Show HN: NoAgeismInTech Job Board (Update) – Companies' Culture - <AUTHOR> https://noageismintech.com/blend <comment><USER2> Ageism has always baffled me. In my pre-funding pursuits, I've always dreamed of hiring a team composed of top-tier talent. That typically means people who have been in their respective industry 20+ years. I'm in my early thirties and there's no one on my hire list that's younger than me. That isn't to say I wouldn't hire anyone younger than myself provided they've the skill—I absolutely would—it's just that age and experience (and thus skill) tend to be highly correlated.

Presumably the motivation for the most common form of ageism is that young people are easier to exploit and abuse under the pretext of "saving money", but why the fuck would anyone ever want to run their company on that basis? It makes very little sense.

<comment><USER3> > young people are easier to exploit and abuse under the pretext of "saving > money", but why the fuck would anyone ever want to run their company on that > basis?

There are two ways to get more from your developer team: quality and quantity.

Quality means you pay your people more and more as you grow. Grow from 10 to 20 over 10 years, while retaining most people and tripling their salaries.

For that to work:

\- your revenue per employee must grow substantially

\- you need managers who are flexible, because you have to adapt your workplace to your employees needs rather than just hiring new people when they turn over

Those are difficult things that not every owner can bring about in their company.

The other approach is quantity: grow your dev team from 10 to 100 to 1000. For that to work you need:

\- Employees who can follow instruction without worrying too much about whether the tasks make sense

\- Employees who just want a standard job and don't need much customization over their career

\- Efficient hiring processes, centered on a repeatable, consistent employee profile (not necessarily the most capable profiles)

\- Caps on wages

The quantity strategy doesn't require finesse. In fact it works better without it. You make coarse, aggregate decisions and let people turn over as needed. The turnover "cleans" the talent pool of people with special needs, which is crucial for the system to work.

The quality strategy requires really smart management which is very hard to hire.

<comment><USER4> Tripling the salaries based just on seniority seems insane. Either you started way too low, or you're going to end up paying a lot. The developers that you were able to recruit with your low starting salary are going to end up working alongside people who came for the high salaries and may very well be quite a bit more talented. This will create a lot of friction.

And at the beginning, either you are keeping your plans of an eventual 3x salary secret from employees, in which case it can not motivate them, you are promising it to them which as an employee I would view with great suspicion, or you are writing some kind of agreement about it which seems like it has all kinds of problems.

Giving employees equity is a much better version of what you are trying to do and I'm puzzled as to why you didn't suggest it.

\- Employees get it when it's cheap and it literally represents the value of the company that you were hoping to give them in the form of higher salaries

\- It's not based on some kind of vague aspiration to be a good boss, it's a solid, well understood form of compensation

\- No new employee is going to resent a lower-skilled old timer for their equity- they earned it.

<comment><USER3> > Tripling the salaries based just on seniority seems insane.

That's a little antagonistic. Your whole comment is weirdly antagonistic.

> Either you started way too low, or you're going to end up paying a lot.

Or 1) you start by paying what people are worth according to "market rates", 2) at some point they break even on what they cost, 3) every year they bring in more revenue than the last and you share it with them.

> The developers that you were able to recruit with your low starting salary > are going to end up working alongside people who came for the high salaries > and may very well be quite a bit more talented.

Sure, but they're paid on performance not "talent". Work is not a talent show. The people getting more money have successfully deployed projects worth much more than their salary. That's why their salaries were bumped. If this new person can do that they'll earn the same salary.

> And at the beginning, either you are keeping your plans of an eventual 3x > salary secret from employees, in which case it can not motivate them, you > are promising it to them which as an employee I would view with great > suspicion, or you are writing some kind of agreement about it which seems > like it has all kinds of problems.

Seems simple enough to me. You do the math on how much revenue you think your work has brought in. I do my own math, and we negotiate a number every few years.

> Employees get [equity] when it's cheap and it literally represents the value > of the company that you were hoping to give them in the form of higher > salaries

Revenue-aligned compensation is very different from an ownership share, both materially and in terms of what they represent.

> It's not based on some kind of vague aspiration to be a good boss

Paying people according to their contribution to the business model is neither vague nor aspirational, although it does require you to have a business model that includes your workers.

And equity calculations in my experience are pretty vague and aspirational. Not sure what you're indicating at here.

> No new employee is going to resent a lower-skilled old timer for their > equity- they earned it.

I'm not sure if what you're describing is based on my actual advice or a misunderstanding so I'll let you chime in if you think there's still a resentment issue here.

<comment><USER4> I wasn't trying to be weirdly antagonistic.

Your original comment sounded like you were trying to reconcile the common HN views of "developers don't get paid enough", "big corporations are soul- crushing", and "startup equity is a scam". At the time I didn't see how it came together as a cohesive whole.

You've add some detail here about this business model, which involves giving developers commission directly correlated to the performance of projects they work on. This gives me more of an idea of what you're talking about. Commission tends to work really well when you can easily quantify someone's contribution, for example sales.

I suppose this might work alright for developers in a consultancy, although it would be hard to separate the developer's work from the work of whoever landed the sale. A developer could do a terrible job on a project, giving the firm a bad reputation down the line (although their manager might not be aware of this at the time of completion). If the project was big and lucrative, they would get paid a lot. On the other hand, a developer could do a great job on a small project, that led to a much bigger contract which that developer was not able to work on for some reason. They would miss out on the benefits of their good job.

For a product company, it sounds even harder. How do you compensate the people making internal tooling for example? How do you compensate devops people? What's the split between the developer who programmed a feature and developer who runs it in production? My suspicion is that for a product company this compensation scheme would start to look really similar to the normal practice of using market rates and negotiating for raises, since attribution of revenue would be really unclear.

<comment><USER3> > How do you compensate the people making internal tooling for example?

You need to place them in your business model.

What are the tools used for? What would happen if the tooling didn't get built and your colleagues used off the shelf tools?

That will tell you how much your team is worth.

Most people seem to throw up their hands at this point and say "it's hard, and imperfect" and they stop working on the business model.

But any model is imperfect. Even the sales person you mentioned, who earns a flat commission on sales... they could be costing the company more than they're bringing in, if their sales are forcing developers into crunch, or if their customers churn, etc. The point of the model is not to mirror reality perfectly, it's to give you numbers that can guide your negotiations, as I said.

Just because it's unusual to think about how developers fit into your business model doesn't mean it's impossible or it shouldn't be done.

</comment></comment></comment></comment></comment></comment><comment><USER5> I've always thought it would be a good idea for companies to note the typical type of office environment (private, semi-private, open office) employees can expect for the specific role.

</comment><comment><USER6> Your link goes to a specific company's post:

[https://noageismintech.com/blend](https://noageismintech.com/blend)

rather than the front page:

[https://noageismintech.com/](https://noageismintech.com/)

<comment><AUTHOR> Yes. I don't know how to announce an update as I already have launched the website here and if I link to the front page, there will be no new post

<comment><USER7> can you append a random querystring to the url or something? i'm on mobile where the full url isn't immediately visible in the browser, and i found the link quite confusing, as i assumed i was already on the front page.

</comment></comment></comment><comment><AUTHOR> Hi all, we have updated the website, adding what matters in companies' culture from experienced professionals point-of-view. Some of them also have age chart, as Monzo and Bulb

</comment><comment><USER8> No age is min tech.

</comment><comment><USER9> I don't interview anyone over 40. Period. Reason is very simple. By that time they're bitter from some past work experiences and have figured out now a bunch of ways to look busy at work. They also likely have more demands coming from family if they were brave enough to try marriage in the "gig economy" we all live in now. It's great that there is a service out there for those who were never able to save enough to retire before they got replaced with younger more energetic and cheaper labor. At 52, I feel lucky every day that I now have a job in management. Not nearly as interesting work as what I did technically ten years ago, but I'm also making almost three times as much money, and who knows how much more than than one of my former colleagues who is in his 70's with a PhD from a top 10 university and is working at Starbucks to help pay his daughter's $45,000/yr. tuition!

<comment><USER10> I've seen bitter, demanding and unpleasant 20, 30 and 40 somethings. Also some of the most brilliant minds I've met are grey haired. Age does not matter.

I hope you meet someone compelling enough to trigger you to rethink your bias. Good luck.

<comment><USER9> Could not agree more. Experience is hugely valuable. Unfortunately, the way a lot of smaller less-funded companies like ours work is that we take the "brilliant ideas" from someone else (often university research but also sometimes insights gleaned through in-house interview process) and implement them for our customers. The vast bulk of our contribution is what you might call "scut work" (often the kind of thing that gets farmed out to grad students and post-docs on the academia side when they want to build a working prototype) and faster rather than smarter is what enables us to compete most effectively with the rest of our market. I wish it weren't this way. I'd still like to be doing technical work myself, in a more carefree and supportive environment, with all the protections that union members in other trades (like law enforcement and primary education) appear to enjoy. But it seems that the technology sector the world over is moving more and more in the direction of "at will" employment where everyone (except when it comes to affirmative action for certain protected classes) has to fight for their own survival until they get too old to put up much of a fight anymore. "Capitalism is cannibalism" is what one of my first supervisors told me right before I got laid off in 2002, and from where I sit today, I feel like truer words could not have been spoken.</comment></comment></comment>


Shutting Down the BGP Hijack Factory - <AUTHOR> https://dyn.com/blog/shutting-down-the-bgp-hijack-factory/ <comment><USER3> Well its nice that they are now shut down, although the process seems to been fairly slow and arduous. They were already identified as misbehaving in 2014, getting kicked out from deixp in 2017, and only now disconnected by transits. And even in the latest episode they could play this game of cat and mouse for a (short) while. And what if Guilmette wouldn't had noticed this, or bothered to rant on nanog, would that happened at all?

I'm not sure what to do improve the situation, but there definitely seems like a need for improvement.

<comment><USER4> The lessons learned section of the article hints at orgs being way too permissive or unresponsive when bad behavior occurs. The thing is though, this isn't a world where that kind of softness and leniency makes any sort of sense.

<comment><USER5> It makes sense from a not-wanting-to-get-sued-for-breach-of-contract standpoint.

The contract at IXPs almost universally includes a phrase like "will not engage in fraudulent announcement of routes", but proving that happened to the satisfaction of a non-profit's board of directors is difficult. You really have to have completely collinear anatidae.

<comment><USER6> > collinear anatidae

I'm stealing this phrase, please and thank you.

<comment><USER7> Why? It sounds incredibly pretentious. I think most people would appreciate Plain English [0].

[0] [https://en.wikipedia.org/wiki/Plain_English](https://en.wikipedia.org/wiki/Plain_English)

<comment><USER8> Because it's a lovely application of rhyming slang.

[https://en.wikipedia.org/wiki/Rhyming_slang](https://en.wikipedia.org/wiki/Rhyming_slang)

<comment><USER3> How exactly is it rhyming with anything?

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I fail to understand why there is no quick and official way to terminate such bad actors. Isn't there a task force for monitoring and enforcing some rules? There should be a SPoC for every AS, available 24/7 so that such notorious players are kicked out immediately. We live in an age where everything can be traced and monitored and we allow BGP hijacking and other similar acts. Oh well, my romantic idea for a properly moderated network.

<comment><USER10> Who would be in charge of the moderation?

This very article describes the closest thing to that: NANOG is a collection of network operators, and they communicate with each other about the overall state and coordination of "the internet", which realistically is just "the total set of a lot of network operators agreeing to connect to each other".

Domain registration and DNS have much more centralization because there exists a root entity for the entire (public) system and an owner of each TLD: if an entity wants to remove example.com from existence, they can go to the .com operator and attempt to compel them to do that. For IP routing, you're talking about BGP between a vast number of different entities. By design, traffic can route a variety of ways between each point.

<comment><USER11> I had a conversation with a friend about this, and the outcome was the idea that BGP could be extended with functionality for this case. There needs to be a way to brand "negative" traffic or routes advertised with some sort of reputation system. In the event of a DDoS attack coming from an AS, you could have intra-AS weight for any given AS such that if an AS reports malicious traffic from a route, it's given a lower weight and traffic is less likely to route to that AS in favor of a less specific prefix. This would encourage any given AS to act in desirable ways, as their actions (or actions coming from within them, e.g. a customer of theirs being the source of a DoS attack) would have consequences.

<comment><USER10> How would that work in practice? If I compromise a pile of IoT devices running on Comcast users' networks, and use them to launch and attack, all Comcast users on their subnet get marked as uncool? And if we're marking them as "bad", doesn't that mean all of their BGP peers mark them as uncool and then the weights for their prefix are lower but still even, so routing still ends up the same?

The only way they'd be impacted would be if some networks didn't implement your bad-actor-prefix-weight-mod, and then we'd just be penalizing the people who don't use your system along with the attackers, since we'd be routing the bad traffic via their networks.

<comment><USER12> You can see the impact of this kind of thinking in RBLs and blocklists - <USER2> to send email via your residential connection and you probably won't be able to.

</comment></comment></comment></comment></comment><comment><USER13> I have worked for a medium size ISP for many years (3 upstream Tier-1 provider, presence on 2 IXP) and we sometimes suffer from BGP hijaking. We had developed a software that every hour checks the BGP prefix assigned to every peer and update the BGP filter automatically. It takes some time to engineering it and develop but after then, it works like a charm.

<comment><USER14> That's a 1-hour attack window though. It should be event driven, something where peers can securely signal changes as they happen

<comment><USER15> Those are very expensive. According to apnic[1], there are 15,000 update / day in 2016. For small size ISP, the number is much lower and may be managible. But event driven can't be a general solution for larger isp.

[1] [https://blog.apnic.net/2017/01/27/bgp- in-2016/](https://blog.apnic.net/2017/01/27/bgp-in-2016/)

<comment><USER16> 15k updates a day? how big is the payload? ...sounds negligible to someone ignorant in BGP finer details.

</comment></comment></comment></comment><comment><USER17> So... what were they doing with the hijacks? Using it to evade IP reputation bans for spamming?

<comment><USER18> Based on what I know of their ASNs, yes.

</comment></comment><comment><USER19> If they have been bad actors for years why didn't they lose access earlier?

<comment><USER20> There will always be someone happy to take their money.

</comment></comment><comment><USER21> Bitcanal sounds like an appropriately terrible name as it sounds like root canal... but for bits.

BGP really needs some more organized security, but that's nothing new, and i'm sure not super easy to organize.

<comment><USER22> Not in its native language it doesn't.

* [https://en.wiktionary.org/wiki/canal#Portuguese](https://en.wiktionary.org/wiki/canal#Portuguese)

</comment></comment><comment><USER23> And yet still being peered - [https://bgp.he.net/AS197426#_peers](https://bgp.he.net/AS197426#_peers)

<comment><USER24> The HE site takes a while to refresh.

<comment><USER23> Good point, thank you. According to the article, Hurricane depeered them on July 9th; the looking glass says it was updated 5pm July 10th, so unless the 'updated' is incorrect, Hurricane started peering this bad actor again!

<comment><USER25> If you look up the BGP routes for a Bitcanal IP address (22.214.171.124) on HE's looking glass ([https://lg.he.net/](https://lg.he.net/)) it does not appear any routes are present. I believe HE's BGP page may still be out of date, or the peers are present but not active.

<comment><USER24> Last time I checked it took multiple days for it to update when routes disappear (I would assume they cache them for a while, in case it's just a temporary change).

<comment><USER23> For historical record, as of today, Hurricane isn't listed anymore, but Cogent is again, and GTT for ip6... Way to remain united against abuse... just, wow.

</comment></comment></comment></comment></comment></comment><comment><USER26> No comments about the cookie warning/opt-out modal on the page? Perhaps it's only visible in the EU?

The thing explicitly takes ~2-3mins to send a HTTP POST to each of their advertising partners saying you've opted out (and warns "Some vendors cannot receive opt-out requests via https protocols so the processing of your opt-out request is incomplete")... lovely.

<comment><USER27> Just came here to post exactly that! What a complete mess... and if you do follow the https link, lo and behold, they re-set the settings slider to the lowest level (advertising is OK), despite having set it differently previously. Took a fair while on the https link, but at least it says it worked...

</comment></comment><comment><USER28> We have RIPE and other IANA organizations that have routing objects in their databases with information about through which ASN certain classes are announced, there are also LOAs. GTT and Cogent are huge Tier-1 providers, why they do not check which classes their clients are announcing? Am I missing something here?

<comment><USER25> According to a post by Job on nanog they have been known to submitted false or fabricated IRR information to RADB and RIPE: [http://seclists.org/nanog/2018/Jun/379](http://seclists.org/nanog/2018/Jun/379)

At the end of the day, BGP is a very trusting protocol and it requires keeping the neighborhood clean and clear. IMO providers should be filtering prefixes their clients shouldn't be announcing (al la BCP38) but keeping up on the various IP blocks being shifted around is a paperwork nightmare I'm sure.

<comment><USER29> BGP is still very much built on trust and reputation... At a local ix level if you were to show up at an ix like the ams-ix and regularly announce prefixes you have no right to, your company name and AS# would quickly develop the reputation of a rancid turd.

<comment><USER30> The BGP authentication method doesn't seem very secure, so how do you know who you are trusting?

<comment><USER29> a properly implemented IX has MAC address filtering on ports. This can of course be spoofed. But there is also a level of security at OSI layer 1 for the physical fiber cross connect from an ISP's panel to the IX's panel.

For instance: If the IX is located on the 15th floor of the building. An ISP might be colocated on the 12th floor. Fiber XC from 12.501.P4.D4 (12th floor, row 5, rack 01, fiber patch panel 4, SC duplex port D4) to 15.201.P1.D4, then a fiber cable from D4 to an SFP+ port on the IX's switch. Unless somebody physically hijacks your fiber crossconnect and moves it (which would be noticed as hard down immediately) it's pretty hard to pretend to be another ISP, from the perspective of the switch fabric operator of the IX.

</comment></comment></comment></comment></comment><comment><USER31> [http://www.bitcanal.com](http://www.bitcanal.com) is down.

Did they host it in their AS and now their AS is unreachable?

<comment><USER25> I'm getting a servfail when attempting to resolve their domain, according to DomainTools[1] the IP for the site was 126.96.36.199 announced from AS42229.

The ASN was mentioned in the article as being listed by Spamhaus ASN Droplist but wasn't mentioned earlier as one of the targeted ASNs.

Edit: reviewed the ASN more and it is the Ebony Horizon mentioned in the article, and it is only peered to BitCanal's primary AS197426, which is subsequently being de-peered, so I'd say that is the main reason bitcanal.com is down :) 1: [http://whois.domaintools.com/bitcanal.com](http://whois.domaintools.com/bitcanal.com)</comment></comment>


Show HN: Pinecone – Design new genes, browse other designs, get DNA delivered - <AUTHOR> https://serotiny.bio/ <comment><AUTHOR> We've built a web-app to make the design of synthetic genetic constructs efficient and cheap. Build novel genetic designs from functional units without worrying about the actual DNA sequence. We can then help you place an order for your design's DNA from a synthesizer of your choice.

Our genetic management infrastructure makes it straightforward to see where particular designs came from and how they've been used. It straightforwardly keeps track of the functions and restrictions of each design.

Design single protein constructs, combinatorial sets of proteins, and mutation sets. [1]

Check it out, I'd be curious your thoughts. I'm happy to answer any questions. We built it all with Go and Ember - a huge thanks to those working on those tools.

[1] [https://www.youtube.com/watch?v=_6l4KYGeFvQ&list=PL5DSAtppP8...](https://www.youtube.com/watch?v=_6l4KYGeFvQ&list=PL5DSAtppP8Q_e7fjYdGhHiYPZL7QpQqtq)</comment>