New porn laws will mean Pornhub asks for your name and address - <AUTHOR> http://metro.co.uk/2018/01/31/new-porn-laws-will-mean-pornhub-asks-name-address-wnking-begins-7275023/ <comment><USER2> Seems like the thin edge of a thick wedge. First porn, then what next? Video games? Movies? Netflix?

It seems like another data grab. I've not seen the technical specification but presumably porn sites will hold on to a verification token of some sort from the government ID database, which could then be used to correlate your viewing habits (at the porn site end) to your age verification request (and thus ID, at the government end).

I imagine this will drive more and more people to use VPNs. I've got to assume someone involved in this has considered that. Maybe this is a prelude to banning VPNs in the UK? ("They're only used by criminals and people trying to circumvent the age verification system")?

<comment><USER2> To piggyback on my own comment - another possibility is that every site or application with user generated content will eventually be subject to age verification. Meaning that all semblance of anonymous/pseudonymous participation online will disappear. Every username you have online will be tied back to a request token in the age verification database. Those reddit alts you use for porn, your Pornhub account, your LinkedIn, HackerNews, email.. all tied back to your passport.

<comment><USER3> Prediction: When this happens, identity theft will enter the mainstream.

<comment><USER4> I think selling your identity will become bigger

</comment></comment></comment></comment><comment><USER5> I predict a surge in the popularity of pornography among British elderly women.

</comment><comment><USER6> It is not clear to me from the article whether this is something which will be rolled out only to viewer from the UK, or to all viewers globally.

If it's the latter, I think it will be received very dimly in countries with more-robust internet privacy regulations (or privacy-sensitive public sentiment) than what is currently the norm in the UK.

</comment><comment><USER7> New source of income for spammers: forget about Nigerian scams or fishing emails trying to install malware: just use stolen porn databases and blackmail users directly.

It's incredible that UK government really thought this was a good idea.

</comment><comment><USER8> I wonder if they have ever heard of fake ID (or spoofed ip addresses)? Boris Johnson is going to be spending a million man hours a day on porn sites...

<comment><USER9> You'd have a difficult time spoofing your IP address for a TCP connection (HTTPS).

<comment><USER10> I'm fairly convinced you just used on online technical jargon generator for 100% of this comment. There are a dozen ways to spoof your IP address for TCP/UDP/SCTP/DCCP/STP/DTP/etc. connection (Even HTTPS - Don t know why you feel this makes any difference whatsover).

Like the other the comment has suggested VPN's are a very effective way to to such a task...really any proxy system in general, TOR works as well. Hell, just have a friend leave a RaspberryPi in his house would work and tunnel TCP over SSH to it...

I'm going to use too many electrons informing you on the plethora of ways to spoof an IP address.

<comment><USER11> I could be wrong but I think what you are describing is technically "masking"

To me "spoofing" implies packet shaping.

I tried to find a good definitive difference between the two and couldn't find one. So as I said, could definitely be wrong.

<comment><USER10> I think its pretty fair to assume to comment was referring to the process of tricking a website into thinking you are at a different IP address then what is actually assigned by your ISP... :/

</comment></comment></comment></comment></comment><comment><USER12> Well, that's a 'stimulating' site. It seems to be channeling the 1980s UK paper the Sunday Sport[1] (famous for its "World War 2 Bomber Found on the Moon" headline).

My favourite line so far is: "He has been banned from every farm in Britain". I can't imagine what it looks like without an ad blocker.

[1] [https://en.wikipedia.org/wiki/Sunday_Sport](https://en.wikipedia.org/wiki/Sunday_Sport)

<comment><USER13> The Metro is a free paper given out in London (and elsewhere?). It's part of the same media group as the Daily Mail.

<comment><USER2> > and elsewhere?

UK-wide, with regional variations.

<comment><USER14> They exist in other countries too. I don't know if there is any crossover when it comes to the content though.

</comment></comment></comment></comment><comment><USER15> This sounds like fun.

Step 1. Get the name and address of people who use your service.

Step 2. You get hacked.

Step 3. Everyone now gets to have their identify stolen and possibly blackmailed.

</comment><comment><USER16> How long before someone makes a chrome plugin that enters a random Brit's information each time?

<comment><USER17> Random? I'd say something quite close to a member of Parliament :)

</comment></comment><comment><USER18> Waiting for the moment Labour and the Tories proudly announce they unite as the English Socialist Party [1], ban the monarchy and other political parties and rename Britain to Airstrip One [2].

Happening any day now.

[1] [https://en.wikipedia.org/wiki/Ingsoc](https://en.wikipedia.org/wiki/Ingsoc)

[2] [https://en.wikipedia.org/wiki/Nations_of_Nineteen_Eighty- Fou...](https://en.wikipedia.org/wiki/Nations_of_Nineteen_Eighty-Four#Oceania)

</comment><comment><USER19> Stupid and pointless because everyone will move to other underground sites and mirrors that flout the rules, better for parents to use parental protection

<comment><USER20> Uh, I wouldn't know myself, but my friend informs me that tons of pornography is available just through Google Image Search. Does the UK have a plan to block that, or to force Google to?

<comment><USER21> > Does the UK have a plan

You could just have stopped there. They (the Government) don't. They're signalling. I'm sure they don't really care at all.

This is just playing to the gallery. Or, at least, a specific segment of the gallery that generally votes Tory but has flirted with the likes of UKIP etc in the recent past.

</comment></comment></comment><comment><USER22> Will Snapchat also be required to collect names and addresses?

</comment><comment><USER23> It's fascinating to watch the British tolerate this bizarre puritanical fascist shift. The forced surveillance laws are not unexpected, that's going on in most of the developed world these days to one degree or another. The laws around porn are the part that I never would have expected. It seems like something the more extreme conservatives in the US would have cooked up.

<comment><USER24> > It seems like something the more extreme conservatives in the US would have > cooked up.

It sounds more like something the US _did_ cook up back in the 90s; the Communications Decency Act in 1996 and then after the relevant part of that was struck down the Child Online Protection Act in 1998; similar age verification was widely adopted by adult sites in the US to avoid liability under these acts, in the brief time they were in force. Usually, credit card verification was used.

<comment><USER25> > Usually, credit card verification was used

How convenient. That doesn't prove age at all. In fact, as a kid I'd steal my parent's credit card, but now that I'm an adult I don't own one.

Go figure.

<comment><USER24> > How convenient. That doesn't prove age at all.

That criticism was noted in a number of media outlets at the time; it probably would have eventually become a legal issue had the laws not been struck down, rendering it moot.

</comment></comment></comment></comment><comment><USER26> 10 Downing Street.

<comment><USER27> Yeah, I suspect Theresa May is going to 'watching' a lot of porn commencing April 2018.</comment></comment>


Tim Ferriss Revisited - <AUTHOR> http://www.texasstartupblog.com/2008/05/19/tim-ferriss-revisited/ <comment><USER2> "We don't mow our lawns, we don't clean our homes, we don't cook our meals, we don't drill for oil, we won't build oil refineries, we simply don't do much anymore".

This is a sign of prosperity not a lack of hard work. We also don't cut our own trees, build our own furniture, use printing presses or churn our own butter. Instead, we've been able to reassign our time and talents to more productive or fulfilling tasks while leaving or paying for tasks such as these to machines or to a lesser amount of people.

One caveat, in TFHWW, Ferriss often comes off as sort of a douche, but that doesn't mean there aren't great concrete ideas and references throughout the book - the key is knowing which ones are applicable to your life. The book is by no means perfect, but it's certainly better than the self-improvement fluff and vapor proliferating itself all over the Amazon best seller lists.

The blog post author seems to confuse working hard and working smart.

<comment><USER3> _One caveat, in TFHWW, Ferriss often comes off as sort of a douche, but that doesn't mean there aren't great concrete ideas and references throughout the book_

I agree. I do recommend TFHWW to people, but never without embarrassment.

</comment></comment><comment><USER4> The guy's older article is just as interesting for the confusion. ([http://www.texasstartupblog.com/2007/08/09/timothy- ferriss-r...](http://www.texasstartupblog.com/2007/08/09/timothy-ferriss- ruining-lives-four-hours-at-a-time/))

He takes the example of one person who has ruined his life. Ruined how? The guy is no longer a customer. He hides from the people he is working with. Therefore, he disvalues building lasting relationship.

Unfortunately, he assumes that a professional life necessarily encompasses a personal life. He seems to be implying that if your professional life tanks, then you no longer have a personal life ... whereas the main thing I get out of Tim Ferris's book is giving priority to your personal life. Since the blog post author only knows his example by through his professional life, he has no way of knowing if his former client has ruined his _personal_ life.

I keep seeing so much hate in those comments. I saw the hate in the reviews on Amazon. Particularly, people keep coming back to the idea that if everyone follows Ferris's strategy, no one would be left to do the work. Why are people waving that around as if they were waving a flag to make a last stand against a charging horde of barbarians?

It seems to me that this blog author reacts violently to the idea that a person can benefit from someone else's "hard honest work", to the point that he may be taking it personally: reacting unconsciously to the idea of "Tim Ferris is taking advantage of MY hard honest work." It is as if Ferris's ideas threatens all those years of struggle with putting in long hours to put food on the table. These are responsibilities as an adult, that one had to give up personal things as a child to become an adult ... and here comes Ferris who seems to advocate extending your childhood ... So he tells himself, "If everyone follows Ferris's ideas, who is actually going to do the work" While this is mathematically true, it serves more as an emotional security blanket validating that all the "sacrifices" he had made was not for naught.

In his book, Ferris himself claimed to have worked extremely hard in his early days, before dropping everything to go to Europe. There, with nothing to do, and no "hard work" to validate himself as a person, he had to either fill it up with something (usually hard work) or come to some sort of a realization about himself. Ferris by no means the first person who has espoused this idea. In my studies of Lao Tzu's ancient text, Tao Te Ching, these very same ideas are already there. In fact, Ferris does not really escape the whole Protestant Work Ethic -- he's turning his entire drive and passions towards doing the things he _wants_ to do (whatever those "wants" are), whereas Taoists of Lao Tzu's ilk tame those fires and retire into a contemplative life away from the material world. Ferris still works hard, he just doesn't work hard in what the mainstream American society considers "productive".

</comment><comment><USER5> "Envy never comes to the party dressed as envy, but as high moral standards."

That's a paraphrase, Wilde or Shaw I think, but this post is a perfect example.

I think the idea that "hard work is an end unto itself" is pretty dumb.

I'd also like to address his comment about "who will do the work?" if everyone implemented Ferriss methods. Well, obviously some people are going to lack the initiative, brains, risk-tolerance, information, or opportunity to do so, and will be stuck manning the refineries or stuffing the boxes. But you can't really blame Ferriss for that, as he wrote a best-selling book trying to show how and why to do it, even without having much money or "qualifications"!

<comment><USER6> The author pretty much seems to say "What will happen if everyone starts coding?" It is amazing how some people don't try to extract what is valuable to them from Tim's book, PG's essays etc and simply try to reiterate why it won't work for them.

This guy is a blubist.

(I am using <http://www.paulgraham.com/say.html> to my advantage ;) Search for _defeatist_ )

</comment></comment><comment><USER7> _Our founders were the hardest working people of their time._

I think that distinction probably goes to their slaves.

<comment><USER8> There is still debate over whether slaves worked harder even than other paid farmhands. The last great volley (slaves do) could be said to have won its author a Nobel Prize.

<comment><USER9> Good, substantive point that anyone cheering on the glibness of the grandparent post should consider.

</comment></comment></comment><comment><USER10> hmmm I didn't feel that Ferriss was espousing laziness. Instead here's what I thought his major ideas were:

1) your time is very valuable; you only live once

2) it is stupid to spend all your time working so you collect and hoard expensive toys that you won't have time to play with. instead use your money to expand your free time and freedom to do cool stuff

3) you can delegate some of your work to expand your free time

4) there are unconventional solutions to conventional problems

</comment><comment><USER11> I've read the four-hour-work-week, and at its core the message is that if you work hard and focused towards building a company that actually makes something people want and structure it in such a way that that you can offload support, etc to third-parties .. well _then_ you can go do something else and macro- manage it in a few hours per week.

It takes a lot of effort and focus to get to that point, though.

Tim Ferriss is hardly a snake-oil vendor. The marketing of the book might suggest otherwise, but to me he seems like a guy who found a novel way to structure _his_ business and wrote the book as a "here's how I did it".

The book's worth picking up if you're reading this site, though comments along the lines of programmers being a dime a dozen (or words to that effect) might put you off.

</comment><comment><USER12> Has anyone seen a blog post where someone applied the information from "Four Hour Workweek" and it worked well for them? (Excluding Tim Ferriss, of course)

<comment><USER13> Ferriss suggests:

1) Reducing information/news intake (Peter Drucker said that) 2) Working ON the business (automating it) rather than IN the business. 3) Pushing the envelope on how much mundanity you can outsource.

You don't have to look far for people who've had success following these ideas.

<comment><USER12> I appreciate that he is using largely recycled ideas. What I am looking for, though, is someone stating that Four Hour Workweek is the tool that they used to get them from point A to point B.

</comment></comment></comment><comment><USER14> I've never read the book, but taking the title literally was the authors first mistake.

From what I've seen in reviews and when I skimmed the book it's not about working 4 hours a week, it's about working less on mundane tasks and doing what you love in your free time (traveling, golfing, whatever)

<comment><USER15> In the book, the author explains how he used Google Adwords to test the marketability/flash of book titles. 4HWW won.

<comment><USER16> The original title was drug dealing for fun and profit! The book isn't necessarily about working 4 hours a week.

</comment></comment></comment><comment><USER17> You have to give Tim credit, he came up with an excellent controversy. Of course, you all must realize that Tim doesn't follow his own advice. He admits that it took a lot more than 4 hours a week to write the book. He spends more than 40 hours a week promoting the book (even now). Get it? He doesn't believe his own thesis. Sure, it is possible, but for how many people? for how long? Not very many and not very long.

<comment><USER18> Ferriss never claimed to be writing his book for money. The book is his _hobby_ : he _enjoys_ writing books. He _enjoys_ promoting his book. That's one reason why he's so good at it!

I do agree, though, that the book's advice is not for everyone.

</comment></comment><comment><USER19> Well .. I think the writer has a few things wrong ... Everybody is not going to be successful . All fingers are not equal .

This is why if you have 50 students in a class who have been taught by the same lecturer using the same books . They dont all get A's

If everyone one in America is given $1 Million most would be broke in less than 3 years . Money will be pissed away on Alchohol, Drugs, Women, Gambling, Bad Biz choices, etc

There is never a time when 100% of the people will get it right 100% of the time .

So saying who will wash the dishes if everyone is a chef makes no sense because life is designed there to be winners and losers . A lot of people that bought the book wont even finish reading the book if they start at all .

Life is meant to be enjoyed . Your not meant to spend your life working hard till you drop dead .

Your meant to utilize you talents to get ahead and finishe early .

</comment><comment><USER20> Anytime I see someone try to use "ethics" to make an argument I instantly stop reading. Ethics and morality are human constructs and inefficient ones at that. The question isn't "Did I succeed at X by cheating/being unethical?" its "Did I succeed at X?" Everything else is superfluous. There are countless real-world "hacks" that require one to bend the rules or forgo being "nice" to accomplish a goal.

<comment><USER21> Really? I agree that ethics doesn't really apply in this case, as what Tim Ferriss suggests is just basic capitalism (companies always profit off the backs of their workers... what has changed?) but you don't even consider it? i.e. professional assassin is fine as long as pays the bills?

<comment><USER20> Honestly? Yes, it is. That being said, were I planning to run for President, I probably wouldn't pick a job like professional assassin because if the public found out they likely wouldn't vote for me. I consider ethics only when my perception as ethical/unethical factors into my probability for success at a given task. In this case, Ferriss' success didn't hing on his ability to be ethical and/or not be an ass so it's irrelevant.

Take Google for instance; their Do No Evil mantra. Maybe they really are super ethical people and truly want to improve the world we live in. Or maybe its just _really_ important to appear and be ethical when dealing with tons of information from the public in order to gain the trust necessary for them to use Google services. Either way, it's an important factor for their success.

I don't go out of my way to break social constructs or be a jerk, but my business partner can attest that I don't go out of my way _not_ to, either. Its why he does most of the talking ;)

</comment></comment></comment><comment><USER19> Yeah ..Our founders didnt do the work .. They outsourced it to slaves .

</comment><comment><USER22> I tried to get through this, despite the piss poor writing ("Let's begin at the beginning...") and the arrogant tone. I skimmed the beginnings of every chapter, and realized that this book could be written in 5 pages. Then I read the part about him cheating to win a kickboxing tournament. That's when I chucked the book aside, and picked up Warren Buffett's biography instead. Talk about contrast. Buffett is insanely talented, works hard AND smart and has incredible depth. Ironically, Ferriss himself recommended the Buffett bio at a talk he did. My prediction? Ferriss is going to do talks to plug his book at smaller and smaller venues, whoring himself out to everything but the local Elk's club, following in the crap footsteps of Andrew Keen's book tour. Then, as he realizes the ship has lost all momentum, he'll admit that this book is just another corner-cutting, outsourced, unoriginal, first-draft, lazy piece of work in a long line of shams that he's pulled.</comment>


Ride sharing, vehicle accidents, and crime - <AUTHOR> http://marginalrevolution.com/marginalrevolution/2016/05/ride-sharing-vehicle-accidents-and-crime.html <comment><USER2> Direct link to paper: [http://poseidon01.ssrn.com/delivery.php?ID=71111908212500711...](http://poseidon01.ssrn.com/delivery.php?ID=711119082125007114086090084086078030054021093008061013104027067125117020103069088064058001029022012102023080086111101121086117103029074046010095002086124112012097020038046089126080116123096119088122007113083077098018081064091126078109115094092095090&EXT=pdf)</comment>


Coffee May Protect Against Cancer, W.H.O. Concludes - <AUTHOR> http://well.blogs.nytimes.com/2016/06/15/coffee-may-protect-against-cancer-w-h-o-concludes/ <comment><AUTHOR> Here's the WHO committee's press release: [http://www.iarc.fr/en/media- centre/pr/2016/pdfs/pr244_E.pdf](http://www.iarc.fr/en/media- centre/pr/2016/pdfs/pr244_E.pdf)

Journal article (behind a paywall): [http://www.thelancet.com/journals/lanonc/article/PIIS1470-20...](http://www.thelancet.com/journals/lanonc/article/PIIS1470-2045\(16\)30239-X/fulltext)

</comment><comment><USER2> NY Times (1981!) talking about how coffee is linked to pancreas cancer: [http://www.nytimes.com/1981/03/12/us/study-links-coffee- use-...](http://www.nytimes.com/1981/03/12/us/study-links-coffee-use-to- pancreas-cancer.html)

The cliche that everything causes and prevents cancer holds.</comment>


Fast IP to CIDR Block Lookup in Golang - <AUTHOR> https://github.com/yl2chen/cidranger <comment><USER2> If it meets the guidelines, this might make a good 'Show HN'. Show HN guidelines: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

<comment><AUTHOR> Thanks for the tip, just made a 'Show HN' post.</comment></comment>


Grupa.io: Product Engineering Service Market Network - <AUTHOR> It's becoming harder and super expensive to attract and retain world class talents; it's even harder and time consuming to build a product team, the alternative is to go to freelance network platforms like Upwork, Toptal , gigster or work with outsourcing dev shops! The problem with this is that such platforms are project focused not product focused ; startups are agile-iterative in nature and therefore the need to reinvent a system that is cost effective and iterative in nature!
Over the last 9months, we have been working on Grupa.io: a platform that allows startups subscribe to product iterations engineering using service teams (work based on their preferred service plans and work mode). This is product focused and affordable (you get a team for the price of 1 senior engineer! this is possible because you get to subscribe for shared, flexible or dedicated plans which are a fraction of the teams commitment).
I'll love to discuss this in detail to know your thoughts! <comment><USER2> Marketplace businesses are some of the hardest businesses to start.

Filling the pipeline on the supply-side and the demand-side, simultaneously is nearly impossible, so you'll find yourself oscillating between the two.

So, I'm curious...

Which group are you concentrating on growing first: supply, or demand?

<comment><AUTHOR> We have aggregated supply and kept some on waiting list; we are focused on aggregating demand now! As we move on, we will have demand aggregation and supply aggregation teams</comment></comment>


Ask YC: Bug Tracking - <AUTHOR>

I am looking for a bug tracking tool for our small software development startup. Open-source is preferred. Less importantly  - if its written in Python/Java it would be preferable. Any suggestions? <comment><USER2> I've never been happy with Mantis which we use where I work, but that's lucky for you because it's written in PHP. I would second davidw's suggestion of Trac, since it seems to work well and is the only bug tracking tool I've actually felt comfortable with.

<comment><USER3> Love Mantis, but I've used it more in the past for project tracking than bug tracking. And I'm not a PHP hater so that helps.

</comment></comment><comment><USER4> Trac and redmine seem nice. Trac is in Python.

<comment><AUTHOR> Trac indeed seems interesting, especially since it integrates with Bitten CI Server. Which we need too.</comment></comment>


'Switch' is Nintendo's next game console - <AUTHOR> https://www.engadget.com/2016/10/20/switch-is-nintendos-next-game-console/ <comment><USER2> It looks fun. I guess this one breaks backwards compatibility though, in the video there weren't any Wiimotes nor any kind of movement based input.

<comment><USER3> I think that breaking compatibility is good. I play with my 9 yo and I've grown tired of the gimmicks.

</comment></comment><comment><USER4> [https://news.ycombinator.com/item?id=12752248](https://news.ycombinator.com/item?id=12752248)</comment>


Ask HN: How to do a private beta right? - <AUTHOR> So I've built a SaaS MVP (B2B enterprise). I guess the next step is private beta, because we're not ready to open the floodgates to the public. How are private betas usually managed? Would really appreciate anyone's experience with this matter. What does the funnel usually look like? Is it ok if we don't have automatic credit card subscriptions yet, and I manually invoice our private beta customers? What are the expectations at this stage in terms of customer experience? <comment><USER2> I have launched some micro-saas products for B2B to give you some background for me. Here is what I typicality have in place for a private beta: 1) Intercom for easy communication in-app 2) Google Analytics for general page tracking 3) Amplitude for tracking granular user actions 4) Rollbar for tracking errors when users don't report issues (you would be surprised how often users don't communicate small or even larger issues to you) 5) I make sure I have some basic self-help tools in the app for betas such as password resets, etc. That is it for basic tools I've used for SaaS betas. As for the private beta itself, I always try to schedule some in-person meets, or virtual screenshares once a week or every few weeks to get a list of issues, wants, etc. that each user has about the product, I then compile all of that feedback into Waffle or Trello so I can get a count of which issues are the most pressing or most requested. As for the funnel, I am not entirely sure what you mean, but as users give me feedback and as I work through their issues / updates I try to position the conversation as if we fix X, Y, and Z or add X, Y, and Z will you pay us (whatever amount) for the subscription. It's good to get them to commit to the next step even if its 6 months out. Also, yes it is completely okay if you take invoices vs. having an automated system. They should understand where you are at since you are not officially launched and be empathetic to that, if not, they are probably not the best fit for the beta. The biggest expectation is they are their to provide you with valuable feedback so you can make this the perfect tool for them an any future customer that looks like them. Hope that answers all of your questions.

</comment><comment><USER3> We did a private beta when launching Honeybadger.io, and it worked really well. We reached out to people we knew who would be good customers, had them go through the same signup flow we planned to use after launch, and had them enter payment information and get billed (so we could test everything). We offered these first customers a special, low-priced plan as a thank-you for helping us test the product.

I think it would be fine to do manual invoicing for this group of customers if you don't have your credit card processing in place yet. These first customers should be ones who will understand that they are _testing_ , so not everything will work. On the flip side, though, you should be prepared to offer them excellent service, responding quickly to any issues they encounter. These customers can become a great source for referrals for additional customers if you treat them well, so treat them well. :)</comment>


AMD Cuts Ryzen 7 Prices, Readies Threadripper CPU Lineup - <AUTHOR> https://www.extremetech.com/computing/250258-amd-cuts-ryzen-7-prices-readies-threadripper-cpus <comment><AUTHOR> Now let's wait for Intel.

On Intel pricing strategy, it feels strange that Intel doesn't reduce the price of older chips once new ones are announced.

<comment><USER2> At this point in the short term, what Intel does and says is irrelevant. All they can do is cut prices on their current offerings, but their current offerings at best take second stage. AMD is presenting a series of very interesting products which are a quantitative and qualitative leap ahead of what has been in the market for years, and are offering them at very interesting prices, and Intel can do nothing to change this.

Perhaps in the medium or long term Intel can do anything to change this, but right now the only thing that matters is AMD and the company's new product lines.</comment></comment>


Deploy Java Apps With Docker - <AUTHOR> http://blogs.atlassian.com/2013/06/deploy-java-apps-with-docker-awesome/

<comment><USER2> It's probably also worth mentioning dokku, which is a simplified private PaaS built on top of Docker. It adds Heroku buildpacks (Ruby, NodeJS and Java right now) into the mix, and a git push-to-deploy model.

Because dokku has a concise and readable codebase, browsing the source is a good way to see one practical application of Docker, too.

I've set it up as a sandbox environment for developers at my company, and for our purposes it's a much better fit than some of the more heavyweight private PaaS products. I'm really enjoying working with it!

<comment><USER2> Link: [https://github.com/progrium/dokku](https://github.com/progrium/dokku)

</comment></comment><comment><USER3> I played with Docker a bit yesterday. Containers really are awesome! VMs look almost stupid in comparison. I'll be using it as much as I can. Being written in Golang doesn't hurt either... Golang seems like a very good choice for this.

<comment><USER4> It is called Go!

<comment><USER5> Not if you want to search for it.

<comment><USER4> The search expression "go programming language" gets [http://golang.org/](http://golang.org/) as first hit.

How hard is that?

<comment><USER5> If you really want to know it isn't for finding the main site that everyone uses golang it is for finding all other references to the language.

As an example cloudflare writes a large amount of posts that have something to do with go if you google "go cloudflare" you get relevant results but you also get results of google mixing in the word "get" for go which are completely irrelevent.

Now if you google "golang cloudflare" all results pertain to the Go programming language.

(Not the best example because cloudflare doesn't use golang in their posts).

<comment><USER4> Easy, "go programming language" cloudflare

</comment></comment></comment></comment></comment></comment><comment><USER6> This is exactly what I've been looking for, a clear walk-through of Docker.

<comment><USER7> There are more links like this. For a list of the ones I have compiled so far check out this page.

[https://github.com/dotcloud/docker/issues/614](https://github.com/dotcloud/docker/issues/614)

Feel free to add to the list if you know of some I forgot.

I'm also planning on writing my own Docker for dummies tutorial that goes from beginning to end explaining how to use each part along the way. Now I just need to find some time to put it all together.

<comment><USER8> I would love to see more conceptual materials, explaining the ideas behind it, why I should use it, use cases, comparisons to alternatives - that kind of reading. It seems promising but a little hazy from a high level.

<comment><USER9> You're right. The Docker community has grown from a core of people who are naturally excited about containers, and typically have been tinkering with them for years. So most of the early material is biased towards the "how" rather than the "why". Now that the community has grown in amazing ways, we're working on changing that.

I gave a talk last week at the dotScale conference [1] about the high-level motivation behind Docker. The video should be available soon.

I'm also working on a series of articles on the design principles behind it - separation of concerns, static vs dynamic dependencies, why developers never use system packages, "real computers all the way down", thinking of the internet as one giant unix computer... Basically 5 years worth of obsessing over this particular subject :)

[1] [http://dotscale.eu](http://dotscale.eu)

<comment><USER8> Sounds great! What can I follow to find these once you write them?

<comment><USER9> The best place is probably the brand new Docker blog: [http://blog.docker.io](http://blog.docker.io)

</comment></comment></comment></comment></comment></comment><comment><USER10> get familiar with openvz - linux containers that allow to configure network interfaces, dynamic resources allocation, etc

Example from [http://openvz.org/Basic_operations_in_OpenVZ_environment](http://openvz.org/Basic_operations_in_OpenVZ_environment):

[host-node]# vzctl create 101 --ostemplate fedora-core-18-minimal [host-node]# vzctl set 101 --ipadd 10.1.2.3 --save [host-node]# vzctl set 101 --nameserver 10.0.2.1 --save [host-node]# vzctl start 101

<comment><USER9> OpenVZ is basically identical to lxc, which is one of the underlying components of Docker.

Docker could be ported from lxc to openvz (and probably will be in the future as a plugin, as it has been requested).

That is to say, Docker is not a replacement for OpenVZ, or any other low-level container capability. It's simply a higher-level tool which is built on top.

<comment><USER10> Yes, LXC and OpenVZ in it's core similar technologies that enable linux containers. OpenVZ also comes with varios containers management tools, some of which are available via docker for LXC containers too.

<comment><USER9> We are very familiar with openvz, as dotcloud was based on it before switching to lxc :) See [https://news.ycombinator.com/item?id=5817455](https://news.ycombinator.com/item?id=5817455)</comment></comment></comment></comment>


Calling All Philly Entrepreneurs... First Round is Having 'Office Hours' - <AUTHOR> http://redeye.firstround.com/2009/05/calling-all-philadelphia-entrepreneurs.html

<comment><AUTHOR> I just love how they call it 'Office Hours'...

<comment><USER2> They'll start holding "lectures" next.</comment></comment>


Show HN: We added an Oink data importer for Cheers - <AUTHOR> http://chee.rs/oinkimport

<comment><AUTHOR> We heard from a number of users of both Oink and Cheers that were disappointed that Oink shut down so suddenly.

To help them out, we put together an importer that takes your Oink data file zip and turns it into posts inside of our app, Cheers, with as much fidelity as we could reconstruct.

<comment><USER2> Fantastic idea! Way to be on the ball!

</comment></comment><comment><USER3> Pounce!</comment>


WebGL through Three JS - <AUTHOR> http://dimroc.github.com/reveal.js-threejs/ <comment><USER2> Most of these slides don't seem to work. Can't tell if they require GL extensions I don't have, need to run in Chrome Canary, or what. (Firefox, GeForce GTX 670)

On a more pedantic note, the 'programmable graphics pipeline' slides are so inaccurate that it makes me slightly uncomfortable. It's okay to generalize some so that people get the idea of what's going on, but you're leaving out a lot of important details that help make it clearer why things work the way they do in modern 3d hardware.

For a starting point, look at how the modern pipeline is described here: [http://fgiesen.wordpress.com/2011/07/03/a-trip-through- the-g...](http://fgiesen.wordpress.com/2011/07/03/a-trip-through-the-graphics- pipeline-2011-part-3/) Even with geometry shaders left out of the picture, you've got something like 6 'stages' in the pipeline, entirely ignoring all the incredibly complex magic that lives in the driver (and for WebGL apps, in the browser).

It might be better to instead show the flow of data through the CPU/GPU instead of showing pipeline stages - for example:

vertex buffers, index buffers, shaders, and draw calls that tie them together

primitives constructed from the indices and vertices

quads/spans/fragments/etc created from the primitives by the rasterizer

the z-buffer - what goes into it, where, who writes to it and reads from it

the pixel shader - what inputs it actually takes and what it produces

the actual output color data being written to the framebuffer

Really just pedantry at this point, but I don't think the existing pipeline diagram in the slides really says much useful.

If I had to pick one important lesson to convey when talking about modern pipelines, it would probably be how incredibly, massively parallel they are. hundreds or thousands of pixels/quads might be getting shaded at any given time, which is important to understand if you're trying to do interesting things with the GPU - it's not going to behave like your CPU and it may degrade in strange ways if you make the wrong demands.

<comment><USER3> For me the slides (also previous slides that worked before) broke after the embedded Carmack Youtube video.

Must be some conflict between WebGL and Flash.

</comment></comment><comment><USER4> If you're having problems viewing the slides, visit <http://get.webgl.org>

It's not what we designed it for, but turns out that our material editor in <http://studio.verold.com> is a really nice way to see and learn about render settings. Even if you just run our intro tutorial to grab the Standford bunny, then turn the dials on its one material. See some of these principles in action, in Three.js.

</comment><comment><USER5> I made a little PoC a while ago with three.js, what annoyed me was the documentation and the ever changing API and how examples were out of date straight away.

But it was still pretty nice making a "game" and pressing F5 to see my changes straight away.

Here is my Gran Turismo clone.

<http://agentrunnerjs.apphb.com>

<comment><USER6> They have a nice migration guide here: <https://github.com/mrdoob/three.js/wiki/Migration>.

</comment></comment><comment><USER7> Just wanted to mention that my demo (Deferred Irradiance Volumes) is not three.js. The credits for it would be <http://codeflow.org/> (but don't worry, I've put that link on the demo long ago anyway).

Fortunately I've fixed a bug with the demo just today, so you're in luck. Unfortunately Windows ATI seems to have trouble with, I'm still trying to figure that one out.

</comment><comment><USER8> This page crashed my PC. Fedora Core 17 64 Bit, Firefox 17</comment>


Do.com bought, gives customers 1 week notice of shutdown - <AUTHOR> http://blog.do.com/post/157299307009/announcing-our-next-chapter <comment><USER2> One week ... that's enough for anyone /s.

In the best case, this behavior is just incredibly bad style. In the worst case, there might be room for legal action.</comment>


Why competition in the politics industry is failing America [pdf] - <AUTHOR> http://www.hbs.edu/competitiveness/Documents/why-competition-in-the-politics-industry-is-failing-america.pdf <comment><USER2> This paper outlines the problem (capture of our democratic process by a business/political elite) quite well. Most of the solutions (fixing gerrymandering, money in politics, primary access) presume a reasonable amount political leverage in order to enact. The paper proposes [http://www.centristproject.org/2018plan/](http://www.centristproject.org/2018plan/) as a fulcrum.

 _The Centrist Project's plan includes strategically identifying a small number of states with a political climate favorable to candidates from "the sensible center," recruiting promising candidates, and supporting them with a campaign infrastructure, as we discuss further on. The genius of this plan is that, while challenging, it is eminently doable because the number of seats required to deny either party a majority is small._

<comment><USER3> I'm not sure "centrist" is really a thing because I'm not sure voters fall on a simple left/right spectrum. I thought this was especially clear in 2016 with strong populist sentiments giving strong showings in both the Republican (Trump) and Democratic (Sanders) parties.

In other words, many forms of populism are neither Republican nor Democrat, does that make them part of the "sensible center"?

EDIT: Do downvoters care to explain their objections?

<comment><USER4> I think of "Centrists" the non-negotiable principle is cooperation and successful operation of government for the dignity of the most people, and other policy principles have to compete within that framework. As opposed to the Republican and Democratic parties, which have identified no-compromise principles that divide people as effectively as sporting alliances or religions.

Example (of my own, not from any Centrist literature): charging a commensurate fee to pollute a river rather than strictly allowing or outlawing it. The business would prefer to be allowed to pollute for free (Republican Party principle) while the environmentalists would prefer that the pollution not be emitted under any circumstances (Democratic Party principle). But a structure that accurately prices the impacts and externalities of the pollution respects the environmental and health values, and the business can choose the most beneficial option for them: prevention, change of product or process, or just paying the fee.

<comment><AUTHOR> But it adds bureaucracy, instead of either nothing or some policemen.

<comment><USER5> There is a cost, regardless.

If you do nothing and allow anyone to pollute anywhere they want, then you get a public health crisis and many people die and many more get sick.

If you prohibit the pollution and heavily police the people who try to pollute anyway, then you have to pay for all the efforts to enforce the prohibition plus you have the possibility of job loss as those companies go somewhere else that does allow them to pollute freely.

If you allow the pollution but charge a cleanup fee, then you have the increased beauracracy, etc....

There Is No Such Thing As A Free Lunch.

</comment></comment></comment></comment></comment><comment><USER6> More like the lack of competition. See the recent lawsuit by Gary Johnson that was dismissed against the CPD, which is essentially a monopoly on voter information.

Even with the Internet making alternative views increasingly accessible to younger generations, the real flaw lies in our voting system, the biggest oversight of the founding fathers. First Past the Post inevitably leads to a duopoly / 'team' mentality, whereas approval voting could possibly solve many of our nation's woes.

</comment><comment><USER7> More generally speaking, it seems that the faster society in general changes, the shorter its institutions last - it's like too much baggage and cruft accumulate up to the point of breaking. The new generations demand a different way of life, and they want it faster than the old ones.

The Roman empire lasted a couple of thousand years, the medieval empires up to a half a century, the British empire a bit more than a a quarter, the American, well, almost a quarter (with a violent change about right about the middle of the period, so...). Interesting times, and all that.

I've sometimes thought that the rigidity of the US Constitution (i.e. it's not revised completely ever 50 years) is both its biggest benefit and its weakest side. If only the founding fathers made a clause like "and thou shall revise whatever we've written every 50 years in the light of new facts, because we are just men, and fallible."

</comment><comment><USER8> The common failing of these reforms, as admirable as they may be, is their reliance on the very same people who depend on the current rules for their position.

IOW, politicians don't change the rules because they suddenly grow a conscience. It has to be presented as an existential choice.

The only other bone I have to pick is with the term "centrist." Meaning what, exactly? Predisposed towards compromise? Absolute neutral in the D&D sense? Unabashedly quantitative utilitarianist?

The way HBR defines it, to be a centrist, one would have to know the extreme positions on a topic and programmatically move towards a middle or compromise position.

</comment><comment><USER9> _> The duopoly controlling today's political competition has no accountability for results._

Sums it up perfectly...

<comment><USER10> Not really, it's that the country as a whole can't decide on the results it wants. Both parties are roughly equally split between moderate and more extreme wings, so even within each party they can't agree, and then when the two parties are pitted against each other in campaigns or in the practice of governing, they again can't agree. Double whammy. It shouldn't be any surprise that under these conditions not much gets done.

Also, controversial opinion here I'm sure, but imho that gridlock is mostly good thing. The less the government is able to do, the more of a stable and predictable state the country is in, making forecasting and planning more reliable. The one exception is the government's inability to reign in deficit spending, and perhaps their longer term inability to ensure solvency of social programs.

<comment><USER11> >Both parties are roughly equally split between moderate and more extreme wings

This is simply untrue and false equivalence.

<comment><USER12> What? You have the Bernie socialists vs the Clinton centrists on one side, and the Trump MAGA warbirds vs the McCain moderates on the other. It sure looks fractured to me.

<comment><USER13> This is a "both sides are the same" fallacy. Just because it looks fractured doesn't mean it is equally so:

[https://fivethirtyeight.com/features/the-two-cracks-in- the-r...](https://fivethirtyeight.com/features/the-two-cracks-in-the- republican-party/)

[http://www.pewresearch.org/fact-tank/2014/06/12/polarized- po...](http://www.pewresearch.org/fact-tank/2014/06/12/polarized-politics-in- congress-began-in-the-1970s-and-has-been-getting-worse-ever-since/)

[https://twitter.com/gelliottmorris/status/888904322326638592](https://twitter.com/gelliottmorris/status/888904322326638592)

<comment><USER14> Agree. Also, see the DW Nominate scores for congress. [https://voteview.com/parties/all](https://voteview.com/parties/all)

Liberals are at 0.38, and the most extreme they've ever been was 0.39. They have been somewhat more liberal than they were in the 40s, but they've generally been within the same band of scores for the last 100+ years.

Conservatives, on the other hand, are at 0.49, which is the most conservative they've been in the last 200 years. They've basically doubled since the 1970s.

So, objectively, conservatives are more extreme (0.49) than liberals (0.38) today. Also, the most extreme conservatives are more extreme than the most extreme liberals.

<comment><USER15> This method is explained a little bit at

[https://en.wikipedia.org/wiki/NOMINATE_(scaling_method)](https://en.wikipedia.org/wiki/NOMINATE_\(scaling_method\))

I think this may be the first time I've seen this, but I'm quite confused about the claim to be able to make comparisons across time by simple statistical methods. The model has a clear statistical meaning about the similarity of different members of the same Congress, who have all voted on the same set of questions. But surely the issues that the Congress is actually voting on are radically different from decade to decade? Slavery, the Federal income tax, alcohol prohibition, the New Deal?

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> The problem is our obsolete voting system which effectively prohibits a third party from winning. Range voting does not have this problem.

<comment><USER9> _> The problem is our obsolete voting system which effectively prohibits a third party from winning._

[https://en.wikipedia.org/wiki/Commission_on_Presidential_Deb...](https://en.wikipedia.org/wiki/Commission_on_Presidential_Debates)

 _Multiple lawsuits have been filed by third-party candidates challenging the CPD 's policy of requiring a candidate to have 15% support in national polls to be included in presidential debates. While the lawsuits have challenged the requirement on a number of grounds, including claims that it violates Federal Election Commission (FEC) rules and that it violates anti-trust laws, none of the lawsuits has been successful._

<comment><USER17> No, it's definitely our electoral system. FPTP fundamentally shifts a system toward two major parties, and no amount of tinkering with debates or other reforms at the margins will make third parties competitive.

Further reading: [https://en.wikipedia.org/wiki/Duverger%27s_law](https://en.wikipedia.org/wiki/Duverger%27s_law)

<comment><USER18> Why is it a competition for a singular explanation? Why can't both be necessary but not independently sufficient conditions? I sense a middle being excluded somewhere.

</comment></comment></comment></comment><comment><USER19> Paper: DISCLAIMER The views expressed in the paper are the sole responsibility of the authors and are not meant to represent views of Harvard Business School or Harvard University.

Title: Harvard Business School: The U.S. Political System Has Been 'Hijacked'

Thanks for fixing the misattributed title, it comes across as sensationalist.

<comment><AUTHOR> I just copied the title of the original article at themaven.net that I submitted ( [https://www.themaven.net/theintellectualist/news/harvard- bus...](https://www.themaven.net/theintellectualist/news/harvard-business- school-the-u-s-political-system-has-been-hijacked- mj-X8WUfskapGULM6GEKVg?full=1&full=1) ). I see the URL has been changed to the paper, which is probably better indeed.</comment></comment>


The League of Entropy Is Making Randomness Truly Random - <AUTHOR> https://onezero.medium.com/the-league-of-entropy-is-making-randomness-truly-random-522f22ce93ce <comment><USER2> Somewhat relevant, Eric Lippert recently had an excellent 40-part blog series about fixing randomness: [https://ericlippert.com/2019/01/31/fixing-random- part-1/](https://ericlippert.com/2019/01/31/fixing-random-part-1/)

</comment><comment><USER3> Not really on topic but can we discourage the use of medium? It's annoying to have to open these links in incognito and on top of that they do some other things that make reading more difficult.

<comment><USER4> > _It's annoying to have to open these links in incognito_

Note that the thing that looks like a paywall isn't - while Medium does have paywalled articles, they're rare (and as far as I can tell this one isn't) and at the discretion of the author, not of Medium, anyway. Medium aggressively wants you to sign up if you've read more than _n_ articles in a month, but you can just click the X and read _n_ +1 articles.

<comment><USER3> We must have gotten different versions. I'm on mobile and my paywall didn't have an X to close it. I have seen the thing you're talking about on desktop though..

</comment></comment></comment><comment><USER5> What I don't get is that the modern chips are reaching the level of being limited by quantum noise yet modern GPUs and Tensor processors don't seem to offer any sources of quantum randomness. Can someone who understand this stuff please explain.

<comment><USER6> Quantum noise does not automatically mean quality randomness

These discussions about randomness have the tendency to get too philosophical. In practice technical details matter more. For cryptographic or statistical applications you need steady quality.

256 bits of random state that gets slowly updated with few random bits from physical source (thermal or quantum noise), is enough when it's fed into PRNG process that whitens it.

</comment></comment><comment><USER7> Doesn't the Bitcoin blockchain serve as a strong, independent, difficult to manipulate source of entropy that gets published every 10 minutes on average?

Why not just use that?

<comment><USER8> Bitcoin block hashes are _expensive_ to manipulate, but not fundamentally _difficult_ to manipulate. All you need to do is bribe the miners. Let's say you strike a deal with AntPool, which mines about 10% of Bitcoin blocks. If they find a block with favorable entropy, they broadcast it; otherwise, they withhold it, and you compensate them for the missed coinbase. So if you only need to control 1 bit of entropy, you can expect this bit to be available within ~20 blocks, at a cost of one coinbase. Very expensive -- but not difficult.

In essence, the difference between Bitcoin and an aggregate scheme is that in Bitcoin, your control over the entropy is probabilistic and directly proportional to the number of bribed parties, whereas in an aggregate scheme, you have no control whatsoever until you manage to bribe _every_ party, at which point you gain full control.

<comment><USER7> The effect of this can be minimized by pre-comitting to which block will be used for entropy. Then antpool has a 10% chance of mining the relevant block, a (.1*.5=0.05) 5% chance of mining an unwanted bit and discarding it, and then from there the chance that another unwanted bit is found will be close to 50%.

All considered that means antpool has a 2.5-3% chance of flipping an wanted result into a wanted result. At $125,000 per block, that's $4 million of cost per bit manipulated favorably, getting exponentially worse as you need to manipulate more bits.

<comment><USER9> I think that the problem is that if you pick the first block mined after April 1st midnight, and there are two competing blocks, it will be a problem. In the blockchain one of the blocks will win sooner or later and it will be extended with a long enough chain to kill the other block. But the people that would have won the lottery with the other block will be angry.

And remember that the timestamp of the block is oply an approximation. You can use any time you want. I'm not sure if the net reject the block when the time is too off, but you can use a fake delayed time of a few minutes and wait to broadcast it (perhaps mining secretly the next block), or perhaps you can use a fake previous time of a few minutes and blame the delay of the broadcast to a bad connection. (It's mode difficult to do this secretly in a pool.)

The newspaper here make a big fuzz about the first baby of the year, and I always suspected the exact born time in that moment is not reliable.

<comment><USER7> You can solve this problem by picking a specific block height, and not confirming the result until it has at least 6 confirmations.

</comment></comment></comment></comment></comment><comment><USER10> How does this sort of scheme prevent a Sybil attack? Assuming that I generate a "random" pool of people, what's stopping me from controlling a dozen of those with a generator that's predictable to me? (In essence, how is this different than "mixing" a bunch of different sources of random data together?)

<comment><USER11> It's (as far as I can tell) not open to the public in terms of hosting so they don't need to be Sybil resistant.

This doesn't seem to be much more than a fancy way of mixing randomness together (which produces valid randomness if just one source was truly random) and then using BLS signatures on top of that. BLS signatures let you verify the nodes that were involved, and it seems like with how they treshold, they're trying to prevent attacks based on not revealling (ie. the randomness is the aggregated threshold signature of the random data they mixed together).

<comment><USER12> I run one of the drand nodes. Yes, the membership is limited. If someone wanted to join they can by just asking and committing to run a node for the long term. It is not a permissionless system, and so Sybill attacks are not in the threat model.

</comment></comment></comment><comment><USER13> This is a solution looking for a problem that doesn't exist.

For all practical purposes a properly implemented software random number generator provided by the OS is fine. The few corner cases where this isn't the case (mosly early boot entropy problems) appear in situations where you don't yet have Internet connectivity.

<comment><USER14> How do you prove to another party that the data was random, or that you didn't just keep sampling until you got a desired result?

<comment><USER15> I think this is the largest necessity for those truly invested in a truly random performing system.

The truly random system can also provide more sophisticated simulation / effects of said simulation.

Think of trying to programmatically trying to solve unbound equations / millennium problems. Anything involved in testing to deal with chaos would not be accurately represented until a true random is created.

Now what is true random, and does true random exist is a whole other topic of conversation.

</comment></comment></comment><comment><USER16> But is physical reality truly random? :>

<comment><USER17> Quantum theory pretty conclusively shows that it is in fact.

<comment><USER18> Conclusive is a stretch. I personally think that reality has "true-randomness" or, is otherwise not deterministic.

Unfortunately, at least from a philosophical perspective for now, things like Superdeterminism have to be considered. One might come to the conclusion that there are both deterministic models, and randomness models of our universe, and thus the physical laws don't commit one way or the other.

</comment></comment></comment><comment><USER19> Decentralized Randomness should be pretty easy to do

One of the problems with current PKI is weakness in the face of quantum computers, leading to a new crop of algorithms being submitted to NIST, etc.

I wanted to ask whether the following simple scheme, based just on cryptographic hashes, can be used CONFIDENTLY, SECURELY and RELIABLY in many situations where Assymetric Key cryptography is used today, and in many others too, such as providing provably random polling etc. It is very similar to a One Time Pad but uses a cryptographic hash function to generate the OTP codes.

Here is the scheme:

Everyone generates a random private key K[p] and store it just like any assymetric private key (encrypted with some non-stored derived key).

They use any cryptographic hash function that hasn't had a serious preimage attack (perhaps even MD5?), hash it n (eg 10,000,000) times to get h[p][n], and publicly commit to that number. This is like a public key.

The hashes are long enough that it's infeasible to reverse them. Key strengthening can be achieved by jumping a few onion layers between transactions.

If you start running out then you post a new public key, signed with one of your remaining onion layer codes.

Any verifiers store the original public key per participant, and then can replace them with the new public key if it was properly signed by the old one, etc.

Use case: generating provably random numbers by mutually distrusting parties

Participants they gradually reveal their hashes, one onion layer per transaction. Each provably random seed is a function of the alphabetically smallest/largest three of those hashes at the next onion layer. If not all of them reveal the hashes in time, they gossip, verify and agree on which ones are the smallest/largest three before some cutoff point like "most reported that most reported". That leaves tons of bits of entropy coming from everyone!

Use case: Authenticator Apps

The hash h[p][n+1] would be a hash of some substring of h[p][n] with enough bits that finding all chosen preimages (by an eavesdropper of the previous code) would be infeasible in advance. Perhaps 10 alphanumeric characters is enough. Also when displaying the code to enter, the authenticator app can tell the user a number from 1-100 indicating to the verifier how many onion layers to peel, making it harder to precompute the preimages. Or the user would have to enter the entire hash via the network-connected computer scanning a QR code, NFC or something. From a security standpoint, this method seems superior to the HOTP and TOTP schemes used in authenticator apps today, since there is no need to trust the verifier with any secret keys ([https://www.ietf.org/rfc/rfc4226.txt](https://www.ietf.org/rfc/rfc4226.txt)) Also there is no need to sychronize clocks, since the client simply lets the server know how many times to run the hash, and increments that number every time.

Use case: Signing Payloads

Participants reveal a payload and commit to an HMAC signature by using cryptographic key at the next onion level, which at that point would be known only to them. All these signatures are collected into a blockchain block / merkle tree timestamp / similar thing, and it is sent to the participant before they reveal the onion key they used to sign it.

Use case: Off the Record Messaging

The Blockchain or Merkle tree is private between a few parties only, so once the next onion level is revealed, no participant can prove the payload was generated by a given participant, since all the onion hashes were known, any of them could generate a new valid tree with any payload history. They can only prove it to each other, or given enough "witnesses" attest to that tree, people might trust then on the basis of consensus of (presumably) mutually distrusting parties, but that's not the same thing as cryptographic proof. But that is true of any OTR conversation.

Use case: Restoring Access

This can be used instead of Shamir Secret Key sharing. The server would have to store keys for every participant, and M of N participants would just sign that they approve authorization of some new session, some new key, or whatever. These signatures could be easily checked by anyone who has the public keys of the M participants who signed it.

Use case: Decrypting payloads

Not sure how one would do this one, to be honest. With PKI, someone could encrypt a payload that can only be decrypted by a private key holder. I see how to do signatures and HMAC, but not the other way.</comment>


Javascript asynchronous problems - <AUTHOR> http://www.codingjohnson.com/javascript-asynchronous-problems

<comment><USER2> I thought setTimeout was still blocking... Javascript isn't threaded, after all. When you do a setTimeout with a large interval, doesn't it simply keep track of how long it's been since you made the call, and at the appropriate time blocks the current code and runs the function? If so, what difference does using setImmediate/setTimeout(x, 0) make?

<comment><USER3> Timeouts are not checked on every event loop, hence the 4ms delay. And no, setTimeout is asynchronous and processed during the event loop.

Basic event loop is; timeouts, js execution, repaint, reflow, etc

<comment><USER2> What I mean to say is, what's the practical difference between running setImmediate(doSomething) and just calling doSomething() in its place if setImmediate blocks the execution anyway, is there some kind of special use that would make it useful?

<comment><USER3> Yes, render,reflow,timeouts,event handling, etc happens.. You might need to set a CSS property and then animate it. In this case you'll need to wait for a render in between the two steps

Also useful if you need to wait until after all event handlers are executed in the current context

<comment><USER2> Gotcha, thanks for the explanation!

</comment></comment></comment></comment></comment><comment><USER4> that explains my issues with <10ms setTimeouts, thanks!</comment>


The Mozilla Manifesto - <AUTHOR> https://www.mozilla.org/en-US/about/manifesto/ <comment><USER2> Sigh. Looks like Mozilla management hasn't been able to sense the zeitgeist, after their latest downsizing, so let me spell it out for them:

Dear Moz://a management: Everyone is already on board with your ideals of open Internet. What you need to do is get your house in order and focus on your core competency i.e. the web browser and related tooling. You won't get a seat at the table of Internet biggies if you're a has been entity.

<comment><USER3> > Everyone is already on board with your ideals of open Internet.

I don't think that's the case. Increasingly content is being placed in walled gardens which you don't get full access to that content unless you have an account. Google is still pushing AMP. Chrome is becoming the new IE, and sites that 'work best' or only work with Chrome are not uncommon. Those (and many other) factors don't indicate to me that everyone is on board with the ideal of an open Internet.

<comment><USER4> I think most people can (and do) agree with these ideals stated in the abstract, but still do things that violate them in their jobs / real life because of practical considerations such as pursuing a profit.

Not unlike how most people understand the dangers of climate change, but continue to drive cars, fly, use air conditioning etc.

Or, stated another way, we are all hypocrites to some extent.

<comment><USER5> Or, stated yet another way, we all suck at coordinating. It's a problem with our species. If something that requires self-sacrifice starts yielding value only after _everyone_ (or majority) does it, it simply doesn't happen, not spontaneously.

The history of human civilization - of governments, religions and movements, of gangs and corporations and worker unions - can be seen as attempts to surmount our inability to coordinate at scale. Laws, shared beliefs and ideologies, shunning, taboos, money - they're all tools for creating and maintaining coordination in large groups.

A classic essay on that topic: [https://slatestarcodex.com/2014/07/30/meditations-on- moloch/](https://slatestarcodex.com/2014/07/30/meditations-on-moloch/).

</comment></comment></comment></comment><comment><USER6> Does Mozilla even follow their own Manifesto?

> Individuals' security and privacy on the Internet are fundamental and must > not be treated as optional.

So having Google as the default search engine is the right approach for privacy?

> Free and open source software promotes the development of the Internet as a > public resource.

We are still waiting for Pocket's server source code...

> Magnifying the public benefit aspects of the Internet is an important goal, > worthy of time, attention and commitment.

What does that even mean? They stopped at 9 and had no idea how to make it to 10 and ended up with wrapping buzz words into one sentence?

<comment><USER7> > So having Google as the default search engine is the right approach for > privacy?

That's not their entire approach to privacy.

How would you have them exist? There aren't enough people willing to pay for a web browser in 2020. There aren't enough unpaid volunteers to work for free and outcompete Chrome.

What would you have Mozilla do? They're trying to develop other services that can actually make them money so they don't need Google's money to exist, and people here are shitting on them left and right for this.

Could Mozilla be managed _better_? Yes of course. Is there some obvious grand strategy that would save them if only they didn't miss it? No, I don't think so. "Just focus on the browser", say people who haven't paid for a browser since Opera, if ever. Ha.

Mozilla are not in a good strategic position. Public trust and technical expertise are the only major assets they have, and those are not directly monetizable to the tune of $100M. I do hope very much that they figure out how to leverage these assets into more neutral, more grassroots profit streams before the next renewal of google's deal. But let's not demonize them unnecessarily, they have it hard enough as it is.

In web technologies they're the last ones on "our side", pretty much.

<comment><USER8> > What would you have Mozilla do? They're trying to develop other services > that can actually make them money so they don't need Google's money to > exist, and people here are shitting on them left and right for this.

charge businesses for Firefox Enterprise Edition, that way businesses are paying for support and funds development towards Firefox.

<comment><USER9> Do entreprises get charged more for edge or chrome similar business options? Competing with free is hard.

<comment><USER8> Google Chrome Enterprise exists for this purpose [0].

[0] [https://chromeenterprise.google/](https://chromeenterprise.google/)

</comment></comment></comment></comment></comment><comment><USER10> >The Internet is an integral part of modern life—a key component in education, communication, collaboration, business, entertainment and society as a whole.

What if Mozilla had used the internet and hadn't spent their billions on bay- area engineers but on hiring young third-world talents and offered them a job that educated them in web- and browser development?

There could be thousands of engineers working on Firefox and servo with the benefit that they would develop content that would be guaranteed to work on Firefox.

<comment><USER9> Theres also literally a world between bay area and third world.

</comment></comment><comment><USER11> A thread from 2013: [https://news.ycombinator.com/item?id=5770461](https://news.ycombinator.com/item?id=5770461)

</comment><comment><USER12> I think it deserves mentioning that if any individual here believes that what Mozilla does is valuable, either to them selves or to others, and would like to "put money where their mouth is" as it were, then they can do so here: [https://donate.mozilla.org](https://donate.mozilla.org)

I had not thought about donating until these recent layoffs, but have now set a monthly 5$ donation up, as Mozilla's tools and work mean enough to my own interests, as well as being important enough for the internet as a whole, for me to donate.

Sadly the public donations will never be enough to cover their whole operational expenses, but every little bit helps.

<comment><USER13> I really don't think feeding more money to their flagrantly incompetent and greedy management right now is at all the best course of action if you want to see them do well. The absolute best thing you can hope for that the public backlash to their recent decisions is strong enough to manifest a financial incentive for those in charge at moz to reconsider their business strategy. By encouraging others to donate, you're essentially rewarding this behavior and reaffirming that this strategy is financially lucrative for them.

</comment></comment><comment><USER14> As someone who has been running my own personal fork off ff for the past half decade because no way the things i want in (and left out) would get adopted due to the conflict of interests at Mozilla, I see these times a great opportunity for more performant adversive additions (and removals of cruft) into browsers directly vs third party addons or custom hacks people may have to do personally now (spoofing data browsers make available to servers/js, noscript, null routing on the fly, etc).

<comment><USER15> What changes did you make? I've always wanted to nuke the keybindings and change them to Emacs ones, but never mustered the will.

<comment><USER14> Spoofing browser data sampled from existing browsers and past versions that is usually sent in http headers for every request in the nsHttpHandler, removing the home page stuff, compiling out telemetry stuff, disableing stuff in CanvasRenderingContext2D, removed some css url stuff in servo url.rs.

</comment></comment></comment><comment><USER16> Seems like open expression is an important requirement of an open internet.

Not sure if that's in one of the 10 or not there because it conflicts with their ad revenue (ie, open expression doesn't mesh with ads), or conflicts with authoritarian regimes (eg, Great Firewall of China), or conflicts with "language is violence" or conflicts with "nudity offends me" or something else.

It seems like one of the big things at risk now is the ability of the internet to allow direct connections between people without intermediaries. I feel like standards bodies kind of help with this (ie, protocols over platforms).

</comment><comment><USER17> How does partnering with Pocket promote the open web? How does the iRobot stunt align with the manifesto?

Mozilla use to live and breath the open web, now they are just empty platitudes like Facebook and Google's commitment to privacy.

<comment><USER18> > iRobot stunt

You mean _Mr_ Robot, right?

<comment><USER17> I do, thanks for correcting me.

</comment></comment></comment><comment><USER19> I _want_ to use Firefox, and Mozilla's kit but every single time I've come onboard after watching improvements etc I get shafted by updates which change major things every few weeks, this is mostly around Firefox having constantly had a different URL bar every update and them removing the ability to search for preferences in my preference list. It feels like they are fighting my ability to make Firefox exactly how I want it and that results in me going to a better take-it-how-you-get-it browser: Chromium.

It's a shame but I don't see it being any better the next time I inevitably try.

<comment><USER20> >removing the ability to search for preferences in my preference list

They did what? _frantically clicks Hamburger - > Options_, which opened about:preferences, "Find in Options" is top and center. Firefox 79, Windows 10.

<comment><USER19> I meant `about:config` but regardless I stand corrected, it's back! Yes!

</comment></comment></comment><comment><USER4> If there are any Mozillians here, I'm curious about how the organization balances its technology development and advocacy functions. Do you think it has been shifting one way or another? Do you think that both roles are represented equally in leadership?

</comment><comment><USER21> I don't get it. Is Mozilla a Neo-Marxist organization now?

Why don't you talk about software development instead? About building FireFox? About disrupting tech?

It seems Mozilla is now run by people more interested into communism than actually building a fucking software and bringing value to the world. RIP Mozilla.

<comment><USER22> Were you under the impression that mozilla wasn't ideologically driven previously? Hell look at the imagery of some of their early logos. [https://www.jwz.org/blog/2016/10/they-live-and-the-secret- hi...](https://www.jwz.org/blog/2016/10/they-live-and-the-secret-history-of- the-mozilla-logo/)

Not to mention that this document is pretty old.

I think the main difference is it feels a lot less authentic now. Less grassroots and more a corporate-ish attempt to appeal to the masses.

</comment></comment><comment><USER23> What is "Fræðast meira"?

<comment><USER24> This is the Icelandic page. English version here: [https://www.mozilla.org/en- US/about/manifesto/](https://www.mozilla.org/en-US/about/manifesto/)

</comment></comment><comment><USER25> I wonder if #8 is the issue here

</comment><comment><USER26> English language version: [https://www.mozilla.org/en- US/about/manifesto/](https://www.mozilla.org/en-US/about/manifesto/)

<comment><USER11> Ok, we'll change to that from [https://www.mozilla.org/is/about/manifesto/](https://www.mozilla.org/is/about/manifesto/). Thanks! Strange!

</comment></comment><comment><USER27> is it time to jump ship from mozilla????????????

</comment><comment><USER28> The Mozilla Manifesto is very weird when you consider the context. Mozilla as we know it exists solely because Google needs a shield against antitrust investigations, and having a "competitor" browser that only takes 5% of the browser market is why Google pays Mozilla the majority of its revenue. Firefox is literally sponsored by Chrome.

<comment><USER29> I don't know if you heard the news but they just stopped. Also Mozilla existed quite a while before Chrome.

<comment><USER30> Renewed: [https://www.theregister.com/2020/08/14/mozilla_google_search...](https://www.theregister.com/2020/08/14/mozilla_google_search/)

<comment><USER31> Collect the $500M ad money and then turn around and claim Google is evil and they are the only company fighting for internet freedom and world peace.

</comment></comment></comment></comment><comment><USER32> Has the op posted the Icelandic version to get it here as a new post and to make a point?

Look, I'm saddened by the layoffs too. And I'm very sad the dev tools and servo teams teams in particular have been hit. And I would like to know why.

Yet there are still 750 mozilla employees. The servo stuff was merged into ff already. I'm not saying it's good that they've scaled down their R&D but the narrative that the C-suite have laid everyone off so they can drink more champagne on one more yacht gets tiring and obscures reasoned discussion about the lay offs.

<comment><USER33> > The servo stuff was merged into ff already.

Really? The project was done? That is at odds to what nearly every person I follow involved with the project has had to say recently.

<comment><USER34> It's not. Just look at outstanding issues in Servo.

[https://github.com/servo/servo](https://github.com/servo/servo)

What Mozilla did was move few stable components to FireFox and shitcanned the rest.</comment></comment></comment>


Germans Lose Faith in the Fourth Estate - <AUTHOR> http://www.spiegel.de/international/germany/most-germans-think-the-press-is-lying-to-them-about-refugees-a-1079049.html <comment><USER2> It is true. The media passes a contrasting view of Germany where a large majority of the population is welcoming illegal immigrants and that this flux of people are largely of Syrian origin, which is not the case.

The situation in Cologne was not isolated to that specific day nor city, but the media portrayed the event as such. And only reported this event after the police department manifested their disapproval for the silencing attempts.

Not even public media such as Facebook are safe to share information. It is a hate crime in Germany to participate/comment on such events or display disapproval on any ethnic group.</comment>


The Trials of J. Robert Oppenheimer - <AUTHOR> http://www.pbs.org/wgbh/americanexperience/oppenheimer/

<comment><AUTHOR> If you want more, there's also the fairly recent biography "American Prometheus" (which won a Pulitzer).</comment>


Thanks HN: Developers and YC companies video speed interview for free 1/11 - <AUTHOR> http://blog.hirelite.com/thanks-hn-developers-and-yc-companies-video-s

<comment><USER2> I don't need to hire anyone currently, and I'm not looking for a job, but if your goal is to put technical recruiters and headhunters out of business, I support you 100%.

<comment><AUTHOR> Thanks! When companies work with recruiters, at best they get an introduction to a good candidate, at worst they get a severe distraction and brand damage. For the best case, the whole transaction is overvalued: Companies pay headhunters 20%-30% of the candidate's first year salary if the candidate is hired.

<comment><USER2> Exactly. And speaking as a developer, I've not once had a positive experience with a recruiter. Not a single time.

</comment></comment></comment><comment><USER3> Whitelabel - do it now.

This would be an easy sale to large companies, HR SaaS apps and especially the gambit of job search sites (Monster, etc). The job search sites can instantly turn this into an up sell.

I want this. I'm in Toronto. If you don't whitelabel, I may never be able to use this :)

<comment><AUTHOR> We're definitely considering white-labeling. One issue we're seeing consistently is that, at least for development jobs, companies are having a much harder time sourcing candidates than screening them. As we move in to other career areas, that will likely change.

How is the demand for software jobs in Toronto?

<comment><USER3> There is a good amount of demand for software jobs in T.O. Between the GTA, Waterloo and Ottawa, we're seeing a good surge of tech in Ontario centered around Toronto. It's got to the point in the past few months where finding available, good folks is touch-and-go.

However, I wouldn't limit your scope to development jobs. This sort of "chat roulette" for pre-screening is a very powerful idea.

Personally, I'd be focusing on the restaurant industry if this was my baby. They spend countless dollars on HR and if there was a way for an assistant manager to sit in an office to pre-screen for real interviews... it would be on fire. Restaurant chain owners are also very willing to spend money on technology like this. I don't think that you'd have a hard time finding low rate, non-intrusive funding from a small group of them to get the entire whitelabel thing off the ground in a hurry.

</comment></comment></comment><comment><USER4> Love this concept. You should do some for college students looking for internships for this summer.

<comment><AUTHOR> Great point about internships - will keep that in mind.

</comment></comment><comment><USER5> Cool idea. I wonder what percentage of the companies participating are willing to look at telecommuting for highly qualified candidates?

<comment><AUTHOR> Few. At every event we have 20 companies. Typically, 3-4 will consider telecommuting candidates seriously. We're considering hosting a remote-focused event within the next few months, but finding enough companies that are comfortable with a remote relationship is tough (not impossible though). In your experience, how do you go about finding companies that are comfortable with telecommuting?

<comment><USER5> Good question. I don't currently have a well defined strategy for finding these companies, hence my interest in HireLite. :)

I typically do short and medium term consulting projects, and telecommuting hasn't been much of an issue so far, particularly after demonstrating my abilities.

But, people seem to have a different attitude with full time employment where things aren't as clearly defined vs. shorter term projects.

Does the HireLite system currently filter by Remote vs Local candidates? I'd like to participate in the upcoming event, but I wouldn't want to waste any one's time if they are rejecting 100% of remote candidates.

<comment><AUTHOR> Hirelite doesn't currently filter remote vs locale candidates, but it's something we're working on.</comment></comment></comment></comment>


I.R.S. Will No Longer Force Kochs and Other Groups to Disclose Donors - <AUTHOR> https://www.nytimes.com/2018/07/17/us/politics/irs-will-no-longer-force-kochs-and-other-groups-to-disclose-donors.html <comment><USER2> I think the title is a little loaded. I give to a lot of groups, I don't want my name on a list that the government or the public can get their hands on. Imagine if during the civil rights era, people who gave money to anti- segregation organizations risk having their names made public just because they donated? Pick a cause. Donor information should be confidential because it's no one's business where the money is going. Whether you're warren Buffett, Michael Moore or anybody

<comment><USER3> I strongly disagree that it's no one's business where that money is going. That money is used to influence public policy, which can have a very real effect on me and my life. I think it should be very public knowledge that, a group that is advocating against climate change, for instance, be required to disclose that all of it's major donors are members of the oil and gas industry.

I think this idea of unlimited dark money coming into our elections to influence policy is absolutely terrifying, and without knowing who is giving the money, combating the influence of these groups is much, much more difficult.

<comment><USER2> Every time you give to MoveOn.org or similar organizations, that money is doing the exact same thing. Let's turn this around for a moment. That donation you gave to the ACLU, or Black Lives Matter... If it's public, or in a way that can be made public, then as an employer I can use that to disqualify you from a job. As an apartment complex, I can find subtle ways to dissuade you from living there, such as a higher rent, or other fees. I can use my political bias against you, just because you gave to a group I don't like. If I can do that, why can't you do that to me?

By keeping donor information private, no one can weaponize that information, and no one can use it to discriminate. Do we really want people harassing one another in public, or worse, for whom they give to? Who I support, who I give money to, is no ones business but mine, and the organization I give it to, because at the end of the day I don't want you to harass me, and come after me because you disagree.

<comment><USER3> First of all, I wholeheartedly reject the idea that giving to a civil rights organization should be treated the same as giving to an organization meant to downplay climate change.

Second, without the information that large, rich people and organizations are the ones behind these groups, their message changes. And again, it is not "no one's business but yours," because those things that you are advocating for affect me. Those laws you're fighting to enact or repeal affect me. So no, it is not just your business.

<comment><USER2> /First of all, I wholeheartedly reject the idea that giving to a civil rights organization should be treated the same as giving to an organization meant to downplay climate change./

Only because YOU believe it. Others don't agree with you, and therein lies the problem: You wish to weaponize data against people because you disagree with them. You're taking this much too personally, which signals that you have an emotional fixation on a specific ideology, or position, and anger at those who you disagree with. That's not how a democracy works.

<comment><USER3> No, because it is correct. I do not buy for one single second this idea that all opinions are equally valid and equally deserving. That is patently false, and I will not fall into the trap of false equivalence.

</comment></comment></comment></comment></comment></comment><comment><USER4> It seems from the public's perspective, the only piece of information that will no longer available is how many donors there are and at what amount. The public was never getting a donor list except in unauthorized disclosures.

The article also does not state why the IRS would need to know who the donor is?

Can someone shed some light here?

</comment><comment><USER5> By investing even more money in politics, rich people are making it so dysfunctional that the system will all come crashing down. At this point, we're so close that whatever moderate reform could be pushed through would just allow the current system to limp along as is for decades. Therefore, I like that we are accelerating the decline by opening the money gates up even more:

</comment><comment><USER3> This is a terrible, terrible decision. Knowing who's behind these groups is one of the only rays of sunshine that can be used to show a group's real motives. Not being able to tell where the money comes is going to make dark money have even more of an impact in our elections, and give the very wealthy even more control.

<comment><USER6> The only issue I see is money laundering. Under the First Amendment I could care less if Warren Buffett slaps a few billion down on a campaign. What I do care about is quid pro quo using donations to launder money into the coffers of purported campaign contractors.

<comment><USER3> See, I completely disagree. I don't believe the first amendment means that money is speech, nor that a rich person is entitled to more speech than anyone else.

</comment></comment></comment><comment><USER7> > "Americans shouldn't be required to send the I.R.S. information that it > doesn't need to effectively enforce our tax laws, and the I.R.S. simply does > not need tax returns with donor names and addresses to do its job in this > area," Steven Mnuchin, the Treasury secretary, said in a statement on Monday > evening.

In light of the Trump Foundation charity shenanigans, is this even remotely true?

<comment><USER3> Hell, in light of the factory that the NRA was caught colluding with a Russian National, it's very much not true.</comment></comment>


Antipattern.io: Every Code Review Is an Opportunity to Learn and Teach - <AUTHOR> http://Antipattern.io

<comment><AUTHOR> Code reviews are where the rubber really hits the road. They are a bit scary, can lead to arguements, but at the end of the day they are really the only way to learn and teach coding at a professionally competent level.

I know there are many edge cases out there who will chafe at that statement, but tell me a better way? Books? Clubs? Schooling & Code Camps? Nuh uh. I've done them all, and nothing beats code reviews for teaching and learning.

<comment><USER2> > [...] they are really the _only_ way [...]

> [...] but tell me a _better_ way?

There you go with your claim's inconsistency (emphasis mine).

And how do you explain how professional competency appeared in our industry _at all_ , if it's _the only_ way?

<comment><AUTHOR> I'm using fightin' words, not logical reasoning. Intersparse all of what I'm saying with IMNSHO. I'm looking for a discussion on the matter.

I have spoken to, interviewed, and worked with many, many software developers. I've never met one who was good at what they did, and did not participate in code reviews. Not one.

<comment><USER2> I take it's easier in your environment to get code reviews than it is in mine. I'm yet to land somewhere where code reviews are a casual thing.

But have you considered that it may be the opposite than your claim? That good developers want code reviews because they're good, not that they're good because they learned most from code reviews?

Because despite that I don't know many people with much experience with reviews, I do know some good developers. Where did they come if code review is the only way to learn much?</comment></comment></comment></comment>


Ask HN: factors to consider in taking job offers - <AUTHOR>

What factors do you take into account in accepting a job? Obviously the compensation and the benefits, but what else? <comment><USER2> 1\. I make sure the job description is inline with what I want to do. I also make sure it's documented in case 2 months into your new job your boss decides you need to focus on something else and you end up pigeon holed into something you don't want to do. 2\. Make sure there is a solid career path that could help you grow within the organization. Ask the employer to highlight such a path for you. 3\. Compensation, benefits, stock options, bonuses, etc. Make sure this is all clearly documented in the offer letter. If they say no to documenting it they will most likely end up not giving it to you once you are on board. 4\. Make sure you clearly understand the company's strategy, growth plan and financials. You don't want to get into a place that will end up on it face a year later. Many times it's easy to spot such companies with simple research. If their strategy doesn't agree with you, you will end up frustrated very quickly. 5\. I usually also do research on the products being sold and try to understand how I can personally add value to make these products more successful. This helps me determine if I will enjoy working on them or if I would be bored. Companies strategy might be good but if the current products are blah you'll be bored quickly and might not have the patience to wait for the strategy to unfold.

<comment><USER3> You should use an extra line break between paragraphs in order to avoid wall- of-text mode.

</comment></comment><comment><USER4> 0\. Are they honest? (See #1).

1\. Is the person I'll directly report to a jerk or the like (unfortunate when this person changes soon after you start...).

2\. Private office with a door that I can close (if my productivity isn't important to them ... that's a _bad_ sign. If they don't even realize the significance of this, e.g. of flow, even worse).

2\. b: The office also has to be warm enough; I've had to quit two jobs because there was very cold air pouring down on me and that triggered an inevitable sinus infection. They didn't listen before the latter happened and didn't care much or at all after. In general, make sure the physical environment is tolerable for you and that they care about this sort of thing.

3\. EMACS is non-negotiable, although that's never been a problem.

After that, the usual stuff, much of which is already well covered in other responses.

</comment><comment><USER5> I am a freelancer, but this is what I take into account:

* Can I work for or with a person that can teach me something new? (Hey Marc, thanks!)

* Possibility to travel?

* Is my team cool?

* Is there a challenge? Am I forced to learn something new?

* Is the project/business at least somehow sane?

* Am I free about the where and when, as long as it gets done?

* Will I be able to get some shares?

more on a technical level:

* Do they follow best practices like version control or automated testing/builds?

* Am I free to choose my tools?

* How high is the wtf-rate when reading existing code? Or better: Do I want to spend the next x weeks digging into this? (Hint for rails coders: Do a 'rake stats'.)

Hope you will find your dream job soon. All the best.</comment>