Exploring Previously Unknown Remote Kernel Bugs Affecting Android Phones - <AUTHOR> https://pleasestopnamingvulnerabilities.com/ <comment><USER2> > In late 2016 and early 2017 I became burned-out from hunting bugs as it > became a race between some very talented researchers and I. For example > Derrek and I spent 2 months auditing and coding up PoCs for some bugs in a > wifi driver where nearly 95% of our reports were duplicates with the Chinese > teams. It was becoming hard to compete with teams who do this 40 hours a > week while I do it as a hobby over coffee on Saturday mornings.

This isn't really the main focus of the article, but I find this really interesting. There are teams of full-time Chinese researchers looking for and reporting vulnerabilities in Android? Are they doing this to win the bug bounties? If so, it sounds like Google's bug bounty program is really paying off.

<comment><USER3> I hope it's Google's bug bounty program that's paying off.

<comment><USER2> If they were black-hat researchers, they wouldn't have reported the vulnerabilities to Google, and thus the researcher's reports wouldn't be considered duplicates.

My guess is they're either working for the bug bounties, or they're employed by a company that uses Android extensively and wants to make sure its secure.

<comment><USER4> Exploring the acknowledgements [0] shows many of these Chinese researchers are working for the big internet firms there (Alibaba, Tencent, Baidu), so my guess is they are more motivated in securing Android for internal use than collecting bounties (its entirely possible they run their own AOSP-based Android builds for employee-provided hardware).

Being China, its also possible that the Chinese government indirectly or directly sponsors this research, since Android is by far the most common smartphone OS there.

edit: C0RE Team [1], who also has many contributions seems to be an independent research company, who may be doing it just for the bounties.

[0] [https://source.android.com/security/overview/acknowledgement...](https://source.android.com/security/overview/acknowledgements)

[1] [http://c0reteam.org/about.html](http://c0reteam.org/about.html)

<comment><USER5> An interesting exercise would be to compile notification dates with code commit dates, and then compare the average difference (notification date - commit date) among groups.

If there's a discrepancy, then that's possible evidence one group might be hoarding bugs, or at least waiting for notification approval from, e.g., a domestic intelligence agency.

<comment><USER6> _cue commit scrubbers_

</comment></comment></comment></comment></comment></comment><comment><USER7> What is a vuln name, other than a binding of a CVE to a real word to make it easier to reference or promote.

It draws public attention to an issue better than any CVE-2017-XXXXX would do.

No, keep it up. Dictionary words are far easier to remember than specific numbers.

<comment><USER8> I think it's better over the long run to keep the CVE as the "canonical" name and just treat the others like nicknames. Instead we have branding, logos, domain names etc. Some argue that it's easier to get attention or shame a vendor by going all-out, but it seems like overkill for a simple mnemonic.

<comment><USER9> I think a lot of it is that there are folks who want to contribute to security awareness, and their skills lie with design/branding rather than with low level security concepts.

I can't speak for what the value-add is there, but I don't see any harm from it.

</comment></comment></comment><comment><USER10> Well done to the author. I always found working on more obscure systems to be a lot more entertaining as a hobby and I'd definitely recommend it -- you'll almost never run into the issue of another researcher coming out with something first. Most security researchers seem to shy away from embedded VR due to an unjustified fear of obscure assembly languages and hardware (or perhaps they just realize there's no money in it...), but isn't nearly as hard as anyone thinks.

I expect to see drastically more work into IoT devices once tooling and knowledge sharing gets better. A lot of the articles right now begin and end with binwalk. Great tool but that's just the start.

The only hard part of embedded work is that it's really, really difficult to collaborate with anyone as VR is always filled with incredible drama and the talent pool of individuals willing to work on this (for free) with the prerequisite knowledge is almost non-existent.

Good luck. And thanks for not coming out with another media campaign first and interesting research second.

</comment><comment><USER11> The PLEASESTOPNAMINGVULNERABILITIES vulnerabilities are surely of a different type than the KRACK attack.

</comment><comment><USER12> fascinating write up. Is it normal for wifi-drivers to have such an enormous code base? like, nearly 700k loc? And how much of it is generated code? I'd love any links to stuff on this if anyone has them and time to post, thanks.

<comment> w-ll Generated code can really build up quick. And that's not taking into account the transformations from higher level languages down to op codes. I use a lot of code gen and some projects I manage ~50k loc which can balloon to 10x that.

The exploits i'd bet are still in the human written weird stuff and not unfolded loops and boring setters/getters.

</comment></comment><comment><USER13> Aw I can't take the quiz?

[https://pleasestopnamingvulnerabilities.com/integers.html](https://pleasestopnamingvulnerabilities.com/integers.html)</comment>


Russian Elite Given Experimental Covid-19 Vaccine Since April - <AUTHOR> https://www.msn.com/en-us/news/world/russian-elite-given-experimental-covid-19-vaccine-since-april/ar-BB16WxKx <comment><AUTHOR> Smart man, IMO:

 _One tycoon said he decided against participating after his doctor told him it would take at least a year to assess the new vaccine's risks._</comment>


Ask HN/PG: Is there an API for hackernews? - <AUTHOR>

If so, where can I find it? If not, how did everyone who got data about HN (such as in posts about the best time to post etc.) get their data? Did you just crawl HN? <comment><USER2> There's an API from the search engine provider, Algolia:

[https://hn.algolia.com/api](https://hn.algolia.com/api)

</comment><comment><USER3> The 2010 era blog posts on best time to post used scraping, but the Algolia API just released is robust enough for HN data analysis. (proof: [http://minimaxir.com/2014/02/hacking-hacker- news/](http://minimaxir.com/2014/02/hacking-hacker-news/) )

[https://hn.algolia.com/api](https://hn.algolia.com/api)

</comment><comment><USER4> To download all stories:

[https://github.com/minimaxir/hacker-news-download-all- storie...](https://github.com/minimaxir/hacker-news-download-all-stories)

To download all comments:

[https://github.com/jaredsohn/hacker-news-download-all- commen...](https://github.com/jaredsohn/hacker-news-download-all-comments)

To download saved stories (not available via API; haven't personally tried it though):

[https://github.com/dougk7/hackernews- stories](https://github.com/dougk7/hackernews-stories)

</comment><comment><USER5> Yeah, HTML scraping with PHP's DOM functions... I'm cleaning it up atm and will release it on github wehen done.

HN is, from a technological POV, stuck in the Middle Ages when compared to the startups that YCombinator backs.

<comment><USER3> The Algolia API is far superior than any scraping API (incidentally, it's also a YC startup)

</comment></comment><comment><USER6> try [http://hnapp.com/](http://hnapp.com/) .. get the json response</comment>


Uber C.E.O. To Leave Trump Advisory Council After Criticism - <AUTHOR> https://www.nytimes.com/2017/02/02/technology/uber-ceo-travis-kalanick-trump-advisory-council.html?_r=0 <comment><USER2> I'm all for working inside the system for change but sometimes refusing to contribute and walking away is the best way get across the advice that is desperately needed. This ban is poisonous for the future of the American software industry.

</comment><comment><USER3> duplicate:

[https://news.ycombinator.com/item?id=13554947](https://news.ycombinator.com/item?id=13554947)</comment>


Circus Charlie remake in HTML5 with phaser.io 2.0 - <AUTHOR> http://eugenioclrc.github.io/circushtml5/

<comment><USER2> Excelent remake. The rings appear different from the game isn't it?

</comment><comment><USER3> great but i ended up sliding underneath the fire rings and the game never ended.

<comment><AUTHOR> Yeha, its on development, but i was very anxius and need to publish it!, thanks for the feedback!</comment></comment>


Status update from the Reproducible Builds project - <AUTHOR> https://lists.debian.org/debian-devel-announce/2017/07/msg00004.html <comment><USER2> So happy someone are spending time on this issue, it's like a breath of fresh air and intelligence in the midst of all the usual software (security/privacy/etc. take your pick) mayhem. It's worth reading [https://reproducible-builds.org/](https://reproducible-builds.org/) for a brief (re-)reminder on why this project is important.

Outtake: "With reproducible builds, multiple parties can redo this process independently and ensure they all get exactly the same result. We can thus gain confidence that a distributed binary code is indeed coming from a given source code."

<comment><USER3> Reproducible builds are extremely useful. There are more benefits. For example, suppose you have a build server compiling software packages. If your builds are not reproducible and you want to debug a core dump, but you have no debug information, you are out of luck (well, you could dive into the assembly code, but it's inconvenient). If you want to keep debug information, you need to store them for _every single build_ (what a waste of storage...) because the binary for each build is different. Not so with reproducible builds, you could simply check out the old version and compile it with debug information!

<comment><USER4> Most huge Debian packages carry a separate -debug package so you can get the symbols without huge recompilation times + having to set up a buildchain and associated dev libraries of all the packages.

<comment><USER5> Similarly Gentoo has 'splitdebug': [https://wiki.gentoo.org/wiki/Project:Quality_Assurance/Backt...](https://wiki.gentoo.org/wiki/Project:Quality_Assurance/Backtraces#Stripping)

</comment></comment></comment></comment><comment><USER6> Beyond providing security, reproducible builds also provide an important ingredient for caching build artifacts (and thus accelerating build times) across CI and developer machines. They also can form the basis of a much simpler deploy and update pipeline, where the version of source code deployed is no longer as important. Instead a simple (recursive) binary diff can identify which components of a system must be updated, and which have not changed since the last deploy. This means a simpler state machine with fewer edge cases that works more quickly and reliably than the alternative.

I'm very grateful for the work that this project has done and continues to do. Thank you!

</comment><comment><USER7> Amazing work. Thanks so much to everyone who's contributing. The upstream bugs filed are especially appreciated since they make the whole Linux ecosystem more solid, not just Debian.

<comment><USER8> Not just Linux; FreeBSD and NetBSD have been along the ride for a while: [https://reproducible-builds.org/who/](https://reproducible-builds.org/who/)

<comment><USER9> In some cases, a _very_ long while. I brought up the question of build reproducibility at BSDCon 2003 because it was relevant to FreeBSD Update, and a lot of my early FreeBSD commits were working on this.

<comment><USER8> Yeah; I've seen both work and developer mindset about this for a long time in bsd-centric mailing-lists. I tried to keep it short here though, seeing how the debian developers have done a great job and didn't want to shift that focus [in this thread].

I think its great that we have come to a point where packagers shift mindset from "it works" to "we can reproduce the results" in more than one package manager.

</comment></comment></comment></comment><comment><USER9> Does anyone know if they've made the Packages file (repository metadata file, listing the packages in the repository) build reproducibly yet?

I tripped over this a couple weeks ago and was both amused and annoyed, since it seemed that packages were being listed in the file in a random order. I'm asking here because it might already be fixed; we're using a slightly old version of the package/repository tools.

<comment><USER10> Why do you care about the order of packages in Packages?

What does "build reproducibly" even mean in this context?

<comment><USER9> _Why do you care about the order of packages in Packages?_

In my personal case, so that when I build a repository which has some new packages and some old packages, when I look at the resulting pull request in github I can see that the packages which haven't changed have indeed not changed.

 _What does "build reproducibly" even mean in this context?_

Two repositories with the same packages have identical Packages files. Or for me, slightly more generally, when the Packages file changes, it changes as minimally as possible.

</comment></comment></comment><comment><USER11> In case anyone is not aware of what reproducibility is and why it's a worthy goal, here's their statement: [https://wiki.debian.org/ReproducibleBuilds/About](https://wiki.debian.org/ReproducibleBuilds/About)

</comment><comment><USER12> How does the kind of reproducibility spoken of here compare to that offered by Guix and Nix?

<comment><USER13> Guix and Nix are input-reproducible. Given the same input description (input being the source files and any dependencies) an output comes out. Builds are then looked up in a build cache based on the hash of al lathe combined inputs. However. The _output_ of Nix artifacts are not reproducible. Running the same input twice will yield a different result.

Nix does some tricks to improve output reproducibility like building things in sandboxes with fixed time, and using tarballs without modification dates but output bit-by-bit reproducible is not their goal. They also don't have the manpower for this.

Currently, a build is built by a trusted builderver for which you have the public key. And you look up the built by input hash but have no way to check if the thing the builderver is serving is legit. It's fully based on trust.

However, with debian putting so much effort in reproducible output, Nix can benefit too. In the future, we would like to get rid of the 'trust-based' build servers and instead move to a consensus model. Say if 3 servers give the same output hash given an input hash, then we trust that download and avoid a compile from source. If you still don't trust it, you can build from source yourself and check if the source is trustworthy.

Summary: Nix does not do bit-by-bit reproducibility, but we benefit greatly from the work that debian is doing. In the future we will look at setting up infrastructure for buildservers with an output-hash based trust model instead of an input based one. However this will take time.

Feel Free to ask any other questions.

<comment><USER14> > output bit-by-bit reproducible is not their goal

I think you are wrong.

The Nix people (and the Guix people, including myself) are also involved in the reproducible builds project. I've met with a couple of them in Berlin last year. It's not just Debian doing this.

I can't speak for Nix but for the Guix project bit-for-bit reproducibility is an explicitly stated goal. It's very important and the reason why Guix is used in several HPC environments as the foundation for reproducible research.

Disclaimer: I'm co-maintainer of GNU Guix and currently at a bioinfo conference where I talked about Guix and reproducibility.

<comment><USER15> Nix and Guix sound interesting. I run Ubuntu currently, what's the easiest way to get start with one or the other? I hear Guix is more user-friendly, is that so?

Do I need to install a whole other OS, or can I install Guix in Ubuntu?

<comment><USER14> You can use Guix as a package manager on top of practically any variant of the GNU system. By design it is completely independent of the libraries that your system provides.

At work I'm using the same binaries on a cluster with CentOS 6 and on workstations running a mix of Ubuntu, Fedora, CentOS 7, etc.

GuixSD ("Guix System Distribution") is the variant of the GNU system where the principles of Guix are extended to the operating system, but you don't have to use it if all you want is play with the package manager.

The easiest way to get started is to download "GNU Guix 0.13.0 Binary" for your architecture and follow the instructions at [http://www.gnu.org/software/guix/manual/html_node/Binary- Ins...](http://www.gnu.org/software/guix/manual/html_node/Binary- Installation.html).

If you are into Lisp you'll feel right at home with extending Guix. If you don't care for Lisp you might at least find the command line interface to be a little easier to understand than that of Nix, but really: that's a personal preference.

<comment><USER16> Oh, that looks pretty straightforward, thank you!

</comment></comment></comment></comment></comment></comment><comment><USER17> What does "reproducibility" mean? I understand and appreciate the importance of reproducibility in the context of scientific experiments, but I don't understand what it means in terms of computer programs. I am guessing it has to do with being able to build on different architectures without issue?

<comment><USER18> In the context of "reproducible builds", it means that if you compile the same source code with the same compiler and build system, the output will be completely identical, bit by bit. This is surprisingly hard to achieve in practice.

Once they have reproducible builds, they can easily prove that each binary package was built from the corresponding source code package: just have a third party compile the source code again and generate the binary package, and it should be identical (except for the signature). This reduces the need to trust that the build machines haven't been compromised.

<comment><USER19> Just piggybacking on this comment, you can do a whole lot more than just trust that a few people have automated. Most people in Ubuntu get non-distro packages from Launchpad, for example, which uses their own build servers. With reproducible builds you can require BOTH launchpad and the developer's signature for a package to be valid, which tremendously improves the security situation.

<comment><USER19> * trust that a few people have audited. (Damn autocorrect.)

</comment></comment></comment></comment><comment><USER20> Once we have reproducible builds, will it be possible to have verifiable builds? As in, can we cryptographically show that source + compiler = binary?

Right now we can sign source code, we can sign binaries, but we can't shows that source produced binaries. I would feel much happier about installing code if I knew it was from a particular source or author.

<comment><USER21> Yes. The first standard for securing computer systems mandated some protections against this. They were partly made by Paul Karger who invented the compiler subversion Thompson wrote about a decade later. Most just focused on that one thing where Karger et al went on to build systems that were secure from ground up with some surviving NSA pentesting and analysis for 2-5 years. Independently, people started building verified compilers and whole stacks w/ CPU's. They were initially simple with a lot to trust but got better over time. Recently, the two schools have been merging more. Mainstream INFOSEC and IT just ignores it all slowly reinventing it piece by piece with knock offs. It's hard, has performance hit, or is built in something other than C language so don't do it. (shrugs)

Here's several examples:

VLISP for Scheme48 whose papers are here: [https://en.wikipedia.org/wiki/PreScheme](https://en.wikipedia.org/wiki/PreScheme)

C0 compiler + whole stack correctness in Verisoft [http://www.verisoft.de/VerisoftRepository.html](http://www.verisoft.de/VerisoftRepository.html)

CompCert Compiler for C [http://compcert.inria.fr/](http://compcert.inria.fr/)

CakeML Subset of Standard ML [https://cakeml.org/](https://cakeml.org/)

Rockwell-Collins doing crypto DSL compiled to verified CPU [http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf](http://www.ccs.neu.edu/home/pete/acl206/slides/hardin.pdf)

Karger's original paper with the attack from 1970's: [https://www.acsac.org/2002/papers/classic- multics.pdf](https://www.acsac.org/2002/papers/classic-multics.pdf)

Myer's landmark work on subversion in high-assurance security from 1980: [http://csrc.nist.gov/publications/history/myer80.pdf](http://csrc.nist.gov/publications/history/myer80.pdf)

My framework I developed studying Karger back when I was building secure things:

[http://pastebin.com/y3PufJ0V](http://pastebin.com/y3PufJ0V)

<comment><USER22> Well you may want to mention stage0 [https://savannah.nongnu.org/projects/stage0/](https://savannah.nongnu.org/projects/stage0/) it starts with just a 280byte hex monitor and builds up to a rather impressive lisp AND forth, while building tools such as a text editor and line macro assembler along the way

<comment><USER21> rain1 started a page for people interested in bootstrapping or countering Karger's attack. Several of us are putting as many links as we can find to small, human-understandable tools such as compilers. I added some formally- verified or otherwise justifiable ones (eg 25-core CPU ain't gonna be simple).

[https://bootstrapping.miraheze.org/wiki/Main_Page](https://bootstrapping.miraheze.org/wiki/Main_Page)

[https://web.archive.org/web/20170724144929/https://bootstrap...](https://web.archive.org/web/20170724144929/https://bootstrapping.miraheze.org/wiki/Main_Page)

We're focused on content right now over presentation. So, it will look rough. Hope you all enjoy it or learn something from the projects.

</comment></comment></comment></comment><comment><USER23> How do they achieve reproducibility with python and some other languages which include timestamps and such?

<comment><USER24> [https://reproducible-builds.org/docs/timestamps/](https://reproducible- builds.org/docs/timestamps/)

</comment></comment><comment><USER25> One (misguided) counter argument I've heard from otherwise fantastic devs it's the notion of adding randomness to unit tests in the hopes that if there's a bug, at least _some_ builds will fail. In practice, I've seen those builds and developers saying "yeah, sometimes you need to build it twice".

I think the solution is to give those devs who favor such techniques a separate but easy to use fuzzing tool set that they can run just like their unit tests, separate from their usual 'build' command. Give them their ability to discover new bugs, but make it separate from the real build.

<comment><USER26> Why would the randomness in unit tests affect the binary? RNGs are invoked when the tests are run, not when they're built, and anyway, test code shouldn't be part of the final binary.

<comment><USER27> The test suite is used to validate the build. Intermittently failing test suite -> intermittently failing build. You can always disable running a problematic test suite, but that doesn't exactly inspire confidence in the result.

</comment></comment></comment><comment><USER28> Compare this to Windows or OSX, where not only are you unable to build packages yourself, but they are installed from downloads you find in disparate places on the web, are not cryptographically signed by people you can trust, and often include spyware anyway.

</comment><comment><USER29> Has anyone played with the tool they mentioned, diffoscope? Sounds interesting and wonder how good it is at, for example, comparing excel files with VBA code and formulas etc.</comment>


Ask HN: Would it cost less for a large scale company to use mainframes? - <AUTHOR> Very large scale companies, such as Google and Amazon for example, relies on hardware servers infrastructure to support the running of their services.
It is in my understanding that these companies use x86 and ARM based rack-mounted servers pushing them to scale horizontally rather than vertically.
Why don't these companies use mainframes (IBM System Z for example)?
Wouldn't they benefit from the following advantages?
 - Simpler software architecture that leverage vertical scale
 - maybe less datacenter space required?
 - maybe more efficient power consumption? <comment><USER2> Mainframes are tremendously expensive per unit of compute power. Commodity hardware is far cheaper. However Google and Facebook have their own custom designed and built computers that have almost every drop of unnecessary cost squeezed out of them. Mainframes would be incredibly more expensive.

The software architecture benefits wouldn't be there either. They'd still have to build multi data center distributed systems, even with mainframes.

<comment><USER3> What data do you have to back up this assertion?

</comment></comment><comment><USER2> Mainframes are tremendously expensive per unit of compute power. Commodity hardware is far cheaper. However Google and Facebook have their own custom designed and built computers that have almost every drop of unnecessary cost squeezed out of them. Mainframes would be incredibly more expensive.</comment>


Seattle's Sound Transit 3 Board Proposes Earlier Light Rail Buildout Timelines - <AUTHOR> http://soundtransit3.org/news/board-proposes-earlier-light-rail-timelines <comment><USER2> Why don't we simply auction off a lane from 15th/Elliott/Western avenue to a private rail company? That way, instead of waiting 19 years for a train between Ballard and downtown, we could have it in two.</comment>


What the Airbnb surge means for UK cities - <AUTHOR> https://www.bbc.co.uk/news/business-47910700 <comment><AUTHOR> I am still amazed that offering your room / flat for commercial rent is not covered already by hotelier law.

It seems such a simple concept to put into the laws that it's amazing it's not already there.

I mean every B&B has fire doors, extinguishers, and usually big signs saying "please respect our neighbors and STFU"

When this happens to airbnb, what proportion of people will stop renting their homes ?</comment>


Ask HN: Your Best Morning Routine - <AUTHOR> Wake up time, hygiene habits, foods and drinks, media consumption, whatever - what's your best morning routine? Can be whatever makes you happiest, most productive, least stressed, etc.<p>How has it affected your life? <comment><USER2> >makes you happiest, most productive, least stressed

This is the same for me.

1\. Sleep with a plan

2\. Wake-up and start working

3\. Have breakfast when hungry (usually 1.5 hours after starting)

4\. Return to work

5\. Get stuck or fed-up.

6\. Clean up and go to the shops to get lunch (or dinner (or midnight snack))

I find that it's critical to drink lots of water and just the right amount of caffeine. Hunger doesn't phase me. Of course this isn't healthy. I do it only during project time.

<comment><USER3> This is extremely similar to what works for me as well.

Any chance you're currently using a water tracker app?

</comment></comment><comment><USER4> I normally wake up about 4:30 AM and spend a few minutes journaling (I use the 5 minute journal technique). Followed by breathing and stretching exercises (Win Hof based) and finally 15 minutes of meditation. This routine allows me to start the day extremely focused but most importantly very calm. I should mention that I am a "morning person" so this may not be the best recipe for everyone.

</comment><comment><USER5> 1\. Brush

2\. Meditate for 20 min.

3\. Weight train.

4\. Have a smoothie.

5\. Read for half an hour.

6\. Journal

7\. Do anything "creative" for two hours

</comment><comment><USER6> As someone who never really had breakfast earlier in life, i can heavily recommend it if you skip the most important meal of the day!</comment>


How to log a timestamp - <AUTHOR> https://howtologatimestamp.info/ <comment><USER2> I'd go a bit further. Log before the operation. If you want the duration, log it separately, afterwards.

This prevents issues where the long operation fails for some reason and never leaves a trace. Yes, you should also log failures, but sometimes that may fail too if the long process manages to crash everything.</comment>


Gramps v5.1.1 Released – The Open Source Genealogy Program - <AUTHOR> https://github.com/gramps-project/gramps/releases/tag/v5.1.1 <comment><AUTHOR> For those into Genealogy, I just thought I'd share that with you.

This version of Gramps switches from BSDDB to SQlite as the default database backend.</comment>


Ask HN:got macmini where to start to learn mac dev? - <AUTHOR>

i have 15 years of c++/java experiences . i want to learn develop on mac as fast as i can . first develop native mac apps then ipad. i started the mac for the first time and then what ? <comment><USER2> <https://developer.apple.com/devcenter/mac/index.action>

<https://developer.apple.com/devcenter/ios/index.action>

<comment><AUTHOR> thanks , what to download? what are the must tools for developers ? what are the must sites/forums for mac devs?

<comment><USER3> For tools. You just need XCode. And I would recommend the WWDC 2012 videos. <https://developer.apple.com/videos/wwdc/2012/> Most of it may go straight over your head but there are some more introductory sessions in there. And I believe most devs are using the Apple Developer Forums.

<comment><USER4> Yeah, Xcode is pretty much all you need. I would second the WWDC videos, they explain a lot.

</comment></comment></comment></comment><comment><USER5> Go on iTunes-U and download the Stanford iOS lessons. That's the fastest and best way to learn iOS development. As for Mac development... I'm not sure. I've not dabbled in that yet.

</comment><comment><USER6> Go for iOS first to get familiar with cocoa, then move on to Mac. There are tons of info for iOS devs but bit less for Mac.</comment>


Twitter Has Lost a Staggering Amount of Money - <AUTHOR> http://time.com/4241716/twitter-losses-twtr/ <comment><USER2> $2 billion is not staggering amount. Given it has over 300 Million active users - thats just $6~$7 for user acquisition.

If you want to build twitter today - its definitely going to cost more. It has built a brand - and hundreds of millions of loyal fans.

Question is - is it worth the valuation thats put on the company. Given now they are cash flow positive - that they have lost $2bn in the past is immaterial.

<comment><USER3> Just $6-$7 isn't a lot, until you multiply by 300 million and realize that they aren't worth $6 each.

$2bn is absolutely material. If their growth is predicated on setting money on fire, future forecasting has to take that into account. Sure, it is a sunk cost, but unless the fundamentals of acquisition have changed then their valuation is not nearly as high.

And the the fundamentals of acquisition have changed. Unfortunately, in the wrong direction.

<comment><USER4> Facebook's quarterly net income is in the ballpark of $1 billion. $2B is a reasonable amount of money for a social media monopoly.

</comment></comment></comment><comment><USER5> I envision all of this taking place in the next 10 years.

\- twitter hasn't been profitable for the past decade.

\- twitter can't turn around, neither can other unicorns.

\- wheres the return???

\- investors abandon

\- twitter announces mass layoff

\- Facebook purchases twitter

\- Facebook faces same music shortly

\- Decentralized Twitter appears!

\- Facebook attempts to capture it...it failed!

\- Decentralized Twitter uses No Ads, No Tracking.

\- It is highly effective!

\- Decentralized Facebook appears!

\- Cryptoanarchy movement arises

\- The biggest wealth equalizer in human history begins.

\- Assassination and Weapons market emerges. Decentralized, trustless free for all markets free of law enforcement. Anyone can be touched for the right amount of the single most untraceable anonymous digital medium used to exchange goods and services.

\- Governments slowly lose their grip to pockets of cryptoanarchial markets. Government services and jobs are replaced with network contracts executed with zero centralized decision making.

\- Anarchy movement settles down as stability is introduced by a decentralized internet.

<comment><USER6> I will happily bet as much money as you want that this won't come to pass.

If for no other reason than no decentralized communication service has ever been as convenient as a centralized one. And convenience is King for communication.

(NB: the list ended at "\- Decentralized Facebook appears!" when I made my comment.)

<comment><USER7> I think you need to split out the directory function. The internet is decentralized. It is DNS that that makes it convenient, and DNS is centralized. Is there a reason that convenient directories need to be centralized?

<comment><USER3> What are you trying to gain?</comment></comment></comment></comment>


What happens inside Amazon when one of its AWS hosting services goes down - <AUTHOR> http://www.businessinsider.com/interview-aws-werner-vogels-amazon-outages-2017-7 <comment><USER2> This is the reason that I disagree with those who say they like to control their own hardware. AWS immediately has 10s, 100s of people attacking the problem with full vendor support. Meanwhile, I'm trying to find out why my SAN firmware update borked 3 disks and HP will be on-site is about 4 hours.

One thing that AWS could do better is actually reporting these outages to their customers. It's a running joke that every time AWS does something funny, their status page stays green. Even when the status updates the indicator is a tiny light grey exclamation point; basically invisible.</comment>


The 'Fly' Has Been Swatted - <AUTHOR> http://krebsonsecurity.com/2014/06/the-fly-has-been-swatted/

<comment><USER2> The thing here that what was being exploited is irrationality of the system that uses these made up "Wars On <X>". Whatever this <X> is, it will always be boon for psychopaths and will be a exploited.

War on Terrorism -- send tips about so and so is building bombs or talking about jihad.

War on Drugs -- plant or send someone a drug package and notify police. One worse, SWAT them. With good luck they will be shot by the cops.

War on Kids via Zero Tolerance -- plant a piece of toast looking like a gun in someone's bag and tell a teacher.

War on Electronic Crime (Hacking) -- plant a DoS tool pointed to a .mil website on enemy's machine or network.

The list goes on. Of course in this case we have a good ending so that is encouraging. But the scary part is not that someone would wish all this harm to another person and come up with scheme like this, but that knowing how prosecution works, how Wars On <X> work, this seems like a very close call. It is the lack of faith in justice and the system to act rationally that is scary. Maybe the neighbor who is building bombs got a visit from FBI and they couldn't charge him. But they visited his work. Scared his kids. And ultimately put him on a watch list so from then on they get harassed every time they travel.

<comment><USER3> But one of the most effective tactics of The Fly was a traditional SWATting based on a false phone call that Kreb's wife had been murdered in the house. 13 police officers showed up, heavily armed, because of the War on What? Murder? Domestic Violence?

All of this long predates any War on ____. Your examples could just as easily be "send tips that so and so plans to rob a bank." There's no "War on Bank Robbers" but it'd be no less effective.

<comment><USER4> You're missing a couple of points:

\- The militarization of local police forces is largely thanks to the War on Drugs.

\- The effects of a "SWATing" are amplified by the militarization of the police. If, for example, someone called in a murder in the 1950's, would the police come in guns-blazing shooting anything, and everything in their path, dropping flashbang grenades on sleeping children?

\- Had the package of drugs arrived without Krebs being 'in on it,' then he would be in violation of the law because he possessed an illegal substance. The War on Drugs has given us the idea that merely possessing something is enough to get you jail time. This allows malicious actors to arrange for an illegal item to find its way into your possession... The police and prosecution hear "I was set up!" a lot. I'm sure they wouldn't pay much attention to just another cry of innocence (though being a white male in good social standing probably increases the odds).

<comment><USER3> > The War on Drugs has given us the idea that merely possessing something is > enough to get you jail time.

Except that's not true either. In many places possession of burglary tools is a crime by itself. I'm not saying it's a good law, but it's certainly law. Same for any possession of child pornography, knowing possession of stolen property, any possession of a long list of EPA-banned toxic chemicals, any possession of unregistered firearms, any possession of modified firearms, etc etc etc.

</comment></comment></comment></comment><comment><USER5> > According to a trusted source in the security community, that email account > [belonging to 'Fly'] was somehow compromised last year.

Right... I'm sure it was just a source who themselves got the information legally secondhand, and that Krebs had nothing to do with it. ;)

</comment><comment><USER6> It's not clear in the post; why was Krebs targeted by this criminal?

<comment><USER7> It may simply be because Krebs has a history of unveiling important members of the cyber crime business.

<comment><USER8> Or it may simply be that 'owning' Krebs has the effect of boosting some stupid kids' standing.

</comment></comment></comment><comment><USER9> This link is blocked in UAE. :-\

<comment> w-ll How about [http://krebsonsecurity.com.nyud.net/2014/06/the-fly-has- been...](http://krebsonsecurity.com.nyud.net/2014/06/the-fly-has-been- swatted/)</comment></comment>


Experience is overrated - <AUTHOR> http://scottberkun.com/2010/experienceisoverrated/

<comment><USER2> This I agree. Kids who are a decade younger than me are drawing circles around me. It seems smart people are smart at any level they are.</comment>


Tell HN: LocBox is spamming HN users - <AUTHOR> I received this e-mail, seems companies/people think it is acceptable to SPAM fellow HN users and have us not care..
Hi there - my name is Saumil Mehta and I'm Founder at LocBox (http://www.getlocbox.com) and formerly a Software Engineer focused on web search (Kosmix) and public-key crypto (Voltage Security). I saw your submissions on Hacker News and decided to reach out; thank you in advance for reading my unsolicited note.
My company focuses on empowering local businesses to have the same Marketing tools as larger retailers - specifically, we help automate customer acquisition and retention (revenue + foot traffic) for these businesses. We work with hundreds of paying customers that love our approach and we just raised a large Series A funding round with Google Ventures and others.
Would you be interested in working with us or advising us (with your referrals)? We're doing meaningful work and want to work with other great people. I've worked with great engineers in the past but these days it's easier to run into Bigfoot :)
Would you be up for a quick phone or Skype chat to discuss?
Best, Saumil <comment><USER2> I don't like this submission at all. It IS acceptable to reach out to people on HN, and other communities like it, to see if you can work together or their startup can help you out. I love getting mails like that, especially from a 2+ year old member that is asking for advice or a chat, along with introducing what he's working on.

Presumably that's why you have an e-mail in your profile when there's nothing compelling you to share that. That someone actually used that e-mail should not result in public defamation and linking their business name with spam. Networking is something lots of professionals do -- and you can opt out by simply not giving out your e-mail, or saying so in your profile.

Now we can see that he also sent the same mail to some other people. That's much less 'cool', and I agree that businesses shouldn't harvest profile e-mails just to market to us. But you gave no indication you knew that when you came here to call it spam -- and you should really be sure before making serious claims that could have ramifications for his company for years. This submission is gonna be in search engines forever with his company name and his target keywords in it.

<comment><USER3> I got this same message several days ago, and I assumed it had been mass-sent, based on the fact that my name wasn't mentioned anywhere in the message body and the phrasing was extremely generic.

I don't think it's unreasonable to assume that jason_slack would come to the same conclusion as I did, and claiming this is 'defamation' is absurd and baiting, especially given that you'd seen confirmation it HAD been sent to multiple users when you wrote this.

</comment></comment><comment><USER4> That's sad. I got the same email (word for word to my eyes), and while I don't mind at all when people email me via HN it's pretty obnoxious that I spent 10 minutes out of my day writing a pleasant and thoughtful response to someone who couldn't be bothered to do the same.

I hope this doesn't cause me to second guess the next email I get from an HN user, since so far this is pretty aberrant in my experience and I've been really delighted to be in touch with the (admittedly few) folks who've pinged me this way.

<comment><USER5> I also got the same email and spent some bit of time writing a (somewhat thoughtful) reply but got nothing back. I assumed he didn't like my reply.

<comment><USER6> Hello there - I've tried to respond to almost everyone that wrote back. If I missed you I'll go back and check my drafts because sometimes I have additional questions that I want to ask folks after taking a look at their notes or their blog/website/github and don't want to piss away an oppty to have a real conversation being trigger happy on responses.

</comment></comment></comment><comment><USER3> I received this a few days ago, and only got around to replying this afternoon, to quickly ask for more details.

It felt like a bulk-send to me when I first looked at it, too generic, with no indicator of why they might want to work with me. If they're looking for JavaScript guys I'm especially surprised they contacted me.

I definitely don't think this is cool - contacting someone you find via HN because you have something relevant to discuss: that's actually awesome. Mass sending the same generic message to anyone who lists an email address: that's just spam.

</comment><comment><USER7> I got that same message too, except that he made specific reference to how my JavaScript related posts caught his eye. Since most of my JS posts are along the lines of "can someone design some sort of training wheels framework for Backbone?" I figured he was casting a wide net.

</comment><comment><USER6> Hello all - my name is Saumil Mehta and since I guess I'm the mastermind behind this whole thread it behooves me to reach out and respond.

First of all, I'm sorry to jason_slack for the major inconvenience caused by my email. It was written by me, came from my work email account (saumil.mehta AT getlocbox.com, in case you care to know), was sent 1-1 not en masse (you can check the headers) and was in no way intended to get anyone ticked off.

Secondly, yes. I've emailed well over 100 people personally in the last 15 days. A bunch of the emails have had very similar body copy so that is also accurate. I read Hacker News a decent bit and always search around for folks doing frontend work by using the search box and if I like their submissions/comments and sometimes if I just find their username intriguing or entertaining I poke around for their bio for their email and send them the note you see above. I do it nights and weekends after my "day job".

Thirdly, I work at and run a venture-backed company in San Francisco. It's the best job I've ever had and as everyone knows, learning from and working with good folks is paramount. It is also challenging to connect w/ the same folks.

With that backdrop set, I will admit freely that I like to ask for help. A lot. I ask lots of people. I cold email a lot of people. I do it with potential customers, potential partners, potential investors, potential folks that might be interested in contracting w/ us or joining our team. I always do it respectfully IMHO. Hell, I've even done it to Patrick Vlaskovits who was kind enough to respond in my stead on this page (hey Patrick!).

The outreach I discuss above has actually been excellent. It has yielded lots of fun conversations over email and Skype and several great phone and in- person conversations with folks in the community. I used to be a (decent but never great) developer. I love shooting the shit w/ other developers. A lot of it goes nowhere because most folks are busy at their day jobs or startups or are booked for contracts or don't care to work w/ us after talking w/ us. Some of it has resulted in freelancing contracts that has really helped my startup. That's all par for the course but a great investment of my time and (hopefully) anyone that takes time out of their busy day to talk to me.

In case you care, the response rate that I tabulated manually in my Google Apps account has been well north of 25%. That tells me that folks are, generally speaking, happy to talk to me and that I'm not wasting their time or trying to sell them timeshares.

I have had exactly 2 people tell me to go take a hike over email. That's ok too. When it happens I always apologize for the inconvenience and move on. But by and large the Hacker News community has been fantastic to connect with and learn from.

Lastly, a philosophical point. We all know startups are hard and millions of dollars of funding does nothing to change that. The only way to hack it after being at it for 18 months, I've found, is to ask for help very proactively, even of folks I don't know. It has stood me in great stead in every endeavor - fundraising, contracts, partnerships, customers, office space leasing, personal sanity maintenance, you name it. I hope you will agree and if you don't, feel free to email me or call me at (415) 322-9308 and flame me over the phone in the middle of my work day :)

Thanks all and good night!

<comment><AUTHOR> Saumil,

Your e-mail to me was generic. Nothing personal. Cookie cutter, boilerplate, etc.

I took it as SPAM and the last thing I am going to do is reply back to a SPAMMER and confirm that my e-mail is real.

Most all of my HN submissions are my thoughts and opinions. Nothing really technical. You say that you did read my submissions before contacting me.

Specifically tell me what about my submissions caused you to e-mail me?

<comment><USER6> As I've said in the rather giant tome above I've done 100+ of these so forgive me if it's not on the tip of my tongue. I went back and looked at your submissions and it must have been the fact that you have a lot of Ask_HNs, a couple about RoR but mostly about lots of interesting technology stuff. It's hard to gauge anything after multiple conversations, much less from a submission feed but I generally get along well w/ folks that ask a lot of questions, are very curious and ask for help freely into various communities.

In this case, I was rather wrong :) well hell, can't win 'em all.

<comment><AUTHOR> But HN is not a "Stack Overflow" style community. So if you have done 100+ of these to HN users I dont think you get the point of this community.

</comment></comment></comment></comment><comment><USER8> I too received this email, more specifically about JavaScript. Obv tacky & tasteless but probably working for him.

<comment><USER6> Disagree with the tacky/tasteless part but yes, as I describe above, it did indeed work for me. Thanks for your feedback.

</comment></comment><comment><USER9> Seems there are different views on this. Maybe you should add something to your profile indicating if you want to receive unsolicited emails from startups.

<comment><AUTHOR> There surely are different views. It was this one being generic and exhibiting SPAM like qualities that made me not happy.

If this reply had been personal.."Hey, this is what I liked about your HN submissions and I think I could use your input, are you willing to provide it..this is how you contact me if you want to.."

I might have formed a different conclusion.

<comment><USER6> Fair enough, agree to disagree on this one. It's not as if you had just heard from the next Nigerian prince or been offered cheap meds at a low price :)

I personally think a Tell HN with an accusatory tone is extreme - could have checked headers, could have talked in private, could have ignored it, could have edited your bio to flame me specifically, could have reported spam on your email client, any number of things - but whatever floats your boat works for me. I did reach out after all so you're free to do what you like in return.

But as I've said earlier, sorry I inconvenienced you so much w/ my little email. Have a great weekend!

<comment><USER10> There's no "agree to disagree" when he's telling you not only what made him unhappy but what you could have done better. This reply just looks more like you're the kind of person who doesn't pay attention.

<comment><AUTHOR> Agreed, he made a mistake by spamming and rather than say flat out he made a mistake, he is sugar coating his words to not admit it outright, save some face.

I have more respect for someone that admits mistakes outright.

An apology has 3 parts: 1\. You say "I made a mistake" 2\. You apologize to the person for the mistake 3\. You dont make the same mistake again

1\. I made a mistake 2\. I am very sorry that I did this to you 3\. I wont do this again.

Someone who doesn't use a 3 step apology doesn't mean it to begin with.

</comment></comment></comment></comment></comment><comment><USER11> I also received the same email four days ago. I'm curious what tool they used to harvest email addresses. I'm very behind-the-times in what harvesters bother to implement these days, if they've gotten to the point of having a regex match on /[emailchars]+.{,20}(gmail|yahoo|etc)/, then I'm impressed! If there was any manual work involved though, it's sad that it went to waste on a generic non-templatized email.

<comment><USER6> That tool would be my very tired but somewhat functional human brain late at night and on weekends. And as I describe above, it's not sad at all. It was actually awesome to be able to speak with so many cool folks.

</comment></comment><comment><USER12> One thing for sure. LocBox probably got a lot more attention now due to this post. I did not get the email but this post made me take a look at LocBox :)

<comment><USER6> Excellent! We try to empower local businesses with good software and we like what we do - Local is super-challenging and very broken which in turn makes it fun to try to build stuff for. Plus customers pay on Day One, which is always nice.

</comment></comment><comment><USER13> Now I'm jealous. I didn't get the email. Saumil, send it over. Let's talk. Someone who is willing to do this campaigns is someone I want to get to know.

<comment><USER6> Will do! Thanks man.

</comment></comment><comment><USER14> FWIW Saumil is good dude, doing good stuff.

Note to Saumil: use a "spinner" script next time buddy. ;)

<comment><USER15> The term "spinner script" was new to me; here's basically what it is: <http://en.wikipedia.org/wiki/Article_spinning>

<comment><USER16> Thanks.</comment></comment></comment>


IBM PC Real Time Clock Should Run in UT - <AUTHOR> https://www.cl.cam.ac.uk/~mgk25/mswish/ut-rtc.html <comment><AUTHOR> This is a reminder that in modern Windows (they finally managed to fix all known bugs in 2014, supposedly) you can actually make the clock of your system run in UTC!

        reg add HKLM\System\CurrentControlSet\Control\TimeZoneInformation /t REG_DWORD /v RealTimeIsUniversal /d 1</comment>


I launched "Circle point" game and I would appreciate to hear your thoughts - <AUTHOR> https://play.google.com/store/apps/details?id=com.vluncasu.circle <comment><AUTHOR> I recently worked on "Circle point" a simple and I would say challenging game. The game idea is simple: 1. You have a simple circle that increases and decreases continuously. 2. Whenever your circle is above some point - tap to collect! 3. Don't let points disappear. 4. And don't tap when there is no point on your circle. That's it! I would appreciate any feedback! Thank you!

<comment><USER2> Right now, I'm on my laptop. When the goal is feedback, put it on the web. Then iPhone, and Android, and Windows, and Linux and Kindle users can chime in.

One of my standard comments about apps is that getting feedback and communicating with users is nearly impossible because people who use Play and the App store are Google's and Apple's customers and Google and Apple are not going to share their customers with developers.

Finally, the game sounds interesting. It's your actual product. This more time you spend on it and the less time on futzing around with platform details the better it will be.

Good luck.

<comment><AUTHOR> Thank you brudgers for your advice. What would be your advice about promoting what you work on. I am agree that you should work continuously on improving the product because more you work means more details covered.

But there are 3 scenarios: 1\. Your idea is great you work hard on improving it, but somehow someone else meanwhile saw your idea and with a bigger team and more experience they develop something similar and you lost your time. 2\. Your idea is great but you do not promote your application enough, you would say that after half a year, or a year someone will say oh look this is a such a great app why haven't we seen this app before? But if noise increases you may result in case 1. 3\. Trying to promote your app as you develop it (that means less time remained on improving product) and in that case it will take more time and the result may be not the same amazing product.

Thank you!

<comment><USER2> It doesn't matter if your idea is great. It matters if your implementation is useful for other people.

1\. Businesses fail for all sorts of reasons. Usually those reasons are intrinsic to the business itself and only occasionally does a business fail due to competition [and often the competition succeeds because the other business can't/won't change.

2\. Apps in an app store are almost impossible to promote because:

      a. Apple and Google control the app store.
         [see my previous comment]
      b. The channels for promoting an app outside
         the app stores are full of noise. The noise
         is because every other app is using the same
         channels.
      c. The big competition for good apps in the app store
         is not better apps, but crappy knockoffs. These just
         add to the noise.

3\. The critical step is not promoting a product. It's building something one other person actually finds useful. Then finding a second person. And all along talking to those people. Improving the product is not a matter of adding features. It's a matter of making it more useful to people who are actually using it.

I'll circle back to my original point. Part of your product is the means of its delivery. I don't use an Android phone. I don't use an iPhone either. Even if you put it in the Windows marketplace, the odds that I will stop using my laptop, pick up my Lumia, navigate to the store, install the app, open it up and _care_ are very very low.

In part because, an email, a tweet, a Facebook post, a Hacker News comment, or my dog barking are things that I _care_ about more during the time it takes to complete the steps just to see what the app actually is.

If it's on the web, I might click, see what it is and not _care_. But I got to "no" fast and it's more convenient for me to provide relevant specific feedback [I won't even go into app store feedback].

Good luck.</comment></comment></comment></comment>


Jason Calacanis: How to Demo Your Startup - <AUTHOR> http://blog.mixergy.com/how-to-demo-your-startup-by-jason-calacanis/

<comment><USER2> Wow - great advice. Jason's emails have been awesome so far.

Maybe it's just me, but I don't even understand the purpose of using PowerPoint. To me it just screams: "I'm a suit". If you have any semblance of a working product, why aren't you spending your time showing it off? Also, when I'm talking I want the audience focused on what I'm saying not the slide animations and colors.

I guess I could understand if you don't have any sort of working product or if you just have a few _concisely_ worded slides to reinforce certain points. However, the vast majority of presentations I've seen aren't like that at all.

I think of the ~1000 or so Powerpoint presentations I've been exposed to, only a handful have added significant value to what the speaker is saying (the Nike VP of marketing had the best one I've ever seen - surprise).

</comment><comment><USER3> How does Jason feel about having his formerly private email list published online?

</comment><comment><USER4> Most of those things seem common sense

<comment><USER5> Yet most demos include too many slides and too much focus on the future and not enough on the present etc...

Sometimes seemingly common sense advice is necessary.</comment></comment>


Genes are key to academic success, study shows - <AUTHOR> https://phys.org/news/2018-09-genes-key-academic-success.html <comment><AUTHOR> Hmmm... Let's see more science around this before we jump to conclusions.</comment>


The Mosquito - <AUTHOR> http://www.swedishaerosport.se/joel_press.htm

<comment><USER2> That's really cool! I wonder if it's an easy skill to master. I can just imagine how much faster my commute would be.</comment>


Ask HN: Do you make more than $200K? What did you have to do? - <AUTHOR> Having been writing software for over 10 years, I recently learnt that a friend has been making more than $220K for the past several years (similar background). I'm at $170K and always thought I'm getting paid really well (I'm an engg manager + programmer in bay area, Java expertise).
Curious if people here make more than $200K - what your role/salary/experience is.
How did you get your high salary? How have you been raising it? Do you plan for it, or does the company reward you automatically? Do you switch jobs a lot?
Side curiosity: how much do execs (such has CTO or VPE make?) <comment><USER2> I make about $275k (145 base, 35 bonus, 90+RSUs) as a designer with strong technical and product management skills. For example I can write you a basic Android front end and also a PRD while tangling through legal and security.

I am an individual contributor and just about to begin managing. However I unofficially lead a team of 20. There are still 4 levels above me that can be paid upwards of low millions dollars before entering executive titles like VP.

I'm 30 and it took running a startup, then pushing high profile products in a big 3 company then launching net new products and running as a solo entrepreneur within the company.

At the upper end, it's not about just being a manager or even being good. It's about how well you can create new opportunities that are strategically valuable for the company.

Honestly, I think of myself as just getting started, as I aim to reach 1m+ total comp per year.

<comment><USER3> > I am an individual contributor and just about to begin managing. However I > unofficially lead a team of 20.

How common is this? I'm in a similar position, albeit a smaller group. I've gotten pushback on a management title, but I think I've largely negotiated the unofficial duties into my salary, so I don't mind much. I make $250K (base and total) at a non-profit.

<comment><USER4> > I make $250K (base and total) at a non-profit.

This is pretty intriguing. May I ask how common this is? I have imagined non- profit careers to be in the <$150k range and not comparable (compensation- wise) to tech companies/startups.

<comment><USER3> In general I think there is a discount to working at a non-profit. I'd expect a salary bump if I went back to industry. That said, I think it is not uncommon. Non-profits span a wide range of organizations. There are well- funded non-profits like the Gates Foundation, Simons Foundation or the Chan Zuckerberg Initiative, medical research institutes and research hospitals, health insurers, and leading museums. Non-profits report salaries of officers, highly paid and key employees. Have a look at ProPublica's Nonprofit Explorer [0]. Look for IRS Form 990. It's pretty interesting. As tsunamifury says, if you can demonstrate strategic value to the organization you will be in a strong negotiating position.

[0] [https://projects.propublica.org/nonprofits/](https://projects.propublica.org/nonprofits/)

</comment></comment></comment></comment><comment><USER5> Currently making ~$300k/year in total comp.

31 years old. 5 years of experience as a hardware engineer, and 2 years as a software engineer (back-end).

Master's degree from Stanford.

Practice hackerrank, cracking-the-coding-interview, read a programming/architecture book every few months, till you can ace programming interviews and understand your field really well.

Living in NYC, where the financial companies have driven comp levels really high for software-engineers.

Working at a big-4 software company.

Currently at my 4th company. Interview and negotiate aggressively at many different places every time you switch, so you can get 20-40% increases.

Don't know how much this helped me, but do a side-project and blog about your experiences.

<comment><USER6> what's your base salary?

<comment><USER7> probably $150k like everyone else :) If you're base salary is $200k and you only have $100k stock/RSU's, then there's a problem somewhere...

</comment></comment></comment><comment><USER8> I have the opposite question for people here: what drives you to more money?

A very expensive house costs a few million dollars, which you should afford quite easily, especially if you have a partner making a decent amount of money. Children and their education cost quite a bit in the US, but even that shouldn't cost a lot. A few expensive holidays per year plus retirement money should be easily doable.

So, basically, why do you want/need more money?

<comment><USER9> "A few million"... say $3M?

So a down payment would likely be $300K-$600K.

Let's say $400K income.

NerdWallet says that even at $600K down with under $2K of monthly obligations, you're still "stretching" to get to $2.25M, so "afford quite easily" seems a bit questionable.

</comment></comment><comment><USER10> If you are already at $170k, you are doing good (even considering you are in the Bay Area).

Like it was mentioned here, focus more on the value you bring to the company, always make decisions like you own the company. If I were the owner, this is what I would do ...

It is a whole different perspective than thinking about "how much can I personally make". Once you get comfortable thinking in that mode (may take a couple of months & years), things will get clearer and you will be able to elevate your thinking and see the forest. It will then get easier for you to talk about "business" and negotiate your pay relative to what you bring. You may realize you are in the wrong company as getting paid $200k is not possible where you are.

If you keep looking around your peers and "at your level" (aka, why is he making more than me), it is definitely easier but you will not elevate your game and get to CTO/VPE.

</comment><comment><USER11> I've had a few years when I made over $200K. I expect that whatever years remain in my career will all be above that level. Instead of participating in the usual ____-size war, I 'll try to focus on the "what did I have to do" part.

First, I had to be willing to learn. Everything. Constantly. Whatever I knew was never enough. There was always some new specialty, some new technique, some new tool. I didn't waste time on puttering around with these things for their own sake, but nor did I balk at picking them up just because they were unfamiliar.

Second, I had to take risks. I changed specialties. I took jobs at companies, or with technologies, that had uncertain futures. I bit off more than I was sure I could chew. It's much easier to make these kinds of leaps by switching companies, but it's not unheard of to do it within the right kind of company either.

Third, I put in the effort. Part of this is developing depth as well as breadth. Neither alone is sufficient, you need to develop both which means you need to recognize when to pursue each kind of opportunity. Also, nobody likes fair-weather friends and quitters. You have to show you _can_ stay with the ship through rough weather, even if you don't always choose to.

Fourth, I kept myself sane. Charging hard can literally drive you nuts. You need friends, and hobbies, and sometimes you just need a break. I went part- time for a couple of years to avoid burnout. Sooner or later most people will hit that point. If they don't steer away from the abyss, they'll fall in - quite often right before they hit their best earning years. Dumb move. Learn to ease up on the throttle when you need to.

</comment><comment><USER12> Staff engineer at Google pays pretty well. I'm somewhere in the $215-245k base salary range, with a 20-30% bonus target and equity comp that is roughly equal to my base salary. So all in all I pull down about $500k per year. I get a bit more if the stock has been going up, a bit less if the stock has been going down. We sell all our stock automatically as it vests, so the compensation is very close to being like cash. I have 8-12 years of experience and tenure with the company. (The ranges are partly obscured so that I can't be identified, and partly because I genuinely do not keep track at this point of how much I make.)

Didn't do anything particularly amazing to get here. Worked for a few good teams, and people liked the code I wrote, especially my management. I had very supportive managers who pushed hard for their people to be promoted when warranted. I don't have any special skills beyond being a C++ server programmer and everything that entails -- expert knowledge of debugging and performance on various levels, solid design and coding skill, and deep familiarity with many Google proprietary systems.

</comment><comment><USER7> First off, are you talking base salary or full package? There is no such thing as $200k base salary for 10 years exp in java. You'd have to specialize. $170k/y base salary for an eng manager is right where you want to be.

If your talking about base salary + bonus + annual sotcks/RSU's then you're way below market.

<comment><USER13> Not to sound like an asshole, but there probably is. There probably are roles paying $500k a year doing exactly that. Not many, but they will be out there for certain people.

<comment><USER14> Yeah I've seen positions offering 200k base salary for less then 10 years experience with java.

</comment></comment></comment><comment><USER15> First thing first. I am FANATIC about people calling me 'programmer' or 'Java Programmer' or even 'coder'.

Even though I DO code and I DO write programs, I never define myself as such and promptly call people out when they call me that.

I focus on the value I bring. It can be Java with Hadoop and it can be deploying a Kubernetes cluster or writing a React application. I solve problems in a creative way.

I am making more than 200K. I don't work for the big 4 (or 5 or 50 or 100 or even 1000)

Recently switched jobs. Making 200K base and around 280K total comp.

Recently, to be honest, I am really less focused on the numbers. I live in SV and those numbers make no sense. I would be more than happy making 150K and saving and investing more money than I am able to right now.

</comment><comment><USER16> I run a company that collects compensation data. We do have a lot of people making well over $200K, though its much rarer in pure salary form. Most of the people in our database with masters degrees and a few years of top-tier experience make in the $120K-$160K salary range, but including stock options and bonuses, a lot of people are easily passing $300K at top companies in mid- level engineering and product roles.

I'd be happy to do some custom data pulls for anyone if anyone has any specific questions. If you want to explore more of the data yourself, check out [https://www.transparentcareer.com](https://www.transparentcareer.com)

</comment><comment><USER17> Senior eng manager at one of the big tech companies, been there about 10 years, 20 years total experience, high performer, work in a non bay area office.

~$300k base, ~100k bonus, ~$500k stock, per year.

Individual contributor engineers at the same job level / experience at our company generally make a little more, compared with people on the manager track.

If those numbers seem shocking, keep in mind that the most reliable way to get wealthy is not to gamble on a startup, but to get your way into a Amazon, Google, Microsoft, Apple, Facebook, etc., and stay there for a decade or two.

Which makes sense, since those are the companies making all the profits, and give generously back to retain top employees.

</comment><comment><USER18> I make $190k base:

$190k base + $10k signing bonus + RSUs = ~$300k total comp

> what your role/salary/experience is.

Senior full-stack engineer. Located in SF.

> How did you get your high salary?

Interviewed at many companies and received multiple offers. Kept every door open, made sure the company/team knew I was excited to join, and moved the negotiations and base salary forward. It helped a lot to have an existing open offer when companies asked what I was making previously. This anchored their starting offer.

> How have you been raising it?

Switched jobs my salary increased by $10k, $40k, $10k, and $60k. Contracting for 4 years increased my yearly income to $330k. The biggest raise was interviewing at 10+ companies and choosing the best offer. Got a lot of rejection emails too.

> Do you plan for it, or does the company reward you automatically?

I never received a substantial raise without switching companies. Larger companies with lucrative bonus programs might be different.

> Do you switch jobs a lot?

First company I stayed 5 years, second 3 years, third 1.5 years, fourth 6 months, fifth just started a few months ago.

Out of my friend circle I'm not the highest paid engineer. A friend just accepted a senior engineer position a recent IPO company making $210k base. Another friend is an eng. manager at a finance company making $1m but not sure if that's base or total comp.

<comment><USER19> Are you sure you don't want to stay in your new job for 3 months?

</comment></comment><comment><USER20> I'm at $95k Canadian. These threads make me feel bad.

<comment><USER21> Makes me feel bad also, until I think of the living costs in US big cities. I would really like to see an European version of this thread. Probably the bar would be set somewhere around EUR 100k?

<comment><USER22> The living costs of some Canadian cities are also very high. Both Vancouver and Toronto are currently experiencing a housing bubble that has made housing extremely expensive. At this point a software engineer in Vancouver is certainly priced out of being able to own a detached home. It is unlikely a duplex or townhouse would be affordable either.

</comment></comment></comment><comment><USER23> To clarify what people are saying: 200 k$/yr+ in base salary is rare (but not unheard of) in SV/NYC for programmers. It usually implies some degree of specialization beyond "Java programmer" ("highly available systems expert" being an example that I know has garnered that base salary.)

200 k$/yr+ in total compensation (ie, salary + bonus + RSUs, at a public company where RSUs are liquid) is much more common. I personally received that as a SDE II at Google, with 4 years of experience, and from my understanding, I was not in any way an exceptional case.

</comment><comment><USER24> I've made a little over 200K for the past few years, but my problem is how to keep it and build wealth from it. I store a fair amount in home equity, 401k, etc. but any time I've tried anything in the stock market I've lost my ass. But to answer your question, I will echo a lot of people and say "specialize". My brother made a lot of money in the 00's by becoming the last expert of an obscure database product used by local governments.

<comment><USER6> Give up trying to beat the market, just call it a day and invest in a S&P 500 index fund. Hedge funds and money managers that get paid $1m+/year can't even beat the S&P 500 in the long run (20+ years). The only one that has beat the S&P year in and year out is Warren Buffet's Berkshire Hathaway, but even now he admits his conglomerate is so big it will be tough to do that in the future and he also recommends a low cost S&P 500 index fund instead.

</comment></comment><comment><USER25> I'm at $160k in the Valley (lead developer with engineering management focus & high quality developer background, originally hired as just an engineer at this amount), but I could easily flip the switch to make over $300k if I want (I have turned down offers greater than this) - I'm very happy where I am right now is my caveat, as my workplace checks every single mark I have as desired/nice to have except compensation.

Earlier in my career I would job search & up my compensation through job hopping. I always had done some substantial open source work on major projects (several of the 150 most starred on GitHub), but I accelerated my work in open source at one point and demonstrated the high quality & unusually high volume I was able to output, while still having a full time job & not doing open source during work for the most part. That experience, along with the volume of accomplishments I have from my work experience, has resulted in excellent dividends for me, as it has allowed me to have my pick of engineering jobs for the most part (whether it'd be a founding engineer, principal engineer, or director of engineering role). I picked my current job very carefully after getting laid off from my previous job (and I was already checked out and actively interviewing at other companies by that point because I was fed up), ending up with a company I still am at almost 2 years later, longest I have been at a job.

I started my career late though - I only am 3 months removed from 4 years in software engineering, after dropping out of a PhD program in math and a stint in the Marine Corps. I did not program prior - I was actually desperate for any job.

</comment><comment><USER26> Obviously a throwaway.

I worked at a Series C startup in the Bay Area as an architect. I made about 450K in total cash comp + lots of options.

Some of the executives were clearing over 500K a year in cash.

<comment><USER27> How did that turn out?

</comment></comment><comment><USER28> 200k US$? I am from Germany, currently working in a company and studying at a university (both in the fields of computer science). To be honest, I never thought about how much I wanna earn in 5 or 10 years, but 200k US$ is super high.. Or am I missing something? I don't know how the US tax system works, but is this, what you can spend? Or is it 200k US$ minus taxes? I am kinda confused right know, can somebody help me please? :D

<comment><USER29> Yes, I assume we are talking about gross earnings before taxes.

<comment><USER28> Thank God, already thought about moving to the USA

<comment> et-al In California, after taxes, you take home about 60-70% of your gross income depending on deductions. It's a lot of money, but property in San Francisco is going for at least $800k right now.

If you want a further breakdown on numbers, linkregister and I came up with a fairly solid breakdown a while back for a new grad in SF: [https://news.ycombinator.com/item?id=13009702](https://news.ycombinator.com/item?id=13009702)

Note that $1200 gets you a room in a shared flat. If you want your own one- bedroom apartment, it's probably averaging $2500/mo right now.

The US is still the one of the best places to make a filthy amount of money. For that, we trade job security, healthcare, and decently-priced universities.

</comment></comment></comment></comment><comment><USER30> $350k total with $160k base as CTO of medium sized company (350 employees)

I got a masters degree, started as a junior at a small company and stuck with it for 15 years.

</comment><comment><USER31> There is a difference between the mindset of an employee working for a paycheck and an employee considering the success of themselves being tied to the success of the company.

How much money did the company make because of your contributions? What can you do to make the company worth more?

Are you forming relationships with people outside of the company that will enable the company to hire more qualified people or become better by any metric?

Are you applying your skills in a way that shows others in the company how to do their jobs better?

And so on.

You are not being paid because of your computer programming ability, you are being paid because you can provide worth to the company with this knowledge. If you are unable to find a way to apply these skills the company will keep you on, giving you a chance to find yourself and keep things going but the people that make more money than you are likely the ones that enable the company to make more money.

</comment><comment><USER32> I'm an SRE (Site Reliability Engineer) for a Fintech startup based in NYC my base is $190000, with options + bonus my total compensation is probably closer to $300k. I've mostly worked in financial for large firms such as Lehman Brothers, Bank of America, Citi, and Morgan Stanley. I now solely work for fintech startups. My career started out as a traditional system administrator working on large Sun Solaris servers (2000 - 2006), I transitioned over to Linux (2007+) then picked up some Java, Python, SQL and I'm now learning Go and big data (Spark) and have a strong background in networking. I primarily get paid to automate and scale infrastructures these days -- my background is that of Google's definition of Site Reliability Engineering, 40% Code 60% infrastructure.

</comment><comment><USER33> Not over $200k but just for a point of reference, I'm close to where OP is at with maybe ~half the industry experience (non-manager). Not at GoogAmaFaceAppleSoft. I imagine I could possible get more at one of those.

</comment><comment><USER34> IC full stack 180k(base)+40k(bonus)+50k(rsu). Did not switch a lot of jobs. This is not the highest salary offer I received, but I liked the tech stack so chose this one.

Didn't negotiate or didn't get them into bidding war to get this salary. I thought I'd maintain good terms when joining them so didn't share my other better offers.

But in bay area, these numbers don't make any sense. I pay about $3000 in rent and $2000 in tuition fee as the school district sucks. So in reality my salary might be equivalent to about $100k in any other places.

</comment><comment><USER35> Side question: What is the current average rent per apartment in SF/SV? What's the current average income? This report from 04/2016 states around $118k/year for income, probably base, and $4,5k rent: [https://www.bloomberg.com/news/articles/2016-04-05/san- franc...](https://www.bloomberg.com/news/articles/2016-04-05/san-francisco- tech-firms-see-workers-flee-from-4-500-rents) \- What do you think - still up to date and realistic?

<comment><USER36> With a roommate and no rent control monthly cost is 1500-1800. For a studio ~2500. 1br closer to 3000. 3 bedroom homes for a family are easily 6k+.

If you are young and don't mind living with others or in small spaces you can save a lot here. This usually ends with children where families frequently move to cheaper locales like Austin.

</comment></comment><comment><USER37> Been a Googler for >8 years, currently among top 10% of engineers at Google.

Base: >200K, Total comp (w/ bonus + RSU): >500K

Total comp number counts RSUs which are going to vest in 2017, at the current GOOG price of 825+. If GOOG tanks, total comp would go down accordingly.

Didn't have to do anything special, neither I am a rockstar/ninja like Jeff Dean or Amit Singhal - just worked hard, made sure to be on a team with good people, avoided bad managers (lots of data sources within Google to figure out who is a good/bad manager).

<comment><USER38> Mate, Care to elaborate? I got offer from goog but something seemed off about the manager. He is of Indian origin. I have offer with total comp of 1/3 of what you make. But, I want to make sure that I am on right team and right manager. What are things to watch out for good/bad managers?

<comment><USER39> If you think a manager being of Indian descent is a relevant detail, you're probably not a good fit for Google, or any software company really.

</comment></comment></comment><comment><USER40> Senior eng in big 4 can easily earn these money...(or in bank sector)

<comment><USER41> Probably don't even need to be senior for +$200k total comp at Big 4.

</comment></comment><comment><USER42> SWE at Post IPO in SF, Currently making (~150K Base) + (~200K from stock option proceeds at current stock price) + (~20K from RSU bonuses) = ~370K but will vary based on stock price fluctuations.

I got pretty lucky honestly. Joined a pre-IPO company at a good time so I ended up with a relatively low strike price. People I know who joined only a few months later make a fraction of what I do from their options because the valuation went up a lot shortly after I joined. Company went public 1 year after I joined.

</comment><comment> throwaway-vamoo Bay area, early 30s, making $200k base at non-public ~200 person company. I was an early engineer at the company and have done significant work that has directly contributed to the success of the company.

Get good at what you do. Try to maximize the direct impact your work has to the company's bottom line. You are more likely to be compensated well when you are working on a core product.

Once you have demonstrated your value you can ask for more (don't be afraid to ask if you think you deserve it).

</comment><comment><USER43> Around 400, depending on the yearly bonus. Programmer at one of the big tech companies, 10 years. As best I can tell I got here mostly by doing my best to solve whichever problems were most important for my team. I feel pretty lucky. I never worried much about compensation and have never negotiated or asked for raises nor have I been forced into management. I think there are others who have done exactly what I have done and haven't been rewarded as much.

<comment><USER36> I don't think it's luck that this happened to you. All companies with HR departments that care about attrition should compensate their employees fairly. If you weren't, I suspect you would have left.

Contrast this to a small engineering firm my friend worked for with high turnover. Skills and contributions had little influence in compensation and instead the strongest influence was how much an engineer initially asked for.

</comment></comment><comment><USER44> Let me ask the same question a different way. How do you make more than $150K outside of California or New York in another (cheaper) city that is known for good tech jobs?

I'm thinking about a city on this list that is not on the West Coast?

[https://www.glassdoor.com/blog/25-best-paying-cities- softwar...](https://www.glassdoor.com/blog/25-best-paying-cities-software- engineers/)

</comment><comment><USER45> I make $250k as the CTO of a smallish company: 50 to 75 employees, 10 of those software engineers. I work primarily remotely.

</comment><comment><USER46> Specialised, specialised, specialised. Then networked, networked, networked. Now consult and contract only. Work is usually okay, but my real enjoyment of tech happens outside of work hours now.

<25, outside US, no-remote work only.

</comment><comment><USER47> Staff level at Google/Facebook/LinkedIn will give you ~200k base + stock + bonus without being 'specialized' like others claim here. E.g. for me at Staff level it's 200k base (>400k total with stock and bonus for last year) with ~5 years working as a Software Engineer. As a Senior at these companies you'll likely max out at 180-190k base but with stock + bonus you easily break 300k after your stocks starts vesting. The stock based part of your salary will increase more and more the higher your position gets. E.g. from the salaries I know it's perhaps 20-25k more base salary per level but the amount of stocks you get each year (or at offer time) will increase by a multiple of that while also depending a lot on how your work is perceived.

<comment><USER7> Of course, google has the highest salaries. If you're a staff at Google I'd expect $200k base. Same if you work in finance. Though, in most of the case you won't make $200k/y base salary with 10 years of exp in "java" or anything related to java technologies. Except if you're at the big 5 + financial/stock market related companies in NYC.

There are way too many people doing Java... It's easy to find and most of the contractors do java.

<comment><USER47> Even at series A+ startups 180-190k base for 10 years of experience is not that unusual and if you get less in SV I would assume you should get a pretty big part of the equity. No matter what I wouldn't count stocks/options in these cases and there's likely no bonus. But you see that even then it's already pretty close to 200k. So at least in SV I would say this is pretty standard for at least the top 10% of companies and likely much more pay this.

Edit: I general I think people complaining about the high cost of living really don't know how much you can earn here in SV after working a few years for a company. Especially equity gets underestimated by most people and it's comparing 'normal' salaries with base + perhaps a small bonus with the salaries here in SV which are after a while mostly based on stock (at least half of your salary often more after a few years and as long it's a publicly traded company that means real money not fake hopes). The houses cost much more here if you don't waste salary it's not that hard to safe for it especially before you have kids. And as soon as you're in the game with some property you have a great salary and fixed costs for your housing situation. I would n't bet on it but it likely also appreciates in value much more than anywhere in the US which is a nice side-effect. Just wanted to add this to make it clear that I think it pays to be in SV salary + experience wise and outdoors in general are amazing here so the quality of life is pretty nice here if you get into one of the growing companies or found your own after you saved enough.

<comment><USER47> Also there is a difference between 'doing Java' and being a Software Engineer writing code in Java (or whatever other language makes sense or makes you happy). For sure you can find people 'doing Java' but I wouldn't allow them to commit a single line of code into anything I care about or want to be associated with. It's not about how much code you produce (which 'doing Java' sounds like) but what quality you produce and how little code you write to make your project do what it should do. That's exactly where these two kinds of people differ. With 10 years+ I would hope a developer is in the second part and wouldn't hire someone still being in the first one.

</comment></comment></comment></comment><comment><USER48> Solopreneur here. Made $445K in gross revenue in the last 12 months. No employees, just a customer service contractor. Gross profit is around 85%.

16 years of experience as a developer, 2 years of experience running a company.

</comment><comment><USER49> I live in Montreal and make 95K CAD. 10 years java. Not a startup.

</comment><comment><USER50> graduated in 2009, found a sales job on craigslist at a startup, startup was invested in by Google, worked in another startup, got recruited by facebook, gg

</comment><comment><USER51> From the other side of the table, anyone who is a big name in Deep learning will fetch big bucks (if we can afford it).

</comment><comment><USER52> Facebook and Google pay 200+ total yearly compensation to most engineers with over 2 years of experience.

</comment><comment><USER53> making 220k base salary, as an architect in bay area - about 20 yrs in the industry, 5 here in bay area - java/hadoop etc etc

</comment><comment><USER54> Damn, I should have gone into software instead of hardware.

</comment><comment><USER55> It's really not very hard to crack 200. Finance and top tech companies all pay this

</comment><comment><USER56> #following</comment>


Unfair advantages grow from irrational habits - <AUTHOR> http://thestartuptoolkit.com/blog/2012/01/unfair-advantages-grow-from-irrational-habits/ <comment><USER2> It may not be evil but it is really stupid, because it means Google results no longer give insight into the structure of the web (things like normalized google distance can't be trusted, for one).

What they could have done instead is personalized Gmail's spam filters, so that I could actually train the thing. But no, lots of false positives that don't respond to training. (Personalized spam filters are the only way to beat spam, since a dedicated attacker can't test against the filter with dummy accounts.)

</comment><comment><USER3> Honestly, no. Not here in Italy, at least. "once you're 10 years into your startup career, as he is, you have access to all the same incredible resources" - what is going to give you those "incredible resources" you're talking about? Time?

I've seen too much to believe that you can be a successful startupper without some kind of external help. And that external help, at least here, it's not something you can gain - it's something you're born with. It's your family, it's the friends of your family, it's the connections your family has, it's the connection you were able to build because you went to an expensive school, paid by your rich family.

Again, I'm not saying that in the US things work the same way. In Italy they certainly do - Startup Chile is/was kind of a failure for the same exact reasons. The commenter has its rights to complain about those guys who had a huge headstart if they act like they didn't.

<comment><USER4> Then why are you still in Italy? Entrepreneurs don't whine about how things can't change, they figure out how.

<comment><USER3> I'm not an enterpreneur and I don't want to be one.</comment></comment></comment>