Changes to USCIS policy on eligibility criteria for H1B visa - <AUTHOR> https://www.axios.com/computer-programmers-may-no-longer-be-eligible-for-h-1b-visas-2342531251.html <comment><USER2> This calibre of journalism feels like clickbait or, worse, incompetence.

> computer programmers are no longer presumed to be eligible for H-1B visas.

This is narrowly true based on what the linked document says. But the intent of document seems to be to rescind old guidance that would consider people with associate's degrees, or in some cases, no degrees, experts. That made sense in the 90s when CS was a newer field of study. It doesn't make sense now.

In practice, this is the government dotting an i and crossing a t - they're re-opening this particular service centre and ensuring that it complies with the practices already in place at other service centres.

> Lawsuits possible: Releasing this policy change at the start of the > application filing window is going to rankle companies who used 17-year-old > policy guidance to apply for this year's visas. Some companies may challenge > the guidance on the grounds that USCIS didn't provide sufficient notice of > the change.

Yeah, right. I doubt the big H1B filers thought they could magically sneak someone without credentials through as a result of this. Having done TN and H1B myself, it was always clear that the government had the last word in adjudicating whether you met the standards, especially for the more ambiguous NAFTA occupations like "Computer systems analyst".

<comment><USER3> You're not wrong, but I think slightly talking past the point of the article. I don't know which is right, but my understanding is:

Prior to the guidance, H1-B filers could just say "this is a programmer, thus they are a specialist" and now they need to provide evidence (i.e. more effort in filing/submitting impending applications). So while the big H1-B filers might not have had an intention to sneak in an Associates' Degree holder, their ready-to-be-submitted applications for Bachelors and Masters-degree holding developers just got a whole lot harder (if the rest of what the article says is correct).

I understand this is an old guidance, but it is not clear to me why that in itself means it hasn't been in effect. If it was (which is what the article claims), then this is still a fairly significant last minute change that requires additional last minute documentation for these applications.

<comment><USER4> >Prior to the guidance, H1-B filers could just say "this is a programmer, thus they are a specialist" and now they need to provide evidence

Only at the Nebraska center, not the California one, nor the Vermont one. And it's only a reminder to the Nebraska center that to be considered a specialist you need to hold a bachelor's degree or higher in that field of study. The California and Vermont one were already applying this rule. It's not clear how many H1-B petitions are event sent to the Nebraska center, but according to [1], originally very few.

> their ready-to-be-submitted applications for Bachelors and Masters-degree > holding developers just got a whole lot harder

That's not my understanding of the notice, but our definition of "a whole lot" might differ.

[1] [https://www.uscis.gov/i-129-addresses](https://www.uscis.gov/i-129-addresses)

<comment><USER3> Thanks -- this is the explanation I thought was missing from the critique. In that case I agree.

</comment></comment></comment></comment><comment><USER5> [IANAL] "Computer programmers may no longer be eligible for H-1B visas" -

This is absurd and incorrect. The USCIS memorandum is rescinding a document dated December 2000 because it doesn't want the Nebraska Service Center (NSC) to use the old guidelines for issuing H-1B visas for computer related positions. The NSC started adjudicating H-1B applications last year after a hiatus of around 10 years.

<comment><USER6> I don't quite understand the memorandum [1] yet either, but it does say [2]:

        the fact that a person may be employed as a computer programmer and may use
        information technology skills and knowledge to help an enterprise achieve its
        goals in the course of his or her job is not sufficient to establish the position
        as a specialty occupation.

So, calling the thesis of the article "absurd and incorrect" is probably too early.

[1]: [https://www.uscis.gov/sites/default/files/files/nativedocume...](https://www.uscis.gov/sites/default/files/files/nativedocuments/PM-6002-0142-H-1BComputerRelatedPositionsRecission.pdf)

[2]: page 4, last paragraph.

<comment><USER5> [IANAL] New guidelines as to what constitutes as a speciality occupation are already in place at the other centers handling H-1B applications. The only thing this memo is saying is "Hey, someone issued you folks a memorandum in December 2000 that shouldn't be used anymore because things have changed. We're rescinding it so that no one uses it accidentally"

<comment><USER7> Moreover, if USCIS thought this would affect already-filed applications, I _think_ they would've made a clear blog post stating it as opposed to dumping it in a hard-to-read memorandum. (I'm subscribed to their newsletter which I've observed sends out all pertinent news with no delays).

</comment></comment></comment></comment><comment><USER8> An immigration lawyer's take:

[http://immigrationgirl.com/uscis-rescinds-memo- on-h-1b-speci...](http://immigrationgirl.com/uscis-rescinds-memo- on-h-1b-specialty-occupation-for-computer-related-positions-no-the-sky-is-not- falling/)

She concludes:

"The new memo issued Friday rescinds that old memo and basically reminds officers that they must look at the particular position and its job duties to determine whether it meets the definition of specialty occupation, rather than relying solely on the OOH. I think the main issue with the old memo was that it gave kind of a blanket statement that all programmers should be specialty occupations.

The new memo does not change the rules, it just reminds us that a petitioner must be able to establish that a particular position qualifies as a specialty occupation in order to be eligible for the H-1B visa."

</comment><comment><USER9> I wish there was a way to distinguish the quality of a worker from the degrees of a worker.

Its not just that one wants a "computer technology worker", but one wants an individual who can communicate, work hard when needed, take on responsibility, easily read and comprehend instructions and so on.

These are weakly correlated with degrees or how technical a field of study is. An art history undergrad could easily display more of these qualities than a PhD studying the physics of plasma.

<comment><USER10> If we are looking for criteria in regards to H1B visas, I think it makes most sense to instead of having a lottery to pick up candidates, the criteria should be which candidates will get higher salary.

By putting a price on a candidate, companies can then decide how valuable a given person is to them and let free market decide who gets the visa.

This has several advantages, it allows sponsoring truly qualified candidates that otherwise might be harder to find locally (restoring the main purpose of what H1B was for), it would also solve issues of H1B workers being underpaid, or companies using this to obtain a cheaper employees (H1B holders are wiling to work for cheaper, because the visa doesn't allow them switch a company).

<comment><USER11> This actually makes sense. If the company thinks you are really needed, they will pay more for you. The bidding may go high, but it will only go as high as how much it would cost to hire an American instead. This would be a win-win because the under-qualified get filtered and the good ones get paid on par.

<comment><USER12> > The bidding may go high, but it will only go as high as how much it would > cost to hire an American instead.

Except this is already the case?

Hiring a H1B worker isn't free. It costs something like $10K in legal costs alone. Do you really think a lot of companies are indulging in a large-scale conspiracy to avoid paying that $10K to an American instead? If you want the worker to stay longer than a couple years, you'll need to renew the H1B and probably file a PERM application as well. All of this costs something like $20K at the minimum.

Getting a position on a H1B is by no means easy or cheap. If a company could hire an American, they'd much rather do it. And if the H1B thing were all about cheap foreign workers, spouses of H1Bs wouldn't have had so much trouble getting hired in the pre-Obama era. Anecdotally, I know many women with Master's degrees from top-tier US universities who were desperate to find a position, and were willing to take wages well-below par, but couldn't because companies didn't want to pay for the H1B. It's also why if you look at resumes/linkedin profiles for Indians in the US, many will advertise their green cards/citizenship status. They're communicating that employers don't need to file a H1B petition for them.

Yes, it's true there are a few companies which have exploited H1Bs to bring in cheap labor. But from a statistical point of view, this is about as common as the epidemic of violence at Chuck-e-Cheese. In other words, it's a nice news story that plays well as a clickbait headline, in reality, it's a non-issue.

<comment><USER13> > All of this costs something like $20K at the minimum.

So they only need to be cheaper by $20K over a couple of years for it to be worth it?

That seems like a fairly small cost to overcome.

And if there isn't very much demand for H1Bs, even with "bidding" we'd expect the cost to companies to stay the same.

It isn't clear to me why prioritizing the value of an employee (as measured by how much they are paid) would not be an effective way of prioritizing H1B visas.

</comment></comment></comment></comment></comment><comment><USER14> highly disingenuous article. Should be "computer programmers without degree will have to prove their specialty to be eligible to H1B visa". And all of a sudden, it becomes way less scary.

Apparently, having a bachelor's degree and a job in computer science was enough, under certain policies, to be H1B eligible. that the bachelor degree might have been in chemistry or in art wasn't relevant to the old policy. The new policy articulates that the degree should be computer related.

On top of it, it seems the old memorandum was not properly informing on the real policy. The given example sounds very odd though (apparently only programmers who were working for a company who's specialty was _not_ software were eligible for the 2-year degree rule...).

Computer programmer is not in and on itself a "specialized occupation" with the new memo. You also would need to be either senior or have the relevant degrees.

<comment><USER15> I think its a bit more than that ... specifically the jobs themselves have to be shown to be requiring Specialized engineering knowledge.

> Companies applying for H-1B visas for computer programming positions will > have to submit additional evidence showing that the jobs are complex or > specialized and require professional degrees

</comment></comment><comment><USER16> Why limit the discussion only to H1B visas? Companies such as Citigroup use external contractors such as First Derivatives to hire thousands of workers on E2 Investor visas. These immigrants displace US workers earning a much higher wage. E2 visas have no salary cap. So my colleague earning $120,000 was replaced by a Citibank E2 visa holder earning $30,000. This is unfair to US citizens that pay their fair taxes and a misuse of the Investor visa scheme.

</comment><comment> d--b The actual text says that describing a h1b petitioner only as a 'computer programmer' is not enough to qualify for a specialized job visa.

It's comparable to 'Speaking French does not qualify you to petition a H1B to work in a bakery'.

</comment><comment><USER17> To quote from the document (top of page 3): [https://www.uscis.gov/sites/default/files/files/nativedocume...](https://www.uscis.gov/sites/default/files/files/nativedocuments/PM-6002-0142-H-1BComputerRelatedPositionsRecission.pdf)

> The [previous] memorandum also does not properly explain or distinguish an > entry-level position from one that is, for example, more senior, complex, > specialized, or unique. This is relevant in that, absent additional evidence > to the contrary, the [Occupational Outlook] Handbook indicates that an > individual with an associate's degree may enter the occupation of computer > programmer. As such, while the fact that some computer programming positions > may only require an associate's degree does not necessarily disqualify all > positions in the computer programming occupation (viewed generally) from > qualifying as positions in a specialty occupation, an entry-level computer > programmer position would not generally qualify as a position in a specialty > occupation because the plain language of the statutory and regulatory > definition of "specialty occupation" requires in part that the proffered > position have a minimum entry requirement of a U.S. bachelor's or higher > degree _in the specific specialty_ , or its equivalent.

\---

Question: BTW, does this mean that a candidate would necessarily need at least a Bachelor's degree in a CS ("in the specific specialty"), in order to qualify? Or does "equivalent" apply to Bachelor's or higher degrees in other (technical?) fields as well?

<comment><USER4> To answer your question:

No, a foreign candidate either needs the BS in CS or they can use work equivalency [1]. However if you worked your whole life in a different field and have no relevant degree, I would assume you are not eligible. Otherwise it'd basically make 7 billion people eligible for the H1-B.

If your other technical field is let's say petroleum engineering, you could surely get a H-1B as a petroleum engineer, but not as a programmer or a lawyer for instance, which I think makes total sense. (Unless you're good looking, then you could get a H-1B as a fashion model :) )

Check out the wikipedia definition for "specialty occupation" : requiring theoretical and practical application of a body of highly specialized knowledge in a field of human endeavor [2]

[1] [http://www.shihabimmigrationfirm.com/h-1b-degree- equivalency...](http://www.shihabimmigrationfirm.com/h-1b-degree-equivalency- using-work-experience-and-specialized-tr.html)

[2] [https://en.wikipedia.org/wiki/H-1B_visa](https://en.wikipedia.org/wiki/H-1B_visa)

</comment></comment><comment><USER18> By reading the actual guidance [1] it seems USCIS will not consider the position of programmer to qualify as a specialty occupation because companies can hire people without degree to do programing. Thus, just saying "programer" will not be enough for H1B petition.

The question here is whether this is going to have any influence on number of H1B visas received by Infosys, Tata, Winpro, Accenture and similar companies.

[1] [https://www.uscis.gov/sites/default/files/files/nativedocume...](https://www.uscis.gov/sites/default/files/files/nativedocuments/PM-6002-0142-H-1BComputerRelatedPositionsRecission.pdf)

</comment><comment><USER19> Read through the official USCIS pdf - this seems to target mainly people with a 2 years degree and people who are at Level I (out of 4) of the Labor Certification pay scales.

As someone on an H1B in this field, I do see this as being a legitimate modification to the code.

</comment><comment><USER20> What's about those software developers who don't have any degree but have many years of relevant experience?

As I understand 12 years of relevant experience is equivalent to US bachelor degree.

Is it still true according to new USCIS policy?

</comment><comment><USER21> For TN visas (Canadians and Mexicans only), computer programmers and software _developers_ aren't eligible for visas, but software _engineers_ are. Would this exact situation apply to this new policy?

<comment><USER22> Serious question, no sarcasm: what is used as a clear and measurable distinction between a software developer and a software engineer?

<comment><USER23> Too many uninformed people spreading misinformation. There's clear and measurable difference between a software engineering degree and the one you get from a boot camp. It's exactly as strict and rigorous as you'd expect from a degree in mechanical engineering. In Canada, you get an iron ring when you graduate and after about 4 years, you get a professional engineering license.

<comment><USER24> Sure, but unfortunately in America that distinction does not exist as there is no rigorous industry-wide standardization process.

</comment></comment></comment></comment><comment><USER25> If the workers cannot come to the US, won't the work go to the workers? I think we will see more off-shoring to get around this and other work-visa restrictions talked about by the administration. While the outsourcing companies _love_ sending bodies to the US (which enables them to bill the best rate for the same person/work), they can continue their work in their offshore locations.

<comment><USER26> Have you tried to manage projects across timezones and cultures? Usually the way this works is all of the outsourced work has to be redone in the US anyway, at twice the original cost.

</comment></comment><comment><USER27> Since nobody has posted the link yet, here is the official memo (PDF): [https://www.uscis.gov/sites/default/files/files/nativedocume...](https://www.uscis.gov/sites/default/files/files/nativedocuments/PM-6002-0142-H-1BComputerRelatedPositionsRecission.pdf)

</comment><comment><USER28> This article does seem to be about nothing. However, I was really hoping that they were clamping down on H1-Bs that are handed out to the consulting companies.

</comment><comment><USER29> it's a real shame with the degree requirements specifically requiring computer science or computer engineering to be considered a "computer programmer". There are many highly skilled devs who may have happened to earn a different credential.

</comment><comment><USER30> What is best source for the prevailing wage for software engineering levels?

<comment><USER31> For the H1B there is no "best source" \- there is one source, the Bureau of Labor Statistics.

[https://www.bls.gov/bls/wages.htm](https://www.bls.gov/bls/wages.htm)</comment></comment>


Spyware Maker NSO Group Promises Reform but Keeps Snooping - <AUTHOR> https://www.nytimes.com/2019/11/09/technology/nso-group-spyware-india.html <comment><USER2> Members of this organization need to be pursued as criminals. Internal reform of a criminal organization is a sick joke. They're all accessories to murder; changes to company policy don't change that.

If their government is intent on protecting them from prosecution, then extralegal retributive action taken by an competing spy agency could be suitable payback. Unfortunately that assumes the existence of a competing spy agency that isn't equally morally bankrupt.

<comment><USER3> > _Members of this organization need to be pursued as criminals_

Not sure why this is being downvoted. NSO and its employees willfully facilitate criminal violations of CFAA, among other laws. (They have received payment in U.S. dollars, making the question of jurisdiction trivial.)

Given the heinousness of some of the crimes they've aided and abetted, many against American citizens, most Americans would be on board with arresting their employees on arrival to the America or our allies.

<comment><USER4> Providing tools that could be used to violate the CFAA is not the same thing as violating the CFAA. There are several US companies that do this. There is nothing illegal about it as long as you don't sell to countries on sanctions lists.

<comment><USER5> Knowingly assisting organizations that target human rights activists and reporters, and assisting the incarceration and murder of those targets makes you a criminal.

They are criminal accessories to gross human rights violations and murder, and should be prosecuted as such.

<comment><USER6> At the very least all US internet companies should follow Facebook's lead and deplatform their employees.

</comment></comment></comment></comment></comment><comment><USER7> Yes yes, but the supply/demand economics remains so even if you get rid of them they'll be replaced. Governments and laws not catching up with tech and being hostile to their own people is creating the demand.

Are exploit brokers like Zerodium exempt from this criticism because they off load the targeting and execution part to third parties and governments?

<comment> fake-name Bullshit.

There's a limited pool of talent that can generate something like this. If you make is sufficently toxic and/or difficult to work for a company that involved with flagrantly violating human rights (like NSO), you'll substantially starve them of talent.

Worst case, you'll significantly reduce the quality of their exploits. Best case, it'll be effectively unavailable.

<comment><USER7> Ok but where will that talent go? Countries will just get someone else to start a firm and support it. It's an arms race and you're blaming defense contractors for supplying arms!

The people with power to be hostile to exploit devs who sell their talent to the highest bidder are the same people who are bidding for that talent. So long as NSO group and others dont harm the interests of countries protecting them they will always be in demand.

If even the entire west punished developing exploits for money a high crime, at best you give business to chinese,russian and indian companies. At worse, western devs move to other coubtries or simply sell exploits illegally without getting caught...to non-western entities.

The only way to beat this sort of a problem is to compete with demand. But that means competing against resources of nation states. Perhaps international treaties to control this arms race would help?

And yes, I know at best there are only a few hundred people with enough talent, but I bet you there are even less nuclear bomb scientists and you know how that supply/demand is turning out...

<comment> fake-name > Ok but where will that talent go?

Presumably to another company where they live, or are comfortable relocating to.

You seem to continuously be assuming a perfect market, that doesn't exist.

I agree that just blocking this sort of thing from countries that actually care about human rights won't solve the issue, but stopping a _lot_ of it is still valuable. Additionally, I don't know if this sort of thing could exist in some of the countries you name. For China, at least, it sure seems like if you're good enough at this sort of thing, you get strongarmed into their existing military infrastructure used for spying on everyone else. I can only assume Russia is similar. I don't think either of those countries have free enough markets that a NSO-like company _could_ exist.

India, I don't know enough to comment.

> At worse, western devs move to other coubtries or simply sell exploits > illegally without getting caught...to non-western entities.

Do people just up and move to other countries at the drop of the hat? That requirement alone is going to substantially reduce the number of people doing this sort of work.

Again, the goal isn't to completely prevent exploit sales (which I agree is basically impossible), but to reduce the harm. Stomping out these companies (or having _MUCH_ more aggressive oversight) won't substantially impact the hosting state's economy, and it will substantially reduce the available products on the market. I can't see a argument against that.

<comment><USER7> Here is where out views diverge: you think reducing volume of supply is important, I think controlling supply is important.

You think reducing volume means what little supply is available will be used against high value targets only. In reality, the smaller supply will focus more on high value exploits which will still be leveraged at the same scale. Even if that was not true, you still have no control over exploit sales and use.

Allowing places like NSO and Zerodium to thrive with some control and restrictions is the best outcome. But really, do we even have law makers that understand any of this or perhaps the NSA/CIA can control them. Normal security companies have intel community ties,I think that can be acheived here as well.

</comment></comment></comment></comment></comment><comment><USER8> [http://archive.is/xrM8p](http://archive.is/xrM8p)

<comment><USER9> Thank you kindly _/\\_

</comment></comment><comment><USER9> I never knew the Bhima Koregaon would be such a politically contentious issue that would compel the government to spy onto citizen's cellphones.

What further surprises me is that this article speaks only about India. Hasn't Pegasus been used by other governments too?

[https://en.m.wikipedia.org/wiki/Pegasus_(spyware)](https://en.m.wikipedia.org/wiki/Pegasus_\(spyware\))

</comment><comment><USER10> the funny part is all this publicity and media outrage actually helps NSO. their customers and potential customers don't give a damn about human rights, and being in the spot light more than competing firms only helps them.

</comment><comment><USER11> Shouldn't we be holding the government of India to account instead of the toolmaker?

Or is the toolmaker a much easier target? This criticism really seems misplaced to me.

<comment><USER12> Yes, but I think one problem is Facebook doesn't have direct evidence that the government of India was responsible, so it would be difficult for Facebook to sue India. Maybe if this lawsuit turns up evidence of who ordered the attacks, Facebook can then sue India (and the various other governments that attacked journalists).

</comment></comment><comment><USER13> What country is NSO group based in?

</comment><comment><USER14> Is it really fair to put all the blame on the toolmaker for finding flaws in devices that were sold as "secure"?

<comment><USER15> Use a $20 flip phone and odds are the baseband is crap enough that you could be spied on easily by someone using a cell-site simulator. Or, heck, since those $20 phones usually use 3G or below, the state-level actor you're up against will just decrypt all your 3G transmissions directly.

I have to wonder if you're being serious when you describe the kind of software NSO produces. It's software to let _other_ people take control of hardware you possess. The better analogy would be to the iOS jailbreaking folks; people aren't generally mad at them either.

<comment><USER7> At least you can easily pull out the battery and assume your text/call is being monitored. They give you more control and less complexity but you're right on how they don't add security.

</comment></comment></comment><comment><USER16> This is a very interesting trend. The name of the company is "NSO Group" but there is this peculiar insistence on calling it "NSO" in titles.

Let's try this NYTimes: "Israeli company NSO Group Promises Reform but Keeps Snooping". That conveys the essential facts at a glance.

<comment><USER17> Their own website ([https://www.nsogroup.com/](https://www.nsogroup.com/)) calls themselves by the name NSO. Here's a direct quote of the first sentence on that site:

"NSO creates technology that helps government agencies prevent and investigate terrorism and crime to save thousands of lives around the globe."</comment></comment>


Ask HN: How to Sell Yourseslf at a  Conference? - <AUTHOR>

So I'm speaking at the Agile 2009 conference this week in Chicago  http://agile2009.agilealliance.org/ (Topic: Agile won't work: Applying Agility to Non-Standard Teams)
I've never been to a conference before -- sounds strange for somebody who's been in IT for a while, but it's true.
My "day job" -- the reason I'm at the conference -- is that I teach/train/mentor/coach technology teams into becoming high performing teams instead of the death marches they sometimes end up being. [Insert lots of lessons learned from start-ups here]
My question: how do I leverage this free conference appearance into some sales or leads? I don't want to look like a used car salesman -- for my work it would be very counterproductive anyway -- but I don't want to lose a good opportunity either.
Any hints, tips, or tricks out there that I could use? I figure this is something lots of folks who attend conferences would like to know.
I figure I'll need to bring business cards. Perhaps have a sign-up sheet for people interested in more information? Any other ideas? Somebody mentioned that I visit the booths and ask other people how things are going -- might be a good way to pick up a lead. Is that really a good idea? <comment><USER2> The best sales pitch is a great talk - interesting and informative. Use anecdotes to tell a story. Ask yourself: What's the one question you're answering for the audience so the next time they're thinking about similar stuff you, and your answer, come to mind. Then provide all relevant contact details. Be sure to save time for questions then have a few slides in your back pocket in case you have extra time. If your talk is good enough, that's your sales pitch right there. You're selling yourself through how you convey the main idea.

If you don't know people, conferences can be somewhat lonely. Just keep putting yourself out there. Try to arrange meetings beforehand and then try to spend meals talking with new people. Worry more about exchanging thoughts than business cards. It's easy to forget that you're there to learn. Find out when meeting people what they're learning there. It's a good opening and you'll soon find like minds.

</comment><comment><USER3> If you give a good talk, people will come up to you afterward. Get their business cards. A salesperson would call these people leads and follow up with them in order to ask the question directly, "Could your team perform at a higher level with some coaching of the sort I talked about in my talk?"

Your coaching work is probably also going to work it's way into your talk because that's where your anecdotes are coming from. Just make sure to spell it out directly at the end of your talk with a slide: "Thanks for listening, here's what I do, and how to contact me."

There's a non-car-sales technique to selling which is often summarized as give value first. That's what you're doing here because both of these techniques rely on you giving a great talk.

<comment><USER4> _Your coaching work is probably also going to work it's way into your talk because that's where your anecdotes are coming from. Just make sure to spell it out directly at the end of your talk with a slide: "Thanks for listening, here's what I do, and how to contact me."_

Give the contact and "here's what I do" slide at the beginning, too. If people watch the videos online to get your contact info after the conference, you don't want them to have to go through your whole slide deck/video to find you.

</comment></comment><comment><USER5> Seems pretty well covered in the comments so far, and you know to bring business cards (ideally, cards with enough white to write notes and such).

One additional thought: try not to have your time monopolized by people who either want to just impress you with their superior smarts, or pick your brains for free.

I don't mean to sound callous, but face time at conferences can be limited, and if a goal is to land work and contacts you need to be sort of ruthless at times with your attention.

<comment><USER6> Being ruthless with your attention can be a hard act to pull off without appearing rude.

<comment><USER5> Oh, quite true, and it may not be the most natural behavior for many of us.

Still, I think most people would understand it if you politely explained that time is limited and you're trying to meet as many new people as possible, and here's my contact info so we can continue this discussion later.

</comment></comment></comment><comment><USER7> Forget selling and focus on imparting good knowledge on your audience without babbling on for far too long.

I only remember two types of conference speakers; the really good and the really bad.

</comment><comment><USER8> This time around, focus on giving a great talk that gets you invited to speak again somewhere else.

Then go buy and read this book: [http://www.amazon.com/Never-Eat-Alone- Secrets-Relationship/d...](http://www.amazon.com/Never-Eat-Alone-Secrets- Relationship/dp/0385512058)

The author comes off as a complete tool, but every bit of advice he offers is pure gold and extremely practical.

</comment><comment><USER9> A lot of good suggestions already.

I think you have to offer one or two very specific symptoms of the problem that you help teams with. Note that a symptom is a prospect's perception of the problem, a diagnosis is the practitioners description.

After the talk exchange business cards with anyone who comes up. If there is some way you can assist them (e.g. send them a url or other info, make an intro) or a point you want to remember, jot down a 2-3 word note on the back of the card immediately so that you don't forget. Follow up within two days.

If you want to hand something out besides your card consider either or both of these:

1\. 3x5 card with a pain question on one side (and two or three sentences on how you address) and a short 2-3 sentence backgrounder on the other. This is still small enough to fit in folks pocket. Bonus: preparing this also prepares you for small talk / networking conversations where you need to succinctly describe what you do.

2\. An article as a "leave behind" instead of your slide deck, a good slide deck is incomplete without the spoken presentation, and article can be complete stand alone.

There are more than 50 sponsors: research each one's website and determine if there are potential synergies between their offerings and yours. I would visit any you might be able to partner with and introduce yourself.

</comment><comment><USER10> I haven't been to the Agile conference series in the last few years, so this is based on several-year-old impressions:

Most of the attendees are not be people "buying" agile; they are (like you) "selling" agile. A great many of them could be described their work as "teach/train/mentor/coach technology teams into becoming high performing teams".

</comment><comment><USER11> If your website isn't crystal clear about what you offer, when you offer it, what your prices are, and how to hire you, it doesn't matter how many leads you get. Your conversion will suck.

If your site does all those things, your (first and) last slide just needs to have your URL and people will look at it (during and) after your speech.</comment>


A2: Analog Malicious Hardware [pdf] - <AUTHOR> http://www.impedimenttoprogress.com/storage/publications/A2_SP_2016.pdf <comment><USER2> This has some similarity to the rowhammer vulnerability. There, if you access some DRAM chips repeatedly in a specific way, some digital elements no longer behave in the idealized way that's expected, and there's cross-coupling between things that aren't supposed to be connected. This allows changing RAM to which you don't have access. That was accidental, rather than being designed in.

This new attack is deliberate, rather than accidental, and very explicit, being wired to to the protected-mode bit. It points the way to even more subtle attacks, perhaps something that misbehaves slightly as power management is bringing some part of the CPU up or down. Maybe slightly more capacitance somewhere, so that right after a core comes out of power save, for the first few cycles some part of the protection hardware doesn't work right.

<comment><USER3> "Maybe slightly more capacitance somewhere, so that right after a core comes out of power save, for the first few cycles some part of the protection hardware doesn't work right."

That already happens in embedded systems (esp MCU's) in a different way. You're thinking on the right track. All I can say.

</comment></comment><comment><USER4> Thanks for this, just added it to my Zotero backlog. I don't see what this has to do with Ken Thompson though. Did he believe that undetectable hardware backdoors would be possible in the future, or what exactly?

I applied for a PhD at UMich this year hoping to work at MICL[1] under Prof. Dennis Sylvester, who co-authored this paper, but I was sadly rejected[2]. MICL is one of the best places in the world to do IC design, and Prof. Sylvester is absolutely amazing.

[1]: [http://www.eecs.umich.edu/micl/](http://www.eecs.umich.edu/micl/)

[2]: I got a funded offer at GA Tech, so it's all good :D

<comment><USER5> Indeed, the article title, per HN rules, should probably be "A2: Analog Malicious Hardware [pdf]". Maybe with " \- undetectable CPU backdoor".

<comment><USER6> This isn't (just) a CPU backdoor though, it's a possible backdoor on any integrated circuit.

<comment><USER7> To be precise, what was implemented was a CPU backdoor, but the attack applies to all integrated circuits.

<comment><USER6> Ah, I get the confusion. I've added "just" to my earlier comment.

</comment></comment></comment></comment></comment><comment><USER8> This is a neat paper. One of the tricky parts of making a malicious circuit is the fact that you want your behavior to only be triggered on some unlikely condition.

In other words you want:

if (counter == 0x686e686e) { do evil } else counter++;

But that requires a lot of hardware.

What the authors realized is that essentially a simple capacitor can be used as a counter! Each time you reach the condition it adds a bit of charge to the capacitor, until at the appropriate moment it discharges and changes the state of the chip in some way.

This is a really clever bit of design, getting something general-purpose and malicious out of a single capacitor!

<comment><USER7> The paper uses two capacitors that share charge to get the same effect as your code. In effect Cunit (the smaller capacitor) is the increment (i.e., counter++), while Cmain (the larger capacitor) acts as the count-holding variable (i.e., counter). Another circuit (Schmitt Trigger) acts as the comparator.

<comment><USER8> Thanks for the clarification! I'm definitely not a hardware expert and was going off of what I remembered from the talk on Monday.

</comment></comment></comment><comment><USER9> Those tens of billions of dollars investments baffle me. I'm relatively well- versed in technologies involved as well as their r&d efforts, I understand construction parameters for fabs.. but I still can't understand how can setting up a production process cost such an extraordinary amount of cash.

Also makes me think are chips (any smaller transistor scale, for arbitrary amount of small) out of reach for DIY fabrications and smaller startups?

edit: I did stumble upon few youtubers doing their own chips with vacuum plasma chambers and DIY lithography and whatnots. It strikes me odd that there aren't more of 'hack' attempts at DIY chips. FPGAs and software is all fine and dandy, but this really seems like a fun and great challenge.

<comment><USER10> the equipment...when you spend 50million or so on a litho scanner and the associated track, plumb in the chemicals, the support equipment for the chemicals, etc. it adds up fast. Remember they aren't setting up one line they are setting up many because the economics only work at scale. If I need to do 40+ litho layers with 60k wsw you need probably a dozen or more litho tool sets. That alone is over a billion dollars.

<comment><USER9> You're right. That's what I haven't considered! Something like an offset printing press. You can do all four (or more) layers with only one machine/press, but most machines have 4 layers/presses inside them in order to expedite production.

<comment><USER10> If you forgive the shameless self-promotion, I did a talk on the scale and economics and so forth a while back you might find interesting: [https://www.youtube.com/watch?v=NGFhc8R_uO4](https://www.youtube.com/watch?v=NGFhc8R_uO4) It has been posted on HN a few times before...the technology still puts a tingle in my spine

[insert critcism of how I need to be a better public speaker here]

<comment><USER9> By the powers bestowed upon me by hacker news user account creation, I absolve you from your sin of shameless self-promotion. Seriously though, I am as remote as possible from that industry (film and TV content creation!), but it absolutely fascinates me. I devour all and every article and paper (that I can understand) about this and HPC as well. You did well in video, we should do a documentary together on this theme!

<comment><USER10> email me...tmf7811 on gmail.

</comment></comment></comment></comment></comment></comment><comment><USER11> This is really cool. It proves something that anyone with a reasonable amount of knowledge about hardware and software should understand intuitively; that the ultimate trust for any computing platform is put in the hands of not the hardware designers, but the actual hardware manufacturer. That doesn't mean Apple, that means TSMC or some other foundry.

It's great that is proven, though, and not just intuited. This looks like some stellar work by the team.

<comment><USER12> I agree that this is a really interesting exploit, but it requires a lot of expensive part-specific work to get it right, as well as the assumption that the foundry does their own masks. Of course, our attacker could work for the mask shop instead, but then he has to do it exactly right the first time, which makes it even trickier. This is all to say that, when we see this attack in the wild, somebody with very deep pockets will have been responsible.

<comment><USER11> If you have a bad nation state actor wanting these exploits in place I don't think it's beyond reason that they would go to any steps. Imagine they could get a backdoor into every smartphone on the market by getting TSMC to manufacture chips with exploits in them. You really think there's any feasible but difficult steps that would stop them from doing this?

</comment></comment></comment><comment><USER13> After reading the other front page article on a possible new Physics force...

Ancient people thought everyday objects had powerful spirits in them or controlling them, subject to whims. Modern science showed almost everything is emergent complexity of very simple rules.

Now, technologists are replacing the gods of old, creating powerful nigh invisible "spirits" that live inside everyday object: radios and batteries and computer chips with microscopic logic, the tiniest pebbles or shreds of fabric could be watching you and talking to you, controlled by an automated or remote maliciously force.

</comment><comment><USER14> Ken proved himself right 32 years ago, this is just another variation.

<comment><USER3> Thompson didn't invent or prove anything. He based his work off MULTICS Security Evaluation where Karger et al invented the compiler attack and submitted it in the report. See p 17:

[https://www.acsac.org/2002/papers/classic-multics- orig.pdf](https://www.acsac.org/2002/papers/classic-multics-orig.pdf)

They invented many other attacks and risk areas you see today despite INFOSEC not existing back then. This was one 2 or 3 pentests that started the hacking part of our field.

<comment><USER14> I never said invented, but he did execute it successfully on a scale that may be larger than he admits.

</comment></comment></comment><comment><USER15> I find that fascinating! I have a faint recollection that one of bugs on the 80186 (the high integration 8086 that Intel built) was due to cross coupled noise from the metal layer to one of the register bits and the fix was to reroute one of the signals in polysilicon instead. I would never have considered that sort of effect as being exploitable as a back door.

</comment><comment><USER16> Time to start building discrete transistor CPUs? This discrete 6502 project was posted here recently:

[https://news.ycombinator.com/item?id=11703596](https://news.ycombinator.com/item?id=11703596)

It's far too slow for most uses, but that's mostly because NMOS logic doesn't handle the high capacitance well. NMOS logic uses MOSFETs as constantly enabled pull-up resistors, so they can't be very strong pull-ups or power consumption would be too high. I expect a CMOS design would be able to run much faster, especially with high voltage and the smallest transistors available.

Individual transistors can be sampled and destructively tested, and the order they are placed can be randomized to make it harder to subvert the circuit by replacing them with microcontrollers.

That leaves RAM, which is far too bulky to build from discrete transistors. But you could encrypt the ram in hardware, and mirror it across multiple chips each encrypted with different keys, and check they all read back the same once decrypted. The same could be done with mass storage devices. EDIT -- on second thoughts this will not defend against replay attacks within the storage device. I'm not sure if reliable detection of a malicious storage device is even possible without having some known good storage.

<comment><USER3> Hardware guru that taught me warned of another risk: you can't uninvent an advance tech once it's invented. The point being such techniques assume you can inspect what's going on because you're using components you know do only X. Yet, as chips get nanoscale, you can actually embed entire CPU's and RF systems in between larger components on others that are invisible to visual inspection and might not show up in black box testing. You can try to act like those nodes and their risks don't exist but subversives can still use them against you.

The simple method here might be swapping more discrete chips or components out for others that are those components plus entire SOC's. Then, once they know your configuration, they hit you. Or they tell each to leak on a different frequency or whatever all at once with them figuring it out later. All kinds of crazy stuff is possible.

So, just make sure you buy older stuff under different names with cash at unusual locations. Have proxies do it for you with legit excuses. Then, use multiple systems with voter logic. Tends to work out better than alternatives. Usability issues for sure, though. :)

</comment></comment><comment><USER17> Except... [http://www.dwheeler.com/trusting- trust/](http://www.dwheeler.com/trusting-trust/)

I think 'nickpsecurity has previously made some interesting remarks on the issue at lower levels...

<comment><USER18> Can you explain this a bit more? I've only read both the abstracts but if I understand right your link deals with compiler-level attacks but the OP deals with hardware-level attacks ("fabrication-time attacker").

<comment><USER17> It was basically a comment on the submission title -- Ken Thompson's famous attack has a counter that's been known about for a while. For the submission itself it's not as related as other commenters note they don't provide a way for the exploit to propagate like KT's attack. I'll have to read the full paper later but I wonder if it references [https://www.usenix.org/legacy/event/leet08/tech/full_papers/...](https://www.usenix.org/legacy/event/leet08/tech/full_papers/king/king_html/)

</comment></comment></comment><comment><USER18> For those who are also wondering, this is a preprint. [1]

Kaiyuan Yang, Matthew Hicks, Qing Dong, Todd Austin, and Dennis Sylvester, "A2: Analog Malicious Hardware", Proceedings of the IEEE Symposium on Security and Privacy (Oakland), to appear May 2016.

[1] [http://www.impedimenttoprogress.com/publications/](http://www.impedimenttoprogress.com/publications/)

</comment><comment><USER19> This isn't _quite_ the same thing -- to be completely analogous, we'd need the fabricator to also recognize that it was fabricating another fabricator, and then change _THAT_ generated fabricator to have the same intervention but only in the case that we care about compromising.

</comment><comment><USER20> "Analog malicious hardware" made me think of [https://en.wikipedia.org/wiki/The_Thing_(listening_device)](https://en.wikipedia.org/wiki/The_Thing_\(listening_device\)) that snooped on americans for seven years...

</comment><comment><USER21> Could one defense be to design the chip to not have any empty space? In other words, fill in any empty area with test circuitry such that you couldn't tell which areas were actually used and which weren't.

<comment><USER7> It would be very complex to fill the entire chip with cells---whose functionality mattered, otherwise we the attacker could replace them without the defender noticing---and get them wired in to the rest of the chip. There is a tradeoff between area utilization and routability of the design: it gets exponentially more difficult to route a design as its area utilization increases. This is why most commercial chips have 20% to 30% of free space in the layout.

Even worse, in many commercial chips, there are spare cells to allow for cheap low-level patching. The attacker can just swap out one of these cells with their own and have an attack that only modifies a single cell.

</comment></comment><comment><USER3> Called it! It was No 7 on a low-ranked comment [1], the third option in link at bottom of another [2] for standard cells (knew they'd get messed with), and mentioned repeatedly on Schneier's blog. Guy I learned risk from said he actively countered analog poisoning of 3rd party I.P. his company licensed. He said he was constantly finding it, mostly for I.P. obfuscation but sometimes more nefarious. Here's one of his observations on subverting crypto processors with digital or analog additions:

"Controlling bits like the Carry flag is essential to the security of all crypto algorithms (techniques like DPA and "timing attacks" try to discover this information by observing the operation of the CPU) if you have a hardware way to transfer just this ONE bit, than most crypto available todays is useless. "

He kept pointing out, probably from experience, that you could just modify a bit here, an MMU there, or add RF circuit to bypass plenty of protections. Nobody would even notice analog additions because "their digital tools can't see it." It would take careful reverse engineering. Old risk already deployed into production re-invented in a neat, new paper with new technique.

Honestly, I originally got the subversion idea from the MULTICS Security Evaluation [3] [4]. Schell and Karger, _not Thompson_ , should get credit for first attack like this as they introduced software that kept poking at a memory location until the MMU experienced an intermittent failure. They got in since software people assumed HW always worked. They also invented basis of "Thompson Attack" (see note below). So, I predicted HW trojans sitting on MMU, IOMMU, PCI, TRNG's, and some other things using non-standard circuits that nonetheless preserve timing, etc. So, a few years ahead on this one.

Note: Karger and Schell also invented in same project the idea of subverting a PL/I compiler to insert malicious code into stuff compiled with it, including the OS. Thompson read that and expanded on it with Trusting Trust. Now, Karger and Schell attack is called the "Thompson Attack." Nah, the founders of INFOSEC thought of that one first, too. Take that Thompson fanboys! :P

[1] [https://news.ycombinator.com/item?id=10906999](https://news.ycombinator.com/item?id=10906999)

[2] [https://news.ycombinator.com/item?id=10468624](https://news.ycombinator.com/item?id=10468624)

[3] [https://www.acsac.org/2002/papers/classic-multics- orig.pdf](https://www.acsac.org/2002/papers/classic-multics-orig.pdf)

[4] [https://www.acsac.org/2002/papers/classic- multics.pdf](https://www.acsac.org/2002/papers/classic-multics.pdf)

<comment><USER22> AFAIK Ken invented the procedure of quining the compiler backdoor to remove it from the compiler source code.

<comment><USER3> Ok, it's not clear here as I read each paper. Here's what each one says. Multics paper first. Already has a discussion of source vs object. Source is more visible but survives recompilations. That's the backdrop here. Here's quote:

"It was noted above that while object code trap doors are invisible, they are vulnerable to recompilations. The compiler (or assembler) trap door is inserted to permit object code trap doors to survive even a complete recompilation of the entire system. In Multics, most of the ring 0 supervisor is written in PL/I. A penetrator could insert a trap door in the PL/I compiler to note when it is compiling a ring 0 module. Then the compiler would insert an object code trap door in the ring 0 module without listing the code in the listing. Since the PL/I compiler is itself written in PL/I, the trap door can maintain itself, even when the compiler is recompiled."

Given backdrop, hard to say whether they put it in the source or object code of the compiler. It's ambiguous: "since PL/I compiler is written in PL/I." Either it's because they have backdoor in its source code or because the backdoored, object code is the PL/I compiler that will be used to re-compile any PL/I source. Next paragraph indicates they insert the trapdoor in another routine using object code that closely matches that produced from PL/I source. So, I'm assuming... with some uncertainty... that they bugged the object code of PL/I compiler to add trapdoor to it and all executables on compiles. With nothing left in the source.

Then, Thompson paper simply says:

"First we compile the modified source with teh normal C compiler to produce a bugged binary. We install this binary as the official C. We can now remove the bugs from the source of teh compiler and the new binary will reinsert the bugs whenever it is compiled. Of course, the login command will remain bugged with no trace in source anywhere."

Sounds like they're doing the same thing except MULTICS attack uses assembly code directly. They might have coded it in PL/I first, then directly inputed the code. That would make both attacks equal. Who knows. That they each bug the compiler at object level with no source-level evidence seems accurate. In that case, Thompson attack is MULTICS PL/I attack applied to C with clear use of C for subversion artifact.

<comment><USER22> You're right! I imagine Karger and Schell wrote their backdoor in PL/I too — it seems like it would just be a lot easier that way.

</comment></comment></comment></comment><comment><USER23> Good for Ken!! Who? lol

<comment><USER24> You use things he worked on everyday, one of them is UTF-8. He also designed and implemented UNIX. He was creator of B language, thanks to which we have C language. He also worked on Golang and Plan9.

<comment><USER25> And even wider, almost everything in the modern world was invented at Bell Labs.

<comment><USER26> Or Xerox PARC.

<comment><USER25> Not even close to Bell-Labs.

<comment><USER25> Sorry downvoter but you really have no idea how much more Bell-Labs has done.

The Simplex algorithm, the transistor, C and C++, the R programming language, the ccd, the mobile phone...

Just some from the top of my head</comment></comment></comment></comment></comment></comment>


How the right kind of trust made me $60,000 - <AUTHOR> https://mightyintrovert.com/trust/ <comment><USER2> This page has some obnoxious scrollbar-breaking behaviour. Why do people do that?

Even if you think you know better than browser developers about how the scrollbar should work, shouldn't it at least be _consistent_? Even if you think this is the "correct" way to work, isn't it better for it to be broken everywhere in a predictable way than to be _occasionally_ correct and impossible to predict?

</comment><comment><USER3> unenjoyable scroll/10\. Did not read</comment>


Google-refine - Project Hosting on Google Code - <AUTHOR> http://code.google.com/p/google-refine/ <comment><USER2> Thanks, this would be great for analyzing and correcting large machine learning datasets. Little things ruining a trained model... no more!</comment>


Programmers are fucking lazy - <AUTHOR> http://swizec.com/blog/programmers-are-fucking-lazy/swizec/2648

<comment><USER2> _It's a common joke that a programmer would rather spend a week making a bash script than copy paste the same file twice and be done with it in two minutes._

isn't that the antithesis of laziness? spending more time to do something "right" than it would normally take to do?

efficiency is not laziness, it's efficiency.

</comment><comment><USER3> I object to the semantics of this discussion. The argument seems to be:

1\. Automating things is lazy

2\. Laziness is bad

3\. Therefore, automating things is bad.

Both 1 & 2 are true _in a sense_ but not in _the same sense_ , so the result doesn't follow.

<comment><AUTHOR> Actually if you read the whole post it's more like:

1\. Programmers are lazy 2\. So they automate stuff 3\. Why are we even so lazy? 4\. Does hard work even bring benefits?

</comment></comment><comment><USER4> I'm assuming the 500 error is a meta statement. Brilliantly played.

<comment><AUTHOR> Apparently my caching somehow got disabled ...

</comment></comment><comment><USER5> Yes, yes we are. A programmer who is not a /little/ lazy is a bad thing.

</comment><comment><USER6> There are lazy programmers and there are "lazy" programmers.

</comment><comment><USER7> > Most importantly, hard work makes you stupid.

I'll respond to that when the author has a real job.

<comment><AUTHOR> I've had a real job and it always felt attacking problems with bruteforce (ie. something not working? add moar manpower!) just made things worse.

As in, it's better to step away and go for a walk, than to pound away furiously at the keyboard.

<comment><USER7> The article discloses many naive misconceptions about the world. Revisit it in ten years or so and maybe by then you'll have changed your approach to unsupported generalizations.</comment></comment></comment>


Ask HN: How to deal with being idea rich, but time poor? - <AUTHOR>

I really struggle with having a lot of ideas, and while I'm very grateful that I have this problem it can be pretty frustrating.  They certainly aren't all good ideas, but some probably are (there's a couple that I think are crackers).<p>The question is, how do you deal with the situation of having many ideas but only so much time (and/or money) to invest in exploring the potential of those ideas? <comment><USER2> Find people who can execute your ideas (or part there of) for you. Think of your time as a finite resource, which it is.

You have two options:

1\. Do less of your ideas by focusing on what is most important.

2\. Use someone else time

Not everyone can be a specialist at everything. Know what you are good at then consider outsourcing what you are not so good at to someone who is better than you. They will do a better job and most likely get the job done faster too.

Though this is assuming your ideas are worth pursuing.

EDIT: Remember you don't only have to outsource things such as programming or graphic design. What about things such as book keeping or house keeping.

</comment><comment><USER3> This article is a bit pithy but true. Ideas aren't worth that much.

[http://www.oreillynet.com/onlamp/blog/2005/08/ideas_are_just...](http://www.oreillynet.com/onlamp/blog/2005/08/ideas_are_just_a_multiplier_of.html)

My advice is do something that you would like your mother or father to excitedly tell their friends about (assuming they are still around).

<comment><AUTHOR> I think that article does make a nice clear point, and while the ideas aren't worth that much in some regard, being a multiplicative factor is a pretty big deal.

</comment></comment><comment><USER4> I am in the same boat ... my plan is to work on the idea I am most passionate about. Then when I have a nice revenue generating business, I can hire developers to make my other ideas happen.

</comment><comment><USER5> Well ask yourself why you have so little time. Are you passionate enough about your ideas that you feel what you're doing instead isn't exciting/worth it?

If you have ideas but you feel your time is better spent doing your work/school/whatever, then get one super-compelling idea and follow through!

<comment><AUTHOR> That's a fair point, but the point is I am already executing one of the things that I am passionate about. So following through is happening in that regard.

But in the midst of that execution, there are other ideas that probably have a genuine shot of generating some revenue. So the question is how to either:

A - Prevent yourself getting distracted by that idea. Do you share it or just sit on it?

B - Seriously evaluate whether it is worth either changing direction or finding ways to execute both (or more) ideas in parallel.

Given that we have the phrase "serial entrepreneur" (which I am not a big fan of honestly) rather than "parallel entrepreneur" I'm guessing a one thing at a time approach is the best way to go ;)</comment></comment>


Ask HN: Ethics of selling domain to prospective client? - <AUTHOR>

I recently petitioned a local business to freelance design/develop a site for them. Ahead of our first meeting, I did some domain searching and found a great domain name (it's a domain hack).<p>I feel that the domain could be worth something on its own, but I'm not sure that it's ethical at this point to try to sell it to them. Do I give it to them? Give them the option to purchase it (cost?)? Solicit to a larger brand? sit on it? I would've never have found it if they didn't appear interested in having an online presence. <comment><USER2> I'm a big fan of transparency. I'd explain the situation and let them know that you believe what you now own is valuable, but that you're happy to give them the first rights to (whether they hire you or not).

Could offer it as a deal sweetener if they do work with you, but also just offer to sell it at a reasonable price if not. Truth is today it's prob not much more valuable than what you paid for it, otherwise you wouldn't have been able to get at that price.</comment>


Intel's Next Unit of Computing HTPC and Raspberry Pi Compared [video] - <AUTHOR> http://www.maximumpc.com/article/features/intels_next_unit_computing_htpc_and_raspberry_pi_compared_video321

<comment><USER2> The NUC is a neat little machine for general purpose computing.

</comment><comment><USER3> I want one!</comment>


Bitcoin now trading over $70. Nuts - <AUTHOR> http://bitcoinity.org/markets

<comment><USER2> Don't worry. This number will be way down shortly.</comment>


The (very) uneven distribution of DNS root servers on the Internet - <AUTHOR> http://royal.pingdom.com/2012/05/07/the-very-uneven-distribution-of-dns-root-servers-on-the-internet/

<comment><USER2> > We think that the root server distribution should take regional Internet > population size into consideration, so we hope the people in charge read > this and act accordingly as the Internet continues to grow.

This is really the sum of their analysis? They "think"? The "people in charge"? No analysis of actual performance? No discussion of the fact that caching resolvers mean that most queries never hit the root servers? No discussion of the fact that this is just the distribution of sites that the 13 root server IP addresses map to via anycast, and that each site will have many actual physical machines behind that IP address?

How about doing some measurement to see if there is any problem? Some analysis that discusses what effects this might have? Some discussion of who those "people in charge" are, and what it's suggested that the should do?

This kind of drivel really makes me which that Hacker News had a downvote button for articles.

</comment><comment><USER3> "you can look directly at how many Internet users there are for each root server site in a region. The lower the number, the better." [citation needed]?

I was under the impression that a diverse geographical distribution (to defend against localized natural disasters and targeted attacks) was the primary goal, rather than a concentration of DNS servers in areas of higher internet population.

</comment><comment><USER4> There apparently is just one root server for all of Russia, and that singlehandedly is responsible for these numbers. (Edit: 4 actually.)

<http://www.root-servers.org/>

And Canada only has root servers on the eastern side of the county, and none whatsoever in the west.

But does it really matter? Aren't they just used when there is nothing cached?

The author makes it seem like "the powers that be" have some kind of conspiracy, but it's really up to the local ISP's to devote the resources to run a server, there is no one in charge - you just have to do it and then ask to be added to the list.

<comment><USER5> There's far more than one. Root-servers.org shows _clusters_ of root servers, not single physical boxes. Even then there's instances of at least the F, J, K and L roots in Russia (3 of them in Moscow; one in Novosibirsk).

But in any case, the fact that his source does not show individual servers makes the numbers he is giving pointless. It's also meaningless to show geography, when what matters is topology.

Having ten times as many root servers in Asia, for example, would be pointless if they're spread out on networks that have poor connections too each other and roundtrip times for most users don't improve.

It's quite possible, or likely, that there are imbalances that matter, but his numbers don't show it.

<comment><USER6> I'd be interested to know more about the topology of the UK domestic internet, is there anywhere where one can find such information?

</comment></comment></comment><comment><USER7> Quote:

        You can see how the world is divided in two parts here:
        Above average (a bad thing in this case): South America, Middle East, Africa, Asia.
        Below average (a good thing in this case): Europe, North America, Oceania.

Just showing such an obvious division, without commenting on it (industrial vs. post-industrial, "developed" vs. ex-colonies, Western vs. everything-else, etc.) seems almost absurd. There's a thing to be said about the way and the ways the US and Europe control the net, it has been said elsewhere.

</comment><comment><USER8> why is this at all important?

it's not as if the end user ever contacts the root nameservers, their ISPs nameserver does, and it'll cache the rather limited set of results for hours.

<comment><USER9> It doesn't matter at all, that's why this article is stupid.

</comment></comment><comment><USER10> Never mind that. Look at how they are distributed in terms of IP (v4) addresses.

22.214.171.124 18.104.22.168 22.214.171.124 188.8.131.52 184.108.40.206 22.214.171.124 188.8.131.52 188.8.131.52 220.127.116.11 188.8.131.52 126.96.36.199 126.96.36.199 126.96.36.199

Back off to the /3 level. All but two of them (22.214.171.124 and 18.104.22.168) are in 192.0.0.0/3.

Guess what happens if someone fat-fingers a sync connection and adds one with a netmask of /3 instead of /30? If it's in the right part of the net, you lose a whole bunch of stuff, but two of the roots keep working.

This makes for some very interesting troubleshooting. I witnessed this once, and it was bizarre: <http://rachelbythebay.com/w/2012/01/08/blackhole/>

I wonder what else might be tripped up by this kind of aggregation gone wrong? It seems like spreading them out some more could be useful in some really bad situations.

Edit: also, look at the /4 and /5 level and so on. Most of them have a _lot_ in common, actually.

</comment><comment><USER11> Interesting that Pingdom would choose to complain about a lack of DNS servers in these regions when they themselves do not offer Pingdom probes in any of these regions less represented by DNS roots

If I knew of a similar offering with more global reach I would switch in an instant.

</comment><comment><USER6> Am I correct in thinking that the root servers only contain the NS addresses for the TLDs? So, in theory, a recursive DNS resolver only has to contact them once per TLD every 6 hours or so?

<comment><USER12> Yes. You can see the full lookup path with "dig yourdomain.com +trace" if you are interested

</comment></comment><comment><USER13> pie charts are the worst charts

<comment><USER6> Devil's advocate says Why?

<comment><USER14> Because humans are much worse at estimating the relative size of angles than of lengths. See also:

[http://en.wikipedia.org/wiki/Pie_chart#Use.2C_effectiveness_...](http://en.wikipedia.org/wiki/Pie_chart#Use.2C_effectiveness_and_visual_perception)

Of course, the very worst are 3D pie charts, as the angles are distorted.</comment></comment></comment>


Circular loom weaves carbon fibre pillars for Toyota Lexus - <AUTHOR> http://jalopnik.com/5393505/circular-loom-weaves-lexus-lfa-carbon-a+pillar

<comment><USER2> Google tells us there are more than two circular looms in the world

[http://www.google.com/search?hl=en&source=hp&q=%22ci...](http://www.google.com/search?hl=en&source=hp&q=%22circular+loom%22&btnG=Google+Search)

What is rare about it?

<comment><USER3> From the video, it appears that this loom has been specially constructed to keep the carbon fiber ribbon properly oriented as the spools move around.

</comment></comment><comment><USER4> This article is interesting in that it shows the minimum amount of information required for something to be called an "article". Any less, and it would actually start to suck in nearby information and eventually explode.

<comment><USER5> The article about the car itself has substance: <http://jalopnik.com/5388538/2011-lexus-lfa-first-drive>

<comment><USER6> Thanks for the link. I never truly appreciated how much hacking and pure engineering there was going on in the car market.

</comment></comment></comment><comment><USER7> Toyota has had a long history with circular looms. Sakichi Toyoda invented the circular loom in 1906. The profits from his automatic loom business were used to start his son's automobile manufacturing company.

</comment><comment><USER8> In other news, rare space station orbits the Earth. Is 'rare' really the best word for something like this?

</comment><comment><USER9> Aren't socks and pantyhose woven on circular looms?

<comment><USER10> And the braid of coax cables.

</comment></comment><comment><USER11> Any idea how big the resulting weaved product is? I am having difficulty discerning scale....</comment>


David Sacks: Is Your Passion Your Job? - <AUTHOR> http://tentblogger.com/david-sacks/

<comment><USER2> This is a funny one. I love designing and coding - it is my passion. I do it for my employer, but my passion is not the subject matter or business model of my employer. I have a lot more excitement working on my own coding projects at home. What is my passion though? The coding or the business?</comment>


Show HN: Vidyard Space Academy - HQ for video marketing learning - <AUTHOR> http://www.vidyard.com/space-academy/

<comment><AUTHOR> Can you find all the easter eggs?</comment>


High Performance JS heatmaps - <AUTHOR> http://codeflow.org/entries/2013/feb/04/high-performance-js-heatmaps/

<comment><USER2> Interesting. I'd be interested to see a version that uses WebSockets to transfer the data points and draw it on another screen (e.g. analytics, see how users interact in realtime).

<comment><USER3> there's no need for that to be part of the library though or am i missing things?

<comment><USER4> Nope. That's the idea. The library gives you a high performance drawing engine. What you feed it is up to the respective use-case.

</comment></comment></comment><comment><USER5> It only works for me once after I refresh the page. If I click overlay the data stops persisting. A hard refresh allows it to work again. Ubuntu 12.10 Firefox 18.0.1

<comment><USER4> That's an interesting bug.

\- Does it work in chrome? (please state chrome version)

\- Do you have any error on the javascript console (ctrl+shift+k in firefox, ctrl+shift+j in chrome).

\- What GPU/driver are you using?

\- Please paste the content of about:gpu in chrome, and about:support (the graphics section) in Firefox

<comment><USER5> Hi, I can't test it in chrome as WebGL isn't supported.

Firefox graphics: <http://pastebin.com/XVdypYVq>

Relevant error messages: <http://pastebin.com/PvKVwWFi> (These are repeated. I missed them the first time round because they were actually warnings rather than errors.

Hardware: <http://pastebin.com/x7Jh025T>

<comment><USER6> What version of chrome are you using?

      Google Chrome – WebGL has been enabled on all platforms that have a capable graphics card with updated drivers since version 9.[14] Google Chrome 13.0 and newer versions use Cross-origin resource sharing (CORS) to control all WebGL cross-domain textures.[15]

Source: <http://en.wikipedia.org/wiki/WebGL>

<comment><USER5> >>> "capable graphics card with updated drivers"

I think that's the issue with this version of Ubuntu. It's a strange hybrid graphics setup.

</comment></comment></comment></comment></comment><comment><USER7> I get the same red "hotspot" from moving my mouse around, or scrolling with my cursor in one place. Is there a way to tell the difference with this?</comment>


Ask HN: Freesomething.com with a paid plan? - le-mark So I have a service I'm thinking of implementing, and I have the domain name freesomething.com reserved. My goal is to let users do something they may want to (upsell from the free service), by paying an annual or monthly fee (haven't decided yet).
Question is; freesomething.com with an upsell? Is this too blatantly a bait and switch? <comment><AUTHOR> Random advice from the internet:

1\. Anchoring the value of the product to $0 may limit the ceiling on possible prices.

2\. Producing a free version with upgrades creates an incentive to make something that is deliberately bad to use because it is easier to make the free version suck than to add functionality to the paid version that convinces people to pay.

3\. _free_ anything.com is probably a lousy name for anything that is intended to be good.

Good luck.</comment>