William Gibson: "Google's Earth" - <AUTHOR> http://www.nytimes.com/2010/09/01/opinion/01gibson.html

<comment><USER3> "Nor do I take much comfort in the thought that Google itself would have to be trusted never to link one's sober adulthood to one's wild youth"

After a preamble that compares Google to the artificial intelligence described in science fiction books, this was what I will take away from that article.

Kids are growing up with public persona's and as anyone 30 or over will tell you, those persona's change drastically over the course of our lives.

Building on this, I want to be known as a different person to different people. In the current Facebook and Google Indexing style of amassing information, there is no way for me to do this. I want to be known as a trustworthy, reliable father; a fun-loving, somewhat reckless friend; and a knowledgeable leader to my colleagues. However, I have no way to separate my past, present and future or the different people that I want to be known as right now.

<comment><AUTHOR> _I want to be known as a trustworthy, reliable father; a fun-loving, somewhat reckless friend, and a knowledgeable leader to my colleagues. However, I have no way to separate not only my past, present and future as Gibson suggests but also the different people that I want to be known as right now._

Guess what: there never was such a way, in real life, either.

Your friends may hang out at the same bar as your colleagues. Your colleagues' children may be in the same school class as your kids. Your "reckless friend" may start telling stories about you.

Controlling your reputation is hard. Keeping different segments of your life from coming into contact with each other is hard. Keeping secrets is hard.

Google and Facebook change the medium, but they don't fundamentally change the rules.

<comment><USER4> What should (hopefully) happen is that after a period of adjustment, people will respect your right to be different in different walks of life. They'll understand that it's possible, and indeed desirable, to be reliable and professional at work while still being immature with your kids and occasionally irresponsible with your friends.

What really needs to change is the need to maintain the appearance of being different people (because you're always you, unless you have severe psychological issues you aren't really different people). People need to understand that what I do at home and what I do at work needn't overlap.

It's just an extension of the adjustment that started with dress down - <USER2> understanding that wearing jeans didn't make me any less smart than wearing a suit. People will understand that playing Mario Kart while drunk with my friends doesn't make me less able than if I spent that time reading Dickens.

<comment><USER5> I agree with this (optimistic) opinion a whole lot. I'd like to see that world come about.

The interesting part is when it comes to people who are already public figures. How do political, religious, or any other charisma-derived leaders cope with the fact that their public images can be ruthlessly criticized?

Even more optimistically, I hope for acceptance and a greater understanding of the narrative of the changing personality throughout life. I hope for a public realization that some politicians even under total transparency are good enough to be leaders. I also hope that this transparency actually becomes a valuable filter on good leaders.

So it's in those hopes that I sort of am happy to hear that our online personas are slowly eclipsing our generative, "real" personas.

<comment><USER4> I suspect that people will have no choice but to be more tolerant as there won't be people who are entirely blemish free when faced with the increased level of scrutiny.

David Brin's "The Transparent Society" has some interesting things to say about this sort of transparency. While I'm not 100% sold on his conclusions the analysis is well worth reading and thinking about.

</comment></comment></comment></comment></comment><comment><USER6> Spectacular! Love the subtle reference to The Second Coming in the last graph. Mr Gibson you continue to capture, distill and serve up the essence of cyberspace.

<comment><USER7> I cannot imagine why this legitimate comment would be voted down.

<comment><USER8> Without this comment, I wouldn't have given the parent a second glance. And without that, I wouldn't have realized that "slouching towards" is a phrase I easily recognized without being able to recognize the source. So some googling (hah!) later, I found the text of The Second Coming by Yeats here: <http://www.potw.org/archive/potw351.html>

And it turns out, as the GP says, that Gibson is making a wonderful and highly relevant reference to the poem.

<comment><USER7> It's not obvious now, but when I came across the parent comment, it was at -2. Don't understand the hate.

</comment></comment></comment></comment><comment><USER9> The funny thing about all this is that since the beginning of the internet, no data privacy issues were ever raised, and that at some point (i may be wrong, but symbolically i would say it started when facebook became really huge) it became a real topic. Coincidentally, facebook becoming huge marked the moment when everybody started to use their real names instead of nicknames. Maybe it's time to do the math, and start wondering if using your real name for every post, every comment, every little lolcat action you take online is really worth signing it with your real name. Returning to nicknames for most of your online appearances would probably render Mr Schmidt's point moot

<comment><USER10> Not really. Most people use the same username or a slight variation thereof for everything they do online. If I read a LiveJournal post you write, I can probably Google your username and discover 90% of your contributions to the web instantly. From all that data I can probably learn enough about you to be scary (where you live, who you hang out with, hobbies, past relationships...), and Google itself could learn basically anything.

Of course all of this varies person to person, but it's already known to be an effective heuristic by the password-stealing community. Point being: we live in a time of powerful data mining algorithms, and they're only going to get better. Anonymity does not come easy.

<comment><USER9> Sure (i just googled my favourite username, and found indeed some pretty old stuff that i'd rather keep forgotten). But listing all the appearances of your online persona is one thing, being able to search for your real-life name and retrieve all the embarrassing info attached to it is another. I'm not saying privacy-conscious persons should obfuscate absolutely everything they publish, but considering how things work, the least anyone should do is to make the retrieval of such information a bit more difficult.

</comment></comment></comment><comment><USER11> Is the first quote totally out of context, or does Eric Schmidt seem more stupid, creepy and horrible every day?

I've always liked Google a good bit, but I'd be prepared to put them in the 'as bad as microsoft or worse' category, based on their CEO, if he doesn't go away or stop talking soon.

</comment><comment><USER12> The Top down transparency imposed by Google, facebook etc (as well as the increased surveillance by other entities) seems to be tempered by a bottom up demand for State and corporate secrets being leaked in increased frequency (WikiLeaks etc..)

It will be interesting to see how transparency (by design or not) will effect corporate governance and state behavior.

<comment><USER11> Yeah, nice how there's a double standard at work. The government wants to have free access to all of our phone calls, emails, stored digital files and heck, even houses, as well as store images, fingerprints and even DNA of each citizen, but on the other hand, they insist that their own privacy is paramount and even filming a police officer can be a crime.

</comment></comment><comment><USER13> In case you didn't get it, he really wants a genie.</comment>


YouTube Will Now Let Mobile Users Choose Whether to Watch Ads - <AUTHOR> http://bits.blogs.nytimes.com/2012/08/22/youtube-will-now-let-mobile-users-choose-whether-to-watch-ads/ <comment><USER2> I feel that showing the ad afterwards is _vastly_ superior.

When I deliberately press a youtube-link I do it because I want to see the clip, any distraction then is annoying and is going to be associated with that. But afterwards I am far more likely to passively let the ad run. Having patiently to wait 5 seconds before being able to disable it is like a blow to the face (as well as those infuriating popups after 10s).

Afterwards I am way more receptive to an ad. Ted.com does this and I have seen waaaay more commercials after a ted video than on youtube (and I watch more on youtube than on ted).

(I have seen youtube clips where the ad is played afterwards (or in some cases, both before and afterwards) but it is extremely rare)

<comment><USER3> The problem with that is that an average user would click away or close the tab as soon as the clip is over. I think its best as how they have it in the beginning with the ability to skip longer ads. I rather get it over with and watch peacefully than be interrupted in the middle.

</comment></comment><comment><USER4> And, a reminder, the YouTube app is removed from iOS 6, so millions more users will be hitting mobile YouTube directly. Pick one of (a) Google encouraged Apple to pull the app or (b) is jumping on top of the removal to exploit it.

</comment><comment><USER5> Some of the most popular Youtubers have their content viewed by hundreds of thousands of mobile viewers so this will make a substantial increase to their revenue (6 and 7 figures for some). Assuming people choose to watch the adverts of course.

</comment><comment><USER6> I've always made the choice not to watch YouTube ads.

Adblock

</comment><comment><USER7> I hate waiting for the ads and I would not like to waste my limited 3g data on ads. I would lovely pay some money for youtube, but I don't have this option.

</comment><comment><USER8> This is the part where they find out people don't really like watching ad's</comment>


An Introduction to Modern CMake - <AUTHOR> https://cliutils.gitlab.io/modern-cmake/ <comment><USER2> Somehow I'm never happy with CMake guides. The official book is ridiculously outdated among other things, the official documentation is complete and current but provides no guidance, and none of the blog-documentation about it gives a complete picture. Some of it is bad advice. This one doesn't talk about the dependency graph, something I consider very important in a build system. It is also missing a lot of other stuff. (Fair enough, it's provided for free.)

I wrote the CMake training material for KDAB (www.kdab.com) while I worked there. In my biased opinion it's the best CMake guide around, especially after it was extended and polished by coworkers :). I tried to mix explaining the "inner logic" of a build system, and CMake in particular, with examples, resulting in something I'm reasonably happy with. The main difficulty was ordering the topics to avoid too many forward-references while also not starting with a lot of not-obviously-interesting groundwork [1]. (I don't work there anymore btw, so the interest I have is getting my work used)

This intro to modern CMake should be good because Steve is a major CMake contributor and good at explaining. The presentation even contains a dependency graph! [https://steveire.wordpress.com/2017/11/05/embracing- modern-c...](https://steveire.wordpress.com/2017/11/05/embracing-modern- cmake/)

[1] Aside: I figured that "There are two types of bad software documentation: math textbooks and cooking recipes. The former does not explain why you are doing things and other helpful context, the latter won't help you if you need to do something differently, which is almost always."

<comment><USER3> The official documentation is sub-par. Want to know the difference between include_directories and target_include_directories? Well, good luck going through docs with no examples and then parsing through several year old stackoverflow posts.

<comment><USER2> That is what I mean with "no guidance". In this case, you have a common best practices question that you have to figure out by diffing the two pieces of documentation yourself. The information is usually there.

</comment></comment></comment><comment><USER4> The recommended compatibility boilerplate for new projects is tedious. There must be a way to include this knowledge in cmake itself rather than requiring every "properly" configured project to get this right:

      cmake_minimum_required(VERSION 3.1)

      if(${CMAKE_VERSION} VERSION_LESS 3.12)
        cmake_policy(VERSION ${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION})
      else()
        cmake_policy(VERSION 3.12)
      endif()

This is all before you even start thinking about your own project.

<comment><USER5> This syntax is also uber ugly. I can't understand why C still hasn't a proper build system that is either using convention over configuration (like Go or Rust) or something like cmake but with a proper syntax (maybe something in pyhon?)

<comment><USER6> Scons ([https://scons.org/](https://scons.org/)) is one alternative. The configurations (and Scons itself) are Python.

<comment><USER7> Scons has soooo many problems. You still can't pass in positional linker flags without completely hacking how it calls the linker. :(

</comment></comment></comment></comment><comment><USER8> It's better than every other build system, but god I wish they had just used a preexisting language for it. The syntax for CMake just feels so janky and weird, and it's another set of things I have to remember and (eventually) forget. It's not like it has these amazing language concepts nothing else can do; and if they're worried about size or dependencies something like Lua would add like no overhead and be super simple to link.

<comment><USER9> I agree. CMake's scripting language has a lot of the same pain-points as Bash. For example, the lack of a clear distinction between lists and strings.

I've sometimes wondered if CMake would benefit from getting an additional / replacement scripting language. While retaining the same underlying object model and other code, that is.

My only fear would be that it would be a first step in morphing into Bazel, which I find unbearably complicated.

<comment><USER9> Clarification: I know that Bash has arrays. But environment variables such as "PATH" use colon-separated strings.

</comment></comment></comment><comment><USER10> The problem with modern cmake is that it _cannot_ run on older systems. So if you want to use it you end up either static compiling an incredibly hard and tedious depedency tree or have to use some just released OS.

What I want out of a make system isn't bleeding edge features. I want to be able to use it for more than 3 years.

<comment><USER11> A nice tip is that you can install a very recent CMake from pip with most systems.

Just `pip install cmake` and then you can require version 3.12 and don't have to worry about ancient Ubuntu packages or whatever.

<comment><USER10> On systems were you don't need to do this (new enough) it'll work. On systems where you _need_ to do this it will break things. And because it's pip, it'll be incredibly hard to figure out what broke and how to fix it.

<comment><USER12> In general you can avoid pip breaking things by doing so inside a virtualenv. The following should work on at least the last few years' worth of OSes:

        $ virtualenv /tmp/ve
        $ /tmp/ve/bin/pip install -U pip setuptools
        $ /tmp/ve/bin/pip install cmake
        $ /tmp/ve/bin/cmake ...
        $ rm -rf /tmp/ve

On some OSes (e.g. Debian and derivatives) you'll need to install virtualenv itself from the OS first, but that won't break things because it's from the OS.

On sufficiently old OSes, you may need to set PIP_INDEX_URL=[https://pypi.org/simple/](https://pypi.org/simple/) and PIP_TRUSTED_HOST="pypi.org files.pythonhosted.org" to disable certificate verification. (I'm not sure of a good way to work around this problem. In theory, Python 3 would solve it, but those same old OSes have an old enough Python 3 that the latest version of setuptools fails, and I can't figure out how to install an old enough setuptools.)

Also - if you need to unbreak your system Python, in _general_ it suffices to ensure that /usr/local/lib and ~/.local/lib have no pythonX.Y directories with anything in them. (Empty directories are fine.) At my last job where we needed to give non-sysadmins root access on certain machines, I added a Nagios check to /usr/local/lib/python*, which was remarkably effective at catching problems before they turned inexplicable.

</comment></comment></comment></comment><comment><USER13> This is quite welcoming. I have tried to digest cmake docs and get so lost.

Am I the only one that can't grok cmake docs?

Edit: spelling fixes

<comment><USER14> The only way I've been able to make any sense of CMake docs is in conjunction with examples -- searching on Github/enormous open source projects using it (e.g. LLVM). Just reading CMake docs to understand how to use directive x almost always leads to failure.

<comment><USER13> Yup agree, I'm like I know this X project compiles file, let me Look at their cmake file....copy pasta.

I'm not proud of it, but it works.

</comment></comment></comment><comment><USER15> What I find a big shortcoming from CMake is that it does not have support for building for multiple architectures at once.

[https://cmake.org/pipermail/cmake- developers/2014-September/...](https://cmake.org/pipermail/cmake- developers/2014-September/022929.html)

Quote: "The fundamental problem with supporting multiple architectures is that pretty much all of CMake is designed to support one architecture at a time. Modules/*, CMakeCache.txt, etc. are all built around only finding, using, and building one artifact per library (OS X universal binaries work with multiple architectures because they are still only one file). I think even your "toolchain scope" approach would end up being used in practice to wrap the entire CMakeLists.txt file."

<comment><USER16> CMake replaces `configure` scripts. It would be difficult to imagine what multi-architecture support in a single build directory / command-line invocation would look like.

Instead, what we do is to wrap calls to CMake in a script that makes choices about build directories, which flavours to build by default, which mobile SDKs exist, etc. When producing a release, we notably don't use this, because we are precisely interested in building for each architecture in parallel on different machines.

<comment><USER15> Yes, for cross-compiling to targets with different configurations we also evoke CMake with lots of options.

However, that you have to wrap calls to CMake in your scripts is quite ugly. Are those scripts cross-platform for starters? As soon as you start to write code to use CMake, this seem to defeat the purpose of a build generator.

<comment><USER17> OpenCV includes a python script to build a framework for iOS. I agree, it's not great.

</comment></comment></comment></comment><comment><USER18> Please don't use cmake, the dependency chain it pulls in on a bare machine is massive.

<comment><USER19> What's wrong with dependencies?

<comment><USER20> Every dependency increases the fragility of your program. What if you update the dependency and it breaks your program? What if you have two programs dependent on the same library -- but different versions? This just scratches at the surface of the problem.

Sometimes the risk is worth it: you need some complex functionality not worth writing yourself. In that case it's a good thing. But understand that it's a tradeoff.

<comment><USER21> This is a very dangerous argument for anything but the most domain specific or simple logic. Every time I roll something non trivial rather than using the widely testing and "battle hardened" alternative _that_ increases the fragility of my program.

There are times when it makes sense, but those are the special cases, and carry a cost which should be considered.

</comment></comment></comment></comment><comment><USER22> This is really not an introduction to CMake. It is more like a collection of the author's opinions about CMake, barely categorised into sections and some quite contentious.

An introduction would be example driven, starting with a very short but complete example:

        cmake_minimum_required(VERSION 3.1)
        project(FooAndBar)
        add_executable(Foo foo.cpp)
        add_executable(Bar bar.cpp)

It would explain projects and targets (noting the different meaning of "project" to some IDEs including Visual Studio: project<->solution and target<->project). Then you would progressively build from there. Start by adding a dependency such as protobuf to show find_package() and target_link_libraries(), showing both the new protobuf::libprotobuf target dependency and the old-style ${Protobuf_INCLUDE_DIRS} and ${Protobuf_LIBRARIES} variables. Then make some shared code between your two executables into your own library, discussing shared vs static. I would not even mention variables until after this point (even though ${Protobuf_INCLUDE_DIRS} already is a variable).

In other words, an introduction should be top-down and pedagogical. This is the exact opposite of that: picking through a CMakeLists.txt from the bottom up, one line at a time, before you even know what the point of it is.

Perhaps I misread the title: I read it as "introduction to CMake [but using modern techniques]", but maybe it's "introduction to the modern bits of CMake [assuming you already know the old stuff of CMake]". But even that could be example driven, admittedly with more effort: start with an old crusty CMakeLists.txt with plenty of bad habits and make it better one step at a time. Or have lots of little CMakeLists.txt with one bad habit at a time, and fix each of those.

I am not convinced by some of the recommendations it makes either, although I think there will always be some disagreement about some of these things. I have already given my view on the "cmake_policy" atrocity (which is the very first thing in "Introduction to the basics"!) in another comment here. And in the examples there are workarounds for old versions of CMake that don't have targets for e.g. find_package(boost) by creating interface targets using the old _LIBRARIES and _INCLUDE_DIR variables. These are very neat but not very accessible to CMake beginners. It would be much simpler to put up with using the old variables, or commit to increasing your minimum supported CMake and forget them entirely.

</comment><comment><USER23> I could also recommend Craig Scott's recent CMake book: "Professional CMake": [https://crascit.com/professional-cmake/](https://crascit.com/professional- cmake/)

IMHO it's the best available CMake book available right now. I especially liked the recommendations at the end of every chapter.

</comment><comment><USER24> I think the best advice I can give to someone learning about cmake is to use meson instead. I once had dozens of codebases using cmake, and have since moved most of them to meson and start most new new projects with meson.

<comment><USER18> I dislike meson, it mixes configuration with generation when a separate project (if even really needed as sh is fine) for configuration could exist.

<comment><USER25> What?

<comment><USER18> It mixes configuration as in ./configure related with generation as in build generation.

</comment></comment></comment></comment><comment> ur-whale CMake is the perl of build systems: useful and feature-fat but one of the worse DSL syntax I've had to grapple with, barely better than that of a Makefile

<comment><USER26> The CMake language is much, much worse than the beautiful makefile syntax.

<comment> ur-whale lol, calling the makefile syntax beautiful is quite a stretch, but maybe having been exposed to enough cmake code slowly rewires your brain to the point where that can happen :)

</comment></comment></comment><comment><USER27> I used CMake and I liked that it can produce NMake files, which can be used for building with Windows SDK (not bloated Visual Studio, SDK contains just headers and compiler) on Windows XP.

And generally it is much easier to use than manually write Makefiles or use Autotools with weird unintuitive syntax. As I remember, they use `dnl` keyword (download?) for comments!

<comment> ur-whale You like CMake in much the same way people like Visual Basic: it has lots and lots of features and therefore people find it useful.

But, just like VB isn't a good solution for an embedded language, it doesn't mean cmake is a good solution to the general problem of building large codebases.

<comment><USER27> No, I like CMake because it is better than writing Makefiles manually or using autotools.

</comment></comment></comment><comment><USER9> One of my problems with "modern" CMake is the same as my problem with "modern" C++:

Their proponents argue for using certain new language features to get things done. But because of backwards-compatibility concerns, the system still supports the old, quasi-deprecated constructs for doing those same things.

And so you end up with an overly complicated language that seems to have multiple, reasonable ways to do the same thing. And codebases containing a mix of the two, even for newly written code.

IMO it would be better for CMake to make a clean break, and have CMake 4 _only_ support "modern" CMake.

(edit: And, as I've posted elsewhere, switch to a more robust scripting language.)

</comment><comment><USER28> There are some good recommendations in here! Does anyone know of a way to check for, or enforce, these recommendations? The only CMake linters I could find seem to focus on whitespace and naming issues.

</comment><comment><USER29> Can anyone with experience with Bazel, Buck, or Pants chime in?

<comment><USER30> They are quite different, speaking of Bazel it's designed to be an all inclusive build system for any language at essentially infinite scale. Which means it:

\- Has nice Python based DSL

\- Strongly encourages 100% explicit dependency specification

\- Has built in caching (local and remote)

\- Built in test result caching

\- a fully featured build graph query language

\- Built in distributed execution support (for any build step)

\- All work scales by part of tree you are building not it's absolute size

\- Support for fetching external source code and binary deps

\- Has first class support for executing and testing containers

\- Has first class support for code gen (ie you can build a compiler use it to generate code, then build its output,and everything works, no hacks in one build system)

The downsides:

\- Works best if you all your code is built with Bazel, which makes deps hard

\- Support for Python is weak, Ruby non existent, and Node is beta quality

\- Has essentially zero convention, everything must be explicitly configured (ie explicitly describing go deps)

\- Has a memory hungry local java daemon

\- Has a more overhead than ninja (but is more accurate because of hashing and isolation)

<comment><USER31> One downside I found: it makes heavy use of symlinking which doesn't always play well with other tools (in particular: Go tools) and I found made things particularly annoying when I used Bazel from inside docker and outside docker (the symlinks left don't match what's on my host).</comment></comment></comment>


Votodo - Social todo app launches its Android app after HN feedback - <AUTHOR> https://play.google.com/store/apps/details?id=com.votodo

<comment><AUTHOR> Thanks HN for awesome feedback on our web launch at <http://news.ycombinator.com/item?id=4036265>

Considering it, we have launched our Android app for making it even easier for you to share your todos.

Try it out and give your honest opinion about it (as always)!</comment>


Instead of practicing, this AI mastered chess by reading about it - <AUTHOR> https://www.technologyreview.com/s/614043/instead-of-practicing-this-ai-mastered-chess-by-reading-about-it/ <comment><USER2> It's a neat idea, but saying that this AI "mastered" chess is a huge exaggeration. In the actual paper [1], it says that it lost 19/100 games against an opponent playing completely random moves. And by "lost", they mean that it was in a worse position after 40 moves. It sounds like the AI isn't even able to consistently finish games, so they just had to try to judge them at that point.

[1]: [https://arxiv.org/pdf/1907.08321v1.pdf](https://arxiv.org/pdf/1907.08321v1.pdf)</comment>


Jason Alexander's amazing gun rant - <AUTHOR> http://www.salon.com/2012/12/14/jason_alexanders_amazing_gun_rant_2

<comment><USER2> Very well said. I think he's off by a factor of ten though: "100,000 Americans that die every year due to domestic gun violence". I think the number is closer to 10k.</comment>


Japan's Privacy Visor will hide your face from software - <AUTHOR> http://www.engadget.com/2015/08/07/japan-privacy-visor/

<comment><USER2> Do they not wear surgical masks anymore?</comment>


What's my eye color, Apple? - <AUTHOR> https://medium.com/@pisicamica/whats-my-eye-color-apple-cf2cc70d6c80#.81f97gjor <comment><USER2> I think this is the first time I've seen a _410 Gone Explained_

"This page is under investigation or was found in violation of the Medium Rules"

<comment><AUTHOR> It might have been due to "Copyright and Trademark Infringement". The article used some pictures that author clearly found on google images

<comment><USER2> Shucks. I was hoping for something much more nefarious. Guess I've been hearing too many conspiracy theories recently.</comment></comment></comment>


The Internet Blueprint - Crowdsourcing bills to build a better Internet - <AUTHOR> http://www.internetblueprint.org/

<comment><USER2> We're working out a few last minute launch bugs. Thanks for your patience</comment>


Time lapse visualization of the tornado outbreak April 25th-28th - <AUTHOR> http://www.stormtimemachine.com

<comment><AUTHOR> Tech details for those interested:

It's built on top of OpenLayers with Google Maps and OpenStreetMap as base layers.

It was written in CoffeeScript.

Jekyll was used to provide a local development server and then also to build a _site directory.

It's hosted on Google App Engine.</comment>


Journalist Sharing Their Salary - <AUTHOR> https://docs.google.com/spreadsheets/d/1SP3Sqqdv6R8chFamjtgdNlOrUar-hJXvkMSeha2mHQ8/htmlview <comment><USER2> [https://news.ycombinator.com/item?id=21528854](https://news.ycombinator.com/item?id=21528854)

</comment><comment> open-paren I recently wrote one of these salary-sharing surveys for my college. Making one survey that is comprehensible and also includes all the different compensation options is HARD. I'm impressed by their ability to do so in this survey.

</comment><comment><USER3> These salaries are higher than I expected

</comment><comment><USER4> Yikes. Makes me appreciate my SWE career.

<comment><USER5> Too bad a functional fourth estate is a dependency for, you know, western democratic capitalism.

Less puckishly: What I feel upon reading this is sort of like that feeling when you find out some bad piece of news about climate change. It's bad enough on its own, but what it implies about the overall health of the national and international socioeconomic context, which, as SWE I (like you) depend on for my survival, is enough to keep one up at night.

Who, among folks smart enough to earn six figures writing code, will deign to don gumboots? And if they don't, who will?

And what happens to us when that person proves incompetent, irregular, desperate, uninformed, or lackadaisical -- all the things that (under capitalism) a healthy salary is supposed to ward against?

</comment></comment><comment><USER6> Considering stuff like

> Covering up Epstein's crimes to protect the Clintons

I guess this whole thing is absolutely meaningless?

<comment> 52-6F-62 It appeared to be better a few days ago when it was first posted. The form was public and anonymous and it became popular so the trolls got a hold of it or so it appears.

Unfortunately it seems that way now.

</comment></comment><comment><USER7> When people report their salaries, I always wonder how we can know they're telling the truth.

<comment><AUTHOR> What would they gain from anonymous lies?

<comment><USER8> Not that I think this is happening, but in theory they could bump up the averages and use that as ammo the next time they're negotiating their compensation.

</comment></comment></comment><comment><USER9> This one is pretty interesting/funny (more so if it's not fake):

 _Chief Media Correspondent

CNN

$1,054,000

White cis male

15

New York

Pretend ABC didn't cover up Epstein's crimes / Report every minor thing about Fox News and Trump / Envy Sean Spicer's dance skills_

<comment> 52-6F-62 It's fake, and it's poisoning the data pool.

<comment><USER9> Hrm, I kind of assumed the epatein stuff might have been one network emoyee laying some blamr on another network, as well as maybe acknowledging much of the media's general overreaction at times (which Trump plays upon), as well as being a bit self-effacing, but on a fresh look, it does seem a lot more obviously fake. :/

<comment><USER9> I wanted to edit this comment to fix the "Epstein" misspelling I made while on my phone, but I can't edit it (and the delete option is also gone), but I can still edit my top-level comment if I want. I checked back on my phone, and it showed the edit, but clicking it just acted as if I had used the comment anchor link. I haven't seen that before.</comment></comment></comment></comment>


Photos of Cabins - <AUTHOR> http://freecabinporn.com/

<comment><USER2> I feel living in the UK there is a real limit to these in-the-middle-of- nowhere places where you can set up shop miles and miles away from anyone else.

Places like the US and Canada have some amazingly beautiful remote spots that would be amazing to have a little cabin in.

</comment><comment><USER3> I think HN would really appreciate the story of Dick Proenneke, the cabin he built, and the simple life he lived there:

<http://en.wikipedia.org/wiki/Richard_Proenneke>

There are several documentaries made from footage he filmed, later edited and narrated by a friend of his from his journals. Clip: <http://www.youtube.com/watch?v=iYJKd0rkKss>

More info and links to buy the videos:

<http://www.aloneinthewilderness.com/index.html>

(Sadly, I was unable to legally find them available digitally, so you have to order and wait for the DVD.)

</comment><comment><USER4> List of famous writer's sheds [http://www.apartmenttherapy.com/famous-small- offthegrid-work...](http://www.apartmenttherapy.com/famous-small-offthegrid- worksp-140587)

</comment><comment><USER5> Sortof like <http://bookshelfporn.com/> , but woodsier.

</comment><comment><USER6> Any advice on buying some land and building a cabin? I'd love to do that someday but I don't know where to start. Is there a book I should read? Do I need a special kind of real estate agent?

</comment><comment><USER7> OffGrid Cabin with Network: <https://www.youtube.com/watch?v=m5rM7QDi_5E>

</comment><comment><USER8> Beautiful until I consider the slow internet speeds I'd likely have to live with.

<comment><USER9> but you'd have a lot of linuxes [http://24.media.tumblr.com/tumblr_mcgkm7bdJw1qzwmsso1_1280.j...](http://24.media.tumblr.com/tumblr_mcgkm7bdJw1qzwmsso1_1280.jpg)

</comment></comment><comment><USER10> For a second, I thought airplane cabins... if only...

<comment><USER11> For some absurd reason I read "Cable porn", all the way through the first page of pictures. I was further confounded by that there were indeed some cables (although nothing that super impressive) but none were very prominent and many seemed to have no cables at all in them..

<comment><USER12> <http://www.reddit.com/r/cableporn>

<comment><USER13> Not surprisingly, <http://www.reddit.com/r/cabinporn> does also exist.</comment></comment></comment></comment>


24/7 Incubation Opened in Tempe, AZ. You are invited - <AUTHOR>

Michael Witham and Michael O'brian founded The Open Source Project at 1415 E University Dr Suite 103.  Walking distance from Arizona State University...the largest student enrollment in the country.
The purpose is to combine tech start ups with Andy Warhol's The Factory (minus the drugs and orgies).  Inspired from Richard Flordia's Creative Class research, The Open Source Projects aims to be the epicenter of innovation and creation.
Come join us for events and festivities and join the elite talent in Arizona.
Follow us twitter and facebook: OSPtempe <comment><USER2> Seems like, everyone is thinking on same lines.

</comment><comment><USER3> Is there a Web page for this?</comment>


The secrets of body language - <AUTHOR> http://blog.bufferapp.com/improve-my-body-language-secrets <comment><USER2> Body language experts are trained to look for _groups_ of behaviors. Often, certain behaviors such as crossed arms could just mean the subject is cold. It is also hard to judge someone's body language after you have just met them; it is much better to compare their behavior to the "baseline" of their normal behavior. That is because certain behaviors are not innate but learned unconsciously from parents, relatives, close friends, and is also dependent upon regional culture. If you want to learn about body language, you should spend a lot of time practicing watching several different people and finding groups of behaviors that signal their respective moods before you start to start to make inferences with confidence. It is helpful to watch people from different cultures or different classes so that you may see how much variation there is. Otherwise, decisions made with little knowledge and practice is actually harmful because your inferences will likely be wrong. "You should never cross your arms again" may be good advice, but only because you can then guard yourself from people that overestimate their powers of observation.

<comment><USER3> Good point. For example, I tend to lean forward (with forearms on the table) out of respect. It shows I'm interested but I can see how it could be misconstrued as a nervousness, or 'low-power'.

<comment><USER4> But isn't giving respect low-power? If you're the alpha, others give _you_ respect, and you do as you please. I'm exaggerating, obviously, but respect is a form of deference. Deference is low-power.

<comment><USER3> I know what you mean, but given the context of a job interview, by definition[1] you are in a lower power position.

I agree with sibling comments, though, that respectfulness is not mutually exclusive with _alpha_ -ness. And if in general you are a respectful person, a high-power posture will probably not impact their opinion of your respectfulness too much.

[1] Assuming you really want the job and unless you are a hot shot who is gracing them with your willingness to work for them.

<comment><USER5> I've gone into every job interview I've had with the attitude that I'm a hot shot who is gracing my employer with my willingness to work for them[1]. I've gotten offers at about 50% of them, which means that I've turned down more companies than have turned down me.

Confidence really does work. If you sincerely believe in your abilities, it's much easier to convince others to believe in them.

[1] This is not mutually exclusive with respect or humility. It's quite possible to believe you have a lot to offer your employer while also believing they have a lot to offer you, and then the job interview process is just a matter of negotiating the right fit.

<comment><USER6> Interesting. Whenever I see aggressive confidence in an interviewee, I immediately think Dunning-Kruger because statistically it's by far the most likely cause. Either way it's down to empirical evidence though.

Anyway, as far as anecdotal evidence goes, I tend to intentionally give off a pretty neutral vibe and rarely worry about flunking an interview. (I chalk it up to mad skillz rather than body language though.)

<comment><USER7> One could also argue that your willingness to quickly diagnose an individual coping with a traditionally high-anxiety situation (interviewing) with trendy cognitive bias issues calls your ability to recognize your own weaknesses into question.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> This kind of article doesn't address the issue known as Chesterton's fence [1]. If so-called "low power" poses are so bad for you, why have they survived evolution? Why do we have such strong ingrained impulses to assume them in the first place? "Experts" need to give a very, very convincing answer to this question before urging us to abandon such poses.

Anecdotally, I've often been with groups of engineers where _everyone_ was assuming "low power" poses. The discussion seemed to flow more constructively in such circumstances; it was as though everyone admitted that they didn't know the right answers. They felt free to submit very rough ideas because everybody else was just as ignorant and not in a position to shoot them down. Enter a "confident" program manager, however, and the group quickly devolved into silence and/or banalities; everyone felt reluctant to express opinions that they didn't feel completely certain about.

[1] [http://epicureandealmaker.blogspot.com/2012/03/chesterton- fe...](http://epicureandealmaker.blogspot.com/2012/03/chesterton-fence.html)

<comment><USER9> I am female. My behavior is frequently interpreted by other people as extremely aggressive, attention mongering and so on. (Edit: I suspect a lot of it would be interpreted differently if I were male and it would be less of an issue.) It has gotten me loads of extremely negative attention. I have spent many years trying to learn to fly under the radar and deflect attention. This problem began very early in life with being an excessively cute, sunshiny child and continued with being viewed as a beautiful young woman (which came with perks like being raped and told it was my fault for being too beautiful to resist).

There are serious downsides to getting attention. Faking confidence when you do not have it and also do not have the ability that it implies can bring real trouble. I still want to figure out how to get traffic for my websites because I think that is my best hope for financial success but I have put a great deal of effort into learning to deflect attention away from me personally. I hope that if my work ever does garner good attention those lessons will stand me in good stead. Lots of celebrities have been seriously burned at some point and had trouble understanding why they were no longer darlings of the public eye. I got to go through that on a much smaller scale. My hope is that it will pay dividends some day when it matters more.

<comment><USER10> " Lots of celebrities have been seriously burned at some point and had trouble understanding why they were no longer darlings of the public eye. I got to go through that on a much smaller scale" After all it seems that you are afraid of loosing attention. Attention flood may be as undesirable as a drought. But if you have an unusual capability it would be unwise to not use it to your advantage, that is, unless you have money enough to pay for marketing and promotion while you stay away from the public eye.

<comment><USER9> I am not afraid of losing attention. I have a healthy respect for the very real danger that comes from negative attention. There is nothing neurotic about that. I have a medical condition which makes a normal job a big problem for me. My best bet for success is via the internet. Traffic is necessary to make money. That is a simple objective reality having nothing to do with my feelings, personal baggage, yadda.

</comment></comment></comment></comment><comment><USER11> The fun part is watching people actually try to control their body language in reality. You can try, but if you aren't feeling what that "power pose" is broadcasting, you'll just look like an idiot to anyone even remotely paying attention.

You aren't going to gain leadership by leaning back and spread eagling in a business meeting. You're going to gain it by being an actual leader and doing stuff that adds value to an organization.

<comment><USER12> > The fun part is watching people actually try to control their body language > in reality. You can try, but if you aren't feeling what that "power pose" is > broadcasting, you'll just look like an idiot to anyone even remotely paying > attention.

The article describes a scientific (?) experiment that goes counter that intuition.

</comment></comment><comment><USER13> Here's the TED talk from the researcher herself: [http://www.ted.com/talks/amy_cuddy_your_body_language_shapes...](http://www.ted.com/talks/amy_cuddy_your_body_language_shapes_who_you_are.html)

<comment><USER14> Came here to post that link. One of the best TED talks ever!

<comment><USER13> Well I beat you to it :-P is your username inspired by Marcus Aurelius? (I'm almost done with Meditations and it's great.)

<comment><USER14> Right! Love the presence of emperors' names.

</comment></comment></comment></comment><comment><USER15> Two things I am wondering:

First, what does it mean that these poses, these concepts ("power" as the desirable mode of relating to your coworkers for example) and even the key hormone we are meant to incite are so gendered? The poses are more essentially masculine than they are powerful. Have you ever seen a woman naturally with in the arm-around-the-chair pose, hips slunk forward and chest back? It would look quite unusual I think. As an employer, I'm not sure I want to select for testosterone (and I don't think I have so far). But maybe there is more to it.

Second, does it matter that attention is zero-sum? I would suggest that to ve convincing the author doesn't need to merely argue that body language manipulation is helpful, but that it is more helpful than, say, listening carefully, or preparing that much more for an interview, or even studying and thinking about human psychology more directly. You can only keep track of so many dimensions at once, and I'm not sold on the idea that I would benefit from privileging this dimension. Maybe I would, but that case hasn't been made for me yet.

<comment><USER16> I took burlesque dance lessons for a while. There was some time spent discussing posture and its use; I learnt some ways of standing that would make me look confident and sexy. There were some strong similarities to these "power poses" - but trust me, they were very, very feminine.

<comment><USER17> Examples?

<comment><USER17> What's with the downvote? A claim was made and I'm honestly curious what these "poses" are.

</comment></comment></comment></comment><comment><USER18> As a great practical guide to reading and applying body language, I'd recommend "What everybody is saying" by Dave Navarro. Guy used to do body language analysis for the FBI afaik, and then wrote a book about it.

[http://www.amazon.com/What-Every-BODY-Saying-Speed- Reading/d...](http://www.amazon.com/What-Every-BODY-Saying-Speed- Reading/dp/0061438294)

Concerning the body language tips the article recomends, I think everyone except arms crossed behind head is covered for in the book. Arm akimbo, crossed legs, etc.

As a personal tip, I'd give the thumbs up. No, like actually stretch your thumbs out when you walk around or talk to people, and leave them out of your pockets. It's ok to put the rest of the hand in, but the thumbs stay out.

Ahh, and if you're arguing, even if you want to, don't start undressing yourself, no matter how angry you are. 2 people arguing and taking jackets and shirts off usually means business you don't want to be part of neccesairily.

<comment><USER19> by Dave Navarro

I think you mean Joe Navarro, unless the guitarist from Jane's Addiction and RHCP has led a far richer life than I previously imagined.

<comment><USER18> I always get his name wrong, sorry for that. Yes, Joe Navarro.

</comment></comment></comment><comment><USER20> This is the actual definition of "cargo cult" behavior.

It's getting cause and effect backwards because you don't understand their relationship, and trying to imitate the effect in the futile hope that it will cause the cause.

People who sit all relaxed like that do so because they have power. They don't have power because they sit like that, and sitting like that will not magically confer power to you.

<comment><USER16> Here's some anecdata.

I took burlesque dance classes for a while. One of the things taught in this class was how to look confident, because projecting confidence is also pretty damn sexy.

Curiously enough, as I started learning these postures and using them, I found myself becoming a lot more confident. This was not something anyone told me to expect; it just sort of happened. It's spread out over a lot of how I move and behave, even when I'm not explicitly turning it on.

You are not a mind riding on top of a body. You are your body. And your body has a lot of weird feedback mechanisms that can be exploited.

<comment><USER21> Two weird feedback exploits I like:

1) smiling can lead to feeling happy 2) deep slow breathing can lead to feeling calm

</comment></comment></comment><comment><USER22> This is great stuff as long as you like people who breath their own exhaust.

As soon as you encounter someone who is not speaking the same language, there will be great confusion. Usually, this means anyone from outside of MBA/Marketing/ or other art-of-BS type disciplines.

<comment><USER23> The whole thesis of the article is that body language is automatic and ingrained, even in people born blind.

</comment></comment><comment><USER24> Impro: Improvisation and the Theatre ([http://www.amazon.com/Impro- Improvisation-Theatre-Keith-John...](http://www.amazon.com/Impro- Improvisation-Theatre-Keith-Johnstone/dp/0878301178)) has a great section on communicating status through body language and movement.

It describes a number of exercises where one actor takes the role of a superior and the other an inferior. The techniques are quite effective for the intended audience.

I would quote from it but I had a paper copy and it's really only worth running through once a decade for a non-actor interesting in the physical aspect of acting.

</comment><comment><USER25> I know that body language and customs are different, but I wanted to point out that in some Asian cultures, arm-crossing is done as a sign of respect, especially towards elders. It's a source of confusion and amusement for older people when the Western-integrated young people get angry.

That said, one should keep an eye out for more than just nonverbal cues, as telling as they may be.

<comment><USER26> It would make sense that a "powerless" gesture taken in deference to another is seen as a sign of respect.

</comment></comment><comment><USER27> I hate it when people put their feet up on tables, especially near my person. If you did that around me I'd just think you were an asshole.

<comment><USER28> Perhaps you are unconsciously responding to the "power move"? I had a boss who would routinely show up late to sales calls _we_ were making. We were the salesmen; we'd show up 10 minutes late. He said it was classic power strategy. Make them think they're waiting on you. I was pissed, back then. Today, I'm less incredulous and wonder if he was on to something.

<comment><USER29> It is a classic gimmick that salespeople do to convince themselves that they have a special skill beyond lying through their teeth at a customer.

<comment><USER17> Nah, he was likely just an asshole.

</comment></comment></comment></comment><comment><USER30> I feel like this is one of those instances where, once everyone knows about it, everyone does it, and everyone knows why you're doing it. Therefore, it eventually becomes ineffective (perhaps there is a name for this phenomenon). If I keep seeing books/blog posts/news segments on "power poses" then every interviewee starts putting their feet on my table, surely I'll notice. It's the body language version of a buzzword.

Also Zed Shaw had an interesting take on putting your feet on the table, but the link appears to be dead now. See: <https://news.ycombinator.com/item?id=1235791>

<comment><USER31> Wayback Machine has the article: [http://web.archive.org/web/20101222093524/http://oppugn.us/p...](http://web.archive.org/web/20101222093524/http://oppugn.us/posts/1270132724.html)

</comment></comment><comment><USER32> I believe that we humans can also detect fake and unnatural body language.

What I don't like about is when people try to be impressive and poses a fake and unnatural body language to convey a certain scenario or meaning.

Body language is all about the meaning of the messages they convey and the GENUINE emotion they are experiencing.

It should not be faked, for the purpose of conveying a meaning or a make believe scenario.

It should begin with the message itself, it should begin with the actual emotion itself.

\- Focus first on having a meaningful means of being confident, before you actually become, convey and exudes great confidence.

\- Focus first on having a meaningful message, before actually forcing people that you have a meaningful and convincing message.

Winners have a genuine emotion for winning, so they actually have a real winning body language. It is not fake, and it is very convincing, and people will be drawn by the same emotions the winner is experiencing via the winner's genuine body language.

I have encountered several people doing unnatural body language, they want people to believe that they are confident speakers but their message is so unconvincing, it does not gel and it is really annoying and is painful to watch.

<comment><USER33> All I can say is don't fake it. If you want to do a body language, feel it from within - instead of simply rearranging your arms and legs.

<comment><USER34> One of the pieces of research he cites (the one I've actualy read :) concludes that faking it will make it easier for you to feel it from whithin.

</comment></comment></comment><comment><USER35> This article doesn't address the "why you should never cross your arms again" that is in it's title at all.

</comment><comment><USER36> A couple of points:

1) As far as interviews are concerned (or any dialogue) mirroring might get you further than power -- eg: when your interviewer crosses his/her arms, you might gain an advantage doing the same - whatever the "power poses" theory says. I suppose it is like language: Short, conscience sentences might be "powerful" or "commanding" -- but that alone doesn't make for _effective_ prose in all cases. No communication without context.

2) Sitting in a room for two minutes, relaxing, convinced that you're doing a "power poise" -- might elevate your hormone levels. I'm sure screaming a battle cry, or doing a haka would work to. Not sure if it is just the poise in itself that helps with the levels. Would be interesting to do a reverse test: tell people that a "low power" position is actually a "power position" and vice versa -- and redo the experiment. I highly doubt we've got strong evolutionary ties to sitting with our feet up on a swivel chair.

3) The point about blind athletes -- so you imply blind people don't have socialized behaviour? Thankfully you don't have to live in an isolation chamber just because you're blind.

[edit: formatting x2]

<comment><USER37> Re: #2, My understanding of the experiment is that they simply had people assume poses, and then measured their hormone levels. If they really did tell them up front whether the pose was intended to make them feel powerful, that would certainly be an egregious mistake in the methodology, but that wasn't the impression I had from hearing the TED talk.

Actually, I wonder if you could even pull of that version of the experiment without the participants seeing through it ("No really, shrinking into your chair and looking at the floor is a great display of power!").

<comment><USER36> I didn't really mean to imply that that's how the experiment was initially performed -- or that there's no correlation between poses and hormone levels.

I was more wondering if the results could be replicated with different poses (and a different context).

Then again, if people already "know" that the poses are (relatively) high or low power (hence are able to "see through" false explanations in an alternative study) -- perhaps the mental state is more important than the actual pose.

</comment></comment></comment><comment><USER38> I can't locate the reference, but I've read, and observed, that if you want to verify that the person w/ whom you're conversing is paying attention to you, cross your arms: if the other person crosses their arms also, then they're paying attention to you.

<comment><USER29> Only if they are trying to sleep with you and have reqd a PUA book.

<comment><USER39> Oh God, I can see it now, startup pickup artistry:

"Yeah, I negged that investor twice and then escalated kino, and then popped the termsheet. You're a beginner--try a cold-open with a Paul Graham story and look for indicators of interest."

Yuck.

</comment></comment></comment><comment><USER40> I typically dance to music that makes me feel cool while walking to job interviews. So far it has worked really well.

</comment><comment><USER41> Great article. If anyone's interested I've got a video course on how to improve your body language. The course is 100% free and you can register at: <http://gobodylanguage.com>

</comment><comment><USER42> Lots of gems in here: [https://www.inkling.com/read/dummies-body-language- elizabeth...](https://www.inkling.com/read/dummies-body-language-elizabeth- kuhnke-2nd/chapter-8/building-defensive-barriers)

</comment><comment><USER43> Hmmm.. With poses you can broadcast your 'negotiation position', but I don't think it's appropriate to try to look like you're on the winner's side if you're not. Makes some sense in some situations like interviews though.

</comment><comment><USER44> I'm learning taijiquan: one of the key concepts is the alignment of the body posture to allow energy to enter the meridians. Health and emotion are both influenced by posture.

</comment><comment><USER45> Nice writeup. Interesting to see quite a few of those from buffer covering some interesting research into stuff that affects our lives.

there's little typo in 'Our nonverbals gove(r)n' though...

<comment><USER46> When I saw the word "than" used in place of "then," my estimation of the author plummeted, even though I agree with most of the article.

<comment><USER47> A single typo may not be enough to justifiably discredit an author - next time look for clusters of typos. :-)

</comment></comment></comment><comment><USER48> The title of this is complete bullshit! Did the writer actually read the study hes referencing? One of the conclusions is that crossed arms is meaningless!

<comment><USER29> Which gets more clicks: spreading a rumor or refuting it?

Link bait is a classic "power pose".

</comment></comment><comment><USER49> Something I find immensely troubling about these studies is that examples of high status body language are frequently things that I personally find extremely obnoxious or social-norm breakingly rude, to the point that I have often called people out on it.

The feet on the table one, for example. To what extent is that signaling high- status simply because it's a very rude thing to do? Is it implausible that a study might come out one day arguing that picking one's nose or scratching one's arse in front of someone is high-status body language for the reason that it is disrespectful to the other party therefore _must_ signal a confidence in the asymmetry of power?

I know it's not quite the same, but certainly as a teacher if my students don't sit "properly" on their chairs then I'll make clear that is unacceptable. The older they get, the better they should know, and the harsher I'll be. I've even sent students out of the room for it.

In situations where my higher status isn't assumed, the "calling out", however, does not have to be verbal. This picture in particular [http://blog.bufferapp.com/wp- content/uploads/2013/04/Screen-...](http://blog.bufferapp.com/wp- content/uploads/2013/04/Screen-Shot-2013-04-17-at-4.50.09-PM.png) annoys me just to look at it, and reminds me of formal occasions when someone has been sitting like that and I have conspicuously adjusted my own position so I am sitting straight-backed and upright. I can't remember a time when they haven't broken the pose and adjusted their position likewise. Sometimes it might take an uncomfortable moment of silence, but they _will_ break it. Am I adopting higher-status body language than them and they are keeping up? Maybe, but I don't think so - I believe sitting neatly and smartly in response to their pose just makes them (an _adult_ ) feel rather silly and they adjust to nullify that feeling. I mean, if you were being interviewed for a job by someone sitting in one of these supposedly "high-status" but actually pretty damn rude positions, you wouldn't think the interview had even _begun_ yet, would you?

Having read other replies in this thread, perhaps I'm wrong, and this means in monkey times (technical term) I'd be the male who beat up the other male for signaling challenging body language - and I doubt I would have lasted long given repeat trials. However, I don't think of it like that. It is simply a matter of respect and etiquette. _I'm_ not the one lying back on my chair or exposing my crotch. "Sit properly!"

My experience of social-norms is informed by growing up in middle class England and spending a long time living in Japan. I accept that in both cultures signaling deep understanding of what is polite is the higher-level currency of status. In other parts of the world, and for lower social strata, I appreciate it can be very different.

Additionally, in the picture I linked, the fact that the first guy is exposing his feet is probably actually more egregious to my sensibilities than his pose. If he were wearing a suit and smart shoes I think I would respect him more and consider the pose acceptable, I suppose in some way "earned". As it stands, there's just something very - and I realise I may be about to lose anyone on my side up to this point - "punchable" about his face...

A final point is that while I find myself in many situations where these displays are considered vulgar, to the point that they counter-signal by betraying a lack of etiquette-knowledge, they do seem to play an important role in the "game" of socialising. I instinctively _feel_ like a "douche" laying my arm across an empty chair next to me or positioning my legs in a way that suggests what is between them is enormous, yet I'll do it anyway when the situation is right and I'll justify it the same way I would "show off" dancing or playing an instrument. But not at work: <http://youtu.be/sEtQj9wuqhs?t=42s>.

<comment><USER50> > Am I adopting higher-status body language than them and they are keeping up?

You're playing a secondary game, countersignalling by conspicuously assuming a lower-status pose. You're both aware that you could instead assume their pose and play chicken with them about who will submit first. By "choosing the high road," you're saying that you've noticed the status game in play, and that now their implicit status move has become an explicit status move. And humans have strong norms about the group disapproving of _explicit_ dominance. (See: democracy.) So when the person displaying the dominant behavior realizes they've been "found out", they stop.

Also,

> The feet on the table one, for example. To what extent is that signaling > high-status simply because it's a very rude thing to do?

To answer this, consider the converse: to what extent could the fact that it's a rude thing to do be explained by anything _other than_ it being a show of dominance?

In the case of picking one's nose, it can be considered rude because it is a private grooming behavior considered to be not especially hygenic by modern standards. It exposes bits of one's internal "grossness" to others. It would be uncouth even without dominance circuitry.

In the case of putting one's feet up on a table, though, I don't much see what could be wrong with it _other_ than that it's a show of dominance. Perhaps we might be slightly wired to predict that feet are _smelly_ or _covered in dirt_ , but in the modern white-collar work environment this isn't the case--so it _shouldn't_ be rude. And yet it is. So it's a dominance behavior.

(And in the case of scratching one's arse, I'm not quite sure--that doesn't seem dominant to me, but nor does it seem rude. It just seems like an artificial restriction created by some Tough environments[1] to stratify people by "those who can ignore all their bodily urges and pretend they don't exist for longest." This is called _etiquette_ , and is a whole different kind of mating-fitness-signalling--more like birdsong than apes beating one-another up.)

[1] <http://michaelochurch.wordpress.com/2013/02/20/1410/>

<comment><USER49> Good reply.

The feet on the table did occur to me as one which I could have the wrong way around and while only "slightly wired to predict that feet are smelly or covered in dirt" may be true (seems unintuitive to me though), I think the perceived discrepancy is cultural as much as anything. I've noticed the ickyness of putting feet on tables is almost universally invisible to Americans, while in Japan it would seem completely unacceptable along with a whole host of other related customs, for example, the taking off of shoes and the special slippers to wear when you use the bathroom. Japanese ask me extensively about UK customs regarding shoes and feet, it's evidently considered a hygiene issue, much like their showering before bathing. In the UK the foot thing is probably a bit of both, varying from person to person, family to family. I was brought up such that I wouldn't ever consider putting my feet up on a table, even when completely alone in my own house. Our trains have signs telling you not to rest your feet on seats, I wonder if US trains do. What you say actually now _reduces_ the offense that I would take if an American put their feet up in front of me. I would think "well for them this isn't considered gross, just a sign of relaxation that at worst is dominance behaviour" and I'd attempt to force myself not to be disgusted by it.

<comment><USER50> One other thing might be that outhouses were an American innovation[1], imported to other parts of the world later; and thus, of all rural-living subcultures (which are the usual source for a culture's hygenic mores/superstitions, being the most affected by them), rural Americans have had the longest to adapt to not worrying about getting shite on their feet. :)

[1] [http://www.radiolab.org/2009/sep/07/sculptors-of- monumental-...](http://www.radiolab.org/2009/sep/07/sculptors-of-monumental- narrative/)

</comment></comment></comment></comment><comment><USER51> How can anyone wearing flipflops strike a power-pose? LOL

</comment><comment><USER52> if you actually have power, you can sit however you like, amirightoramiright?</comment>


The Twelve Days of Crisis – A Retrospective on Linode's Holiday DDoS Attacks - <AUTHOR> https://blog.linode.com/2016/01/29/christmas-ddos-retrospective/ <comment><USER3> I strongly believe it's not possible to safely run a site without DDoS protection for all servers anymore. Anyone with $20 can take down anything on Digital Ocean, Linode, Hetzner, and many others. Or they can run up a huge bill for you on AWS. I would love to use Cloudflare but I can't afford $6000/mo for DDoS protection on my servers with the wildcard requirements we need. Linode may have solved their DDoS problems with their own stuff, but what about their customers' VPSes?

I really wish people would start taking DDoS more seriously. It's really not something we can just null route servers for anymore. It's becoming a very serious problem. It's not going away, it's amplifying and getting far worse.

I'm also not sure how effective it would be, but it would be nice to see the FBI, NSA or whomever spend at least as much time fighting these DDoS warlords as they did persecuting whistleblowers and trying to shove backdoors into cryptography.

<comment><USER4> I think that effort would be better spent encouraging (see Forcing) ISPs to start dropping forged traffic at their borders.

IMO there should be significant penalties for network operators who do not drop obviously I forged traffic. How long has that rfc been around now and how little adoption has it seen?

<comment><USER5> >I think that effort would be better spent encouraging (see Forcing) ISPs to start dropping forged traffic at their borders.

The importance of spoofed traffic to attackers is greatly exaggerated, I could personally easily send 500+ Gbit (probably terabit) sized attacks by spending a couple of weeks building a router botnet. No need to spoof IPs and at that point diminishing returns would make amplification attacks useless. Not only that, but most amplified attacks are particularly inexpensive to filter.

>IMO there should be significant penalties for network operators who do not drop obviously I forged traffic. How long has that rfc been around now and how little adoption has it seen?

Who would penalize them? Why?

And I'm not entirely sure if you understand what RFCs are, that RFC (which hasn't even been around for very long) is - most other RFCs - <USER2> meaningless.

<comment><USER6> In practice, most volumetric attacks have spoofed IPs- amplified UDP reflection attacks and even SYN floods with no amplification.

Getting rid of UDP amplification reflection attacks will get rid of 90% of volumetric attacks.

<comment><USER5> We had volumetric attacks every day much before reflection attacks became common, the biggest attacks these days aren't reflected but from router nets.

And you simply cannot solve IP spoofing without rebuilding the entire internet, not to mention the fact that it does have legitimate use cases.

Also, if IP spoofing is making filtering difficult for you then you're doing filtering wrong.

<comment><USER6> How big were the volumetric attacks that you saw that involved real IPs? The amplification factor is 1x for the real IPs. With NTP reflection and DNS reflection, you get 50x amplification, so 1Gbps botnet (trivial bandwidth) will cause a 50Gbps DDos (non-trivial bandwidth). This is why filtering is desirable.

<comment><USER5> I saw a 500Mpps SYN flood just last week, followed by about 500Gbps of UDP packets. All from real IPs.

Botnets have far surpassed amplification attacks at this point.

>This is why filtering is desirable.

Come up with a way to implement it that actually works and doesn't break legitimate use cases. spamsolutions.txt is starting to seem relevant here.

<comment><USER6> We work with Verisign that specializes in DDoS mitigations, they have state of the art scrubbing centers on four continents and they are leading mitigation provider to the banks and schools. They told me they almost never see anything above 300gig. You must be special.

<comment><USER5> Yes, I would imagine I have far more experience dealing with large attacks than verisign.

>they are leading mitigation provider to the banks and schools

:)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Layer 7 attacks are the new hotness in DDoS. If you have a big enough botnet (either conventional botnet, or hijacked browsers), you can do them, and they're often quite effective.

Fundamentally, layer 3/4 are usually amplification. Those are still effective, and very efficient for the attacker, but they will someday (5y? 10y?) be blocked by closing up sources amplification. Address spoofing address at layer 3/4 might get addressed by BCP 38, Vixie's good fight, etc., but not holding my breath.

By the time all that happens, attackers will have moved on to layer 7 attacks. Those can target the weakest parts of your stack, and with a large botnet, even the act of blocking the IPs in the wrong place can add enough overhead to hurt. With a huge botnet of hijacked browsers, blocking everyone affected becomes a DoS vector in itself, since some of those are your own legitimate attacks.

The big problem for DDoS mitigation is that this requires much deeper knowledge of the protected application. It's hard to just put a box inline, or an unmodified cloud service, and have it block the attacks. There's both good science and great engineering to be done, by developers, platform vendors, and specialty anti-DDoS providers, to block this emerging kind of attack.

<comment><USER5> >Layer 7 attacks are the new hotness in DDoS

Maybe 10 years ago.

>Fundamentally, layer 3/4 are usually amplification. Those are still effective, and very efficient for the attacker, but they will someday (5y? 10y?) be blocked by closing up sources amplification. Address spoofing address at layer 3/4 might get addressed by BCP 38, Vixie's good fight, etc., but not holding my breath.

Sending "raw" UDP floods from bots still has several benefits over amplification attacks provided you can amass enough bandwidth, which isn't that difficult these days.

>By the time all that happens, attackers will have moved on to layer 7 attacks. Those can target the weakest parts of your stack, and with a large botnet, even the act of blocking the IPs in the wrong place can add enough overhead to hurt. With a huge botnet of hijacked browsers, blocking everyone affected becomes a DoS vector in itself, since some of those are your own legitimate attacks.

Unlikely, it'll take a fundamental change on how networks work for network layer attacks to become irrelevant. Especially considering volumetric attacks have the added benefit of potentially getting your target kicked off by their hosts and causing added damage in BW bills. And as internet connections become faster, DDoS attacks become bigger.

<comment><USER7> Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs.

If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers.

<comment><USER5> >Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs.

But the "great cannon attack" was absolutely minuscule compared to the stuff that happens every day, attacks of similar sizes were already reasonably common years ago (See: [http://i.imgur.com/0quYBdV.png](http://i.imgur.com/0quYBdV.png) a graph of an attack on reddit, from 2013).

Today we're talking about Mrps, not Krps.

>If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers.

That'd just be sloppy filtering, there's no need to drop L7 attacks on IP basis.

</comment></comment></comment></comment><comment><USER8> Far more concerning to me than this outage were the security incidents ([https://news.ycombinator.com/item?id=10845278](https://news.ycombinator.com/item?id=10845278)) that Linode seem to continually have once every year or so. The most recent one seems to have happened in July, but they didn't notify customers or reset passwords for another six (!) months. [https://news.ycombinator.com/item?id=10845619](https://news.ycombinator.com/item?id=10845619)

</comment><comment><USER9> Wow, still a lot of people fighting over whether or not Linode is a good company. It's a shame we don't get to see how <hipster hosting company of the month> copes with 80gbps of DDoS on a single DC.

I'm personally happy with Linode. They have a seriously tough technical issue to deal with —as much working out what's happening as how to stop it— and they seem to be doing a fairly top job at staying afloat. My servers haven't gone down. Any downtime in the last four years has been my fault.

So even if they are targets of some ludicrously powerful botnet, I'd rather stay with them than let the bastards doing this win. The attack isn't hurting my business or my clients and each incident we go through, the lower the chances of it _ever_ being a problem in the future.

On a more serious note, governments keep moaning on about encryption but botnets are still a much greater direct threat to national security.

</comment><comment><USER10> Uh-oh, the attacks started again a few minutes ago:

[http://status.linode.com/incidents/mkcgnmjmnnln](http://status.linode.com/incidents/mkcgnmjmnnln)

<comment><USER11> Which is why you do not blog about them and communicate quietly with your customers.

<comment><USER7> Not really as possible with a consumer scale web service, but you can certainly modify your communications strategy to be less of a red flag for the bull. :(

</comment></comment></comment><comment><USER12> Where's the Linode founder(s) in all this, and why couldn't they have kept customers informed? It seems like a lone network engineer has been left to deal with a potentially company destroying event.

<comment><USER11> I was personally in the room, and in agreement, when running a real grown-up AS with carrier transit was proposed to Chris Aker as early as 2010, maybe 2009, to avoid this very scenario and many others like it. It's not really news. I have tremendous respect for the engineer who proposed it and fully believe he could have executed on this when Linode still had four facilities and 360 MB Linodes were the norm. I'm not saying that to toot my own horn (really, I'm not "I told you so" or arrogant like that), but there are very specific reasons that this wasn't done for as long as possible. I lack recent context, but the Linode decision-making culture was for many years completely driven by one individual who worked to spend as little on infrastructure as humanly possible.

Even once growth really took off and revenue started making these big shifts in strategy viable, the mindset was still to be lean and scrappy. The minimal capital expenditure strategy had benefits early on and allowed Linode to maintain an incredible margin and support explosive growth, but they were too slow to start thinking like a grown-up company when it started to matter, and it's coming back to bite both on security (with almost zero investment; just enough to pass PCI-DSS) and things like this.

When I heard they bought the Philadelphia building, for example, I was very surprised because that's not the Chris I knew. We lobbied for a Philadelphia office for _years_. Could be a good sign regarding decision-making culture for the future, but hard to say.

Don't read me as bad blood or anything, as I wish Linode no ill will (I actually hope they can turn this perceived slump around), it's just educational to see the consequences of choices and mindset catch up with a company. I learned a lot about management style while working there and contrasting with subsequent employers.

<comment><USER13> > just enough to pass PCI-DSS

nope, the only way Linode "pass" now is being below the self-assessment questionnaire threshold. Once they have to move to an actual external audit they are fucked.

</comment></comment></comment><comment><USER14> > Our longest outage by far... can be directly attributed to frequent > breakdowns in communication

I have direct experience with Linode staff breakdowns in communication because of a security problem before the December attacks.

The problem affected many Linode customers and included risks to confidential information such as billing.

The Linode staff communication was terrible. The problem was severe and ended up with Linode on a blacklist of companies that are not suitable for hosting.

I have to agree with tptacek: do not use Linode for anything, and if you do now, make plans to switch to a new provider.

To end on a happy note, I migrated the project to Rackspace, and the Rackspace staff communication is excellent.

<comment><USER4> I'd like to learn more about these blacklists so I can factor that in when choosing a vendor, do you have a link? Google is just showing me pages of vendors trying to sell me hosting when I search.

<comment><USER5> I think this is more of a mental blacklist.

</comment></comment></comment><comment><USER5> >Layer 7 ("400 Bad Request") attacks toward our public-facing websites

I really wonder what that is supposed to mean, Linode has mentioned it multiple times but not elaborated on what sort of an attack this is.

I personally haven't ever head of a "400 bad request"-attack.

Edit: Yeah, I know what Layer 7 floods are :), but I'm pretty sure "400 bad request" floods are something Linode came up with, so that could use some elaboration by them.

<comment><USER15> I think it's just another name for Layer 7 DDOS. I.e. crafted HTML-requests, designed to be 'expensive' to compute/process.

<comment><USER16> Right, it seems pretty clear to me.

<comment><USER5> There's a lot of different types of Layer 7 attacks, what sort of a payload is a "400 bad request"?

<comment><USER16> Any HTTP request that causes the webserver to respond with HTTP status 400?

<comment><USER5> But that's not descriptive at all.

<comment><USER16> To me what it means is that the attacker figured out some custom call to the application that is probably expensive for the app to deal with and can easily cause a denial of service.

<comment><USER5> It'd be pretty rare for the application to return error 400, generally that's something that the server would be spitting out when it fails to parse the HTTP request.

<comment><USER16> That could suggest random urls. But it could be anything really depending on the app. I'm coming around to your pov that it is not descriptive. Something about the layer 7 flood was causing the app to respond with 400s and that's what Linode started calling it. But it doesn't help us understand anything about it.

<comment><USER5> It wouldn't suggest a flood of random urls, error 400 is generally a response from the webserver when it receives a request it can't understand (e.g not HTTP).

A request like that would never hit the web application as the server wouldn't know what to do with it.

see:

      echo ":P"|nc linode.com 80

      <title>400 Bad Request</title>

400 Bad Request

nginx

<comment><USER17> What exactly are you asking here? You seem to already have a solid understanding of what type of attack would generate HTTP 400.

<comment><USER5> Not really, there's a wide variety of different requests that would cause such an error.

Just flooding someone with ":P" shouldn't take them down.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I am pretty amazed Linode didn't have their own IP Transit up to this point. Their colo provider is Newark charges some pretty high prices from what i've seen.

</comment><comment><USER19> My plan is to keep saying this on Linode threads, just in case there are people who have missed it. Take my advice or leave it:

Please don't use Linode. If you are using it now, make immediate plans to switch. If you have friends who have things built on Linode servers, tell them to switch.

<comment><USER20> My plan is to keep saying this on Starfighter threads, just in case there are people who have missed it. Take my advice or leave it: Please don't use Starfighter. If you are using it now, make immediate plans to switch. If you have friends who have used Starfighter, tell them to switch.

Feel how dickish this sounds without giving any reason whatsoever?

Please explain why.

<comment><USER5> There's a pretty clear difference here.

Saying that would make you a dick.

The linode comment doesn't make tptacek a dick.

Why?

Because it's trivial to figure out why he's saying that by simply typing "linode" into google, but as of right now googling starfighter doesn't immediately bring up any reasons to avoid them.

Edit: Didn't mean to imply that parent was a dick.

<comment><USER20> It's dickish saying that without explanation. Like this it sounds like baseless smearing.

If he argumented the reasons before he could had just put a link. Sincerely, it's too much to ask?

<comment><USER21> To be honest, the number of "linode screwed up" posts on hacker news the last few years would be educational to you, and if I remember correctly, ryanlol even got a slap on the wrist due to one of those situations.

At this point, I am bored of people asking for citations on hacker news for things that are should be part of our tribal knowledge.

[https://www.google.com/search?q=linode+hacks&ie=utf-8&oe=utf...](https://www.google.com/search?q=linode+hacks&ie=utf-8&oe=utf-8#q=linode+hacks+site:news.ycombinator.com) About 2,810 results (0.34 seconds)

<comment><USER20> Tribal is the right word here with all the blind faith in medicine men and cargo cultism.

<comment><USER21> I meant it in the way of shared knowledge, just like we all know how to bypass a NYT filter, or that someone is going to complain about the lack of native scrolling in an article, especially on a Show HN.

I definitely agree that there is a huge amount of that type of thinking on HN (of course), reading the amount of people who used github but didnt know the different between it and git and were commenting today was a personal education.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Slightly related question:

They mention segregating their customers into separate /24s, and consequently having to assign an IP from every one of these subnets to the router for use by the customer as a gateway.

Is there any reason why they couldn't get rid of these by having customers set up a static route to the "primary" IP of the router (migration / configuration issues aside)?

<comment><USER23> The static route has to be via a gateway that is on a locally connected subnet.

<comment><USER22> You can have a static route to any local device, this is essentially what subnet membership does.

For example, if I have IP 192.168.0.2/24 assigned to eth0, my routing table will have:

      192.168.0.2/24 dev eth0 proto static scope link

I'm free to add a local route to a device outside 192.168.0.2/24 though:

      192.168.10.1 dev eth0 proto static scope link

This just indicates that I should be able to resolve the MAC address associated with 192.168.10.1 through an ARP query, same as other devices on my subnet.

</comment></comment></comment><comment><USER24> We are currently getting DDoSed at Hetzner and they are clueless as well.

<comment><USER5> If you're planning on getting DDoSd you probably should pick a provider that offers DDoS protection.

Not sure why you'd choose a budget provider for production infra anyway.

<comment><USER25> > If you're planning on getting DDoSd

This, don't do it, far better to not get DDoSd ;-)

<comment><USER5> Surely any org that depends on internet presence would plan against DDoS attacks. That's like internet 101.

</comment></comment></comment></comment><comment><USER26> No guess at motive? Did someone ask for ransom before these started? Is one of the Linode subscribers hosting censorship-evasion technologies? Or is this one just some very determined kids having fun over holiday break?

<comment><USER27> Could it have been Bitcoin related? The timing seems to roughly match up with the Bitcoin XT DDoS attacks mentioned here: [https://medium.com/@octskyward/the-resolution-of-the- bitcoin...](https://medium.com/@octskyward/the-resolution-of-the-bitcoin- experiment-dabb30201f7)

</comment></comment><comment><USER28> > Our nameservers are now protected by Cloudflare

How? I thought CloudFlare only protected HTTP? Can you have it reverse proxy a DNS server or is Linode using CloudFlare as the host for ns1.linode.com now?

<comment><USER7> Yeah, it's called Virtual DNS (vDNS); essentially a DNS application proxy.

(email me if you want more info; it's not really ideal for small sites, it's better to just use cf for hosted DNS then, since it's free, but we're happy to do vDNS for people who can't do hosted. Mainly providers, but also some enterprise customers with special DNS needs. It's a pretty cool technology.)

[https://www.cloudflare.com/virtual-dns/](https://www.cloudflare.com/virtual- dns/)

</comment></comment><comment><USER29> > after some stubborn transit providers finally acknowledged that their > infrastructure was under attack and successfully put measures in place to > stop the attacks.

Care to elaborate why it took them so long to ack? And name them so I know who to avoid in the future (or route around)!

</comment><comment><USER30> >he pervasiveness of these types of attacks has caused hundreds of billions of dollars in economic loss globally.

Is it really $100bn+ ? If so we could do with some government funded research / countermeasures.

</comment><comment><USER31> Thread on IPFS/DDoS: [https://news.ycombinator.com/item?id=10329195](https://news.ycombinator.com/item?id=10329195)

</comment><comment><USER32> > blackholing is a blunt but crucial weapon in our arsenal, giving us the > ability to 'cut off a finger to save the hand' – that is, to sacrifice the > customer who is being attacked in order to keep the others online

There is something very ironic about this. They have a policy which instead of addressing the problem actively assists anyone wanting to attack their customers. No surprise that these customers have been complaining about this practice for a long time. But until now it was Somebody Else's Problem so they didn't bother figuring out some proper (or at least less terrible) solution. Now this lack of preparedness bit them in the ass...

<comment><USER11> I'd posit that 98% of providers from whom you can acquire budget VPS will do the same thing. The practice is not unique to Linode; why should a network you're paying $20-$100 do everything they can to keep a target online and threaten other customers?

Contrary to popular opinion, if you're getting DoS attacked, you're either (a) popular enough to start thinking about adult-size pants for your transit strategy or (b) inviting the attention by your choice of content or activities. In years of hosting, I started to know the targets of DoS attacks by name. You have to own at least a little bit of responsibility, and mitigate on your own end if you're going to be inviting that kind of attention; IRC and controversial blogs are the usual suspects here, but that's probably changed recently as I've been out of the hosting game for a while.

Linode has few options for reacting other than the one they use. I know that sucks, but it's how it is.

<comment><USER32> Yes, customers of other budget VPS providers are complaining about this too.

> why should a network you're paying $20-$100 do everything they can to keep a > target online and threaten other customers?

I am not a network engineer and I know that this is a very difficult problem. But when the provider doesn't even _seem_ to try, it only encourages further attacks.

</comment></comment></comment><comment><USER33> Does the buck stop with this network admin? Where's the CEO?

<comment><USER34> Riding his motorcycle across Europe, occasionally sharing photos from vacation with his plebeian workers in #linode-staff who are earning $38k and can't afford to take any vacation.

</comment></comment><comment><USER35> I wonder what will happen if Linode routes their traffic through CloudFlare...

<comment><USER11> It wouldn't work. That's not what CloudFlare does (right? they didn't do BGP last I heard). You'd need something like Black Lotus, now owned by Level3, for that.

<comment><USER7> You're technically correct as of Fri Jan 29 15:48:27 PST 2016.

(email me if you'd like more detail; you seem smart/interesting but don't have email in your hn profile)

<comment> X-Istence Transparent scrubbing would be awesome, have CloudFlare advertise my networks, then CloudFlare on the backend sends the clean traffic to me...

Can do it with peering with CloudFlare directly, or even if that is not possible MPLS on the backend to direct the traffic to where it needs to go.</comment></comment></comment></comment>


Ask HN: Starting a Business with Full Time Job - <AUTHOR>

Hi guys, first post on the board...
I was curious if any one has a success or horror story about creating a startup while working full time in a corporate environment (eventually transitioning to the startup).
I have a great idea for the industry my employer is in. I have already began building the product on Force.com on my own time and have my first customer with 500 users waiting for me to finish.
I would not be competing with my current employer, but creating a service that would in turn help my employer (and their competitors)  sell products more effectively. This is something I have tried pushing through our company with no success, so I figure it's time to do it myself.
I am working as fast as I can in my spare time, carefully separating my personal time from my employer's time. I should complete my work sometime next month.
Has anyone been in a similar situation and had issues with their employer when leaving? I dont want my employer to claim rights over what I have created in my spare time.
Thoughts? Suggestions? <comment><USER2> Your on dodgy grounds right now, as the idea was developed in the course of doing business for your employer. Any IP rights will probably belong to your employer, you either need to leave before you work on it or negotiate an agreement with your employer.

The later might not be impossible but depends on your company, Salesforce actually started in a similar way with Benioff leaving Oracle to pursue his vision, Larry Ellison actually not only gave his blessing but also invested in them. The investment bank I was working for we're completely happy for me to work on a non-competing startup.

Salesforce actually have an investment fund especially for startups building products on Force.com, have you considered applying for it as an alternative to your day job ?

<comment><AUTHOR> Thanks for the input, I actually didnt know about the investment fund for Force.com startups. I will definitely apply.

Thank you everyone for the feedback, my decision will probably be to leave the company and provide consulting for them while I start my business, I am definitely ready to jump in!

</comment></comment><comment><USER3> Since there is a potential conflict of interest between the work you do for the company and the work of your startup, I would advice you to take a closer look at the terms of the employment agreement as well as the local IP and ownership laws governing corporations and their employees. Hoping that a corporation might let you of the hook is because what you are doing might be helpful, might not be a good thing to err on.

</comment><comment><USER4> Many businesses start out just like you describe. If you did all of your work off the clock and you're not using any intellectual data or proprietary processes you should be in the clear. Keep any concept designs or specifications just in case. I have friends who started their business on the side, left their employer, and then the employers became their customers.

<comment><AUTHOR> Thanks, I agree with the first posters that you should always consult with an attorney to be 100% sure.

I know many in this community have dealt with the situation and have a story to share.

I am also considering the option of leaving the full time position and becoming a part time consultant to continue my work and eliminate the risk of the company claiming IP on my creation.

</comment></comment><comment><USER5> My thought is you should consult a lawyer who has experience with intellectual property law before you do anything else. Bring your employment contract and employee handbook with you (if applicable).

<comment><AUTHOR> I knew this would be the proper answer :-)

Im just curious if anyone has similar experience in dealing with this common scenario.

</comment></comment><comment><USER6> Add "Ask HN:" prefix to your title.

<comment><AUTHOR> Thanks for the tip!</comment></comment>


USPS API bug exposed user data of 60M users - <AUTHOR> https://krebsonsecurity.com/2018/11/usps-site-exposed-data-on-60-million-users/ <comment><AUTHOR> This is the site that last year had a password reset bug also. When resetting your password the system would generate a random password and email it. During the reset password the current password (the one emailed) is required, and their form validated the old password for the security requirements (length, special character, etc) that the auto-generated reset password did not meet. This effectively locked you out of their site. It took them three months to fix that.

We absolutely cannot trust this company with our data, yet we have no choice but to do business with them.</comment>


Microsoft releases STM for .NET - <AUTHOR> http://blogs.msdn.com/somasegar/archive/2009/07/27/stm-net-in-devlabs.aspx

<comment><USER2> More information: <http://msdn.microsoft.com/en-us/devlabs/ee334183.aspx> and [http://download.microsoft.com/download/9/5/6/9560741A-EEFC-4...](http://download.microsoft.com/download/9/5/6/9560741A-EEFC-4C02-822C-BB0AFE860E31/STM_User_Guide.pdf) [PDF]

MSFT's STM strengthens my belief that STM cannot be done correctly without modifying the language semantics. Clojure avoids many of the pitfalls in the current user guide (2nd link I posted) by using semantics that are not possible for C# to adopt and remain backwards compatible; this will likely result in an inferior product. Standard MSFT.

<comment><USER3> Reading the pdf makes me appreciate Haskell again. It seems really complicated whereas using STM in Haskell is simple. One paper by Simon Peyton-Jones explains STM much better than this large user guide.</comment></comment>