Why Henry Kissinger Is Wrong That AI Is "How the Enlightenment Ends" - <AUTHOR> https://www.skynettoday.com/briefs/kissinger-ai <comment><USER2> on a slightly different tangent.. if a small group of people successfully develop an AI to sucessfuly perform some task such as driving vehicles.. and it is so successful that it becomes the standard for all cars, when it makes decisions that no one can understand, how are its actions accounted for and is it not therefore possible that because only a limited number of people were involved in its design that it may not (by its actions) represent what a democratic society would normally be happy with regarding its decisions as there has been no option for review and debate over what is important to the majority of people and no chance for open review of the software because it is not open source.</comment>


Coding Freedom: a review - <AUTHOR> http://esr.ibiblio.org/?p=4781 <comment><AUTHOR> Maybe ESR thinks he should have been consulted before publishing?

The "ritualized" nature of mean comments on bad code seems to be in evidence on HN recently.</comment>


Github is Your New Resume - <AUTHOR> http://code.dblock.org/ShowPost.aspx?id=232 <comment><USER2> I don't want to take the time to build it, so here's a silly programming project for an afternoon:

Build a bot that can simulate an open source genius via a classic academic technique: Plagiarism.

The algorithm:

Use Github's API and/or Google to find some popular repos.

Fork those repos into a new Github account named (e.g.) "Nicolai".

For each repo, find some other forks of that repo. Grab some branch names and commits from those forks and commit them to Nicolai's fork, under Nicolai's name and with a few Nicolai-specific changes here and there, to commit messages and perhaps to code comments, to obscure the trail. Sprinkle in some choice text from, e.g., Zippy the Pinhead, the Tao te Ching, random comments from Stack Overflow or Lambda the Ultimate... whatever.

Scoring:

For every recruiter who emails Nicolai with an opportunity: one point.

For every interview that Nicolai gets offered: ten points.

For every job offer that Nicolai gets: one thousand points.

<comment><USER3> I fail to see how that is any different from someone lying on their resume.

If the hiring manager is too stupid to be able to detect the person is lying about their skill level after a 15 minute conversation, caveat emptor.

<comment><USER4> Lying on your resume is an explicit attempt to deceive a prospective employer.

Lying on Github (and then presumably not using it on an actual job application), you're only fooling those who are willing to be fooled.

If someone is going to scrape data off the web about people and evaluate it for prospective candidates, the burden of separating the signal from the noise is on them, the internet is full of bullshit. You're obviously mucking with their process, but you didn't ask to be included in it either. No different than assuming all the content on blogs isn't plagiarized and then trying to use that to proposition people to be authors.

</comment></comment></comment><comment><USER5> I recently interviewed at a Fortune 100 company's new "Innovation" group. I pointed them to the various projects I have on Github as examples of my work. They reviewed it and liked what they saw.

However, my interviewer told me "we've seen your code on Github. It's great, but just so you know, you won't be able to keep that up if you work here."

I asked more about what he meant by this and he told me that the company is extremely secretive and would not allow me to post any code to Github. Some other developers had already been told to take down some (very general, non- proprietary) code they had posted to Github.

What came out is that my public work on Github helped me _get_ an offer but I wasn't going to be able to contribute any new code during my years at this company.

I certainly don't want a three-year blank spot in my public code "resume", so I turned down the offer.

This is a bit of the tangent from the OP's point, but I think its related: Companies need to realize that the benefit of allowing employees to contribute to open-source isn't merely getting the community to work or review your team's code, but rather, open-source is a marketing and recruiting tool.

Say you let your employees create and maintain open-source software. Say it is successful and other people start using that software. If it used widely enough, your employees are asked to speak at meetups and conferences and say "Look at this great software I built while working at company X. Company X is so cool, come work here!" (and every contributor to the project becomes a potential employee who will already know a portion of your code.)

tl;dr - Companies: allow your employees to freely work on open-source and it will improve your recruiting.

<comment><USER6> _Companies: allow your employees to freely work on open-source and it will improve your recruiting._

Apple barely lets their employees blog even, and last I checked they're doing OK by all counts.

Unfortunately, the intersection for people who are passionate about their 9to5 work and those that are passionate about their side-project seems to actually be fairly small.

<comment><USER5> So I agree with you in the case of Apple. But let's dissect for a minute why this is the case.

Apple can be incredibly secretive and still hire with no problems because

1) they are literally creating world-changing products and people want to be involved with that

2) they have a reputation for hiring extremely bright people. If you take a job at Apple you will interact with them (/ be one of them)

But outside of the big technology names (msft, google, fb, etc.) there's a huge collection of companies where either a) the brand is known but the company isn't know for being an innovative place in the hacker community or b) the company isn't known and neither is the team.

In both of type (a) and (b) companies you hear a lot of moaning from managers right now about how they can't find any good folks to hire.

So I'll qualify my advice a little bit: _If_ you find you're having a hard time finding "rockstar-ninja-l88t programmers" by posting to Monster.com, maybe consider that you're approaching hiring in the wrong way.

</comment></comment></comment><comment><USER7> What about:

\- those that use different VCSs?

\- people who don't have the time (due to their job or other circumstances) to work on things they can open source?

\- people who work at companies that essentially own everything they might do so you can't work on open source? and

\- companies where hiring goes through HR who won't know what the hell Github is?

Having work on Github is probably a good idea for college students and recent grads but once people are employed it's value drops off significantly (IMHO). From a hiring perspective, you're also greatly limited your field of candidates if you only look at Github profiles.

<comment><USER8> Regarding different VCSs, the point is that code is the new resume and Github happens to be the most popular place to find it. Links to bitbucket, sourceforge, google code, etc etc are all equally valuable and would have the same impact.

Personal time commitments are understandable, but I feel like they are just an excuse in 90% of the cases. As 37signals puts it, "No time is no excuse". If you are serious about improving your abilities and buy into the craftmanship model at all, you can surely find a few hours of month to work on something, anything. Trade an hour of TV watching for an hour of writing your own blog engine or a Todo list app. Or write something to improve some small bit of your life (a program that emails you once a month to remind you to take your SO out for a nice dinner), put that on github. Don't make it out like you have to write the next Rails or jQuery to put code online.

The rest of your issues are largely related to workplace culture.

If you work at a company that uses any open source code (and I know there are some cases that don't due to federal validation and redtape etc etc), you have probably found a bug at some point. Put in an issue on github - send a pull request if you feel ambitious or if you had to monkeypatch the code for your project anyways. I have a feeling that people that work for closed/IP-hungry companies will go to the same kind of company when they change jobs. And that is fine, for some people software is just a job; but those are not the kind of people that read HN or software blogs anyways.

I know you are probably playing devil's advocate here, but every time someone posts about why developers should have side projects or github accounts, these points all get brought up and it bugs me.

<comment><USER9> You're expressing a prejudice here and advocating discrimination based on it. It seems ideological. You're saying "Don't hire people if they don't contribute to open source projects." You _assume_ they are watching TV, rather than, say, working on an iOS game that they are selling.

Resumes are for deciding who you're going to interview. If github is the new resume, then you're not going to know about the side projects.

<comment><USER8> I don't want to turn this into a game of forum post logical proofs.

I don't advocate "don't hire if no OSS". I work with smart people that get stuff done and don't have a Github account. That's fine, it's a personal choice how you use your time.

What rubs me the wrong way is when people say "It's unfair to look at Github as the new resume because I don't have enough time to do open source". Like I said originally, I'm sure someone is going to come along and post about how every hour of their day is being used for meaningful activities, but for the majority of people _I_ don't think that's true.

<comment><USER9> People are very different. It takes all kinds. The kind of hacker you are, is not the only kind of hacker there is. There can be very bright, excellent engineers, who spend their entire off-duty time watching TV. They don't have a duty to contribute to open source software and choosing not to does not tell you anything about their skills as an engineer.

I remember once a new coworker telling me -- on his first day, no less- that he didn't have a computer at home. He was proud of this. He was a new CS graduate, and for him, computers were not an interest, at all. It was just a job. I asked him what he was into, and it was sports, naturally.

I didn't like that, it rubbed me the wrong way. I probably would have given him the thumbs down if I'd been in the hiring loop then.

Turned out he was a good engineer. Better than that, the sport he was into was one I got into as well and we spent a fair bit of time over the years in our off hours far away from any computers.

<comment><USER10> Let me guess - Brazilian Jujitsu.

</comment></comment></comment></comment></comment></comment><comment><USER11> A big problem with github-as-resume for the experienced developer is that it destroys the idea of side-projects as play. I can no longer just fool around with something for the sake of fooling around with it. I now have to judge whether my "fool-around" project is good enough to go on github and be evaluated by potential hiring managers. And if not, I need to ask why I'm working on it, rather than working on something that I'd want a hiring manager to see.

Moreover, everything I put out there now needs to be of professional quality, including comments, code organization, adherence to conventions, etc. And from the beginning, because hiring manager might look at logs and frown upon the fact that I inserted a bunch of comments, and cleaned up a much of memory leaks, two days before I applied for the job.

For a side-project in a technology that I use at the office, this basically makes side projects the same as work. Which is going to lead to burnout really fast.

For a side-project in a new technology, I'd be much less inclined to take my time to learn something new. My first few attempts at writing something in a programming language I'm learning are invariably something I don't want anyone else to see. But again, why would I take time to work on something that I can't put on github, if that's how I'm being judged?

<comment><USER12> Excellent points. If github-as-resume becomes commonplace, we can expect to see lots of methods for gaming it, as Goodhart's law would predict: <http://en.wikipedia.org/wiki/Goodharts_law>.

</comment></comment><comment><USER9> One of the key motivators that made me start my own company was this kind of nonsense. Poor managers, having made bad hiring decisions, are always looking for some way to short circuit the process. The entire recruiting agency industry exists for this very purpose (and look how little they know about engineering!)

This does provide a very useful feature for confident, quality engineers: Whenever someone asks for your github ID as part of the hiring process, you can say "Next!"

Seriously, you're an engineer. You can be choosy. And signs of pointy-haired boss syndrome are a good way to choose.

This is one of them.

The correct way to interview someone is to have a stakeholder in the business, who is a competent engineer, look thru the resumes, pick the ones they want to meet with, and bring them in. Talk to them, one on one, for about 30 minutes. (You should know after about 5 minutes, but you want to give them more time so they don't feel like they're being brushed off if you aren't willing to give them the job right then and there. Also, be ready to make an offer, or tell them you'll be making an offer, right then and there.)

If your startup doesn't have a stakeholder in the business whose competent enough to do this, then you still need your technical cofounder. Your technical cofounder cannot be "too busy" to interview engineers.

<comment><USER13> Frankly, I think you're out of your mind.

You should hire people based on absolutely as much useful information as you can ethically get your hands on. Why waste the information in a person's github profile?

Resumes suck, and are damned near useless. Bringing people in based on resumes wastes your lead engineer's time because the % hit rate on them will be very low. You will, at the very least, need to phone screen somebody that you only know from a resume, a process which takes a surprising amount of time.

Talking to people is totally useful, and necessary, but not sufficient. It's prone to passing bullshitters (esp since you have your best _technical_ person interviewing) and useless smart people (who don't get shit done), and to failing good employees who don't speak well or are having a bad hair/brain day or are very nervous.

When you go to hire, use all the information you can. Look at their github, interview, have the person write code, have lunch with them to see if they get along with the team. Don't fail them for missing any one part of the interview, but take it all into account.

Especially in a small team, you're making an decision with an enormous impact on the future of your company which is difficult and painful to undo. Don't waste any information.

<comment><USER9> I find it interesting that you presume the hit rate on bringing people in based on resumes would be very low. I can tell a good engineer from a bad one, pretty well, using resumes.

Phone screens, however are a waste of time. It is difficult to establish rapport with someone over the phone, for both parties, and I've seen some people actually ask programming questions over the phone.

One very good engineer I hired, back before I was running my own show, did terrible on the phone screen.

I brought her in, though, because I saw something in the resume. She's asian and had a real problem talking on the phone, but eventually got the job and was great.

You are making a decision with an enormous impact. Therefore, it is critical that you do it based on a truthful assessment of the candidate-- not ideological prejudice.

<comment><USER14> I once was given a phone interview because a friend of mine knew the hiring manager. The manager really didn't want to waste time with me, he said, because I had just graduated from school, and thus I couldn't possibly be useful to him.

But at my friend's insisting, he gave me the interview, and summarily dismissed me.

A few weeks later the manager was fired from the company for some sort of unprofessional behavior, and replaced by someone who had just graduated from school.

<comment><USER9> I'm not sure the point you're making, but I should have said "phone interviews, _at least for me_ , are a waste of time."

I would have brought you in face to face... a recommendation from someone already working there is a very valid positive signal.

</comment></comment></comment></comment></comment><comment><USER15> There are two issues with this.

1\. It excludes developers who have managed to find jobs that are sufficiently challenging, difficult, and interesting that their jobs keep them fully occupied, and so they simply do not have the time or energy left over to contribute to a bunch of open stuff on Github.

2\. What happens after you hire someone? Do you have any policy to ensure that the job won't take too much of their time, or won't be too challenging and interesting, so as to leave them the time and energy to continue working on various open stuff on Github?

<comment><USER16> I love Github, but I certainly must agree with point number 1. I work as a CTO at a start-up here in SF full-time (which means, 8am-2am). We have to a lot of developers and designers around the world which means when I'm not coding, chances are I'm managing. This leaves me very little time to contribute to my own personal projects, much less open source projects.

I'd say that using Github as a resume is a great idea for Jr. Developers and students looking to get some "cred" in the real world. But that really just refers back to knowing your industry and being professional about your work.

<comment><AUTHOR> Everyone missed the part where I found myself contributing to several open- source projects, naturally.

Here's an example: we use this gem called "analytical". Its configuration didn't support test vs. dev vs. production. I could have hacked on top of it - it would have added some gross code to my project. Instead I changed the original - turned out to be less code overall and didn't pollute anything in my work project. My pull request (<https://github.com/jkrall/analytical/pull/17>) still hasn't been accepted, but we use the fork.

I just think that the reason you're not contributing to OS is not time, it's that you choose to design within the box.

<comment><USER17> Interesting considering he works from 8am-2am. How on earth do you come to the conclusion he's not contributing to OS because he chooses to design within the box?

</comment></comment></comment></comment><comment><USER18> this may be true in startup land, where hires are evaluated by the engineers/managers/founders but it's absolutely not the case in the world of BigCorps. many recruiters (including internal ones) are less technical than anyone would like and have to operate on looking at key words in a resume before deciding what to pass along to managers. a github account with a bunch of code in it would be so confusing they'd just move on.

if you're looking for work, it's worth knowing how to put together a good resume just so it gets you by the HR department.

i've also had experience where i was required to write (non trivial) sample code with my application, only to find out months after i started the job that nobody even looked at it.

code samples and projects are great to have, and especially helpful if someone cares, but the resume isn't dead yet.

<comment><USER19> Maybe a better title would be "Github is Your new Resume... At Progressive Companies With Strong Engineering Organizations."

I think Daniel nailed it.

<comment><AUTHOR> Thank you. I wasn't writing about dinosaurs :)

</comment></comment></comment><comment><USER20> I like the idea of GitHub as a resume, but most of the code I drop in GitHub is closed source and I don't spend a lot of free time hacking on other people's projects. So, while a GitHub resume is a great idea if you do a lot of open source hacking, it is not nearly as useful if you are working on private code.

<comment><USER21> Yeah. I mean, accountants and lawyers don't publish accounts and cases they've worked on pro-bono do they?

<comment><USER22> not yet but I think as far as making use of the web, devs are on the early start of a trend. Think about blogs, they were widely used in the tech community before mass adoption, now my mom even has one. I suspect you will find more and more industries figuring out ways to share their professional experience online

</comment></comment></comment><comment><USER23> _So do yourself a favor and move to Github!_

How, exactly, would i be doing myself a favor with this? I'm not such a big fan of git and i avoid github on moral grounds[1]. Other code hosting services work great for me and i see no reason to switch both my hosting and my VCS.

I don't disagree with the argument that your code should act as your resume, but it could have been worded a lot better.

[1] I can't in good conscience support the guy who posts things like this routinely: [http://dev.pocoo.org/~blackbird/github-vs- bitbucket/bitbucke...](http://dev.pocoo.org/~blackbird/github-vs- bitbucket/bitbucket.html) and <http://whygitisbetterthanx.com/>

<comment><USER24> Wooooow. I already wasn't a fan of Git or Github, but those links are vomitous.

"Waah, they copied us!" Maybe. "PLAGIARISM!" Not so much.

</comment></comment><comment><USER25> No, github is not your new resume. Remember the post from Marco? You need to own your identity[1]. You do not own your github account.

If you really want to show that you are a good coder, you need your own website as a central point with aggregation of your information from other sources. Github is really nice, but in 5 years, they may have sold themselves to BigCorp for BigMoney and the BigCorp could completely destroy github.

Be it github or the next "cool company", do yourself a favour, build your own site at the centre. Of course, you can open source the code on github or the next cool git/svn/hg hosting company too. Double win.

[1]: <http://www.marco.org/2011/07/11/own-your-identity>

</comment><comment><USER26> Along these lines, David Coallier created a tool to generate your github "résumé" awhile back: <http://resume.github.com/>

As unshift mentioned, the entire development community is not quite at the point where a github account can be used as your go-to résumé, but it is certainly becoming more and more useful in the job market.

<comment><AUTHOR> cool, thanks for mentioning resume, I've never seen it!

</comment></comment><comment><USER27> While this works for freelancers/students/startupers, it doesn't work very well for people working in bigger companies. If your interests are related to your day job, I think it's quite risky to put your code on GitHub, even if the code is not "official". While I do have a GitHub account with some code in it, that code is not really representative. If having a relevant GitHub account becomes a pre-requisite, you may be overlooking some good people.

<comment><USER28> > you may be overlooking some good people.

Every heuristic overlooks good people.

This heuristic has the advantage of having next to no false positives, even though it allows for lots of false negatives. Given that false positives are absolutely disastrous while false negatives are merely unfortunate, it's a trade-off I'm happy to make.

<comment><USER27> I guess the majority of repos are either bigger and useful open source projects or just small toys. If you're looking at somebody with repos from the first category, most likely his resume will mention "author/ contributor to project X". For the people in the second category, only thing you'd infer is that they can somewhat code. Which you could assume as well if they worked on any delivered project. There are obviously exceptions in both cases.

</comment></comment></comment><comment><USER29> GitHub in particular is problematic for those of us that don't particularly use Git, and use other hosts for their code.

Something like ohloh is much better suited to being a CV.

<comment><USER30> If you're using Mercurial instead of Git you can create a mirror on GitHub with little effort (unless you're doing something pretty crazy with your DAG): [http://hgtip.com/tips/advanced/2009-11-09-create-a-git- mirro...](http://hgtip.com/tips/advanced/2009-11-09-create-a-git-mirror/)

This also lets git users contribute to your project, so you get the benefit of GitHub's community without having to deal with git.

<comment><USER24> Interesting, but this doesn't address the other problem--I fundamentally dislike Github! (I use Bitbucket because of consistently stellar support from Atlassian and an overall pleasant working experience.) And going outside my current, working ecosystem for benefits I consider dubious at best--the overwhelming majority of open-source projects get no outside commits, ever, and magic Github pixie dust doesn't really change that--isn't really a good use of time.

For me, Git and Github are both problems with this "GitHub's your resume" thing, not one or the other.

<comment><USER31> I'm sure a bucket full of your source code on bitbucket will serve the same purpose when interviewing. I'm on the job hunt and in interviewing with some YC startups we haven't really gotten to my github, since they more were interested in some of the closed-source projects I've done at other jobs. I think the overall point of the article is to be able to show people you can code rather than just list it as a bullet point in a document.

<comment><USER24> The assumption, however, that everyone uses Github results in processes having a dependency on Github. Which is stupid.

<comment><USER32> We use github, but have a fallback server.

<comment><USER24> Sorry--I meant social processes. If the mindset is that "Github is your resume," then the focus is that _Github_ is your resume, and the line of thinking goes, so to speak, "if it's not on Github, they don't have it." Which is not good.

While social networking makes sense to have a single central location makes sense (but not totally so, see G+ v. Facebook), writing code does not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> I recently started a new job and their recruiter found me through my Github profile. Aside from that, I put my Github link on my CV and have for a while.

Additionally, when I am interviewing others, I always like to see a Github link or will Google them to find a Github account. Even though people may work a lot in closed source, it is interesting to see the activity history, to see which projects they've forked, patched, written, or contributed to.

It sometimes varies based on the community you're in, but the Ruby community is very collaborative and sharing contributions. Even when I've worked in largely closed source codebases, I'll still encounter bugs in other libraries, fork them, fix it, and send a pull request. Those all show in my repo list and activity feed.

</comment><comment><USER34> I don't use a public Github because my interesting code often isn't something I want to share with the public, particularly if it happens to include AWS credentials, API keys to various services, etc. All my most interesting sites have been money making endeavors as well, so I don't see any reason to give away the source code, or share it with the public. I do share the URL of the finished product, though, and that has been enough to land me quite a number of job offers, including the one that led to the startup position I am filling right now.

I've never made a traditional resume, and I've never made my code publicly accessible on Github but I've gotten along fine.

<comment><USER35> You should really be factoring out sensitive information from your repos anyway.

</comment></comment><comment><USER36> "Your first job should be at an organization that embraces open-source and lets you contribute to existing projects. Other companies simply don't deserve you."

Oh, I had to laugh at that. Good luck explaining that one to the wife. I'm sorry honey, the pay way great, the benefits were good, there was an excellent health plan and even a stock buy-in option.... if ONLY they had agreed to embrace open source so I could work there.

<comment><AUTHOR> You're implying that a company that encourages open-source contributions sucks at pay, benefits, health plan and stock. You should know that generally startups, which by definition encourage more open-source contributions, have comparable pay, benefits, health plans and stock after their first round of financing. There's more risk in theory, but the numbers since the financial crisis are against this theory.

</comment></comment><comment><USER37> I wonder if programmers are going to overwork themselves at some point.

Judged by programming OUTSIDE of work time. Not having free time to do this is not an excuse.

gf/bf/wife/husband/son/daughter/parents/dog/cat/friends/life will have to understand that you need time for your craft.

I currently have time to do programming in my spare time, but I worry that in a few years my time won't be as free.

<comment><USER38> What is wrong with only programming 10 hours a day?

<comment><USER37> I was actually being sarcastic, except the first and last sentence. I should have been more clear.

</comment></comment></comment><comment><USER39> If that was to become true, it'd be great to be able to curate your profile. At the moment your repos appear in order of newness, and an unchanged fork of someone's repo could be the first thing potential employers see.

</comment><comment><USER40> > College and Personal Projects

At the risk of stating the obvious, I'd strongly recommend against putting school projects in a public repo. You might disagree with the ethics of it, but if someone submits your code to your own school, you could conceivably be held responsible for facilitating plagiarism.

<comment><AUTHOR> I am shocked. What kind of pojects are those? Does anyone believe that students were waiting for this "internet" thing to share source?

</comment></comment><comment><USER41> At first I thought "No, LinkedIn is my New Resume."

But then I realized neither are. Because when a recruiter wants a resume, they want to see a concise document that details exactly how your experience matches their job requirements. Github can't be that because it would require that (probably non-technical) recruiter to slog through a lot of stuff to get to what they want to see. Which none of them will actually do.

</comment><comment><USER35> I put my stuff up on Github in part because I like being part of a community. It also has the nice side effect that it shows that I'm intellectually curious and like trying out new things. If someone is looking for a new hire with those qualities, it'll be a big benefit.

If they're not I don't really want to work there to be honest.

</comment><comment><USER42> I certainly believe this to be a trend. I have been interviewing with different startups and they all have seemed to respond more to my github page than my resume. They all want to hear about personal projects and your thought process through them. Maybe I'm biased towards startups though.

</comment><comment><USER43> I use zerply. The name is terrible but I like their service and don't see myself updating my "traditional" cv in the near future. That could change but I'll resist it.

Might be a nice recruiter filter too. If you tell them you don't have a resume and point them at your github or whatever else and it's not good enough you probably dodged a bullet. If they are fine with it then perhaps you found the proverbial needle in the haystack and could give the recruiter a chance.

</comment><comment><USER44> Github[0] gives Junior developers another way to get an interview. Those with minimal professional experience are able to show - to some degree - that they can code, use a VCS and have an understanding of the push/pull/fork contribution model. Bonus points for contributions, bug reports etc.

I don't believe it replaces one, but for those without a well-seasoned resume, a Github profile works well as a conversation starter.

[0] Or any public VCS, of course.

</comment><comment><USER45> Anything that can quickly prove you are awesome can be your resume. TopCoder, your LinkedIn profile, the list of hacks and demos that you've put together yourself, I think they all fit this category.

Did you create some awesome project on GitHub (or on any other CVS for that matter)? Then you have something to show off.

But none of them in themselves will help you get hired. They will maybe help you get to the interview.

</comment><comment><USER46> Not in my experience. Most job boards are dominated by technical recruiters so, to get in through them, you play by their rules.

In their world, web presence of projects almost never counts. The rationale is that "anyone can point to my work and claim they did it." The preference for assessment is still resume keywords, good references, and multiple choice tests.

<comment><AUTHOR> There's a huge trend of engineering managers to take things in control to avoid this. Every time I had an HR person between me and a candidate they managed to screw something up. Here're some better job boards.

<http://wearenytech.com/jobs> (New York based) <http://careers.stackoverflow.com>

<comment><USER46> I'm liking this trend you speak of but it hasn't reached everywhere yet. I live in the middle of Connecticut and there are 2 companies total that post anything on the Stack Overflow boards. So, the reality of the situation would seem to leave 3 options for people in my neighborhood.

1\. Play by the rules of the local recruiters. 2\. Telecommute. 3\. Move.

</comment></comment></comment><comment><USER47> On a related note, you can actually add your github repo details to your LinkedIn profile via their OpenSocial app. I have found it super useful when looking at people.

[http://www.linkedin.com/opensocialInstallation/preview?_ch_p...](http://www.linkedin.com/opensocialInstallation/preview?_ch_panel_id=1&_applicationId=122233)

</comment><comment><USER48> I had this crazy idea that I'd buy a vanity domain with my name in it. Use it as my personal email, which is used an all kinds of technical newsgroups. Setup a web page where I described myself, linked to various projects, source code, etc. A site that has a better indication of my personality than github ever would, and has some projects that will never go in github for various reason.

After seeing the last one of these articles, I actually put a note on my github site directing people to my primary site. Seems silly that I felt I had to do this, but oh well.

It's also a shame that the last few patches I did, involving smartcard hardware for gnupg, doesn't get me any bonus points, since that project, like a majority of major projects, hosts its own version control. Not to mention, 9 times out of 10 when I open an issue on a github project, I hear nothing back, making me really unmotivated to fork the project and fix something.

<comment><USER49> I did the reverse - had a vanity domain and all that stuff, then just tacked my Github account onto it.

Also, why not find your patches from <http://git.gnupg.org> ?

</comment></comment><comment> wes-exp You're not your Github account. You're not your Facebook account. You're not the car you drive. You're not the contents of your wallet. You're not your f'ing open source project.

I don't espouse the negativity in Fight Club, but the quote that I've adapted seems particularly relevant here.

"Facebook users 'are insecure, narcissistic and have low self-esteem'" [http://www.dailymail.co.uk/sciencetech/article-1310230/Faceb...](http://www.dailymail.co.uk/sciencetech/article-1310230/Facebook- users-narcissistic-insecure-low-self-esteem.html)

I consider Github sort of the developer equivalent of Facebook. Let me clarify that. If you're posting stuff on Github just to impress recruiters and fellow engineers, then it is. If you're using it in a constructive way, less so or maybe not at all. The point I'm trying to make is that there are parallels between the two.

Look. It's good to provide recruiters (by recruiter I mean a real engineer here who is evaluating candidates) evidence that you're skilled. There are many ways to do that. One way would be to bring in code and discuss it. Another way would be to work through programming problems in the recruiter's presence. I'm not talking about "a-ha" brain teasers but real, actual programming. After all, that's what a programmer is (theoretically) being hired to do.

But please do not encourage an arms race where programmers fall over each other trying to see how much code they can post publicly, and how much work they can give away.

I'm highly skilled and my time is precious. I don't spend it looking in front of the (Github) mirror, and I actually charge money for it. Charity is a good thing, but you shouldn't do it to boost your ego and image. And further, if that's all you spend your time doing, I would wonder why you want to work in private industry where the purpose is to make money so we can be employed. You know, engineers at Apple might not have Github accounts, but they are employed and support their families. Apple's work also lifts tons of people out of poverty in China. How many people does your open source project feed?

You guys need to step off the ego train and direct your energy into stuff that actually matters. And you will be happier for it.

<comment><AUTHOR> I actually agree with a lot of stuff here. One should contribute to things that are useful for your job or your future, not spend time polishing your github resume.

</comment></comment><comment><USER49> I came to this conclusion a while ago and tossed Github Badge (<http://drnic.github.com/github-badges/>) on my personal site.

<comment><USER22> cool, similar to coderwall

<comment><USER49> Ah - I just gave coderwall a try this time. Github's authorization prompt is much clearer now as to what I'm allowing access to.

</comment></comment></comment><comment><USER50> Its really only true for startups at this point. I've had plenty of interviews with the interviewer scratching their head when I mention github.

<comment><USER51> I'd be fine working with devs who don't _use_ github, but very alarmed at the prospect of working with anyone who _never heard_ of it (or bitbucket or sourceforge). That betrays a striking ignorance of what's going on in the profession. Actually it might be a decent litmus test, if you have the luxury of avoiding navel-gazing employers.

</comment></comment><comment><USER52> I must be getting old, but this post strikes me as silly to the point of seeming like a troll. If any hiring managers are seriously discarding candidates that don't use github, well, I think the market will ultimately dictate the utility of this shortcut.

</comment><comment><USER53> Exactly what I said over a year ago <http://news.ycombinator.com/item?id=1472985>

<comment><AUTHOR> Ah, but you were waaay ahead of your time! Now someone else (me) stole your thunder ;)

</comment></comment><comment><USER54> If you're using this sort of approach, check out www.gitalytics.com, a site I made to automate this sort of search when I was doing it.

</comment><comment><USER38> No it's not. Github it's a shared repository tool.</comment>


Hitachi says it can predict crimes before they happen - <AUTHOR> http://qz.com/513125/hitachi-says-it-can-predict-crimes-before-they-happen/ <comment><USER2> This sounds like lie detectors and K9-units... not accurate and used to get their foot in the door.</comment>


Open Device Lab, in a suitcase. - <AUTHOR> https://medium.com/p/122f87dac737

<comment><USER2> Awesome to see this becoming a reality. Great story and project website as well.</comment>


Information obesity - <AUTHOR> http://andrewoneverything.com/information-obesity

<comment><AUTHOR> This is related to the issue discussed in the "Did You Hear We Got Osama?" thread, which spurred me to write down various thoughts I've been having for a while.

<comment><USER2> An interesting technique I found:

Create a "quiz" every day. For every article, formulate a question answered by the article that is actually important.

Later on, you can go back to your quiz and review your questions.

However, the most interesting part is that you will learn to instantly recognize cruft you don't need.</comment></comment>


The largest vessel the world has ever seen - <AUTHOR> http://www.bbc.co.uk/news/science-environment-30394137 <comment><USER2> Pretty sure this is the Prelude: [https://www.google.com/maps/place/%EA%B1%B0%EC%A0%9C%EC%8B%9...](https://email@example.com,128.6007412,1879a,20y,270h/data=!3m1!1e3!4m2!3m1!1s0x356ecd6fa8cc1edd:0xc0cad7f7fac90992)

<comment><USER3> Great spot!

The giant pivot-hole in the bow seems to confirm, as well as the size...

<comment><USER4> And the first word of the second paragraph being "Prelude" was a pretty good clue, too.

<comment><USER5> The 'this' the OP was referring to was the vessel in the Google Maps link they posted.

</comment></comment></comment></comment><comment><USER6> That really is an incredible achievement. It's 1/3 of a mile long. Travelling at the speed of sound you'd take 1.4 seconds to go from the bow to the stern. You'd only need 82,000 of these ships to encircle the Earth at the equator. It's 203 times bigger than the largest natural sea creature (a Blue Whale), and more than 3000 times heavier.

Bit of a shame it's dedicated to continuing our use of fossil fuels really.

<comment><USER7> "Bit of a shame it's dedicated to continuing our use of fossil fuels really."

Well, I guess the onus is on us to greatly reduce our use of fossil fuels. They're doing their part to more efficiently meet our demand. We can't help but be happy when gas gets cheap then we can buy large vehicles again.

[http://www.usatoday.com/story/money/cars/2014/12/02/automake...](http://www.usatoday.com/story/money/cars/2014/12/02/automakers --monthly-sales-november-ford-gm-chrysler-toyota-honda-nissan/19760173/)

<comment><USER8> True, but I'd rather another LNG field than another coal mine or crude refinery. As fossil fuels go, natural gas is the least bad option.

<comment><USER7> Unfortunately, companies don't create more LNG fields and fewer refineries because people on the internet understand that it's a cleaner solution. It's about supply and demand. Our choice in the cars we drive has more of a vote.

</comment></comment></comment></comment><comment><USER9> Is it the largest? Longest, yes, but [http://www.oedigital.com/energy/item/571-the-new- leviathan](http://www.oedigital.com/energy/item/571-the-new-leviathan) claims

 _" Excluding any protruding lift equipment, the new vessel will be 382m long [...]. Shell's Prelude FLNG facility [...] will be 488m long. But it is the plan view of these vessels that is the more telling in terms of displacement. Pieter Schelte will be 117m wide, against Prelude's 74m"_

That is 50% wider and 25% shorter. Height, I couldn't find. Prelude is bulkier, though (the Pieter Schelte is a catamaran)

</comment><comment><USER10> Just as amazing as the ship, I'm in awe at the mazes of pipes, scaffolding, cranes, etc. Just think that teams of people had to design and lay all those structures out, and teams of more people had to cut and weld all those together.

<comment><USER11> Also the scheduling of it all; when building ships, there are things which must be done be for others such as welding in parts A,D,L before piece C is installed because if piece C is installed first, parts A,D,L can't be installed due to new physical access restrictions. It's a coordination master- work all by itself.

<comment><USER12> You would think so, but having worked on a ship built at SHI there is still a lot of installing part c, cutting it out, installing A, D, and L and then reinstalling C.

</comment></comment></comment><comment><USER13> I think having a huge plant on a ship means they can staff it with workers from 3rd world countries without worrying about Australian visas, employment laws, etc. It's not uncommon for local miners to earn north of $200k per year.

I was on cruise around Queensland last year - ship never left Australian waters, yet all crew was from Asia and they had a casino on board. Prettty sure it'd be illegal to open a gambling venue like that on the soil

<comment><USER14> >I think having a huge plant on a ship means they can staff it with workers from 3rd world countries

FPSOs in Australian waters are crewed with 100% Australian crews. Unfortunately this means FPSO operators need to deal with the likes of the Maritime Union of Australia, that makes the Teamsters look reasonable.

<comment><USER13> I didn't know that. Is that a law, or just the way it's currently done?

</comment></comment></comment><comment><USER15> Prelude will be the world's first operational FLNG. It is somewhat longer and wider than Knock Nevis, but the fully-loaded displacement will be less. And Knock Nevis was a ship; Prelude is a floating platform that must be towed.

Pieter Schelte is a ship (under construction). It's shorter than Prelude and Nevis but, due to twin hulls, much wider and heavier when loaded (displacement is 900,000 metric tons).

<comment><USER16> The first and probably not the last. It reminds me of fish factory ships [1], where fish are processed at sea rather than being brought back to shore for processing. What's next? Maybe assembling airplane parts while in transit?

[1] [http://en.wikipedia.org/wiki/Factory_ship](http://en.wikipedia.org/wiki/Factory_ship)

</comment></comment><comment><USER17> It would be interesting to know whether the ordinary rules of nautical operation change at a scale like this. For instance, ordinary waves would have no effect at all on something this size (aside from rocking the structure, of course). You could probably be in 10-20' swells and it wouldn't any kind of danger. Rogue waves? A 100' wave would be like normal choppy seas for a small boat.

The scale is incredible. It's less of a boat and morelike a small metal island that's self-propelled.

<comment><USER18> I've been in 80 foot swells on a Nimitz class carrier - tossed it around like nothing. Dented the bow all in - and did some other damage. I realize this is quite a bit bigger but I think you underestimate what the ocean could do to it.

<comment><USER14> Really? Who was the silly bugger that sailed the ship into such weather? I hope the nukes were securely stowed...

<comment><USER18> We got caught in a rather bad storm working our way from South Korea back to Alameda. We were in a rush to get back as their had just been a bad earthquake in the bay area and a lot of people had family there.

As to the second, I cannot confirm or deny.....

</comment></comment></comment></comment><comment><USER19> I know my thinking is probably damaged by the war on terror, but my first thought was "engineering is doable, but how will you secure the thing". It is a nice juicy target. And as the recent events have shown - even small tinkering with supply and demand of fossil fuels can have global consequences.

<comment><USER3> Addressing you and some other grandchild comments:

This is why we have a navy, not to mention the supporting apparatus of land-, sea-, and space-based monitoring of the air and seas.

Unless this thing is placed under a heavily-trafficked air route, attacks from non-state groups are unlikely to succeed, as the divergent flight-path of a commercial airliner will set off alarms.

And state actors would be declaring war by attacking this thing.

<comment><USER20> [http://en.m.wikipedia.org/wiki/USS_Cole_bombing](http://en.m.wikipedia.org/wiki/USS_Cole_bombing)

Divers attaching charges to the hull would be another low-tech way to take a vessel like this down. Low tech mines would probably do a pretty good job too.

<comment><USER21> That was at port, though. This ship is planned to spend 25 years at sea. Certainly a ship carrying divers would have to get close enough so as to be obvious.

</comment></comment></comment></comment><comment><USER22> Just make sure the front doesn't fall off. /s

Seriously though, I can't imagine that maintenance will be very easy on this rig, and you really want your CNG plant to be well maintained and inspected

<comment><USER23> Well, that's not supposed to happen.

</comment></comment><comment><USER24> The Browse Basin project was originally going to be onshore - until the traditional land owners wouldn't release the land for somewhere in the tune for $3B AUD. Coupled with the budget blowout for the Gorgon Project building large LNG facilities in Australia will likely not happen again anytime soon.

The Prelude has had a lot of Australian engineering input but based on my experience working on the maintenance side with other FPSOs (especially those of Korean and Singaporan manufacture) there will be a lot of headaches with the Prelude.

Integrity control is at the top of the list for the Prelude design, but this may go the way of the Gorgon Project in terms of budget once they get it to the field. Last I heard there are still some issues with the field development side of things so even if they finish the vessel in time, it may be a while before production is able to go.

<comment><USER25> The way I understood it, the traditional land owners were all too happy to get the jobs and royalties associated, but were overruled by out-of-town activists. Is that true or false?

<comment><USER24> I've heard a number of different stories on the matter, none that I'd want to perpetuate too much.

It was more economical to build the world's largest vessel and develop a lot of new technology than to deal with the issues involved with an onshore facility - interpret that however you'd like.

<comment><USER25> Well, in my book, it's a devastating loss for economic development of people in dire poverty and the associated social issues that come with that. Regardless of how it came about.

</comment></comment></comment></comment><comment><USER26> Compared to the Titanic, it's almost twice as big! (Titanic: 269m vs Prelude: 496m)

</comment><comment><USER27> For a good related time, please google for the skyscraper index by Andrew Lawrence. The TLDR is in a boring commodity market like skyscrapers (... or boats?) you always get the "worlds biggest" right before a financial collapse.

Anecdotally Parkinson's theory about fancy buildings mean a company is dying hold true across my decades of telecom experience. So if you look at this as the fanciest boat ever made not just the largest, Parkinson's theory applies and that corporation is doomed.

<comment><USER28> Of course you will get the "worlds biggest" before any sort of collapse. Its like the same adage when trying to look for something 'it is always the last place you look'.

<comment><USER29> "I was going to build the world's longest suspension bridge, but then I found out someone had already done it." \- Jack Handey

</comment></comment></comment><comment><USER30> I wonder at what price gas needs to be for this to be profitable?

<comment><USER31> They aren't making more fossil fuels. Wait long enough, just about anything to extract them efficiently becomes profitable.

<comment><USER32> "They aren't making more fossil fuels." \-- Well, they are, just rather slowly. All the fossil fuels we use now have been created since the Cambrian and most have been created since the start of the Mesozoic. And if we are willing to wait another 300 million years, we can have yet another 2 centuries of vigorous economic growth based on fossil fuel consumption. In fact, we can probably have 200 good years, every 300 million years, for as long as the Earth lasts.

<comment><USER33> That's disputed. Carbon storage might have stopped quickly wheen wood devouring fungi evolved. [http://news.clarku.edu/news/2012/06/28/findings- point-to-fun...](http://news.clarku.edu/news/2012/06/28/findings-point-to- fungi-as-prime-suspects-in-fossil-fuel-mystery/)

</comment></comment></comment></comment><comment><USER34> for science fiction fans, it's significantly longer than a general products #4 spaceship hull (300m), though the hull being a sphere gives it a greater volume.

</comment><comment><USER35> Anyone else read that as "wessel" with a fake Russian accent?

</comment><comment><USER36> Don't be so proud of this technological terror you've constructed.

The ability to produce 3.6m tonnes of LNG annually while at sea is, uh, well that's actually pretty kick ass.

But I'll bet none of the crew have light sabers.

</comment><comment><USER37> The timing of this debut is hilarious to me. So, they build the largest boat to increase the exportation of oil but, simultaneously the need for oil is diminishing. I don't care what forecasters have to say because, at the end of the day oil prices will definitely continue to sink. It may go up for a while, but it surely will sink. Renewable energies are taking their market by storm and destroying the need for the anti-green oil industry. For example, India, a country that in theory could add extremely large value to oil, is one of the fastest growing renewable energy markets in the world. Not to mention, other countries with a smaller potential demand are doing the same. I love the idea of "the new biggest ship", but it's purpose humours me

<comment><USER38> Did you read the article? It is producing gas, not oil. It is much easier to move gas from Australia to China than from North America.</comment></comment>


Is mixpanel down? I am getting a 500 internal server error? - <AUTHOR>

<comment><USER2> <http://www.downforeveryoneorjustme.com/> \- Save yourself a post next time.</comment>


The "Cobra Effect" that is disabling paste on password fields - <AUTHOR> https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ <comment><USER3> TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out.

Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers.

[1]: [https://community.tradeking.com/forum/categories/suggestions...](https://community.tradeking.com/forum/categories/suggestions/topics/664-new- tradeking-login-password-on-screen-keyboard-why/forum_posts)

<comment><USER4> Another one that is a great pain are the sites that insist upon asking for three letters from one's password to log in. This is all very well if one has an insecure password, but when I've created a 20-character password containing all the necessary characters then this makes it rather more difficult to enter the required values.

<comment><USER5> > three letters from one's password to log in

Could you explain how this works? I've never ran into this and I'm curious as to what it solves / they claim it solves.

<comment><USER6> I never used them, but my guess they try to make one time passwords from your passwords.

They probably ask to enter e.g. 3rd, 6th and 8th letter of the password. Supposedly if someone logs it it supposedly won't be as useful, because next time it will ask for different letters.

Not sure why won't they use rsa keys or similar technology. Also if it is the way I think it is, then you know that your passwords aren't hashed on their servers.

<comment><USER7> > _Also if it is the way I think it is, then you know that your passwords aren > 't hashed on their servers._

Only if the developers are _extremely_ lazy. A proper implementation would precompute a series of hashes for different subsets of the password and store them in the database instead. Similar to how Facebook stores both the password and its reversed-case form as a convenience feature for people who forget to turn their CAPS LOCK off.

<comment><USER8> But how many subsets would you do? With enough of them (and particularly relative to password length) this would leak a lot about your password. For say an 8 character password, do these things ask you to enter more than 4 characters?

<comment><USER7> On my >10 character passwords (I generally don't use shorter passwords with banking sites, so I don't know how the system behaves for short passwords) they ask for ~11 characters. Of course the login box can, and often ends up, being longer than your actual password, so it doesn't visually reveal the actual character count of your password. In my case they usually end up asking for ~5-7 "real" characters.

I presume a good implementation hashes and salts each "sub-password" separately. Since it's the server that decides which subset it wants, I don't think it reduces the search space, unless the hashing/salting algorithm is vulnerable to differential cryptanalysis (which it may be, I don't know this aspect of state-of-the-art hashing functions).

<comment><USER9> It's a huge detriment to security. You can break sets of 5-7 characters at a time and combine them instead of having to break the entire password at once.

<comment><USER7> Seems like a tradeoff. What's more likely - that a bank loses its password database, or that some customers find themselves infected with keyloggers?

Also in any bank that's even remotely sane this is just one leg of a 2FA; often a kind of a "delayed" 2FA - where one factor is enough to get you mostly "read-only" access, and any important changes or wiring actual money requires one-time SMS codes.

<comment><USER9> Any bank that's remotely sane with regards to website security (probably rather few of them) doesn't do this at all and uses standard forms of 2FA. This one doesn't even protect against keyloggers, because they can combine the characters from multiple logins to get the full password (guessing the remaining ones if necessary) and because the password might be reused somewhere else, and they try this at the expense of user convenience (counting characters is annoying) and security in the event of a leak involving password hashes (if they hashed them at all).

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> The worst is websites which not only disable pasting but don't even let you _type_ your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login.

I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

<comment><USER11> HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

<comment><USER12> Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be using the same password elsewhere.

<comment><USER13> Phishing is a much bigger security threat, but is a much less harmful one than having the password database stolen. It sounds like they are trying to minimize the day-to-day risks, at the expense of maximize the damage of a catastrophic event.

<comment><USER14> All the systems I've used that do this make you have two passwords, only one of which they are storing in a reversible way.

</comment></comment></comment></comment></comment><comment><USER15> I doubt that the motivation for preventing paste in a "confirm password" context is to prevent workarounds to character limits.

Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. To this end, it makes some sense to prevent copy/paste, as a user may simply copy their mistyped password and paste it into the confirmation field. Especially risky if the input fields are obfuscated with placeholder characters ( __ __ __*).

Not to argue that it's the right answer, it certainly makes more sense than a heavy-handed enforcement of character limits.

<comment><USER16> This raises the interesting question of why we obscure the input when changing passwords. Showing the new password would allow people to check and correct it, so you'd only need one input.

Given that the contents of a password input can easily be revealed, the only security obscuring the input provides is from an attacker who can see the screen but not the keyboard, and has no physical access to the device - <USER2> pretty limited threat pool.

I guess the answer is that users expect passwords to be hidden. So we make their lives more difficult purely to keep them happy.

<comment><USER17> IE/Edge have at least one thing good about them : you can click on a little eye icon to the right of the obfuscated field to reveal the text in the field until you release the mouse button.

</comment></comment></comment><comment><USER18> Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ([https://www.bankid.no/en/company/](https://www.bankid.no/en/company/)). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper.

The procedure for the mobile version is to input your phone number and birthday on the login and you get a popup on the phone (via the gsm network and sim toolkit, not ip) to input your password along with a short phrase like "pink bridge" so you can verify that it was the web page that sent it. This also works with a lot of credit cards for paying online via 3dsecure.

It's become so common that a large majority of our customers (I work in a bank) are using this as the sole mechanism of identification.

(And yes, for the non mobile version of BankID you can paste the password!)

<comment><USER19> This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

<comment><USER20> South Korea has exactly that kind of ID and it is causing a major privacy headache in the country because the number itself tells so much about you. [https://en.m.wikipedia.org/wiki/Resident_registration_number](https://en.m.wikipedia.org/wiki/Resident_registration_number)

<comment><USER21> US SSNs used to be that way. The initial prefix was based on where you applied, and the last four were shown like it was nothing (Boeing used my last 4 as part of my UNIX account ID). Instead of 5-9 digits of entropy, you're down to just 2.

<comment><USER7> I still don't get why anyone would ever want to treat SSN / national ID numbers as private information. They're _usernames_ , you give them to so many people all the time and they're printed in so many places plain that it's ridiculous to think they should be used as a secret for authentication.

</comment></comment></comment></comment></comment><comment><USER22> I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row.

Edit: This is regarding account creation/changes like the PayPal example. I have no idea why login forms would disallow pasting.

<comment><USER10> That's still not a very good reason.

If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times.

It boils down to security theater making us all less secure.

<comment><USER22> As someone running a user-facing site, you cannot control whether your users use password managers. So what's your solution? Just disregard the segment of your users who don't use password managers? That's a tradeoff that you might not want to make, depending on your business.

Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating passwords; you just have to retype them. So maybe less convenient, but less secure is kind of a stretch. (By the way, I personally use KeePass, and I generally use auto- type instead of pasting, so I'm not inconvenienced at all.)

<comment><USER10> > Just disregard the segment of your users who don't use password managers?

No, I recognize that most users probably don't use password managers. But I'm not convinced that disabling pasting helps much.

For one thing, I don't actually think it's that common for someone to copy a mistyped password. Browsers disable copying from password fields, so they would have to type it in a third place and copy it into the fields from there. Most users are not sophisticated enough to do that.

> Also, if you're someone who uses a password manager, does disabling pasting > really make you less secure?

It directly encourages people to use less secure passwords. If I try to manually retype a 50 character password myself, I'm very likely to make an error. This isn't theoretical—I've often purposefully lowered the complexity of passwords for sites with these kind of arbitrary restrictions.

It's too bad 1Password doesn't have an auto-type feature.

<comment><USER23> You can get/set HTMLInputElement.value on [type="password"] anyway so if you wanted to shim the PW field copy/paste functionality back, you could just create a bookmarklet or something.

Edit, threw an example together. Ignore the horrible code ;P

Http://jsfiddle.net/6gc2d6hb

Type in one of the PW fields then double-click it. Doesn't overwrite populated PW fields.

<comment><USER24> And once again, we find ourselves inspecting elements to fix someone's brilliant idea.

<comment><USER23> True enough - the open nature of the client makes a joke of so many do-called security measures implemented there.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> Fortunately, it's not hard to get around this on desktop (for Mac at least) with an applet like Paste Typer. But when I see this on iOS it infuriates me. I use 1Password to generate strong (long) passwords and having to type them out manually is a huge PIA.

<comment><USER26> The annoying one on iOS is how often it makes me re-enter my Apple ID password. In a modal, of course, so it's impossible to bounce out to 1Password to copy the (very long and complex) password without dismissing the modal first. Sometimes I'll get a "re-enter your apple id password" modal at some random time while I'm doing something else, dismiss it to go get the password, and then have no idea how to get it back because I don't know what triggered it in the first place...

<comment><USER27> > re-enter my Apple ID password

I find it absolutely infuriating that this is necessary even when "purchasing" a free app.

The #1 reason I will not buy an app is because I do not want to deal with entering my Apple ID password _yet another goddamn time_.

If your phone shuts all the way down with any regularity, it's a nightmare.

<comment><USER28> You haven't had to enter a password for free apps for a while now - maybe it's a preference somewhere?

</comment></comment></comment></comment><comment><USER29> If it helps anyone, this Chrome extension has worked every time I've tried it:

[https://github.com/jswanner/DontFuckWithPaste](https://github.com/jswanner/DontFuckWithPaste)

(I usually keep it disabled, but enable it when I'm about to use a site that has paste disabled on any fields.)

<comment><USER30> "If it helps anyone, this Chrome extension has worked every time I've tried it: [https://github.com/jswanner/DontFuckWithPaste"](https://github.com/jswanner/DontFuckWithPaste")

Shouldn't _chrome itself_ be a "don't fuck with paste" tool ?

As the world moves to the browser as the OS (essentially) it's imperative that the browser respect end user wishes and behave as a _sentry_ against malicious websites and malicious website behavior.

<comment><USER31> Most of the time websites disable paste by registering "onPaste" events. How do you allow websites to keep doing that when necessary, but not allow the websites that break the paste?

<comment><USER32> > when necessary

When would I ever want a website to know the difference between me pasting and me typing some text?

<comment><USER33> Kudos +3

Edit: Does anyone else feel... increasingly... trapped?

</comment></comment></comment></comment></comment><comment><USER34> I believe that copy and paste is needed in login forms, as a UX expectation. Typing a secure random password is really painfully hard, especially on mobile.

Sometimes password managers don't recognize the target form fields correctly, so copy/paste is the next step. The act is even encouraged through the use of convenient helper buttons in the password managers.

However. In MacOs Sierra, Apple will introduce the Universal Clipboard feature. This means when someone copies a password on desktop, it would be available on their phone. Which is just one step away from being pasted, by mistake, into an IM chat or worse.

I'm uncomfortable with the idea that when I copy something it's being sent around to different devices, and available to everything running.

I've actually made the terrible mistake of doing that - pasting a password into a group chat my accident, because I didn't copy text correctly, and my last paste buffer was still around. Or messing up when using pbcopy/pbpaste in a shell script.

1Password for instance can actually reset the copy/paste buffer after some time, but the settings need to be enabled. I wonder if Apple has any kind of security around this planned. Maybe applications and scripts should not be able to access the paste buffer until the user explicitly allows it (via the act of using it)?

<comment><USER35> >However. In MacOs Sierra, Apple will introduce the Universal Clipboard feature. This means when someone copies a password on desktop, it would be available on their phone. Which is just one step away from being pasted, by mistake, into an IM chat or worse.

If Apple has any sense at all they will allow apps to mark content being put in the clipboard as local-only. Otherwise this feature will leak all kinds of information intended to be private (passwords, stuff copied from incognito browser windows, financial information from tax software, etc).

<comment><USER36> Yes, Apple has thought about this: [https://twitter.com/1Password/status/743198373323341832](https://twitter.com/1Password/status/743198373323341832)

</comment></comment></comment><comment><USER37> I always assumed this anti-pasting was a requirement of some braindead auditor who insisted that this was a necessary security mechanism.

If they aren't, there's a lot of "debt" in the passwords space, like Troy mentions. This is just something that will get better as websites get better. Webapps are much more complicated today than 5 years ago, on average, and as complexity increases things like user auth will get better and more homogeneous. This is especially true if Google and Apple have their way with the Credential Management RFC and get people to have a reason to save their passwords with chrome.

"Passwords" are getting better but we need another 5 years to get us there.

<comment><USER38> I had a quick look through PCIDSS which is the usual source of this kind of nonsense, but couldn't see anything. However when the first site in the posting talked about losing their "security certificate" they were almost certainly talking about PCI or some related standard.

</comment></comment><comment><USER39> Perhaps the companies involved have been told by their lawyers that choosing a password is a legal action, like an electronic signature, that must be performed by a human, letter by letter, to have certain legal ramifications.

It is only stupidity if you assume the only purpose of a password (or a physical key) is security, and not also _authorized_ entry. It may still be a poor engineering solution to the requirement (because engineers were told the solution, to asked to meet the requirement). But it is wrong to assume there is no reason for the requirement.

You can't paste your legally binding electronic signature either, I'll warrant. I've had to type out my name plenty of times, in digital contracts, even though my browser is quite capable of auto-filling.

<comment><USER40> This is all made up nonsense. You can paste your signature, choose some random image to represent your signature, or even merely click to sign. Have you used Docusign? HelloSign? Document signing in Mac Preview? Please don't spread FUD.

<comment><USER39> The companies involved have specified a protocol for communicating your chosen password to them. Namely, the well known "spelling protocol" whereby you repeat your choice, letter by letter, to the other party. They have gone to some pains to enforce that protocol.

The article advocates breaking the bank's protocol for your own convenience because you supposedly know more than the other party. In general, in life, this is bad advice.

Please do not ask people to do things against the will of the other contracting party for their own convenience, without considering the risks of doing so.

<comment><USER33> You know, we all -- us individuals -- have our own protocols as well. These don't always align with yours.

This may be hard for you to grasp.

<comment><USER40> I think they were being sarcastic.

</comment></comment></comment></comment></comment><comment><USER41> Until better minds prevail.., Disable JavaScript, paste password, enable JavaScript, login. A pain, but usually effective.

<comment><USER42> Unless the login page needs JavaScript to work (like SPA)

<comment><USER28> No, this should still work. Kid the page, let JavaScript run. Kill js, paste your password, then re-enable js before hitting submit

<comment> nommm-nommm Or just directly edit the DOM.

</comment></comment></comment></comment><comment><USER43> Luckily middle click paste on unix seems to bypass everything.

It doesn't trigger not copy events (so the website can't mess with the text), nor paste events. Just the way it should be.

<comment><USER44> The article outlined a way for websites to check this: count the number of key press events (filtering modifiers of course) and the number of characters. Or you can imagine a particularly asinine site performing some statistical analyses on your keystroke timing (flight time and dwell time) and even deduce whether it's typed by a human or not. The thing is, this is a _policy_ issue, not a technological issue.

<comment><USER45> You can always solve this technologically, though, as long as the code powering their nonsense checks runs on hardware physically under your control. There are no javascript commands, only javascript suggestions.

</comment></comment></comment><comment><USER46> I always assumed that the reason paste is disabled on change password forms is to prevent you from changing it to something you don't know. The whole point of making you type it twice is so that you get it right. If you type the password once and paste it twice, that is moot.

Not that I necessarily agree with that notion (just make it easy for me to change it again) but that's the idea. I thought.

<comment><USER47> And that's exactly the point of OP. You can only "know" weak passwords. Disabling paste is assuming and forcing people to use weak passwords.

<comment><USER48> What about the people who already have weak passwords, and accidentally misspell their dog's name or whatever? They're probably in the overwhelming majority compared to people using strong, complex passwords. Disabling paste here seems to be more of a convenience decision rather than a security one.

<comment><USER49> Isn't that what the "I forgot my password" feature is for?

</comment></comment></comment></comment><comment><USER24> I have a crazy idea: what if we held people responsible for their own mistakes, instead of turning the world into a padded room? You messed up your password? Reset it. You have a virus / XSS that is slurping the clipboard? It's probably logging keystrokes too, and that's not the devs problem (well, XSS is, but blocking paste isn't the solution)

<comment><USER50> I agree that the security theater is annoying, and uselsess, but I think you are drawing the wrong conclusion.

Sometime in the 1960s we realized that we can't reduce fatal car accidents by "holding people accountable for their own mistakes". We actually have to make cars safer.

<comment><USER24> That's different, people can't learn from fatal accidents. They do learn not to ignore the "check oil" indicator though, we don't need to disable the engine to make people pay attention to that. This is acceptable, even if it costs the occasional fool an engine.

</comment></comment></comment><comment><USER51> On OSX using Hammerspoon to type from the clipboard into whatever for you has been a life-saver for me.

Especially ever since Apple disabled pasting for decrypting external drives.

</comment><comment><USER52> Is there a way to disable just pieces of JS, so I can turn off "onpaste"?

note: sorry, accidentally deleted earlier version of this comment.

<comment><USER53> I just added it to my list of stuff that pushing this bookmarklet button fixes:

javascript:void(document.onmousedown=null);void(document.onclick=null);void(document.oncontextmenu=null);void(document.onpaste=null)

<comment><USER54> Wouldn't setting `onclick` to null break desired functionality in some sites?

<comment><USER55> Sure would. You couple just reload the page after logging in though.

</comment></comment></comment></comment><comment><USER56> Great article. The only point missed is that password length limits AND re- type fields AND disabling copy and paste are all measures that when, implemented correctly, are supposed to help you remember your password and prevent easy access to reset mechanisms by forcing you to type it twice and not accidentally copy and paste it twice.

Of course, in an era where weak password re-use and leaked hashes are one of the biggest problems facing normal internet users, we really should re- evaluate all the above assumptions.

Or if it's too hard, let email providers handle the login security requirements... Since most places allow email-based password resets anyway.

<comment><USER10> > remember your password

Starting with the premise that users should be remembering passwords at all is a mistake.

</comment></comment><comment><USER57> I encountered this once. "xdotool type password". If they're checking for a delay, xdotool can introduce that for you (defaults to 12ms though).

That said, we should never have let websites have this kind of control over the user agent. For the one time disabling right click was helpful (context menus in Google Docs), 99% of the time it's something dumb ("don't steal our images!").

Finally, I loved the comment about losing their security certificate. I'm sure the average CA will give you a cert for google.com if you ask nicely enough.

</comment><comment><USER58> There is a piece of terrible, unwarranted analysis in this article:

> But there's one angle to this that helps explain the madness and it goes > back to that earlier PayPal screen grab. This was of the change password > page, not the login page. You can easily paste into the login page and in > fact you can even paste into the original password field on the change > password page, just not the new password field or the other field that > confirms it.

> The reason lies in the earlier message I showed from PayPal, in particular > this part of the password criteria:

> Use[] 8-20 characters

> Ah, so because you've gone and put an arbitrary limit on the length of my > password and taken away my ability to create a nice a 50 character random > string, you've had to kill the paste function because otherwise I'd go > around thinking I've got a 50 char password but it was actually truncated to > 20 due to the maxlength attribute of the password field. Nice one guys, good > work there

Having spoken to no one about this, I'm _still_ confident that Troy Hunt is full of crap. The reason to disallow copy-and-pasting into the _new_ password field(s) is obviously the same as the reason you have a confirmation field in the first place: you want to make sure the user hasn't entered the password wrong, inadvertently locking _themselves_ out of their own account. Allowing them to enter their password once and then paste it, typos and all, into the "confirm password" field completely defeats the purpose of having the confirm password field at all.

<comment><USER59> The typo is the added security.

All joking aside, that's why you have password reset functionality. The reason I can't paste in most cases makes me choose another site. One that takes my security seriously. I'm the kind of user that wants to paste in a 40 character long password and store it in a manager that will allow me to forget all my passwords except one or two.

</comment></comment><comment><USER60> Any web developer who does this should be shot. Same with silently dropping characters from passwords when signing up and poor validation of email addresses

<comment><USER61> Nah, they simply should take away the developer's own paste functionality so that they can no longer paste code from websites. ;)

</comment></comment><comment><USER62> Although relevant, this dates from 2014. It's been submitted a few times, although the only time it got any discussion was here:

[https://news.ycombinator.com/item?id=7832938](https://news.ycombinator.com/item?id=7832938)

There were 33 comments on that submission, so that discussion might be relevant. I wonder if this discussion repeats any of the points made there ...

</comment><comment><USER63> Backblaze is another company that does this, which is infuriating when you're entering your long private key into their client. CTRL-V doesn't work, but surprisingly, right-clicking and selecting paste does. I didn't realize this until I the second time I had to enter the key.

</comment><comment><USER64> Not that I think it's a good reason, but I think the rationale behind disabling paste is to prevent users from implementing their own "password managers" via a .txt file full of passwords on their Desktop (more common than you'd think).

<comment><USER10> Why though?

A .txt file on the desktop is actually probably a lot more secure than using the same shitty password on every site.

<comment><USER65> A friend may get tempted to sneak a peek.

<comment><USER66> Your friend could just as easily install a keylogger and get everything anyway.

<comment><USER65> Theorethically yes, but there is a much bigger psychological barrier to doing that.

</comment></comment></comment></comment></comment><comment><USER67> This is from 2014. I'd forgotten the Cobra Effect but remembered the BG tweet. :)

</comment><comment><USER68> For a mathematically rigorous password strength meter library, check out zxcvbn: [http://github.com/dropbox/zxcvbn](http://github.com/dropbox/zxcvbn)

</comment><comment><USER69> I am starting to be even bigger fan of 2FA. I had once bank account that prevented me from pasting pw first I made grease monkey script to remove this blocking then I removed my bank account from that bank.

</comment><comment><USER70> Why do browsers all them to do this? Surely there should be some way to determine it's just a textbox and prevent the side from screwing up the user's actions? Same for autocomplete.

</comment><comment><USER71> Every time I see an apparently stupid security restriction reason I feel obligated to check if "Password1" is a valid entry...

You won't ever believe how often this work while gibberish keychain-generated passwords get rejected because they contain a "-" character ...

Wake up IT departments it can't always be users fault. People born with Window95 starts to work, they won't take your shady security reasons for granted as did people born in the 60's! They just will just think that your are incompetent...

</comment><comment><USER72> Disabling pasting on forms is like... security through cargo cultism. If we make things seem secure, maybe the bad guys will just leave us alone!

<comment><USER73> There's a lot of cargo cultism in modern UI design.

</comment></comment><comment><USER74> I get the meaning of the "Cobra Effect", but I'm not understanding it here w.r.t. disabling paste on password fields.

</comment><comment><USER75> I find it slightly annoying there were repeated hypotheticals that blamed the developer for designing these password pages. It's highly unlikely it was a rogue developer... Most of these companies probably use contract work and likely provide these stupid password requirements and use cases arbitrarily and weren't properly challenged...

</comment><comment><USER76> I recently read that Slack has combined salting and hashing with 2FA after their data breach in March 2015. But if I remember well, whenever you want to connect, you can get a "magic link" with an automatically generated password right in your mailbox and then copy-paste it in the app. Has someone tested if it's bullet proof?

</comment><comment><USER77> In Turkey there must be law which says that mobile carriers must cooperate with banks because when I enter my ID and my first password to the web page of the bank it says "oups! it appears that you have changed your SIM card, please re-validate yourself before we SMS you a 2fa password".

And in Bulgaria I saw use of client-side certificates.

</comment><comment><USER78> Disabling paste on changing password strikes me as a good idea. If you're not pasting from a password manager, it's easy to accidentally select additional whitespace or miss the first or last character. If you then paste it, you end up with a different password than you thought.

But for login, I see no reason to prevent it.

<comment><USER24> What? The password comes from the password manager in the first place! Please people, do not break shit just to protect me from my own sloppy mistakes.

</comment></comment><comment><USER79> I could see it having at least some benefit if you not only disabled paste, but tracked the individual letters as they were typed in. It'd give you a little statistical information, like how Google watches how you click a checkbox for a captcha.

But it seems like an actual captcha would be better, then.

</comment><comment><USER80> The final inanity; what supports a compromised user device from simply submitting it's own copy of the form that it populated, or even transparently proxing the client and MitM on the compromised machine it's self so that it can change the submitted values?

</comment><comment><USER81> Hopefully we'll all start using login methods like SQRL and alike and all this nonsense will be a thing of the past.

Link for the interested: [https://www.grc.com/sqrl/sqrl.htm](https://www.grc.com/sqrl/sqrl.htm)

</comment><comment><USER82> Windows doesn't let you paste when changing your password either. It's annoying.

<comment><USER83> Windows doesn't let you paste whenever you are in one of those 'elevated' contexts, like the login screen. In fact, this prevents my nifty mouse macros from running too.

</comment></comment><comment><USER84> One of the local bank in my city not only disable pasting, it disable typing altogether! It pops up a virtual keyboard and let client click on those virtual buttons. Since noticing that, not one single service from that bank was used anymore

</comment><comment><USER85> I've recently seen this on credit card pages as well.

I store my credit card data in 1Password - so I dont have to pull out my card each/every time I want to buy something online.

Not been able to paste my credit card number into the field is a PITA.

</comment><comment><USER86> Can someone school me in why we don't just throttle login attempts (each fail extends time to next attempt exponentially) and put an attempt cap that requires password reset?

</comment><comment><USER87> So what banks out there actually have password systems that let you use secure passwords, or maybe even real 2FA that aren't German banks with their TIN systems?

</comment><comment><USER88> I just ran in to this using Google Drive for Mac yesterday. I assumed it was a bug and sent them feedback to fix it. I had no idea this was a thing.

</comment><comment><USER89> Obligatory XKCD: [https://xkcd.com/936/](https://xkcd.com/936/)

</comment><comment><USER90> Thank god I use "babababa" for all my passwords. No copy paste for me! I also defeat microphones with tape!

</comment><comment><USER91> In Finland there are several banks which restrict passwords to 6-8 digits. Is that worse than disabling paste?

</comment><comment><USER92> Well, I go around these using the Dev Tools - even taught my kids how to go around such idiotisms!

</comment><comment><USER6> Are there add-ons (particularly for Firefox) that disable these checks. This is quite annoying.

</comment><comment><USER93> I have a feeling that while Ctrl+V is prohibited, maybe Shift+Insert isn't...

<comment><USER94> No, it counts as the paste event as well. But pasting to another text field in the application (or just the address bar), selecting and dragging the password to the field works, as it just counts as a "change" event, which would be very hard to disable without causing issues.

</comment></comment><comment><USER95> and at this point, who isn't using a mobile device to enter passwords where potential shoulder surfers (human and camera) lurk? Without copy and paste, you have to what? Go into a bunker to type in passwords safely?

</comment><comment><USER96> ...whatever. Use NoScript. Problem solved.

</comment><comment><USER97> It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

<comment><USER98> I respond with a strong password for all security questions. It created a cute incident recently when I had to verify my account over the phone by telling the phone rep that my favorite pet's name was 'o(c:Y^u=86U@4k', or whatever. I'll give the rep credit, they didn't care the answer made sense, just that it matched their screen.

<comment><USER99> I'm intrigued as to how you 'pronounced' that. Did you say "open parens" and "caret", and did they understand what you meant? Also, is having to divulge your password _really_ the best way of verifying your account? Do they advise you to change your password immediately after going through this rigmarole?

<comment><USER98> I would have rattled off something like "oh open paren sea cap why colon caret you equals" and so on. Honestly I have no idea if they parsed the sentence, or decided "gibberish from phone equals gibberish on screen .. good enough"

They didn't advise me to change my security question, no doubt because the name of my favorite childhood pet isn't likely to change.

<comment><USER100> Huh, never thought about it, but that's a pretty good argument against random security questions.

<comment><USER97> Another good argument is: having 5 passwords is not more secure than 1 really strong password.

I also think 2fa is ridiculous for 99% of applications. The widespread adoption we've seen is largely the result of developers trying to solve for user error, which as I stated in a previous comment is a waste of time and can never succeed (unless your goal is to find the flaws in your system).

</comment></comment></comment></comment></comment></comment><comment><USER101> >Sometimes you want to use the same credentials on multiple domains of the same service and auto-fill only works against the domain the pattern was recorded on.

That's why you should use Lastpass.

<comment><USER102> I've tried to use Lastpass but that thing needs a UX enema because it's atrociously bad.

<comment><USER103> Oh good so I'm not alone! I tried setting it up but trying to mass import multiple passwords from KeePass over (which doesn't translate directly 1 to 1) left me manually entering them. The process was so incredibly slow and cumbersome that I gave up. It doesn't help that LastPass looks like it was created in 2003 by developers with zero UX / design talent.

I hope they can improve that one day.

<comment><USER104> When did you try it? It very recently went through a total ux overhaul. Big improvement imo.

<comment><USER102> It's gone from apocalyptically bad to horrendously bad.

I have no idea where they thought any of that UX would be even remotely a good idea. Everything about it is misguided to such an extreme I'm left wondering if there's a single human on their development team.

1password may not be perfect, but their attention to usability is obvious!

</comment></comment></comment></comment></comment><comment><USER105> One reason to dissuade users from using the clipboard to paste passwords is this: the password stays in the clipboard.

Not all users realize this, and so .. don't 'clear' the clipboard after logging in .. which means their password is still available to anyone else who might use that computer.

<comment><USER106> So, login form can just clear clipboard instead in onsubmit() handler.

<comment><USER107> That's an interesting idea actually. My first response was that you can't freely interact with the clipboard but you can set it provided you do it in response to a js event so in theory that is possible. The only problem is that you'd need to be sure the clipboard did actually contain the password because of course you can't read it. I guess you can log whether onpaste fired and then if the login button is clicked with a second or two, clear the clipboard.

<comment><USER107> And by 'clear', I mean add a textbox, set its value to an explanatory message '{app} cleared the clipboard because it contained your password' and then execCommand on it.

</comment></comment></comment></comment><comment><USER108> Disagree that it's a conscious decision on the developers' part. Developers get told to do this, so they do.

<comment><USER109> Developers don't need to be mindless code punchers. They can be thoughtful individuals who say, "that's dumb", and then have a discussion with the PM on why that is dumb.

On the other hand, maybe development of software is a mindless endevour, and so the labor in this area must be cheap, right?! </sarcasm>

<comment><USER110> You're right, of course, but it's also true that in a real life environment, you've already found a polite way to say "that's dumb" three times this morning and you're starting to pick your battles.

<comment><USER111> This! Dilbert is a documentary not a cartoon. Devs work for businessfolk. Businessfolk have the control call the shots. Sure they'll listen to devs but get the final say.

<comment><USER112> Couch your suggestions in business terms? user engagement decreases when you don't let them save their passwords or some such drivel. honestly if you think businessfolk call all the shots, you may have a broken business relationship

<comment><USER111> Ultimately they call the shots because they'll judge the developers idea and say yay or nay. All a developer can do is influence and with a given number of battles to fight, password copy and paste may be a long way down there.

It requires getting promoted to management or board level to get the ultimate decision power. Some companies are more progressive when their board chooses to be but they can always revert back if they choose or get taken over.</comment></comment></comment></comment></comment></comment>


What Kills Startups? Maybes  - <AUTHOR> http://www.rookieoven.com/2012/09/26/maybes-kills-startups/

<comment><AUTHOR> What's the one word you've banned from your startup?</comment>