Why GitHub Won't Help with Hiring - <AUTHOR> https://www.benfrederickson.com/github-wont-help-with-hiring/ <comment><USER2> I look at GitHub profiles to help filter / disqualify candidates. Just last weekend, I had a marketing candidate who had stolen three Wordpress projects from their current employer and post them as public repos on their personal GitHub account. In addition to the flagrant intellectual property theft, the repos contained the wp-config.php file with exposed database "root" credentials to live, client sites.

<comment><USER3> Perhaps I misunderstood. But isn't Github help you filter out such candidates, is it? They have some big projects, but their contribution calandar should be almost empty, cuz all the code is pushed into Github at once.

<comment><USER4> No one should look at the contribution calendar and hire based on it without looking more in depth. To answer your question it's based on commit time, but because of that you have things like: [https://github.com/gelstudios/gitfiti](https://github.com/gelstudios/gitfiti)

</comment></comment></comment><comment><USER5> GitHub profiles are incredibly useful for college grads, bootcampers, and self-taught devs that typically can't speak of professional accomplishments.

As your professional accomplishments increase, the value of GitHub profiles (for most) as a marketing tool diminishes dramatically, but can still be helpful.

For developers at any level, repos are a good conversation piece for interviews. The interviewer can ask why choices were made, what the candidate might do differently now (shows growth), and start interesting technical debates.

I always ask my clients (I'm a resume writer and career consultant) if they have a GitHub profile if I don't see one listed, but I don't always include it on the resume. New entrants to the industry are not exactly punished for not having one, but it's becoming an expectation. This is different than expecting an older adult that may have life responsibilities that prevent (or simply no interest in) coding outside work.

<comment><USER6> They are also great in demonstrating knowledge in a new field. For example, if you do C# at your day job but you want to move into Go. Showcasing side projects can demonstrate some experience. This helps sidestep the "well, I don't have Go experience" issue.

<comment><USER7> This -- exactly. I know of at least one person who's done this and a few others who were able to move into areas of their preferred language (i.e. going from a job that was mainly web/C#/MVC to mainly REST/C#/Angular or React) by doing this.

Even _within_ a larger organization it's possible to use side-project examples as a demonstration that you're ready to move from a team that uses one discipline/language to an unrelated team. While a large organization might be willing to move a senior developer who's a less-perfect-fit from a different department if they've demonstrated that they can be trained/learn what they need to know, it's a _lot_ easier if they can demonstrate that they're a lot more than a "less-than-perfect fit"

</comment></comment></comment><comment><USER8> What should be the Dribbble equivalent for software engineers then? All I hear these days is, whiteboards for hiring is bad, asking to do a sample project for hiring is bad, now GitHub is bad. I don't know when software engineers became such "I don't want to show my work" industry.

Having a portfolio to show what your capable of is a great way to set yourself apart. I don't think anyone is expecting you to have developed Linux from scratch. But something is better than nothing. Which do you think is more likely to get an interview, someone with several source GitHub projects or someone that says "all my work was closed sourced" and has nothing to show.

Having founded three startups now (2x acquired), most of the best engineers I have ever worked with have a noticeably more active Github/Bitbucket/Gitlab portfolio than the average. In my experience, great engineers have public proof (open source, a self produced product, book, etc) of their craft vs nothing at all.

Now to be clear, just because someone has an active Github, or a book, or whatever doesn't mean you should hire on the spot. But should be someone you'd prioritize over someone that is seemingly too lazy to do any related extra circular activity.

<comment><USER9> I do plenty of extra curricular activity.They don't involve coding.

I've also hired developers. I have a simplified version of a real world project that we are working on. The methods are skeletons with no code and a bunch of failing unit tests. Part 1 they have to get the unit test passing. Then I give them a harder set of requirements with unit tests. They have to make the second set pass without breaking the first set.

It tells you a lot about how someone thinks.

<comment><USER8> I do the same as well, I think it is a great approach. It is just a paring exercise, the language of their choice, their equipment, full internet access. We just build something like a calculator or pig latin translator. Something that you build up in layers. I usually read off the test cases one step at a time, in hopes that they write their own tests along the way.

But hiring good people is very time consuming. The reason GitHub as a portfolio makes sense, is that it helps compare potential candidates--that I know nothing about--faster. Biased or not, I have had the best experience with people that are very active publicly. From Battlebots competitors, book authors, to startup founders, etc.

Ivy League Colleges, VCs, even Y-Combinator works very much the same way-- trying to make an assessment based on past accomplishments. The more visible, the better. With the caveat being a strong direct reference.

I am sure we all have extra circular activities besides coding, but depending on how strong your experience or professional network is, really depends on how much you need in a portfolio. I have been coding since I was nine and have decades of experience, I still have stuff I hack on that is public, from SlackBots that control GPIO pins to Sonos controllers, etc. I would think the more experience you have, the better chances you would have more stuff you can add to your GitHub (portfolio).

At the end of the day, as a someone hiring, I am going to gravitate to engineers that have more and better examples of their work ability and output vs where they worked on their Resume. Not to say that we should ignore anyone that doesn't have public projects--but they are certainly at a disadvantage against someone that has.

<comment><USER9> I had two positions open recently. The recruiter gave me 15 resumes, I narrowed that down to 6, spent one day doing phone screens, narrowed that down to three, invited both for the same day then I had them do the coding interview I mentioned above.

I narrowed that down to two and made offers the same day.

<comment><USER8> You're about a 13% hire rate. Google is about 0.2%, Apple 2%, and Harvard is 7%.

<comment><USER9> And not everyone wants to work for Google or Apple and not every company needs a Google level employee. Most developers are doing boring line of business apps....

</comment></comment></comment></comment></comment></comment><comment><USER10> I am just tabbing over from looking at a github profile of a potential hire. It was somewhat useful as a way of understanding this person's technology style.

I saw PHP, game dev, JSON. I saw that he does do OSS stuff, though not much. I saw that he can write a decent readme.

That's the kind of thing a hiring manager gets from a github profile. It's not a one-dimensional test like how many checkins does the dev have.

<comment><USER11> > _I saw that he does do OSS stuff, though not much._

GitHub will not even remotely tell you that, though. There are _tons_ of open source projects that are not hosted on GitHub. If you, say, contribute to the Linux kernel, or to Firefox, or perhaps Xfce, nothing will show up on your GitHub profile to give you "credit" for that.

I agree with another poster that GH can be useful to disqualify candidates (say if they've posted something they've plagiarized as their own), and you might find interesting things on a candidate's profile that increases your impression of them, but it's absolutely useless for _comparing_ candidates or getting a full picture of what they've worked on in public.

<comment><USER12> If you contribute to any of those large projects then you should have that on your resume/cv with a link to the instructions for pulling down a list of the commits related to your work. Easy Peasy.

</comment></comment></comment><comment><USER13> I wouldn't have been hired for the jobs i've had if it wasn't for my Github. I don't think false-negatives should lead you to disregard the ability to find that perfect developer. Is it not your responsibility as a developer to keep an accurate portfolio of your skill set?

<comment><USER14> > Is it not your responsibility as a developer to keep an accurate portfolio > of your skill set?

It is not. If an employer can't ascertain your skill level through the interview process, their hiring is broken. It is a slippery slope where we allow employers to dictate uncompensated signaling necessary for a role.

Observe how it worked out for everyone who got a degree because employers won't hire without one, and then they don't get hired regardless of that degree. So we'll all toil on public Github projects in hopes that'll be what convinces an employer to hire? Will we all need to intern for several months for free next?

@always_good: Hiring is hard. If you succeed in hiring the right people, it won't be because they jumped through your hoops, but because they were passionate, had some of the skills and could grow fast, and a huge helping of luck.

<comment><USER15> _> If an employer can't ascertain your skill level through the interview process, their hiring is broken._

That's just outright factually inaccurate. Are you expecting employers to hire on blind faith? If employers are hiring without _evidence_ to support your skill-set, then their hiring process is broken.

 _> Observe how it worked out for everyone who got a degree because employers won't hire without one, and then they don't get hired regardless of that degree._

I don't have a degree, I got my first job because I walked into the interview with a portfolio; more specifically a fully functional completed piece of software that I live demonstrated. This wasn't an open-source project, but I sent them the code to be reviewed nonetheless (I own the IP).

The reason some people with degrees don't get jobs is because people with portfolio's (irrespective of degrees) can demonstrate their skill-set, where as waving around a piece of paper and having no demonstrable skills makes it extremely difficult for a potential employer to evaluate you.

 _> It is a slippery slope where we allow employers to dictate uncompensated signaling necessary for a role._

I do somewhat agree with this. However, your portfolio need not be open-source work, it's just common as there's _some_ proof (version control, although not tamper-proof) indicating you did the work you're claiming you've done.

<comment><USER9> _That 's just outright factually inaccurate. Are you expecting employers to hire on blind faith? If employers are hiring without evidence to support your skill-set, then their hiring process is broken._

I haven't had any publicly accessible work to show off since I posted a HyperCard stack on AOL and freeware FTP sites while I was in college in 1995. I've been working as a professional developer since 1996, have never been asked to show code and have a pretty good track record for getting jobs based on solely my interview skills and knowledge.

At this point in my career, few companies waste time even asking me about technical trivia. I talk about the projects of the teams I've been on and led. I've gotten jobs over the past 10 years where I didn't meet half of the requirements going in.

<comment><USER16> Surely the argument isn't that a portfolio is a _necessary_ positive signal, but rather that it's just a positive signal.

In other words, would you take the stance that having some quality work on Github can never work in your favor?

What about other positive-but-not-guaranteed signals like having a quality blog where you cover technical topics? Can that ever work in your favor? Or is it pure noise that can never demonstrate value?

<comment><USER9> I have to admit my own bias against actually doing side projects. While I will read technical books dealing with high level concepts, I've never done a side project outside of work.

I'd rather try to champion technology at my job and do a proof of concept or if that isn't possible, change jobs.

I've been able to find jobs where what I am good at is a "requirement" and where what I want to learn is a "nice to have" and learn the nice to have.

I find it carries a lot more weight to be able to talk about how you have used technology at work than a side project unless the side project was a really popular open source project.

Then again, I never work for companies with a large development team where I can't have a large, resume building impact.

</comment></comment></comment></comment></comment></comment><comment><USER17> While much of this article hits upon the right points, I'd like to add a few things.

\- GitHub also allows you to display your activity on private projects (as long as their development also happens on GitHub, of course). \- It's not a great indicator, but it's an indicator of what kind of programming people do for fun (or alternatively, that their employment/life circumstances don't allow them to be active on GitHub).

I don't think not having anything on there is a bad thing, but I'd like to talk to the candidate about why. Sometimes you'll learn that people have the most fun non-programming hobbies or the most responsibly-filled lives.

</comment><comment><USER18> The argument that "GitHub isn't a useful indicator of skill" has the logically-following argument "we won't look at GitHubs at all because they're a waste of time." Which is a loss of helpful information for hiring a candidate, and _ignoring_ relevant information seems inefficient.

<comment><USER19> Nobody actually wants to make the most informed decision, what they really want is to make the right decision. There's all kinds of places where additional information leads to worse decisions:

[https://ignoranceanduncertainty.wordpress.com/2011/01/31/whe...](https://ignoranceanduncertainty.wordpress.com/2011/01/31/when- can-more-information-lead-to-worse-decisions/)

So you may in fact want to ignore relevant information _to be more efficient._

</comment></comment><comment><USER20> Most people realize that "Github isn't your resume" unless you are paid to work on open source. Forking repos, submitting the occasional pull request or a random side project don't provide much signal compared the code you've written and the people you've worked with at past companies.

I am currently working on building a tool [1] that helps developers build profiles that articulate very clearly both what they bring to a team and what they are looking for in a next job. We're approaching this as a data problem, but unlike many dark recruiting tools, we think it's important for the developer to be completely in control of the information that makes it into their profile.

[1]: [https://www.fizbuz.com](https://www.fizbuz.com)

<comment><USER21> You need to provide a privacy policy for this service.

<comment><USER20> Thank you for the reminder! A privacy policy has been added to the website.

</comment></comment></comment><comment><USER22> I find this stuff fascinating, partly because I work in the industry and partly because I love sports statistics.

One crazy idea I have it to experiment with some kind of "Sabermetrics for software engineers"–think "WAR for developers" [0]. Using GitHub would be an obvious data-source (how to use it and if its a good idea is an entirely different discussion).

While I think this article makes some good points, he seems to only touch the most simple approaches. There's a lot of things you can do with a GitHub profile. To me, they'd never be deciding factors, but you can definitely extract some pluses out of a person's profile.

[0] [https://www.fangraphs.com/library/misc/war/](https://www.fangraphs.com/library/misc/war/)

</comment><comment><USER23> According to the article I am clearly in the identified top 1% of GitHub users by commit quantity. While prospective employers may not dissect the code in my various GitHub repositories this certainly hasn't hurt when looking for jobs.

In fact, contributing to public open source has been the proven tipping point that shifts hiring decisions in my favor if the hiring manager is on the fence. In all other cases the combination of a frequent open source contributions and a strong interview have allowed me to nail senior positions as the top candidate.

Whether or not any of this makes me a rockstar is completely subjective, but beating out all other candidates (several dozen) hands down on multiple occasions really increases my self-esteem.

</comment><comment><USER24> Nonsense. The last two full time jobs and several gigs I've landed in the last five years I provided the hiring manager with a link to my public profile on github in lieu of a resume.

<comment><USER25> The author addresses that point in the introduction:

"As an example in the latest Hacker News' Who is Hiring thread, there are a bunch of different job ads asking for a Github profile as part of the job application.

...

While both of those posts give excellent reasons to reconsider asking for open source contributions when hiring, my take here isn't about why it is ethically dubious to require open source contributions or why GitHub isn't great for showcasing your projects.

Instead, this post is about why GitHub profiles just aren't all that useful when looking to hire developers."

</comment></comment><comment><USER26> What I think a lot of the comments are missing is that, sure, a strong GitHub profile can be a positive signal for hiring, but an inactive GitHub profile is not a negative signal.

So no one should be "filtering out" inactive or boring profiles.

The exception I'll claim is for junior engineers. At that stage in someone's career, having a portfolio matters, and should be actively cultivating some kind of public code presence.

</comment><comment><USER27> I very much check GitHub profiles when hiring. Even if a person has a simple project on there it shows they have interest in coding, and I can see their style of coding. That's enough to swing my judgement when I'm deciding between two candidates that are close. GitHub alone won't get you the job, but it certainly will play a positive role in your profile.

</comment><comment><USER28> If we are being interviewed like carpenters, a carpenter's work may be a lot of effort to create and then none and it still remains created. Why is the age or spontaneity of the commits a factor? Yes I am working in a professional capacity and can't show any of that. Why not look at the table I created 2 years ago?

</comment><comment><USER29> > "Interviewers Don't Check GitHub Profiles"

This generalized statement is false; some do, some don't.

Been at multiple startups and the best candidates hired have great open source projects on github that indicates they're qualified for the role more than someone with nothing to show.

</comment><comment><USER30> The only question I can answer with GitHub is "can you use git." If I'm reviewing a candidate who says they are familiar with git based workflow and they provide a link to their GitHub with > 0 commits, check. If not, consider exploring in an interview.

</comment><comment><USER31> So of the 7.4% of users who pushed more than 10 times in the last year, how many are bootcamp students? (after you remove the big,open source projects like all the big companies have up there) I just think these students should know this.

</comment><comment><USER32> I think that "having github will help you" is the same kind of advice as "prefer to provide resume in pdf over doc".

There are people who believe in it, it seems reasonable, but in reality nobody cares. Just another cargo cult.

</comment><comment><USER33> When I am hiring, I tend to use a github account with an active project as a positive signal.

It shows me they can code, perhaps in the languages I am hiring for. It also shows me they know how to use version control.

</comment><comment><USER34> I rarely look at candidate's GitHub profiles anymore. I used to do it, but I didn't get much value from it, and I didn't notice any correlation to job performance.

</comment><comment><USER35> One thing that have always annoyed me about Github is the lack of (free) private repos which makes the activity history patchy. So you show that you're active for months on end, then then radio-silence for a month. Or when you delete/move a repo and suddenly months of activity disappears. Just makes it look like you've lost interest in what you were working on =(

<comment><USER36> Please don't do this -- GitHub does not register activity or hobbies outside of GitHub. You are arbitrarily ruling out people on BitBucket, Gitlab, and elsewhere, in addition to the legions of programmers that cannot post their work publicly and do not want to produce stuff on their own, unpaid, time.

<comment><USER37> Even if you do work on GitHub, when a repo is deleted, your activity on that repo is also deleted.

</comment></comment></comment><comment><USER7> Having personally used GitHub to aid in hiring developers, I find it to be a _very_ valuable resource ... provided it's used correctly. The author makes a few points that I would have considered somewhat obvious (i.e. social networking is not a metric that indicates a successful developer) and he's correctly pointing out that using it superficially as a sort-of "metrics engine" for developer candidate quality is going to yield poor results.

Case in point, the candidates I interviewed -- if they had any public Github projects: (1) had maybe one or two projects of their own that were public. (2) They were personal projects of varying levels of "quality", i.e. not their day job. (3) They were the only developer/committer and new commits were somewhat rare. For the most part, just the existence of a profile with some projects was a plus. Most candidates didn't give me a way to _see_ that they could actually _write software_ (fizz/buzz?) -- though there are ways to solve that without resorting to white-board or in-interview programming.

I started using GitHub and "external work" as an interview technique after an experience with one of my best hires. This was a candidate not unlike others that had a pretty dead profile, but there was _one_ project that showed code quality and thought that far exceeded "the typical". It was clearly "That One Project(tm)"; his baby. The code quality was quite good, it had documentation and it had thought put to its design[0]. It had zero stars or forks, but it was obvious this was a tool he wrote for himself and _really_ cared about. His interview started out very badly because he was nervous, but the project saved him. Mainly because I started wondering if he actually _wrote_ the code in that project (because he failed to answer some pretty basic code design questions), I pulled up his project and started asking him specific questions about _his_ code. He went from nervous to excited[1] and was suddenly able to explain things that he had a difficult time with when they were presented simply as abstract concepts.

I used to facilitate _many_ technical interviews, but it's been a little while since I've done one due to a new job/different company, however, I think the method I use is still the one I'd go to. The technique I used after this gentleman was to call the candidate a week in advance of the interview and ask if they have anything public, code wise (blog posts, SO/Github/Gitlab/Bitbucket profiles), that they can point me at or if they could provide some samples[2]. I always explicitly state "This doesn't need to be your best work, or even terribly great code, it just gives me a starting point to discuss development practices" and I recommend they pick something they've done recently since "any code we've written more than 6-months ago might as well have been written by someone else" The technical interviews would then, generally, be that candidate explaining their code, the choices they made, why they made them and what they think improvements would be in order of priority. That has worked _really_ well for me and beats the daylights out of any paper/pencil, whiteboard or even "code this on this laptop while I look over your shoulder"[3]. Assuming you successfully disarm the candidate with the "we're not judging your code (!)" preamble, I've found that people are _far_ more comfortable (and most legitimately _enjoy_ ) talking about things they've written -- even critiquing them[4].

[0] In this case, a unit tests covering the right parts of code, documentation, build instructions, logical layout/design -- he cared about this code and it gave a really good insight into

[1] Given his performance in the interview, I would have expected this person to be introverted and not a terribly motivated programmer... goes to show how terrible interviews are at judging people -- this guy ended up being the guy everyone else on the team looks to -- he was passionate in a job that, frankly, wasn't the sexiest programming job.

[2] This last point, to be clear, I expect to _never_ receive proprietary samples. It _did_ happen, once, and I didn't think this was something I had to actually state, but I wouldn't have hired someone who would share code they had agreed to protect since they'd be agreeing to the same thing working on the team they'd be going to.

[3] The difference between a great developer and a great developer who gets anxious during interviews is that the latter might be a little introverted/not good at interviewing -- a personality trait that I've found to be common and for every job I've done interviews for -- not a negative (and can just as much be a positive) for the work I was assisting in hiring for. One of the hardest working people I know -- a guy I'd work with on _literally anything_ because he'll make up for any deficiencies with sheer will and hard work -- has such anxiety in interviews that he _actually forgot his middle name_ in an interview (not completely, he just spaced -- hard -- my boss hired him anyway on my _strong_ recommendation).

[4] A small tip: Complimenting the work is an easy way to get things started smoothly -- it doesn't need to be phony; there's usually _some_ way to point out a few positive things about the work. Start there, ask questions in a manner that simply states a desire to understand the code more, and let things roll from there.

<comment><USER38> Interesting, thanks. Do you specifically ask the candidates if the code in their repository is all their own work? One small thing that worries me about relying on GitHub is that I can't be 100% sure that the author actually wrote all of it.

<comment><USER7> Yes. But mainly only to direct my questions. Whether or not they were the primary author was mostly only important in knowing how well they knew the code in question. If it was written entirely by someone else but they fully understood the code, that worked for me, too.

It was more important to me that a candidate could reason about the code in question -- even (perhaps especially) if it was an implementation they pulled directly from an SO post. There were occasions where I'd see unique implementations of common tasks (i.e. pulling a value out of a URI string that carried an unusual formatting pattern where simply using the URI parser in .NET wouldn't have worked directly). Having worked with a few different frameworks that use unusual URI formatting, I might ask why a regular expression was used over writing a custom parser tied to the Uri type (or vice-versa) and I was more interested in hearing the argument and reasoning behind it as well as whether or not the candidate could come up with pros/cons for both methods. Sometimes it'd be a custom implementation for something that could be done directly with features available in the framework -- and often the answer was obvious[0].

And a little humility doesn't hurt, either. I remember asking why someone used a regular expression to do some rather involved data extraction from an HTML source versus using something like Angle# and I recall the response was something along the liens of "Well, it started with pulling just URLs for a limited case and exploded into getting some metadata around the link, but it was for something at home and I put a total of ten seconds into thinking about how to do it right and if it stopped working completely, it didn't affect me all that much". Good enough; a lot of developers would go off into tall weeds defending bad code rather than just saying "sometimes the tolerance for error greatly exceeds the availability of time" or "I just didn't care enough" \-- especially in an interview where you are hyper-sensitive about looking bad -- and we all have a bunch of very dirty scripts that "work ... mostly". Provided it's not a theme of ambivalence throughout the interview, a little honesty at a time when it's tempting to fluff gave me confidence that when that developer made a mistake, he might actually own up to it.

[0] It's either "I didn't know it could be done that way" or the most common "I wrote it before that method/call existed" \-- since I was hiring for .NET positions at a time shortly after Framework 2/3.5, this was a _really_ common situation due to many new ways of doing things arriving with Generics/LINQ. And both were acceptable answers since it took some time for a lot of .NET folks to grok generics/LINQ and understand them well enough to realize the appropriate place for them (outside of just "oh, I can make a List of anything without having to use ArrayList of object types")

</comment></comment></comment><comment><USER39> Why are we reading this post?

"I've only had one job interview in the last decade or so, but as far as I could tell none of the people interviewing me checked out my GitHub profile before the interview"

So that makes this guy an expert?

<comment><USER40> That's really not a charitable representation of the article. When the HN guidelines say: "please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize", it applies to authors as well as commenters.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER39> Well, it is an honest question. And I don't think it is uncharitable at all. The premise of the article is that github does not help with interviews but it doesn't really provide facts to back that up.

<comment><USER41> It provides plenty of facts and data, but few anecdotes. That seems like a desirable situation.

<comment><USER39> I don't want to get into a comment war here. Let's just say I respectfully disagree that there is plenty of facts and data, and that what facts and data are there area really more of an opinion with thin data that seems to violate the new guidelines that are being brought up to say that my comment is out of place. In my opinion the author has gone out of his way to cherry pick data to support his claim and has not put effort into finding data that would prove him wrong.

<comment><USER41> You are welcome to your opinion about the quality of data provided by the author. But your original comment was attacking the lack of personal experience/anecdotes. That wouldn't improve things much, one way or another.

</comment></comment></comment></comment></comment></comment><comment><USER16> Github projects don't need to be impressive or have substantial technical depth to provide a positive signal.

For example, a good README can communicate someone's abilities in documentation, thoughtfulness, and design.

</comment><comment><USER42> Stitchpunk needs to :set expandtab

</comment><comment><USER43> Even when combined with your WakaTime profile to account for code written at work?

For ex: [https://wakatime.com/@alan](https://wakatime.com/@alan)</comment>


Faster, Better DOM manipulation with Dommy and ClojureScript - <AUTHOR> http://blog.getprismatic.com/blog/2013/4/29/faster-better-dom-manipulation-with-dommy-and-clojurescript <comment><USER2> ClojureScript is so different from JavaScript that it makes sense write a more native DOM library for it. As someone with a lisp background, it's very cool to see a high-profile company like Prismatic using it.

However, macros for javascript are being worked on. sweet.js is coming along _really_ well, and just needs to continue ironing out bugs and maturing. <http://sweetjs.org/> I believe that it could have a profound effect on JavaScript, such as parsing selector string at expand time.

<comment><USER3> Other languages can totally have macros, but unless you have homoiconicity, which lisp languages do, macros aren't easy to use or support. In ClojureScript, macros are built into the language.

<comment><USER2> That really only applies to `define-macro` style macros. You can have syntax- case style macros if the language can disambiguate reading and parsing, which a lot of them have trouble with, and why they don't support them.

sweet.js figured out how to do that in javascript, so we have full syntax-case macros just as easily.

<comment><USER4> Wait so does sweet.js support arbitrary JS execution in macros now?

<comment><USER2> Not yet, but it's theoretically possibly with all the groundwork that's already been done. See <https://github.com/mozilla/sweet.js/issues/12>

So I should have said syntax-rules (for now). My bad!

<comment><USER4> Seems like you would still need to provide something like syntax objects and a special API to manipulate them?

<comment><USER2> This involves a longer discussion, and I'm not sure what Tim is thinking along those lines. Suffice to say, Clojure's macros are always going to be the best, but I have pretty high hopes that you can get 95% of the way with sweet.js. :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Interesting, but I'm not sure how appropriate it is to be comparing it to jQuery in such a head-to-head fashion such as by saying "15x slower", etc. Does Dommy offer the same features (including the browser support) that jQuery does? If not, then you're just comparing apples to oranges, and it doesn't sound like it does (or even plans to) on account that it sounds like there are design decisions that separate the two with regards to the published API ("Inspired by jQuery, but adapted to be functional in order to better fit with ClojureScript core").

Also, wouldn't it be more accurate for the selector testing to actually test against Sizzle[1]?

Other features aren't even present in jQuery, such as templating, and so I'm not sure why you'd even compare that. Yes people can and do use templates with jQuery, but that's an implementation detail and is not a concern of the library itself; jQuery does not coerce or force you to use a slow templating system, and most any good templating system will also have a compilation step that is run at build-time. So yeah, you can take some ugly userland jQuery example code and make specific code that is faster..

1\. <https://github.com/jquery/sizzle>

<comment><USER6> > Does Dommy offer the same features (including the browser support) that > jQuery does?

No, currently Dommy has a smaller feature set that we think covers a majority of use cases, while maintaining reasonable browser support. Our general philosophy is to add functionality as we need it or others request it. I don't think this makes the comparison invalid. We're comparing the general use cases (selectors, basic dom manipulation, etc.) that any DOM library should have. Can you point out a specific comparison that doesn't apply because of api differences or browser support?

> wouldn't it be more accurate for the selector testing to actually test > against Sizzle[1]?

Part of the point is to show that you can achieve the same elegant chaining- like syntax as jQuery without wrapping selections, so maintaining the wrapped jQuery selectors are important for comparison.

> Other features aren't even present in jQuery, such as templating, and so I'm > not sure why you'd even compare that.

The point of the templating comparison is to show that macros can provide a significant performance boost while maintaining a sane syntax.

<comment><USER5> Isn't Dommy basically testing plain JS vs. jQuery at this point? That's kind of my point.

I'm also curious how well Dommy would perform in the 'real world'; seeing as everything is compiled down to plain JS, then the divide between library and implementation is removed. jQuery is a larger download hit on the first visit, but if it's already in cache (perhaps before they even reach your site) then the only code required to be downloaded is your app's specific implementation.

In the Dommy example for the templates, the jQuery code is 10 lines -- when formatted like generated.js (the equivalent Dommy code) and removing 2 unnecessary variable declarations. By contrast, generated.js is around 60 lines (giving you a few on account that there's some empty else- statements...). I know minification can do wonders, but the jQuery implementation is clearly going to be much fewer bytes. At what point does it eclipse the size of the jQuery lib itself? I guess that's up to usage.

If your library _is_ the implementation, then it'd seem like you'd have a lot more data being sent over the wire, and likely more often as well on account of any changes to the Dommy which alters the output will have an effect on the cached files for each of them where that functionality was used. On the other hand, updating jQuery means only the 1 file has to be re-downloaded -- and not every userland implementation which uses the API.

</comment></comment></comment><comment><USER7> This is super impressive. I'm going to use this for my frontend work now. On a side note, what's the idiomatic structure, or "design pattern" for cljs front end code? I would assume something based on MVC, with models comprising of atoms with watches, Views consisting of hiccup templates and controllers gluing dom events to models and views. Am I close?

<comment><USER3> We internally have a nice component/widget abstraction we use which is not quite MVC, but we think cleans up a lot of web development. We will release in the near future once we perfect it.

<comment><USER8> Cool! I am wondering if you have worked with other frameworks like Pedestal.io, C2, or WebFUI, Ganelon. Or any others. What do you think of them?

I am just getting started with Clojure/CS and am evaluating the different options.

<http://pedestal.io/> <http://keminglabs.com/c2/> <https://github.com/drcode/webfui> <http://ganelon.tomeklipski.com/>

<comment><USER9> Take a look at Luminus.

</comment></comment></comment></comment><comment><USER10> >> Again the time saving comes from macros moving the work of parsing the template data structures from runtime to compile-time and directly generating efficient JavaScript.

If it ends being javascript string in the ends, how is it 7x faster (or whatever number)? I mean, sure the compiler could optimize a part of my code, but other javascript compiler could do it to.. right?

Although I find the Clojure example very sexy, I don't like how the examples tries to compare to contrived Javascript. I.e. I've been coding javascript for a couple years and I've never used jQuery "sort/filter/slice". But more importantly, it uses pre-defined function in Dommy but not in javascript. For instance:

      (->> (sel [:ul.my-list :li])
         (sort-by #(-> % (sel :input.last-name) .-value))

This uses sort-by where there's:

      function(a, b) {
        return (
            $(a).find('input.last-name').val()
          .localeCompare(
            $(b).find('input.last-name').val()
          )
        );

in Javascript.. Obviously, I can say:

      $('ul.my-list li').sortBy(function(x) { return x.attr('last-name'); }

My point isn't that much that jQuery is longer/shorter, but mostly that if two examples in two different languages are to be compared, it makes sense to use the same function.. where in this case sort-by is a high-level sort.

>> One is the loneliest number

It's not just "1" or "more than one", it's also zero. Iterating on a list makes it such that you can freely think in a high-level way about the operation and not about the exceptional cases. I.e. $('.blabla').hide(); It Just Works.

>> (mapv #(add-class! % :first-ten-adults)))

Yes, of course you can use map.. but using $('..').addClass('first-ten- adults') makes it so much easier to deal with, instead of knowing what works on one object, what works on multiple objects, what will throw an error if there's nothing, etc.

Meh.

I think Dommy is a great library but the author didn't do a great job at explaining why it rocks. I guess attacking a very popular language with its most popular library doesn't help :p

<comment><USER11> Re sort-by: the point there was to show how Dommy gets for free "features" that have to be added to jQuery and contribute to its code size.

Re one/map: you can still do operations on sets of 0, 1, or any number of elements, without knowing how many, by always doing map. There's nothing to keep track of, everything always only works on one object, so you're explicit about whether you're operating on exactly one object, or whether you don't care how many objects you're operating on. The latter is just as convenient as jQuery; the former is safer and deliberate. In jQuery, on the other hand, you have to keep track of what works on one object and what works on multiple objects: .text() and .text('a string') are asymmetrical, for example.

</comment></comment><comment><USER12> Whilst I'm sure this is clever - I guess I'll never understand the obsession with micro DOM optimisations. When, ever, are we severely held back by the 'speed' of our selectors? It just doesn't happen!

<comment><USER13> There are some web apps out there that are sluggish as hell if one doesn't have the latest beefy machine. Gmail or Google Doc running on old hardwere are examples of this. "Mobile web" apps are _very_ sensitive to DOM manipulation performance too.

I'm not saying that all sluggish performance in web apps is caused by inefficient DOM manipulations, but having a DRY _and_ efficient way to express DOM manipulations could help a lot in that regard =D

</comment></comment><comment><USER3> Author here. Happy to answer any questions/concerns.

<comment><USER14> does Dommy provide a pure API on top of the DOM? (e.g., lens based) I don't immediately understand how one would make that performant given that the DOM is a mutable data structure.

edit: WebFUI[1] is one clojurescript project trying to provide a pure interface for dom manipulation; there are others.

[1] <https://github.com/drcode/webfui>

<comment><USER3> No. We're not trying to do something pure on top of the DOM. That isn't feasible for performant manipulation. Being functional is about more than just immutability.

We use standard manipulation.

</comment></comment></comment><comment><USER9> Carthago delenda est: when are you re-releasing the software you yanked from your Github?

<comment><USER15> We're working on it! We removed the software because it needed extensive cross-project reorganization, consolidation, and cleanup which just wasn't possible to do with a clean upgrade path using available resources (3 backend engineers). Plans are to re-release all of this and more, and we've already started with Plumbing and Graph: <https://github.com/prismatic/plumbing>. Which librar(ies) in particular are you most interested in?

</comment></comment><comment><USER16> All this talk of jQuery and no mention of domina (<https://github.com/levand/domina>) the native clojurescript dom manipulation library? I've since abandoned css and jquery selectors in favor of using domina.xpath.

I also want to mention webfui (<https://github.com/drcode/webfui>). It is authored by Conrad Barski, who also wrote Land of Lisp. He gave a nice talk about it at the Chicago Clojure meetup group a few months back. He is a fellow hacker news user so I figured he deserved a shout out.

</comment><comment><USER17> I'd love to use Clojure and clojurescript to replace js/ruby. It's a shame I never come across consulting gigs that use it. Or know any local clojure devs, so I'm still wary of using it on my own projects.

So it continues to only be the ideal choice for pet projects.

</comment><comment><USER18> It would be more interesting if someone wrote something like this for standard jQuery-compatible syntax. jQuery code in, compiled selectors out. And it's just standard javascript, so no learning curve to learn or anything.

<comment><USER19> Yes, and a compile step is necessary to produce JS code for those macros. Sounds like it would be really good with coffeescript, like.</comment></comment>


Macs May Be Getting 'Pro Mode' Option to Boost Performance - <AUTHOR> https://www.macrumors.com/2020/01/13/pro-mode-macos-catalina-beta/ <comment><USER2> I had a Lenovo computer that had this feature almost 10 years ago.</comment>


Eventtus: How we decided to use Mongo instead of MySQL - <AUTHOR> http://engineering.eventtus.com/post/69485634651/how-we-decided-to-use-mongo-instead-of-mysql

<comment><USER2> I like that this article doesn't say this is the best solution for everything. no way you can have one solution for all problems</comment>


The paradox of technology and how to avoid it - <AUTHOR> http://blog.usabilla.com/the-paradox-of-technology-and-5-ways-to-avoid-it/

<comment><USER2> You see, that's what's wrong with GUIs. You have to dumb down everything just so your casual users can use it. And when I'm not a casual user anymore I'm stuck, because you decided for me what features are "confusing" or not. That's why, IMO, things like basecamp suck.</comment>


Dashlane's Password Management Service Security Whitepaper [pdf] - <AUTHOR> https://www.dashlane.com/download/Security-Whitepaper-Final-Nov-2011.pdf

<comment><AUTHOR> While reading, I was a bit concerned/confused by the section "Anti-Click Jacking Provisions", especially I don't really understand things like: > the popups used to trigger form-filling on a webpage are C++ popups Is this marketing? Does this apply as Dashlane is a desktop/mobile app, i.e. non-web- based?

(note: I'm genuinely interested in the discussion and the content of the whitepaper, the fact that it comes from Dashlane is irrelevant to me).</comment>


Exploiting the unexploitable, Linux 2.6.30+/SELinux/RHEL5 test kernel 0day - <AUTHOR> http://lists.grok.org.uk/pipermail/full-disclosure/2009-July/069714.html

<comment><USER2> So, to make a long story short, apparently compiling your kernel with -fno- delete-null-pointer-checks removes this kind of vulnerability.

It's a good thing this is a local exploit... humble fellow too...

</comment><comment><USER3> Looks like it is using suid pulseaudio to load the exploit into the kernel. I don't think RHEL5 systems install pulseaudio by default. Also note that this is a local exploit, you need access to a user account on the system.

ETA: I just tried this on a CentOS5 vmware image (2.6.18-92.1.22.el5) without SELinux and couldn't get it to work.

<comment><USER4> I think the whole pulse audio thing is just for a little entertainment. Check the description in "exploit.c".

<comment><USER5> My understanding is that it uses pulseaudio to avoid null pointer dereference protection, but the hole is in the tunneling driver.

<comment><USER6> Any SUID binary which allows library loading would work for this purpose. Normally that's not a security problem, but a combination of other factors has allowed it to become one.

<comment><USER7> "Normally that's not a security problem" ? PulseAudio allowing arbitrary code loaded into a suid root app via command line parameters is a gaping security hole by itself.

This exploit used a trivial root exploit to setup a deeper kernel level exploit, that can bypass SELinux, hide itself completely, etc.

</comment></comment></comment></comment></comment><comment><USER8> Kudos on cracking SELinux!</comment>


Ask HN: Are there technical measures you take to protect your children online? - <AUTHOR> I don't want to spy on my kids, but I also want to take reasonable steps to protect my children from bad actors and can't-be-unseen internet content.<p>My wife and I talk with them about internet safety, but I'm interested in what (if any) technical measures HN moms, dads, and guardians have found helpful as age-appropriate internet guardrails. <comment><USER4> Yes, I use screentime on our iPod touch. Still a bit buggy sometimes but usually works. How I set it up:

\- 8am-9pm

\- Time limits per category, say 1 hour per day weekdays, 1.5 hours weekends

\- Safari, only with whitelisted educational sites like Wikipedia, pbskids, etc.

\- No social media accounts allowed.

\- Location services off, other access (microphone, camera, etc) denied to most apps.

\- No Youtube or other predatory apps. See recent HN stories:

Google, YouTube to Pay $170M Penalty over Collecting Kids' Personal Info: [https://news.ycombinator.com/item?id=20876960](https://news.ycombinator.com/item?id=20876960)

Adult Content Disguised as Kids Videos Is Flooding YouTube: [https://news.ycombinator.com/item?id=21937464](https://news.ycombinator.com/item?id=21937464)

I restrict Netflix as well because most kids programming is low quality even when not inappropriate.

<comment><USER5> How old are your kids? I'm not a parent so I have a different perspective but I wonder, what kind of stuff could actually be done on such a device? Web browsing restrictions mean you can't actually browse the web in a meaningful way because most links lead to non-whitelisted websites. Time limits mean there's barely any time to do anything (and you'd end up running into the limit at the worst possible time).

<comment><USER4> That's the point. Tenish. An hour or two per day is plenty, imho. Usage is mostly iMessage with friends, learning Japanese, photos, and listening to music and podcasts. It warns you and easy to ask for a bit more time. Leaves plenty of time for reading, family, and chores.

I also put many of these restrictions on myself recently so I could get more sleep, haha.

</comment></comment></comment><comment><USER6> Don't give them a mobile phone until they are 16. Give them a dumb phone, if you must. Educate them if the why. Be consistent and use a dumb dumbphone yourself.

Nothing works that you don't do yourself. My parents told me not to smoke as they lot their cigarettes. Told me it's an adult thing, which was a very bad idea now that I think about it. I don't smoke, but not because of them. If anything, in spite of

<comment><USER6> One more thing, I'd give them desktop computers so they learn to differentiate time spent on the screen and time spent away from it. Laptops are too easy to bring to bed, toilet, etc. Just like smart phones.

</comment></comment><comment><USER7> Not a parent, but I did build parts of OpenDNS's content filtering offering. You can point your routers DNS to 220.127.116.11 and 18.104.22.168 to get a basic level of filtering for the most obvious porn, malware, and phishing sites. More fine grained network controls come with an account.

<comment><USER8> Yup. A similar service:

[https://cleanbrowsing.org/](https://cleanbrowsing.org/)

</comment></comment><comment> jerome-jh I used to use OpenDNS for my grown-up child who is now an adult. For my younger daughters, we use basically nothing. The rules are:

\- no tablet after dinner

\- no tablet in the bedroom

\- ask before searching something on the internet

They are only loosely enforced, but we are always in a position to ask: "what are you watching/doing?" and do so casually from time to time. Search engines filter inappropriate contents much better than a few years ago. No Youtube, and they moved away Youtube kid by themselves, preferring TV replay.

They are not old enough to have a phone, so that is pretty easy, for now :)

</comment><comment><USER9> 11 and 6yo kids here.

In Android: We use Family Link to approve apps installation and set app time limits per day. No social/user generated content apps. 11yo has access to Edge browser (more on that in Windows).

In Windows: We use Microsoft Family to monitor screen time/usage. We also whitelist webpages that can be visited through Edge (settings translate to Android's Edge).

We only just got a SIM card for our 11yo (so we and family can communicate with her), we closely monitor usage and gave strict guidelines about not answering calls/texts from numbers not in the contact list.

<comment><USER4> Unfortunately android and windows are known to be collecting, storing, and (windows) potentially selling lots of information about the user and device. I think this makes them unsuitable for children.

<comment><USER6> It's not about privacy, it's about not letting kids fall for Skinner box sites like YT, imgur, etc

<comment><USER4> It's about privacy and those things.

</comment></comment></comment></comment><comment><USER8> Whitelisting. I have used webconverger, routerlimits, and Screen Time (on Apple devices) at various times and places to achieve this. Anything else I tried, the darn kids found ways around.

</comment><comment><USER10> Depends on age and maturity.

When given access to computing had discussions about finding things you may not understand or extreme weird things - and that he/she can talk with us to discuss these things.

We occasionally look at url history to this day.

later showed how to use multiple sources to check for accurate info and showed how mayo clinic, webmd, a few others may offer different details.

Showed articles from the news where people stalked and tried to kidnap based upon online chats.

Did research on software - used family-link on google to block things until age 13 when family auto-destructs.

Had discussions every few months about how people show edited bad things to get others to to bad things - story about the 'bernie sanders freedom sticks' \- other challenges' where people got seriously hurt or killed.

Talked about how sharing a picture could give you your exact location in multiple ways.. and if other details were known like time or whether or time school starts, how that process is easier.

Decided Disney cirlce's dns poison on the router and via app on the phone is the best censoring we could find. Then found out we can't afford it.

Found out other kid never uses youtube on his phone and cant use directions apps cuz the family link from google.. found out other kid tells that kid to install amino chat(?) and it iframes youtube (non-kids version) - they are hackers already..

Show article from yahoo news recently about the grooming kids via list of apps, getting them to send pics, then blackmail for more - depression and crap.

Show them that anyone can voice change and appear to be a girl or kid using phone apps and even method to do so on playstation mic.

Show how I can use a cam plugin to show "live cam" form my system, which is actually some random girl not me..

I have been considering getting some people together to build an app that semi-spies on kid's audio - and auto erases 90% of it.. and only sending a notice or save if it gets hits on certain keywords.. and make that toggle-able for various parents.. some might want sex keywords.. I think suicide related ones would be pretty universal.. but able to toggle others.. some parents no cuss words.. it's still various napkins of ideas.. something maybe with mycroft or similar that does not send audio to the cloud..

Keeping an ear out... my stepkid can and does tell me various things that are going in his digital world and I cam always accepting / listening, not getting angry - and I offer counter info on occasion..

The surprise I had when I found that a meme-thread-group was pushing extreme anti-feminist stuff... I did not show my emotions, I instead offered multiple other viewpoints and said perhaps reality is in the middle and there are extremes and edge cases here and there that do not represent the masses..

Looked into the open source disney-circle like thing - could not figure out how to make it work after studying a couple hours.

There have been more things over things, I'll try to remember and add.

<comment><USER5> Kudos on showing your kids real-world examples of how bad stuff is done and the consequences of it, but on the other hand by reading your list it seems like there's so much danger out there it would be a miracle if any kid manages to survive.

Counterpoint: grew up with full unrestricted access to the internet - <USER2> were both trusting me not to do bad things and also clueless about technology. Saw things most parents would consider the end of the world (aka pornography), somehow it didn't kill me or seemed to affect me in any way and I still ended up fine.

<comment><USER10> I appreciate your counter point completely. I would not care too much if my kids viewed some porn, but might want to keep a look out to make sure it did not turn into being only the 'forced' type that xham offers.. I think people need to see a little of everything that is out there.. but more importantly have people or groups they can go to and talk about what they have seen - <USER3> know they can research multiple sources for info about things to know effects of them.

This was not too much a concern when the main desire was club penguin and youtube... however once a large par tof net access becomes amino chats, discord chats, meme boards and the such, I think it's important to discuss some of the dangers if it's relevant (I noticed when asked to fix something on the phone that selfie's started appearing in gallery) - this could be innocent but it could also be leading to not so much

If I had a daughter she might spend all of her time only chatting with her close friends she knows in real life until college - in which case my discussions would probably not be so many 'these-bad-things-can happen' \- a different situation compeltely..

I used news stories and stuff that has aired on local tc broadcasts, and some from yahoo and such - I did not dig deep for horror stories... I think the most important thing is not to flip out and remain an open line of communication no matter how terrible something could be.

So again it varies by each person... I don't think you want to wait until your kid is swatting the neighbors and showing off on 4chan to pay attention to what they are learning / engaging in online.

I also would not have a device report to me if it heard youngsters talking about sex, people should talk about that and share what they know. I would perhaps want an alert if 'plane tickets' came up or 'sneak out' or 'skip school' maybe.. then I'd want to know more surrounding, but that is now and that might be different a couple years from now.</comment></comment></comment>


Fire Mario, Not Fire Flowers - <AUTHOR> http://words.steveklabnik.com/fire-mario-not-fire-flowers <comment><USER2> As I monologued elsewhere:

If C is like playing with knives and C++ is juggling chainsaws, Rust is like parkour suspended from strings&wearing protective gear. It'll look ridiculous at times, but you'll be able to do all sorts of cool moves that would otherwise be damn scary or outright impossible. You'll have so much fun you'll start trying to do it in other languages, too. And many of us never look back.

Especially when we hear stories about knife players ending up with a bleeding heart, and that one chainsaw juggler who lost their poodle. At the beginning, you fear the padding will hinder you, but by now you learned that its clever design allows you to move as fast as without it. A bit faster, actually, since you're no longer on the lookout for ledges you might stumble over.

Also you get new improved gear every six weeks, and between this and your newly built muscles, you start feeling like a super hero. This feeling is amplified by the community, which simultaneously does awesome feats and is really humble and open about it (you're by now accustomed to people being good at concurrency, and get slightly annoyed that your snake-charming friends insist on doing everything one step at a time).

You also met some folks you wouldn't have expected here, from a number of dynamic languages, braving the learning curve to descend into low-level programming, usually singing Rust's praises with unreal sounding benchmark comparisons.

You start looking with pity at your knive- and chainsaw-wielding friends. You see both their bruises and denial about said bruises. You'd want to offer them some of that awesome protective gear (by now you no longer feel the strings, because they seldom get taut), but you know the answer already. Poor folks.

We are super heroes. We are legion. Join us!

<comment><USER3> > If C is like playing with knives and C++ is juggling chainsaws, Rust is like > parkour suspended from strings&wearing protective gear.

I hereby declare this week "Creative new similes + metaphors for programming languages week."

</comment></comment><comment><USER4> I think his point is sound. His arguments are in line with the ones from Kathy Sierra's book Badass: focus on making your user awesome, instead of telling them how awesome your app is. Or in Rust's case, tell users how great they will be at systems programming when they pick up Rust, instead of technical details like "memory safety without garbage collection."</comment>


Ask HN: What is the best way to find remote full time work? - <AUTHOR> Are there any tools that make the search easier? <comment><USER2> I make a site called [https://remoteok.io](https://remoteok.io) where I collect most new remote jobs from traditional job boards, as well as have fully-remote companies post directly.

You can also set up email alerts on there to get notified first when a new remote job appears in your specific niche (like DevOps).

Hope it helps and let me know if you have feedback.

<comment><USER3> I like the site, but It keeps crashing the chrome browser on Android unfortunately.

</comment></comment><comment><USER4> As they say: "Looking for a job should be a full time job", or in other words: put your full time and effort in it. When not applying for job - study. When you are applying - do your research about every company you send your mail to. That way even with shittiest tools you can have success. Good luck!

<comment><USER5> Yep that's the approach I took when I started my job search a year ago. Took notes on every potential employer, managed my interview schedule very carefully, made sure always to have my phone with me. It worked very well and within 6 months I got like 20-30 really good paying jobs at reputable and respectable companies, and several of them were remote (or mostly remote) positions. So it's doable if you make a point of it.

</comment></comment><comment><USER6> The best jobs come when you have an in. Someone refers you, someone you know is a manager inside, etc.

You get ins by building your network. Meet people, talk to them, make what you do public. This can be easier in a big city.

But, if you aren't in a big city, one strategy: find a Slack channel for a big city nearish to you and hang out in there. Get to know people. Demonstrate competence.

The Chicago Tech Slack is a great example of a place that would be great for this.

Jobs are posted all the time in there. There's a guy in there who does job placement services and I got added to his rolodex just by existing inside of the Slack.

Another option: participate in Hacker News. I got one job by saying "Yeah I spent a year traveling and doing remote Django work." To which someone responded "Are you still interested in doing remote Django work? I need someone."

Finding work is "all luck", but increasing your "luck surface area" by exposing yourself to more serendipitous events can systematize that "all luck".

</comment><comment><USER7> This repo [https://github.com/lukasz-madon/awesome-remote- job](https://github.com/lukasz-madon/awesome-remote-job) contains plenty of resources

<comment><USER3> For those on mobile, this is the file you are looking for in that repo. [https://github.com/lukasz-madon/awesome-remote- job/blob/mast...](https://github.com/lukasz-madon/awesome-remote- job/blob/master/README.md#companies-with-remote-dna)

</comment></comment><comment><USER8> The easiest way is to have an office job and slowly switch to remote. Once you have remote experience, it's much easier to get a fully remote position from a job board or connections.

<comment><USER9> i second this approach, get an office job, prove yourself to be valuable, request remote, I've done this successfully twice.

</comment></comment><comment><USER10> I send out a newsletter every 2 weeks with a hand curated list of remote jobs which I think are interesting - [https://remotejobsclub.com](https://remotejobsclub.com)

You could also look at the popular job aggregators like remoteok, weworkremotely... etc

<comment><USER11> How is the conversion on the leave-site popup?

<comment><USER10> To be honest, I have no idea. I should really add some tracking, but haven't got around to it yet!

</comment></comment></comment><comment><USER12> I find remote work by simply demanding it, but be willing to do office visits if needed. If the hiring manager likes you, they'll come around. Also I find not budging on rate because of working remotely is a better look. Don't be desperate. Be Patient.

</comment><comment><USER13> I had luck in the past being a solid member of a dev team and asking for more remote time. Finding good devs is really hard and a remote one is better than a new one.

<comment><USER14> This is great advice. If you're in demand, it's usually straightforward to turn an in-person job into a remote job.

</comment></comment><comment><USER15> I found my current job (remote, full time) on [https://weworkremotely.com/](https://weworkremotely.com/). It's been a little over two years so I'm not sure how the site is now, but at the time it seemed pretty decent. Maybe a little low traffic compared to non-remote boards, but I think that's to be expected.

</comment><comment><USER16> Is working remotely something you put on your resume? I am currently a remote intern for a company that would be a Fortune 500 if it did not domesticate to Switzerland. I am graduating in next month and will move into an office based full-time position, but remote work does sound great. Is it in the realm of possibility for a new graduate?

</comment><comment><USER17> I keep a list of 50+ sites that focus on remote-first (or remote-only) jobs:

[https://userinterfacing.com/here-is-the-full-list-of- my-50-r...](https://userinterfacing.com/here-is-the-full-list-of-my-50-remote- job-sites/)

</comment><comment><USER18> upwork.com - I am a remote developer for over a decade now, started working remote when was still odesk.com in Dec 2007. Best decision ever, I have my own hours, bid on what interests me, get to have time with kids all day.

</comment><comment><USER19> Like most jobs it's who you know, start asking around/working in your network.</comment>


StartSSL vs. Let's encrypt - <AUTHOR> http://pastebin.com/GbsBB3My <comment><USER2> I'm excited to see another player in the market for easy, free certificates.

I do wonder, though, why StartSSL seems to care so much about ownership of the free certificate market. What value do they derive from it?

<comment><USER3> Because they make money on revocation and validation (OV/EV in particular)</comment></comment>


Attack of the 50-foot blockchain, a sceptic's guide to crypto - <AUTHOR> https://ftalphaville.ft.com/2017/07/27/2191972/attack-of-the-50-foot-blockchain-a-sceptics-guide-to-crypto/ <comment><AUTHOR> A Google Title search should present the article page without a registration requirement.

The content is a podcast available (for now) via Soundcloud:

[https://m.soundcloud.com/user-544122300/gerardpod](https://m.soundcloud.com/user-544122300/gerardpod)</comment>


Can a molecule that makes mice smarter heal a human brain? - <AUTHOR> https://www.statnews.com/2016/09/28/memory-isrib-peter-walter/ <comment><USER2> FTA:

"To Walter's dismay, some are buying ISRIB online and ingesting it, long before it's been extensively tested...

Some outside scientists remain skeptical. They warn that interfering with vital cellular mechanisms, as ISRIB seems to do, could lead to a host of dangerous side effects. They caution that it will be years, or possibly decades, before it's ready for testing in humans."

Cause, meet effect.

</comment><comment><USER3> Isn't _Flowers for Algernon_ required 7th-grade reading anymore? This isn't going to end well, people.

<comment><USER4> I would guess that you are right simply because most drugs that initially show promise in mice fail during clinical trials in humans.

But it's also worth remembering that the trope in fiction of _$REALLY_GOOD_THING_ turning out to be _$BAD_THING_ in disguise is just that, dramatically convenient fiction. There's no natural "game balance" to the universe. Yet popular entertainment is very small-c conservative about human improvement; if vaccines were still the stuff of fiction rather than daily life, a TV drama would show that universal prevention of smallpox has some terrible side effect that turns out to be worse than just letting people get infected and die. Fortunately we know that to be false but it won't stop dramatists and those shaped by them for immediately looking at newer biomedical advances with the most crushing cynicism.

(Not _really_ directed at you, since I take it you're joking a bit, but this was the comment that prompted my thoughts...)

<comment><USER5> > I would guess that you are right simply because most drugs that initially > show promise in mice fail during clinical trials in humans.

What about the contrapositive... How many substances fail in mouse studies (and are discarded), yet would have been viable in humans? Any known examples of this?

<comment><USER4> I don't know off the top of my head of any drugs that work in humans but have intolerable problems in mice. I do know that some substances are much more toxic to other mammals than to us. For example, acetaminophen is very toxic to cats. Theobromine is much more toxic to dogs and cats than to humans. 2,3,7,8-Tetrachlorodibenzo-p-dioxin is rapidly lethal to guinea pigs at a level that might only cause skin problems and/or reproductive defects in humans.

<comment><USER6> Minoxidil, the active ingredient in Rogaine, is lethal to cats.

<comment><USER7> Curiously, felines are apparently among the most resistant mammals to prions, maybe second to pigs.

</comment></comment></comment></comment></comment></comment><comment><USER8> The fact that you can patent a molecule blows my mind.

<comment><USER9> This is how big pharma works.

<comment><USER10> Yep, isolate lovastatin from red yeast, patent it, market it, and then try to make the supplements take it out since they're not FDA regulated.

BTW, red yeast rice did wonders for my blood work.

</comment></comment></comment><comment><USER11> I am curious. Does anyone know someone who has tried this on themselves yet?

<comment><USER12> Some "life extension" site forum had a group buy for the stuff apparently. People posted some of their results:

[http://www.longecity.org/forum/topic/68589-isrib-group- buy-n...](http://www.longecity.org/forum/topic/68589-isrib-group-buy-new/)

One quote: _So far I 'm very much surprised about the effect on the overall cognition. My personal experiences are, that ISRIB definitely has it's effects on memory consolidation, but in my experience it doesn't only influence the long term memory formation (as JPC suggested), but the short term memory as well. It mens practicaly, that while reading a text, it is way much easier to remember the words, expression, and contexts as well (after 1-2 days). For instance currently I'm studying medicine basics again (I will enter a residency program soon), the subjects floaded with unique expressions related to molecular biology, basics of anatomy etc.. meaning, they are not very easy to link while memorizing even for a medical professional (they are meant to be boring..), and so far, after two days (meaning the text I read on friday) I can still remember a lot sharper on the names of for example cellular proteins, special basic physiological mechanisms than before, it is very obvious to me. I have to add, that I would value my memory above the average (as far as I can asses), but lately I somehow got slower by memorisation (I think it is an aging effect, and that was one of the reasons, why I started to search for some chemical hacking of my brain..)._

<comment><USER13> Sample size of 1, no blinding, no verification of the substance received. Quite worthless.

Placebo effect is strong enough children recognised as more intelligent by chance do act and measure smarter.

<comment><USER5> Many major innovations occurred from individuals experimenting on themselves. In fact, it's one of the few ways to make progress when you have overbearing regulatory agencies.

You should be glad that many enterprising "sample sizes of one" are willing to become anecdata for everyone else. They push the boundaries so that maybe, just maybe, we get the benefits of these advances within our lifetimes rather than after many generations of careful study (ie. too late for me).

Carry on, intrepid experimenters! Some of us appreciate your reckless abandon.

<comment><USER14> But we can't know from a sample of one whether the placebo effect was in play, or whether the individual's response was atypical.

<comment><USER5> How do you think humanity learned about new medicines before clinical studies? A journey of a thousand miles starts with a single step; or in this case, a single experimenter.

<comment> crooked-v This is also how people learn about the dangers of fan death, how carrots help improve your night vision, and that bulls are enraged by the color red.

<comment><USER5> Those examples seem _super_ consequential compared to all the medical advancements that we got... I would gladly keep the medical advancements in exchange for turning off fans inside, eating more carrots, and avoiding red around bulls (or just avoiding bulls altogether; they stink).

Thankfully, humans like to try new things and then apply cause-and-effect reasoning to create good, new hypothesis (based by early citizen science evidence). I suspect that trait has massive benefits in our evolution. I hope people don't get put off by calls for "rigorous science" and keep experimenting on their own... and that the scientific establishment latches on to good ideas to do more rigorous studies! [The two aren't mutually exclusive! It's not zero sum!]

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> How does this now-patented "ISRIB" molecule compare to Leonard Guarente's research[1][2] on nicotinamide riboside and pterostilbene supplementation?

[1]: [http://nymag.com/scienceofus/2016/08/is-elysium-healths- basi...](http://nymag.com/scienceofus/2016/08/is-elysium-healths-basis-the- fountain-of-youth.html)

[2]: [https://news.ycombinator.com/item?id=12345526](https://news.ycombinator.com/item?id=12345526)

</comment><comment><USER13> An interesting new approach. Let's wait for the studies to follow.

He is mistaken about "nothing" in case of brain trauma. Racetams have been shown to be mildly effective.

</comment><comment><USER16> What if the drug only makes mice be more nervous or active and that's why they found the submerged platform more quickly?

</comment><comment><USER17> What's the difference between healing a brain and just generally improving a brain?

<comment><USER18> A semi-facetious question, perhaps? Healing at least is a return to a baseline, "generally improving" is more subjective. I would tend to expect that changing any system as complex as the human brain would have the potential for improving some things, while impairing others. Not that it would impossible to find a compound that only produced changes we considered positive, without any we considered negative - just unlikely.

<comment><USER17> Not facetious at all.

If I take that molecule and find that I can acquire perfect pitch as an adult or easily learn a new language, was my brain "damaged" prior to taking the drug?

<comment><USER18> Different, clearly, but the 'damage' (or 'healing') would be subjective, wouldn't it? Since most of our organ systems return to the mean, I still suspect it's more likely that taking it when you have no reason to would be more likely to cause negative changes, rather than positive ones - but brave people are apparently willing to make that gamble.

</comment></comment></comment></comment><comment><USER19> The article's title on statnews.com bugs me, I admit I have not investigated this case, but...

I suspect it wasn't that graying old man that discovered that molecule, but that man's brilliant but underpaid post-doc that discovered that molecule.

<comment><USER11> Walter (Main Investigator), gave credit to Carmela Sidrauski his Post-Doc. He said if it were not for her, they would not have looked at it. The chemical itself was kicked out by a massive screening of small molecules, but originally not looked at because it was not very soluble.</comment></comment>


Mail from Amazon that my password has been changed - <AUTHOR> I got a mail today from Amazon that my password has been changed due to security reasons.<p>".... As part of our routine monitoring, we discovered a list of email address and password sets posted online. While the list was not Amazon-related, we know that many customers reuse their passwords on several websites. We believe your email address and password set were on that list. So we have taken the precaution of resetting your Amazon.com password..."<p>Any idea, which list are they talking about? <comment><USER2> Did you look at the email routing paths to make sure it is genuinely of Amazon origin? More importantly, is any given link actually resolving to amazon.com?

<comment><AUTHOR> Yea, it's originated from Amazon IP addresses and my amazon password has be reset as well.

</comment></comment><comment><USER3> [https://haveibeenpwned.com/](https://haveibeenpwned.com/) maybe</comment>


The Morning After: Startup Famous for 24 Hours - <AUTHOR> https://medium.com/@cliffordoravec/the-morning-after-startup-famous-for-24-hours-dab9d6b2c036#.y3iyqc6yo <comment><USER2> Clutching back for another fix huh? In all honesty great article. Would have liked to see it written after the 31st to see conversions.

<comment><USER3> I wanted to get this out while it was still pertinent and relevant but do plan on updating the article in a few days with those stats.

</comment></comment><comment><USER4> I'd love to see you write the book you mentioned at the end of the post. I'd buy it :=)

</comment><comment><USER5> Looks like you made it to #2 on the daily front page (bested only by Zuckerberg haha) :)

[https://news.ycombinator.com/front?day=2016-12-19](https://news.ycombinator.com/front?day=2016-12-19)

<comment><USER3> Wow, I didn't realize it made #2 - thanks!

And yeah, I'll take that hit - kinda hard to compete with the Zuckerberg/Freeman power combo ;-P

</comment></comment><comment><USER6> Great read. Congrats on the bump - here's hoping you catch another wave :)

</comment><comment><USER7> If you write the book I'll buy it</comment>


Making Bluetooth Work on Lenovo X1 Carbon 6th Gen with Linux - <AUTHOR> https://200ok.ch/posts/2018-12-17_making_bluetooth_work_on_lenovo_x1_carbon_6th_gen_with_linux.html <comment><USER2> It's kind of sad that getting things to work on Linux almost invariably ends up requiring taking magical incantations from a dozen different sources in the hopes that it will fix your problem.

<comment><USER3> When something breaks on Windows, the situation is no different and in fact possibly worse. Since it is proprietary, you have far fewer people who really know the innermost guts of the system and can help. Microsoft's own forums are practically useless for non-paying 'users.' As for the rest of the Internet, it is the same as Linux:

"Run this command and tell me the output"

"Run this script as admin/root"

"Go into these folders and delete these files"

"Add these lines to these files (Linux)/Registry (Windows)"

and of course the famous:

"Reset/Refresh/Reinstall" catch-all.

The problem is exponential complexity of interactions of various systems, hardware and software, and almost nobody really seems to know the exact workings and interactions of the system. At least no one on web forums.

<comment><USER4> Not really - this is a different issue : generic problems vs out of the box behaviour.

I expect Bluetooth to work out of the box on a Lenovo laptop in 2018, while I don't expect Linux to work well at all. I've been using linux since 1996, and things haven't changed : unless hardware makers start supporting it natively, we'll always have problems.

Now, I may be very wrong on the windows side of things : I expect it to work, but maybe it doesn't!

<comment><USER5> I just cringed a bit remembering my idealistic but ultimately doomed mission in the early 2000's to convert an entire organization to Linux on the desktop, complete with a test group of forward-thinking, masochistic users who I encouraged to jump off the cliff with me. In a parallel universe I'm on the phone with a user at 3am cheerfully explaining how to use pico to edit their /etc/modprobe.d/iwlwifi.conf!

<comment><USER6> Thankfully on this front most of the desktop environments have come a long way, one can give a user a laptop running Debian or Fedora and that user will be able to install software right in Gnome Software, change wifi networks, display resolution/configuration and so forth without ever using their keyboard.

Its feasible in 2018 to give your aunt a laptop running Linux (just so long as its not Hannah Montana Linux or Gentoo) and expect her to be able to go about her normal Facebook browsing, document editing routine without much issue.

</comment></comment></comment></comment></comment><comment><USER7> Lenovo ought to know better in 2018. I'd understand if their "consumer" laptops weren't fully compatible, but all Thinkpads should be compatible with the latest LTS release of Ubuntu (or corresponding Debian) out of the box.

<comment><USER8> and how exactly should lenovo enforce setting default driver options in a distribution it doesn't control?

<comment><USER9> Well, by engaging with the community and perhaps even preparing a patch. Making changes to the distribution is not exactly arcane knowledge.

</comment></comment></comment><comment><USER10> I spend 2-3 days around the holidays to revive an old HP laptop with a Debian desktop distribution. I had problems with hibernation / suspend, but what was the show stopper for me was that there is still no smooth scrolling on Linux. [1]

1: [https://www.reddit.com/r/linux/comments/2qd564/why_no_smooth...](https://www.reddit.com/r/linux/comments/2qd564/why_no_smooth_scrolling_on_linux/)

<comment><USER11> Personally, I wouldn't spend time setting smooth scrolling up, not to mention implementing it. I doesn't seem to have much impact to my reading. The scrollable things I use is the browser and a PDF reader. Firefox scrolls smoothly, while the PDF reader doesn't, but my experience reading with both is about the same. So I sympathize with devs who put their time into solving other problems.

I'd be interested in hearing from people who feel the opposite.

<comment><USER12> Application devs shouldn't have to implement smooth scrolling. The DE should, and make it toggleable on a per-application basis.

</comment></comment></comment><comment><USER13> I remember Apple having scads of Bluetooth problems in the first ~5 years, and then off/on problems for 10 years. These days I pretty much expect it to work.

The problem on Linux with Bluetooth is there's multiple kernel drivers involved, one or more daemons, and one or more interface tools. Knowing which component to blame for a bug, is not obvious. Learning about components is tedious: btmon, btattach, hciattach, hcitool...it just goes on and on.

I've filed bugs about random bluetooth mouse disconnects, and it gets blamed on some other component where there's no response from maintainers for basic questions like, how do I get you more information? Things like hcidump will get you metric f tons of information about the connection, way too verbose (dozens of lines per second) but zero information about why there's a disconnect.

And in many bug reports I see maintainers blame hardware, even when the problem doesn't reproduce on Windows 10.

I'm sure it's quite complicated, but there isn't even a decoder ring for how to help users file useful bug reports.

</comment><comment><USER14> The one that got me was trying to pair an ODBII dongle with a the default Ubuntu bluetooth stack. It's one of the kinds with a fixed PIN you have to use to pair (1234), but the Bluetooth stack insisted on generating a 6 digit code and have me somehow punch it in on a device with zero buttons/switches.

It was annoying, but I figured there must be some commandline utility where I can force the other behavior right? If there is I still have no idea where or what it is. I found some utilities, but they have among the worst documentation I've ever seen for a Linux utility. Just a list of the commands that require options, with no description of the options that I can find no an explanation of what they do. It was kind of surprising because I've become accustomed to stuff just kind of working these days. To have something so broken is a bit shocking.

</comment><comment><USER15> Thanks, I own this same computer, installed Archlinux on it, and while Bluetooth has always worked ok, this did seem to speed up things.

</comment><comment><USER16> I used to be a happy x201 user 11 years ago, but nowadays can't see any good reason to prefer it over a good Macbook Pro (2015?). It's now more hacky to remove Windows and install Linux in a Thinkpad, compared to setting up a dual boot Arch + OSX system in a Macbook Pro.

<comment><USER17> MacbookPro 2016 and newer is far from fully supported in Linux and MBP2015 is huge compared to 2016.

[https://github.com/dunedan/mbp-2016-linux](https://github.com/dunedan/mbp-2016-linux)

<comment><USER16> Yes, even new Macbook keyboard is not compatible. That's why I referred to 2015 and older.

<comment><USER6> So you end up with an overpriced used Macbook Pro 2015 (looking at eBay) that is comparable to a Thinkpad T440 or W540?

Why would anyone pay 3x to 4x for a device that is a PITA to get most common Linux distros onto, and is challenging to repair? I don't see the value provided, even comparing weight and dimensions...

<comment><USER18> I have a t440, the weight of the mbp is not comparable. It's more like a carbon and there's huge advantage to being able to move easily without a heavy laptop.

<comment><USER6> Note that OP was referring to a 2015 MBP, before they seriously thinned the laptop.</comment></comment></comment></comment></comment></comment>


Half the work people do can be automated: McKinsey - <AUTHOR> https://www.techinasia.com/work-people-automated-mckinsey-study-shows <comment><USER2> And what about those McKinsey consultants, surely their work can be automated as well? :)

It is funny that the managerial class thinks that they are safe from automation.

<comment><USER3> A lot of McKinsey's fees are generated from consulting about outsourcing. The outsourcing boom can be ended with the stroke of a pen.

They (along with a lot of other people) have a strong incentive to scapegoat automation for job losses.

</comment></comment><comment><USER4> McKinsey predicted that there'd be 900,000 cell phones by 2000. If their automation prediction's error will be even a quarter as off as their cell phones', then we are not going to have enough people to have their jobs automated. I know inference here is inductively fallacious and here we're talking about job categories not job numbers, but it just makes 49% feel like 98%.

</comment><comment><USER5> Important note: that's 49% of work people are doing right now can be automated with current technology. As a programmer, I see this as a signal that there's massive need for product and sales people. Programmers are the way we get from A to B but since <5% of the jobs can be 100% automated, there is still need for human buy in for almost all adoption.

</comment><comment><USER6> Automation will create countless jobs.

How? Take retail as an example. Sure, an online store is cheaper to set up and run. Until every company has a web shop and you need to advertise to drive traffic, requiring a large ad budget and a marketing team just for digital. E-commerce becomes table stakes, and how you really stand out as a brand today is by opening physical stores that improves customer experience and brand.

In the same way, automation will cut jobs until it is ubiquitous. Then, searching for competitive advantage, firms will find new ways of adding value and hire people to do so.

<comment><USER7> Re your comment:

>how you really stand out as a brand today is by opening physical stores that improves customer experience and brand.

How you really stand out as a brand today is by being better and faster than what's on amazon, which is hard as nails and has little to do with physical retail.

Re what your comment misses:

A whole lot of people drive trucks, cook food, and balance books. Those people will be jobless in our lifetime. (if anyone has advice on how to bet big on this, please share)</comment></comment>


Need help determining how my Smart Contract was hacked and balance drained - <AUTHOR> My Smart Contract: https://etherscan.io/address/0x5cee173ee3a9568a4d66d882d78fdf5724251e82
Here's what i've been able to gather so far:
<comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--
Hacker's wallet
https://etherscan.io/address/0xf4c6bb681800ffb96bc046f56af9f06ab5774156
- Jul-11-2018 03:04:12
https://etherscan.io/address/0x740786a45e8f8d0f8e38dad03f0074ccbc138e93
Created this exploit contract
- Jul-11-2018 03:04:56
https://etherscan.io/tx/0x1486b26af65bd8c4c0054a177c6a4b73ea1fedca1928cfe511153abe091caf1f
Then called the method Bet() on the explout contract which transfered 0.5 ETH to my contract:
- Jul-15-2018 08:56:38
https://etherscan.io/tx/0xeae5c502b046693f46e66fa7f53ac8840d2028a22c3b2b4b7469b16a9b4ffa27
Then the wallet initiated a transaction of 0 eth to the exploit contract resulting in this transaction that caused my contract to make a number of internal transactions to Oraclize
- Jul-15-2018 08:57:23
https://etherscan.io/tx/0xef0641ff010e7d925bd3f9bed2f299465d06a3aed1e3be78f2e6e1cd29e56121
Another of the previous transactions
- Jul-15-2018 09:02:52
https://etherscan.io/tx/0xbdb6add293d5405e6e7311197d7d96fb744f5fad8ec41eb2bdd6c0422414173a
Then the wallet called the method getETH() on the exploit contract which transfered 0.794100662427911166 from my contract to the hacker's wallet
So far it seems they're exploiting something in Oraclize? I'm not really sure.
</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>--
reddit url:
https://www.reddit.com/r/solidity/comments/93qrhw/my_smart_contract_was_hacked_and_its_balance_was/ </comment><comment><USER2> Post contract source code.</comment>