Introducing MIR - <AUTHOR> http://blog.rust-lang.org/2016/04/19/MIR.html <comment><USER2> I'm incredibly psyched for MIR. It'll represent the first conceptual "leap" for the language since Rust 1.0, checking off (or at least unblocking) a ton of the improvements that we've had in mind for years now (the list in the OP is hardly comprehensive!).

It's also interesting that Swift, another LLVM-based project, has also transitioned to using their own language-specific intermediate representation (SIL). I think it's fascinating that, despite the availability of a robust and mature pluggable language backend, two professional languages independently decided that they needed _another_ layer of abstraction between AST and LLVM IR. Not sure if this should be interpreted as a bug report against LLVM IR, or if it possibly represents a future trend in compiler design.

EDIT: I should also mention that MIR has been available on play.rust-lang.org for a while, if anyone would like to play with it in their browser: [https://play.rust- lang.org/?gist=fee8ccf28bae2c89107d&versio...](https://play.rust- lang.org/?gist=fee8ccf28bae2c89107d&version=nightly)

<comment><USER3> It's been pretty common for compilers to require 3 different intermediate representations (parse tree, MIR, and LIR). My copy of _Advanced Compiler Design and Optimization_ [1] (over 10 years old at this point) lists the 3-IR architecture on page 8. It references Sun's SPARC compilers, DEC's Alpha compilers, Intel's x86 compilers, and SGI's MIPS compilers as implementations that use it.

What _has_ changed are the boundaries. Traditionally, semantic analysis (including typechecking) operated on the parse tree, which resembled the human-written language extensively. Optimization operated on MIR, then it'd be lowered to an architecture-specific LIR via register allocation and instruction selection, and another round of optimization (instruction scheduling, etc.) would be applied. The purpose of all of this was to provide multiple language front-ends on top of a single compiler. In the 80s and 90s, compilers were often written by the hardware vendor, so they would tightly optimize the MIR and LIR for their own architecture, and use the parse-tree => MIR lowering to support multiple surface languages.

LLVM chose a LIR that's closer to what many compilers had been using as MIR, and then moved the optimization passes into the LIR, and hid the architecture- specific backends within the LLVM project itself, out of the eyes of language designers. It could do this because of open-source: with a shared body of compiler code owned by everyone and gradual consolidation of the hardware market, it became easier to contribute your backend to LLVM than to maintain your own compiler stack and fight for adoption. (GCC actually had a fairly similar architecture first, but the GCC IR was very difficult to comprehend if you weren't a GCC maintainer, which made it impractical as a compilation target for outside projects. They generated C code instead and let GCC compile it.) That in turn made it much easier to write a compiler and experiment with language design, since you only had to figure out how to translate your language to LLVM's IR rather than work out the details of scheduling and register allocation. _That_ , in turn, allowed greater complexity in language features: Swift and Rust have language features that go beyond what cutting- edge research was <10 years ago, and do so in a production language that you can use _now_. And so it's not surprising that they're now re-introducing a MIR to manage the additional complexity introduced by the new language features.

[1] [http://www.amazon.com/Advanced-Compiler-Design- Implementatio...](http://www.amazon.com/Advanced-Compiler-Design- Implementation-Muchnick/dp/1558603204)

<comment><USER4> I tried to upvote you, but I fat-finger downvoted you instead. Sorry. :(

<comment><USER5> A slight side note: this is one of the most difficult parts with using Hacker News on a mobile device. I fat finger upvotes _all the time_! I wouldn't mind the ability to change a downvote to an upvote and vice versa, even if it was time limited so I could correct any incorrectly voted items.

<comment><USER6> couldn't this be easily fixed by putting the downvote triangle on the other side of the time?

(upvote arrow) name xxx hours ago | parent | flag | (downvote arrow)

would make it less fat finger prone and still be pretty straightfoward to use (plus having downvote close to flag IMHO makes sense as well from a context perspective)

<comment><USER7> Could be easily fixed by one line of CSS to make the dang buttons larger, but apparently Hacker News can't be bothered to improve their shitty website.

EDIT: great community, shitty website.

</comment></comment></comment></comment></comment></comment><comment><USER8> I suspect that the MIR idea could (should?) become a pretty common concept for a large number of LLVM-based languages. the LLVM IR is very low-level, and in most modern languages there's a big gap between the programmer-friendly features they have and "the bare essentials that still capture the same ideas".

I also suspect that the act of designing a MIR for a language is a fun one, should be pretty damn enlightening. It really forces you to focus on what's "core" about the language.

In my own, limited, experience with language design and compilers, I've found that doing something like a MIR greatly simplifies other parts. Code written in MIR (in my case, it didn't even have a concrete syntax, just an abstract syntax tree) is full of duplication and is ridiculously explicit, but it's super easy to process in all kinds of ways.

Just plainly guessing, but based on this blog post, if I'd write a Rust interpreter, I'd probably run it on MIR and not on plain Rust or LLVM IR.

<comment><USER9> You are correct that a Rust interpreter would work great on MIR, which is why Scott Olson (@tsion) has been working on one: [https://github.com/tsion/miri](https://github.com/tsion/miri) (check out the slides and the report).

</comment></comment><comment><USER10> What I want to see in a language would be a bunch of syntactic sugar which corresponds to a MIR like Rust's by a well-specified reduction that is likely to be consistent from build to build.

The reason that this could be really cool is that you could hypothetically hash these MIRs and store these hashes in a public database of open-source code. (You would have to include hashes of whatever functions they call/depend on, and you would have to solve foreign-function imports.)

Then you would have this cool language where modules are simply saying "here's a mapping of names to hashes in the public database," with automatic recognition of "hey, these two functions you're importing from these two modules are actually the same function, I don't need to disambiguate them." If your dependency graph isn't a tree and one of the branches can't cope with a dependency-upgrade, that's fine too -- you upgrade the dependency on the one branch only. The point is, all of your dependency-semantics are now reduced to a really straightforward reasoning about unique names.

<comment><USER2> Why would you prefer to hash an intermediate representation, rather than hashing the source?

<comment><USER11> Maybe two different sources compile to the same IR?

<comment><USER12> If the IR contains file and line number info, that seems pretty unlikely.

<comment><USER10> Right, the point would be for the hash to strip out file info, line numbers, whitespace, comments, any stylistic choices which turn out to be equivalent "under-the-hood" in some straightforward way, and probably even the bound variable names (with de Bruijn indexes).

</comment></comment></comment></comment></comment><comment><USER13> I'm curious how this new architecture preserves safety invariants. The post says MIR contains operations not available in Rust because they are unsafe. Does this mean every MIR transformation needs to be safety-preserving? Or is safety-checking the last stage that runs directly before LLVM IR generation?

<comment><USER14> MIR transformations do have to be safety-preserving, but this isn't any different from all of the LLVM IR-level optimizations.

<comment><USER13> But the MIR definition of "safety" must be more encompassing than LLVM IR, right? LLVM IR has no concept of a borrow. Where in the MIR pipeline does borrow checking happen?

<comment><USER14> I believe that when it's implemented it will happen first before any optimization, in order to provide the best diagnostics possible and to avoid doing wasted optimization if there are errors. But Niko would really be able to answer this more definitively.

</comment></comment></comment></comment><comment><USER15> That's awesome work, thank you!

I'm wondering if MIR will make it possible to replace the backend IR. For instance, to use WebAssembly instead of LLVM IR.

Or is it still a better idea to base it off of LLVM?

<comment><USER9> There is discussion of a WebAssembly backend which lowers MIR directly, see [https://github.com/rust-lang/rust/issues/33205](https://github.com/rust- lang/rust/issues/33205).

</comment></comment><comment><USER16> Wow! More than the actual concept (which is cool), I found the level of technical writing is of high calibre .. highly educating. Pleasure to read such articles.

</comment><comment><USER17> Will this allows us to get TCO? I'm used to writing recursive functions and miss TCO all the time.

<comment><USER14> In theory it could allow for sibling call optimization by rewriting those functions into loops. It would not allow full unrestricted TCO--that would require both ABI work and thorny high-level design issues around destructors that may well not be solvable at all.

However, in practice LLVM already has full support for sibling call optimization internally, so implementing such an optimization at the MIR level wouldn't really buy us anything over what we already have.

<comment><USER17> Then maybe rustc ought to have diagnostics that warn if a recursive function won't be optimized fully, and then I can either avoid recursion or rewrite to fit into the optimizer, but having to appease a changing optimizer isn't what I'd call maintainable code, so a function attribute might make more sense.

<comment><USER18> There's a reserved and unimplemented keyword "become", which is like "return" except it requires that it can optimize the tail call (and is a compile-time error if it can't). See this comment: [https://github.com/rust- lang/rfcs/issues/271#issuecomment-18...](https://github.com/rust- lang/rfcs/issues/271#issuecomment-189386398)

Nobody's tried implementing it recently, though.

</comment></comment></comment></comment><comment><USER19> This really sounds like GHC's Core, a simplified, desugared, explicit intermediate language used during compilation.

</comment><comment><USER20> Not super familiar with Rust, but will this have any impact on debugging?

I imagine LLVM is generating debug symbols from what it receives (which would be fairly representative of the original program).

Now with this extra step, won't LLVM generate debugging symbols for the MIR, which doesn't really map well to the original code (ie: LLVM won't know all those gotos were originally a loop)?

<comment><AUTHOR> MIR keeps track of where in the original source it was generated, so you still get good debugging output.

<comment><USER20> nice! thanks :)

</comment></comment></comment><comment><USER21> I'm surprised to see no mention in the article or on HN about how this might affect writing crypto code in Rust. Maybe it's a little tangential, but I'm dying for constant time operations.

Avoiding branches, etc. in Rust doesn't mean LLVM won't add some as an optimization, which is frustrating to say the least. It would be awesome to be able to define a block - similar to "unsafe" \- that tells the compiler to disable optimizations that could introduce non-constant time operations. When I started reading the article, I though maybe this new development would open the door to something like that, but it doesn't appear to be the case.

There's some work to do constant time ops in rust, but it's very experimental and untrustworthy. :/

<comment><AUTHOR> Since this is before the LLVM passes, it doesn't really change anything, and can't.

<comment><USER21> I have no experience with LLVM internals, but couldn't you split up the code and disable some of LLVM's optimizations on blocks defined by the programmer?

Or do you have to pass the entire program at once to LLVM? Maybe the ability to disable optimizations only on certain functions is possible, idk, but I think it certainly would be nice.

<comment><AUTHOR> I'm not knowledgeable about that, to be honest.

</comment></comment></comment></comment><comment><USER22> This is some really fantastically well done exposition. I loved it.

</comment><comment> nv-vn Awesome. This reminds me of the recent changes to the OCaml compiler (flambda). If it's anything similar, can't wait for the performance improvements from this (which can hopefully continue bringing Rust up to C speed).

<comment><AUTHOR> In general, if Rust is significantly slower than equivalent C, it's a bug. Please file them if you find them.

</comment></comment><comment><USER23> What is the reason the MIR was not a part of the compiler right from the start?

<comment><USER14> Because (a) I resisted it due to (mistakenly) thinking it was not necessary; (b) the language was changing a lot and having a MIR to change would have made that harder. If we had had a MIR from Rust 0.1, it probably would have had to be completely overhauled by this point.

</comment></comment><comment><USER24> Hopefully the IntelliJ Plugin of Rust will iterate faster and support more completions. Actually it would be awesome to edit Rust the same way than Scala/Java.

<comment><USER25> I don't think this new work would be useful for that. It's an internal compiler IR for programs in the process of being optimised and lowered, not a general format for representing Rust programs for user applications.

<comment><USER26> Specifically, based on the thread covering WebAssembly as an output target [0], rewinding the graph into higher control structures like loops may be non- trivial.

[0] [https://github.com/rust- lang/rust/issues/33205#issue-1509804...](https://github.com/rust- lang/rust/issues/33205#issue-150980448)

</comment></comment></comment><comment><USER27> It's interesting to compare and contrast this against bytecode from other platforms like CIL or JVM bytecode. They're both essentially a kind of compiler IR and they allow for incremental compilation, can be interpreted, dynamically manipulated, structed as basic blocks, etc. But MIR is represented using a textual form that still has scoping and which still uses Rust syntax. I can see the appeal. But I wonder how much it complicates working with MIR. You'd need a more complex parser, I guess.

<comment><USER14> It's kind of a moot point, because MIR never leaves its in-memory representation in normal compilation. (However, that may well change with future improvements to incremental compilation, though the on-disk format will likely never be formally defined and stabilized--it's too much work for little gain.)

Surface syntax of the compiler IR isn't particularly important anyway.

<comment><USER9> Well, actually, we store MIR in crate metadata. However, it's not a special serialization format, just the rustc_serialize infrastructure, i.e. you could also serialize MIR to JSON if you really wanted to.

</comment></comment></comment><comment><USER28> I wonder; can someone explain to me how this compares to Scalas' TASTY? It seems to be on about the same layer, but I understand too little about compilers to be sure.

</comment><comment><USER29> I assume this is not the X Window replacement from Canonical.

<comment><USER30> I thought before clicking they were going to announce that the X Window replacement was being rewritten in Rust, lol. They should change the name.

<comment><USER2> I don't think they're concerned overly much with the marketing presence of a compiler implementation detail. :P

</comment></comment></comment><comment><USER31> I am not sure if Julia already has something like this, because there was some work precompilation. Can someone throw some light on this ?

<comment><USER32> Yes, Julia uses a similar "lowered" form: [http://docs.julialang.org/en/latest/devdocs/ast/#lowered- for...](http://docs.julialang.org/en/latest/devdocs/ast/#lowered-form)

If you are interested in more details, there was a talk two years about the compiler design: [https://www.youtube.com/watch?v=osdeT- tWjzk](https://www.youtube.com/watch?v=osdeT-tWjzk) (many type names and implementation details have changed since then, but conceptually it is still very applicable).

</comment></comment><comment><USER31> I am not sure if Julia already has something similiar to this ? Can anyone throw some light on this.

</comment><comment><USER33> every rust topic, i vote.

</comment><comment><USER34> MIR riffing on peace or world?</comment>


How to make installable web apps for Chrome - <AUTHOR> http://code.google.com/chrome/apps/docs/ <comment><USER2> (Sorry, I think this turned into a trolling ramble possibly...)

I cannot decide if this matters or not. Seriously, will this matter? I have web apps, I have web apps that would rock in a desktop environment where I didn't have to host the data, or could at least "sync" it with the desktop.

But does it matter? Will Chrome matter? Will telling people to install Chrome to install my app be worth it? Will other browsers follow suit?

Obviously this has so much going for it. First, it's being launched as a "store" and not just an "add-on" system. I haven't written my apps for Firefox because I need it to financially make sense. Creating something for another "store" does make sense.

I can now write apps for Android, iPhone, Palm, RIM, Windows, Mac, iPad, web- based, and other cell phones. Now add "browser-desktop" into the mix.

This means I have to write my app in Java with Android's SDK, Objective-C, (uhm?), Java, .Net Pascal C etc, more C, more C, PHP/Ruby/.Net/Python, more Java, HTML5? Uhgo.

Good Lord!!! Can I just write one app in Flash or Java and be able to distribute it everywhere PLEASE???

<comment><USER3> You have to stop thinking about apps as standalone things. We are quickly getting to the place where apps are all comprised of a client and server exchanging data over http(s). If you build a robust api to your data, then you can build many many client implementations to get at it on any platform. The Chrome platform doesn't require anything beyond what you're already building for your web client. Unless you're not building a web client, in which case why would you be worried about the Chrome web store at all?

Note that there are tons of things to figure out in terms of network latency and up/downtime, some of which are addressed by the newer features of html5.

</comment></comment><comment><USER4> One of those icons looks awfully familiar :)

<comment><USER5> I was surprised to see it there, next to gmail!

<comment><USER6> Hacker news is an important use case of ours :)

(edit to reduce snark)

<comment><USER7> I did an installable app for HN here <http://blog.ricodigo.com/2010/5/23/how- to-create-chrome-apps>

</comment></comment></comment></comment><comment><USER8> So it appears this is windows only for now according to this: <http://code.google.com/chrome/apps/>

Which seems so weird considering this is what will make chrome os, at least in terms of the web as a desktop sort of thing.

Though they probably did this for other reasons such as a larger userbase to test with or some reason unknown to me, hopefully I'll get to try it soon when it is ported to the other OS's.

<comment><USER7> No, it works fine on Linux too, I even made an app for HN that I posted a few days ago <http://news.ycombinator.com/item?id=1371515>

</comment></comment><comment><USER9> Great, more stuff to jam horizontally along my tab bar. Perhaps it's time to start thinking about putting things vertically?

</comment><comment><USER10> Isn't Chrome's "Create Application Shortcuts" better than this already?</comment>


'Impossible' EmDrive Space Thruster May Really Be Impossible - <AUTHOR> https://www.space.com/40682-em-drive-impossible-space-thruster-test.html <comment><USER2> Disappointing, but not really surprising.

Yes the _actual_ laws of physics can't be broken. We don't know those. We know an approximation of them based on centuries of careful observation and analysis. That approximation is incredibly good, too. It lets us make microchips with 7nm features, synthesize high atomic weight elements, and build spacecraft that have traversed the solar system. Even so, there are things we know we don't know and there are bound to be things we don't know we don't know.

It would be nice if the EmDrive turned out to be a ground breaking demonstration of a hole in our model. We could probably squeeze a century of amazing science out of it. Not to mention the potential practical applications.

But groundbreaking new discoveries that shake the foundations of a developed scientific theory are incredibly rare. So, as awesome as it could be if it were right, the odds were always against it.

<comment><USER3> It is also much more likely for such a discovery to appear at the edge of our knowledge where our understanding of the rules is at least a bit fuzzy (like near black holes and whatnot). Something like EmDrive, which is in a regime that has been exhaustively tested, would be like discovering that Bin Laden was hiding in the Oval Office all along.

<comment><USER4> > It is also much more likely for such a discovery to appear at the edge of > our knowledge

This instantly reminds me of the Casimir Effect. Yes, it's way more likely for problems to appear at the edges of our knowledge. But discoveries within the noise of experiments people run every day are not unheard of.

I would also expect any such discovery coming from public science made by somebody wondering why their instruments are off, not by for-profit research looking for patents. But that's not unheard of either.

<comment><USER5> > _discoveries within the noise of experiments people run every day are not > unheard of._

That's also at the edge of the parameter space we're familiar with.

<comment><USER4> This one is on the edge of low noise measurement of torque. In fact, the entire exercise pushed the edge way lower than it was.

</comment></comment></comment></comment></comment><comment><USER6> I've been curiously watching this story although, like many other folks, I realized that the chances were greater than 99% that it wouldn't work out.

What saddened me is the glee that some scientists and students took with dismantling all of these home experimenters. It was shameful to watch. What could have been a great opportunity for many to learn more about science and experimentation turned into a bunch of jackasses mocking a bunch of interested laymen. Not exactly the public image you want for your field of study.

<comment><USER7> Agreed. Science is hard, especially without funding...but amateurs do contribute to science. This is most noted in astronomy.

<comment><USER6> When I was 17, I took independent math study at my high school. (I had ran out of math classes to take by doubling up on them) The math department lead mentored me.

One day I asked "Why is 1/0 undefined? You guys said you couldn't take the square root of a negative number, but when push came to shove, you just invented new stuff. Why not do that with 1/0?"

He did not laugh at me or mock me. He looked earnestly at me and said "Why don't you try doing that. See what happens."

I spent the next week or two trying to set up another number system. When I ran into trouble, I did a bunch of research at the library.

When I came back the following week or two? I was able to give him a mini lecture on why it didn't work.

Curiosity, humility, ignorance, and passion is the beating heart of science. The more we make it into some modern priesthood, pro football team, or rock band, the more the general public doesn't want anything to do with it.

<comment><USER8> [https://en.wikipedia.org/wiki/Riemann_sphere](https://en.wikipedia.org/wiki/Riemann_sphere)

<comment><USER6> Yep. That's where I ended up. What a great way to get an introduction to a really neat concept.

</comment></comment></comment></comment></comment><comment><USER9> Of course it is. Nearly every physicist knew this was quackery from day one. It should of course be tested properly, but nobody should be surprised.

<comment><USER10> Why is it impossible? Is it the _amount_ of thrust that's generated that's impossible, or the mere concept of generating thrust from electromagnetic waves?

The reason that I'm asking is because light has momentum. If I shine a beam of light out the back of my spacecraft, then I will accelerate in the opposite direction. Not a lot, just a little.

Was EmDrive impossible because it was claimed to generate way more thrust than could be explained from the energy levels involved? (Edit: It looks like an additional reason it's impossible is because the EmDrive was claimed _not_ to emit radiation, and rather keep it bouncing around in the cavity. Thanks for the replies and explanations!)

Imagine that I attach a 1 megawatt laser in the 630 nm spectrum to my spacecraft. From some rough calculations based on (1), it looks like the laser will generate about 0.003 newtons of thrust (equal to the weight of 0.2 pounds on Earth), which is very little thrust, and impractical for accelerating a spacecraft over regular time scales.

(1) Momentum of a laser beam: [http://umdberg.pbworks.com/w/page/50455623/Momentum%20of%20a...](http://umdberg.pbworks.com/w/page/50455623/Momentum%20of%20a%20laser%20beam)

<comment><USER11> Any reactionless drive better than a photon drive is probably a perpetual motion machine.

[https://arxiv.org/abs/1506.00494](https://arxiv.org/abs/1506.00494)

<comment><USER12> Again, this is incorrect interpretation of the cited paper.

</comment></comment></comment></comment><comment><USER13> Pity, I really hoped we hacked the rounding error of the Universe :-/

</comment><comment><USER14> Hmm, could we use interactions with the Earth's magnetic field for thrust when in LEO? With the Sun's magnetic field? It would be slow going.

<comment><USER15> Yes, sort of, but that's mainly useful for torque rather than thrust as thrust relies on (if I'm getting this right) field _gradients_ rather than absolute field strength. It's not nothing, but it might as well be.

I back-of-enveloped a launch system with a very big magnet on the ground, supplying a much steeper gradient to push against, and it was still crazy expensive.

(I wonder if it would be useful for skyhooks?)

</comment></comment><comment><USER11> It would have been a perpetual motion machine of the first kind (you could get an unlimited amount of energy out of it): [https://arxiv.org/abs/1506.00494](https://arxiv.org/abs/1506.00494)

The evidence for it was no better than the evidence for any other perpetual motion machine, there was nothing that made it special other than not claiming to be a perpetual motion machine (despite being one).

</comment><comment><USER16> I wanted to believe it could be true, but that's the beauty of science.

Test. Test and re-test. If the conclusion isn't want you want it to be, refine the accuracy of your test and increase sample size. If you test is already at maximum resolution, then tough tacos buddy.

<comment><USER17> Re: _" I wanted to believe it could be true"_

Indeed. Star Trek dreams shatnered, I mean shattered. Sorry, no visiting green Orion space-babes. Live long and cuss.

And, wouldn't somebody typically check electrical interaction with Earth's magnetic field? It's a factor already known about.

</comment></comment><comment><USER18> The paper discussed on HN:

[https://news.ycombinator.com/item?id=17096175](https://news.ycombinator.com/item?id=17096175)

</comment><comment><USER19> The measured thrust was evidently interactions of electrical cabling with the Earth's magnetic field as per the new study.

<comment><USER20> Wasn't that just a theory - has it been conclusively proofed it was the cabling?

</comment></comment><comment><USER21> Unsurprising, but still unfortunate.

</comment><comment><USER22> Yes, the laws of physics are rarely to be messed with. Doesn't mean we should stop trying, as long as we stay grounded.

<comment> the-pigeon We still can't bridge classical mechanics and quantum mechanics so obviously we are missing at least one huge piece of the puzzle.

<comment><USER4> What problems with bridging them do you have in mind? I thought this was entirely solved.

<comment><USER23> Einstein theory of gravity is still considered classic (since it's not quantified).</comment></comment></comment></comment>


Paul Graham's personal website (circa 2000) - <AUTHOR> http://bugbear.com/

<comment><USER2> Paul Graham invited the entire internet to play pickup soccer in (presumably) Cambridge? [http://bugbear.com/pickupsoccer.html](http://bugbear.com/pickupsoccer.html)

That would not work out well today...

Edit: There's also an older version of the Rice and Beans recipe from "Ramen Profitable":

[http://bugbear.com/riceandbeans.html](http://bugbear.com/riceandbeans.html) (compare: [http://paulgraham.com/ramenprofitable.html#f1n](http://paulgraham.com/ramenprofitable.html#f1n))

There's a few other recipes as well. Now that PG is retiring from leading YC and running Hacker News, maybe he can write the "Ramen Profitable Cookbook"?

Edit 2: I'm curious what this is meant to be a list of: [http://bugbear.com/sludge.html](http://bugbear.com/sludge.html)

<comment><USER3> sludge.html is apparently "Suspiciously homogeneous substances."

</comment></comment><comment><USER4> [http://bugbear.com/tutuspeech.html](http://bugbear.com/tutuspeech.html)

Is listed as being given in 2002.

</comment><comment><USER5> The Coke Monkeys article is fascinating: [http://bugbear.com/cokemonkeys.html](http://bugbear.com/cokemonkeys.html)

<comment><USER6> This explains why I have such crappy bananas, do cocaine, and fight so much.

</comment></comment><comment><USER7> One of the most interesting things about the site to me was the navigation system. There is an "up" button and a "next" button in the navigation panel on the pages. It is conceptually set up as a file directory--which has been replaced in navigation with the modern convention of "forward" and "back" buttons.

</comment><comment><USER8> Woah. He was such a _nerd_! And I mean that in an endearing way - cars, drawings, quotes, books, family, events - all of the things that we used to nerd out about and then put on our websites.

I guess now we tweet or fbook these things.

Careful, pg, it expires in November of this year!

</comment><comment><USER9> I've failed at YC applications three times. And I know I'm completely missing the day-to-day stuff of the most creative community on the planet. But all that is fine by me.

I miss PG more. There was this hope in him that there is someone who understands the correlation between the riskiest larval start-ups, investor appetite and home runs. There was this hope that my seemingly dumb ideas had a chance, however small, of making it big when someone like PG gave me a starting gun.

</comment><comment><USER10> so, should I put a trevor icon on my site?

<comment><USER3> yes

</comment></comment><comment><USER11> Looks better than his current site, IMHO.</comment>


Does anyone still need Google Wave invites? - <AUTHOR>

I just got an influx of wave invites, and if anyone doesn't have one that wants one, I'd be willing to give a bunch away. <comment><USER2> I have some too, if zck runs out.

Seems like Google Wave invites are worth about as much as Gmail invites are now.

Are Google Voice invites still hard to get a hold of? I'm in Australia, so I can't even use the thing.

<comment><AUTHOR> Yeah, I don't really think too many people will need an invite, but I wanted to double check.

</comment></comment><comment><USER3> I would love to have one, if you have a spare one left.

email@example.com

Much appreciated!

<comment><AUTHOR> Sent!

<comment><USER3> Thank you!

</comment></comment></comment><comment><USER4> I'd like one too please. My email: mihai tarnovan with a dot in between on gmail. Thanks.

<comment><AUTHOR> Sent!

<comment><USER4> Thank you very much

</comment></comment></comment><comment><USER5> I'd love one actually --> austin (at) beatnex (dot) com

<comment><AUTHOR> Sent after a minor typo. So if anyone can get firstname.lastname@example.com, you can get a wave invite.

</comment></comment><comment><USER6> Yes please! zephyrfalcon at gmail.com...

Thanks! ^_^

<comment><USER7> Sent, there you go :)

</comment></comment><comment><USER8> May I have one? Please?

firstname.lastname@example.com

<comment><AUTHOR> Invited!

<comment><USER8> Thank you, kindly!

</comment></comment></comment><comment><USER9> sure my email is my name with @gmail.com

Thanks, <USER9>
<comment><AUTHOR> Sent! The other invites I've been sending out got through pretty quickly, but not necessarily immediately.

</comment></comment><comment><USER10> one here please -> ngsayjoe at gmail dot com

<comment><AUTHOR> Invite sent!</comment></comment>


Show HN: redigest.it – Digest for Hacker News and reddit - <AUTHOR> http://www.redigest.it/ <comment><AUTHOR> Hi, I created redigest.it because I was unhappy with reading Hacker News and reddit. The goal is to get the best content in less time.

The three major pain points redigest.it improves for me are:

1\. I want to see links once, then hide them.

2\. I want to have better control over which links and how many of them I get to see. Especially when I haven't visited the sites for more than a day facing a large backlog.

3\. I often want to see the best links since my last visit instead of "hot" links. (reddit's "top" fails because it underrepresents small subreddits as they tend to have low scores.)

Visiting the sites too often shows me few new links under many that I've already seen. Visiting the sites too rarely makes it easy to miss good links/discussions and overwhelming due to the amount of content.

More detailed descriptions of the benefits:

\- Hacker News: [http://www.redigest.it/hn/why](http://www.redigest.it/hn/why)

\- reddit: [http://www.redigest.it/r/why](http://www.redigest.it/r/why)

There are three digests so far:

\- Hacker News: [http://www.redigest.it/hn/](http://www.redigest.it/hn/)

\- reddit's /r/all: [http://www.redigest.it/r/](http://www.redigest.it/r/)

\- Your personal reddit frontpage: [http://www.redigest.it/r/my/](http://www.redigest.it/r/my/)

The personal reddit digest is the one with the most improvements so far.

The site is using:

\- Flask

\- RethinkDB

\- haxor for the Hacker News API: [https://github.com/avinassh/haxor](https://github.com/avinassh/haxor)

\- Praw for the reddit API: [https://praw.readthedocs.org/](https://praw.readthedocs.org/)

Next, I'm going to take the number of comments into account for the HN digest.

Looking forward to your feedback!

<comment><USER2> I couldn't figure out how to get "1." to work.

<comment><AUTHOR> At the bottom of each digest is a button: "Hide stories older than the above"

If you press it, you will only see newer stories when you visit again.

</comment></comment></comment><comment><USER2> I couldn't understand how it works. Are they supposed to be merged on one page or on two separate pages?

<comment><AUTHOR> They are meant to be on separate pages as not everybody reads both.

Clicking "Hacker News" in the navigation, opens the HN digest. Which is here:

[http://www.redigest.it/hn/](http://www.redigest.it/hn/)</comment></comment>


Show HN: Iosevka, the Coders' typeface, and is code itself - <AUTHOR> https://github.com/be5invis/Iosevka <comment><USER2> I'd like to try this out but how do I install it on OSX? The instructions link me to the fontbook Apple page but I can't find the .ttf file anywhere. Admittedly this is my first time installing a new font on OSX.</comment>


Hiring Secret: Best Way to Vet a Candidate - <AUTHOR> http://www.inc.com/brian-halligan/hiring-process-vet-a-candidate.html

<comment><USER2> You can't be a software engineer for long without working in some shitty environments filled with TPS reports, dysfunctional management, and clueless executives. It's especially discouraging when you're formerly thriving company starts devolving into this said mess, usually when it fails to manage its growth appropriately ("production went down! no more production logins for anyone except our horribly understaffed sysadmin staff!") or when its core product starts showing its age ("we're going to pivot! to high growth markets! best in class! jack dorsey! jack dorsey!")

Not all of us handle this well, and I don't know about everyone else, but I have at least one job in my past that I left with some burned bridges. The idea of interviewing for a job and having my potential new employer calling the Bill Lumbergh-equivalent whom I eventually lost my shit about and publicly chewed out for being a moron, for an opinion about me, literally puts me in a cold sweat.

So this article would worry me, but I've seen it in practice a few times, since the Los Angeles tech scene is small enough that a lot of people have at least one stint at a small set of companies (e.g. Yahoo, MySpace, PriceGrabber, Citygrid, etc). Usually it's not quite so deliberate as the article paints of stalking mutual connections on LinkedIn. The typical scenario is someone on another engineering team asking, "hey I'm interviewing X, did you work with him when you were at Y company?" and I'll say, "yeah, he was really badass" or some equivalent. Even if I don't have a great opinion of him, it's usually something like, "Well I think he got let go when they did layoffs in 2009, but his manager was a dick so who knows."

Software engineering one of the few meritocracies left. If your quality of your work is good and you're respected by your peers, then Bill Lumbergh's opinion of you probably doesn't matter. And if it does, it's probably not a place you want to work at anyway.

<comment><USER3> Can you elaborate on the Jack Dorsey reference?

</comment></comment><comment><USER4> I guess it's important to be a contrarian in this thread. I am a lawyer (although I acknowledge I have practiced very little in employment law), and to the best of my knowledge and belief, the practice described in the article is legal in the majority of states of the United States and perhaps in plenty of other places. I suppose it's more of a matter of opinion whether asking someone whom you didn't name specifically on your application as a reference is "ethical" or not, but it's simply a matter of fact that your whole reputation in the workplace may be of interest to the next person you work for or work with. AFTER EDIT, ADDITION TO THIS PARAGRAPH: A reply posted as I was replying helpfully refers to a website

[http://www.crimcheck.com/resources/job-reference-shield- laws...](http://www.crimcheck.com/resources/job-reference-shield-laws.htm)

that summarizes some tips for employers about what they can say in response to requests for reference checks. The short summary of the various state laws is that employers can tell the truth. No employer may lie, but in general someone who knows you through an employment relationship is permitted to truthfully answer questions about your work, and you have no legal ground to sue the person who answers reference check questions (whose identity, as a practical matter, is likely to remain unknown to you).

I'll give an example of the hiring practice of one large (137 million dollars of revenue per year) organization in my town. The organization, which happens to be my friendly local public school district, has for more than a decade checked out candidates to be district superintendent by having resume-checkers telephone the references listed on the candidates' applications. The reference-checkers follow a protocol developed by a hiring practices consultant to conduct the reference check, and one question on the protocol is "Do you know anyone else who knows this candidate?" That person will be called, and the same question is asked, among all the other reference-checking questions.

The school district chief personnel officer, in a report to the school board just last month, mentioned that now a practice like this is followed for all new hires of teachers in the school district. The goal is to talk to multiple third-order references for each new person hired by the district. Going two degrees of reference out from the original references, and asking the right questions, does a lot to distinguish the best candidates for the job, in the personnel director's opinion. The practice mentioned in the submitted article, where the interviewer uses the candidate's self-disclosed social network information to find second-degree and third-degree references, seems fully legal and similarly likely to turn up more information about a candidate than just contacting the references mentioned by the candidate.

The school district chief personnel officer noted that when teachers are separated from our district's employment for poor performance, it is rare for anyone ever to contact our district even to verify the barest details of the teachers' job performance. So it appears that some organizations still don't check references or employment history at all. That is the organizations' choice, but it should hardly surprise a job candidate that some organizations check work histories very carefully, especially for positions of great responsibility like teaching young people. It is EXPENSIVE to make a hiring mistake for any organization, so quite a lot of time and effort is justified in making hiring decisions carefully.

In an earlier reply in another thread 58 days ago,

<http://news.ycombinator.com/item?id=3148100>

I linked to some external sources about legal reference-checking practices that I'll post here again as information for fellow Hacker News participants:

[http://hiring.monster.com/hr/hr-best-practices/recruiting- hi...](http://hiring.monster.com/hr/hr-best-practices/recruiting-hiring- advice/job-screening-techniques/reference-checking-questions.aspx)

<http://www.drgnyc.com/list_serve/Jan24_2005.htm>

[http://www.acadweb.wwu.edu/hr/Employment/InfoForHiringOffici...](http://www.acadweb.wwu.edu/hr/Employment/InfoForHiringOfficials/HiringPersonnel/Exempt/TelephoneReferenceChecks.pdf)

[http://www.best-job-interview.com/reference-check- questions....](http://www.best-job-interview.com/reference-check- questions.html)

<http://www.k-state.edu/hr/employment/referencecheck.htm>

[http://pbsbo.ucsc.edu/personnel_payroll/staff/recruit/ref_ch...](http://pbsbo.ucsc.edu/personnel_payroll/staff/recruit/ref_check.html)

[http://www.bridgestar.org/Library/HiringToolkit/ReferenceChe...](http://www.bridgestar.org/Library/HiringToolkit/ReferenceCheck.aspx)

[http://jobsearch.about.com/od/referencesrecommendations/a/re...](http://jobsearch.about.com/od/referencesrecommendations/a/refercheck.htm)

</comment><comment><USER5> This is not indicative of the type of employer-employee relationship I would wish for, from either side of the table. You're presuming an _awful_ lot to spend someone's social capital, without consent, _for the express purpose of soliciting negative comments about them_.

Suppose a candidate did a reverse background check on Hubspot by cold-calling an investor or customer, quietly, to solicit dirt on the company prior to evaluating a job offer? That strikes me as either a) too socially unaware to function as a professional or alternatively b) borderline sociopathic.

<comment><USER6> This is pretty standard practice in the valley, particularly if you are being hired in anything more than an entry level position.

Nobody is going to be paid $140K+/year, and be trusted with access to the source code tree, intellectual property, and possible exposure to customers on the basis of 3-5 45 minute interviews and a few (supplied by the candidate) reference checks.

You are going to be hired if (A) we already know you or (B) someone we know can vouch for you that you've done good work for other companies.

Trying to hire on any other basis is just playing a crap shoot.

It's what I like to tell my employees - "None of you are working for this company. You are all working for the _next_ company - and every decision and action you take here, will reflect on whether your next employer will want to hire you."

<comment><USER7> There's a huge difference between a personal voucher and a opinion randomly solicited off LinkedIn. The latter might nix some candidates, but is probably not very useful in determining the best ones.

</comment></comment></comment><comment><USER8> I love it when psychopaths write articles. They're being serious, but they sound like they're writing an _Onion_ article! Hilarious and sad.

Anyway, this is why I never answer the phone. Nobody calls you because they have something for you. They call you because they want something from you. Why should I give you an honest review of my friend? If I lie and say he's a 10, my friend will like me more and I will have a laugh at your expense. If I tell the truth, my friend will like me less and the end result will be having no friends. Why would I do that just to save you, some douchebag I've never met, some money? It just doesn't make sense.

<comment><USER9> This alone does not make the tactic invalid. A glowing review at least means that the candidate was able to make friends which is still a plus in the context of hiring.

The real danger is that the person you called is unethical and feels the need to get even for things like the candidate having exposed their own incompetence - clearly not a minus in the context of hiring.

</comment></comment><comment><USER10> Wow. This is horrible advice. I'm sure it works for the hiring company to get a better picture of the candidate, but this is unethical and potentially illegal in some states/countries. Legal issues are why many companies recommend/require references in a specific format- 'this person worked here from [date] to [date]', etc... devoid of any 'opinion' statements.

Here is a per-state summary of job reference shield laws (sorry, not sure how current it is): [http://www.crimcheck.com/resources/job-reference-shield- laws...](http://www.crimcheck.com/resources/job-reference-shield-laws.htm)

</comment><comment><USER11> Oh wow, these are helpful comments. I now realize the author is advocating actually stalking down someone's personal acquaintances. Yeah, the professional protocol here is contact the provided references only. Going outside that and engaging in web stalking is a huge no no. If I found out someone had done that to me, I would be extremely reticent to accept a subsequent offer, it's a clear privacy violation. I would definitely be wondering what other lines they would feel no hesitation in crossing.

</comment><comment><USER12> Awful. This could destroy a company's hiring pipeline.

The cost of retaliation by a spurned candidate are HUGE. All it takes is a few tweets or blog post about how company X is going to blow your cover during your job hunt, and all the candidates that are currently employed will run to the hills.

Has this guy ever _actually_ done this trick, or did he just have an idea in the shower this morning?

</comment><comment><USER13> I think that one of the key things in the article that people a overlooking is the part about finding someone that you and the candidate know in common. He's not advocating just randomly calling people from the candidates LinkedIn connections, but trying to find someone you both know in common that you could speak to in confidence. My guess is the article got edited down a bit too much and didn't make this key point clear enough.

FWIW to the people who are commenting that they are highly turned off by this tactic... I know Brian Halligan and have worked with him twice (the last time being at HubSpot), he's a very professional and ethical guy overall (IMO) and I don't think he'd recommend doing something that put a candidates current employment in jeopardy. He is also not the only person I know who uses this approach. I've known several people to take this approach, and I've also personally been contacted by people who trust me, in order for those folks to get an unbiased back channel on candidates they were hiring.

<comment><USER14> It still doesn't make any sense. Just because Brian knows some person doesn't mean he necessarily knows potential problems in mentioning the candidates name (unless it's always Brian's BFF -- but I suspect it's really just some person who Brian happened to have some degree of contact with in the past decade).

Why does this need to be blind at all? If there's someone that Brian would like to talk to, just ask the candidate, "I saw from LinkedIn you know Sheila. I'm good friends with Sheila. Would it be OK for me to contact her as a reference, or would that pose any problem for you?"

And I think it's also on Brian's shoulders to make clear why Sheila provides values. "Sheila is someone I've worked with in the past and value her opinion." Brian should also give you the option of giving her heads up, otherwise Sheila may view the cold-call from Brian as you dropping the ball.

All in all, just seems like a bad idea. And frankly, I'd really like to see the data that shows he's gotten better hires from this.

<comment><USER13> The interviewing process would usually flow along a line of screening out candidates that are potential hires and THEN trolling their LinkedIn profiles to see who you both know in common. I think it would be tiresome to do that for EVERY candidate so that you can ask them during the interview "Mind if I contact Foo.".

As long you apply a little discretion about it I don't see what the big deal is. EG: don't contact someone at the candidates current company unless that contact really IS you BFF and you know they can keep the conversation private.

Also, if you do get any odd reviews you'd probably also want to give the candidate room to explain. I wouldn't have a big issue with someone contacting random ex-coworkers of mine as references. There is one person in particular though that probably wouldn't have good things to say, but digging further on that guy you'd realize he's a complete nutjob. So, you'd just want to make sure you properly tempered all the feedback, but in that scenario you _should_ see overall trends and be able to spot outliers.

I guess I'm also not highly opposed to this because I think most current interview tactics suck as screening methods, and everyone hand-picks their references anyway, so you kind of need to go out of band to get a really reliable reference.

I'll also add that I think it depends somewhat on the level of person you're hiring. I don't know if Halligan still personally interviews everyone coming into HubSpot. If he does, I'm pretty sure he is not the one checking references for a level-1 phone jockey. So, we're talking mostly about the higher-order candidates, key individual contributors and managers that he's doing this for. It just doesn't strike me as such a deplorable practice.

<comment><USER15> Unfortunately it's difficult to guarantee discretion - for all you know the person you're contacting is the brother of the candidate's boss's girlfriend, for instance.

Furthermore, in my experience, references like to know in advance that they will be contacted: in my culture, any ethical reference is going to want to know who's asking, why, and whether they have permission to speak on the candidate's behalf.

Finally, there may be personal issues between the person you're contacting and the candidate that would make the reference biased.

Ultimately it seems pretty straightforward and professional to simply ask the candidate outright whether you can contact X, Y and Z as additional references (unless you happen to know these people well enough that discretion is relatively certain). At that point the candidate can say, "sure, but let me speak to them first to see if they're OK with that", or perhaps "No, Bob stole my wife from me and I hate that guy."

</comment></comment></comment></comment><comment><USER16> This is interesting, but I keep seeing articles that reduce down to "kiss up to everyone on LinkedIn or your career will suffer".

It is the Orwellian overtones implicit in these kind of glowing references for LinkedIn that I find disturbing.

Oh yes, that and the fact that everyone who seems to be heavily into LinkedIn is a colossal douchebag.

<comment><USER17> This seems like a good reason to (continue to) avoid LinkedIn.

</comment></comment><comment><USER18> This doesn't seem like a very good way to hire a developer to me. Why not actually ask them direct questions to find out if they can code? Why not look at and talk through some code they have written, or even ask them to write some code there and then discuss it?

Why go through all the levels of indirection of a LinkedIn search and then sift through hearsay? Why assume that the one or two people you talk to actually know what they're talking about? You haven't even vetted the candidate, so you're going to put blind faith in the two strangers you find via LinkedIn? What if they are not very good, or have poor judgement, or what if they hate your candidate because he was really good and they weren't (or for any other irrational reason)?

I'm not trying to be rude, and maybe I'm missing something brilliant here ... but I just don't see any "secret sauce" here.

<comment><USER19> Given he is the CEO, I think he's making many more non-technical hires such as Operations, Sales and Marketing folk. The secret sauce is that he's getting info that the candidate hasn't presented himself or hasn't cherry picked people to provide on his behalf.

Of course, I have a major problem with it because it can "blow up someone's spot" as they say - alerting people you may not want to know you're on the job hunt (current employer/clients).

</comment></comment><comment><USER20> I've worked for the same small cluster of entrepreneurs, who are all very close personal friends, for my entire career. If you cold called people I'm professionally related to, and not on my list of references, then changes are _very_ good that you're calling someone I currently work for or with. And chances are very good that my employer will find out.

Now, I have an excellent relationship with my company's owners and would certainly not get fired for such a thing, but others in my position might. And regardless, that's not information that you have any business giving out to my current employer. That's a discussion that must happen on my terms -- if my boss found out that I was interviewing other companies from your sloppy hiring practices, I would be _pissed_.

edit: Just realized that if you're going from LinkedIn contacts, you might be calling one of my _current clients_. That would be absolutely disastrous for myself and my employer -- yeah, go ahead and throw them under the bus by instilling doubt in our customers, thanks.

</comment><comment><USER21> I'm going with the majority opinion on this.

It's perfectly fine for you to look up my past work relationships for people you know and trust for an objective opinion of my skills - but you damn well better let me know and get my permissions before-hand. I'd like to know whom of my associates you're calling and get their permissions for it beforehand. Skipping this step is just an unbelievable dick move on your part and will make me seriously reconsider working for you.

</comment><comment><USER22> I'd personally be a bit surprised if a friend who I hadn't listed on a job application was randomly contacted by a potential employer.

Has this happened to any of you? It doesn't seem unethical but is definitely a little sneaky.

<comment><USER14> That is completely unethical. So unethical that I'd go out of my way to let people know about this company.

The job search should be at least semi-private. My LinkedIn network are work connections. If I'm leaving my current employer the last thing I want is for someone to contact my manager's best friend or a customer that my current employer is trying to close a deal with ("Oh Ken's leaving? Why? What's wrong with the company? Did he say?").

Especially in the valley, the circles are a lot tighter than you think -- and if you're doing blind calls there's a good chance you just made my prospects at my current job very uncomfortable.

This is a horrible practice and I'd say that I'd recommend to anyone to avoid this place -- unless you're currently unemployed or just don't care.

Also, if someone cold called or emailed me about someone, the first thing I'd do is contact the person in question and let them know someone was snooping about them. I definitely would not answer any questions -- especially if I had a high opinion of the person.

<comment><USER23> Why are you publishing all your professional relationships to the world on LinkedIn and then feeling like your privacy has been violated if someone actually uses that information?

<comment><USER14> I publicly go to lunch with friends too -- so if you follow me to lunch and then ask some of the people I went to lunch with about how I'd be at this new job --you're saying this is acceptable or simply a natural consequence of going out in public with people?

The name of my child is public record too. So it's OK for you to go by his school and ask his teacher how I am as a parent?

There's a lot of public information that exists. Those who have the inability to recognize that there exists a line between simply unethical and illegal are people I'd prefer not to associate with -- much less work for.

<comment><USER23> I agree there's a line. Following me around yeah, that's over the line.

Using information I've published to the world on a website, I think is probably not.

</comment></comment></comment></comment></comment><comment><USER24> What if I don't want word getting around that I'm looking for new work? This seems creepy, especially because I don't really expect that this company would disclose the fact that they are running unsolicited background checks to me.

</comment><comment><USER25> I once reached out to someone I knew personally who wasn't as a reference, who then told me that it was his understanding that contacting people for references without the permission of your candidate is illegal. (I'm based in Vancouver, BC, Canada) Can anyone with more knowledge comment further?

<comment><USER26> It almost certainly is illegal in Europe under a variety of different laws ranging from data protection to breach of confidence.

The important takeaway here is that if you're going to do it you should clear it with the candidate first.

</comment></comment><comment><USER23> Best hires: people referred by current (good) employees.

Next best: people with good references.

If you have either of the above, you'd have to really blow the interview. I've never done "blind" reference checks; it's surprising how many employers don't check references at all and base everything on the interview and maybe a few "gotcha" puzzles or coding tests.

</comment><comment><USER27> I think people should be aware that this goes on, in the form of hiring managers saying "this candidate worked at X, my buddy/coworker/neighbor worked at X, I wonder what their opinion of this candidate is".

I would hope that people who do this only call people they know well and trust to keep the discussion confidential (or at worst, tell the candidate "hey, your prospective employer asked what I thought of you, they must be getting serious about hiring you").

On the other hand, I agree that doing this kind of reference-seeking with total strangers is really creepy, and stupid. If someone I didn't know called me out of the blue this way, I'd definitely tell my friend "your prospective employer called me, did you give my name as a reference?".

Still, the first kind of reference-checking is a good reason to do your best to leave every job on good terms (not just with your boss, but with coworkers as well), if at all possible. You never know who might talk to whom down the road.

</comment><comment><USER28> I think if the company gives some notice that they're going to do this it might be tolerable but in general it would seem like a huge disincentive to work there. If the employer can't be straightforward with you at the very beginning of your relationship, it's hard to imagine the situation improving with time.

</comment><comment><USER29> Please correct me if I am wrong, but I believe responding to a guy like this might put your company in legal jeopardy in relation to the former employee.

We have been explicitly told in the past that we cannot discuss former employees' performance with interviewers who call for a reference. We can only state that they were employed with us, and what specific job functions they performed.

</comment><comment><USER30> Here's the next step in this arms race: cold-call people who know the candidate and then lie about why you're asking. Then you don't necessarily get "caught", and you don't say where you're calling from.

Lies that will potentially work here: "I'm doing a background check for a security clearance". "I'm a private investigator checking out (some other person or company)." "(Person) was supplied as a reference and I'm checking their quality to see how seriously I should take it."

It may be a tough time to be a (real, actual) security clearance background checker in a few years.

<comment><USER31> I've received a few calls asking for information to be confirmed during a security clearance background check and each time I knew before hand that I might receive the call. I would be highly suspicious of any call claiming to be on that subject without the person in question notifying me before.

edit - I should also note that I don't give out information about anyone I know without their prior consent so this wouldn't work anyway. I would also notify the person about the snooping.

</comment></comment><comment><USER32> The opposite is also quite true: Best way to Vet a company. Find someone who used to work there...

I always get sort of angry about the whole reference thing. It seems that employers are entitled to reference checks but candidates somehow are not allowed to reference check a company?

How many times have you heard the story of someone who got hired into a role to find out on their first day that they are the 4th or so person in that role in 5 months... It's OK for companies to lie, or not fully disclose the truth, but oh boy, if a candidate's reference doesn't check out...

</comment><comment><USER33> Hi folks. Sorry I haven't had a chance to respond. I've got some family in town for the holidays and have been tied up.

I stick to the advice in the article. The one thing I didn't mention was that I only do these references if the potential employee is cool with it. I ask the potential employee if I may check blind references and 95% of the time, they are cool with it...this happens toward the end of the process. Sometimes when that employee is not leaving their current employer, they ask me to only reach out to folks from their previous employers which is totally cool w/ me.

Once I get the green light, I go through my LinkedIn and find folks who I know who have worked with the candidate -- Boston's a small town and I don't have to look too far. I reach out and ask them about them. I must say, I do ask some pretty "open" questions and leave the door wide open for someone to say something negative about the person because I don't feel like a get a full picture about the weaknesses from the "given" references.

I totally agree with those who say it is not cool to do this without the employees consent.

I'll give you a case where this worked. Last month, we went through the interview process with someone from Microsoft. The person did well on the interviews (I've noticed that humans are getting better and better at interviews over time) and it was time to do the blind refs. The candidate was fine with us doing them. In this case, they were already out of Microsoft. I happen to know a bunch of folks at Microsoft. I talked to them and they all said the same basic things and were all pretty negative. We ended up passing. Personally, I think we dodged a bullet there.

This method is one I learned from vc's. In our venture rounds, I give them 5-6 references to call for me. They usually call them, but spend the majority of their time calling mutual connections that I didn't provide. Imho, this is smart! ...There was one venture capitalist who I thought went a bit too far. They called everyone they could find that had worked at HubSpot at one time, but no longer did. That's not a long list, so all of those folks were calling me asking, "Are you getting funded by ____."

</comment><comment><USER34> What worries me is that people will see this on the front page, and as many never read the comments here, will think that this is community supported advice.

Luckily the facebook comments on the article are going a similar way as those here, but I wonder is they carry as much weight as the community feeling in this thread?

</comment><comment><USER35> This is the method the government uses when investigating jobs requiring a security clearance.

FYI.

<comment><USER36> It's more reasonable when the security of the nation is at stake, rather than a successful hire at a small company.

Safety of 300 million Americans > Hiring the right person for a company no one's heard of.

</comment></comment><comment><USER37> Great way to staff a project within a firm, but violates the confidence of a job search. The only thing I think that might be ok is asking people within your own firm who know them.

</comment><comment><USER38> I would like to add my voice to those who have noted that this is in fact poor advice with potential legal consequences. This should not be on the front page.

</comment><comment><USER39> LinkedIn is not a replacement for common sense.

</comment><comment><USER40> One way to thwart this: make your LinkedIn connections visible to you alone. <http://min.us/mlinkedinconnections> (shared connections are not hidden).

<comment><USER41> Wouldn't that only thwart people that don't collect tons of connections? I wonder how many connections a hiring manager would need in order to have a decent chance of having at least one shared connection with a given candidate.

</comment></comment><comment><USER42> See also: how to make sure that someone who had a horrible work environment never, ever, finds a better one.

</comment><comment><USER43> I am shocked that this isn't standard practice.

Last time I got a job offer, the first thing I did was call up two people who'd sold their companies to that employer, one guy who worked there, one guy who'd quit, and one who'd been offered another job and turned it down. Next time I'll try the "scale of ten" trick, too.

All management positions are to some extent sales positions, and part of a good sales technique is to shape the truth so the good parts are obvious and the bad parts aren't. The more someone's naturally talented at this, the easier it is for them to fudge the truth.

This is much easier to accept if you consider it in the other direction. Would you really think it unethical to do this kind of due diligence on a prospective employer? Would your boss find it creepy? I was open about it.

<comment><USER14> Your prospective employer doesn't have a job they can lose.

It's simply not a symmetric relationshop.

<comment><USER44> I agree with kenjackson. Me checking on an employer is worlds away from an employer coldcalling my contacts without informing me. A company isn't a person so I can check on the company. A company checking on the applicant without notifying them is a dealbreaker.</comment></comment></comment>


Chinese actress disappears after getting 0% goodness rating - <AUTHOR> https://www.bbc.co.uk/news/world-asia-china-45426882 <comment><AUTHOR> Ok, this is some seriously dystopian stuff. One can hope this is being blown out of proportion by the BBC, but its hard not to see this as a solid reason to think long and hard about technological choices that facilitate real time evaluation of peoples societal "value."

<comment><USER2> Sure glad that facebook and other tech giants are working on similar society rating systems /s</comment></comment>


Facebook staffer sends 'blood on my hands' memo - <AUTHOR> https://www.bbc.com/news/technology-54161344 <comment><USER3> There was a previous discussion of this yesterday based on a Buzzfeed News article about the same memo: [https://news.ycombinator.com/item?id=24474343](https://news.ycombinator.com/item?id=24474343)

<comment><USER4> But the title with the word "blood" is more attractive.

</comment></comment><comment><USER5> when I went to university in 1999 it was my dream to work at a company like microsoft, then google. then i realized that big tech is just a way for those in control of society to control us more efficiently. i feel for those who just want to put their head down and do the work. nobody thought they were going to CS school to enable the exploitation of less lucky others. but now we have facebook, amazon, palantir, google, microsoft et al doing whatever their doing, not with the benefit of society but for the benefit of society's owners. as a tech person, that makes me extremely uncomfortable, and someone who hasn't figured out even a personal route around the problem, much less a societal one. god bless us all.

<comment><USER6> Isn't this looking at the past with rose colored glasses though?

Time before using computers for business was terrible with much less transparency (no Googling prices, etc). Paperwork got lost all of the time. Companies could easily bury things, etc.

<comment><USER7> Agreed, imo transparency, accountability, and general corporate "goodness" are probably at all-time highs. The thing is the public's level of awareness of the remaining shadiness is also at an all-time high, so it can feel like things have gotten worse because we see more of it, even if the amount of things that go unnoticed has gone down.

</comment></comment></comment><comment><USER8> Here's the original article, with more direct quotes from the memo: [https://www.buzzfeednews.com/article/craigsilverman/facebook...](https://www.buzzfeednews.com/article/craigsilverman/facebook- ignore-political-manipulation-whistleblower-memo)

According to it, the full version isn't going to be released because it contains privately identifiable information.

<comment><USER9> I'm honestly confused. Doesn't the Buzzfeed article publish her full name and excerpts from her LinkedIn profile? Protecting the author's private info is a hard reason to swallow when they literally reveal the author's full name and LinkedIn profile.

<comment><USER8> The way I interpreted it is that she referenced private info on other people (or internal teams) in there.

</comment></comment></comment><comment><USER10> I've been involved in politics and software a long time. I was an elected Hillary Clinton DNC Delegate in 2008. I'm a senior software engineer today. And I'm not sure Democracy will survive contact with social media. I have a solution.

1\. Ancient History - Historically politics was a hobby of the elite. You had to go out of your way, sometimes into the cold to attend party meetings. The discussions were academic and professional. People who were involved in politics had their lives very much together, on both sides of the isle.

2\. Social Media was invented. I had the opportunity to work with a very fantastic and kind person. My role in the organization was software engineer. This person's role was warehouse operations. Because of Social media this person, who would otherwise never be politically engaged, rocks social media all day long. With the advent of Facebook on mobile, this person tweets political memes all day long. This person spends Xor time on reddit, and "chan" sites. This person now represents the main stream. This person is awesome, but shouldn't be shaping policy.

3\. Solutions. I have a number of ideas. I think we should move away from ideas such as ballot initiatives and direct democracy and embrace the fact we are a Republic. We need professionals to determine policy not the twitter mob. Another solution I would seriously implement is a rule. No politics on social media. If its political, flag it, delete it. This would take care of twitters toxicity problem, and facebooks foreign interference problems.

I'm spitballing ideas here, but I am not sure Democracy can survive first contact with social media. It's a mess. people are angry. If you work at one of these big tech companies, I'd love to know your take!

<comment><USER11> > Solutions. I have a number of ideas. I think we should move away from ideas > such as ballot initiatives and direct democracy and embrace the fact we are > a Republic. We need professionals to determine policy not the twitter mob.

Congress people and senators are professional policy makers. The problem is that if they acted solely in the best interest of the nation then they wouldn't get reelected. So what, is not having elections a better solution? Should there be no parties so that actual conversations happen and require a consensus? Should terms be limited? No clue. I'm not sure we as a society can fix ourselves without a major kick in the butt.

</comment></comment><comment><USER12> I find it repulsive that no one is discussing that the original author was doxed by a news organization and this was done after a "whistle-blower" leaked their memo to the news org. One person discussing something internally with their peers, and maybe trying to make things better, has their life ruined now because everyone on the internet knows their name.

<comment><USER13> It is Buzzfeed after all. The lowest of the low.

</comment></comment><comment><USER14> Facebook uses the term "inauthentic" while the memo's author and the BBC use the term "fake".

[https://news.ycombinator.com/item?id=24477933](https://news.ycombinator.com/item?id=24477933)

</comment><comment><USER15> What would happen to Facebook if we do ban advertising from the internet?

<comment><USER16> Advertising itself is not inheritly bad: healthy socium needs product and price discovery.

Even targeted advertising, if done right is very good for both buyer and seller.

Bad part is data collection and predatory targeting, like for (rather mild) example "easy money passive FBA business" targeting aspiring enterpreners.

</comment></comment><comment><USER13> Why do all these types of leaks end up at Buzzfeed?

</comment><comment><USER17> I've taken a hard line with people who work at Facebook. If you're still there and unwilling to represent the failings your company has done to society, then I need to hear a justification before moving further in the conversation. I don't think I've ever felt this strongly about a tech company.

I know that's tough but it's a matter of ethics. And frankly, Facebook is an amazing technical institution, and I would love to work with the majority of them based on technical chops alone.

I've put my money where my mouth is on this sort of thing in the past - <USER2> passed on an Uber employee who worked on the "god mode" feature and had no opinions on it making the news or its being abused other than "I was just building the feature". It made the news for abusiveness, at least have a little remorse!

So Facebook employees, please understand, if I ever meet you in a technical interview, there will be a five minute section for a hard "liberal arts" question politely lobbed your way :)

<comment><USER18> > I don't think I've ever felt this strongly

I'm sure that your employer loves your personal feelings interfering with hiring talent.

<comment><USER19> Exactly why we have interview problems in engineering. I respect engineers for having opinions and ethics and they should lean on them, but to bar one from employment because they were doing their job is wrong, immoral, and potentially illegal.

<comment><USER20> What if the job they were "just" doing exists in a legal grey area? Or, more realistically, is flatout illegal?

<comment><USER13> You wouldn't hire a former prostitute who put themselves through education to better themselves and get a mainstream job?

<comment><USER20> Is the prostitution on their resume?</comment></comment></comment></comment></comment></comment>


Coronavirus: NHS unveils 'data platform' to track beds, staff and ventilators - <AUTHOR> https://news.sky.com/story/coronavirus-nhs-unveils-data-platform-to-track-beds-staff-and-ventilators-11964216 <comment><USER2> You'd have thought they already had something that does this?

<comment><USER3> I worked for a startup that tracked hospital equipment (with active RFID tags), and it was shocking how disorganized hospitals can be. It's not usually a single person or department's fault though - there are a bunch of factors:

\- equipment is often managed by a small team who doesn't have the resources to really track down everything

\- equipment gets distributed to different departments who then might move it, store it, swap it, it breaks down and they don't tell anyone, etc

\- theft can be a big issue: equipment is often very expensive and not very large, which means it has the ability to "walk off"

\- different departments (or individuals) might hoard equipment because it can be difficult to get what you need exactly when you need it

\- data about what you have can be split across 15 different systems that don't have the ability to talk or reconcile

\- "full" real time tracking (like what we made) can be very expensive

So yes - there are systems that can help, but they're expensive and often not a first priority (even though they can help tremendously, especially when it comes time to do maintenance and reordering, etc.)

<comment><USER4> And now they don't swap the gear because of this magical software from Palentier? Equipment does now not walk away?

<comment><USER3> Well - that software will hopefully solve the problem of data being spread across 15 different systems (although to some extent, now you've just added another system in the mix :) )

To start solving the problem of equipment being swapped or walking off, that's when you need to look at an active RFID or other real time tracking solution.

</comment></comment></comment></comment><comment><USER5> I don't really see a problem with this, Palantir make a datastore and set of tools that are really good for geographic and operational datasets.

Doesn't really have much to do with the tools application in the US, and really, isnt it for the US to decide if what its government is doing is acceptable/ethical?

Otherwise, the tool is just a tool, not inherantly evil.

<comment><USER6> There's not necessarily a problem, but there are questions which Palantir and other providers could and should address using their contracts, source code and training/support availability.

If I offer you an axe, we can consider that a tool, and you can do good or evil with it. If I offer you a _software-enabled_ axe and I'm able to turn that tool on/off at will, apply and/or withhold fixes and modifications, then who really holds the tool?</comment></comment>


Jonathan Blow – Preventing the Collapse of Civilization [video] - <AUTHOR> https://www.youtube.com/watch?v=pW-SOdj4Kkk&feature=youtu.be&t=1614 <comment><USER2> For those who aren't sure they want to go through the video: behind the somewhat arrogant title, you'll find a compelling talk about why software engineering has declined and how it's affecting society.

</comment><comment><USER3> previous large discussion: [https://news.ycombinator.com/item?id=19945452](https://news.ycombinator.com/item?id=19945452)</comment>


Mastering Git branches - <AUTHOR> https://medium.com/p/f20cb2d0c51f/referrers <comment><USER2> HTTP error code 403 -- access forbidden.

Article was pulled? Not fully published yet?</comment>


Kryder's Law Outpaces Moore's Law (2005) - <AUTHOR> http://www.scientificamerican.com/article/kryders-law/ <comment><USER2> I guess this is notable because Kryder's Law ended in 2011: [http://www.theregister.co.uk/2014/11/10/kryders_law_of_ever_...](http://www.theregister.co.uk/2014/11/10/kryders_law_of_ever_cheaper_storage_disproven/)

<comment> daniel-cussen Thank God for it. It means agencies can't just store every last piece of data that they ever capture, but have to choose, think, and forget.

</comment></comment><comment><USER3> Can we please stop talking about these "laws" that are based on absolutely nothing but observing an apparent trend that may not continue past tomorrow? Seriously, spoken to too many undergrads who think there's some sort of physical process or causal relationship driving Moore's law. It's bullshit. It's just people saying "growth has been this fast, and I don't know why, but I sure hope that growth continues to be this fast!"

</comment><comment><USER4> How wrong they were... Turns out storing tons of data is useless if it takes forever to seek drive heads to read it.</comment>


Ask HN: Use Google App Engine? Share your stats - <AUTHOR>

I don't use it yet so I can't share mine, but if you do I'd like to know the size of the apps people are running there, and what I can expect of the platform. Other threads talk about the good/bad/ugly, I just want to know the numbers.<p>Users, traffic, availabilty, ... <comment><USER2> I really want to hear the Simplenote/Simperium group talk (YC S10) about their experience: <http://simplenoteapp.com/about/> I love their app and I'm really curious to how their experience with App Engine has been.

___

As far as my personal experience goes, I just learned Python/AppEngine a couple weeks ago, and within a day or two I wrote a "random button" for a blog I like:

<http://www.iwrotethisforyou.me/> (If you look at the URL of the "random post" link on the right, it goes to my appengine app)

From what I've read, there really is a certain "style" of app that fits well with GAE, namely one that fits within their requirements. Simplenote may just be the prime example of that. Also it has close integration with Google services (Blogger, Picasa, etc) which is what allowed me to so easily pull data from that blog with my app.

I personally see it as a great choice for Android (and possibly iPhone) Developers looking to serve a lightweight and easily scalable backend to support their mobile devices. I say Android because each Android device required a Google login, which will authenticate easily with App Engine. This is what I'm planning to do as a next step for my Android App.

<comment><USER3> We like it overall, but (like everyone else) we're anxious for it to keep maturing. Some of my co-founder's thoughts (with a bit of PR spin):

[http://adtmag.com/blogs/watersworks/2010/10/mobile-app- creat...](http://adtmag.com/blogs/watersworks/2010/10/mobile-app-creators- talk-google-app-engine.aspx)</comment></comment>


BTC bottom callers contest - <AUTHOR> https://medium.com/@492727ZED/calling-the-bottom-ec21c4442a8f <comment><USER2> $700 or so which is double the 2015 average price and accounts for the Halvening</comment>


Jony Ive's custom-designed Leica camera took 9 months and 55 engineers to build - <AUTHOR> http://www.theverge.com/2013/10/10/4824290/jony-ive-leica-camera-took-nine-months-55-engineers-to-build <comment><USER2> I wonder why they don't sell it for cost +x% and give x to charity. Wouldn't that give more to charity with even a fairly small run?</comment>


Class Breaks - <AUTHOR> https://www.schneier.com/blog/archives/2017/01/class_breaks.html <comment><USER3> This is exactly why I hate electronic voting. When I argue about it, people always tell me that it's easier to commit vote fraud with paper ballots.

Sure, it's easier for a single person to temper with a single paper ballot or even poll box, but it is much harder on a large scale. Tampering with every physical boxes and tallies in a country requires much more effort and organisation than exploiting a single vulnerability that applies to an endless series of identical machines.

<comment><USER4> The biggest actual risk to voting remains the party in power. Why go through the effort of fraud, when you can just throw out the results?

Similarly, propaganda is also more effective.

<comment><USER5> Why hide that you're changing the election result? Well, I can imagine cases where it's not worth the bother, but they hardly seem like the default.

<comment><USER4> My point is look at pretty much every election where democracy actually left. Not exactly subtle fraud going on.

(Though, I will confess I have not tabulated this, so would be very curious in full numbers.)

<comment><USER6> This is a tautology. You're saying that in every election where fraud was obvious ("democracy actually left"), fraud was obvious.

There is probably a lot more subtle election fraud that is never detected.

<comment><USER4> Hmm... I'm trying to say in every election that was manipulated, it was not subtle fraud that was the problem. I have little doubt that some fraud happens. I just don't think it typically matters. In most cases where it was not detected, it had no bearing on the outcome.

Now, overt manipulation of the voting populace through propaganda or other means is very common and has definitely happened. Ballet fraud, though? Are there any documented cases of that being a thing that mattered?

</comment></comment></comment></comment></comment></comment><comment><USER7> I can't help but think this sort of issue far outweighs whatever concern we may have when it comes to any sort of bad AI actor. Every time I read about the OTA updates on Tesla cars my spine tingles a bit about the possibility (which I can only conceive is greater than 0) of some bad actor sending out code which turns those cars into ungoverned highway missiles.

If there's one lesson that we can take from all the data breaches from top companies and high-profile government officials is that we are terrible at securing software. The 21st century Ted Kaczyinski isn't going to need the post office; he's got a MBP and SSH.

<comment><USER8> > of some bad actor sending out code which turns those cars into ungoverned > highway missiles

Yes but think of the probabilities that have to happen are:

a) Knowledgeable person

b) Motivated person

c) Evil or mentally unstable person

d) Determination and ability to overcome adversity.

And the person or person who has to decide that Tesla is what they want to exploit instead of another car manufacturer or another object and so on.

Compare this with someone who simply wants to take their car and drive it into a crowd.

<comment><USER9> > Compare this with someone who simply wants to take their car and drive it > into a crowd.

You have to multiply the probability by the harm. Yes, most people will just drive their car into a crowd, killing - let's say - 10 people.

But the man who perseveres and drives EVERY controllable car into a crowd can kill thousands, if not millions.

<comment><USER8> Yes but it's infinitely easier (which is my point) for multiple people to drive a car into a crowd killing 10 people at different times. The bar to be able to deploy on a large scale (by a single actor, not North Korea) is much higher and the group of people that could potentially pull it off is infinitely smaller for at least the reasons that I mentioned.

Anyone of us could drive into a crowd and kill 10 or many more people. Yet it happens extremely infrequently, compared to at least how many times it could happen.

</comment></comment></comment></comment><comment><USER10> Very interesting read. My personal highlight is (about the _type_ of security we are moving into):

> It's a world where driverless cars are much safer than people-driven cars, > until suddenly they're not.

<comment><USER11> It also means any political figure who "dies in a self driving car accident" will instantly become part of a conspiracy theory.

<comment><USER12> The case of Michael Hastings comes to mind.

[http://nymag.com/news/features/michael- hastings-2013-11/](http://nymag.com/news/features/michael-hastings-2013-11/)

</comment></comment></comment><comment><USER13> If we take a cue from nature, it means diversified genetics. This means different IoT manufacturers becoming as snowflaked as possible to avoid diseases that affects other systems. When one system gets too large it only takes a single virus to bring it down.

But this runs counter to the "don't roll your own crypto" philosophy. Crypto in this context can be any sort of important aspect of your device that you want to secure from hackers.

Right now it's a bad idea to do things on your own, but as systems get even larger and interconnected it may be your only defense.

<comment><USER14> I think you're missing the fact that a line of devices from a manufacturer is still a "class." If you have thousands or millions of devices out there with un-tested, DIY crypto, then that's still thousands or millions of devices rendered malicious when a vulnerability is found & exploited. At least vulnerabilities like Heartbleed were quickly patched and widely-publicized. IoT vendors have been historically horrible when it comes to providing updates.

</comment></comment><comment><USER15> This seems related to the concept of Software Monoculture that Bruce wrote about here: [https://www.schneier.com/blog/archives/2010/12/software_mono...](https://www.schneier.com/blog/archives/2010/12/software_monocu.html)

It's a clear case for technological diversity. The hard problem is that economies of scale work against technological diversity. It's similar to what happens with monoculture in biology.

<comment><USER16> It's a catch 22 because diversity reduces the potential for class breaks but also increases the probability that any given system is insecure in the first place. (Less resources can be devoted to securing each unique system.)

<comment><USER15> I don't think that necessarily follows. People deciding to make a new system with different security would factor that into the cost of the system. It's just as likely to result in fewer systems due to increased cost.

<comment><USER16> That's basically my point. The level of tech diversity is set by some kind of equilibrium between the cost of writing new code and the value of doing so.

</comment></comment></comment></comment><comment> rm_-rf_slash I'm surprised this isn't getting much attention here.

There really isn't a technological solution for class breaks. Go big and you replace one kind of class break with another (a top-tier security system for hotel card readers just focuses the attacks on that system). Go small and it isn't cost effective or plausible at scale (everybody install gentoo! Compile your own kernels!).

Honestly, I'm stumped. We rely on these systems more and more to squeeze out every bit of productivity we can get, but that only leaves us at the mercy of our systems.

Is it even possible to fix this kind of situation before it really turns on us, or are we doomed to suffer a cataclysm we cannot yet imagine?

<comment><USER17> The cure is worse than the disease. But it's coming. It will come as a devastating one-two punch: the end of general purpose computing devices and the rise of a publicly-identified Internet.

The former will be phased in as countries legislate it. Legislators won't be concerned with the slippery slope between abacus and iphone, the courts will likely draw a distinction somewhere around anything north of "silicon-based electronics with the right resources for an IP stack". A few countries will be bastions of Free Computing, but many/most will draw up similar laws.

The latter will be held back by Metcalfe's Law until some near-global momentum can be built. It would likely take a simultaneous attack on many global corporations/political parties/beloved individuals, but it seems like that's just a matter of time. Faced with repeated attacks, the public won't accept "but we designed it that way intentionally" as valid.

<comment><USER11> Abandoning general purpose computing is too crazy, as it amounts to throwing away software. The anonymous internet is a dead-man walking, but silicon valley is as complicit in this as the government will be.

However, software engineering will change into a much more regulated environment. Writing software for the web will eventually become like writing software for the space shuttle: slow, rigorous and very expensive.

It will also kill the hacker culture, as hacking together a piece of software will become like hacking together a bridge: illegal.

<comment> rm_-rf_slash IANAL but I assume that if I purchased a tract of land and built a bridge on it, I could create it as I please, given that I would be liable for damages should the bridge break and harm somebody on my property, not unlike a slip- and-fall.

I for one would prefer most vital software to be developed slowly and methodically. We insist on strict standards for our bridges and roads - <USER2> don't we do the same for our information infrastructure?

Move fast and break things can break people too.

<comment><USER11> I would prefer software infrastructure be developed rigorously as well, as I think would most people. But that will lead to regulations or at best, expensive insurance company mandated standards.

But before we celebrate its demise: the side effect will also be the same ones seen in the civil engineering world: creative ideas take decades to come into existence. As you mentioned in your other comment, there was a time when railroad building was exciting, and in that time, people died doing exciting engineering. Civil engineering tools are now orders of magnitude better than they were years ago, but there hasn't been an explosion in creative structures, even at the lowest level. I also think many of the perks (ie: salary) of the software engineering industry are intimately related to the 'move fast and break things' culture. When that leaves the industry, it may be less of a good riddance than you think.

This may be my perspective as an outsider though, I don't work in software. But I have considered making the jump to software engineering, because 'moving fast and break things' sounds fun.

Fundamentally we agree, but I'm a pessimist.

<comment> rm_-rf_slash Also agreed, but I don't think the "boringification" of civil engineering is all that bad either. I met a civil engineer recently. He is a mundane but serious professional. He has no patience for the shiny objects that the real estate developers try to distract other people with. Codes are upheld and enforced.

It's easy to grumble about regulations until their reasons are forgotten. Then they get repealed and the problems come back. The mortgage crisis is a prime example.

I don't think this is such a bad future for software either. Much of my job writing software for higher education involves adhering to complex policies. These policies are necessary to remain FERPA/HIPAA compliant, which are necessary for their own reasons. Playing fast and loose is taking out a debt for an uncertain future.

<comment><USER18> The "boringification" of computers will bring us back to the 70s.

If we have to prove _everything_ on your computer, from your calculator or Pokemon, how much do you think a license of windows will cost? $250,000?

Linux/FreeBSD/OpenBSD/Minix will be dead (no one to sponsor certification and then put it in the public).

Crazy "best-practices" (change passwords every couple days, password must include symbols, letters, numbers, upper-case and lower-case in a random order, but be no shorter or longer than eight characters)

Must have a full team of lawyers to prove that everything done fit the letter of the law, and that any hacks are not your responsibility

"Shinyness" is what allows you to have free VSCode and Atom.

Sure, I miss the 70s when you could get a text editor measured in bytes (but, btw, electron is probably more secure than 70s unix) but I definitely like the cost/convenience of modern software.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> A better analogy would be crops and the dangers of a mono culture. A class break is akin to a disease that an entire crop is susceptible to. See, e.g., the bole weavil. Or the reason the current popular banana is at risk.

</comment><comment><USER19> For what it's worth, the more idiomatic term in computer security is "bug class". I know "class break" is potentially the better, more general term, but nobody I talk to ever really uses it.

<comment><USER20> In the insurance industry it is called Category Risk. As in if you insure houses instead o cars you get lots of exposure with a hurricane.

</comment></comment><comment><USER21> Very similar argument to lovely CPG Grey video: [https://www.youtube.com/watch?v=VPBH1eW28mo](https://www.youtube.com/watch?v=VPBH1eW28mo)</comment>