The Black Technologist Who Invented the First Internet Search Engine - <AUTHOR> https://daily.jstor.org/alan-emtage-first-internet-search-engine/ <comment><USER2> Oh I remember Archie!

There was always a story it was named after the comic, and after it there were the Veronica and Jughead systems which were named the same way. I just checked then and Wikipedia says he didn't name it after the comic and hated it. So there goes another 1990's myth.

Archie itself actually never worked very well, but nothing did in those days so we were amazed when it actually returned a result.

<comment><USER3> I can probably count the number of dinner parties I've been to on one hand. The only one I remember is the one where, in the mid-90s, we discussed the fact that the web was wonderful but there was no way to find anything.

<comment><USER4> And you didn't sense a start-up opportunity and beat Sergey, Larry and friends to the table?

<comment><USER3> I only lacked a few things: a good idea, a workable skillset, a funding source, anything remotely construable as personal initiative...

</comment></comment></comment></comment><comment><USER5> HN is sometimes one of the more progressive wings of the geek community. It's disheartening to see the number of replies expressing dismay at race being an interesting and notable part of this story. Representation is a crucial concept in history and media, and a key element in why conversations about privilege are necessary.

Rather than stating that you don't know why it would be relevant to mention the man's race, why don't you just actually ask yourself the question? Why does it matter that he is black? You all are great problem solvers. I think you can come up with some interesting answers.

<comment><USER6> Removing my comments because this thread has sparked unnecessary discourse and reactions that this comment is the cause of.

<comment><USER7> Ah yes, if you truly want to get rid of bugs in your software, then not mentioning them is the best way to get there. Start acting like your code has no bugs now!

The status quo doesn't change if people don't talk about, analyse and challenge it.

<comment><USER8> "Fuck it, ship it" as applied to bugs in political systems... I like it.

Maybe it can help get through to people who write code all day that racism is built up technical debt, and ignoring it doesn't mean it will go away?

</comment></comment></comment></comment><comment><USER9> Here's the 1990 USENET announcement of "archie".[1] This wasn't a full text search engine. It just collected what it got from "ls".

 _" Alan has a set of shell scripts that automagically calls up some subset of our list of servers each night (to keep load down on any one machine) and do a remote 'ls' on that machine. We cycle through the entire list in about a month, so no entry can be more than that old. For what it's worth, we currently know of about 210 sites."_

 _Archie allows anyone to rlogin into one of our machines and query our archive lists. Another one of my guys, (Bill Heelan, whe...@cs.mcgill.ca) wrote a bare-bones front end, which allows people to login, get a help message, ask for a specific string (using ed-like regular expressions) or get the contents of a specific archive server._

 _Currently, archie is pretty brain-damaged. The files are stored as flat ASCII files and the "prog" command just launches a "grep" with the appropriate arguments. Future plans (once we get the latest start of semester out of the way) is to add a real database (we've compiled postgres (sp?) and Alan has started to code the program to parse the raw input)._

So that was Archie. That's like a library shelf list, or Active Directory, not a search engine.

Long before WWW search engines, there were computerized keyword and catalog databases. The US National Library of Medicine (MEDLARS) and Mead Data Central (later Lexis/Nexis) were early big ones. Big libraries also had online catalogs by 1990.

AltaVista was the first big full-text search engine. AltaVista was in the old telco building behind the Walgreens in Palo Alto. where PAIX is now. AltaVista was built as a demo of DEC Alpha servers. It was the first data center built telco-style, on open racks with the cables overhead. This was because they had the racks in place, but it became a trend.

[1] [https://groups.google.com/forum/#!msg/comp.archives/LWVA50W8...](https://groups.google.com/forum/#!msg/comp.archives/LWVA50W8BKk/wyRbF_lDc6cJ)

</comment><comment><USER10> I loved Archie and it was still useful for a good year or two after the weww got going. Nice to finally learn who was behind it - back then people rarely shared photos of themselves since they took forever to download.

</comment><comment><USER11> Not related but Montreal is mentioned every once in a while on HN but I still feel a bit of pride every time.

</comment><comment><USER12> I vaguely remember Archie. On the topic of early web search, does anyone remember "Jump Stations"? They were basically collections of curated web links (as I recall, 25 years out now).

</comment><comment><USER4> Was just thinking this earlier this week, can anything, at this point, hold a candle to Google in terms of search? Or possibly compete well with it such that people could switch?

Recently heard about the news Google is discontinuing enterprise site search, not that that is such a huge problem, but it's just another example of the issues that arise from having a monopoly control everything with no alternatives. They can pull the plug and everyone is left lacking.

<comment><USER13> The cost of entry in the search market just went way, way up due to Google implementing neural nets extensively in its search algorithms (Deep Mind whatever.) No question about that. Someone else might find a way to do that better, however; if so they could now take the market away. (But that doesn't mean I think that's likely.)

<comment><USER14> The years of collected data on personalizing search results, what different demographics expect, etc...Is a big barrier as well.

I believe they are able, for example, to know I want "Apache" the software organization even if I've never typed it before, because they've seen my previous software related searches. And...Injected some behavior based on searches by other people like me.

Someone else is getting much different results for the same term...Again, even if it's for the first time.

When I hear people say they don't like duckduckgo's results for a search term, it seems to usually trace back to "no tracking equals no personalization".

<comment><USER13> I agree with all of that. I think it's all well known. Which is why I said I'm not saying that someone overtaking Google is likely - just more possible now.

</comment></comment></comment></comment><comment><USER15> One of the things I love on the old Internet is how people took off with the Archie theme on other search engines. Gopher's main search engine was Veronica (Very Easy Rodent Oriented Internet Something Something). I also recall a Jughead search engine.

The second generation search engines killed the theme off (Altavista, Lycos, Webcrawler, Infoseek, etc...), but it was fun while it lasted.

</comment><comment><USER16> Neat.

I clearly recall connecting to archie.au and archie.nz to do (slow-ass!) searches back in the late 1980s and early 1990s.

Why those? Easy to remember!

</comment><comment><USER17> Sad to see some people here be upset at the harmless mention of a subject's race. Though it is proof positive to me that even a community as dedicated towards intellectual pursuits like Hacker News has its fair share of regressive elements as well.

</comment><comment><USER18> This escalated quickly. But I would actually somewhat side with the commenters saying that it is odd to explicitly mention the race in the article. I get that it is Black History Month in the US and in that context it seems appropriate but I would question whether having a Black History Month is a good idea in the first place.

It is not obvious to me that explicitly pointing out a distinction is the best way to get rid of said distinction, be it black or white, male or female, gay or straight. It is a historical accident that one of the groups in each case was at a disadvantage in the past and that this continuous on to today with the gap narrowing slower than one may want.

So I understand that it seems warranted to give the disadvantaged group special attention to close the gap as fast as possible. But does this necessarily require pointing out the distinction in the way this article or Black History Month does? Sure, any program targeting a specific group can not totally avoid making use of the addressed distinction, but would it not be better to keep this as inconspicuous as possible?

<comment><USER13> Why mention his race 'cause there's no such thing as unconscious bias and Valley funding and hires are as diverse as society is and... ah... oops, no, wait...

<comment><USER18> This did not really add something to what I said, I did not deny the existence of the problem. You have to argue why mentioning the race is helpful, why it helps to reduces biases. Why does it not do the opposite, why does mentioning the race not reinforce its importance?

<comment><USER13> I think I did mention that bias was unconscious; we all know brains are association machines, therefore associating more colors with computing achievements is obviously a good thing. If you know of a perverse effect, I'd be glad to hear of it.

</comment></comment></comment></comment><comment><AUTHOR> the OP here. as it seems there are some queries in peoples' mind re: the article's title; I am copying below the author's thoughts (from her social media feed) about the article, which I think is useful.

"My latest piece for JSTOR Daily looks at a hugely influential technologist who is strangely absent from most lists of Black inventors. Alan Emtage invented the world's first search engine -- so I look at the massive impact of search, not only on how the web works, but how our brains work, too."

P.s. Am notifying the author about the discussion here. If she has time & so inclined, to engage.

P.p.s. as for myself, I was hoping to see interesting HN discussion about search before pre-Google, & how search is affecting our brain + thinking process.

</comment><comment><USER19> Unfortunate title, since it's already dragging this into flamey territory...

Any good information on the actual search engine? I'd never heard of it, it's before my time. TFA has about two paragraphs about it before bloviating into a philosophical discourse on the effect of search technology on society.

</comment><comment><USER20> Why is the race of the man relevant? Seems a bit odd to point it out in the title that he was of presumably african heritage?

<comment><USER21> If your question is honest, I'll give you an honest answer: When you're a member of a minority that is commonly portrayed in the media as being an 'other' / 'not good enough' / 'not likely to succeed', this kind of identification is heartening. It shows you that people like you can succeed, people like you have succeeded, and people like you _matter_. I'm going to go ahead and assume you're not a part of a group that experiences this, and that's why you're asking this question. This is me assuming the best in your comment. Be aware, though, that lots of times when this question is asked, the underlying sentiment is: "I'm tired of hearing about race," or "why can't everyone just shut up about what group they belong to."

So the next time you ask that question or hear it being asked, be aware of how it's often heard. It might help you understand the potential reactions.

<comment><USER22> I find it demeaning to make it a point that someone from a certain race " _actually succeeded this time!_ "

It seems to me that in doing so, one also indirectly makes the point that most people from race X don't succeed.

It's good sentiment at best and racism at worst.

<comment><USER21> You raise a valid point. Our celebration of "Minority successes" does often border on infantilization. This is a sentiment that comes up in the disability community: "I don't exist to inspire you, I just want to live my life and be respected like anyone else."

It's a fine line. As more fields (I.e, CS) have visible minority successes, this need will fade. But we are not there yet.

</comment></comment></comment></comment><comment><USER23> Reading "black technologist" my first thoughts goes to some malicious figure in a science-fantasy novel, not the color of ones skin. What is next, "the yellow programmer"?

I'm so glad I don't define who I am based on my skin color. Is the color of your skin of any importance when we are talking about your achievements? If he was white, would making the first search engine be less remarkable?

<comment><USER24> I think it's pretty important if the descendant of someone who was kidnapped and enslaved to provide for a legally enforced illiterate underclass is able to not only read and write but read and write code and make significant contributions to the field of software engineering. Like if someone who lost a foot won the 100 meter in the olympics, not the paralympics . . .

<comment><USER23> "Alan Emtage was born in Barbados, the son of Sir Stephen and Lady Emtage."

<comment><USER25> Sorry but your facts don't fit his narrative.

</comment></comment></comment></comment><comment><USER26> Annnd they used the whitest photo of him they could find.

<comment><USER27> im not sure what him beeing black has to do with the first search engine

<comment><USER28> Black History Month - that's why.

</comment></comment></comment><comment><USER29> Why is his skin color mentioned as part of the headline? Also, isn't Emtage a French name, and the guy doesn't look black?

</comment><comment><USER30> This concept does not conform with my confirmation bias.

</comment><comment><USER31> I don't understand why one would point out a person's race (unless it's relevant to the situaiton), but since the title did...

I cannot fanthom how anyone could call this person "black". If anything, his complexion is similar to what US people call "hispanic" (although to me that's just southern European, not a distinct race).

<comment><USER32> I can tell you why it's important to note the race of an underrepresented minority who made a notable contribution.

I teach programming to a group of black young adults. Self image is very important to most young folks. Just seeing other black people who are successful computer programmers helps them imagine themselves as computer programmers.

Identity matters to young people who are trying to shape their own self image.

<comment><USER22> Then why is it strictly forbidden to write an article with a title that caters specifically to young white children?

<comment><USER32> I don't think I'll be able to do satisfactorily answer that question in a couple sentences, but I'll try.

White people are a majority in technology, so it's assumed to be obvious to white children that they too can be a technologist. There's not a significant gap in perceived identity between themselves and Mark Zuckerberg, for example.

So, that begs the question, why focus on encouraging specifically white children? They don't face racial barriers and have many famous role models. Preference for white people has a long and ugly history in America.

<comment><USER33> We probably need more white role models who didn't go to Harvard or Stanford, though.</comment></comment></comment></comment></comment>


3K, 60fps, 130ms: achieving it with Rust - <AUTHOR> https://blog.tonari.no/why-we-love-rust?ref=twtr <comment><USER2> Previously:

[https://news.ycombinator.com/item?id=23540586](https://news.ycombinator.com/item?id=23540586)

</comment><comment><USER3> 130ms is a world better than 500ms and a much welcome improvement, but it is still terrible.

Latency happens throughout the whole stack; Unfortunately much would need to be fixed outside this project to achieve any further significant improvement.

Operating System, firmware, blackbox hardware are some other non-negligible sources of latency. Everything adds up.

<comment><USER4> What would a "non-pathetic" latency look like? What improvements in "the stack" would be needed?

The 130ms is "the time from light hitting the camera to when it appears on- screen on the other side". The article doesn't really specify _where_ the latency happens, but with just the encoding/decoding of video alone I think you'll very quickly get latencies in roughly the ~100ms ballpark no matter what.

<comment><USER5> Not "no matter what," but perhaps "running on a multitasking operating system." With a hardware encoder and 1-frame buffer you could get down to 50ms.

<comment> vertex-four Across the internet, at all times?

<comment><USER5> No, just exclusive of transport. So 50ms in-the-building and another 50ms for SF-NY and another 50ms for SF->Moscow or similar.</comment></comment></comment></comment></comment>


RAMBleed Attack – Reading Bits in Memory Without Accessing Them - ga-vu https://rambleed.com/ <comment><USER2> Shortly after I joined Microsoft in 2004, all new feature work on Windows Longhorn (Vista) was halted. There had been yet another high profile computer virus on Windows XP caused by a buffer overflow. It was an all-hands-on-deck type moment. Everyone spent weeks adding SAL (source-code annotation language) annotations to the entire Windows code base. SAL annotations enabled automated source code analysis to identify potential buffer overflow bugs and other common security vulnerabilities. Once annotated, we identified and fixed who knows how many hundreds of security vulnerabilities in Windows.

This colossal security update was released as Windows XP Service Pack 2. This is the beauty of software.

Hardware vulnerabilities scare me. There are millions of Intel CPUs and DRAM modules installed in data centers and PCs around the world. When we find vulnerabilities in _hardware_ how are we supposed to fix them?

The past few years have been really scary for me as a software engineer. I keep thinking that the next one will pop the software bubble.

<comment><USER3> > SAL annotations

Are there tools for developers to use these (e.g. with VC++), or are they all Microsoft internal?

<comment><USER4> I have read about this: [https://github.com/google/styleguide/tree/gh- pages/cpplint](https://github.com/google/styleguide/tree/gh-pages/cpplint)

There is also this: [https://github.com/mre/awesome-static- analysis](https://github.com/mre/awesome-static-analysis)

<comment><USER3> I was specifically asking about SAL.

<comment><USER4> There is also this: [https://docs.microsoft.com/en-us/visualstudio/code- quality/u...](https://docs.microsoft.com/en-us/visualstudio/code- quality/using-sal-annotations-to-reduce-c-cpp-code-defects?view=vs-2019)

<comment><USER3> I think they talk about the annotation but not the analysis tools?

<comment><USER5> [https://docs.microsoft.com/en-us/visualstudio/code- quality/c...](https://docs.microsoft.com/en-us/visualstudio/code-quality/code- analysis-for-c-cpp-overview)

It's part of VC++.

But I do not recommend using SAL for modern code.

<comment><USER3> Oh wow. I'd used /analyze before but I hadn't realized it takes SAL into account. I thought it just does limited extra analysis without SAL. Thank you!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Whenever you have sharing, you usually have side channels. We're going to see more and more of this until we have much better hardware isolation.

This is a kind of obvious variant of Rowhammer, which hasn't generally been fixed AFAIK.

Hardware in the late 2010s seems a bit like Windows in the late 1990s - <AUTHOR> house of cards waiting to collapse, but the dominant vendors know that very few customers are willing to pay more for security and reliability vs. performance/features/new and shiny.

(So if we're lucky then we'll end up with a "more secure" version of hardware that is analogous to... Windows Vista.)

<comment><USER7> Real-world side channels are going to start getting more attention as the technology and techniques for extracting information from EM radiation from circuits (not radios) leaking state improve.

<comment><USER8> Is that possible without special hardware to detect EM radiation?

<comment><USER9> You usually need an antenna, yes. Does that matter?

<comment><USER10> it matters because if the hardware is difficult and expensive to obtain, an attack can be costly, and hence, won't affect the common man. Industrial espionage or state level espionage hardly changes for the common man, and since most of the hardware in use is by the common man, it's unlikely to get a real fix.

<comment><USER11> Effective antennas are reasonably easy to build from scratch (depending on the frequency band), and are commercially available in an insane number of variations. Either way is very cheap - as little as a few dollars.

Software defined radios can be had for as little as $10-20 for simple receive only types, up to several hundred for substantially nicer transceivers. They can also be $1000+ for special applications or R&D.

</comment></comment></comment></comment></comment></comment><comment><USER12> From the speed figures (many hours of setup and runtime, very low read rate) I can suggest that restarting your important service often, and moving it between VMs, would prevent an attack like that.

In many deployments, automatic scaling and failover already provide the necessary mechanics. Then the Chaos Monkey suddenly becomes a security enforcement tool :)

<comment><USER13> > From the speed figures ...

You know what software's like, though. What today takes the blood of a virgin and a dozen dribbly candles will be doable next week with a toothpick and three cc's of mouse blood.

<comment><USER14> That was ..... interesting quote.

</comment></comment></comment><comment><USER15> If I understood correctly, this is orders of magnitude worst that RowHammer, as it is kind of passive: you set some program to do the RowHammer side, within its own memory space, and then use RAMBleed to see changes from memory cells, not exactly the ones that were RowHammered. Is that it ?

<comment><USER16> > a bit is more likely to flip when the bits above and below it have the > opposite charge. ... To exploit this effect, we developed novel memory > massaging techniques to carefully place the victim's secret data in the rows > above and below the attacker's memory row.

The secret data has to be duplicated, column aligned, and have a single unallocated row between it. Controlling the alignment of the secret data seems like a major complication for realistic exploitation.

Edit: The strategy in the paper requires allocating a bunch of physical memory from all the small blocks so that memory allocation requests from a new process are allocated deterministically to a desired physical row.

<comment><USER17> _> Edit: The strategy in the paper requires allocating a bunch of physical memory from all the small blocks so that memory allocation requests from a new process are allocated deterministically to a desired physical row._

Honest question, because I'm not a security expert: can you do this without having already pwned your target to such a degree that this would be unnecessary?

<comment><USER18> Probably not.

However, historically, these sorts of attacks always get better, not worse.

And while even that can sometimes be empty rhetoric, I will say in the last 5 years I'm seeing a lot of security attacks that are _already_ well beyond what even my moderately-trained intuition would suggest are possible, so I have to admit I've sort of given up on trying to guess on whether or not an attack can be made practical. I've seen too many mind-blowing presentations from security researchers to think I can bound their abilities safely. I wouldn't care to bet that they won't move the attacks I already am flabbergasted can exist to some other even-more practical attack that I am flabbergasted can exist.

This is unrelated to the current matter, but let me give you an example: [https://www.youtube.com/watch?v=_eSAF_qT_FY](https://www.youtube.com/watch?v=_eSAF_qT_FY) If you think that's trivially obvious, and you're confident you can predict how these sorts of things will play out in the future, more power to you, but I'm certainly not justified in that belief at my skill level. I'm just happy I can _follow_ that presentation!

<comment><USER19> Yeah, it seems that whenever an exploit "doesn't seem practical for actual use" it is just one more exploit-in-the-chain away from being operationalized.

So many systems have unspecified, undocumented and undertested behaviors that have not been exploited only because no one has ever tried.

<comment><USER20> Presumably there would be value in releasing the "impractical for actual use" version to the public after you have already operationalized and not before.

</comment></comment></comment></comment></comment></comment><comment><USER21> These recent CPU and Memory vulnerabilities are calling into question the economics of the public cloud. A lot of these bugs only really matter if you have multiple programs from different entities running on the same computer system. A company that has its own private cloud, doesn't have to care about these attacks so much.

The cost of mitigating these attacks both in terms of CPU performance and increased hardware costs may offset some of the economies of scale.

</comment><comment><USER22> Since the mention of OpenSSH can cause readers to jump to false conclusions: This attack still requires that the attacker's code runs on the victim machine; it is not a remote vulnerability.

(I don't think the authors implied otherwise, I just know that I somehow got confused for a second.)

</comment><comment><USER23> Can we talk about these attack names? Everything bleeds these days. "RAMSack" is a legit missed opportunity.

<comment><USER24> "Bleed" has a functional purpose; it communicates that it is a side-channel leaking information.

<comment><USER25> "Bleed" is normally just used for communicating that the exploit leaks data. See Optionsbleed, Heartbleed and Ticketbleed which are not side-channel attacks afaik.

</comment></comment></comment><comment><USER26> Perhaps I'm missing something really obvious, but doesn't hardware-provided memory encryption solve this quite handily? You might be able to read single bits of raw physical memory from another process, but this won't tell you anything substantial about what that process is up to.

<comment><USER27> The mitigations section of the paper discusses memory encryption

</comment></comment><comment><USER28> For those who find that sort of thing interesting, the domain was registered 109 days ago, February 23, 2019.

[https://whois.domaintools.com/rambleed.com](https://whois.domaintools.com/rambleed.com)

</comment><comment><USER29> Anyone else love how vulnerabilities these days have full on marketing-esque campaigns backing them? In any case, if it increases awareness, I'm mostly supportive.

Allow me to save some time, from TFA:

> Is there a CVE number?

> Yes, see CVE-2019-0174 [1].

[1] [https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2019-0174](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2019-0174)

\---

> What is RAMBleed?

> Previous attacks exploited the Rowhammer effect to write (or flip) bits in > the victim's memory. RAMBleed is different in that it uses Rowhammer for > reading data stored inside the computer's physical memory. As the physical > memory is shared among all process in the system, this puts all processes at > risk.

> What data can be read by RAMBleed?

> While the end-to-end attack we demonstrated read out OpenSSH 7.9's RSA key, > RAMBleed can potentially read any data stored in memory. In practice, what > can be read depends on the victim program's memory access patterns.

> What technologies are affected by RAMBleed?

> RAMBleed relies on Rowhammer-induced bit flips to read privileged memory. As > such, any system that uses Rowhammer-susceptible DIMMs is vulnerable. > Previous research has demonstrated bit flips on both DDR3 and DDR4 with TRR > (targeted row refresh) enabled. While we demonstrated our attack on a > desktop machine and an ECC enabled server machine, Rowhammer attacks have > been demonstrated against both mobile devices and laptops. As such, we > suspect that many classes of computers are susceptible to RAMBleed.

> How can I mitigate this issue?

> Users can mitigate their risk by upgrading their memory to DDR4 with > targeted row refresh (TRR) enabled. While Rowhammer-induced bit flips have > been demonstrated on TRR, it is harder to accomplish in practice.

> Memory manufacturers can help mitigate this issue by more rigorously testing > for faulty DIMMs. Furthermore, publicly documenting vendor specific TRR > implementations will facilitate a stronger development process as security > researchers probe such implementations for weaknesses.

<comment><USER30> Relevant @patio11 article

[https://www.kalzumeus.com/2014/04/09/what-heartbleed-can- tea...](https://www.kalzumeus.com/2014/04/09/what-heartbleed-can-teach-the- oss-community-about-marketing/)

I think the marketing campaigns are awesome. Makes it much easier to get resources to fix.

<comment><USER31> Wow, that's a really excellent read. Thanks.

</comment></comment></comment><comment><USER32> Does this affect public cloud providers? Can it be used to obtain data from other VMs running on the same host?

<comment><USER33> If this attack is a concern then so is rowhammer. So you can basically ask whether cloud providers have mitigated rowhammer.

AMD's SEV might help protecting VMs from each other.

<comment><USER34> _> unlike Rowhammer, RAMBleed does not require persistent bit flips, and is thus effective against ECC memory commonly used by server computers._

Seems like mitigations for Rowhammer is not enough for RAMBleed.

<comment><USER35> ECC isn't effective mitigation against Rowhammer either.

[https://www.vusec.net/projects/eccploit/](https://www.vusec.net/projects/eccploit/)

tl;dr ECC logic can't cope with 'single' errors involving > 2 bits.

<comment><USER9> It has to cause a huge amount of single-bit errors to find a spot suitable for a three-bit error.

If these errors are actually treated as errors, then chips will be disabled or processes will get blacklisted _long_ before they can be used to exploit.

So this is really "ECC is often configured wrong", not "ECC isn't effective".

</comment></comment></comment></comment></comment><comment><USER36> This is a tangent, but I find it (somewhat) annoying when f.a.q's don't answer their own questions. I see this happen occasionally and I always wonder if it's intentional to side-step an issue by raising it yourself, and then answering something else.

> Can RAMBleed be detected by antivirus? > We believe that it is very unlikely > that any antivirus software on the market currently detects RAMBleed.

<comment><USER37> What should they say? It's theoretically possible for any AV to detect the bug (how else did they prove it exists?) but a simple "Yes" hardly conveys accurate information.

</comment></comment><comment><USER38> > Users can mitigate their risk by upgrading their memory to DDR4 with > targeted row refresh (TRR) enabled.

How does one enable this feature? Is it in the BIOS?

<comment><USER39> I'm not sure if it is an option you can enable/disable in BIOS, but if your CPU and memory have support for pTRR/TRR it should be enabled.

Ivy Bridge and newer processors should support pTRR and possibly even TRR.

<comment><USER40> Do AMD processors support it?

</comment></comment></comment><comment><USER41> I find it very amusing that they use the name "Feng Shui" for placing the victim page.

For those who don't understand: [https://en.wikipedia.org/wiki/Feng_shui](https://en.wikipedia.org/wiki/Feng_shui)

<comment><USER42> It's also an idiom Alex Sotirov coined 10 years ago:

[https://en.wikipedia.org/wiki/Heap_feng_shui](https://en.wikipedia.org/wiki/Heap_feng_shui)

<comment><USER43> Imagine if human beings could be vulnerable to such attacks. Someone sends you a video link, you watch it, you see weird shapes appearing and disappearing for a few minutes, then the next thing you know, you wake up in a bathtub full of ice-cubes with one of your kidneys stolen.

<comment><USER44> Sounds like you'd enjoy [https://en.m.wikipedia.org/wiki/BLIT_(short_story)](https://en.m.wikipedia.org/wiki/BLIT_\(short_story\))

<comment><USER45> Also Snowcrash [https://en.wikipedia.org/wiki/Snow_Crash](https://en.wikipedia.org/wiki/Snow_Crash)

<comment><USER46> Another fun one is the Lexicon by Max Barry, except it exploits the auditory language processing.

[https://www.goodreads.com/book/show/16158596-lexicon](https://www.goodreads.com/book/show/16158596-lexicon)

<comment><USER44> If you're into movies with zombies, pontypool is a fun watch: [https://en.m.wikipedia.org/wiki/Pontypool_(film)](https://en.m.wikipedia.org/wiki/Pontypool_\(film\))

</comment></comment></comment></comment></comment></comment></comment><comment><USER47> I want to find a way to run each application I use on its own machine so that memory attacks (like spectre/meltdown, etc.) are theoretically impossible.

I still want to have a reasonable computing experience (e.g. copy + paste works and the experience is kind of like using one computer the normal way).

Any ideas? I was thinking some kind of remote desktop setup with a bunch of cheap boxes, each running Linux, on a LAN.

<comment><USER48> Plan 9 is really radical about this, but I'm not sure how secure that would be in practice: [http://doc.cat-v.org/plan_9/4th_edition/papers/net/](http://doc.cat-v.org/plan_9/4th_edition/papers/net/)

But the computing experience is quite unreasonable - with copy&paste working though ;)

<comment><USER47> Plan 9 is so cool.

I'm going to guess that it's not actually a practical solution to this problem right now.

</comment></comment></comment><comment><USER49> I am so torn about the whole vulnerability branding thing. On the one hand, it gives a great amount of visibility and motivation for brass to actually provide for getting prod patched when IT might not have had the political capital to do so otherwise. But on the other hand, I think about things like:

\-- What happens when the cure is worse than the disease (some variants of Spectre), and we "have to" patch because otherwise we're "not secure against this scary sounding thing." It takes a lot of agency away from the IT department to make an informed decision about the appropriate mitigation and threat model, and turns it into a business requirement regardless of the trade-off - because brass "understands" _Spectre_ , they don't understand CVE-1234

\-- Or, theoretical exploits that aren't practical in the real world, but we spend a lot of effort or make tradeoffs to fix just because someone needs some material for their PhD.

\-- What do you call it when we find another way to read RAM next year - RAMBleed2? I guess.

<comment><USER50> > \-- What do you call it when we find another way to read RAM next year - > RAMBleed2? I guess.

or RAMBleed-NG, probably.

<comment><USER40> RAMBleed++

<comment><USER51> RamBleed MAX9

</comment></comment></comment></comment><comment><USER52> Very cool and scary, but in reality actually exploiting this without a cooperative target, and a relatively quiet machine is _quite_ unlikely. Does not mean it shouldn't be looked at, but do not lose sleep over it.

<comment><USER53> > actually exploiting this without a cooperative target, and a relatively > quiet machine is quite unlikely.

... until someone does it somewhat reliably. I always assume my knowledge and imagination does not come close the collective creativity of exploiters.

<comment><USER54> Yes, this. Also, there is a saying in the security world, "Attacks only get better over time."

I consult on embedded systems, and at least one medical device I work on is directly concerned with this issue. Embedded systems (cars, elevators, medical devices) consider a different threat model than, say, a server sitting in a data center. These poor devices often sit vulnerable, physically unprotected, and often they can be acquired on Ebay, etc. and "tortured in a garage" for months on end.

Scary stuff. Good for me and my business, bad for all of us though.

</comment></comment></comment><comment><USER55> Why does every new attack have a homepage these days?

<comment><USER56> I forget if heartbleed was the first one to a have a homepage or the first one to have a catchy name, but it was to help with the public relations angle of convincing CIOs or their equivalents in an organization to take the problem seriously AFAIK. Someone else here can probably answer it better.

<comment><USER31> On this subject, I'd love to see a full history of the "branded vulnerability" thing.

<comment><USER56> Here is a link up thread with 'patio11's take on it: [https://news.ycombinator.com/item?id=20158079](https://news.ycombinator.com/item?id=20158079) .

</comment></comment></comment></comment><comment><USER57> Well, this sounds really bad. Though on a positive note, I guess we could try a similar exploit in meatspace to figure out if we're living in a simulation or something.

/sarc but also maybe not

<comment><USER58> That's actually a pretty cool thought. I've always scoffed at philosophies along the lines of, "what if it's all a dream/simulation" because if it's perfect, and you only escape it through death, what's the point of holding that view? But if there's a chink in the armor, it becomes suddenly very interesting. Not that I think that's likely to pan out since it so badly violates Occam's Razor, but it's an interesting possibility.

<comment><USER59> It might not be as unlikely as you think: [https://www.newyorker.com/books/joshua-rothman/what-are- the-...](https://www.newyorker.com/books/joshua-rothman/what-are-the-odds-we- are-living-in-a-computer-simulation)

<comment><USER60> These arguments seem entirely unconvincing to me, in the same way that the Fermi Paradox is. Let's take some small numbers (which we got mostly by guesses, not experimentation), multiply them together, and then be shocked at what a tiny number it is.</comment></comment></comment></comment>


Website to find relavent, short urls. - <AUTHOR>

I swear a while back I saw a website (maybe a YCombinator startup) that would let you add descriptive terms, and it would search out domains that were available based on those terms.<p>For the life of me I can't remember what it was.
Any help? <comment><USER2> Are you looking for <http://domai.nr> ?</comment>


Give Me Back My Google: Google Search without Affiliate Links - <AUTHOR> http://www.givemebackmygoogle.com/

<comment><USER2> I confess, I don't get it. Was this just clever ad spam?

I did the same searches at the linked site and directly at google, and got essentially the same results. I searched for:

"affiliate links"

unicorn

At least I learned about the 'or' syntax in the 'inurl' tag.

<comment><USER3> Whether or not you get affiliate links highly depends on the queries you do.

For instance when I search for 'webcams' it starts off with 3 affiliate links.

I really think google is on the wrong path with this, I remember clearly when they launched that their biggest selling points where in order the quality of the results and the fact that they did not pollute the results with paid links.

<comment><USER2> 'k, I see it now, thanks.

</comment></comment></comment><comment><USER4> I like it. Not sure if I'll use it regularly, but it's cool.</comment>


Microsoft Pours $1B into Poland's Digital Transformation - <AUTHOR> https://finance.yahoo.com/news/microsoft-pours-1-billion-poland-101051280.html <comment><USER2> Interesting. What are some tech products from Poland though? I only know of CDProjectRed and their video games</comment>


Building autoencoders in Keras - <AUTHOR> http://blog.keras.io/building-autoencoders-in-keras.html <comment><USER2> What a lovely tutorial. It should also be noted that autoencoders are useful for supervised learning as feature generator for more effective (problem specific) techniques than NNs like GBMs.

<comment><USER3> Could you please elaborate on this. I would really like to know if autoencoders are still useful for classification if I have only labels for a small part of my training data. Is unsupervised pretraining still useful or was it completely replaced by other techniques as the article somehow seems to suggest?

<comment><USER4> A single layer autoencoder with n nodes is equivalent to doing PCA and taking the first n principal components. If you're familiar with PCA in natural language processing, which is called Latent Semantic Analysis (or Indexing), projecting high dimensional data on a lower dimensional surface can actually improve your features. This is because similar words will project onto the same Principal component allowing you to model some semantic information.

Autoencoders with more than 1 layer are more interesting because you end up doing what is essentially non-linear PCA by projecting your data onto a curved manifold. This famous paper, "Reducing the Dimensionality of Data with Neural Networks" [0], by Hinton shows the improvement in how linearly separable documents become once multi-layer autoencoders are used.

The old argument was that unsupervised pretraining helps get proper weights faster, but this has largely been disproven. However, I do believe AEs assist in semi-supervised learning because they project the initial data into a more useful space. As you can seen in the article I linked the projected data are much more linearly separable.

And as a practical evidence: I used a 5 layer AE in the kaggle black box competition [1] to eventually outrank of team of Hinton's grad students. The problem had a larger unsupervised data set with a small number of labels. Using the autoencoders before the MLP ended up nearly doubling our team's score.

[0] [https://www.cs.toronto.edu/~hinton/science.pdf](https://www.cs.toronto.edu/~hinton/science.pdf) [1] [https://www.kaggle.com/c/challenges-in-representation- learni...](https://www.kaggle.com/c/challenges-in-representation-learning-the- black-box-learning-challenge/leaderboard)

<comment><USER3> Thank you for the answer. That makes very much sense.

Just a side note: As far as I know a single layer autoencoder and PCA are only equivalent if all units have no activation function (linear activation function), which is usually not the case.

</comment></comment></comment></comment><comment><USER5> I don't understand the image denoising. He put noise in the images, but never use them in the code.. It's an error from the author or I missed something?

edit: Author fixed it

</comment><comment><USER6> I hadn't heard of Keras, but it looks easy to use. Can anyone comment on how it compares to the other deep learning helper packages out there?

<comment><USER7> It's both simple to use and very easy to customize to build ad-hoc architectures with custom nodes. The development is very active and it's well documented.

It can also use either tensorflow or theano as runtime.

</comment></comment><comment><USER8> if you just want it and dont want to build it: [http://getnarrative.com/](http://getnarrative.com/)

<comment><USER9> This has nothing to do with autoencoders.</comment></comment>


Ask HN: Why is the web only HTML-based? - <AUTHOR> Why don't movements like the IndieWeb and others recommend serving other formats like Markdown, reStructuredText or a stripped down HTML? The served version would depend on the Accept header.
It could even be the Gemini file format, voiding the need for a new protocol. <comment><USER2> First of all the web isn't only HTML. I can put a plain text or a PDF document or a big gif and it will serve up and display just fine. The reason why people don't just do that is that said document formats aren't designed to solve the problems that HTML already does - problems such as how to display reasonably on a wide variety of devices.

But suppose we wanted to create a new format that does what HTML does, only better in some way.

There is a hard to solve chicken and egg problem here.

Our format is no good until we have created and deployed browsers how to read it. There is no motivation to do that when nobody has such documents. (Note that the other formats that I just named predated the web so there were a lot of documents available from the beginning.) There is no motivation for a website to put such a document up when nobody has browsers that can read it.

And if we solve that problem, that's when we begin to solve the problem of everyone learning how the format works, and how to make it do what we want to do in a wide variety of circumstances. There is a tremendous amount of industry knowledge about HTML, and it takes time to get people to learn the equivalent about the new format. And until they do, what is the motivation for businesses to jump into the new thing that doesn't really work yet?

</comment><comment><USER3> The web isn't HTML-based only: it is increasingly Javascript based. In fact, there's a surprising number of sites posted to HN whose entire HTML is a reference to a script that requests some Markdown to render.</comment>


Show HN: Wknd MVP; Similar Guitar and Amplifier Suggester - <AUTHOR> http://www.ampnote.com/

<comment><AUTHOR> I had a database of guitar-related affiliate ads, did a word count on all of them, filtered keywords and used these to suggest related guitars/amps/accessories.

Thanks for impressions/snafu reports...So far, basically "ugly" and design- free.

Minimum Viable Product in that:

(a) AdSense

(b) and it works, click some links!</comment>


A Peek at the First Sodium-Ion Rechargeable Battery - <AUTHOR> http://spectrum.ieee.org/energywise/energy/renewables/a-first-prototype-of-a-sodiumion-rechargeable-battery <comment><USER2> Sodium batteries are irrelevant, as they have no advantages over lithium batteries (except maybe a slight cost decrease). At the same time Japanese engineers prototyped magnesium-ion batteries, which will double capacity of Li-Ion:

[http://www.japantoday.com/category/technology/view/japanese-...](http://www.japantoday.com/category/technology/view/japanese- team-develops-high-energy-density-magnesium-rechargeable-battery)

Can't wait to see them entering mass production.

<comment><USER3> Sodium isn't toxic, 5 grams of lithium can kill you.</comment></comment>


Palmer Luckey's defense company Anduril already leading to arrests at the border - <AUTHOR> https://techcrunch.com/2018/06/11/anduril-lattice-sentry-palmer-luckey/ <comment><USER2> That's an interesting solution to the problem. I'm curious as to how valid those "captures" are, though. It's clearly giving enough of a lead in time for action to be taken but I wonder if the majority of its effectiveness comes from the ignorance of it. Is this something that will be easily defeated once people know it exists?

<comment><USER3> It's probably a case of finally having a complete chain from detection to action for smaller non-aircraft crossings. There have already been government cameras in place along the smuggling routes, and you can even watch some amateur hidden footage on YouTube, for example [https://youtu.be/dj_4SH_LRSI](https://youtu.be/dj_4SH_LRSI) . There's also those odd observation airships (TARS aerostats) along the border. The smugglers know they're being observed, they just counted on low enforcement on ground crossings.

With this system it sounds like law enforcement has the ability and motivation to immediately respond to detection, something that wasn't there until recently. It also means that as much as the smugglers can try to defeat it, a motivated and well-equipped government has the potential to stay a step ahead (see Israel for an example of this). If this tech works as advertised it might make a pretty big dent, but that's a pretty big "if".

</comment></comment><comment><USER4> I bet they are using an implementation of mask rcnn/fast rcnn object detection and bounding box to achieve their objectives.

</comment><comment><USER5> His support of Trump makes a lot more sense now.

<comment><USER6> Didn't he make enough money to follow his honest convictions? I take it at face value he wants to achieve the mission because he believes in it.</comment></comment>


How Facebook Ships Code - <AUTHOR> http://framethink.wordpress.com/2011/01/17/how-facebook-ships-code/ <comment><USER2> Am I the only person who thinks this whole approach is broken?

We have seen the rise of "devops" recently, and big name web companies like Facebook and Google seem to be very proud of how engineer-led they are, how empowered their developers are, how their product managers don't have much real authority, how they push code to production ten minutes before it's even written, and so on.

From the outside, I see systems that are always changing, so users can never rely on anything working the same way from one visit to the next. I see organisations with access to sensitive personal data being cavalier at best about how they handle it. I see a major blunder _every few weeks_ that at best causes serious irritation to users and at worst risks significant loss of business and/or legal/regulatory consequences.

And I see huge brands whose egotistical staff don't realise that they are successful _despite_ evidently not bothering with either real product management or robust testing, _not because_ of these things, and who don't seem to notice that they are still relying almost entirely on momentum from one or two really big successes from early on to maintain their user base and revenues.

<comment><USER3> I wouldn't lump Google in there with Facebook. We have very strict controls on access to user data (we can't even see email addresses in logs), and we have not adopted the motto "move fast and break things". We do extensive automated testing and have release processes that are designed to minimize problems in the event of a bad push. Yes, bugs happen from time to time, but it's software -- there is no known practical technique to produce bug-free software, so we have to settle for mostly-bug-free software instead. This isn't being amateurish or egotistical, it's being realistic.

<comment><USER2> I'm not arguing for unrealistic quality levels, and I will acknowledge immediately that my experience could be atypical.

However, in fairness, if I look at all of the software that I use regularly in a professional capacity today, then it is _clearly_ Google products that are the most buggy, and by a very wide margin.

For example, I have a client who uses Google Docs/Drive. We have rarely managed to hold a meeting without one of our small team struggling to see either a word processor document or a spreadsheet properly, and that's just the minor cosmetic or browser incompatibility bugs that keep appearing along with all those minor UI changes. We have also experienced some much more serious problems, including corruption/data loss and seeing the entire change history for some files become inaccessible for no apparent reason. In other words, it's not just minor UI errors that crept in as the product evolved, there are evidently fundamental flaws in the underlying architecture that don't store the data robustly.

Another example: I spent a couple of days last week trying to figure out why a site that had been working fine for users until recently and had not been changed at all on our side was suddenly generating bug reports. It turned out that recent Chrome builds have broken some HTML5 features in multiple ways. There have been related bug reports in some cases, but they have been closed as the specific example given no longer seemed to be a problem. Again, the nature of the problems makes it obvious that these are not just one-liner issues but fundamental flaws, typically where Chrome is so aggressive with its cache usage and/or trigging redrawing/relayout that it just plain doesn't work. And even though the bugs had been reported, obviously the correct root cause was never identified and fixed.

Another example: I recently spent some time looking into how the Closure Tools are coming along. Have you tried the examples/demonstrations for the Closure Library recently? Many of them simply don't work in Gecko-based browsers, and that would be obvious if anyone working on the project had made even a cursory attempt to test them for five minutes.

I will finish by once again acknowledging that my experiences here may be atypical, and that the particular projects I've mentioned that I happen to be using may not reflect the wider Google culture. But on the evidence before me, I see an organisation that keeps breaking things in its rush to push new features out and that demonstrably lacks robust architectures that keep data safe, effective testing processes before pushing code into production, and proper issue resolution processes when defects do get reported.

<comment><USER3> _However, in fairness, if I look at all of the software that I use regularly in a professional capacity today, then it is clearly Google products that are the most buggy, and by a very wide margin._

It's more likely that you just spend more time using Google software than other software. When I worked at BofA, our website was down for an entire week because of a bad push. No online banking for a week. That's pretty much the standard for the industry. I don't doubt that there are bugs in Docs or Chrome, but they are relatively obscure. That's the nature of software, not every bug is caught by a unit test and users end up seeing them and reporting them. (Oddly, we use Docs heavily at Google, and the only bug that I've noticed is the "Your zoom level is not supported one". I haven't personally hit any other issues.)

But like I said in my original post, if you know how to develop bug-free software, I'd love to hear how. Expecting low-cost web apps to be as reliable as airplane control systems is unrealistic.

<comment><USER2> _It's more likely that you just spend more time using Google software than other software._

Sorry, but I'm really not. In the case of Chrome, for example, I would routinely test new work on web projects in _all_ the major browsers. I am writing this with some empirical data in front of me, because I've just checked the bug tracking systems for a couple of projects I work on to be sure: for both projects, excluding mobile browsers, Chrome has been responsible for a clear majority of all defects where the root cause was found to be a browser bug over the past two years.

 _I don't doubt that there are bugs in Docs or Chrome, but they are relatively obscure._

Respectfully, if they were that obscure, my colleagues and I wouldn't keep running into them on multiple projects. I'd agree that the particular symptoms of any particular bug are usually a corner case: set this option to A and that option to B and it breaks, but other combinations work OK. It's the way that several of these bugs have recurring themes that betray both an underlying architectural weakness and a lack of effective quality control that I find most unfortunate.

Using Chrome as an example again, it is clearly aggressive with caching and conservative with repainting, but sometimes that means it is simply not behaving properly at all. If I set a part of the DOM to display instead of being hidden and then send an AJAX request, I want my "please wait" message displayed while the request is running, not afterwards, or indeed not at all since it probably gets hidden again as soon as the response arrives.

 _That's the nature of software, not every bug is caught by a unit test and users end up seeing them and reporting them._

And as I mentioned, several of those bugs in Chrome _had_ been reported, and subsequently closed without the root cause ever being identified and fixed.

 _Expecting low-cost web apps to be as reliable as airplane control systems is unrealistic._

I don't expect Google's software to be as reliable as airplane control systems, but somewhere close to as reliable as everyone else's software would be nice. I appreciate that you're having trouble believing it or reconciling it with your own experience, and I've already acknowledged that my experience might be a complete outlier, but I'm looking at several years of _empirical data_ across multiple completely different projects and development teams and it is quite clear that the Google products I'm looking at here haven't been keeping up lately.

<comment><USER3> _And as I mentioned, several of those bugs in Chrome had been reported, and subsequently closed without the root cause ever being identified and fixed._

Link?

<comment><USER2> See issue 104487 for one recent example. An issue was flagged up where HTML5 videos weren't playing properly when given a poster image but no controls attribute.

The issue was closed almost immediately, with some obviously hastily written comments, apparently because no-one could reproduce it in a different version of Chrome on Linux or Mac. As far as I can see, no-one even tried to reproduce the other reported failing case on Windows, and there was no attempt at all to investigate the original bug and determine how it happened and why it was no longer observable on the platforms tested.

The issue was simply marked "fixed", despite no actual fix having been identified, rather than giving it a more specific "no longer reproducible" status.

There are still serious problems with that combination of attributes today.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> This may be my favorite quote...

"Engineers handle entire feature themselves — front end javascript, backend database code, and everything in between. If they want help from a Designer (there are a limited staff of dedicated designers available), they need to get a Designer interested enough in their project to take it on. Same for Architect help. But in general, expectation is that engineers will handle everything they need themselves."

I actually like this idea. Building my own website as well as working as the senior engineer during my day job forces me to be involved in all facets of web developing. The jobs are not abstracted. You are expected to know what you're doing from the front end to the back end. If not, nothing get done in a timely manner. I like this method because the front end is tightly woven in with the business logic of the module that you're working on. In other words, you know what the code is doing inside and out.

<comment><USER5> I dunno. I personally am a full-stack guy.

But when I work with back-end developers who don't know MySQL inside and out, and they write a query that works fast in development but slow in production because they didn't realize the column index they specified won't work because of a string collation incompatibility between tables, and they've never even _heard_ of this kind of problem before...

Then I wish they'd stick to writing their back-end executable code, and have a database guy write their query for them, and have a JavaScript expert take care of the front-end stuff.

It's not a question of intelligence, just a question of experience. You have to have done a lot of JavaScript coding to realize never to call parseInt(x), but always parseInt(x, 10), for example. And the number of CSS incompatibilities between browsers that you need to account for...

Unless someone has a lot of full-stack experience, it doesn't seem that great that they should be pushing out full-stack code on their own at a place like Facebook. Maybe code reviews will catch those kinds of things, though.

<comment><USER6> Facebook has a good abstractions at all levels of the stack. This allow engineers to work on all parts of the stack without having to worry about low level implementation details. I have not written a line of SQL while at Facebook.

If there is some domain knowledge needed then I can just rope in an engineer from the appropriate team to review my diff.

It's also worth noting that on product teams engineers tend to gravitate towards the parts of development they are more comfortable with, or enjoy the most. They are not forced to work with te full stack just for the sake of it.

</comment></comment></comment><comment><USER7> What a crock of shit:

 _after boot camp, all engineers get access to live DB_

I can understand on a startup or small org but an organisation of that size, there should be very tight access control.

Despite what anyone says, the probability that someone does something bad increases in larger groups. Security should be on a simple need-to-know basis and nothing else.

I build BIG financial software and we have certain audit requirements, access control requirements, data protection requirements etc and that is exactly how it should be.

I'd never put my data near FB. They are simply irresponsible.

<comment><USER8> You finance and billing guys will never understand.

These are _rockstars_.

They work for facebook.

They would never ever type UPDATE users SET email = username || '@facebook.com'; WHERE username == 'john.smith';

<comment><USER9> Of course not. Much faster to type

        UPDATE users SET email = username || '@facebook.com';

Then let the users sort out the exceptions.

<comment><USER10> I think he was being sarcastic - you can see the semicolon in the middle of the command which looks like pretty much what they did with the whole e-mail debacle. You simply removed the second incomplete statement.

<comment><USER9> I now realise that I am underqualified to work at Facebook. :(

</comment></comment></comment></comment></comment><comment><USER11> See this question on Quora for some clarifications from people who are or have been Facebook employees (including myself). The article (particularly the original version) has a lot of inaccuracies, and is now around 18 months out of date.

[http://www.quora.com/Facebook-Engineering/How-accurate-is- th...](http://www.quora.com/Facebook-Engineering/How-accurate-is-the-How- Facebook-Ships-Code-article-written-by-yeeguy)

</comment><comment><USER12> I really like seeing this approach listed:

"resourcing for projects is purely voluntary. A PM lobbies group of engineers, tries to get them excited about their ideas. Engineers decide which ones sound interesting to work on."

That sounds exactly the same as how Github's engineers work.

It's an awesome concept; no-one can justifiably be bored with their projects if they chose them. And if you can't get anyone interested in working on the project, then it's a good indicator it may not be a project worth completing for the company anyway.

I'm sure there are times when someone has to say "We _need_ someone to do this", but I'd be curious to hear from someone who works in one of these environments how common an issue that really is.

<comment><USER9> > _It's an awesome concept; no-one can justifiably be bored with their > projects if they chose them._

Eventually people lose interest. It's only human. But _The System_ has been written, it is in production, and it has accrued a healthy stock of user data.

One day, The System breaks. "Only" tens of millions of users -- less than a percent of all Facebook users -- rely on the The System. But they rely on it utterly.

Who will fix The System?

Of the five engineers who wrote it:

* Jack and Mandeep left to launch myfornaxisnatrr.com

* Wei Li has moved to a different group

* John doesn't want to touch it, he only came on board to help Jack

* Michael was an intern but has since taken a job with Google.

Uh oh! There's nobody around to voluntarily fix an existing system. That's boring, and there are no incentives for fixing bugs in obscure features because only launching successful new features gains visibility from higher- ups.

Guess we'll need some mean old managers to round up a posse.

If they care enough.

Meanwhile, The System has acquired millions of users, cost millions of dollars to develop and operate and will now abruptly cause tens of millions of customers to become incredibly frustrated. And at no point has anybody stopped and asked:

 _"Was this the Right System to build?"_

<comment><USER13> > That's boring, and there are no incentives for fixing bugs in obscure > features because only launching successful new features gains visibility > from higher-ups.

Companies really should find a way to incentivize this. Rewrites are about as silly. "Write the next generation xyz." Translates to "No one here has any idea how xyz was written, so it's being rewritten instead of modified. We look forward to rediscovering the same problems we did the first time."

<comment><USER9> > Companies really should find a way to incentivize this.

It can't be done from the top. You need to start with engineers who care about quality over the long term. It has to come from within each engineer.

When Zuckerberg talked about younger programmers being "better", he probably meant "more like me". But old farts are just young farts with expensively- acquired scar tissue.

Most of our most treasured software development lore comes from the lesson that "move fast, break things" just devolves into "fuck, everything is broken, fix it fast".

</comment></comment></comment></comment><comment><USER14> The facebook system actually sounds really solid, especially the "boot camp" thing that so many companies fail to have, however it's probably pretty expensive. Choosing between fast, cheap, and good, Facebook is choosing fast and good. For many, cheap and good but slow is more desirable.

One of the risks to consider with a "devops" oriented approach is that you may become more dependent on it than you want.

Often, applications split things into a few different categories depending on how tweakable they need to be. There's code, configuration, app administration, and data. Code shouldn't need to change often. Configuration may need to change when the environment changes. App administration (eg creating new accounts) needs to change often, and data is always changing (or at least growing).

The risk is that developers will design the system so that only developers can administer it. Configuration, the settings that may need to be tweaked by sys admins long after the original developers have left the project, may wind up in the code or sometimes lumped into the database alongside end-user options.

It's not a reason not to take this approach, just something to consider when developing internal processes and culture.

</comment><comment><USER15> Previously on HN: <http://news.ycombinator.com/item?id=2594083>

↪ How Facebook _actually_ pushes updates to the site

I came across this originally on the Etsy dev blog, rather than HN, and that particular post had some good other stuff about Flickr and Etsy:

[http://codeascraft.etsy.com/2011/06/01/pushing-facebook- flic...](http://codeascraft.etsy.com/2011/06/01/pushing-facebook-flickr-etsy/)

</comment><comment><USER16> I like the idea of encouraging a high-performance culture, but I don't think the 'perform or die' atmosphere would be healthy for many engineers. I know, idolizing 'rockstar programmers' is a sort of new hotness and I understand that a company like Facebook wants to have super-talented developers, but developers grow and learn new tricks as they mature, and they might take more than six months to do so.

<comment><USER10> True - but those engineers don't work at Facebook. This isn't no-child left behind. This isn't hand-hold time. This is the most expensive and expansive internet application in the world. If they need time to ramp up, they can do it on someone else's product and come to Facebook when they're ready.

<comment><USER17> That sounds impressively macho, but it's an attitude that has long-term organizational costs. HN just had a great article on how Microsoft's internal competition deeply harmed the company. The number one complaint I hear from departing Google engineers is the absurd internal promotions system.

Years ago I did a gig at eBay, and I thought their macho attitude was a giant source of problems. Plenty of good, sane people were driven off (or driven mad) by artificially high-pressure situations. Every email about a promotion mentioned how somebody had worked all night to get something done; they were promoting more for drama than for skill. And a "this isn't hand-hold time" attitude was common among senior technical staff, which meant that people often hid their weaknesses rather than getting the help they needed.

The lesson I learned from that is that software companies that take normal circumstances with the intensity of emergencies are gradually cutting their own throats.

That's a lesson reinforced for me spending a lot of time with a family member in hospitals last year. Even when survival was on the line, the best doctors and nurses proceeded with patience and kindness, working to train staff and improve systems as they went. In an actual emergency they moved like it was an emergency. But only then. If they can be serene and thoughtful while dealing with brain tumors, I don't think there's any reason that people at Facebook have to puff themselves up with self-importance.

<comment><USER10> This is a good lesson. I was straight-forward to get a point across, but it is easy to see how "excellence first" could turn into a poor work environment without moderation.

It also seems that an "excellence first" culture seems to provoke fears that people can't learn, or aren't allowed to make mistakes. Tone and delivery are important here - especially from leadership. My take on excellence first is you don't have to compromise environment for it. Create an environment that fosters excellence, where people aren't afraid to make mistakes but are committed to learning from them. Everything doesn't need to be treated like an emergency, but theres a level of bullshit on a technical level that shouldn't be tolerated. Again, each situation needs to be felt out individually and moderation is always key.

Personally I don't advocate the internal competition aspect of excellence either. The pitfalls of that are well documented as you have pointed out. I'd promote based on team success, and THEN individual contributions. If you can't work as a team then the whole team loses, only once the team succeeds would you start singling people out to see where the best influences were coming from.

TLDR - I think there is a middle ground between not running it like a daycare and running it like a wall street trading firm or gulag.

</comment></comment></comment></comment><comment><USER18> Don't get me wrong a developer-led company in theory sounds like an awesome idea because the developers know the product better than any product manager ever could, but that isn't a good thing. I've worked with companies that have ultra-strict testing of features, where many eyes see and use the code before being pushed out and while that process works it can get in the way of progress when the politics come out to play.

The whole move fast, make mistakes mantra is a bad approach when you're a high-trafficked site like Facebook that risks jeopardising your revenue. A second of down time can be very costly. Knowingly pushing out half or completely untested features might be acceptable if you have a small user base, you're a new Internet startup or your logo says alpha or beta, but certainly not an established brand and company it's stupid.

This is all my own opinion, of course.

<comment><USER10> I would argue the opposite. Facebook is in prime position to move quickly and break things. They have enough traction, gravity, and brand recognition they can afford to make mistakes.

If you have a small user base or are just getting started, delivering the best product experience is the #1 thing you can do for success. Is iterating faster and making more mistakes and giving the early adopters (ones that champion your service the most to others) a sub-par experience worth the speed? Sometimes, yes. All the time? No.

Facebook can change your privacy settings, steal your e-mail address, recognize you automatically in photos, watch your browsing activity outside of their walled garden, and sell your data to advertisers. And yet they still have 500million+ users.

</comment></comment><comment><USER19> "very engineering driven culture. "product managers are essentially useless here." is a quote from an engineer. engineers can modify specs mid-process, re-order work projects, and inject new feature ideas anytime"

Maybe this is why Facebook seems to be chaotic for users. They change and change to whatever design they wanted without much consideration about what the user's would feel about the design. Facebook has now become the combined features of the other existing social media.

</comment><comment><USER20> """ Engineers responsible for testing, bug fixes, and post-launch maintenance of their own work. there are some unit-testing and integration-testing frameworks available, but only sporadically used. """

Sounds like a lot of code debt accumulating that could bite them hard down the road - it's one thing to write and manually verify bug free code, it's another for a different engineer to make sure he/she doesn't break that code inadvertently a year later when the original author has moved on to another project or company. I'm not talking about 100% test coverage; if the smoke test for a feature breaking is someone noticing while playing with the site, in the long run it strikes me as a much less efficient way to verify and fix regressions than using an automated test suite. Writing good tests is hard, but keeping a product bug free as more and more functionality accumulates without automated test suites is even harder in my experience.

<comment><USER21> This article's about a year and a half old. We have pretty good unit test coverage on a good chunk of our code (especially core stuff), though admittedly not everything.

Some groups put particular emphasis on this (e.g. the messages team is great about testing), and it shows in the reliability of their products. Even better, they end up building frameworks that make it easier for the rest of engineering to write tests, and drive the whole ecosystem forward.

<comment><USER20> Good to hear. Related: a good article by Eric Ries on how in many situations within a startup technical debt can be used effectively.

[http://www.startuplessonslearned.com/2009/07/embrace- technic...](http://www.startuplessonslearned.com/2009/07/embrace-technical- debt.html)

</comment></comment></comment><comment><USER22> I stopped reading at "very unique". It is unique, or it isn't. Intensifiers to 'unique' tell me the writing is below par; and I've been correct about this enough over the years that I stopped bothering.

</comment><comment><USER23> Well, I'll be joining Facebook in a few weeks. I am a bit of a laid back type and don't know if I fit into their culture of moving fast.

</comment><comment><USER24> This is the real Facebook secret sauce in convenient flowchart form:

        What's the most evil thing we can think of doing?
         V
        Candidate <-----<</comment><comment>- Think of the next-most evil thing we can do
         V                                     ^
        Can we code that? (no) </comment><comment>-></comment><comment>->^
         V (yes)                               ^
        Is it legal?                           ^
         V (yes/no)                            ^
        Can we get away with it? (abs. not)--->^
         V (yes/maybe/prob. not)               ^
        Keep shipping!                         ^
         V                                     ^
        Did we get in trouble for it? (no)     ^
         V (yes)                        V      ^
        Claim it was a mistake!         V      ^
         V                              V      ^
        Still in trouble? (no)-> Keep feature->^
         V (kind of)                    ^
        Being sued for it? (no) --->--->^
         V (yes)                        ^
        Throw money at lawsuit          ^
         V                              ^
        Did we lose? (yes/no) ----->--->^

<comment><USER7> That's great - thanks for posting it :)

<comment><USER7> If you're going to down vote, please at least say why...

<comment><USER25> Comments on HN tends to be voted down if they are not substantial. To quote <http://ycombinator.com/newswelcome.html>: Does your comment teach us anything?

That page also says that a simple thanks may be acceptable, but the consensus seems to be that those comments are superfluous as well.

</comment></comment></comment></comment><comment><USER26> what does this mean?</comment>


The Golden Era Of Spam Comments Has Ended - <AUTHOR> http://www.theawl.com/2013/12/the-new-spammer-panic

<comment><USER2> Don't count on it. There are many software developers out there with knowledge of NLP algorithms, statistics, symbolic systems, etc. who aren't employed by Googles, Facebooks, Ciscos and Twitters. They're bored out of their minds and waiting for a challenge.

As time progresses, SEO companies will adapt. I contributed hundreds of thousands of pages of web spam prior to the Panda modifications. If I were still working at the company I did it for, and there were proper incentive, I would definitely be able to get around Panda.

It took me about 10 hours to build a cute little tool, and after about 3 months of using it judiciously, we were able to push many sites up to number one for some very competitive terms. The search engines might be ahead now, but there are thousands of intelligent programmers out there trying to pick the black box apart. No black box stands unbroken forever.

</comment><comment><USER3> The companies who hired the shady SEO companies to spam the internet presumably paid them; I wonder how they'd feel about paying content hosts to remove those comments as well.

<comment><USER2> They'd definitely pay if you stated it nicely. ("I would love to help you in removing these links, but my developers are occupied. If you want to expedite the removal, it will be $X per link.")

I get many requests a month to remove spam links that get through our filters. I've debated charging them for it, because I know in most cases the people asking me to remove them are the same people who had them placed there. I haven't charged anyone yet, and I don't think I'm going to.

I do take my time when removing them (lowest priority), and I don't remove the links where the requester cites some legal consequences if I don't comply. Those stay up forever.

<comment><USER4> I can't believe I never thought of charging for this. I've been ignoring the requests because if you were spamming us you get what you deserve.

</comment></comment></comment><comment><USER5> It seems like there's also an inverse application - if you have a competitor, post a bunch of spammy blog comments for them and watch as how google penalizes them.</comment>


Google Authenticator on a TI Chronos Watch - <AUTHOR> http://circuitcellar.com/featured/ti-chronos-one-time-passwords/

<comment><AUTHOR> It's $58 to order the watch from TI. I've seen some deals go as low as $24 on other websites. I wanted this because I had a minor moment of panic when my iPhone started flaking out on me. This would be a small price for me to pay for a peace of mind.

</comment><comment><USER2> I'm really happy with the watch app market becoming a thing.

Similar implementation for the Pebble watch:

[http://abl.github.io/pTOTP/](http://abl.github.io/pTOTP/)</comment>


Show HN: WebRTC NAT Traversal Infrastructure Service for everyone - <AUTHOR> https://seamconnect.com/ <comment><AUTHOR> The service provides STUN and TURN servers to aid with NAT and firewall traversal, allowing the WebRTC services/apps to concentrate their energies on their core service delivery. Further, the service allows the WebRTC service providers to monitor, audit and enforce policies for each of their users.</comment>


How to start learning crypto - <AUTHOR>

I'm a PHP hacker with front-end experience and a love of building new things.
As a result of the NSA/Prism scandal, I, like many of you, have become passionate about helping to pioneer an open web. I've been dreaming ideas on this front for the past few years, but haven't taken the time to jump in because well, I wanted to work my way to the knowledge. Now I'm feeling I don't have time to wait.
So while I'm a decent PHP programmer, I don't know much at all about security (beyond what it takes to build and secure a web app), cryptography, and other related fields.
I'd like to start this thread for people like me that are very interested and passionate about this, but don't know where to start.
Books, people, tutorials...all of it is good info. If you had to start in this field today, how would you study? <comment><USER2> You could try doing the Matasano crypto challenges which don't require any previous crypto knowledge and are a hands-on way of learning it.

There's also a MOOC on Coursera by Dan Boneh that is all about cryptography. Next session starts on September 9th.

</comment><comment><USER3> From burritocop (linkdead): Hacking Secret Ciphers with Python [http://inventwithpython.com/hacking/](http://inventwithpython.com/hacking/) I haven't yet read the book but I've heard good things about it. It looks like it's a beginning programming book that also teaches cryptography

</comment><comment><USER4> For crypto itself, read Applied Cryptography by Bruce Schneier. It begins with some history, high-level theory and pseudo-code and ends with C code and the nitty gritty.

</comment><comment><USER5> see [https://news.ycombinator.com/item?id=6217908](https://news.ycombinator.com/item?id=6217908) (particularly since another answer here mentions applied crypto).</comment>


Tweet Visualization in World-Map Heatmap Form - <AUTHOR> http://aworldoftweets.frogdesign.com/

<comment><USER2> Wow, that is awesome. What is up with Rio being a third (or more) of the overall network volume?

EDIT: I guess since it's the percentage of geolocated tweets the most likely answer is that the most popular Portuguese client geolocates by default.

<comment><USER3> There's a been a press release for a study on erectile dysfunction in Brazilian men and now it's a trending topic.

[http://zerohora.clicrbs.com.br/zerohora/jsp/default.jsp?uf=1...](http://zerohora.clicrbs.com.br/zerohora/jsp/default.jsp?uf=1&local=1&section=Segundo%20Caderno&newsID=a3165741.xml)

Based on the portuguese trending topics, it looks like Ronaldinho isn't going to be playing soccer in Teofilo Ottoni.

Edit: It's extraordinarily difficult to find the signal of the original story amongst the noise of Portuguese tweets saying "lol, erectile dysfunction is a trending topic!"

Perhaps someone with a better handle on tweet mining can get to the bottom of this.

</comment></comment><comment><USER4> > A world of tweets is compatible with every browser supporting HTML5 and the > <canvas> tag, and _degrades gracefully to Flash on older browsers._

Who would have thought...

<comment><USER5> When it does, it gives this message: "YOUR BROWSER DOES NOT SUPPORT HTML5. GRACEFULLY DEGRADING TO FLASH. PLS DON'T TELL STEVE."

In other news, I really wish my employer would let me upgrade my browser...

</comment></comment><comment><USER6> It would be great to see a heatmap of all the tweets that they've collected since November 1st. The real-time thing is pretty cool, but I think it would be interesting to see the most active locations from the last few months on a higher resolution heatmap.

Or even better, let the user select between fixed time periods (all time, one month, one week, etc.).

</comment><comment><USER7> I like these geographical data visualizations but I'm always slightly disappointed when the data turns out to be 90% what you would expect. I always think it might be more interesting to show some slightly more nuanced data if possible, like instead of showing volume of stuff, show the rate of growth of stuff or where stuff has appeared for the first time.

</comment><comment><USER8> Very cool. I don't use twitter myself but I really like the visualization idea.

The GUI doesn't seem to work here, though, I cannot change any of the radio buttons such as "Satellite" instead of "Map". It simply doesn't respond to mouse clicks (Firefox 3.6.13 Linux).

<comment><USER9> Same configuration here; but buttons work fine for me.

<comment><USER8> Hm on my laptop (same configuration) it works fine. Must be some configuration problem or misbehaving plugin at my side.

</comment></comment></comment><comment><USER10> I would like to see a visualization like this, but corrected for population density. What cities tweet disproportionately?

</comment><comment><USER9> Even when I open only this site in my browser, within a while it uses >90% cpu time and soon rises to 100%.

</comment><comment><USER11> Very cool. Total "wish I'd thought of that" idea with excellent design.

</comment><comment><USER12> What's the point of staring at the browser for 2 minutes to get the info you are looking for? If you are retired, that is another story ...

</comment><comment><USER2> filter_term == "earthquake" || "tsunami" || "tornado"

</comment><comment><USER13> This is awesome. You know what would make this super-awesome? Being able to filter by keyword. Though they're probably already filtering down the tweets or else the map would be a complete mess.</comment>


Evaluating Graph Databases for Efficient Persistence of Large Models [pdf] - <AUTHOR> http://www.jot.fm/issues/issue_2014_07/article3.pdf

<comment><USER2> I was a bit surprised to find graph databases described as "efficient", and wondered if I'd missed some new development.

No, it's just that "efficient" is relative. The charts at the end indicate pauses of thousands of seconds before any data gets through. This matches my experience.</comment>


3 Principles of Success from a Killer Self-Funded Company - <AUTHOR> http://rocketship.fm/episodes/ep-68-jeff-berg/

<comment><AUTHOR> If you can't tell from the interview - I have a serious company-crush on Planning Center.

There are few companies out there that hold such strong beliefs and really stick to them. The impact of this shows in the quality of their team, culture, and office environment.

Lots of good nuggets in this chat with Jeff.</comment>


The self-sorting mailbox: using IFFFT to speed up the processing of emails - <AUTHOR> https://gwapit.com/blog/email/automate-your-inbound-email-workflow/ <comment><USER2> Er, don't you mean "IFTTT" ??</comment>


Anne Learns To Recruit - <AUTHOR> http://www.solipsys.co.uk/new/AnneLearnsToRecruit.html?HN0

<comment><USER4> Forget HR at big corporations. Just forget it. Fill out whatever boilerplate you have to and get them out of the way as quickly as possible.

At one point I tried to get into the hiring pipeline to both streamline the process and to get better candidates in the door because the job adverts we were putting out were horrendous. Instead of seeking general problem solvers that were familiar with X, Y, Z technologies the adverts were specifying things like specific versions of Tomcat and JBoss. Long story short I just gave up. I couldn't get the recruiters out of the pipeline and they were the ones going to campuses and job fairs and gumming up the works. I couldn't get it across to them that we just wanted smart people and didn't really care if the person fell in front-end, back-end, or QA bucket.

</comment><comment><USER5> This doesn't just happen in large companies. I've experienced this kind of useless gatekeeping with 50-100 person "startups".

I'm sometimes asked about tech hiring and I keep telling people that technical teams need to be responsible for technical recruiting. No one wants to hear that though.

<comment><USER6> Apparently, nobody on teams has time to invest in recruiting. Because meetings. Or something.

Here's the reality: these companies can't hire. I know it and they know it.

They can't hire because they're invested in cancerous HR bureaucracy. Think _The Crimson Permanent Assurance_ , the opening scene in Monty Python's "The Meaning of Life." Turns out there's a reason why The Very Big Corporation of America can't move fast and hire the people they need. And a lot of smaller companies trying in vain to hire like this don't have any excuse to act like VBCA because they aren't big now and never will be.

They can't hire because they won't pay market salaries, don't offer enough equity, and try to make up for it with a combination of pizza, Red Bull, foosball, and nerf guns.

They can't hire because their office is a place that makes Initech (the company in _Office Space_ ) look appealing.

They can't hire because they skimp on benefits.

All this has been covered before, but VBCA refuses to learn anything new because they don't want to change the way they do things.

[http://www.joelonsoftware.com/articles/fog0000000050.html](http://www.joelonsoftware.com/articles/fog0000000050.html)

<comment><USER7> I got a job at a start up once - it lasted 3 days - I still dont understand what happened. I had been laid off from my job, decided to take a stab at relocating to the bay area, took me a couple weeks, landed a job at a storage startup - I was a contractor, but it was contract to hire - the interview was kinda odd - normal technical questions, then a very strange interview with the manager which mostly consisted of "when can you start?"

I'd like to point out - this was not some fly-by-night sort of deal - <USER2> we're clearly not on a shoestring budget, well funded by major industry players, offering a unique solution, and it was the true startup environment - replete with: engineers who looked as if they rolled out of bed, and into work - friday night beer, free lunch, well stocked soda, nap and gaming rooms, and of course the obligatory fooseball table.

My title was to be "Senior Technical Support Engineer" \- on my first day I was handed an HP laptop - with nothing but Windows on it, and a manual for their product, which I read in about 2 hours (I read fast, and it was only about an inch/inch and a half thick) - my training consisted mostly of watching the guy next to me do calls - most of which have to do with license entitlement issues and anything beyond that or simple config issues, required come cli-fu to fix.

The next day, was really just a repeat of the first - I still don't have an ID badge or a phone at my desk - so I keep watching and listening to these calls, I also took a note on hoe the majority of the office was dressed - <USER3> casual - Asking my peers about Putty and other apps, I asked, and was told I have local admin on the box, for office, go thru IT - anything else, just install yourself - so I then installed putty and winscp, and went thru the rigmarole to get office installed.

The next day I showed up in toe shoes, jeans and a button up shirt - as I don't really have much in the way of dressy working clothes (plus they advertise not having a dress code on their website) - but my toe shoes are brown leather - so I figure it cant be that bad, I get a sneery look from the manager and an aside comment - later that day, I was called in - and told that this would be my last day - she said I spent the whole day on Facebook (at that time I didnt even have one), dressed unprofessionally and installed "advanced software" on my laptop - I of course protested, and indicated what I saw for dress - and then told her what I was told about tools - she told me I didn't need putty, that was too advanced.

That was that - and of course the consulting house that sent me in basically looked at me as mud - I got fired on the third day; who gets fired on the third day? - eventually 2 other people had a similar experience and I was in good graces again.

The moral of this is - its not enough to worry about HR - HR is one problem, you also need to make sure you have a sane way of onboarding people, no matter if your giant or not.

<comment><USER8> i don't quite get the 'advanced software' part..how can it be criticism? and what an odd example..like, what other ssh client should one use if one were on winodws...

<comment><USER7> it was that I'd installed an SSH client at all. She told me I didn't need 'advanced tools like that' to do my job.

</comment></comment></comment></comment></comment><comment><USER9> This is a known issue in recruiting.

From the perspective of the agency recruiter, what seems to happen at some companies is that the development team just find the person they want through the agency recruiters and unless HR can find a better person, they tell HR to hire them and pay the recruiting agency. It's an approach that is hard for HR to argue against if they can't find a good person.

</comment><comment><USER10> Depressingly accurate portrayal of hiring in a large company. Also hilarious.

</comment><comment><USER11> Interesting. What I occasionally see from recruiters is almost a bit of the opposite.

e.g.

        "Seeking Junior Ruby on Rails developer with 8+ years in C++, JavaScript,
        Delphi, AnyLisp, MongoDB, NoSQL, API, Agile, MooseTalk, Apache, GoLang

        Experience contributing to the Linux Kernel preferred"

</comment><comment><USER12> This does not only happen in software field but also in biomedical sciences. If the recruiter can't find exact keyword matches on your CV or resume then you are out of luck how much skillful or experienced you are in your field does not matter. In fact big Pharma companies have algorithm developed for their job sites where if it cant find exact keywords on your resume then tough luck. Almost all time it will go to trash(virtual one).

</comment><comment><USER13> Anne needs to stop talking to the personnel department and start talking to the CEO: tell him she needs authority to hire programmers without interference from the personnel department, and that said interference is the reason his favorite projects are behind schedule.

If he refuses, then she needs to either get on with her job with the people she has and accept that the schedule delays are not her fault and not her problem, or start looking for a job in a less dysfunctional company.

</comment><comment><USER14> Very funny. It happens a lot in Brazil. What about other countries?

<comment><USER15> American here. Had coffee a while ago with a manager complaining about this exact thing. Can't get talent on his team because of the "HR Firewall" blocking recruits for arbitrary reasons (not the right college degree, not enough 'years' of experience in the correct area, etc...)

</comment></comment><comment><USER16> Recruited for a lot of big companies. I'm lucky that my current one is really good with hiring. Everyone super open with what they want and why.

There is a main concern about the interview process in this story. Anne's team should've been the one interviewing. Then they would know who would have the skills required.

</comment><comment><USER17> Big defense contractors, horrifying beaurocracy and all, don't even recruit like this anymore. Source: I worked for one a few years ago and have friends who still work there.

</comment><comment><USER18> I honestly haven't seen a lot of this kind of job posting of late. Ten years ago this was the norm, but I just don't see it any more.

<comment><USER5> I was curious, because I do agree that some of the flavor of job ads has changed, although I'd say more in the last few years. This was the second ad I opened on the SF CL: [http://sfbay.craigslist.org/sby/sof/4419917236.html](http://sfbay.craigslist.org/sby/sof/4419917236.html)

<comment><USER6> _Extensive hands-on experience in MPP DB 's like Teradata, Greenplum, Netezza, etc and related utilities_

 _Excellent hands-on experience building ETL jobs using ETL tools like Informatica, Talend, Ab Initio etc._

Bloody hell, that's a disaster. How do they ever hire anybody that way?

</comment></comment></comment><comment><USER19> Find the people you want to hire outside of HR, and then craft an HR job posting that they can ace.</comment>