incentive for providing a solution. That meant for one person, I cut their after hours report production down from 3 to 3.5 hours every night to about 3 minutes (included production of reports, formatting, emailing to international management, emailing to national management and local report printing). His wife and daughter were very happy to get him home at night at a reasonable hour.

Programming is understanding the problem at hand and providing a workable, efficient solution using the tools at hand. This means that you have to be able to understand the subject field with enough detail to provide that solution and make it easy for the end user to use.

Early in my working life, I had people who encouraged this mindset and multi- discipline learning. Not everyone is capable of this, or even wants to do this. This then leads to the shmozzle that is the industry today and its continuation is the outworking of many of the major IT industry players who are interested only in the easiest way to make a profit.

Programming is hard because you have to become a "jack of all trades" as well as an expert in your own. You have to be able to document all the assumptions that have controlled your development activity, the "whys and wherefores", the paths taken and in some case the paths not taken and why. Too many "programmers" think that documentation is not really needed. They are happy to show off their "tricks" to enhance their reputation as good or great programmers, but anything too hard to do is left for some other shmuck. To those of us who are tasked with expanding, maintaining, correcting or even rebuilding applications, we find that the lack of intelligible documentation just makes the entire process that much harder. It does then behoove us to provide said information.

I have extended family members still in their teens who are recognised as brilliant programmers, yet they fail to appreciate that knowing programming languages, frameworks, tools and toolsets is only the beginning of the process to becoming a good and maybe in the future a brilliant programmer. My job as an old programmer is to expand their multi-disciplinary education is as many ways as possible, so that they become much better than me.

Programming is hard and it is not what a lot of programmers believe it to be. It is much much more.

</comment><comment><USER24> Most points seem pretty obvious honestly. Hard to tell if this isn't just low afford clickbait (sorry if it isn't)

<comment><USER25> You're not the intended audience for the article.

There's plenty of people for whom it's not at all obvious - in particular, people who're being sold educational materials and courses so they can get those big tech salaries.

<comment><USER24> I see how those could fall for that miss information but I fail to see that someone serious is even telling these

</comment></comment></comment><comment><USER26> Can we stop with this "programming is hard" business? In a CS program, the programming classes are going to be the easiest ones you'll do. The hard stuff is the math, theoretical computer science and algorithms.

<comment><USER27> Your statement is valid but your conclusion is wrong. The programming classes will be the easiest one but the average graduate still produces absolutely terrible code, in my opinion. Even my own code from when I was a student wasn't what I would accept as a manager now.

Software development is so difficult that it's hard to teach and most students don't get it -- consequently the classes are far easier than they should be.

A large number of CS graduates can barely program at all.

Being a good developer requires a lot of experience.

<comment><USER28> The lack of emphasis on software engineering/programming/implementation at my program has been an ongoing complaint of mine. I went to school as an adult, so I know what the workplace needs and I know a lot of universities are missing a critical component of that.

Do you have any preferred resources for getting up to speed on the software engineering side of things? I'm picking up stuff here and there, but always looking for more or for convergence.

<comment><USER27> I went to a very good school for my computing science degree and they spent a good amount of time on software engineering.

But one of my coworkers is going to a terrible school and I'm literally _appalled_ at their degree program. Without going into too much detail, it's just _awful_. Anyone taking that program would be better off taking their time and money and learning on their own.

My coworker is very talented developer; she gets A's without going to class and she is specifically going to _this_ school to get an _easy_ computing science degree while working full time.

A good school should teach the foundations of software engineering; what I learned in school was a good foundation for everything I've done since. We learned about agile. We did an entire semester long waterfall project (teaching by explicit example why the waterfall method is terrible). I suspect it's even better and more modern now.

I don't know if there is a good convergence of information. I don't think there is no one-true-way to do software engineering yet everyone proposes their own singular method. The best way to go is often to pick a little bit of experience from everywhere.

</comment></comment></comment></comment><comment><USER29> Okay I'm being serious here. I'll comment on the main points because I feel like they're pretty much all wrong.

"Learning programming is hard" I just kinda rolled into it as I grew up.

"Self-directed learning is hard" It's automatic for me. I'm interested in things.

"Attending one workshop or a couple won't turn you into a professional developer." Well yeah. Does anyone think a couple workshops turn you into a professional blacksmith?

"It takes time: You won't become an developer in 3 months." Fair enough, though I think if you study full-time, have fun doing it, and have a friend helping you a few evenings a week, you can probably be good enough for a junior position by 3 months.

"Finding your first developer job is hard." Is it? Haven't heard that from people.

"Finding any kind of first job in tech is hard." Yeah this definitely isn't.

"Tech interviews are terrifying." Not really. I'm generally nervous for interviews, but not more than is healthy I think.

"Job search in tech is extra long and frustrating." What planet are they on? I hear bad stories about people that did psychology as a study, but tech?!

"Some people won't make it." Fair enough.

I've stopped reading there because I just can't see what the author is getting at. Is this just me? Or is it perhaps applicable to Silicon Valley specifically, where developers are abundant (are they?)?

<comment><USER30> To be honest, I think in this case it might be just you. Not everyone - <USER2> perhaps in this case not most people - experience(s) the things listed here same way you do. (As a corollary, just because you find something obvious doesn't mean most people or everybody does.)

Plus, you're not really disagreeing with the points raised. You're just providing one point of anecdata, your personal experience, and saying "yeah this can't be right."

<comment><USER31> Agreed, learning programming (even in great classes under great guidance) is obtuse if not largely inaccessible to lots of people I know or have heard of.</comment></comment></comment>


Airbnb owners rush to offload their homes, Redfin CEO says - <AUTHOR> https://www.marketwatch.com/story/vacation-real-estate-markets-are-toast-because-of-the-pandemic-as-airbnb-owners-rush-to-offload-their-homes-redfin-ceo-says-2020-05-11 <comment><USER2> The article is actually about Redfin and how they're reentering the home flipping business. It's a business that requires a lot of capital and risk, completely different from software which has high margins. Also every housing market is different, which makes it even harder to know if you're paying the right price for a property.

If AirBnB owners are truly selling in mass quantities that would be interesting but the Redfin CEO is going to have a skewed perspective since Redfin is currently a buyer.

</comment><comment><USER3> Previous discussion: [https://news.ycombinator.com/item?id=23142355](https://news.ycombinator.com/item?id=23142355)</comment>


Shipping Containers as Tiny Homes - <AUTHOR> https://www.bloomberg.com/news/articles/2017-03-16/now-you-can-live-in-a-remodeled-shipping-container <comment><AUTHOR> Heather and I build these; happy to answer any questions! -Luke

<comment><USER2> @Luke - A few years back I looked at opportunities to resolve the issue of having surplus containers stacking up largely in U.S. ports due to trade (import/export) imbalance. As you probably know, it turns out that its generally cheaper for Asian companies to abandon containers overseas and simply fabricate new ones than it is to book a return trip for an empty container. So, the continership capaciy surplus (rcord cheap shipping rates) coupled with a trade imabalance has helped create a container surplus. Given the surplus, and knowing that nobody is going to pay $2K to ship an empty container, I would think you could get a much lower cost per unit than $2K. Is there no longer a surplus?

<comment><AUTHOR> 2k is delivered to my door. Definitely still a surplus, but they're worth _something_ as scrap: prices fluctuate directly with steel's scrap price.

<comment><USER2> Ah, got it. Sounds like as you look to scale you could probably increase your margin by doing your own trucking.</comment></comment></comment></comment>


Phishing attack uses Unicode characters in domains to clone known safe sites - <AUTHOR> https://www.wordfence.com/blog/2017/04/chrome-firefox-unicode-phishing <comment><USER2> The Unicode consortium maintains a list of "confusable" strings[0], that is supposed to be used to prevent domains being registered that are visually identical or near-identical to already-registered domains.

As far as I can see, the characters used in this attack are indeed on the list. So presumably the problem is that not all domain registrars are checking this.

I don't understand why ICANN or Verisign don't enforce this. This is hardly a new problem. Does anyone know the background to why this is possible?

[0] [http://www.unicode.org/Public/security/revision-03/confusabl...](http://www.unicode.org/Public/security/revision-03/confusablesSummary.txt)

<comment><USER3> It's not that hard to come up with legitimate domains in non-Latin script that could be recognized as word written in Latin script. For example, керас is a Russian transliteration of Keras. So I imagine they would get a bit of false positives and (fair) claims that non-ASCII languages are oppressed. To me, better alternative would be to limit puny code names to punycode TLDs, and make sure that no two TLDs look the same: task of much smaller scale.

<comment><USER4> Maybe non-latin domains should use non-latin TLDs? Or at least registrar should reserve all alternative spellings when registering a domain.

<comment><USER3> Yes, that was my suggestion: non-Latin domains MUST be in the non-Latin TLDs, with additional constraint that non-Latin TLDs cannot look like already registered Latin TLDs. In a twist of irony, Russian word "сом" (roughly pronounced as "some") means "catfish" (the animal, not the action of catfishing though).

</comment></comment></comment></comment><comment><USER5> For reference, the example is using:

        U+0435 CYRILLIC SMALL LETTER IE
        U+0440 CYRILLIC SMALL LETTER ER
        U+0456 CYRILLIC SMALL LETTER BYELORUSSIAN-UKRAINIAN I
        U+0441 CYRILLIC SMALL LETTER ES

...which are basically _indistinguishable_ from the corresponding ASCII (65 70 69 63) in most if not all fonts.

I don't see this as being an easy or even solvable problem in general --- after all, a Russian IDN registrar could rightly argue that it should be valid to use all Cyrillic characters in IDNs; but at least for those of us who are content with English-only domain names, we can just disable IDN.

I suppose one solution would be, when IDN is detected, to show both the Unicode and Punycoded versions:

[www.xn--e1awd7f.com][https://www.epic.com/](https://www.epic.com/)

One could also argue that this is also a usability feature, for easy copying of IDNs by those who otherwise cannot write them.

<comment><USER6> >I suppose one solution would be, when IDN is detected, to show both the Unicode and Punycoded versions:

That looks like the best solution. The security certificate of the site shows the punycode version of the URL. If the address bar URL and the certificate URL are different, then, at least for addresses in English, that should raise an alarm.

<comment><USER7> no-one checks the certificate readout - it'd have to be inline for regular users to see any benefit.

<comment><USER8> The least-impact visualisation could be using colors: group the characters in the domain name by script family, then use regular colors for the largest group (so that e.g. an all-Korean domain name would look just fine) and highlight those exotic relative to the rest.

<comment><USER7> or maybe just disallow mixed-charset domains. After all there's not much use for a domain that's partially Cyrillic and partially Latin. Not that I'm aware of anyway - and the rule could be more granular if there are legit uses.

<comment><USER9> see [https://news.ycombinator.com/item?id=14120372](https://news.ycombinator.com/item?id=14120372) \- this example uses all-Cyrillic

<comment><USER7> the point is that is reduces the number of potential variations. There would only be 1 or 2 possible visually-identical phishing domains for any latin domain, as opposed to potentially hundreds or thousands as it stands now.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> The rules on homoglyph domain registration need to be tightened up and enforced.[1] As usual, ICANN is soft on making registrars obey rules. That's where the blame lies.

[1] [https://en.wikipedia.org/wiki/IDN_homograph_attack](https://en.wikipedia.org/wiki/IDN_homograph_attack)

<comment><USER11> It's a hard problem. There are valid use cases for mixing characters from different alphabets. They'd need to detect malicious mixing without creating a prohibitive amount of false positives.

IMO it'd be fine if there was an automated flagging mechanism that would require manual review for suspicious domains, though. But good luck getting registrars to do anything more involved than a simple blacklist check.

<comment><USER12> Homograph detection isn't about prohibiting mixed characters; it's about considering letters that look the same to _be_ the same when checking for existing duplicates.

<comment><USER13> It's not that simple. A lot of different characters may or may not look the same depending on the typeface used.

<comment><USER12> Yeah, if I were doing it I'd probably tend to be pretty cautious - if I see any popularly-used typeface that would confuse the characters I'd mark them as homographs.

It would absolutely have to be a pretty labor-intensive, manually-maintained database.

<comment><USER13> And thus extremely error prone. I think introducing IDNs at all was a mistake given the (security) cost-benefit tradeoff, and the best solution would be to scrap them but I realize that is unlikely to happen. Domain name script is probably the last place where cultural imperialism needs to be fought, it's just empty PC posturing and a way to extract some more easy money from gullible domain owners.

</comment></comment></comment></comment></comment></comment><comment><USER14> Random ideas to solve this:

Get phishing sites on Chrome/Firefox's red-flag lists (presumably this already happens?)

Show a country flag in the URL bar based on the language/alphabet of the URL

Change the URL bar colour for punycode domains

Show a big banner the first time you visit a site that you've not visited before.

Have the browser detect and warn about possible homographs based on history.

Having said all that, is this really such a large problem that no browser has needed to solve it? I suspect the centralised malware lists are good enough, but scary demo URLs will never get onto one.

<comment><USER15> > Show a country flag in the URL bar based on the language/alphabet of the URL

Languages are often spoken in more than one country. Should amazon.com fly the Union Jack or wien.gv.at a German flag? I don't think a Russian flag for Cyrillic would be appreciated in Ukraine either.

Scripts (e.g., Latin, Cyrillic, Hangul) could get their own signifier or symbol, but that does mean disallowing (or discouraging) mixed script domains — which may not be a bad idea.

Perhaps certain scripts should be limited to certain CCTLDs and generic TLDs so that the demo URL would be disallowed in .com, but permissable in .cyrl, which in turn disallows any other scripts (including Latin). It might solve the phishing angle.

It would also solve complex cases such as Japanese (which would require Chinese characters, katakana, hiragana, and some Latin characters; perhaps the full-width set?). Perhaps put those under .日本 and allow only Latin characters under .jp.

Technically feasible, though politically untenable.

</comment></comment><comment><USER16> It's a bit weird that punycode for emojis gets rejected for .com domains, but this kind of stuff is perfectly fine. I wonder who made these decisions, and with what reasoning.

</comment><comment><USER17> The proposed fix is invalid as it will break all those sites that actually use international letters. I am looking specially at Japanese and Chinese, but I can see how you _cannot_ allow for _other language charactere_ since, for example, cyrillic has some really similar characters to latin. This is a really odd situation and there's no easy fix IMO.

</comment><comment><USER18> I think it would be useful to implement some security against this at the registrar level (until a better fix is more broadly available). For example, if I'm registering "epic.com" (the ASCII version), the registrar could suggest that I also register "epic.com" (the Cyrillic version), or vice versa. This could at least help site owners avoid phishing attacks on their own domains.

Unfortunately, this would require all the big registrars to be on board for it to actually be effective.

<comment><USER19> In order to prevent anything, you would need to register every combination of latin and cyrilic. For a short domain like "epic" this constitutes 16 domains. For a 7 character domain it would be 128 domains. In either case it would be a heavy multiplier on the base cost of the domain.

<comment><USER20> I don't think you're allowed to combine Latin and Cyrillic in a domain name. The issue is mainly that the two sets have identical looking characters.

</comment></comment></comment><comment><USER21> Wow this is an old attack. I wonder whether we could use computer vision to check for similar/confusing glyphs.

<comment><USER22> In all the cases I've seen so far, the glyphs haven't just been similar, they've been _the exact same glyphs,_ just in a different part of unicode.

I think a lookup table would be enough.

And then a rule that might be good to implement at registrars (please correct me if I'm missing a valid use case for this): if all the the unicode characters represent ASCII (or its 'duplicates'), reject the registration.

<comment><USER23> I don't think that works, "cccp" could look identical in latin and cyrillic but represents 2 different acronyms.

<comment><USER22> Oh, dang, good point.

</comment></comment></comment></comment><comment><USER24> Address bars should show punycode urls in a different color or perhaps have an option for displaying urls in ascii only (that is turned on by default for english browsers)

<comment><USER11> What English speakers tend to forget is that the problem exists outside Latin script in exact reverse: if there are non-Latin homoglyphs for Latin characters that means there are also Latin homoglyphs for non-Latin characters.

Forcing punycode representation is a hack that would help English speaking countries (you don't expect non-Latin characters in typical English language website domains) but it wouldn't solve the problem.

Also, it's not as simple as "ASCII or not": outside English most European languages use a superset of ASCII glyphs mostly via diacritics or variants. It's not useful to single these glyphs out as "non-ASCII". But these languages too are affected by the same homoglyph attacks as English.

It's a hard problem and in the 21st century it certainly won't be fixed with one-off small-scale hacks that only benefit a subset of monolingual English- speaking users.

<comment><USER5> Given that English, and in particular, ASCII domain names, have practically been the _lingua franca_ of the Internet even for those who otherwise use a different language, I don't think it's too unreasonable to say that IDN has really caused more problems than it's solved.

<comment><USER17> I don't know much about the apparently thriving Japanese and Chinese internet communities, but there's a big chunk of the internet in Spanish. I agree English was the absolutely most used language on the internet, but with cheap and global internet access I'll argue that the % of English speakers relative to internet users is lower everyday.

<comment><USER25> lived years in China, not a single time I saw advertised IDN domain, they always use regular latin domains, number domains are particularly popular, so don't really understand what's point of this option...

</comment></comment></comment></comment></comment><comment><USER26> How do I disable unicode in domains entirely for Chrome? Such a useless and dangerous feature.

<comment><USER27> > Such a useless and dangerous feature.

Useless to you != useless to everyone.

<comment><USER26> Last time you used it?

</comment></comment></comment><comment><USER28> Interestingly, Safari doesn't translate [https://www.xn-- e1awd7f.com](https://www.xn--e1awd7f.com) but it _does_ translate [http://xn-- 8q8h17eba.ga/](http://xn--8q8h17eba.ga/) to emoji in the address bar.

Chrome behaves oppositely, showing unicode for [https://www.xn-- e1awd7f.com/](https://www.xn--e1awd7f.com/) but not showing emoji for [http://xn--8q8h17eba.ga/](http://xn--8q8h17eba.ga/)

<comment><USER29> For me, Safari 10.1 does not show emoji in the address bar for that URL; both the ones listed show up as raw punycode.

</comment></comment><comment><USER30> I find the title confusing. At first I thought the post was about DNS hijacking or something similar. However, the phishing attack does not make use of identical domains but homographs.

<comment><USER31> Thanks, we updated the title from "Chrome and Firefox Phishing Attack Uses Domains Identical to Known Safe Sites".

</comment></comment><comment><USER32> How effective would a hashing solution be? Possibly with a colour code. Lastly, what about showing the number of Unicode and ascii characters in the URL so as not to get confused?

</comment><comment><USER6> Windows users have a problem. The suggested solution of copying the URL into Notepad to reveal the true 'punycode' address does not work. Both Notepad and Wordpad render the 'punycode' as it appears in the address bar. Similarly for copying and pasting the URL in place, at least on firefox. A Chrome user commented that it did reveal the fake address.

The Scite text editor did reveal the difference: [http://www.ebswift.com/scite-text-editor- installer.html](http://www.ebswift.com/scite-text-editor-installer.html)

Does it work on any others?

Edit: I am incorrect. Windows and notepad are not the problem. It seems to be a peculiarity of the particular browser I am using, Cyberfox 52.0.4, which is converting the punycode as it is copied.

Edit: It looks like my Anti-virus, Avast is doing the conversion. I tested this on browsers with and without the Avast plugin, and the conversion only occurs on the browsers with the plugin.

<comment><USER33> Neither Notepad nor Wordpad have any mechanism for converting punycode on the fly -- the copy and paste executes correctly on my box and displays as [https://xn--e1awd7f.com/](https://xn--e1awd7f.com/) in both Notepad and Wordpad. You must be somehow copypasting the post-converted url.

<comment><USER6> I tried it again with the same result. From the same Copy/Paste, Notepad showed [https://www.epic.com](https://www.epic.com) but Scite showed [https://www.????.com/](https://www.????.com/). This demonstrates that I have not copypasted the post-converted URL. Interestingly, pasting the fake address into HN comment box showed [https://www.xn-- e1awd7f.com/](https://www.еріс.com/)

Could it be that notepad now delegates the handling of Unicode to the OS. I tested the above on the latest official release, Windows 10 Creators Update.

<comment><USER33> I also have the latest update. Not really sure what to make of this. If you manually type the punycode URL ([https://www.xn--e1awd7f.com](https://www.xn-- e1awd7f.com)) into your Notepad or Wordpad and then copy THAT and paste it back on the following line, does it convert?

<comment><USER33> I agree with your comment below mentioning Cyberfox -- the browser appears to be to blame, not Windows per se. The only question is why your browser is doing that. On both Firefox and Chrome, I am not getting the Unicode inserted into my clipboard, only the actual punycode. In fact, if I attempt to copy the Unicode from the address bar in either browser, it pastes as [https://www.xn-- e1awd7f.com/](https://www.xn--e1awd7f.com/) in the text editor, not as "epic.com." Edge seems to be completely immune to this exploit; it renders the punycode as punycode in the URL (I suppose it just doesn't "understand" punycode is all.)

<comment><USER6> I suspect that my antivirus software, Avast is converting the URL to unicode when it is copied.

I tried the Copy/Paste of the fake URL with standard Firefox, Brave (Chrome), and Avast Safezone (Chrome). Only in Brave did the fake address copy correctly as punycode. The other two browsers have the Avast plugin as a common factor, but Brave does not.

</comment></comment></comment></comment></comment></comment><comment><USER34> The title was just recently changed to remove the offending browsers. Since it's not a universal attack, it's limited in scope to only Chrome and Firefox; why remove this important metadata?

Especially since the title for the linked article _also_ calls out the offending browsers.

</comment><comment><USER35> A good way to fix this would be coloring all Unicode characters in the URL bar.

<comment><USER36> That doesn't work for colour blindness, or languages that use extended Latin alphabet. Some letters of a word would be one colour and others another.

<comment><USER6> The Unicode letters could be darker, which would still be visible if you are color blind. If the highlighted characters were not ones that would be expected to be represented by Unicode, i.e. if they were not special characters or diacritics, than that should raise an alarm, especially if the user was familiar with how the genuine URL looked.

<comment><USER35> Different colour + underlined.

</comment></comment></comment></comment><comment><USER37> Why is it even allowed to register "epic.com" with e|p|i|c cyrillic when it is already registered with english/ascii??

They look exactly the same, they are the same characters just borrowed from one language to another..

It should just be illegal to register same-character domains. All other solutions that force browser vendors to "do something about it" are implying that the web is in english all other languages are just addons.

<comment><USER38> It's about separation of concerns. Who defines what is the same and what is not? It's computers, so you need to be clear about this. You can't emulate our judicial process, here: make a law with a spirit and define the corner cases as they get litigated.

You already mention this yourself: you don't want the browsers to "do something about it." Ok, but somebody has to. So, if not the browsers, then ICANN. But they would be using the very same algorithm, in the end, no? If so, then why not have the browsers do that, in the first place? They have more control over UI, and it is a cleaner separation of concerns and responsibility.

Somebody needs to do something. And because this is about humans (in the end, when you say "similar looking", you mean "... to humans"), better have that be in the part of the system that actually is about them: the user agent. ICANN is too slow to be able to rapidly adapt to changes in this fight.

<comment><USER37> The truth of the matter is that e|p|i|c are actually the same characters just borrowed from one language to another.

If I give you a piece of paper with "epic -> epic" you would say "it says epic two times".

If we give the same piece of paper to a Russian he will say "it says <insert Russian meaning here> two times". The Russian guy may even say it says epic(as in the English meaning) because there might be no "epic" word in Russian.

In short: It all depends on the reader how he interprets the characters e|p|i|c. The same should apply to computers too.

The lowercase a is the same character in French, Russian, English etc. The fact that some decades ago some computer inventors decided that there are four types of "a" depending on the language - that's completely broken in my opinion.

I don't think and I don't see any use of embedding the belonging language to every character. For me, this is obviously like an encoding "flaw".

So the ones that actually have to do something are the OS vendors. If they don't then ICANN or browser vendors should do something..

</comment></comment></comment><comment><USER39> On Debian 9.0 (64-bit), with defaults:

Not affected: \- Chromium Version 57.0.2987.133

Affected: \- Chrome Version 57.0.2987.133 \- Firefox ESR 45.8.0 \- Tor Browser 6.5.1 (based on Mozilla Firefox 45.8.0)

tested with [https://www.xn--80ak6aa92e.com/](https://www.xn--80ak6aa92e.com/) -> [https://www.apple.com/](https://www.apple.com/)

</comment><comment><USER40> Well this was pretty scary. Anybody got a link to the chrome canary fix? And what about mobile browsers?

I consider myself to be quite a bit privacy concious. But how do you even protect against something like this? IMO there should be a clear opt-in unicode URL character conversion in browsers.

</comment><comment><USER4> I think this is a problem with registrars. It is the same if they would arbitrarily share access to your domain setup to another person. They should not allow registering domain names that look identically or very similar.

And of course we should stop using passwords and switch to physical keys.

<comment><USER41> Seems like it would be much easier to convince browsers to make punycode in the browser bar opt-in than to convince every registrar to stop selling certain punycode domains. For starters, who draws the line on which characters are unsafe?

<comment><USER4> Maybe that's a good idea. Punycode could be used only for names ending with non-latin TLD.

But the problem would still remain, for example if one company uses a name with latin "i" character and another with ukrainian charater that looks the same.

</comment></comment></comment><comment><USER42> Can anyone suggest a Chrome extension that flags or blocks any non ascii URLs?

<comment><USER43> Punycode Alert is one. It has 12 users and no reviews. I haven't looked into it besides a quick search.

<comment><USER42> Thanks!

</comment></comment></comment><comment><USER44> I ran the name through NFKC, but it didn't help. I didn't get back the ASCII equivalents. I wonder if Unicode has a normalisation like NFKC which applies to similar looking glyphs. Anyone know?

</comment><comment><USER45> Is there any name servers that would allow me to block / redirect any non- ASCII domain names? At this point, the value of Unicode domain names is a lot less than local safety.

We currently use unbound for users.

<comment><USER46> You could probably block the `xn--` prefix, which is how it appears over the wire.

</comment></comment><comment><USER47> In general, using a password manager creates a good line of warning against phishing attacks. I assume they would not trigger autofill for those fake sites either.

</comment><comment><USER48> Or maybe use a font that make obvious the difference between ASCII chars and their UNICODE clones without uglying too much the results for the end users.

</comment><comment><USER49> Would this also work with email? Like, register the Cyrillic fb.com and send emails from firstname.lastname@example.com as a valid reply-to address?

The possibilities seem mind boggling

</comment><comment><USER50> Browsers should probably disable IDN by default, at least if region settings are not set to use Cyrillic chars

</comment><comment><USER51> This is bad. Perhaps big corps should buy, as fast as they can, these fake domains before scammers do and redirect them to the legit websites. Doing so they will help protect their users as well as their brand reputation.

<comment><USER7> would these kind of attacks, where you can replace 1+ letters and have a new domain, not be subject to combinatorial explosion? I can imagine companies with longer domains having to buy 10,000+ domains to do this.

<comment><USER51> I think Google or Facebook can afford this.

They already do this with misspelled domains.

<comment><USER7> Google or Facebook sure, but medium-sized businesses might find it to be too expensive.

<comment><USER51> Sure, but phishing is most all about very big brands or banks.

My point is, for this segment will never be a money problem, more a digital culture deficit problem. Most of them are still not proactive enough about those issues, it seems like they don't care that much. At least, until they will be hit hard by this. Then, they will likely spend 100x in lawyers, reputation, and so on.

</comment></comment></comment></comment></comment><comment><USER52> Why not have the browser handle this?

<comment><USER53> Handle what? Detect when punycode is ASCII only?

<comment><USER6> One solution is to detect when whole words are rendered via punycode. This would allow the use of diacritics and apply to languages other than English. Of course, there could still be exceptions, but maybe these could be handled on a case by case basis. The problem would become more tractable, at any rate.

<comment><USER54> In this case, the whole word is rendered via punycode. Are you saying that should be allowed, or prohibited?

<comment><USER6> Prohibited. Or at least, flagged. There is no compelling reason to use punycode where conventional Unicode can be used.

<comment><USER54> There is no "conventional Unicode" in hostnames. DNS is ASCII-only in practice. All non-ASCII hostnames have to be encoded in punycode for DNS to work. This is why punycode was invented.

</comment></comment></comment></comment></comment></comment><comment><USER55> I see two issues: the mere existence of punycode (does any serious website use a punycode domain?) and the ability of any website to generate an ssl certificate for itself in a matter of minutes, making the "secure" part of the UI most users have been trained since forever to respect irrelevant.

<comment><USER17> I partly agree with the second part. I think it starts to make sense to set it as:

1\. Non SSL/TLS sites get marked as _insecure_. With recent events (ISP allowed to sell your data) this seems like a no-brainer.

2\. Self-signed certificates such as Letsencrypt get a normal status.

3\. Extended Validation SSL (or however they are called) get the green lock to mark them as trusted.

About your first point there's a huge chunk of the internet who doesn't even speak English so I'd say yes.

<comment><USER55> I see you're Spanish, and so am I--how many times have you seen domains with accented letters? If I see one of those I automatically think I have to remove the accents before I type the URL in my browser.

Regarding countries that don't use latin letters, examples:

[http://www.alexa.com/topsites/countries/RU](http://www.alexa.com/topsites/countries/RU)

[http://www.alexa.com/topsites/countries/CN](http://www.alexa.com/topsites/countries/CN)

[http://www.alexa.com/topsites/countries/DZ](http://www.alexa.com/topsites/countries/DZ)

<comment><USER17> Not many, but arguably Spanish people (at least young people in Spain) omit always the graphic accents in instant messaging and many times in social media so it's not weird for us to type an url without an é or an ó. I do know I've been asked by companies to get both the accented and unaccented names just in case.

In contrast, Japanese or Chinese people almost never use English characters mixed with their own on a day to day basis.

The alexa results is really interesting, but I think the whole unicode in the url thing is recent (or at least browser support), right? so it would make sense for unicode urls not to be so popular yet. Or it might just be that way, I'd love to see say the top N sites what % use punycode to see if it's relevant or not.

<comment><USER55> Punycode has been there for over 10 years and it's almost unused. If it hasn't been a success yet, it will arguably never be a success. It's not worth it to let it live, given the hazard that phishing poses.</comment></comment></comment></comment></comment>


Halfdollar – Budgeting You Can Understand - <AUTHOR> https://halfdollar.co/ <comment><AUTHOR> Halfdollar is an interactive budgeting tool for individuals, couples, and businesses.

To learn more, watch this: [https://www.youtube.com/watch?v=rpE8JlrS3Tc](https://www.youtube.com/watch?v=rpE8JlrS3Tc)

Enjoy!</comment>


TechStars Companies: Demo Day Preview - <AUTHOR> http://www.betabeat.com/2011/10/17/the-12-sexiest-techstars-ny-companies-demo-day/

<comment><USER2> This list makes me weep. Where are the startups actually doing useful work? Do we really need to another company to help us target customers, sell crap people don't need, or share experiences with each other?

<comment><USER3> Agreed. I think the sad truth is the truly game changing startups doing real, practical work aren't "sexy".

</comment></comment><comment><USER4> sexiest techstar companies, as distinct from the sexiest techstars

<comment><USER5> This list doesn't seem to be about sexiest at all. Just which companies are furthest along and might raise big rounds.

Confused.

</comment></comment><comment><USER6> Yeah, BetaBeat got a whole bunch of facts wrong anyway. Great reporting... not.</comment>


A list of all the great engineers laid off. Help them land on their feet - <AUTHOR> https://parachutelist.com/ <comment><USER2> > Where is this sourced from? - We rely on a combination of verified sources > at companies, submissions/tips, tech blogs, as well as public lists.

If I am reading this right, some (most?) of these people might not even know they are listed on this site? I am assuming all of the info is already available since linked in profile is required, but this is still a bit creepy.

<comment><USER3> I agree that it is weird if it's coming from a secondary source rather than the engineer themselves. It's a violation of their privacy.

Getting data from public lists, blogs, etc seems perfectly fine.

<comment><USER4> It's an incredibly naive project. I can see that it probably has been done with good intentions, and that's blindsided them.

All of the people in Berlin, Germany on the list can fly right off, probably a GDPR violation to list them.

</comment></comment></comment><comment><USER5> Great tool if you're laid off and your name is first in the list according to whatever arbitrary sorting function is being used here.

<comment><USER6> At a glance it looks like it's sorted first by layoff date descending, then alphabetically on name.

<comment><USER7> <changes name to AAAAAISL>

<comment><USER8> Andrew Alexander Anthony Aadien Arthur?

edit: I know this is nonserious, but hell, if you wanted to do that and you live in the UK, you only have to fill out a deed poll and get it signed by someone :)

<comment><USER9> Surely you mean Aadien Alexander Andrew Anthony Artur? ;)

<comment><USER8> Suddenly I'm getting a throwback to the "Aaron A Aaron" scene from Hot Fuzz

<comment><USER10> [https://youtu.be/pT6hEQ-ktNQ](https://youtu.be/pT6hEQ-ktNQ)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'm more interested in tracking the companies that have laid off (and don't have an ability to help hire individuals), so I'm just watching [https://layoffs.fyi/](https://layoffs.fyi/) instead of this page. That is more geared to following the trends in layoffs. If anyone knows other compilations I'd be interested to know!

</comment><comment><USER12> Could we also have a list of all the crappy engineers laid off? :-)

<comment><USER13> Anyone can add themself to the list, so those will be in there too. (:

</comment></comment><comment><USER14> There's a lot of companies that won't come out of this, but some will, and they'll be in the position of having to hire again.

I'm sure that a few companies may have tried some way to keep their furloughed employees "close to the back door," so they can get them back, when things open up, but a lot of companies will be in the position of having to start over from scratch.

I saw an ad for a "Senior React Native" developer, in the SF area, for $25,000 -> $80,000.

Oof. Different world, indeed.

</comment><comment><USER8> I get why it uses LinkedIn, but that's not something that represents my actual CV or skill level. Most of the stuff I've done I don't really know (thanks to their abysmal and dark-pattern-based UI) how to put it on there in the first place.

<comment><USER15> I sympathize, because Linkedin's ui is SHIT, and I've worked on both sides of it - recruiter and engineer. It sucks to search, it sucks to present yourself, it rewards bad practice.

That being said, that's the game. If you can't get it done, someone else will get hired through linkedin, and you won't. Linkedin is in my experience the most popular way to find candidates when your application pipeline isn't yielding the candidates you need.

<comment><USER16> > That being said, that's the game. If you can't get it done, someone else > will get hired through linkedin, and you won't.

But it's not the game here. Recruiters are being introduced to these candidates outside of LinkedIn. The requirement to direct them back to LinkedIn is self-imposed and arbitrary. It would have been a perfect opportunity to allow submitters to choose a link that they feel best represents them.

This is Rocket crowdsourcing data for their own use.

</comment></comment></comment><comment><USER17> No location at all? Isnt that fairly important?

<comment><USER18> It's on there. You have to scroll.

</comment></comment><comment><USER13> It's not a list of "great" engineers. It's just a list of engineers. Anyone can add themself to the list.

</comment><comment><USER19> Saw a bunch of Amazon layoffs. I know they regularly hire and fire people, but this seems like a really shitty time to do that to people.

<comment><USER20> I saw 19/6563 and only 6 of them are software engineers.

I wouldn't say that is a bunch in this time, more like regular process.

<comment><USER21> Yeah, 5-10% of the workforce is fired yearly at Amazon due to forced attrition from stack ranking.

</comment></comment></comment><comment><USER22> Is there a list of companies that are still hiring (and haven't hugely slowed down hiring like Google?).

<comment><USER23> I started a job search just before shelter-in-place took hold. I think most well-funded startups that aren't obviously directly impacted are hiring as usual, but that's anecdotal and based on a pretty small sample size.

<comment><USER24> My anecdata is a fortune 500 financial institution, DOJ, and DOD contractors. Finance is in a hiring freeze, we dropped some contractors. DOJ and DOD contractors looking for multiple candidates each.

</comment></comment></comment><comment><USER25> How very convenient that you can blacklist companies like Uber with a simple click of a checkbox.

</comment><comment><USER26> We're still hiring! I passed this link off to our head of talent acquisition.</comment>


Ask HN: Where can you find good remote work? - <AUTHOR>

I am looking to switch jobs. Remote work sounds appealing, and I think I might be able to find a better and potentially more interesting job if I expand my search nationwide. Does anyone have any tips for finding remote work? <comment><USER2> It's a bit difficult. I was lucky to have a friend who worked at Cheezburger who clued me into their remote worker policy. We've got people all across the country and fly to Seattle every quarter for a week long team building.

Message me if it sounds interesting as I believe we are hiring right now.

</comment><comment><USER3> Work on open source software, Its not a coincidence most of the most successful companies that have remote employees revolve around open source software</comment>


Redrawing the Map: New tools create a niche for the cartophile [pdf] - <AUTHOR> http://history.yale.edu/sites/default/files/files/2015%20rankin%20-%20redrawing%20the%20map.pdf <comment><USER2> _I would suggest that the cartographer's sensibil- ity is becoming ever more crucial to public life. We are awash in data, and all our "look-up" needs can be fulfilled in a matter of seconds. But we also rely on maps when making sense of the world — we use them to orient ourselves historically, socially, and politically as well as geographically. This has always been the case, but what is new today is the opportunity for unusual, provocative, or minority points of view to reach a wide audience. Pick an issue — anything from drone strikes abroad to the Olympic bid in Boston — and imagine a map that reframes the debate. Now go make that map. For the cartophile, loving maps should mean producing them, too._

I think he doesn't really value the point that more people have access to geo (and other open) data and to excellent mapping/visualizing tools nowadays.</comment>


Why Twitter is Terrible - <AUTHOR> https://theweek.com/articles/562716/why-twitter-terrible

<comment><USER2> Stopped using twitter a while ago, it's mainly for companies' marketing department talking to other companies' marketing department</comment>


Interactees startup t-shirt for talent hunting - <AUTHOR> http://interactees.com/

<comment><USER2> Another nice version would be some emoto-cons to express my present mood via buttons!

<comment><USER3> +1 vote for this. There are many ways to expand the idea to reach bigger markets.

</comment></comment><comment><USER4> @cubtastic71 great idea!

@frankdenbow we definitely have more ideas and designs to announce after we come back from SxSW this year.

Thanks @ck2 for sharing this.

Took a lot of learnings from other fellow HN posts (ie. <http://news.ycombinator.com/item?id=2176771>), and will share my own learnings pretty soon. =D

</comment><comment><USER5> You might also want to offer an "I AM" version of this as well.

<comment><USER6> Place the I AM on the back... I AM A _____, LOOKING FOR A _____

Good combo that covers all bases. Someone sees you from behind across the room and can come up and say, hey, I see you're a UI guy...

</comment></comment><comment><USER7> Very clever.</comment>


Ask HN: What substantial real-time apps are out there aside from turntable.fm? - <AUTHOR>

I'm really interested in the possibilities behind real-time web apps but it seems hard to get right.  Any compelling apps out there with a real-time aspect? <comment><USER2> Check out Trello. This was just posted here on HN:

<http://blog.fogcreek.com/the-trello-tech-stack/>

</comment><comment><USER3> <http://eightbitbeats.com/> is pretty cool!

<comment><AUTHOR> haha, I helped build that one :) I was wondering what others are out there. Glad you like it. Hopefully we will be updating it soon.</comment></comment>


AT&T cuts another 1,800 jobs as it finishes fiber-Internet buildout - <AUTHOR> https://arstechnica.com/tech-policy/2019/06/att-cuts-another-1800-jobs-as-it-finishes-fiber-internet-buildout/ <comment><USER2> Dupe: [https://news.ycombinator.com/item?id=20207337](https://news.ycombinator.com/item?id=20207337)</comment>


Facebook Messenger Day launches as a Snapchat Stories clone for making plans - <AUTHOR> https://techcrunch.com/2017/03/09/facebook-messenger-day/ <comment><USER2> >> The launch demonstrates Facebook's philosophy that while Snapchat may have invented Stories, it's actually a fundamental content medium bigger than any one company. Facebook is not afraid to copy, no matter what critics say. All that matters is whether it's valuable to users <<

So copying competitors' features is a "philosophy" now? :D

</comment><comment><USER3> I can understand the strategic reason for embedding snapchat in every product, but I can not see how all those changes do anything different than making the user experience worse for those who don't use the Snapchat media format.

My contacts are already not using this feature on WhatsApp.</comment>


Zuckerberg: Our new honesty-first approach is 'going to piss off a lot of people - <AUTHOR> https://www.cnbc.com/2020/01/31/mark-zuckerberg-silicon-slopes-speech-honesty-will-piss-off-people.html <comment><USER2> "Specifically, Zuckerberg said Facebook is going to support free speech and enable strong encryption on its services."

So what if Facebook never existed? How would things be different? No Trump? No Brexit? No massive anti-vax movement?</comment>


Ask HN: How does one get access to flight data? - <AUTHOR>

I'm toying with the idea of creating (another) travel site, I'm just wondering if anyone has any advice on the best way to get accurate flight schedules and prices. Cheers, <comment><USER2> You may check FlightStat <https://www.flightstats.com/developers/bin/view/Main/></comment>


More Wretched News for Newspapers as Advertising Woes Drive Anxiety - <AUTHOR> http://www.nytimes.com/2016/10/28/business/media/buyouts-wall-street-journal-bad-news-for-newspapers.html <comment><AUTHOR> HN may not be the place to ask, but I would desperately like to hear from advertisers about why they're abandoning newspapers, and whether or not this is part of a more general advertising recession.

I've noticed in particular that many long-time mainstays of newspaper and print advertising seem to be conspicuously shunning those media: auto dealerships, B2B ads, alcohol, grocery stores, home electronics, financial services, department stores, luxury products, and more.

Having not read much print for the past few years, the transformation has been shocking.</comment>


Activate WhatsApp Calling Feature on Android and iOS (iPhones) Now - <AUTHOR> http://thenextdigit.com/18371/activate-whatsapp-calling-feature-android-ios-iphones/

<comment><USER2> With most messaging services adding Calling features, I wonder when we'll get some sort of interoperability? Why hasn't SIP taken off as a standard in the messaging space?</comment>


Alleged CrunchPad Specs Revealed: Will Michael Arrington Beat the Apple Tablet? - <AUTHOR> http://tech.yahoo.com/news/pcworld/20090731/tc_pcworld/allegedcrunchpadspecsrevealedwillmichaelarringtonbeattheappletablet

<comment><USER2> Mike Arrington's reaction to the leak: "i'm completely ripshit mad"

<http://twitter.com/arrington/status/2949113649>

<comment><USER3> if the press is "bs", maybe he'll release the correct specs

<comment><USER4> Correct specs:

      * No keyboard
      * No way to stand the screen up
      * No way to protect the screen in a bag
      * Costs more than a laptop

<comment><USER5> * no hdd or way to install programs locally. Yay!

</comment></comment></comment></comment><comment><USER6> I think it is hugely ironic that Mike is as mad about the leak as he is.

<comment><USER7> Or perhaps he knows that if you want a bigger fire, you start fanning some flames.

<comment><USER8> This. He linked directly to the "leak" in the same breath he said he was "ripshit mad" about it. Mad my ass.

</comment></comment></comment><comment><USER9> If he really wants a "big boy" grade leak that deserves anger it will need to include unachievable specs, like a dual core Atom 330 processor running at 1.8GHz and an 8 hour battery life @ 2 pounds, so that the media can then respond to his eventual product release with _well, it's nice, but they didn't really hit the mark_.

</comment><comment><USER10> Nonsense headline.

First, there has been no solid evidence that the Apple Tablet is even coming (just a "confirmation" that was only confirming that the rumor existed).

Second, _how_ would the CrunchPad "beat" the Apple tablet? By existing? By coming out first? In build quality? User experience? Price point?

That said, would anyone here pay $400 for that thing? I'm not sure, considering for that I could get an iPhone, iPod Touch (more portable and with native apps, but with the diminished small-screen experience) or a netbook.

</comment><comment><USER11> Arrington promised: "The next time we talk about the CrunchPad publicly will be at a special press and user event in July in Silicon Valley."

Now end of July -- did this happen?

</comment><comment><USER12> No. I personally don't think he will beat the "Apple tablet." (If such a thing will ever come into existence). Because I think he has very little style.</comment>