Dealing with Timezones in Python  - <AUTHOR> http://lucumr.pocoo.org/2011/7/15/eppur-si-muove/ <comment><USER2> a few more gotcha's:

* when storing a UTC timestamp and you need to get a datetime object back in order to add dates or do some calcualtions, make sure you use datetime.datetime.utcfromtimestamp(), eg.

        >>> datetime.datetime.utcfromtimestamp(1310727758.472)
        datetime.datetime(2011, 7, 15, 11, 2, 38, 472000)

* python timestamps are longs and represent time in seconds. in Javascript it is the number of milliseconds since epoch, so you need to divide/multiple by 1000 depending on which way you are going. for eg.

        > new Date().valueOf()
        1310728084389

        >>> datetime.datetime.utcfromtimestamp(1310728084389)
        Traceback (most recent call last):
          File "<stdin>", line 1, in <module>
        ValueError: year is out of range
        >>> datetime.datetime.utcfromtimestamp(1310728084389 / 1000)
        datetime.datetime(2011, 7, 15, 11, 8, 4)

* always set your server to UTC, always use the utc* functions (eg. utctimetuple, utcfromtimestamp, utctime etc.), store as a long, and when passing back to the client send the current UTC timestamp as well rather than relying on the client system clock, which is frequently wrong. You can also use:

<http://json-time.appspot.com/time.json?tz=UTC>

or implement something similar. I resorted to always outputting the current UTC time into a javascript variable and using that to calibrate the local computer time (again, never trusting client time)

* never use time.time() to get a timestamp back because it will munge the value and re-add tz info

* in Javascript, to go from your server-provided UTC timestamp to a local date object that you can then work with, use:

        > new Date(1310728084 * 1000).toUTCString()
        "Fri, 15 Jul 2011 11:08:04 GMT"

* If you are providing an API or a feed, please include a UTC timestamp in the output - parsing all the different date formats and timestamp info and attempting to work out when something happen (such as when a post was published) is a real pain in the ass. store the timezone in a sep field called 'utc_offset' or similar

<comment><USER3> > * never use time.time() to get a timestamp back because it will munge the > value and re-add tz info

Not sure I understand this one. I though time.time() returned the seconds since Epoch?

<comment><USER2> it does, but it assumes that the timestamp you are giving it is from your current timezone. compare:

        >>> time.mktime(datetime.datetime.now().utctimetuple())
        1310737652.0
        >>> int(datetime.datetime.utcnow().strftime('%s'))
        1310701659

my local timezone is +10, and mktime is adding it back in, hence why I always use strftime

</comment></comment></comment><comment><USER4> So I've been coding for about a year and a half now and had to learn all this the hard way. Which isn't a bad thing at all.

It's little stuff like this that really makes it true that you should try to build an app or two like a blog-n-whatnot so that one's ignorance of these issues can be exposed.

<comment><USER5> To be fair, even a lot of experienced programmers are tripped up by these issues.

</comment></comment><comment><USER6> Another good time read is "Time, What Every Programmer Should Know" (<http://unix4lyfe.org/time/>) -- in short, it's usually best to store time/dates as Unix time (it's UTC and a single number).

<comment><USER7> Storing time as Unix timestamps is often not possible. Often you need to be able to answer questions like "did this moment fall on a weekday?", "what day was it 3 hours after that moment" and so on.

My rule is to either work with integer Unix timestamps or timezone-aware datetime objects. A naive datetime object is, well, naive. If it's the number of seconds since the Epoch, represent it as a number, not an object.

<comment><USER6> You can convert unix time to whatever format you want.

<comment><USER7> But you frequently need to store the original timezone, to be able to do date calculations after storing it.

For instance, a user added an appointment and her timezone is America/Los_Angeles. Then she moved to China and changed her timezone in your app to Asia/Shanghai. Then you run analytics to see how many users had had appointments on weekdays.

When storing date information in persistent stores (like databases), it's always advisable to store the time and the timezone.

<comment><USER8> Even in that situation it's a terrible idea to store local time alone. In the calendar situation (which is the exception not the rule!) I personally would store the time in UTC, in local time _and_ the name of the country separated. I would not store the local time alone because what do you show in the calendar if you are in a different country?

If the assumption is that the problem is a theoretical one because nobody has appointments in the middle of the night when DST changes come, I present you with sysadmins, rescue workers and other people that do have these things scheduled at odd times.

I know that around DST changes many people explicitly not work over night to avoid these issues. Same with year changes and other situations where computing and time does not work properly. For instance overnight trains in Europe just wait for an hour and do nothing.

<comment><USER7> You store the local time and timezone. You show the value in whatever timezone the user configured the application.

If you store only Unix time, you don't have enough information. If you store both the Unix timestamp, the local time and the timezone, you have too much information. You can derive Unix time from local time and the timezone.

Ergo: store time with time zone.

<comment><USER8> > You store the local time and timezone. You show the value in whatever > timezone the user configured the application.

Because local time is ambiguous. During DST changes local time can mean that it happens twice. Your calendar would have to show 4 AM twice for instance and if you want to make an appointment there you would have to select which one you actually mean, thus UTC + local time.

But granted, it does not happen often that people schedule appointments during DST switches, but certain professions have to so certain people already have to live with that.

> If you store both the Unix timestamp, the local time and the timezone, you > have too much information.

Nope. That is incorrect. If I store local time only + timezone and someone sets a date during that transition window it's ambiguous. If I store the date in UTC only and remember the timezone that date was intended for I will not be able to account for changes in the timezone. For instance the legislation of the country could deactivate or change DST settings (which is not uncommon). In that case the timezone information of my operating system will change again and my appointment will move without my consent.

If I store both I can see if they are still in sync and if not, prefer the local time and rebase as necessary.

<comment><USER7> Oh, I see what you're referring to.

Yes, storing the local time and the timezone is not exactly what's enough, all that time I was thinking about the PostgreSQL timestamp with time zone type, which is preferable to use vs storing the Unix timestamp.

I guess we've been talking past each other, with me being the main culpable :)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I'm just bitten by this today: I was trying to get the time zone offset in Python to print the local time for an app.

Doing

        date +%z

in console gives me correct offset

        +0800

of China (we do not have DST anymore) while doing

        import time
        time.strftime('%z', time.localtime())

gives me

       +0706

WTF??!!! I can understand Python might not be able to get the correct timezone info from the system, but giving this kind of obviously incorrect offset is just dumb. Still searching for a solution other than manually configure Python code. If anyone knows why, I would be really glad for your help. Thanks in advance!

<comment><USER7> Use pytz.

      import pytz
      from datetime import datetime

      tz = pytz.timezone('Asia/Shanghai')
      tz.normalize(pytz.utc.localize(datetime.utcnow()).astimezone(tz))

<comment><USER9> Thanks for the response! I'm looking for a solution such that Python will go and load system's time zone and use that---it's a nightmare to deploy an app to multiple severs located in different timezone and I have to change the timezone in Python manually.

</comment></comment></comment><comment><USER10> I'd just like to point out in reference to his Galileo quote that there would still be a need for time zones even if the sun revolved around the earth.

</comment><comment><USER11> In Fantom we model DateTimes with both an absolute time in nanosecond ticks and a relative timezone:

<http://fantom.org/doc/docLang/DateTime.html#dateTime>

Works great for dealing with timestamps in absolute terms, but also when you need to deal with local time.

</comment><comment><USER12> I have never heard any convincing argument (other than "we're already doing it") to use timezones or DSTs in the modern world. Can someone offer some articles or arguments?</comment>


Ask HN: Problem finding/choosing an idea to work on - <AUTHOR>

TL;DR: Bad at coming up with startup ideas, or possibly just think about them too critically and don't pursue them. Advice?
To give context: I'm 17 and just started college (web dev. with design degree). Got my first computer at 13. Have been interested in startups and designing/coding for a couple of years. Had a job at a web dev. company in Summer '09. They offered me a full-time job as a front-end designer for when I finished high school (Summer '10), but I gracefully declined as I wanted to pursue my own projects and go to college. Debated about going to college and eventually decided to go for the networking aspect - and since my country has a free educational system, it's not as if going would put me in debt like in the US.
But I have this ongoing problem. At first, I just thought I was bad at generating good startups ideas, but now I'm starting to think maybe the problem is over-thinking any ideas I have to the point where I can't see them succeeding. I have several (somewhat niche) ideas which I know I could turn into high-profit lifestyle businesses, but I want to go for something a little bigger than lifestyle since I'm prepared to put every second I have into it. Also because I have no family to support and don't need immediate income.
In the meantime I've just been improving my coding and learning more so I'm not exactly wasting time, but I'd like to get started on a real project with good potential.
Is this a common problem? I'd be hugely thankful if anybody could give some advice. <comment><USER2> I have 3 things to tell you.

1) Consider taking another path on your college education. Web Dev curricula is awful almost everywhere, and borderline regular in the few places where it's not bad. Study business, engineering, design, computer science, etc. Universities just can't keep up with the advances in this sector right now, and the knowledge of managing a business, learning the aspects of graphic design and usability, or learning how to program in C (or Java, or Python, or whatever) will all have a bigger impact in your abilities than the curricula in a Web Dev degree. I'd also argue that for networking those degrees are better suited to put you in contact with the people you want to come in contact with.

I was hiring for the company I work for a few months ago, and to be honest, the only reason I interviewed 3 people with a "Web Dev" degree (2 where actually university certifications though) was because I had to fill a quota of people interviewed. Those 3 people totally failed the simple tests I had for them. Badly. I honestly believe this degree is actually frowned upon in the industry (don't take my word for it though, it might be a regional thing)

2) Consider that since you don't have any ideas yet, why not go on board at someone else's startup and get some experience. Hell you could even do so while you go to college.

3) The best way to come up with a great idea, is to scratch your own itch. What part of your life do you think is lacking that could be solved or improved on with a web app? Trust me, it seems hard at first, but with time you'll realize that there is lots to improve on.

<comment><AUTHOR> Thanks for the reply.

1) For what it's worth, the web dev part of the course was given a complete overhaul to bring it to more of an industry standard this year, and 50% of the course is now design. I intended to study business but a massive amount of the curriculum (in this country anyway) would be of little use to me. I've had business as a subject for the last 5 years and found the syllabus to be appallingly orientated towards only management - there was literally just a chapter on entrepreneurial activity. I also considered CS, but there's a lot on the curriculum that doesn't really interest me, and since I'm certain I want to specialize in web/design I thought I'd be more interested in this course. Java is actually one of the languages on this web dev degree. As for networking, I've joined clubs and societies to network with people from these other departments.

2) I would definitely take that into consideration. Unfortunately there's little to no startup culture where I am, but I'm working on it.

3) I've heard that many times, but so far haven't found many personal itches. However I constantly get feedback from other people about their own itches and see what I could improve on there.

</comment></comment><comment><USER3> You are 17, have 3 months of work experience as a web developer, have more balls than brains, and you want to hit a home run right of the gate.

Take one of your niche ideas, build it, launch it, earn. Then once you finish that try to swing for the fences.

How long do you think it's going to take? The answer is always longer than you think, so get that lesson out of the way.

<comment><AUTHOR> Thanks for the reply. I'm not sure if my post seemed to indicate I only have 3 months coding experience, but I've been coding for almost 2 years. I'm about to do exactly what you're suggesting with the niche ideas, but just thought I'd ask here first. There's a good chance I'll have to work on it longer than expected, but that's one of the reasons I want to have a great idea I'm passionate about.

<comment><USER4> Don't hold out on getting experience because you're waiting for passion. (If this is starting to sound like dating advice, my sincere apologies!)

</comment></comment></comment><comment><USER5> Ok, I'm ten years older, I'll give some advice.

You're 17, you're just _starting_ to get good at stuff, so don't sweat it so much. I think the best thing to do is take on an interesting, challenging project that has _some_ potential to become a product, but will definitely push you to learn.

Hell, copy someone else's idea. As you work on it, you'll probably figure out something they aren't doing, or find a product that rests between the competition. For now, becoming a great hacker is more important than having a winning idea, because if you do it in the reverse order, you may not be able to implement said idea...

<comment><AUTHOR> Thanks for the reply.

That's pretty much my train of thought, but I just want to maximize the potential.

Great point about figuring out something the competition aren't doing. And I understand about becoming a great hacker, that's why I haven't stopped learning despite not having solid project ideas.

</comment></comment><comment><USER6> What you're explaining is pretty normal. It's also a GOOD thing. The worst thing you can do is start on a project the moment you think of it. It's like the honeymoon period of a relationship, everything looks great, then you hit reality.

A really good idea you'll get to those problems and still be passionate enough about the idea to resolve them. If you can get past THAT point, that's when you start working. But you need to put effort into resolving the issues first. If you're giving up before then it's because you're either lazy (sorry!) or not that keen on the idea.

You may also need to reassess your expectation of success. I doubt anybody here has had an idea which they 100% knew was going to allow them to retire at 17. Most of the time you have something you think "could" work, or "might be cool". If you can live of your projects, that's a good place to start.

<comment><AUTHOR> Thanks for the reply.

That's reassuring to hear. I highly expect it's less about laziness and more about not being keen on the idea!

My expectation of success isn't really retiring at 17. It's just not having to work for some big corporation when leaving college. Hell, if I had a few million in the bank already I'm pretty sure I'd still want to work on startups. The money would just be good security and also help fund projects.

</comment></comment><comment><USER7> I wouldn't say this problem is common, but it's not rare among developers or entrepreneurs either. I would say a couple things:

1) don't rush anything. At some point you'll create some beautiful ideas in your head which you just can't contain - you'll feel the urge to rush at your computer and stay up coding all night long. THIS is normal. I'm pretty sure this has happened to most every developer early on in their career (I still get this and I've been coding for well over 3ish years now)

2) if you really can't sit idly by while you finalize your ideas, try programming familiar applications which you enjoy. Friends of mine have cloned scripts similar to Digg, Twitter, Wordpress... it's fun and you build a lot of project experience.

<comment><AUTHOR> Thanks for the reply. In response to point 2, that's actually exactly what I've been doing (making a Flickr clone), and have found it to be a great idea.

</comment></comment><comment><USER8> It's not that you are over thinking them. You are just giving up too early. Let's say there are two girls. You go on a first date with one and you see all the potential. By the time you're on your 67th date, there are a lot of flaws you've discovered. That's how projects work.

Each hour you spend thinking about it or working on it is like another date. The more dates you go on the uglier she gets, but also the richer the experience. Pick a project and just stick with it. The reason why your other ideas look so much better is because you haven't ever gone on a date with them yet.

<comment><AUTHOR> Thanks for the reply.

Ha, that's an interesting analogy! Will take it into account and sample all the ladies.

</comment></comment><comment><USER9> You get really good ideas by learning a lot and cross referencing little groups of knowledge. My advice would be to build something solved already (for example a voting based photo site, maybe with tags) while you learn, learn, learn. You won't come up with any good finance/law/science/whatever related startups if you're not immersed with the material.

Also, now that you are in college I recommend taking 5 or 10 hours a term figuring out how to maximize your marks per course given the least amount of work/inputs. Highest time ROI you will ever come by.

<comment><AUTHOR> Thanks for the reply.

Great point about the cross-referencing, will take it into account.

</comment></comment><comment><USER10> Not sure how much this is worth, I only recently discovered Hacker News (and am 17 also), but if you're having trouble coming up with ideas, it's probably best to find a co-founder who is really good at coming up with ideas....

One of the most common things you here from successful "entrepreneurs" is that they have an overflow of ideas and not enough time to work on all of them.

<comment><USER4> Don't get a co-founder because they are "really good with coming up with ideas", that is not a good idea. (pun intended)

<comment><USER11> Do get a co-founder who is good at coming up with customers/revenue if you don't want to do that side.

</comment></comment></comment><comment><USER12> So let me get this straight... You declined the job to pursue your own projects, while concurrently thinking you were "bad at generating good startup ideas"? I might have missed something in there, because that doesn't make a whole lot of sense. You must have had some idea of what projects you wanted to pursue when you declined the job, right?

<comment><AUTHOR> Well I mostly declined it because of choosing college instead, but yes I did and still do have an idea of the projects to pursue.

</comment></comment><comment><USER13> Don't rush. You have a lot of time to figure it out. Just pick one idea you have now, try to launch it, learn something along the way, if it is not going to work out, move on. Sometimes I regret that at your age, I am too hungry to be success early, and that really doesn't help much.

<comment><AUTHOR> Thanks for the reply.

I'm far from rushing at the moment. Launching one of the ideas is exactly what I intend to do, especially after this thread.

</comment></comment><comment><USER14> It's not about the idea dude. No matter how much you believe otherwise. It's about solving a problem and solving it well. And making money while doing it.

Best will be to work with a startup, colleges are no good when it comes to WebDev/Design.

<comment><AUTHOR> Thanks for the reply.

Yeah I'm trying to discover said problems in any way possible. Possibly could with a startup but there's very few anywhere here, especially in web/tech. College seemed like the best way to network, and I don't mind having it for a fall-back plan since it's free.

</comment></comment><comment><USER4> Your hunch that you're overthinking: probably right.

Advice: build experience by actually doing stuff.

ps: if you're not going to build your profitable niche ideas, mind sharing them?

<comment><AUTHOR> Thanks for the reply. Don't really wish to immediately post the ideas, however I may post some of them in a new thread soon to get feedback as I don't believe in hiding them worrying if they'll be stolen. Stay tuned.

</comment></comment><comment><USER15> I like your thinking- you should trust it.

Select a HUGE market that interests you and do something disruptive. Your youth, resources, and lack of risk make the timing perfect.

</comment><comment><USER16> 999 business ideas:

<http://www.sixmonthmba.com/2009/02/999ideas.html>

<comment><AUTHOR> Thanks for that, some are a little out of my area but I'll read every last one.</comment></comment>


Cheap financial freedom - <AUTHOR> http://www.thewavemag.com/pagegen.php?pagename=article&articleid=21827

<comment><AUTHOR> Last time YC News was polled, most said they wanted to become rich in order to be financially independent.

This assumes a Western cost of living. This article describes how you can be financially independent much more cheaply by living overseas.

Say you saved up $100,000. If you then stick it all in a high interest savings account: [http://www.getrichslowly.org/blog/2007/03/21/which-online- hi...](http://www.getrichslowly.org/blog/2007/03/21/which-online-high-yield- savings-account-is-best/) you can withdraw about $325 a month from interest alone, which is more than enough to live in some overseas countries.

So, if you are interested in retiring early, and don't have expensive tastes, this is a route to consider. Here's someone who did it, and lives on $319 a month: <http://www.escapeartist.com/efam29/book.html>

Even if you don't want to get away from it all right now, it is good to know you can. It takes the pressure away from life.

<comment><AUTHOR> An important consideration brought up in another thread is the overseas country's rate of increase in cost of living.

<comment><USER2> Also if you want good internet and electricity the cost of living seems to bump up to around 1000$ a month in most of my research.

Certainly still doable. I think it is safer in a country that allows foreigners to work easily. That way you can always find odd jobs to supplement your income when needed.

<comment><AUTHOR> I can understand the good internet connection cost, but don't most countries have a dependable source of electricity?</comment></comment></comment></comment>


No link between immigration and increased crime, four decades of evidence finds - <AUTHOR> http://sciencebulletin.org/archives/10334.html <comment><USER2> Word-for-word blogspam of

[http://www.buffalo.edu/news/releases/2017/02/020.html](http://www.buffalo.edu/news/releases/2017/02/020.html)

</comment><comment><USER3> <_kr4m3r> so many fucking criminals, its bullshit

<foniks`> heh, if we sent all the criminals to some empty continent and just left them there to die

<foniks`> and showed up like 50yrs later like, "sup?"

<foniks`> whatd u think they'd say?

<FoSZoR[bg]> something along the lines of, "G`Day mate"

[0] [http://web.archive.org/web/20160521082904/http://www.bash.or...](http://web.archive.org/web/20160521082904/http://www.bash.org/?262417)

</comment><comment><USER4> How does one access the study?</comment>


Why is Stack not Cabal? - <AUTHOR> https://www.fpcomplete.com/blog/2015/06/why-is-stack-not-cabal

<comment><USER2> It is really great to see all the work being done focusing on deployment of Haskell applications. With stackage for a curated package list, and now stack for a better build tool a lot of things are coming together.

FPComplete is really doing amazing work for the community, especially with not just going around fixing their own problems but actually putting out questionaries to identify what the community as a whole sees as the problem.

I can't wait to see where the community goes in the next couple of years!

</comment><comment><USER3> I was well aware of the problems of cabal-install but I wasn't sure of what stack is exactly. These finally cleared the thing for me. Thank you.

<comment><USER4> Exactly. I've been doing some research on Haskell, but Cabal is making it quite difficult for me. I've been dealing with a lot of dependency version mismatches when using sandboxes... I'll definitely give Stack a try after reading this.

</comment></comment><comment><USER5> For a new project, is ditching Cabal altogether and using Stack recommended?

<comment><USER6> For a recent project I did:

        cabal init
        stack init
        stack build

Then I wanted a newer version of persistent, so I opened up my stack.yaml file and added persistent 2.2 to the extra-deps section:

extra-deps: \- persistent-2.2

Then I was wondering how to make emacs haskell-mode work with it, and I saw this[0] in the stack repo:

        ((haskell-mode . ((haskell-indent-spaces . 4)
                          (hindent-style . "johan-tibell")
                          (haskell-process-type . ghci)
                          (haskell-process-path-ghci . "stack")
                          (haskell-process-args-ghci . ("ghci")))))

Now everything is working flawlessly and very fast. As a bonus Haskell-mode works correctly for projects I haven't moved to/tested with stack yet.

0: [https://github.com/commercialhaskell/stack/blob/master/.dir-...](https://github.com/commercialhaskell/stack/blob/master/.dir- locals.el)

<comment><USER7> Same experience here--that .dir-locals.el was absolutely crucial.

In case anyone is wondering how to turn on language pragmas with stack ghci in emacs, I did this for the project I'm working on, because I need OverloadedStrings turned on:

((haskell-mode . ((haskell-indent-spaces . 4) (hindent-style . "johan-tibell") (haskell-process-type . ghci) (haskell-process-path-ghci . "stack") (haskell- process-args-ghci . ("ghci" "\--ghc-options" "-XOverloadedStrings")))))

</comment></comment></comment><comment><USER8> Awesome. Great to see the "control the inputs, control the outputs; gain repeatability, gain control" mantra finally moving into the package management and dependency world. If Haskell's next generation of tooling lands hashes and built-in end-to-end integrity as a first class citizen, afaict that'll make Haskell be one of the first communities to really permanently address the "it built on tuesday" problem... and hopefully far from the last :)

</comment><comment><USER9> Great to see the cabal problem being addressed. It's the main reason I've given up on Haskell.

I'm wondering, is there any plan to support installation of pre-compiled binaries with Stack? (Compiling Haskell libraries with all their dependencies can be quite slow.) Or is it what Nix is for? If so, can I use Nix along with the regular package management of my Linux distribution?

<comment><USER10> Likewise, I'm now torn between Rust and Haskell as my "safe" language of choice. ("safe" as in - if it compiles, it runs correctly.)

Rust's lifetimes are a bit annoying, its async IO story is woeful, but it does allow safe mutation.

Haskell's more mature, IO is great, and it looks like cabal-hell may be ending, but it is a garbage-collected language.

<comment><USER11> That's kind of a false dichotomy, as these languages are applied to different problems.

Speaking of the garbage collector, it was the biggest productivity boost that software developers ever experienced and no matter how many tricks the Rust compiler pulls, the hit on productivity is real. And in terms of the " _if it compiles, it runs_ " feeling, that comes with having an advanced type system. Rust pulls some really nice tricks, but cannot match Haskell. And again, the lack of a GC means the compiler's budget is spent on ensuring that the code is memory-safe, with other things having much lower priority.

<comment><USER12> > Rust pulls some really nice trick, but cannot match Haskell.

I'm not convinced that's true. Rust is even stricter than Haskell in many respects (first example that comes to mind is incomplete pattern matches, which is a compiler error in rust) and strictness also avoids some run-time errors. I've managed to produce infinite loops in Haskell by accidentally defining recursive values more than once.

<comment><USER13> While I agree with you about pattern matches in Haskell but for completeness sake there is a ghc flag -W for it. If you compile this code with that flag, you will see the result below:

      --hello.hs
      f mx = case mx of
            Just x -> x
            --Nothing -> "NA"

      main = do
        let v = Just "5"
        putStrLn $ f v

      ghc -W hello.hs
      [1 of 1] Compiling Main             ( hello.hs, hello.o )
      hello.hs:1:8: Warning:
        Pattern match(es) are non-exhaustive
        In a case alternative: Patterns not matched: Nothing

<comment><USER14> In my opinion, incomplete pattern matches should be an error not a warning, but it seems strange to choose a different language based on that issue.</comment></comment></comment></comment></comment></comment>


In Need of serious help - <AUTHOR> I am such a novice and someone has managed to hack my entire system which is bad but worse they are posting DDOS's on "my behalf" on a valued member of the hacker community can someone please help me stop this. So far they have sent emails from my account and not are posting a "DDOS" on my instagram account trying tohurt the person i love. PLEASE PLEASE help me stop this <comment><USER2> Going to need more details. What system have they hacked? Who are they trying to attack via DDOS? What do you mean they are not DDOS your I stage am?</comment>


Hair weaves from Chinese prison camps seized - <AUTHOR> https://apnews.com/fff5fc7925f09916bf6b9d5f79bb4132 <comment><USER2> > suspected to be made out of human hair taken from people locked inside a > Chinese internment camp.

Is it possible to do a genetic analysis to find out the origin of the hair product?

</comment><comment><AUTHOR> Looks like the Chinese gov't is committing another Holocaust.

<comment><USER3> And the rest of the world will look the other way because there's a lot of money to be made doing business with China.</comment></comment>


In a relationship? We'd love your thoughts on our new venture... - <AUTHOR>

Hi everyone, I'm Danny. I'm one of the co-founders of Date Night Is... (http://www.datenight.is). We're a newly launched NYC-based startup that's aiming to help couples keep date night on their calendars without going stale. We're completely bootstrapped and launched our MVP recently.
Right now, our primary product is an email based reminder that offers up date night ideas (the first email reminder will go out in the next week or two). Our goal in the future is to grow the technology to better learn about couples and their interests in order to customize the ideas that we're sending on a personal level.
We'd love to get feedback from the Hacker News community about what we have so far, where we're headed, etc.
Thanks in advance! <comment><USER2> Interesting...

An example of what a date night might be would be cool. Will you be geo- specific or general? ie: how about italian tonight or how about dinner at The Chophouse downtown?

A tie in with specials / promotions might be cool too: "2 for 1 drinks at this restaurant tonight"

I think if you collect some more information, you could produce better results: q: do you have a vacation planned and where? and you could provide a place to eat, something to do, etc...

<comment><AUTHOR> @lsiunsuex

Thanks for the feedback. The things you've mentioned are definitely a huge part of what we have planned. The email reminders will include Date Night ideas of the type you're recommending.

In the near term, recommendations will be either NYC specific OR general enough to work for people anywhere. However, our goal is to become extremely geo-specific once we've built the technology to a point where we can gather that information (as well as interests) easily. Promotions are also part of the idea; we're working on building partnerships right now to make that part of the offering possible.

Thanks for the feedback; it's great to see that our ideas and the things you're recommending are in line.

</comment></comment><comment><AUTHOR> Big thanks for the input from everyone. Very helpful to see where we're on and off track. Thank you!

</comment><comment><USER3> you might want to think about gamification. points, levels, quizes. etcs. Obviously that could go in a bad direction but, if the couple is scored together probably not too bad.

<comment><AUTHOR> Interesting thought. Do you have a moment to expand on it further?

We've considered the possibility, but for the time being at least, we're aiming for this to be a tool between two people in a couple (or for a single person to use as an "angel on the shoulder"). Gamification requires pitting couple vs. couple within the ecosystem which might be odd for something that's designed to foster healthy relationships.

Or maybe we just haven't hit on the right idea for it yet...

<comment><USER2> Gameification doesn't need to be a competition, you could make it achievement based.

"Achievement unlocked: stayed in a hotel with a jacuzzi" or "Achievement unlocked: shared a desert"

We're (the wife and I) aren't to the point where we don't do a date night, but even we're starting to forget sometimes how to keep it new and fun like sharing a dessert or holding hands or sharing a kiss on a balcony or ...

<comment><AUTHOR> Good point. I suppose my hesitation is in the notion of turning a relationship into a monopoly board, but with the right achievements, etc. it might be an interesting proposition. I think we'd we'd to achieve personalization (location, interest, etc.) first, but down the line it's definitely worth a thought.</comment></comment></comment></comment>


Hyphos - A better way to socialize - <AUTHOR> http://hyphos.com Getting ready for private beta testing.  Hyphos is a next generation online social platform with an intuitive, "real life" inspired UI and an ever evolving social graph of people outside your network but within your interest zone. <comment><USER2> why post this if there is nothing there. You haven't even told us why its better.</comment>


Thinking of a Cybersecurity Career? - <AUTHOR> https://krebsonsecurity.com/2020/07/thinking-of-a-cybersecurity-career-read-this/ <comment><USER3> I think the cybersecurity (I hate the term cyber btw as it's usually used by people who don't know what they're talking about), is very focused on the 'think like a hacker' skillset right now.

While I do agree this is important in various roles in the security realm, there are also many jobs where this doesn't really add value. A lot of work is about implementing things like MFA, role-based-access etc where knowledge of the platform used (e.g. Microsoft) and internal processes are more important. After all, most companies already fail at the 'fix the obvious' stage, it's not necessary to go looking for clever ways in when there are many doors left open.

Just to elaborate: A lot of discussions go like this. A pentest or random scan finds obvious issue. Ticket is raised to the security team. They go like "WTF why do we still have Windows 95?? Kill it.". Then their boss goes like "Sorry, Bill the manufacturing VP lobbied with the CEO, we have to leave that one alone". Of course when it actually gets hacked, Bill is nowhere to be found. This is why internal influencing skills are so important in real everyday security jobs.

Of course in the pentesting role this kind of thinking is absolutely necessary. However even there the kind of training given right now is too much in the realm of 'scriptkiddie'ism. Hacking is about inventing and true mastery of technology, not about using the tools everyone uses. Being able to run metasploit and wireshark does not make one a hacker. By doing this, pentesters test for yesterday's hacks, not tomorrow's.

<comment><USER4> > Being able to run metasploit and wireshark does not make one a hacker. By > doing this, pentesters test for yesterday's hacks, not tomorrow's.

Be careful here. This is bordering on elitism.

Having someone come into a business and check for "yesterday's hacks" is better than no one doing any checks at all, therefore such skills are still valuable and worthwhile.

In learning how networking works; how operating systems are designed and implemented; why and how the OWASP Top Ten work; and knowing solutions to these problems is still a valuable skill set.

What you're suggesting is everyone has to be willing and able to write fresh exploitation on the spot when they're testing a client's network when in fact there's a lot that can be discovered (and resolved) with basic scans and simple questions based off of Security+ grade knowledge.

<comment><USER3> I know, but most of these "hacks" are identified by internal scans already. The pentest doesn't add much value then. The issue is more internal resistance to change in the management team.

Like I said I know most companies already fail at the basics. But these are normally well known already, just not fixed due to political pressure. Having the security team's management be better at influencing would pre-empt these issues. Pentests serve to bring these known issues under discussion again, but they often don't bring any unknown issues to light.

Also, they tend to be too artificial. In one example: In a recent pentest I know of, they sent some remote access malware to the admins, which they all ignored and reported. However as they couldn't continue they called one admin's manager and asked him to tell the admin to click on the link so that they could proceed. The outcome of the pentest was that _if_ a malicious actor sent a malicious remote access malware and _if_ it was clicked on, they would have remote access. Well duh.

Of course this could be mitigated by having separate workstations for email and admin activity, which was an issue that was already understood and a mitigation in progress. This is what I mean by pentesting not raising new issues. Another example: The company in question already test new web apps for known attacks, and is quite successful (in fact I've never seen a new app come through the certification process in the first round). What I'd expect from a pentest is to tell us something we don't know :) It's an interesting second- opinion but it's not the amazing X-ray it's promised to be.

> What you're suggesting is everyone has to be willing and able to write fresh > exploitation on the spot when they're testing a client's network

Which is exactly what a serious adversary would be doing in a targeted hack!

<comment><USER5> > I know, but most of these "hacks" are identified by internal scans already. > The pentest doesn't add much value then. The issue is more internal > resistance to change in the management team.

This sounds like management's fault for using a service they don't need yet. If there are glaring, obvious vulns that are repeatedly pointed out but aren't getting fixed then how useful is it to point out additional more subtle vulns? I understand the point you are trying to make about pentests telling you data you already know, but how many people are going to take the time to enumerate subtle vulns when there are basic ones that can be hit to great effect?

> Which is exactly what a serious adversary would be doing in a targeted hack!

I don't think it makes sense to worry about what a serious adversary could do when a moderately skilled one can already wreck you with known exploits.

<comment><USER3> Well, the issue is that these vulnerabilities can't be hit to great effect, because they're usually well understood and mitigated by other means (see the admins being very conscious of email malware). In many cases the pentesters cheat by asking for special permissions or for someone to click something they wouldn't normally have done. Just so they can be seen to 'have found something'.

I think a targeted adversary is more worrying because they usually are driven by high gains, which means something that's a big risk to the company. Like strategic information that can cripple the company. Whereas a more moderate adversary will usually trigger a ransomware campaign on some low-secured laptops or something which can be mitigated in a day or 2 by restoring backups. Big interruption yes. Company-killer no.

Also an advanced adversary will usually operate unseen altogether and penetrate the highest levels of security. A ransomware attack is much more obvious. I would view them as different things altogether. An advanced adversary might use the same techniques for their initial access but due to the many layers of security this won't be enough to reach the most critical information.

</comment></comment></comment></comment></comment><comment><USER6> CyberSecurity, the domain that doesn't recruit yet has a shortage.

What cybersecurity is to most people is automated security scans. This can be done by interns with a week of training to run the tools. (Interpreting and remediating the findings is another matter).

Besides that, security is mainly about authentication. That's done by setting up LDAP, active directory, openid connect and co, and integrating in applications. A tremendous amount of setup and integration work for administrators/developers. (Not cyber security engineers)

There are cyber aspects around infrastructure and networking for sysadmin/devops/sre/developers. Setting up firewalls and 2FA in AWS, configuring TLS, upgrading OS and abandoned libraries. (Still, no permanent cyber security roles in sight)

Last is a couple of researchers finding vulnerabilities, concentrated in the likes of the NSA, NSO Group, project zero. Highly technical work that very few companies recruit for. These are full time jobs, offensive cyber security (vulnerability researcher) but extremely few in the world.

When I see people looking for cyber security engineers or trying to break into security. I can't help but think what do they mean by that? Just become a developer or a sysadmin/devops.

<comment><USER7> > CyberSecurity, the domain that doesn't recruit yet has a shortage.

Yes, they are 100% lying about this. Any time you see an article about skills shortage, it's complete bullshit. It is cheap for them to create the illusion of a skills shortage via articles and blog spam. What they really want is people to spend their own money on training vs. them training their own talent. Then, once you've spent your money on training, you'll still run similar gauntlets in interviews that developers like to complain about.

This is why some of the certs are kind of useless at getting a job _despite_ industry advice to get them. Some places will see something like OSCP and then still give you a time-limited CTF to do before they'll even talk to you about an entry-level position. Other larger companies will praise you for your certs, saying certs + programming skills is what they look for with new people, then just ghost you.

The interviewing process in pentesting is just as bad, if not worse, than development.

Plus, despite most pentesting gigs being more difficult day-to-day than regular web development jobs, they pay much, MUCH less, sometimes as much as $40k less (80k vs. 120k in a large metro area).

All of this is kind of countered by the fact that you can really do bug bounties on your own now, so you may not really need a traditional job. IMHO, you're better off being a developer first before going down that route.

<comment><USER8> > Yes, they are 100% lying about this. Any time you see an article about > skills shortage, it's complete bullshit. It is cheap for them to create the > illusion of a skills shortage via articles and blog spam. What they really > want is people to spend their own money on training vs. them training their > own talent. Then, once you've spent your money on training, you'll still run > similar gauntlets in interviews that developers like to complain about.

This is so true. It is now common with most undergrads in India now, that they cannot even apply for a fresher job without such additional courses/certificates.

Training, learning and skill development budgets mobilized by CXOs for "other purposes"(may be for their vacation in the Swiss Alps that they promised to their spouse).

</comment></comment></comment><comment><USER9> It's important to note that while there are a lot of skills which can be useful, it's fairly rare to find a job which requires them all.

For example, if you have a mobile application specialist, they probably don't need to worry about, say, VLAN configuration on a regular basis. It's quite likely that even if they do know it, the lack of use will result in them not showing that knowledge well in an interview situation. If you give them a few hours and an internet connection, though, they may well be able to refamiliarise themselves easily. Alternatively, you just need to hire someone who specialises in network architecture and segregation - this does rely on the person doing the hiring to know vaguely what they need, though, which is not always the case.

I work in the industry, and there are people who are well known as experts in specific fields, but who I would never expect to be able to do some other aspects of my job, just as I would struggle to do things they can do without any difficulty.

I think the cyber security industry is at the stage where the web was 15-20 years ago, where a company would hire a "webmaster" who did all the web related stuff, rather than getting a combination of people in different roles each specialising in one area. It's slowly getting better, but it's still common for companies to look for a jack of all trades security person, rather than getting the specific knowledge they need.

<comment><USER3> Totally agree, it's not really possible for a hacker or security specialist to excel at all categories. Some people become an expert in web injection, others in buffer overflows, network attacks or crypto. The field has become way too wide for one person to have expert knowledge in everything.

</comment></comment><comment><USER10> In my experience many jobs in "risk management" (under which I'd file a large part of cybersecurity from an organisational perspective) are 'second career jobs'. You first need to have done the job yourself before you start learning how to properly comment, guide, influence and teach colleagues and teams. People are notoriously resistant to outside critique even when you are part of the same organisation and principally on the same boat. So I would advise companies to let medior to senior staff that are not management material but can lead by example to take on more risk management roles.

So how to get into cybersecurity? Don't. Do what you like (programming, systems administration or even IT-procurement) and after a few years start transitioning to cybersecurity. An exception would be the hardcore whitehats but firms usually don't have those on board and rely on consulting. So programmer-consultant is another route. But you won't get hired without quite the demonstrated homework, so you'll need to love it.

</comment><comment><USER11> Seems like a good place to copy/paste one of my comments from a different thread.

Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy.

...

Online sources:

* OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here.

* [https://owasp.org/www-project-web-security-testing-guide/](https://owasp.org/www-project-web-security-testing-guide/) Thanks to redis_mic for this one, I didn't know it existed until today.

* overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different.

* [https://0x00sec.org/](https://0x00sec.org/) A forum dedicated to security. There's a lot of script kiddies, but also some gold.

* [https://www.hackerone.com/](https://www.hackerone.com/) What better way to learn then practice on live targets? That being said, I would do some of the others first.

...

I do a lot of learning through reading, so books:

* Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated.

* Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful.

* Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this.

* Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date.

...

This should be enough to get you started. There's a couple more books I can think of, but they tend to be more specialized into certain fields of security and less approachable/generally applicable. If you want these recommendations as well, feel free to email me, my email's in my bio.

</comment><comment><USER12> Cybersecurity, as a field, is in desperate need of identifying different roles within it. These roles are notionally understood within the field, but what they are called and what exactly they do hasn't really crystallized quite yet. You still see job postings for "Cyber-security SME" or whatever and the organization has almost no idea what exactly they want out or the person they hire. So they end up with bored, highly skilled, reverse engineers and pentesters running automated scans, or overwhelmed "security guys" who's career was running compliance checklists being asked to build a defensive intelligence platform.

I call this the "Cyber Dash" problem where there's many different kinds of Cyber-<insert job> but the industry hasn't figured out what those are, what to call them, what they do, and what the requirements are beyond maybe a handful of roles.

<comment><USER13> Identifying roles? SANS has done this 10 times over.

</comment></comment><comment><USER14> I'm a senior level security leader and hiring manager. I focus on software security. Ask me anything about what I see, or don't, in candidates.

<comment><USER15> Can you talk about your interview process? e.g. types of interviews, screens vs. on-sites, distributions, etc. What are the shortcomings that keeps a candidate from an offer in the final steps, e.g. the candidate passes screening interviews, but falls short on an on-site interview. What are the indicators you observe that differentiate a senior candidate? How do you go about evaluating entry-level and junior candidates? Thank you!

<comment><USER14> We do a few screens, starting with general security discussion - <USER2> like: intro, light tech/coding - just to make sure we aren't completely wasting our time

The main interview centers on software security, and is focused on real world scenarios. We avoid "explain this OWASP top 10 blah blah blah" kind of questions. The goal is to see if you can reach the outcomes we expect, regardless of how you may approach them. I don't care if you can explain SQLi to me, you should be able to approach exploiting it on a live system.

We will:

* Give you a sample system and ask you to threat model it. Maybe you will use STRIDE, maybe you wont, but we hope you will find some threats using structured techniques.

* Ask you about secure systems you have designed, why you made the choices you made, and how you would make them differently today. We want to know if you have a methodology, a structured approach, and experience.

* Expose you to vulnerable code implementations, and running systems. We hope you will discover vulnerabilities.

* Show you examples of our systems, and ask you how you would secure them. We want to understand if you can see, and discuss security architecture.

* Role play developer interaction scenarios. Can you handle soft skills?

* Have you done any of this at scale? Do you understand how to make it work for 10, and 1000 developers? Explain your experience, how would you do it differently?

I can go on, but again the emphasis is evaluating whether or not you can do the tasks we need you to do, with a high degree of quality in whichever way works best for you, while also being able to completely ignore your resume if we want.

It is extremely difficult for us to consider hiring junior candidates, and we frequently encounter candidates with no deep experience. While it is unfair to expect candidates to have spent time at home treating this as a passion project, those are the ones im going to hire because they can deliver the outcomes in an interview. To combat the hiring difficulty, we have arrived at this approach which allows us to send candidates through the machinery quickly, with low bias.

<comment><USER16> > I don't care if you can explain SQLi to me

Huh interesting. I work in infosec (but not a hiring person). I would normally rank this as an important skill. Not because i actually care about getting an explanation but because half the job is getting non security devs to care about security issues/fix them/not make them in the future. In my experience it is really difficult to do that if you can't explain the vulnerability to them.

<comment><USER14> I think you misunderstood. Almost anyone can tell you what sqli is, few can demonstrate an exploit. You need to be much closer to the latter than the former.

<comment><USER16> That's fair. Proof of concepts definitely get the point across better than a natural language explanation.

</comment></comment></comment></comment></comment></comment><comment><USER17> During my degree, I had a crossover unit for cryptography. The unit was a mix of computer science majors, and also a new "cyber security" degree the university had recently started. This was a third year unit.

Holy-moly, did the cyber security students flop from the first class. It was immediately clear that the new "degree" they had signed up for had not given them even elementary math skills in comp. sci related fields (discrete math, linear algebra). A few of them put in the hard yards, studied about a year's worth of math and did okay. But the majority flopped out hard and failed.

The "degree" was dropped a year later. Poor kids.

</comment><comment><USER18> This is a predictable pattern at this point:

1) Employers don't like the fact that the labour they require has skills that a lot of time to become competent at and the labour wants to be compensated accordingly.

2) They get universities to start offering degree programs tailored to churn out new graduates who are willing to work for entry level wages.

3) Employers complain that the grads who come out of these programs are unprepared to do the same job as the old guard.

Using Metasploit, Nessus, and nmap should be a 1 credit elective course in a CS degree. Not top billing.

<comment><USER19> Totally it's the same pattern over and over again we don't want to pay technical talent that can actually do stuff, and won't or can't train the people that are willing to work cheap.

<comment><USER18> Step 4, in the US at least, is to lobby for more H1B bodies.

While they may or may not have the skills that are actually needed, the H1B system makes feudal servants bound to the corporation.

</comment></comment></comment><comment><USER20> I feel like it's hard to teach cybersecurity formally. It deals with hacking and by nature the spirit of hacking is hard to teach. I have learnt cybersecurity as a hobby and have competed with our university team in some online well known attack/defense style competitions (we sucked) and a lot of this stuff is really hard to formalize. I guess you could teach the basics like overflows, aslr, stack canaries, basic assembly, but in the end it's up to the hacker to string everything together to overflow a buffer, control the return pointer, leak the canary, string together a rop chain and pwn the system, and this takes a lot of tinkering and discovery rather than prior knowledge, although experience definitely helps. I guess it's also why some random high school teenager could be going up against the hacking team from Tencent in these competitions. And this is only for binary exploitation mind you. If you look at some of the crazy talks from defcon, the stuff they do draws upon a lot of random knowledge, and it comes down more to the act of piecing everything together than knowing anything before hand, hence the "hacking". And that's also why I love it :)

<comment><USER21> Sounds like they need to bring apprenticeships to the field.

</comment></comment><comment><USER22> Call me naive, but isn't simply completing every live hackthebox.eu box a good way to get some practice in to apply for certain security roles? Hacking 20 boxes on various levels to me seems that you have what it takes. The easy ones are Metasploit and so on. The medium ones are attacks like SQLi or injection into MongoDB. The hard ones are simply a chain of those things with a lot less intelligence to go on. The insane ones also put some binary analysis or C vulnerabilities in there (e.g. heap overflows or ROP attacks of stripped binaries).

Then again, I'm far too early in my career to know whether simply rooting all live boxes is good enough. Doing so myself has definitely helped me at my job as a full-stack developer to make the company I work at more secure.

Here's an example of an "insane" box: [https://www.youtube.com/watch?v=p8XkVDRtTQg](https://www.youtube.com/watch?v=p8XkVDRtTQg)

And this is a "medium" one: [https://www.youtube.com/watch?v=7QXzebQHEWA](https://www.youtube.com/watch?v=7QXzebQHEWA)

</comment><comment><USER23> I find this article very interesting. I'm coming at this from the other way around. I am a Site Reliability Engineer, so I've been writing code, architecting systems, building networks etc for 8 years professionally; I am however eyeing a more security oriented position so only now I am looking at courses and training.

</comment><comment><USER24> In my experience, c level folks just want someone who can produce a dashboard or executive report with a bunch of green check marks that basically say "yay! We're secure". They don't care about the why, how, if the check marks are actually meaningful, etc. This mindset is then reinforced by vendors selling security snake oil - the entire infosec domain is a shit show; if infosec practitioners ever want to be taken seriously, they need to collectively get their shit together and organize around some real tangible standards.

<comment><USER25> There's the MITRE ATT&CK Framework [https://attack.mitre.org/](https://attack.mitre.org/) which is gaining attention and seems very promising (although it of course isn't the golden answer to all questions, it goes a long way to cover the basics).

</comment></comment><comment><USER26> I'm in Georgia Techs online MS in cybersecurity program and have argued these points a few times. Most of the cybersecurity classes are just CS classes. I think it was just a money grab to repackage their existing CS degree into a more marketable package.

I've argued that we should have some type of network and OS hardening classes. There is a required network security And secure computer communication class but they are much more about programming vs implementation. The counter arguments I get are that what I'm suggesting is more aligned with a vendor cert. But a lot of cyber security is doing the hardening of os and proper user access.

A lot of the cyber students end up switching to the policy track instead of the information security track. They are admitting students with almost no prior CS experience. They get away with only having to take an intro to cyber security CS class. Their remaining classes are all management classes marginally related to security.

I'm going to use this article to backup my arguments that there is more to cybersecurity than programming.

</comment><comment><USER27> As someone undertaking a Master's in Cybersecurity, that table is totally true.

Most of my courses have a programming alternative for assignments yet the students alongside me have very little interest.

I've been doing this a while so maybe I'm just an outlier as I've always been the guy who is the jack of all trades, but I can't help but see something unknown as something to learn.

<comment><USER25> Don't ditch programming. Knowing how programs are made will in some situations help you understand how they can be abused as well.

<comment><USER27> Of course not... after 11 years as a software engineer, it would be difficult to not do it.

</comment></comment></comment><comment><USER28> Krebs does not work in Cybersecurity, does not come from a position of knowledge or experience in Cybersecurity and his only skill relating to Cybersecurity is doxxing people.

I could understand if this was "Thinking of a Cybersecurity journalism career" but there are better people to learn from.

<comment><USER29> Perhaps instead of going after the author you could go after his ideas? It seems like quite a well written essay imo

<comment><USER28> Shall I do that for everyone who _does not work in the industry they are advising people on_?

</comment></comment></comment><comment><USER30> In my opinion (working as security architect for an US Fortune500) technical skills are mandatory, but they are not enough for a successful career on cybersecurity. You need to have great communication skills (writing a great pentest report is probably the most important and difficult part), negotiation and persuasive abilities (sometimes you have to accept risks against budget, deadlines and business requirements). In the cybersecurity community I see a certain degree of elitism (don't use Kali, don't use Metasploit, etc.), but we need to understand that they are just tools, so anyone is free to use the tool that is more confident and more appropriate for the tasks.

</comment><comment><USER31> If it can be done without a degree and largely by self study than most of it can be packaged into a course or a book with practice problems and labs that anyone with dedication can finish can complete and come out competent.

Maybe such a course that covers what's needed to get into that top 10% doesn't exist yet but I'm sure it can exist and I would gladly pay for such a course to attain the required mastery rather than explore the space haphazardly myself.

Do any professional security experts know of such a course? Are any of you willing to start one?

</comment><comment><USER16> So this article is not what i expected.

I agree that hands on skills are important. And i agree that candidates often lack them.

But im not sure that the skills in the article are really hands-on skills.

For example, the article talks about picking up a book on tcp/ip. That's not hands-on, that is theory. I also question what type of cybersecurity degree program this is, where you don't learn how the internet works?

All the things in the article sound like stuff i would expect a "cybersecurity" degree to cover. They don't sound like things that need to be taught practically.

</comment><comment><USER13> The amount of people completely forgetting and not even mentioning:

\- Cybersecurity Incident Response, \- The behemoth that is SIEM (nowadays called security analytics platforms) and everything else Blue Team \- The role of centralized Vulnerability team and Threat Intelligence team. \- And Red Team for in-house vulnerability detection to support the previous bullet.

Is alarming.

</comment><comment><USER32> Very interesting article, but at the same time it depicts a very sad truth...

[Disclaimer: also not a certified security professional, but I do follow the topic and practice it hands-on from time-to-time...]

However I think there are multiple (sometimes non-overlapping) types of cyber- security professionals / roles:

* the policy maker / enforcer -- which is what some companies want, and what the most well known people out there (including Schneier, Krebs, etc.) are blogging and speaking about; (to put it metaphorically they are the ones in charge of designing an IT "hygiene", and making sure everyone "washes their hands" properly;) :)

* the operations security -- which should make sure systems and networks are well locked down, patches properly installed, watches out for suspicious activity, and if he is capable enough tries to check the boundaries and limits the firms security; this is another role most companies want, what some courses train for, and what usual bloggers write about;

* "applied cryptography / security" developer (for the lack of a better name) -- which (if he knows better) should make sure proper well-known techniques and best practices are used throughout the developed applications, and when necessary (if not already covered by existing solutions) is capable enough to mix cryptographic primitives;

* "high budget zero-day" researcher (also for the lack of a better name) -- which is mostly employed by state level actors to discover zero-day vulnerabilities, and on the other side employed by large corporations (e.g. Google, Microsoft, etc.) to make sure their most valuable systems aren't vulnerable to those types of attacks; these are the guys that come up with Spectre and Meltdown and other very low-level hardware related vulnerabilities;

* (many others that escape me at this moment...)

Each of these roles require some different traits and focus areas, which most of the time aren't strictly related to IT or security; for example:

* the policy maker should be well versed in social sciences and human behavior, as in the end he has to work with people;

* the operations security person should be as capable (if not more) than any of its "normal" peers in all matters of network and systems administration;

* all of them must understand that in the end security is a spectrum (i.e. from air-gapped-system to no-authentication-internet-connected) and it has to take into account a balance between internal cost (development, operations, etc), end-user costs (e.g. how cumbersome is for the end-user to login), risks (e.g. is the data valuable enough to protect it with 2FA), time-to-market, etc.

So in the end I think the underlying problem is that most companies want "one cybersecurity guy", and most candidates see themselves as that "one guy", when in reality there is no real person that can actually fulfill all these roles. Just like nobody wants to hire "a developer", but a "web developer", or an "embedded developer", so should companies specify what kind of security professional they are looking for...

<comment><USER33> > * (many others that escape me at this moment...)

* Threat hunting / attribution

Familiarity with clustering incidents and pivoting between actors by attack signatures.

Or before that, do you even know what an APT is? (Probably only a small percentage of CS grads.)

* Malware re

* Post incident forensics

Random tools and skills that come up...

SQL keeps coming up even though I try to avoid it. There's generally an "SQL person" on the team that drives simple queries but having the basics down will be faster.

Visualization tools that help diagram clusters of incidents, though these might be declining in importance.

Beyond the network stack, understanding common network services, how people (criminals) register for domains and set up virtual services, techniques for c2.

You can play around with riskiq as a free user. You can read _some_ reports from FireEye, Symantec, Crowdstrike, etc. for free to see how they do it. The MITRE attack framework collects a lot of it. Most CS students probably don't know those names though or where to start.

An understanding of criminal law and/or geopolitics doesn't hurt.

<comment><USER34> > Or before that, do you even know what an APT is?

You mean that Linux command thing? ;)

</comment></comment></comment><comment><USER35> That's surprising to someone not in CyberSec that so few can do basic tasks of their job. I wonder how they declare the bar for basic or not.

<comment><USER36> I used to do interviews for pentesters at an old job, and I was suprised as well. I think it's because CyberSecurity is relatively new, so companies have no idea how to hire for it, and end up hiring whoever can talk the best. I interviewed a lot of people with titles like "Senior Cybersecurity Engineer" who had no security knowledge beyond how to run an automated scan against an IP range, and put the findings it printed out into a report for management.

<comment><USER37> And yet here I am with half a decade actual experience in 'Cyber Security', can write passable Golang, C, C++, Python, hands on, real world knowledge and experience of threat actors and APT TTPs, for Blue team threat hunting, IDS/IPS signature creation, incident response... etc.

And I can't even get a callback from any other company, because I don't check the "Bachelor degree required" box.

Fucking, awesome.

<comment><USER38> That's very surprising. I don't have a degree and at Dropbox, the last company I worked for, dropouts were more common than those who held a bachelors.

Maybe there's something else going on?

<comment><USER6> Location most likely.

Search cyber security jobs on indeed in London and there is hardly anything coming up. I can't imagine what it's like in a small city.

</comment></comment></comment></comment></comment><comment><USER39> As with most positions, the largest obstacle to getting a job in security is overcoming the HR Gatekeepers. The hiring system is broken. Those who successfully attained job are those who generally have networked their way around the first line HR personnel. Get your name out there so that hiring managers know who you are. Blog, go to meet-ups, make friends, do capture-the- flags, create a website, create a Git repo, and a home lab that you write about.

<comment><USER38> TBH while a lot of people say the shortage is a myth, I am not so convinced. I wouldn't personally hire most people in infosec because I think the industry has the wrong idea of what the career should look like.

 _Most_ people in infosec have no coding skills. That isn't their fault, they aren't told it's important. I think it is, so I won't hire them. That just cut out the vast majority of candidates with a single criteria, and I believe a _lot_ of the criteria is broken.</comment></comment>


Ask HN: How to check if an idea has traction? - <AUTHOR>

I have an idea that I think is good. I have set up a landing page, and I can go ahead and build the product whenever I want. However, it will also take significant manual labor by me to actually get running once the software is done. I have also run some Google Adwords, but they are expensive even with coupons and it's expensive to get a decent sample size.<p>What has worked for you in the past? <comment><USER2> A claasic is the Dropbox video-MVP. It was a tough product to build, so they created a simple, direct video showing how it would work. A lot of people liked it, so they built the product. Google it for a better version of the stroy.

It is possible to make 2 cents Adwords. I am getting about 30 signups each day for about $5. I don't know if that is enough for me, but it is working for me to test some things.

And also, your landing page should be validating it for you, it isn't? The problem is just traffic for it?

</comment><comment><USER3> Who do you think will buy your product? Go and talk to them. Its simple. You dont know who they are? Do some research around the web to find who uses similar products, and get in touch with these people through forums, email, tweets, etc.

Note that there is no hack around this. You have to go looking for people. End of story.

<comment><USER4> Agree. OP might want to get acquainted to Lean Startup and especially Customer Development ("Get out of the building").

You don't want to spend time working on something nobody wants.

The earlier you can validate parts of your business model, the better. And the easiest way to do that is getting insights into your potential customers. Talking to them will do that, looking at what they complain about on forums, twitter etc will also do that.

</comment></comment><comment><USER5> I'm reading PG's essays. He says you should make it because you want it, you're the target audience. The nos you get from funding and other people is a poor indicator of if an idea is good. Go for it.

</comment><comment><USER6> Talk to customers! Or, in your case, talk to people in your target market! Is this something they need? Are they willing to pay you for it?

</comment><comment><USER7> Interested in the responses to this question as I am currently in the same boat.

<comment><USER8> Yeah, me too.</comment></comment>


Flippa.com Hacked? - <AUTHOR> http://www.flipfilter.com/blog/2010/07/19/flippa-hacked/ Flippa's having a hard time lately.  From seller complaints to fraud to hackers, the king of sites for sale seems to be under attack. <comment><USER2> omg</comment>


Symantec Acquires Blue Coat Systems Inc - <AUTHOR> https://www.symantec.com/about/newsroom/press-releases/2016/symantec_0612_01 <comment><USER2> Funny they talk about keeping their customers protected, when turncoat's products are MITM attacking privacy invaders.

Now they're owned by the same company that own verisign how long before they offer a system that uses their own root certs to undermine the very security of the Internet for (authoritarian) governments?

</comment><comment><AUTHOR> [https://en.wikipedia.org/wiki/Blue_Coat_Systems#Controversy](https://en.wikipedia.org/wiki/Blue_Coat_Systems#Controversy)</comment>


Nominum Domain Correlation - <AUTHOR> https://www.nominum.com/tech-blog/domain-correlation-just-let-malware-beat/ <comment><USER2> Unfortunately the piece is light on the technical details.

<comment><USER3> If you're anywhere near France, and free in December, there's [https://www.botconf.eu/2017/math-gpu-dns-cracking-locky- seed...](https://www.botconf.eu/2017/math-gpu-dns-cracking-locky-seeds-in- real-time-without-analyzing-samples/)

</comment></comment><comment><USER4> Tl;dr: correlation of great many DNS queries allows to discover malware c&c networks, and block them. Works without prior knowledge, using just stats / ML.

</comment><comment><USER5> Fascinating. They don't mention but I can't help but wonder if time and source also are fed into the correlation net.</comment>


Show HN: Poetic.io – beautiful, simple and professional file transfer - <AUTHOR> https://poetic.io/

<comment><USER2> Seems good, but emails? Again? What makes this different from SendSpace or WeTransfer?

Do something different. Maybe a combination of keywords + geolocation for identifying files.

\-- I've sent you a file at poetic.io!

\-- What is the link?

\-- Just go there, it's in your address.

<comment><AUTHOR> Yes, about emails you are right. I'm pretty open to find another solution. We can also brainstorm a bit about the solution if you like :)

I think poetic.io has a much better UI, user experience (comparing it with SendSpace). The real differences will be deployed in two/three weeks: \- previews on pictures (gallery), pdf and media \- background customisation for the transfer (for example with your brand) The pro version will be completely different, I'll keep you updated on that ;)

</comment></comment><comment><AUTHOR> After this chat we made an update to the "terms of service" under "Rights you licence". Let me know what you think guys.

</comment><comment><USER3> What makes Poetic.io different than other methods of transferring and sharing file? (Dropbox for example has 10 GB limit file-size limit)

<comment><AUTHOR> with Dropbox you have to register, install a software and, most of the time pay,(actually you just have 2GB per account): [https://www.dropbox.com/en/help/73](https://www.dropbox.com/en/help/73) You have also to keep the file on your computer while is shared.

Here you have 3GB per transfer (unlimited number of transfers), no registration needed.</comment></comment>


The future of world education? - <AUTHOR>

Online, institutional or absent? <comment><USER2> All three. There's no way online will work for everyone. At least, that's what it appears like now. Many drop courses almost them immediately. Link (PDF): [http://www.kfrankola.com/Documents/Why%20online%20learners%2...](http://www.kfrankola.com/Documents/Why%20online%20learners%20drop%20out_Workforce.pdf)

My theory is that like many things in our postmodern world, Education will be tiered:

You'll have the industrial school, which most people will go to, for jobs and a basic, crappy education. \--This will educate the unmotivated more than any other, more independent form of learning.

You'll have the internet based, self leaning resources we have now, for the motivated and willing. \--This will be used for people unsatisfied with the basic form of education.

</comment><comment><USER3> Online education isn't good for what most people want, which is getting certification. It doesn't have the reputation, cheating is harder to prevent, and the barriers to entry are lower.

But if you actually want to learn, I think online is superior for most things or at least will be.

</comment><comment><USER4> I think the trend towards educational choice and diversity will continue.

I have an AA, a couple of certificates (one from a technical college that my former employer sent me to), and I am a few classes short of a BS. I have taken plenty of classes on a college campus but have also taken online classes, condensed classes aimed at adults, and other stuff. I have also homeschooled my kids and what I know about running websites and writing code comes from books, educational CDs, websites, online discussion and other forms of uncredentialed "independent" or self study.

For my websites, I don't need any credentials. The king's stamp will not make them gold. Either I put up something good that has value to other people and I figure out how to get traffic and monetize it or I don't. A diploma makes zero difference. That doesn't mean taking courses would do nothing. That means if I took a class and it taught me something useful it would make a difference. But listing my educational credentials will have little to no impact on usability, appeal, etc for my websites. I get it right or I don't.

Since I don't plan to get a regular job again, credentials are not terribly important to me. I was STAR student, a National Merit Scholarship winner, inducted into Mu Alpha Theta in 11th grade (that's a college math honor society), state alternate for the governor's honors program, blah blah blah. None of that made very much difference in my life in terms of employability and income or certain other critical areas. I was a homemaker for a long time. My educational background and typing, math etc skills helped me get a better than minimum wage job while going through a divorce but I never got a promotion in part because of my health issues. Since I have special needs in that regard (and for other reasons), credentialing is of little importance to my life. Credibility is something I need more and that's a completely different animal.

So it depends a lot on your goals and needs. With a few billion people on the planet, we can easily support a diversity of educational approaches. There are plenty of people to fill both roles of provider and consumer. Even a fairly niche area or approach can routinely fill a class. That wasn't always true.</comment>


WebMynd Could Change the Way You Bookmark Websites - <AUTHOR> http://www.techcrunch.com/2008/01/26/webmynd-could-change-the-way-you-bookmark-websites/

<comment><USER2> When I was making fun of Xobni some months ago, I said the next product of this kind would be "a browser plugin that lets you search your bookmarks":

<http://news.ycombinator.com/item?id=56422>

No its here and its called WebMynd. Alright.

Just for the record, here is my prediction: No one will use or remember this project in 2 years.

</comment><comment><USER3> Well, I have developed something similar (all your history is stored in a Database in YOUR sever). It is a free package.Check it out here: <http://history.sansj.com>

</comment><comment><USER4> I appreciate this is a YCombinator start-up, so apologies for being a little negative. Firstly I think the app itself looks good, but I visit a lot of sites and I was alarmed at the space being taken up after just a couple of hours of use. Also, I don't want to remember everything - just some sites. Currently I use Furl for this and it works well for me. Click one button and the page is saved into Furl - and fully searchable also. I appreciate that this WebMynd looks slicker, but having this kind of option for me would be better than saving everything

</comment><comment><USER5> cool, but this is another echo-chamber "non-product"

</comment><comment><USER6> Cool!

But I wish there was a way to store all the pages _locally_ instead of on a website. When I travel, I'd like to be able to go through my pages without going on the web.

<comment><USER7> I think the images are local. They mentioned on techcrunch that they'll be making an offline app.

[http://www.techcrunch.com/2008/01/26/webmynd-could-change- th...](http://www.techcrunch.com/2008/01/26/webmynd-could-change-the-way-you- bookmark-websites/#comment-1943852)

<comment><USER6> Forget about images, I'd like to have a full text search like the latest Opera 9.5 has... that would be super cool!

</comment></comment></comment><comment><USER8> Nice idea, like my own personal google.

Is there a way to download the history from their servers? Can I also upload my bookmarks, google history, etc?

<comment><USER9> I thought they store it on your harddrive atm

<comment><USER10> yes they do, and the data size does bloat up rather alarmingly ... I used it for around an hour and the directory size is 50Mb now.

<comment><USER6> It seems to be stored in [path o FF prefs]/ScrapBook folder. But you can't view the stuff without being online :( Hope this is fixed soon.

</comment></comment></comment></comment><comment><USER11> Grats guys! Great work in such a short time. Your launch has kicked me into higher gear working on our next release...

</comment><comment><USER12> Excellent product and I'm looking forward to seeing all the new features the WebMynd guys have in store! Congrats.

</comment><comment><USER13> Well, it doesn't seem to work for linux systems. So I can't try it. Bookmarking is a very real problem for me and I wouldn't mind paying, say, $10 a year for a good tool. Unfortunately, as far as I can tell your tool won't solve the problem. Atleast that's what I can tell without being able to try it.

<comment><USER13> I am curious why this got funded though, there is just no barrier to entry, actually, I have no clue why PG funds some of the stuff he does - Fuzzwich is an example. Anyway, I suppose he knows things I don't.

<comment><USER14> Boo. What did Fuzzwich ever do to you? On a more serious note, I am pretty sure Paul invested in us because we are a very creative and well rounded team. While we might not be a breakout hit in our current incarnation, we know we are on to something. The Fuzzwich team is very confident that we will eventually find our niche and are determined to keep trying until we do.

<comment><USER13> Best of Luck. Nothing personal, just curious. :)

</comment></comment></comment></comment><comment><USER15> I don't like having everything saved to disk. Hence why I so often use Safari's private browsing feature.

<comment><USER16> you mean there are more legitimate uses to that feature than browsing pr0n?

</comment></comment><comment><USER17> You guys have a bright future. Congrats on having a solid business model right off the bat.

</comment><comment><USER18> This sounds just like a spiced-up ScrapBook

<http://amb.vis.ne.jp/mozilla/scrapbook/>

</comment><comment><USER7> The visual history slider is really, really slick.

</comment><comment><USER19> Congrats on the launch guys. Great work!

</comment><comment><USER20> woot! Way to go guys!</comment>


Hypit app – Hype the things you love - <AUTHOR> http://hypit.co <comment><AUTHOR> Hypit is the easiest way to share the things you love.

The app lets you hype your favourite things (places, movies, tv, music) and see what your friends are hyping, all in one place!

We launched in the UK this week so any early feedback would be massiely appreciated! You can download it here - [http://apple.co/1kg4IYI](http://apple.co/1kg4IYI) or [http://bit.ly/1WlwAfu](http://bit.ly/1WlwAfu)

Thanks :)</comment>


Show HN: I built a faster way to burn your money on Etsy.com - <AUTHOR> http://www.Scrollsy.com

<comment><AUTHOR> Everything 100% clientside jQuery & JSONP. Hosted on Amazon Cloudfront so low costs and no scalability issues.

Some examples you should check:

Regular search: <http://www.scrollsy.com/#s=nyan%20cat>

Treasury listings: <http://www.scrollsy.com/#l=treasury>

Shop: <http://www.scrollsy.com/#un=machelspencePHOTO>

Color search: [http://www.scrollsy.com/#c=art&color=0A9600](http://www.scrollsy.com/#c=art&color=0A9600)

Would love to have some feedback!

<comment><USER2> You really should have a fallback page for browsers with no Javascript. NoScript has become increasing popular and the "Javscript Free" page of a site is the first page those users will see (even if they go on to temporarily allow javascript for your app).

In your case, it is just a blank white page. Since you are asking for suggestions, I would suggest you just make it display a message. One for suggesting users with older browsers to download chrome or firefox and another message directed at those with Javascript intentionally disabled which gives a very brief outline of what your app does and why they should enable JS to play with it.

e: I clicked through to the other mashups you have created which you linked in your other comment. They all do the same thing, just bring me to a blank page.

ee: To those down-voting, what do you disagree with? Do you not think pure JS web apps should have HTML fallback pages or do you disagree with the way I said it?

<comment><USER3> I didn't downvote you but I personally never worry about users with JavaScript disabled, and the companies I have worked for don't care either. The number of people without JavaScript is most likely way to low to spend time on an HTML fallback.

[http://www.quora.com/What-percentage-of-Internet-users- use-J...](http://www.quora.com/What-percentage-of-Internet-users-use- JavaScript-Is-it-safe-to-pretend-that-non-JavaScript-users-do-not-exist-when- designing-your-website?redirected_qid=12124)

<comment><USER4> An adequate "fallback" is
This site requires Javascript to function
. It's not exactly hard, and it's better than a blank white page.

It can also occur due to network problems on occasion or other technical issues; if you have JS beyond just progressive enhancement on your site you really ought to have a  tag in there somewhere.

</comment></comment></comment></comment><comment><USER5> So Pinterest.

I say that as a compliment. Great job.

Only thought is the constant Loading Items widget is annoying and isn't in line with how most sites do dynamic scrolling.

<comment><AUTHOR> Thanks for the compliment! The loader is something to re-code indeed. Anyone here with a good example of a nice scrolling loader?

<comment><USER6> I agree, your app looks dangerous in a good way.

I think the most important thing is that the loading animation be anchored to the bottom of the loaded content so that it never obscures content that's already loaded. If the user manages to outrace your loader and gets to the bottom, some kind of indication that the app is churning away would no doubt be welcome.

<comment><AUTHOR> That's a good idea, got it on the list!

</comment></comment></comment></comment><comment><USER7> This is really great. I like the "exploding" treasuries a lot.

What was your motivation? If you're looking for more exposure you can write a blog post for the Etsy blog. I did that for my app and it drove a lot of traffic (<http://www.etsy.com/blog/en/2011/handmade-code-babylist/>)

<comment><AUTHOR> Thanks! The Treasuries view is a nice one indeed, took me a night to find a good way to keep it stupid simple and fast.

My motivation is coming from previous mashups I did in the same style. <http://Scrolldit.com> which was featured on TechCrunch ([http://techcrunch.com/2011/10/25/scrolldit-i-heard-you- liked...](http://techcrunch.com/2011/10/25/scrolldit-i-heard-you-liked- scrolling-reddit-so-i-put-scrolling-in-your-reddit/)) and another mashup I did <http://www.ScrollFriends.com> (Facebook Scroller, no viral)

However Scrolldit is (most of the time) a pure timewaster, check this: 377.913 (unique visits) x 1.20 (avg minutes on the site) = 453495,6 minutes = an impact of 314,93 wasted days on our world economy.

However with all those minutes wasted I felt the need to do something productive, I think Scrollsy.com is a good try. Supporting all those small shopkeepers, trying to give them more exposure.

Good idea to do the blog post, it's on the list!

<comment><USER8> What's your motivation for all these mashups?

<comment><AUTHOR> Multiple things: I love endless scrolling and visually rich designs, I want to learn new techniques and ofcourse it's great to see other people using these mashups. Btw this mashup was also some kind of compensation for the damage I've done with <http://Scrolldit.com>

</comment></comment></comment></comment><comment><USER9> The activity indicator is very intrusive. Why not make it small and place it below the last item?

<comment><AUTHOR> It's on the list to improve :)

<comment><USER10> Along with everyone else's activity indicator complaint, I also think that color coding the bottom "info bar" area of each item according to category would be useful for quickly scanning and separating all of that info with the eye.

<comment><AUTHOR> Great idea, I'll put it on the list. Thanks.

</comment></comment></comment></comment><comment><USER11> FYI: I get "Connection Timeout. Etsy.com is unreachable. Try again." in Firefox 9.0.1 on Ubuntu, but all is good in Chrome.

I can image using this to gather ideas for gifts, and presumably buying a few (if I was US-based). Nicely done.

<comment><AUTHOR> I think you hit the API Limit. Just fixed a bug that used an old API key for API calls (got lower limits).

Big chance you won't get that error if you retry it after 10 minutes (time needed for Amazon Cloudfront to push the new version to all the edge locations).

</comment></comment><comment><USER3> This is awesome man. The wife and I just spent 30 minutes scrolling around and added quite a few items to my Favorites. You need to find a way to get an affiliate fee as soon as possible!

The Pinterest-influenced UI is such a great way to explore. I'd much rather browse around on your site than the actual Etsy site anyday. The new items flying in from the left does catch me off guard sometimes and I think the search input and browse dropdown need to be a bit larger but other that, very well done.

<comment><AUTHOR> Thanks for the kind words!

</comment></comment><comment><USER12> I love browsing products like this. I assume inspired by Pinterest? A Toronto startup is doing the same thing, but local shops/products. <http://shopcastr.com/>

<comment><AUTHOR> Inspired by masonry jquery plugin and after the success of <http://Scrolldit.com> :)

</comment></comment><comment><USER13> I did an Etsy search similar to this, with "instant" search instead of scrolling. I have to say I like your approach better.

A few questions about your Etsy API experience - can you now see who purchased through your site? At the time they had no feedback loop and no sort of affiliate program. Building my Etsy app was a lot of fun, but I had no way to monetize my work. I'm a bit out of the Etsy API loop now, but I do hope they've come up with some way to help devs make money.

<comment><AUTHOR> I'm not sure if I could see who purchased through my site, as far as I know shopkeepers see it. There is no sort of affiliate program. So I don't see any monetizing options for this moment.

<comment><USER14> What motivated you to use the Etsy API? I'm good friends with a number of people there and worked a bit on their search too.

<comment><AUTHOR> It's fast, it supports JSONP and their API team is great to work with (fast replies on email). I could recommend anyone to build a mashup on top of the Etsy API.

<comment><USER14> That's great to hear, Jonathan. I personally know two of the people on that team and they're brilliant programmers but never saw their view from the outside. I'm glad to hear you're getting amazing support from them.

If you're enjoying it a lot and love to program, you should consider applying there too.

</comment></comment></comment></comment></comment><comment><USER15> Did you post this on HN before? It's still jarring how new items fly in from the top left. It's also constantly loading items, which is annoying.

Otherwise, looks pretty cool. You should also take a look at other fashion sites for the "Quick Look" interaction (using mouseover or some other light interaction to provide more ui/information/larger image, vs opening a new page), which would be pretty great on a purely visual site like this.

<comment><AUTHOR> I posted it 5 hours ago on HN but had to delete it because of API limit I had to resolve before risking a viral.

After they were resolved I posted it.

Trick: Click the about link in the top left box and flag the disable animation checkbox.

Do you have any examples of those fashion sites?

<comment><USER16> You should rename about to options (or make a second link).

Listing options in an about link is counter intuitive.

<comment><AUTHOR> I'll make a second link, good idea.

</comment></comment></comment></comment><comment><USER17> It would be really awesome if something liked this was done for the recommended reading lists on Amazon.com, although, not sure if Amazon has an easy API for that.

<comment><USER18> I made something sort of similar for Amazon a few years ago:

<http://bigbooksearch.com/>

It's horizontal (like a bookshelf), instead of vertical, though.

<comment><USER17> Nice! I could definitely see a simply iOS app for something like that that makes use of the cover-flow animation. Could be a nice alternative to the Amazon.com store app if you can hook it up to user accounts and Amazon's personalized recommendations.

</comment></comment></comment><comment><USER19> Does Etsy have an affiliate/referral program?

<comment><AUTHOR> No they doesn't, as far as I know.

<comment><USER20> A life lesson which was news to me: there is some scale at which _every_ commercial site has an affiliate program. (Varies based on the site.)

<comment><USER13> When I did an Etsy app, there was no affiliate program, which seemed to largely stem from the fact that Etsy charged to little to sellers that they were barely making a profit. The idea of giving a cut to ousters seemed like a bad idea. I'm not sure if it's changed. But when one considers the number of Etsy apps that have been made just for the joy of it, it would seem to be in Etsy's favor to incentivize developers once they can get the numbers to work out.

</comment></comment></comment></comment><comment><USER21> Noo why have you done that...

Seriously I like is a lot, very well thought.

Sorry have to go back on Scrollsy...

</comment><comment><USER22> Start the scroll-loading earlier, and make the loading notification at least 50% smaller. It's annoying.

</comment><comment><USER23> This is genius. I'm going to do something like this.

</comment><comment><USER24> doesn't pinterest already have a section where its exclusively etsy products?

</comment><comment><USER25> Nice Work!

I have been working a lot with JSONP lately it's a great way to bring content Cross domain/into Apps. I just recently finished writing a Webservice/iPhone implementation.

Something to consider, try preloading the content to give the user a smoother experience. My UITableViews (iPhone) were a bit clunky until I got around to pre-caching my JSON results.

Anyway, Keep up the good work!

<comment><AUTHOR> Pre-caching JSON results is something I'm testing with, expect it within a short time.</comment></comment>