Do software engineering managers make more than software engineers? - <AUTHOR> <comment><USER2> Here is a ratio for you (from personal experience). Yes, about 70% of the time. No, about 30% of the time. I am referring to annual base salary exclusively. When it comes to full package, the ratio looks more like 50/50.

Most likely, a manager will have a higher annual base salary versus lower RSU/stock grant. Again, this is not true all the time but RSU's are used in order to retain talents. Managers are very replaceable compared to experienced engineers. If you're easily replaceable but you have a lot more pressure, your annual salary will most likely be high and your RSU's will be good, not amazing.

When it comes to annual bonuses, managers win by far... I'd say it's a 80% to 20% ratio.

<comment><USER3> I think this varies wildly. I know if a few Rockstar managers that get paid higher than their individual contributors. If they have a proven track record of getting their team to perform and ship product.

<comment><USER2> Sure, which is why I used a ratio to describe the difference. There are indeed a lot of managers who make a lot more than their direct reports. It is not always true. Base salaries would most likely have a higher cap than IC's, stock grants are based on how replaceable you are within the organisation, then annual bonuses are usually based on the company annual results, your business impact (and a percentage of your base salary) which is why managers usually get higher bonuses. I agree it varies a lot since not all companies offer RSU's, annual bonuses, etc.

</comment></comment></comment><comment><USER4> At FANGMA, yes - almost always. Managers typically has level either equal to or more than employee they manage. In addition, managers gets to make recommendations for bonuses for their directs. This by default make them at least as much paid as their directs. In a weird scenario it may be possible that manager gets dinged while he/she recommends better bonus for same leveled direct. However this is very rare because typically manager gets to claim at least partial credit for his/her direct and of course they are the ones with direct lines to higher up.

On a side note, this is a bad thing for industry because it makes lot of great ICs forced in to management.

<comment><USER5> A manager has hiring, firing and often budget responsibilities. Also over- looked other HR responsibilities like ensuring policies are being followed which are usually there because there are laws the company has to comply with, like sexual harassment. There is more risk to the larger company if a manager acts unethically or worse, illegally, with these responsibilities.

Given that a legal/ethical issue can potentially cost a company a lot of money, a good manager should be paid more in addition to other actual area of expertise responsibilities they have.

If they are more of a supervisor or team lead, literally managing workloads of people without the budget or hiring/firing HR responsibilities then maybe one could argue they may not necessarily make more than other Software Engineers.

</comment></comment><comment><USER6> No. Most cases, the first level engineering manager will make less than some of those being managed. One cause is experience, years, and wage growth. Another cause is high salaries for software engineers relative to the rest of the company.

</comment><comment><USER7> Depends on company, experience etc. Where I am, no they don't and am glad they don't (I am a engineering manager).

</comment><comment><USER8> From my experience an engineering manager in most organisations is considered a direct promotion from a senior or lead engineer. Compensation tends to follow this and thus I'd warrant in 90% plus of cases engineering managers make more than the engineers.

</comment><comment><USER9> Usually but not always. Somtimes the manager is not technical, in which case they might be paid less (think Business Admin degree). Or you might have a superstar who needs to be paid well, but still needs to be managed.

</comment><comment><USER10> Depends on the country as well. Here in Uruguay, 99% of the time they do, and usually several multiples of what their reports make.

</comment><comment><USER11> Another related question might be how taking a manager vs engineer position may ease to access to future positions and earning levels.

</comment><comment><USER12> Yes</comment>


SpaceX Slapped With Wage Class Action Over Mass Layoff - <AUTHOR> http://www.law360.com/articles/564591/spacex-slapped-with-wage-class-action-over-mass-layoff <comment><USER2> Here is link that goes through Google and bypasses paywall: [http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd...](http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CB8QFjAA&url=http%3A%2F%2Fwww.law360.com%2Farticles%2F564591%2Fspacex- slapped-with-wage-class-action-over-mass-layoff)

</comment><comment><USER3> (Only tangentially related) If you're a space exploration nerd working in the space industry you'll realize one day that your salary and benefits are space exploration costs. This produces the following dilemma:

Accept a small pay and benefits. Space exploration costs go down. More space exploration is done per dollar.

Demand a good salary and benefits. Space exploration costs go up. Less space exploration gets done per dollar.

Damn it.

<comment><USER4> The ROI on space exploration (currently) is terrible and the only tangible near term solution to that dilemma is asteroid harvesting. That is why SpaceX is predominantly about getting government contracts - outside of satellites (GEO and down) there isn't much economic incentive for humanity.

Look, manned spaceflight is cool and there are some really bad ass ideas about space exploration, but the reality is that there really isn't that much in it for us. Our bodies are fundamentally not suited for space travel - so much so that the bulk of on-board systems are life support, making anything else a small portion.

What are the goals anyway? I have heard many things like: having a second habitable home for humanity in case (X) happens, or exploration for its own sake. None of these are particularly compelling given the economics behind them.

I certainly wouldn't pass up the chance to go to space, but I think it is not where humanity should be putting its energy.

<comment><USER3> > ...second habitable home for humanity [...] or exploration for its own sake. > None of these are particularly compelling given the economics behind them.

So this is what economics has done to "going boldly"? No wonder it's called dismal science ;-)

But seriously, diversification of our real estate beyond a single small planet seems like a necessity given the scale of the potential losses in case (X) happens.

Exploration for its own sake seems like a perfectly valid reason too whether done for touristic or scientific purposes.

As for ROI on space exploration, I wouldn't say it's terrible. It's just that we're short lived creatures and we like our returns fast. Space exploration is a very long term investment with potentially huge returns in far future.

<comment><USER4> >So this is what economics has done to "going boldly"? No wonder it's called dismal science ;-)

Yes the economist is typically the buzzkill.

To your other point, I think it is silly to think that it would take fewer resources and time to terraform another planet^, than it would be to harden ourselves from disaster. Strike that it's not silly, it's wasteful.

^there are no known planets that are habitable to humans and getting out of our solar system is not feasible for humans given that it is 27,000 ly across

<comment><USER3> You don't need to terraform a planet in order to inhabit it. Also, not all disasters are easily managed or predicted. Hypothetical virus with long incubation period that spreads quietly to almost every human on Earth before giving any symptoms could pose a huge danger. There are other scenarios where survival of civilization is doubtful or reconstruction is very difficult without off-world help. Given high stakes directing 1% of human energy into the long term goal of expanding our habitat beyond a single planet seems like a reasonable hedge.

Not sure where the figure of 27kly comes from. Depending on how you measure it our solar system is ~200 AU or ~28 light hours across (for comparison 1 ly is ~63241 AU). Our galaxy is ~100kly across and it contains hundreds of billions of stars.

</comment></comment></comment></comment></comment><comment><USER5> Seems like a clear wrong doing on SpaceX's side... Weird SpaceX would lay people off when by all accounts their business is doing fairly well?

<comment><USER6> According to this article ( [http://www.spacenews.com/article/launch- report/41428spacex-s...](http://www.spacenews.com/article/launch- report/41428spacex-says-%E2%80%9Cheadcount-reduction%E2%80%9D-due-to-annual- reviews-not-layoffs) ) they were firings, not layoffs. Which may throw a wrench in their lawsuit.

<comment><USER7> IANAL, but I don't think this is going to fly in court given that (4 times) more than 50 people were let go at once. If it looks like a layoff and quacks like a layoff, I don't think the judge or a jury is going to care what SpaceX calls it.

Kind of surprised a company that is so on the ball technically would fuck something like this up; it is definitely going to end up costing them way more than 2 months severance to everyone (plus whatever they were owed -- some people claim they didn't even get that) would have.

<comment><USER8> In this case I think it might, I'm not a lawyer, but the relevant law seems to be this one ([http://www.leginfo.ca.gov/cgi- bin/displaycode?section=lab&gr...](http://www.leginfo.ca.gov/cgi- bin/displaycode?section=lab&group=01001-02000&file=1400-1408)), which defines layoff as

> "Layoff" means a separation from a position for lack of funds or lack of > work.

<comment><USER9> US Dept of Labor and the Federal WARN Act have specific requirements for employers over 100 employees where 50 or more are let go from a single location in a 30-day period: [http://www.dol.gov/compliance/guide/layoffs.htm](http://www.dol.gov/compliance/guide/layoffs.htm)

Doesn't matter if they're layoffs for lack of work or performance-based firings: you still have to comply with the provisions of that law.

(I have no knowledge whether SpaceX did or did not comply, of course.)

<comment><USER8> The article says that the suit is about a alleged "violation of California's Worker Adjustment and Retraining Notification Act.", and "The Cal WARN Act", not the Federal WARN Act.

I have no knowledge of this lawsuit other then this article though.

<comment><USER10> The " _not paying them wages earned before termination_ " would be a matter of state law, and with California having its own WARN Act, I presume the lawyers think it's best to sue in state court.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Do the affected employees know they're in a bad state? Would be courtesy to let them in on their low performance so that they can make a job change before they are "terminated with cause" as that never looks good for future employment. Are they put on a performance improvement plan? It sounds pretty fucked up.

</comment><comment><USER12> Two comments: First when any 'vulnerable' company does anything at all out of the ordinary you can see this. SpaceX is vulnerable because they trade on their reputation. Legal extortion is not all that uncommon so it is not necessarily true that the lawyers think they can win, but they may feel they can get a settlement of some sort. Perhaps one of the lawyers in the gallery will chime in.

Second, the laws apply differently in different states. California is an 'at will' state which means you really can be tossed for any non-protected reason at any time (not true if you have a labor contract). But SpaceX employs people in Texas and Florida as well.

</comment><comment><USER13> Does anyone know why this layoff occurred? Was it a case of their designs maturing, and thus SpaceX no longer needing the large R&D staff they previously did?

Quite curious, as they seem to be doing very well. Musk has capitalized on the Ukraine/Russian ordeal quite well, and is positioned to become a dominant force in the US Aerospace industry. Wouldn't have thought he'd be the type to let go of productive employees on a whim. He understands better than most that talent is the only resource companies have in the long run.

<comment><USER14> _The loss of up to 200 jobs at Space Exploration Technologies Corp. is due to firing of "low performer" employees as part of its annual review process, and not layoffs, the company's president said July 26._ [1]

That sounds like trying to dodge officially having a layoff, or pretty shitty company culture. I wonder what other SpaceX employees think of the matter. I didn't see much news about it.

[1] [http://www.spacenews.com/article/launch- report/41428spacex-s...](http://www.spacenews.com/article/launch- report/41428spacex-says-%E2%80%9Cheadcount-reduction%E2%80%9D-due-to-annual- reviews-not-layoffs)

<comment><USER15> Is there something inherently wrong with firing "low performers" rather than laying them off?

<comment><USER14> Well, generally speaking "firing" reduces the amount of unemployment insurance you get, while a layoff gets you the full amount. So an employer that shrouds a layoff in a firing is screwing the employee twice.

I generally think that the employer should have a very high bar on proving that it was performance based when you are laying off significant % of the workforce at one time. Every time I was involved in an employee firing, it happened out of phase with the typical performance review cycle, and it was typically one person at a time.

<comment><USER16> > "firing" reduces the amount of unemployment insurance you get

Could you describe how this works? Do you get unemployment for a longer period of time or larger payments if you were laid off?

<comment><USER17> severance pay is given out for layoffs and not firings. It always seemed like a weird system to me b/c if you're laying people off, you're probably already strapped for cash - so you'd try to find an excuse to fire the person.

<comment><USER18> Yes and no... if your fiscal management is that shoddy that severance is a problem, you're beyond screwed as a company. The idea is that "Well, we're running down our funds, best to get these people out the door now with x month's salary, rather than hope something turns around in x+y months."

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> SpaceX doesn't owe anything to you unless it signed a contract that says it has to employ you for this amount of time. I don't understand neither laws, nor the people who would foster such lawsuits. That's using government to steal someone else's money because _you feel_ it's unfair that they laid you off.

<comment><USER20> > SpaceX doesn't owe anything to you unless it signed a contract that says it > has to employ you for this amount of time. I don't understand neither laws, > nor the people who would foster such lawsuits.

If they agreed to employ you in a state, they agreed to do so under the laws of the state. Even if you don't understand the laws, you should be able to understand that the existence of laws providing various protections is part of the context in which people agree to accept employment from a particular employer, in a particular place, and under particular payment terms.

Employers certainly consider the legal environment when they choose to employ people in a particular location, and when they decide on the terms of employment.

<comment><USER19> I was trying to argue from a moral point of view. The existence of state, which itself is an immoral institution, doesn't justify the absurdity of the idea to demand being employed.

<comment><USER20> > I was trying to argue from a moral point of view.

One might argue that it is moral (if not legal) for parties to by mutual consent expressly agree to conduct an economic exchange under terms other than those set by the law of the jurisdiction in which the exchange is conducted (even if the law prohibits such waivers and alternations), but I think its a much harder case to make that it is generally moral for one party in arms- length exchange where no such waiver is expressed to simply elect to ignore the governing law, except when one makes the case that what the law demands would be immoral _even as a term agreed to by consent_ , or that the change in the law which occurred after the agreement violated the fundamental premises on which the agreement was based (and even in the last case, only if the the party acted timely to notify the other party of their objection and to either terminate or renegotiate the relationship based on the changed context.)

<comment><USER19> Of course I don't suggest SpaceX ignores the law. That would put them in a lot of trouble. What I'm saying is, people should stop and think for a moment: wait a minute, why do we have this monopoly on law which many people exploit and why can't we allow people to freely sign employment contracts with the terms defined in advance?

If, for example, 100% of people who SpaceX could hire would express concern over a possible layoff, then SpaceX would have no choice, but to put this into the contract, specifying potential payouts in the case of such a layoff. However, I think people would actually compete to get into SpaceX, thus the actual terms of the contract wouldn't include that. In short, let the market decide voluntarily, what are the best terms.

What's going on now is one side (employees) taking advantage of the other side. I don't care how rich Elon Musk is. If he made his money honestly, he doesn't owe a cent to those employees.

<comment><USER20> > What's going on now is one side (employees) taking advantage of the other > side.

No, its not. Both sides voluntarily entered into an agreement with knowledge of the legal context (well, at least constructive knowledge -- in terms of actual knowledge, there _is_ a real imbalance, here, but it almost always favors the employer, as the side who is more likely to both motivated and able to secure expert assistance prior to making decisions whether, where, and on what terms to engage in employment agreements.)

> I don't care how rich Elon Musk is. If he made his money honestly, he > doesn't owe a cent to those employees.

To the extent that SpaceX makes money by not treating people according to the law under which they agreed to employment, the money is not made honestly, so even if I accepted your maxim, it would be irrelevant.</comment></comment></comment></comment></comment></comment>


Rise of the Zombie Deer - <AUTHOR> https://thecompost.io/articles/rise-of-the-zombie-deer <comment><USER2> "... six year follow-up study found no adverse effects in anyone who consumed the meat"

yet a few paragraphs down:

"... the best way to avoid it is by not eating deer or elk meat"

Is the six-year study is wrong or your assertion to stop eating the meat is wrong?

Furthermore, CDC writes that CWD "... likely spread between animals through body fluids like feces, saliva, blood, or urine, either through direct contact or indirectly through environmental contamination of soil, food or water". [https://www.cdc.gov/prions/cwd/index.html](https://www.cdc.gov/prions/cwd/index.html)

Nothing to do with eating the meat, after all the impacted animals are herbivores.

Who is the author? At the bottom there is a link in "[r]ead more here" to a site. Draw your own conclusions.</comment>


Ask HN: Should site navs be part of the browser's UI? - <AUTHOR> Does anyone else find it frustrating that there's no consistent nav structure on all the websites they visit? <comment><USER2> No. Not at all.

The Browser is my portal between sites on the internet. The Nav is my portal between pages on a site. I want them to remain consistent to themselves.

The site has to have a uniform experience across all pages. And the browser needs to stay the same as I switch between sites. I need it to house my various tools and interfaces to best allow me to __browse __the internet as a whole.

But what's that? If the Nav was in the Browser, it would still be consistent across a single site? Sure, but not all sites are created equal, and I need the Nav to be tailored to that site so I can interact with the site most efficiently. The Nav I use for HN would be wholly inappropriate for YouTube, and the Nav I use on Reddit would be overkill for my personal website.

</comment><comment><USER3> It's not just the navigation structure. It's the entire user experience. Every single website/app/service has its own custom UI and language. This needs to end.

The solution is not to bring navigation to the browser. The solution is to get rid of all websites, and replace them with just one system.

</comment><comment><USER4> This is an interesting idea. Information architecture is a hard problem to solve and definitely not something that every site solves well. I imagine you are thinking of something like a universal hamburger menu built-in to the browser chrome.

</comment><comment><USER5> This is kinda what the <link rel="" /> stuff is meant to do, but from memory only opera supports it properly</comment>


Product Idea: Smart and Beautiful Spaced Repetition - <AUTHOR> http://blog.dennybritz.com/2015/08/02/product-idea-smart-beautiful-spaced-repetition/

<comment><USER2> it's not a bad time to get into this space.there aren't hundreds. I'd say the two biggest are fairly googleable. the platform idea won't work because schools don't have the capital and already have the functionality due to (Anki being open source as you mention,) there's money in the banana stand but it's a tough nut to crack.

</comment><comment><USER3> There are hundreds of apps based on spaced repetition. How will you be any different?

<comment><USER4> "Here are some simple examples of how one could make use of collective data."

Sounds like they're going to be a Big Data Aggregator. I look forward to the privacy and security issues.</comment></comment>


Which PHP template engine do you use? - <AUTHOR>

I use PHPTAL, but I am not satisfied with it. I am wondering if I should switch to Smarty. <comment><USER2> I use Smarty and like it. I've never really ran into something I can't do with Smarty. Look into writing your own plugins and resources.

</comment><comment><USER3> Take a look at codeigniter</comment>


Tor in a safer language: Network team update from	Amsterdam - <AUTHOR> https://lists.torproject.org/pipermail/tor-dev/2017-March/012088.html <comment><USER3> As a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular.

It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.

<comment><USER4> > As a mere average user of computer languages, every time I play around with > Go I start wondering how a language like this became so popular.

You can pick it up in a weekend. A lower entry bar means more people will try it out.

> It feels like it was invented in a universe where Haskell, OCaml, Erlang, > Smalltalk, Lisp and so many more languages and research in languages never > happened.

It was developed in a large enterprise context not in an academic context. I think it shows.

<comment><USER5> So was Erlang. The language, the runtime, and the standard library were all purpose-built together to solve a real world problem... to build fault- tolerant, distributed network applications.

Which makes Go's rapid popularity as a language for solving the same problem even more peculiar. Especially since Go's surrounding tracing, debugging, and online code swapping facilities are so much worse.

I'm sure some component of that is Ericsson's complete lack of interest in evangelism and Erlang Solution's apparent lack of capability to effectively evangelize, but it still seems like Go isn't so much filling a void as it is being better at attracting an ecosystem that delights in reinventing a particular set of wheels.

Java was very much the same way for a very long time.

<comment><USER6> Golang is simpler java, and that is it's target. It even has the same perf profile as java. Erlang does have a worse perf profile.

<comment><USER7> Golang performance profile is very different from Java. It's speed is closer to C++, garbage collection optimized for latency, not bandwidth, very low startup time comparable with typical native code.

<comment><USER8> You can actually get a performance profile very much like Go's out of Java...

* Inasmuch as you can make a blanket statement like this about a language, Go's speed is very much comparable to Java's.

* Java has a huge number of garbage collectors available. You're just talking about the default, but there are extremely low-latency GCs.

* Java has a bunch of ahead-of-time compilers; thanks to Android this might be the most common deployment of Java.

Even green threads were tried (and sensibly abandoned) in Java before.

I think people may not be aware of all the options available in the Java ecosystem, but other than sized types, which are theoretically coming to Java 10, there isn't much performance-wise that Go does and Java doesn't.

</comment></comment></comment></comment></comment></comment><comment><USER9> When I read safer language, 'Rust' came into mind automatically.. Not sure if 'Rust' will ever be as popular as golang but certainly see a future with it popping up everywhere mission critical / super safe software is required.

<comment><USER10> I am afraid Rust will become much more popular than Go is atm. I think the C++ crowd will embrace it as soon as it will be mature. I am sure it is better than C++, but I still like the concepts and syntax of Go much better.

But as C++ programmers obviously never care about readability and simplicity, I am pretty sure they will take Rust. After all, Rust is a decent language and as users, we will all benefit from the migration.

<comment> vertex-four I've... never had a problem reading Rust code. It's generally well-typed, and makes good use of "automatic" error handling constructs to ensure errors flow upwards without visually polluting the success case.

Whereas with Go code, I have to filter out all the error handling (which often takes up 2/3rds of lines of code, even when it's just "if there's an error, return the error" which it almost always is), wade through the mass of functions that take interface{} and cast it to something internally, etc etc.

I've tried programming in Go and I find it horrifying - I either get to ignore errors or spend ~80% of my code doing this, repeatedly, a few times per function:

        foo, err := bar()
        if err {
            return nil, err
        }

<comment><USER10> My problems with the readability of Rust is related to the syntax and not so much about the code structure. For example, Smalltalk has the most readable syntax I know, while I find it's code structure average.

I know that error handling in Go can be tedious, but to some extent, it is also the programmer's job to utilize the features of the language to write clean code: [https://blog.golang.org/errors-are- values](https://blog.golang.org/errors-are-values)

Regarding your type problem I find very few cases where I need an empty interface (mainly container types). Most of the time I use real interfaces and the most code I have seen used non-empty Interfaces too.

<comment> vertex-four I tend to find that Rust's syntax warts are primarily in function headers (primarily due to lifetimes), and less so in the bodies.

> Regarding your type problem I find very few cases where I need an empty > interface (mainly container types).

I've run into the issue with quite a few "generic" libraries, since Go doesn't have a generics system. For example, [https://github.com/manyminds/api2go](https://github.com/manyminds/api2go) requires a few of them in common cases.

My alternative is writing the same code over and over, and hoping that I've not missed something in one instance of it.

</comment></comment></comment></comment></comment><comment><USER11> Rust is almost always going to win for any projects that take a 'gradually replace' approach, simply because it can interact so easily with C code in both directions (i.e. C calling Rust and Rust calling C) in a way that other languages can't, or can't without significant efforts/hassle.

The Rust team showed great foresight for bringing about those changes before the initial 1.0 release and it will pay off in spades.

It's a key step in removing barriers to entry:

[https://www.joelonsoftware.com/2000/06/03/strategy-letter- ii...](https://www.joelonsoftware.com/2000/06/03/strategy-letter-iii-let-me- go-back/)

</comment><comment><USER12> Since bitexploder asked, I'll add what I wrote on this on other forums. If it's about secrets or anonymity, make sure you always use a safe language that supports careful control and reasoning about both memory and CPU time. The reason is that this enables covert, channel analysis for vulnerabilities that leak secrets through storage and timing. It's why I wanted Freenet to ditch Java aside from the obvious reasons. It's also why GC languages such as Go are better not used. Although, memory management where programmer controls timing & it's simple to analyze might be used. Reference counting comes to mind.

The other thing you want is proven, successful use in high-assurance systems. That is, systems that either didn't fail or provably couldn't in certain ways. These are almost all written in a subset of C or Ada/SPARK. The advantage of using those is you can combine them with a vast array of proprietary or open- source tooling to catch about any error you can think of if it's implementation. There's also formal specification and protocol analysis tools that combined with expert review can catch the rest. Rust, although a good choice for increased safety/security, doesn't have such tooling yet. That means they will get less correctness overall and over time vs MISRA-C or Ada/SPARK unless similar ecosystem in industry and CompSci emerges for Rust. That's why I recommend against it for high-assurance security for now.

It does seem good for medium-assurance security where you want to knock out low hanging fruit in systems code. It will avoid serious errors in C while providing additional benefits with type system and other features. Ada 2012 + SPARK 2014 are the standard for safe systems since they systematically eliminate all kinds of errors with a consistent design and tooling with decades of field success. I haven't seen a direct comparison with Rust on each protection to see if it matches it already or not. The main advantages Rust has over them are its borrow-checker for temporal safety, more usable method for safe concurrency, and (best for last) highly-active community to provide libraries or help. Go has similar benefits if its GC works with your use case but a lower, learning curve & possibly lower efficiency. Due to ecosystem benefits, these are main two I'm recommending for medium assurance if Ada/SPARK are too much to learn.

<comment><USER13> G'day Nick!

Java is getting an AOT compiler in July (Graal, [http://openjdk.java.net/jeps/295](http://openjdk.java.net/jeps/295)) that will let you AOT compile parts, or all, of your program, including the JVM modules themselves. This would seem to leave the GC as the main source of side channel vulnerabilities. The GC itself will become more pluggable as well, with a pure Java implementation. What requirements would you put on a GC for side channel safety? (Ignoring the obvious just allocate a large heap and never GC anything, eventually just restarting the process when it runs out of heap). What if we had a fully concurrent, pauseless GC (e.g. Azul), would that change things?

What other issues would remain in your opinion?

<comment><USER14> A concurrent GC running on a single processor machine is still going to pause. There are still other ways to get into situations where an attacker can cause the gc to kick in in ways where you can get information -- find a few CPU- heavy functions that nudge the GC to kick in when and where you want it. Harder, but even a background GC can wiggle into the foreground.

<comment><USER13> Even a statically compiled program run on a single core machine will pause because of the OS scheduler. Assuming we have a multicore cpu then one core can be dedicated to the GC.

<comment><USER12> Good you're thinking out the box. That pause might not be a problem, though. The pauses that are a problem when the malicious app can control the timing with an external observer seeing those manipulations. The OS scheduler is usually independent of secret processing. It's just doing it's own thing causing pauses that don't tell you about the secret itself. Theoretically, there could be an esoteric attack in some situation where an OS scheduler would accidentally leak somethinh or be activated to leak something. Not popping into mind righg now, though.

</comment></comment></comment></comment></comment><comment><USER15> How has this community reached the point where the vast majority of comments on this decision are arguing about Go, which isn't even the language that they picked?

<comment><USER16> pg's early essays like [http://www.paulgraham.com/avg.html](http://www.paulgraham.com/avg.html) and [http://www.paulgraham.com/power.html](http://www.paulgraham.com/power.html) drew a crowd who want to see language design move in the polar opposite direction. From that viewpoint, Tor only barely dodged a bullet.

</comment></comment><comment><USER17> This is either a horribly timed announcement or a joke written very seriously. I have no idea which.

<comment><USER18> How so? I'm honestly wondering why.

<comment><USER19> Today is April Fool's Day.

<comment><USER18> Oh. So I get it is a joke, I just don't get why it is a joke. I program daily in Go and everytime I read about buffer overflows and a dozen other preventable security holes I'm glad I'm programming in Go.

But maybe this joke is only funny to those who enjoy programming in C? :)

<comment><USER20> Doesn't seem to be a joke, the "meeting" was week-long and lasted from the 22nd to the 27th: [https://trac.torproject.org/projects/tor/wiki/org/meetings/2...](https://trac.torproject.org/projects/tor/wiki/org/meetings/2017Amsterdam)

It's just the ML recap mail which hit a rather poor timing.

<comment><USER21> The email was time stamped as being prior to April 1st UTC, so it's actually less an issue of the recap email being poorly times and more an issue of the post to HN being during a confusing time period.

<comment><USER17> I mean, the post could have been posted on April 1. We don't know that it was posted from a UTC area.

<comment><USER20> I believe Sebastian is German (or possibly Austrian), I think the CET date change was last week so we're in CEST (UTC+2) which means it was posted at 30 to midnight local, close enough that it could be just in time for April 1st local.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> I am curious why they were advised not to use Go. Probably not a safety concern.

Edit: cgo != Go. Thanks for the responses. I have done a bit of Go, but just pure Go.

<comment><USER23> Go and Rust are very different languages. Rust is, by design, well-suited to Tor's use case, where they have a large C or C++ program and they need to incrementally rewrite parts of it (and maybe never all of it!) in a better language.

It turns out (or so I hear) that Google statically links everything in production, and has been using C++ as a language to implement HTTP endpoints for a long time. So Go is a better C++ _for what they want out of a better C++_ ; for the rest of us, it looks more like a compiled language along the lines of Python/Ruby/etc. with a nice deployment story. If you want that out of your better C++, Go is great. If you want to reimplement _all of_ Tor from scratch, Go certainly seems like a reasonable choice.

But as a result of these priorities, Go basically doesn't have interoperability with the platform ABI as a goal. (For some combination of historical reasons and the lack of complicated features in C, the platform ABI on just about every platform these days is a C ABI.) Rust does; it uses a standard compiler toolchain (LLVM) instead of what's basically a custom one (Plan 9), and the standard toolchain knows how to generate calls that follow the C ABI. Rust doesn't have a runtime of its own, and it's safe to directly call into a Rust program from some arbitrary point in a C program. Rust's allocator doesn't care if you do stupid things with pointers it allocates, as long as you give them back eventually. Rust doesn't create threads on its own unless you ask. Rust functions use the normal stack. Rust on UNIX uses the platform libc. And so forth.

It's possible to call C code from Go and vice versa, just as it's possible to call C code from Python and vice versa. But Go is not best tool for this particular job.

<comment><USER24> Totally agree, and Rust isn't a sane choice either even though the points you make are valid.

Rust has some interesting features, but being C isn't one of them.

<comment><USER23> Can you expand on why you think Rust isn't a sane choice here?

<comment><USER24> Because again you are deviating from the industry standard completely portable lingua-franca language that is designed explicitly for precisely these types of problem spaces, and is perfectly in tune with the OS and existing standard library.

What would be the advantage, just improved memory safety guarantees for people working on the project?

If that's the case start again from scratch and the first thing you do is build a handle based memory management system that everything must go through Safexxxx() versions of everything and then explicitly enforce no other memory access patterns.

If you want to do concurrency, build simple threads with input queues that would just be like channels in Go.

You can use a completely functional actor model in C. Is all this object oriented dangling pointer stuff that is scary, but there really isn't any need for that.

Software pipelines with slab allocation or ring buffers virtually guarantee no leaks and are very scalable and cache friendly.

That would be my personal recommendation.

<comment><USER23> You _can_ do all of these things in C - but at the point that you're enforcing use of your Safexxxx() functions, you've already given up on the industry standard. You can't use the normal OS libraries; you've got to route everything through your special functions.

The advantage of Rust is, honestly, that it has a community of people who are excited to do this sort of work in a language. At least 50% of the advantage of any particular language is not the benefits of the language directly, but the community around it (that derives indirectly from the benefits of the language, but also from marketing and other things). Some time ago I needed to write bindings to SCM_RIGHTS / CMSG_*, which is probably the trickiest part of the libc API (all of cmsg(3) is macros that do stupid things with casts). It was annoying, but it led to a better interface than C itself offers, and someone else found a bug in the OS X handling. I couldn't expect that if I were working on my own custom reimplementation of libc.

<comment><USER24> So basically what it comes down to is the argument for building it in Rust is there are some excited people.

And is funny you talk about community, since as the guys on slashdot and others pointed out, the community of people who can use and work in C effectively is orders of magnitudes more than Rust. Have you any idea how many Linux Kernel developers there are alone?

[http://m.slashdot.org/story/324469](http://m.slashdot.org/story/324469)

Building API's specific to the use case is part of our jobs as professional developers.

Abstracting a few things things isn't "rewriting libc", that is just general practice for most decent size projects.

Anyway, the decision is made, so the whole thing is moot at this point.

<comment><USER23> > _the community of people who can use and work in C effectively is orders of > magnitudes more than Rust_

The key word here is "effectively." For the purposes at hand, effectiveness includes memory-safety. Do you know of a single project that implements cmsg(3) in C or C++ in a memory-safe, well-typed, cross-platform way? Or a project where I can submit a pull request and expect it to be reviewed, tested across platforms, and fixed?

I do genuinely believe that the community of people who can use and work in C effectively, in the sense of effectiveness that I and the Tor Project are interested in, is orders of magnitudes _smaller_ than Rust.

I have a very good idea of how many Linux kernel developers there are - <USER2> also how many high-severity security bugs there are. I'm a coauthor of a research paper where we wanted to talk about exploitable security bugs in Linux, so we sat down and found a local privilege escalation in _hours_ (CVE-2009-0024).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Not sure why Ada is not taking off these days. It is mature and has all the safety and concurrency bells and whistles:

[http://www.adacore.com/uploads_gems/07_safe_secure_ada_2005_...](http://www.adacore.com/uploads_gems/07_safe_secure_ada_2005_safe_memory_management.pdf)

[https://en.wikibooks.org/wiki/Ada_Programming/Tasking](https://en.wikibooks.org/wiki/Ada_Programming/Tasking)

[http://courses.cs.vt.edu/cs5204/sp99/Overheads/6UP/6UPCSPand...](http://courses.cs.vt.edu/cs5204/sp99/Overheads/6UP/6UPCSPandADA.pdf)

<comment><USER26> 1) Two words: "begin" and "end";

2) Unix, C is so fundamental to building software, that I think any language that doesn't share syntax with it is doomed. Having a common syntax helps in learning new languages, IMO, and can also be a launching point for differing semantics...

<comment><USER12> I'll give you it's overly verbose even though quite a bit of it was justifiable. The theory of Ada's designers was that people read software more than write it. So, the syntax should be designed to facilitate catching errors in maintenance mode, during extensions, or during integrations. It's done phenomenal at that per industrial, case studies despite having been invented in the 80's when lots of language decisions were still being debated.

EDIT: I keep thinking a different language that acts as a front end w/ a better syntax might be a good idea. It outputs Ada that integrates with the tooling ecosystem. Also, a seemless FFI for C libraries like Julia's.

<comment><USER24> I totally agree that code should be written to be read.

It certainly wouldn't hurt if people simply used a more literate programming style no matter what language they choose

Far too many people think code as below is acceptable.

This is C obviously, but pretty much equal horrors around in every language.

This isn't 1994 and the compiler really doesn't care how long your variable names are, plus EatWhite() is pretty damn fast.

      const int to_pn  = base_n ^ label_n;
          const int from_p = _array[to_pn].check;
          const int base_p = _array[from_p].base ();
          const bool flag
            = _consult (base_n, base_p, _ninfo[from_n].child, _ninfo[from_p].child);
          uchar child[256];
          uchar* const first = &child[0];
          uchar* const last  = flag ? _set_child (first, base_n, _ninfo[from_n].child, label_n)
            : _set_child (first, base_p, _ninfo

<comment><USER27> > This is C obviously

No, that's C++.

<comment><USER28> You can't say that definitively based on that code. It could very well be C code. There's nothing there syntactically that a straight C compiler would barf on.

<comment><USER24> Absolutely correct.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> I like their approach of chipping away pieces instead of porting the whole system. It will result in better modularity and some generic libraries that can be used by other people. Seems like a win-win.

</comment><comment><USER24> I live and love in Amsterdam and Golang seems to be the quintessential hipster language for this quintessentially hipster city.

Booking.com's soup du jour if you will.

Basically, if you aren't using JavaScript in a web shop, and you claim to be a "full-stack" "ninja", then probably you are using Go around here as a jobbing programmer.

I know that sounds terribly cynical and obviously a massive generalization but that is my personal experience.

I don't have a problem with Go per-se, but I do have a problem that a lot of people seem to go to extreme lengths to defend what someone else mentioned is frankly a pretty "mundane" language, citing memory safety, but more strangely portability and performance as its wonderful virtues.

When I meet with the zealots of the Go community around here I often have to quickly excuse myself with good grace.

Seriously, if that's what you want... go (pardon the pun) use C#, it is a saner and more expressive language, has a higher performance runtime and is way more portable with less vendor / career lock-in.

Go... I just don't get it.

Positives... Has a fairly nice package manager like npm.

Isn't made by Microsoft if that's your thing.

Oh and heaven forbid you don't have to think much... until you do because it is slow.

For a project like Tor though, which is damn slow as it is, I think it is totally the wrong choice.

Developers, please suck it up, get over it and learn C/C++ and some variation of Lisp.

Fine, go play with different languages for fun stuff. Use python for ML, try serious meta-programming in D, or jump into Haskell for kicks.

On the other hand modern C++ really can be a very safe language to work in if you can be bothered, and you are only deceiving yourself and your project going with something less sympathetic to the machine itself, especially if you are working on infrastructure level systems.

Sorry if this offends anyone, and of course it is just one opinion, but I think I'm being fairly nice as compared to what Linus might have said in comparison.

Basically stop it with the hobbyist shit. You are horrifying me and probably many others.

You aren't writing a web page here, so please treat the project seriously.

IMHO

<comment><USER30> > Developers, please suck it up, get over it and learn C/C++ and some > variation of Lisp.

I've got over 20 years of writing production C/C++ under my belt and I know Lisp. So I've "sucked it up." Am I allowed to like Go now?

It never ceases to amaze me how many people are bothered about other people's taste in something so mundane. If you don't enjoy programming in Go, don't do it. I personally think it feels light and easy like a scripting language, but with more C-like performance.

I like the fact that its stdlib is very complete, so I can sit down and do pretty much any kind of small project with zero external dependencies, I like the fact that the core libraries are well-designed so the interfaces are consistent and easy to learn, I like the fact that it produces statically- linked binaries so deployment issues are minimal, I like the simplicity of the CSP approach for a lot of concurrency problems. I could also come up with a list of things I __don 't __like about Go, but I 'm not going to bother, because I've decided that on the whole, I really like it as a tool.

Btw: > Positives... Has a fairly nice package manager like npm

One of my biggest complaints about golang is that it really _doesn 't_ have nice dependency management. It's terrible and probably the one issue that has made me seriously consider walking away. :)

<comment><USER31> _> If you don't enjoy programming in Go, don't do it._

Ordinarily, I would agree; I don't really care what people do when writing application code. The way it's filtered into devops tooling makes the choices of Go peoplea problem for me, though. If I'm going to be stuck with a language with bad error handling and inexpressive typing, I'd rather it be Python or Ruby so at least I can leverage dynamic typing instead of bad static typing.

<comment><USER30> Well I could make the same complaints about how ruby has "filtered into devops tooling." If I never see another quasi-DSL that's really just a cute set of ill-specified ruby methods I will die happy.

<comment><USER31> You're talking a taste thing; I'm talking a _correctness_ thing. The inability to create an easily-managed DSL doesn't compensate up for Golang being actively dangerous when it comes to error management. One of these provides structures for ensuring that you catch errors and can do the right thing, and the other demands that you if-check them upon every invocation of a method that can fail.

</comment></comment></comment></comment></comment><comment><USER32> I hope Linus can develop a new language.

</comment><comment><USER33> Literally none of this matters. None of the flaws exploited in Tor are memory corruption flaws. They are entirely architectural and design flaws. No attacker cares if they move to Rust. _NO ONE_.

<comment><USER19> > None of the flaws exploited in Tor are memory corruption flaws.

[http://www.cvedetails.com/product/5516/TOR- TOR.html?vendor_i...](http://www.cvedetails.com/product/5516/TOR- TOR.html?vendor_id=3132)

This list is full of memory safety issues.

<comment><USER33> > None of the flaws exploited in Tor are memory corruption flaws

_exploited_ is the operative word here.

Show me the list where people wrote exploits for the bugs you point out, or where someone abused them to de-anonymize a Tor user? There aren't any.

</comment></comment></comment><comment><USER34> Concurrent thread for this safer language: [https://news.ycombinator.com/item?id=14013444](https://news.ycombinator.com/item?id=14013444)

</comment><comment><USER35> I'm disappointed they did not consider COBAL given its vast superiority and flawless track record for April first rewrites.

<comment><USER36> Fri Mar 31 21:23:27 UTC 2017

<comment><USER35> I believe there is a crate they can use to prevent date bound out of bounds fun leaks. (can't find the link atm)

</comment></comment></comment><comment><USER37> This is exciting not only because of the Tor project itself but because this will set an example for other projects to follow.

<comment><USER38> This creates also an opportunity to engage Mozilla into contributing

<comment><USER39> If any of the developers are reading this, converting the existing C code to SaferCPlusPlus[1] (a memory safe subset of C++) is probably a more expedient solution (if that's what they're looking for). (And speaking of contributing, an automatic translation (assistance) tool is in early development, and could maybe be functional in short order with a little extra motivated talent... :)

[1] shameless plug: [https://github.com/duneroadrunner/SaferCPlusPlus](https://github.com/duneroadrunner/SaferCPlusPlus)

<comment><USER40> I would recommend updating your .gitignore for VS2015. The .vs directory and *.VC.db should both be excluded from the repo.

<comment><USER39> Thanks. I'll take all the git/github advice I can get. :)

</comment></comment></comment></comment></comment><comment><USER41> we all want to be safe. no one can say no to safety ...

</comment><comment> m-j-fox I don't know much about Tor. But I hope I can route all of my home network traffic through it. That or route everything through VPN. I'll bet you can guess why I'm suddenly interested.

<comment><USER42> Founder of [https://easyvpnrouter.com/](https://easyvpnrouter.com/) ask me anything or how to build one yourself if you want a project

<comment> m-j-fox I guess the main question about this product (which is the sort of thing I'd buy -- an hour of saved effort pays for it) is how can I trust you to be less evil than Comcast?

I guess if you're open-source and a lot of people are paying attention, that would do it.

<comment><USER42> It is much more difficult than 1 hour to setup yourself, because of FCC regulations flashing new routers is much more difficult, you need a TFTP server, it's pretty annoying. In addition the edge cases of the internet going out, then when it comes back bringing the VPN back up automatically, being able to switch PIA accounts / countries easily, it's not a simple thing. I got into this because I wanted to build one myself, and I have a friggin master's degree in CS and it took me several weekends. So I figured a business could be formed :)</comment></comment></comment></comment>


YC-Funded DailyBooth Raises $1 Million  - <AUTHOR> http://www.techcrunch.com/2009/10/19/yc-funded-dailybooth-raises-1-million-from-sequoia-kevin-rose-ron-conway-et-al/

<comment><USER2> <http://news.ycombinator.com/item?id=889506>

</comment><comment><USER3> This looks like a really cool idea. I have always thought it would be interesting to have a picture of me or other people taken each day. From day to day it probably wouldn't be that different, but it would be fun to look at long term changes. This seems like a service that will make that happen.

</comment><comment><USER4> Any DailyBooth users reading? Curious to hear how HN readers like it.

<comment><USER5> I use it occasionally. At first I thought it was a bit of a gimmick, but actually, it's quite nice. Posing for a picture is quite an expressive medium.

</comment></comment><comment><USER6> Can you hook this into Twitter/Gravatar/etc and have your profile picture changed several times a day?

</comment><comment><USER7> Guys, I registered for your service but please don't spam me with messages from people I don't know.</comment>


Foregone conclusions – the Kruskal count - <AUTHOR> http://www.futilitycloset.com/2016/02/06/foregone-conclusions/ <comment><USER2> The description, which says that you can start at any of the first 12 words, doesn't seem quite right; you can start on any of the first 8 words and it works, which seems amazing (but apparently isn't—I haven't read the linked analysis), but starting at the 9th ('sitting') or the 11th ('her') will leap- frog you right over 'sister'. (I suppose it's debateable whether or not this 'works' starting at the 12th word, depending on whether you count starting there as winding up there.)

<comment><USER3> You do land on the second 'sister'.

SITTING by her sister on the bank, AND of having NOTHING to do once or twice she HAD peeped into THE book her SISTER.

<comment><USER2> Oh, thanks! I didn't even notice that there was a second 'sister'.

</comment></comment></comment><comment><USER4> Obligatory XKCD: [https://xkcd.com/903/](https://xkcd.com/903/)

Ah, but unlike any other obligatory XKCD you tend to see on HN, the relevance here isn't in the comic but in the alt-text you get when you hover over the image.

<comment><USER2> While funny, I think that's not the same spirit. In some sense, the XKCD one is observing "if you ask 'why' enough times, then the answer is eventually 'philosophy'"; the fact that these links all lead to 'philosophy' is, in some sense, a (jointly if not singly) intentional human creation, and it has semantic meaning.

The Kruskal count is observing, on the other hand, that 'large' collections of data (even for values of 'large' that are quite small, by statistical measures) inevitably include apparently designed, but actually semantically meaningless, coincidences.

Hmm, let me try again. The fact that all Wikipedia articles eventually lead, by transitive linking, to 'philosophy' means something about philosophy; the fact that all trails from the first 12 words of Alice in Wonderland eventually lead, by letter-counting, to 'sister' means nothing about sisters.</comment></comment>


Introduction to Complex UIs Using the jQuery UI Components Library - <AUTHOR> http://msdn.microsoft.com/en-us/scriptjunkie/hh127352.aspx

<comment><USER2> Login form online demo <http://jsfiddle.net/RWhitbeck/9s4x6/>

To-do app online demo <http://jsfiddle.net/RWhitbeck/ZyYFG/>

They'll be added to the article tomorrow I am told.

</comment><comment><USER3> While this article covers a few things that tend to be missing on most jQueryUI howtos, particularly the amount of hand-coding of classes is necessary, it's an intro to the package basics with a more or less default theme.

<comment><USER2> Yes, the point was to show you could make custom UI's utilizing the "out of the box" functionality of jQuery UI. I tried to incorporate as much of the library as I could. I used a ThemeRoller theme (ui-lightness) to show how easy it could be to maintain a consistent theme across all widgets on a page. Thanks for the comment.

<comment><USER3> I got hung up on the "complex" part, but maybe I just underestimate my own skills. ;)</comment></comment></comment>


Ask HN: What tools have most helped your day-to-day productivity? - <AUTHOR> I'm looking to find out what tools people use (software, apps, or otherwise) to increase productivity. It could be things like task management systems or more specific development tools (like a certain CI provider). <comment><USER2> I have a 7-minute sand timer I picked up for a few dollars. Whenever there is a task I keep putting off, I'll commit to doing the task at least until the timer runs out. It probably sounds silly, but it really helps me get things done that I'd avoid otherwise.

<comment><USER3> How often do you find yourself either keeping to that seven minute limit or going past it? Also, do you flip it over at the end if you go past the seven minutes? How do you decide when to start it?

<comment><USER2> I don't flip it over. Usually I'll go beyond the timer for some period of time because once I get some momentum on a task, I'll want to finish it up. I also use it to timebox activities that can consume the entire day. For example, if my office starts getting messy I may decide I want to spend 7 minutes a day just straightening things and organizing. In that situation, it becomes more of a notification of when to stop and get back to other work.

</comment></comment></comment><comment><USER4> My reply falls in the _otherwise_ category.

The Nutribullet blender has let me add one additional billable hour a day. Instead of cooking breakfast I blend it. Half an avocado, 1 raw egg (for the downvotes), protein powder, a little flour (or walnuts), creatine a frozen banana (or carrots), and almond milk. I love them.

I make these twice a day and prepare 3 smaller quick meals. Less dishwashing. Less decision fatigue as to what to eat when I awake.

I also purchased a pull-up bar and skip the gym most days.

A better Wifi router surprisingly helped too. I was previously adamant that my old one was fine since it provided 5X the bandwidth provided by my ISP anyway. I was wrong.

I'd also recommend learning to cut your own hair and stop watching the news so you can concentrate on your tasks and not ruminate about the state of the world.

<comment><USER5> I use to visit a barber twice a month to maintain my hair. The total time cost was 5 hrs/month, and a cost of $50/month. Now I shave my head 3 times a week. The total time cost is 8 minutes a shave, or 1.5 hours/month and a cost of $10/month.

The 3.hrs/month and $40/month extra is nice, but I wouldn't recommend it to someone as a productivity hack.

<comment><USER6> What kind of hair "maintenance" are we talking about? My admittedly low- maintenance hair style takes one visit about every two months and costs ~20USD each. Just wondering whether this is a case of both different hair styles and different local barber pricing, or whether there's more to it.

<comment><USER5> I had a stylish haircut. It included using both a razor and scissors. The haircut looked significantly worse if it grew 1cm and noticeably worse at .75cm. My hair grows about 1.4cm/month.

I bundle style, hygiene, diet and exercise together in a group called "appearance" and find investments in this category valuable for non-malicious social engineering.

</comment></comment></comment></comment><comment><USER7> I use a bunch of IDEs from [https://www.jetbrains.com/](https://www.jetbrains.com/) (mainly Idea) and it is hands down the most important thing for my productivity. Been using them for over 10 years, super worth it.

<comment><USER8> Seconded. I've used RubyMine for years (at home and at work), just getting into Go, and finding GoLand by them is fantastic.

Also tmux.

</comment></comment><comment><USER9> I record my screen all day using a cron job and shell script and a small node express app to review the day and categorize time. I always was inspired by John Carmac's discipline so I do that knowing I'm recorded and know I will see it later when reviewing my day.

It's way more of an optimizing tool than switching ide's ever was for me.

<comment><USER10> Open source it! :)

<comment><USER11> please!

</comment></comment></comment><comment><USER12> I've slowly developed my own system to focus my efforts. It's mostly manual now but I'm automating it.

Daily: Reference my weekly goals and decide what I intend to do for the day. Look back on the previous day and pull over not-done items that I still need to do. It's very tactical execution. Examples are cleaning the house, finishing up taxes, or scheduling lunch with a friend.

Weekly: I write a summary of the areas in life I care about (work, family, social interactions, fitness, reading, volunteering) because my memory isn't great. I also reflect on the previous week's goals. Then I decide on goals for the next week. It's similar to iteration retro/planning at work. The big thing to watch for is intentions that show up multiple days but I don't end up executing. This is a sign that either I need to focus on it more, or stop wasting energy on it if it's not actually important. Examples of weekly goals are getting 7 hours of sleep, going to the gym 3 times, or building a feature in a side project.

Quarterly, or whenever I finish a big goal: Review the big picture goals. Are they the right goals? Are my weekly goals helping me achieve them? Examples of these are training for and running a 15k, completing a side project, or starting a band.

<comment><USER13> What tools or apps are you using to track/automate this data?

<comment><USER12> I'm building a web app for it. I could probably piece it together from existing tools but I needed a side project and I think other people might benefit from it.

</comment></comment></comment><comment><USER14> Bullet journaling.

If you scrape off the layer of Tumblr or pinterest types who spend their time on calligraphy and washi tape, underneath is a really great system for productivity and dumping your brain to an analog medium.

Bonus: it's just a book and a pen, so it's "cross platform", and I never have to worry about XaaS providers going under, or Google killing a project and losing all my notes.

<comment><USER15> Do you have any recommendations for tutorials or guides?

<comment><USER16> [http://bulletjournal.com/get-started/](http://bulletjournal.com/get-started/)

</comment></comment></comment><comment><USER17> I use Ike for Android (Eisenhower time management matrix). It's adapted for people who can't use 'Delegate' for less important tasks:

          Now | Soon
        </comment><comment></comment><comment>-
        Maybe | Don't

Everything else I've tried for task management left me kinda paralysed trying to figure out what to do first and procrastinating.

The `Don't` quadrant is also a good place to record the things I do to procrastinate.

Keeping it all on my phone and _not_ syncing it to a device that I actually use for work also stops me idly peeking at other tasks and loosing focus on what I need to finish (at which point I just take a break instead)

The app I use can have multiple matrices for work/home/whatever, but I tend to just usea single matrix and focus on managing _all_ of my time.

</comment><comment><USER18> I also use Workflowy for my notes/todos/journal. I connect it with complice.co where I set my intentions for the day every morning.

</comment><comment><USER19> I usually create reminders from my desktop but I want to READ, DISMISS, SNOOZE and RESCHEDULE them on my phone. This led me to combine two usefull apps.

1) Remind Me Later ([https://itunes.apple.com/us/app/remind-me- later/id408236729?...](https://itunes.apple.com/us/app/remind-me- later/id408236729?mt=12)) - Let's you create Google calendar events from your desktop with single shortcut. It works like google "quick event" text box. Just write the reminder with a day or time at the end. I created a new calendar in Google to group all my reminders.

2) Calendar Notifications Plus ([https://play.google.com/store/apps/details?id=com.github.qua...](https://play.google.com/store/apps/details?id=com.github.quarck.calnotify&hl=en)) - Ensures you get a notification for every calendar event, even ones without an alarm. From the lock screen you can dismiss or snooze the reminder. You can configure the list of snooze times and the default swipe length. You can move the event to a different date and time. You can pick which calendars it monitors, so if you just want it to see your reminders, it can.

<comment><USER20> >It works like google "quick event" text box

Google has removed this feature in Calendar, sadly.

</comment></comment><comment><USER21> Gmail filters. Take a month. Whenever an email comes in that is not actionable, unsubscribe, or create a rule that either trashes it or sends it to a low priority folder. PayPal notifications of monthly statements, your credit card bill has been paid, mailing lists, make a rule for all of em. Now your inbox contains almost exclusively email from a person to you. This makes it far easier to operate at inbox zero.

<comment><USER22> There's a nice open source alternative I use called imapfilter by Lefteris Chatzimparmpas. I have it set to run every 2 minutes on a remote server and have the config file in an svn repo. It's easy to add new rules locally, and I have it set to auto-deploy when I commit a change.

It's also pretty powerful. For example, any email in my "Newsletters" folder is automatically deleted if it's 30 days old.

Same as the above comment, it only works if you are diligent about adding new rules, but after a while you'll notice that the only emails in your inbox are important.

When moving to this type of system, instead of manually deleting or moving an email from your inbox, add a rule to do it for you, commit it, and watch the email disappear from your inbox. Write the rule once and you'll never have to deal with that type of email again.

</comment></comment><comment><USER23> A door that closes.

<comment><USER24> I wish

<comment><USER23> Being able to work out of a home office helps with this. And moving out of San Francisco helps with being able to afford a home office. This wasn't my primary motivation for moving out of SF, but it's been a nice benefit.

</comment></comment></comment><comment><USER25> Sorry for the non-answer here, but I think this is rather subjective depending on what kind of work you're doing and the tools needed for the job.

With that being said, learning shortcuts/macros for whatever tool you're using can lead to impressive productivity gains. This can be learning up more shortcuts for Vim, to learning how to create tables efficiently in Excel (lol). Customize some for yourself if you need to.

Another thing that has worked for me is automation. Automate as many things that are repetitive as you can. In software, this can be simple bash scripts. Learn how to scripts well. If it's 3 manual steps that you need to get an app running for dev purposes, stick it all into 1 script and run just that 1 script.

You're minimizing the risk of human error and increase your productivity significantly.

</comment><comment><USER26> StayFocusd chrome plugin -- I set it up so that I have a grand total budget of 10 minutes _combined_ between 8am-10pm to look at notorious time-suck sites like Reddit/NYT/FB/etc. After the time is up, you're locked out of all the sites. It's great, and free.

</comment><comment><USER27> Emacs, Org mode, magit, Alfred.

</comment><comment><USER28> Visual Studio Code with the LaTeX Workshop addon is definitely my favorite LaTeX editor. The integration with the Chktex linter, latexmk, git, and all that jazz just makes it so much easier to focus on writing.

For research management I had been using Mendeley for a while and got a bit frustrated with the way it handled bibtex. Like it got really annoying when I had papers which fell into multiple categories and/or were used in multiple papers. My new setup is to use JabRef to manage individual bibtex files for specific projects and to use Mendeley just for document management and notes.

Oh also PyCharm is extremely good.

<comment><USER29> I initially like Mendeley but ran into problems over time. I've tried half a dozen options out there and found www.paperpile.com to be my favorite.

</comment></comment><comment><USER30> Workflowy: [https://workflowy.com](https://workflowy.com)

Dynalist: [https://dynalist.io](https://dynalist.io)

Either one works great for productivity.

<comment><USER31> I used Workflowy for a couple years and loved it. But I craved something a _little_ more robust and found [https://checkvist.com](https://checkvist.com). It is similar to WF in terms of concept and UI but it has a lot of handy extras.

<comment><USER32> Hi, thanks for mentioning. I'm a Checkvist developer, if you have any questions - please ask.

<comment><USER33> Wow, has this really existed for seven years? Congratulations, smooth as silk, impressive!

<comment><USER32> Well, a bit more, actually. It will be 10 soon :)

</comment></comment></comment></comment></comment><comment><USER34> C# Developer:

\- Vi-key bindings in Visual Studio (and VSCode) for editor navigation

\- Resharper for code generation and file navigation

\- A password manager for maintaining secure passwords

\- Todoist to for task management

\- Evernote (premium) for notes management

</comment><comment><USER35> Tools really only can help you so much. Productivity is a lot more about attitude and skills. The necessary attitude is that you are trying to avoid unnecessary work, instead of the more typical of attitude of trying to do all the work more efficiently.

More here: [https://codewithoutrules.com/2016/08/25/the-01x-programmer/](https://codewithoutrules.com/2016/08/25/the-01x-programmer/)

</comment><comment><USER36> I have ADHD-PI (previously called ADD).

The two things that have helped me most are (1) ritalin and (2) pair programming. Between the two of them I can stay mostly on task. I am able to use less ritalin when I am pairing, which I like, because at higher doses I get uncomfortable muscle tension.

Coming third, a fair way back, is a calendar program. Any one of them will do, so long as I can program multiple reminders.

Everything else is negotiable. I'd scribble code by hand before giving up ritalin.

</comment><comment><USER37> Leechblock [http://www.proginosko.com/leechblock/](http://www.proginosko.com/leechblock/)

</comment><comment><USER38> I use this every minute of the day :) [https://tomato- timer.com/](https://tomato-timer.com/)

<comment><USER39> Came here to say pomodoro technique. I use a physical kitcten timer at home but use this website when I am working out of a coffee shop.

</comment></comment><comment><USER40> I have a running list on google doc where I write down every and anything that pops up in my mind throughout the day that I consider a to-do or inquiry. I organize the document by day and start with three categories: high priority, medium priority, and low priority. I tend to develop anxiety when I think I might forget a novel idea or task because of the other obligations I have throughout the day. Once I write down the to-do/inquiry, I vow to put the thought away until later in the day when I have down time to get more in depth. This has really helped me stay focused on tasks more deeply.

I also maintain a bullet journal. Like others have described, once you get past the frills and truly customize it's functionality, it becomes a very powerful tool for accountability. If you are a paper and pen type of person.

</comment><comment><USER41> Switching Gmail to the Inbox mode. Then it suddenly becomes a pretty decent task queue management tool.

</comment><comment><USER42> Figma.com (a browser based Sketch) for me.

I am able to quickly prototype out ideas. I used to use Slides or OneNote for jotting down ideas, now I just sketch them out and wire them up as a quick prototype. Now I have all of my quick sparks sketched and drawn out without getting lost.

<comment><USER29> have you seen [http://www.draw.io](http://www.draw.io)? I like that one.

<comment><USER42> Yes - I have & I use it for user flows. But that is mainly for flowcharts and visio type of drawings.

</comment></comment></comment><comment><USER43> I'm using "Lights spreadsheet" to fight procrastination and build good habits: [https://www.ultraworking.com/lights/](https://www.ultraworking.com/lights/)

</comment><comment><USER44> Workflowy ([https://workflowy.com](https://workflowy.com)) - diaries, projects, brainstorming, someday/maybe idea storage.

Evernote ([https://evernote.com](https://evernote.com)) - a store-and-forget tool for information of any kind that I might need at some point.

Matterlist ([https://matterlist.com](https://matterlist.com)) - to-do lists, recurring tasks, calendar. (Full disclosure: it's my own Wunderlist alternative, currently in alpha testing.)

<comment><USER45> Matterlist seems interesting. My problem with these kind of services always comes to two things:

\- Pricing; \- Privacy;

I find it incredibly expensive to spend 5usd (and 10 on some) for essentially a to-do-list software. And you might tell me that it's the price of a coffee, but it really is not. A coffee, where I am from, is much cheaper, but more importantly, everything is subscription based nowadays. How come it is so expensive?

\- Privacy: Is that E2EE? I suppose not. Does anyone know of such a project that has E2EE and is not from the US? (edit: apparently, matterlist is from estonia. Good)

Also, you state "Try our native apps __now __! It 's free!". I would, but apparently it's "coming soon". There are no accounts and there is nothing to download yet. Is it even possible to use it right now?

<comment><USER44> > _Is that E2EE?_

Not yet. However, this is something I'd absolutely like to see implemented, including for my own personal use. Alternatively, we could use optional LastPass-style encryption based on a master password for task texts, which should be easier to implement (though it will restrict search by task text to client-only).

> _How come it is so expensive?_

We'll need to be self-sustained for the long term. The app is 100% bootstrapped and there will be no external funding. Plus, a to-do app just cannot afford to be unsustainable, because its closure will hurt a lot of its users. So we'd prefer to scare off some part of our potential user base, but in exchange gain better financial stability and thus longevity.

Also, it may be just me, but the app, as it currently is, with all its rough corners, provides _much_ more value (at least by a couple of orders of magnitude) to me than it's planned monthly cost.

> _Also, you state "Try our native apps now! It's free!". I would, but > apparently it's "coming soon"_

Sorry for that. We haven't publicly announced the app yet, but the site is written and designed as if the app is already available for download, hehce the mismatch.

</comment></comment></comment><comment><USER46> The timer on my watch for Pomodoro. The tactile alarm is less jarring than audio.

Also Vim.

</comment><comment><USER47> rm -f gulpfile.js

I recently made a decision to try hard to avoid a build step in my scripting projects. Happy with it.

</comment><comment><USER48> There's no object or process (hardware or software) instrumental to productivity. It comes from the personality dimension called conscientiousness (not intelligence). It can be improved with focused work.

Here's Harvard's advice on doing that: [https://www.health.harvard.edu/staying-healthy/raising- your-...](https://www.health.harvard.edu/staying-healthy/raising-your- conscientiousness)

</comment><comment><USER49> [https://rescuetime.com](https://rescuetime.com) , when I bother to pay attention to it.

</comment><comment><USER29> I'll detail some of my favorites for Alfred, in the terminal, and in sublime- text.

 _Alfred_

I like [http://www.alfredapp.com](http://www.alfredapp.com). Gives you immediate access to lots of tools and you can install custom workflows. A few favorites:

sublime workflow - [https://github.com/franzheidl/alfred- workflows/tree/master/o...](https://github.com/franzheidl/alfred- workflows/tree/master/open-with-sublime-text) \- Useful for opening folders or files in sublime.

git repos - [https://github.com/deanishe/alfred- repos](https://github.com/deanishe/alfred-repos) \- Search local repos in alfred

font-awesome search [https://github.com/ruedap/alfred-font-awesome- workflow](https://github.com/ruedap/alfred-font-awesome-workflow) \- Retrieve css for fontawesome.com icons.

HN - [https://github.com/wkgg/hackerNews-alfred- workflow](https://github.com/wkgg/hackerNews-alfred-workflow) Shows hacker news in Alfred.

I've also written a couple workflows. There is a really nice python library: [https://github.com/deanishe/alfred- workflow](https://github.com/deanishe/alfred-workflow) that makes it easy.

gist-alfred - [https://github.com/danielecook/gist- alfred](https://github.com/danielecook/gist-alfred) \- Search and copy github gists from alfred.

Quiver-alfred - [https://github.com/danielecook/Quiver- alfred](https://github.com/danielecook/Quiver-alfred) \- Search and open quiver notes

codebox-alfred - [https://github.com/danielecook/codebox- alfred](https://github.com/danielecook/codebox-alfred) \- Search and copy codebox snippets.

I've come to rely on the codebox and gist workflows for managing snippets quite a bit.

 _Terminal_

Autojump [https://github.com/wting/autojump](https://github.com/wting/autojump) \- Remembers what directories you have visited and allows you to jump to them. Jump to them by typing

      j <fuzzy search dir name>

pyenv - [https://github.com/pyenv/pyenv](https://github.com/pyenv/pyenv) \+ python-virtualenv - Manage python versions or virtual environments at the directory level. Makes managing multiple projects with different software requirements much easier.

direnv - [https://direnv.net](https://direnv.net) \- Similar to pyenv except it allows you to set environmental variables. Useful for setting things like API keys.

 _Sublime-Text_

I'm a big fan of sublime text. Some of my favorite packages are:

git - [https://github.com/kemayo/sublime-text- git](https://github.com/kemayo/sublime-text-git) \- Add, commit, branch, push, pull

GitGutter - [https://github.com/jisaacks/GitGutter](https://github.com/jisaacks/GitGutter) \- Shows which lines are modified, added, and deleted in the gutter of the editor.

SendCode - [https://github.com/randy3k/SendCode](https://github.com/randy3k/SendCode) \- Send code to the terminal/iTerm/IDE.

SublimeLinter-flake8 - [https://github.com/SublimeLinter/SublimeLinter- flake8](https://github.com/SublimeLinter/SublimeLinter-flake8) \- Used to clean up Python code.

</comment><comment><USER50> I use Pocket to save articles to read later, Todoist for my to-do list, and OneTab chrome extension to keep my Chrome tabs clean.

<comment><USER22> Wallabag is a great open source alternative that you can host yourself. Anything interesting that I stumble across on hacker news (or elsewhere), I add to Wallabag, then when I fly I have a huge collection of articles to read.

</comment></comment><comment><USER51> Sorry for a non-answer, but I noticed whenever I get excited trying out new tools and apps (I love productivity apps), what is really happening is that I just procrastinate. Tools can be useful but won't make you magically more productive.

Having said that, what I find incredibly useful is Scapple as a form of "smart" paper.

</comment><comment><USER52> I use Sunsama daily ([https://sunsama.com](https://sunsama.com)) to navigate my time + tasks. Disclaimer: I also work on making it.

I also built a really fast rig recently. It saves me a lot of time since I'm spending less time waiting for projects to build and can't lose focus.

</comment><comment><USER53> TextMate - simple with great bundle support.

Also, a new version (v2.0-rc.8) just came out a few days ago: [https://github.com/textmate/textmate/releases/tag/v2.0-rc.8](https://github.com/textmate/textmate/releases/tag/v2.0-rc.8)

</comment><comment><USER54> Vim.

</comment><comment><USER55> Developer journal, simply in OneNote, kept day by day and a separate section for general knowledge or quick snippets.

It takes some time before it pays off, in my case one month, but it offloads your memory and allows you to quickly look up issues to problems you have had before.

</comment><comment><USER56> vim,tmux,i3,taskwarrior and redmine

</comment><comment><USER57> It's totally fine to be a nerd about your tools, but sometimes, productivity comes when you stop being one.

I had major productivity boosts after switching from a nerdy tool, to a more mainstream one:

Linux -> Mac

Vim -> Emacs -> Sublime -> Vscode

Gdocs/OpenOffice/iWork -> MS Office

etc...

<comment><USER57> Also, stopping hating JavaScript and embracing it allowed me to do awesome things. I used to be a system/backend-only engineer, but once you get your head around UI, you get a lot more freedom.

And it's not just about getting MVPs out. For example, I had to make a few audio-processing algorithms, and in order to help myself understand and debug those, I build a simple web app to visualize each step of effects chain. Oh, and with hot module reloading, I can record a sample, then change the code and see updated results without losing the sample. Bret Victor level of productivity ;)

Oh, and after some bundling and transpiling (if necessary), I can run the same code in browsers, node.js and mobile (we're actually using jscore directly)!

</comment></comment><comment><USER58> I'm surprised nobody has mentioned Freedom:

[https://freedom.to/](https://freedom.to/)

It's a siteblocker, except at the VPN level (so you can't just disable it from your browser).

Really helps me be productive.

</comment><comment><USER59> if like me, you're an avid user of vim, the vimium [0] plugin was a game changer in my productivity.

[0]: [https://vimium.github.io/](https://vimium.github.io/)

</comment><comment><USER60> Walls. They block distractions to a number of senses: audio, light, smell.

</comment><comment><USER61> I use [http://www.hammerspoon.org](http://www.hammerspoon.org) for scripting my own window management, extra shortcuts for my mouse, pomodoro timer.

<comment><USER62> care to share how you use hammerspoon?

<comment><USER63> \- Flip audio outputs dependant on the application running (e.g. if Zoom I want my headset with mic, if Spotify I want my DAC/Amp).

\- Mute sound when suspending, so I don't accidentally wake my laptop up with the volume on in some public place.

\- Bind applications I use often to capslock+letter.

\- Close ScanSnap application when my scanner isn't plugged in, and open it when it is.

\- Move windows and resize them when I'm docked into monitors.

\- Type my paste buffer into places where paste is forbidden.

\- Extend my screen timeout from 2m to 10m when at home (based on SSID).

A few of the examples, there's 1000s of things you can do.

</comment></comment></comment><comment><USER64> Evernote and VSCode have both been gigantic productivity boosts for me.

</comment><comment><USER65> The "Do Not Disturb" mode on my mac and iphone

</comment><comment><USER66> Vim, although now I often use Atom with Vim bindings for Clojure work.

Parinfer for Atom.

Clojure. Easily the most productive tool in my library.

</comment><comment><USER67> Netsso.com, bookmarker which holds all my links to places I might wish to revisit, behind one single sign on, from any PC/ Android. Very fast re-find search. Also loads my Dropbox while encrypting the files if i wish to, and they decrypt on any other machine, with no software required. Takes Notes, too,

</comment><comment><USER31> The clipboard manager in Alfred

<comment><USER68> Ditto, indispensable utility within a must-have mac OS utility. I look forward to one day having the option to increase the font size of the clipboard.

</comment></comment><comment><USER69> Autohotkey, Resharper, Timesnapper, Evernote, Stickies (the app, not the paper)

</comment><comment><USER70> gitlab projects - for todo lists, notes etc., (so they can be accessed everywhwere)

pycharm - for editing python programs

Zim - for wiki style editing

vim - for remote files, non python files etc., where pycharm is not option

</comment><comment><USER71> tmux, emacs/emacsclient, org-mode.

</comment><comment><USER72> pen/paper, OneNote, think-cell for graphs / reports, Alteryx for quick data blending.

</comment><comment><USER73> orgmode for work on the Mac, OmniFocus on Mac and iPhone for private tasks.</comment>


Ask HN: Novice getting started with Tensonflow - <AUTHOR> Coming from a web background (PHP,JS), what would be the easiest way for me to get started with tensorflow?<p>I find the setup quite daunting.. <comment><USER2> That's a common feeling because setting up tech is daunting. Tools like Tensorflow are developed at companies like Google for use by teams of engineers...or individuals with access to support teams. Companies like Google don't design products like Tensorflow to hide all the necessary complexity and don't document the products for less technical users.

When a product like Tensorflow is released by Google, many early adopters are working in environments with institutional knowledge about sophisticated tools. For them, Tensorflow is easy to use relative to what they were using before but it's not easy to use like an iPhone or other consumer technology.

So what might this mean for you? Well if setting it up is daunting you will learn a lot by doing it even if you never really get it set up quite right or abandon it as too much bother or become an expert. Or to put it another way, when technology X requires technology Y which requires technology Z, maybe I wind up learning more about Y and Z than X and get back to X in a year or two once I have the background and if I don't come back then it is sometimes that X wasn't really as interesting as I thought but going through the process makes picking up technology W easier.

So my random advice from the internet is stick with it because it is daunting and see where it goes. One of my favorite essays is by Peter Norvig who is a Principal Engineer at Google: [http://norvig.com/21-days.html](http://norvig.com/21-days.html)

Good luck.

<comment><AUTHOR> Thanks for the reply, I guess my weekend is planned lol

<comment><USER2> Direct advice: for Tensorflow, use Python because it will mean swimming with the current in the middle of the channel.

</comment></comment></comment><comment><USER3> You are a (Insert unix OS here) user I hope...?

Python version 3 works well for me. Hardware wise as of right now a nvidia cuda card compute level 3.0 or greater is needed for running on gpu. That means basically a Ge-force 710 or better, also tensorflow runs on a cpu (for now) but that does affect performance.</comment>