Ask HN: Stay or Leave? SoundCloud has deferred salary reviews - throwaway-sc SoundCloud has deferred salary reviews until the next funding round is complete.
Over the last few years, travel between offices has been restricted to business critical travel only. More expensive food items have started disappearing from our kitchen.
Employees used to get a small bottle of champagne on their birthdays & employment anniversaries. This doesn't happen anymore.
All of the above feels reasonable.
However, they recently announced that the July 1 salary review that everyone was promised will be deferred. There is no information about back pay or a date about when the next salary review will happen.
Salary increases are predicated on the next round of funding. They anticipate that the round will close over the next couple of months, if not weeks.
I'm sure that everyone here will have been in similar situations before.
What did you do? And, how did you decide whether to continue working or start looking for other opportunities.
Also, what other arrangements, we, as employees should consider putting forward.
Example: I'd be okay working 4 days weeks, until the salary review is complete.
What questions should we ask our founders that'll help us build confidence that the company's financials are in a reasonable shape? <comment><AUTHOR> > _However, they recently announced that the July 1 salary review that > everyone was promised will be deferred._

The company is obviously facing a cash crunch, but to me this is the key bit and why I would start shopping my resume if I were in your shoes. Management will have known about the cash crunch or should at least have anticipated it was a possibility for a while now, and should not have set expectations that they were unlikely to meet. The rest of the actions look like prudent cost- cutting measures, but if you can't trust that management will honor their promises today what guarantees do you have that they will do so in the future?

As a non-founder (i.e. very low equity upside), it's not for you to make compromises to keep their high-upside baby alive. Put your own interests first and find an employer that doesn't require you to subsidize their growth.

Also, if I had a dollar for every time a founder has told me that funding is coming in "months, if not weeks" .... well, you can guess the rest.

<comment><USER2> Key aspect of becoming a manager is making promises you may or may not keep. They cost you nothing, and when they come due it's the employees who suffer.

<comment><USER3> A good manager manages expectations when reality changes.

<comment><USER2> A great manager doesn't make promises he can't keep.

<comment><USER4> Sometimes, a great manager needs to speculate and do things at uncertainty and risk, while motivating their subordinates. They are clearly working to save the company in OPs case.

<comment><USER2> Ah yes, with a late June notification.

Maybe communicate earlier hmmm?

That would be better management rather than hold my beer I'll probably close this round while I risk the livelihoods and futures of my rank and file.

<comment><USER3> But alas, communicating earlier is when things have the most uncertainty. I have had great managers that set expectations around how much uncertainty and change is built-in to what they're communicating, but in general, the earlier they share something, the more likely it is to not be certain yet, still it's often useful information to have.

(I'm only speaking in general, not specific to this situation.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> There's a quote: "If you owe the bank $100, you've got a problem. If you owe the bank $100M, the bank has a problem."

Here's a tweaked version. If you can't get a raise, you have a problem. If a company can't pay its employees market rate, the company has a problem.

I pretty firmly believe that if money is tight at a company, paying fewer people more money (and setting higher expectations around performance) is the way to go. Otherwise you end up with top talent leaving and those left feel entitled to not give 100% (because they aren't being paid 100%).

</comment><comment><USER6> Posting this with the company name is a little indiscreet.

If it was my company and I was having a bump in the road with funding I would hope for it not to immediately hit the front page of HN for the sake of a few weeks.

Soundcloud actually have a good reputation as an employer so maybe they deserve a small benefit of the doubt? I get the mercenary attitude but it's only potentially a few weeks or months for an incremental pay rise, not as if they are going under....

I suspect this won't be a popular point of view but I like to think company and employee owe each other at least a modicum of loyalty.

<comment><USER7> The OP is anonymous. Are there any other SoundCloud employees willing to stand up and confirm these accusations?

<comment><USER8> That would make it even worse.

</comment></comment></comment><comment><USER9> You don't lose anything by starting to look at alternatives. You don't have to do that full time either. But if you're uncertain about the future, while still holding a paying job, this is the perfect time to refresh the CV, request old references, subscribe to some job ad feeds.

You can easily send an application a week or two to places you find really interesting without the "need money for food" feeling.

<comment><USER2> Strongly concur.

Also make this a yearly habit, so you stay on the ball, know where the market is at, and become comfortable leaving at a moment's notice to avoid this life changing anxiety you might be feeling.

Once you do it regularly, it's no big deal. Companies hire and fire dozens of people a year, it shouldn't be that different for you.

</comment></comment><comment><USER10> Maybe this makes me the devil's advocate here, but why would you suddenly only work 4 days a week?

I assume you have a valid contract that says you work X hours for Y amount, what makes you think you're not bound to that just because you don't get to talk about a possible (!) raise?

It's up to you if you interpret the company's behaviour as a red flag and leave, but reducing your working hours because you don't get your regular fix of more money seems like a sense of entitlement to me.

As a side note, your post would have worked just as well without publicly shaming your employer.

(I am not affiliated with SoundCloud, except for the coincidence that one of my previous companies used to share an office with them.)

<comment><USER11> I think he is not considering working only 4 days a week unliterary. He is considering negotiating working only 4 days a week instead of a pay rise.

He can try to negotiate whatever he wants, for example working only 4 hours per day, or 3 days a week, or ... but the employer is not forced to agree.

<comment><USER12> I think they are thinking of getting the pay rise, then work a four day week (and getting paid 80% of his increased salary) until the company can afford to pay them five days a week at the increased salary again.

</comment></comment></comment><comment><USER13> Well, businesses come and go. Start ups come and go faster. Nothing tragic will happen if you accept that. I am sure you will find a job if you keep things in perspective. It is just business.

However there is no reason to panic yet. It is likely they will raise again.

Meanwhile you can use your energy to prepare yourself. Get your resume and LinkedIn put together. Make sure your personal finances are secure and can handle 3-6 months with no income (standard advice for everyone). Start inquiring about what other companies would be worth working for.

If you have a plan to handle the downside risk, this will be less terrifying and more of a business like decision of the merits of staying or going.

Once you can feel safe walking away then you can negotiate a better structure if you want the extra time. It is important to have the walk away plan as your BATNA when negotiating.

<comment><USER2> This is the crux of negotiating. The person with more options has more power. There's really only one way to get a raise: pay me X or I walk. If yay, good, if nay, walk.

<comment> semi-extrinsic A subtle way to reinforce your words is drawing on the famous million-dollar Amdahl coffee cup:

[http://dealwhisperers.blogspot.com/2015/07/a-million- dollar-...](http://dealwhisperers.blogspot.com/2015/07/a-million-dollar- coffee-cup.html)

In this case, find a friend at Google/Apple/whatever and ask them if you can have some employee-only branded stuff.

</comment></comment></comment><comment><USER14> You don't have to make a big decision right away, but those are certainly signals that the decision may be made for you in the next few months if you are unlucky.

I'd certainly start the usual job-hunting process: updating my CV, mentioning to friends that I may be open to a new position, breaking out the ol' whiteboard for algorithm interview practice, going to meetups etc.

Also, prepare yourself for being laid-off, financially and mentally. It sucks, but it's the reality of startup life.

Don't worry about questioning the founders - it's their job to be upbeat and optimistic to get the best result for their startup, but it's your responsibility to look after your career. But that doesn't necessarily mean giving up the day job - hope for the best, prepare for the worst.

</comment><comment><USER15> This happens in a lot of companies, there are moments like this.

Also, nothing in your contract or offer letter would have said that the company would do a salary review every year.

When such a decision is made, companies are aware that what could happen, the way salary review is important for an employee, in equal measure it is important for the company too.

So if such a decision is made, they weighed in every thing, may be the fact also that, people might leave or they would look for another option.

And the company also knows that people who would have options are the good people, and no one wants to let go the good people and being left with average or above average people later, when the finances are sorted.

If you love what you do, stick with SoundCloud, it's just part of life and could happen anywhere.

PS: I have been through this once.

</comment><comment><USER16> I'm sorry to hear this. However...

 _> What questions should we ask our founders that'll help us build confidence that the company's financials are in a reasonable shape?_

... there is no question you can ask anyone that will help SoundCloud from burning money. Building confidence is just an act of faith, but this won't solve the underlying issue that SoundCloud does not have a viable business model, at least, with it's current corporate structure and business model. Don't get fooled by cheerleading VCs and CEOs, it's the oldest trick in the book. Always at the expense of employees and other stakeholders.

Many people join startup-land with the impression that these multi-(b)million, VC-funded companies are as safe as joining other old-school corporate companies which apparently are going to be disrupted by those very startups. Some other people joining startup-land are aware of this issue, and they will be the first to jump ship. All I can suggest is that you start looking for other opportunities, just in case. Do not get fixated on the back pay date, etc... just move on.

</comment><comment><USER17> The company is not profitable. Compensation is based on raising money. The financials are not in "good shape".You say they haven't received their next raise so consequently you either. If that concerns you, you should seek employment elsewhere.

</comment><comment><USER18> I went though a similar situation as an employee of a struggling start-up in the late 90s (dot com bubble 1.0). The founders (who by the way were wonderful people trying to make the best of a bad situation) decided that rather than start firing people, we'd all be taking half pay until we got funded, with promises to square everyone up eventually. I was young and dumb at the time so I, along with most, accepted this. A few months later, it went down to 1/4 pay, and we lost a few people but many stayed. Then, no more health insurance, at which point I finally bailed, and ended up unemployed for close to 6 months. I'm not sure what additional sacrifices the remaining employees had to accept, but I know it was much better for you the earlier you got out.

There's no way I'd make the same mistake today. No pay, no work. If I want to do work without being paid for it I'll get a hobby. While I might enjoy what I'm working on for you, YOUR dream is not my hobby. If I was a founder and the company went through tough times, I'd gladly work it for free because of the upside potential, but not as employee number 5 with 0.1% equity. No way, no how.

</comment><comment><USER19> Whether to stay or leave is obviously an important decision that can impact your career, and you may not want to base it on something as simple as the things you've mentioned here.

Of the things you mention, there seem to be two primary concerns.

One is that you definitely won't get a raise until a new round of funding comes in, and even if that funding does arrive I assume a raise is not a guarantee. We obviously aren't aware of your status or current and past performance. We also aren't aware of how much you are making now, and whether that amount is perhaps at the higher end or lower end of market rate already.

Two is that the company seems to be having at least some financial concerns.

You've also told us "they anticipate that the round will close over the next couple of months, if not weeks". That sounds optimistic. Being that the next salary review isn't for a couple weeks, it sounds as if this entire thing could be about nothing.

If you like your job enough where not getting a raise is OK for at least a few months, you should stay.

Beyond liking your job, are you still learning? Are you becoming better at what you do year after year by staying there? If the answer is "no" to either of those questions, you should probably leave regardless of salary raises and free champagne.

You should always be prepared for the worst, of course, so if an event (layoff, closure) were to happen you should always want to be in a position to start looking for work quickly.

I don't think suggesting a 4 day work week due to an incomplete salary review is a good option. That suggests that you may have anticipated a 20% raise, which isn't all that realistic. Making unrealistic demands of a cash-strapped company could be a quick way to a layoff.

I'm not sure at this point it's even relevant to ask the founders any questions. They seem to be forthcoming about things - it's not like they told you there will be no salary reviews the day before they were scheduled to happen, and if they have been trustworthy in the past you should have no reason to doubt their honesty now about their expected timeline for the next round to close.

When should one start looking for jobs? There are lots of reasons. If you are not fairly compensated for what you do and there are no other 'upsides' to your employment that make staying a good option. When you aren't learning or challenged by what you do. When you feel work is having a consistent negative impact on other parts of your life. When your company clearly makes decisions that do not consider the best interests of their employees.

Good luck to you.

<comment><USER20> This seems like the most thoughtful response. Salary cuts and freezes, while painful and unfortunate, do happen.

If you're financially stable, enjoying your time and continuing to learn, stick around. It may be an informative experience for the future. Plus, you may have opportunities to take on new projects if other employees leave.

In the background, it can't hurt to sharpen your resume and start talking to friends about their companies in the event that you do have to depart SoundCloud.

</comment></comment><comment><USER21> >Management will have known about the cash crunch or should at least have anticipated it was a possibility for a while now, and should not have set expectations that they were unlikely to meet.

As user bspn has said before, this is a bad sign. If the company has good financial management, they have seen this coming and chose to inform its employees very late (which is bad). If the company did not see it coming, they have bad financial management (which is also bad).

So yes, from an objective point of view it surely cannot hurt to start looking somewhere else.

</comment><comment><USER22> Soundcloud is out there for several years raising rounds with great expectations (meaning high valuations) and still hasn't found a business model yet. They've lost a lot of high class tech talent such as Peter Bourgon. Users stay stagnant, no exit in sight. If you have equity, count it as zero, as latest at the next round, liq prefs will be so high there won't be much left for employees. If I were you, I'd start looking in any case.

</comment><comment><USER23> This may sound too self-serving, but at the end of the day, you need to ensure your bottomline and well-being as well. You have responsibilities and the necessity to feed yourself (and those who may depend upon you) which involves in some ways some financial means, which would be perfectly alright that you start looking for places that may well use your skills/talent and compensate you accordingly.

</comment><comment><USER24> > I'm sure that everyone here will have been in similar situations before.

No, because I've only worked for businesses that make money.

<comment><USER2> Not the time or place.

<comment><USER24> What? Why not? The OP is explicitly asking for advice. My advice is to work for a business that makes money.

<comment><USER25> That's not the advice you gave. In fact you gave no advice, you simply proclaimed your superiority when it comes to past decision making, in that you only worked for companies that make money.

Your reply was intentionally snarky at best; obnoxiously insulting, demeaning and entirely non-useful at worst.

</comment></comment></comment></comment><comment><USER26> I think this might be evidence of the trend that is already occurring of IT companies (including startups) becoming more like companies in other industries. Which is to say, no champagne on your birthdays. I've noticed less lavishness. It was only a matter of time for the excitement of a whole new industry to begin to wear off. Many components of what is necessary to create a startup are becoming commodified by so called cloud offerings. There is less need to exert the same level of effort to retain your developers and a failure to do so has less consequence.

</comment><comment><USER27> If you're in London there's a cool company called FutureLearn, they are not actively advertising for new employees but you should check them out.

</comment><comment><USER28> I would probably send my resume over to recruiters and started looking at possible new opportunity while keeping your job.

It won't hurt to get a sense about the current job market, what interesting companies are hiring and what are salaries for positions with your level of experience.

You will find out whether you are underpaid or not (working for a startup you very likely are) and then decide based on that.

</comment><comment><USER29> tl;dr - if you believe in the company future and are willing to make that sacrifice, stay. if you don't, leave.

all startups have risks. i think that's something people overlook and they tend to think about the non-corporate atmosphere. anyways, that being said, i think it boils down to if you believe in the future of the company.

if you believe in the company's plan and you're willing to stick it out, great! imo, you should expect to hear an explanation of a company/product strategy _you_ believe has a chance.

if you don't believe it has a chance, well, i imagine you are sticking around for other personal or professional reasons. that could be because the opportunity you are getting (with specific tech, roles, etc) that you believe will help get you to where you want to be. it doesn't have to be about money.

if genuine promises were broken, that makes it tough to trust the folks that you are likely looking to for said strategy and plan.

</comment><comment><USER30> If you've been there a while it sounds like a good time to explore your options. You don't have to accept a new offer, but my experience is that it's probably going to get worse before it gets better. By the time they turn things around you could be making 20-30% more in a new role somewhere else.

</comment><comment><USER31> As a SoundCloud employee myself, I seriously wonder why you had to post the company name in your question. Also, I have not yet heard any official announcement of the regular salary review being deferred (which I would also consider a company habit more so than a made "promise").

</comment><comment><USER32> _What questions should we ask our founders that 'll help us build confidence that the company's financials are in reasonable shape?_

They aren't profitable and trying to get another round of funding. Only in the world of tech would that even be a question.

</comment><comment><USER33> One consideration is that is easier to get another job when you are still employed. So you have to weigh that against the other factors.

</comment><comment><USER34> They are keeping the machine running with "funding". Not actual profit?

so understand they have to be mindful/careful on frivolities.

If you gave a 100 million to the company, would you be annoyed if you found out about people getting small champagne bottles on their birthday? Would you be worried about your investment?

The days of these companies building floor to floor slides, and pampering adult children was never going to last. Whats there to worry about?

Saying all this of course, if the Mgmt are still getting these perks (wasting money), while the employees are not, id leave.

That ship will hit the rocks very soon, and hard. And of course, it wont be the first company to get done under with high budget pay/perks for low budget mgmt.

</comment><comment><USER35> As a founder of a startup, reading posts like that make me sad. In the imaginary world I live in , tough times a company is going through are triggering employees to give up their benefits and work harder to help the company recover.

Before my entrepreneurial journey I was working for a startup as a developer , I sticked there around for 5 years. For the last 3 years of the company existence I voluntarily gave up 20% of my salary and worked my ass off, simply because of being loyal and caring for the organization.

I work hard to create a sense of commitment and loyalty in my current start up, and during the recruiting process we pay a super attention to don't hire people who are looking for just money and are easy to abandon a ship during a crisis.

<comment><USER2> As an employee of a company, I'm paid salary for my time.

I'll take a pay cut for more equity if I want it, not for nothing.

If I take risk, I get rewarded with ownership, but if I'm paid cash, why do I honestly care what happens to a company.

This isn't some fairytale, we're all here to get paid, and employees aren't your buffer for bad cash flow management, that's the responsibility of owners and management.

<comment><USER36> Blaming management make it sound like you have never owned a company.

When cash is getting low two choices. Paycuts or firings. Pros and cons to both.

In the OP sounds like they arent that drastic yet. Just no raises. Seems not that dire all things considered.

<comment><USER2> Not holding management responsible makes me think you might have owned a company.

Let me spell out the compact that undergirds capitalism: employees don't take risks and are paid a constant stream of cash, owner's do take risk, and it is up to them to ensure there is enough capital buffer to meet their constant stream obligations. Employees do the work, management/owners ensure they get paid.

<comment><USER37> From what I read, throwaway-sc is being paid 100% of salary. They're just not being paid 103.5% of salary after a raise that's been deferred.

While there are certainly things to worry about, this is not a case of employees not being paid.

<comment><USER2> Funny thing is that salary changes with a raise, so technically they'd be < 100% of their promised benefits after July, and past that, who knows?</comment></comment></comment></comment></comment></comment>


Simple iPhone X Screenshot Mockups in CSS - <AUTHOR> https://github.com/twodayslate/iphone-mockup-css <comment><USER2> this would be an excellent wordpress plugin to add in images or iframed examples for mobile websites

<comment><AUTHOR> I'm thinking about doing just that!</comment></comment>


How I Work (revisit) - <AUTHOR> http://how-i-work.com/ <comment><AUTHOR> good for those learning to code or want to see how other programmers use their tools.</comment>


NSA Says It Can't Search Its Own Emails - <AUTHOR> http://www.propublica.org/article/nsa-says-it-cant-search-own-emails <comment><USER2> This is a pretty common strategy. Many companies have poor record retention and backup policies because it's in their best interest to "forget" the things they do. I know of large companies that limit email boxes to 50 MB partially because it forces deletion of old, possibly incriminating email. Government agencies are generally supposed to be better about this due to stuff like the Freedom of Information Act. I wonder if there's any teeth in the act for non- compliance like this?

<comment><USER3> > I know of large companies that limit email boxes to 50 MB partially because > it forces deletion of old, possibly incriminating email.

Fortunately it doesn't stop me from archiving locally. I've got emails from 2006 on my desktop machine. It is damn frustrating that my free gmail account is drastically less trouble to manage and search than my (probably expensive) corporate Exchange account.

<comment><USER4> Archiving my work email by forwarding to a personal email literally won me a decision against a former employer. When they can cut off your credentials in anticipation of firing you and they think it means you don't have access to those emails anymore, it's really satisfying to show up at the next hearing with clear proof that they've come down with a terminal case of foot-mouth syndrome.

</comment></comment></comment><comment><USER5> Who ever thought there could ( _could_ ) be a class war fought over privacy? Since this means _some_ Americans _do_ get official privacy protections (many also get to walk through TSA checkpoints unmolested), we now know there is now a two-tiered society in the US that has been engineered from the top down to create this state of affairs based on the 4th Amendment.

<comment><USER6> There's only one class war: the haves vs. the have nots. Everything else is a diversion.

<comment><USER5> I think there's something to be said for "have," historically referrering to tangible assets.

</comment></comment></comment><comment><USER7> Administration officials have also been caught using email addresses corresponding to non-persons in order to avoid exactly this sort of FOIA request.

[http://washingtonexaminer.com/watchdog-epa-grants-ethics- cyb...](http://washingtonexaminer.com/watchdog-epa-grants-ethics-cyber- security-certificates-to-fake-employee-richard-windsor/article/2530993)

</comment><comment><USER8> The obvious solution is for the NSA to spy on themselves, and then get a court order to "collect" the emails so they can read their own email. Legally.

<comment><USER9> Or switch to Gmail.

</comment></comment><comment><USER10> > thousands of trillions

If only there was a word for this.

<comment><USER11> There is. The word is 'quadrillion'.

<comment><USER12> or thousand billion, if you use the Long scale

[https://en.wikipedia.org/wiki/Long_and_short_scales](https://en.wikipedia.org/wiki/Long_and_short_scales)

<comment><USER13> Don't do that.

</comment></comment></comment></comment><comment><USER14> I'm not quite sure I get what the article's point is.

"Government agency lousy at complying with FOI request"? Well, it's poor but it's nothing new.

"Government agency does not use secret spy programme to search petabytes of communications traffic when responding to FOI requests"?

"Government agency responsible for many secrets successfully keeps its own email secret, even in response to FOI requests"?

Or is it really just the lousy click-bait of "They spy on everyone but can't give us a couple of emails?" (Wouldn't any journalist have gone to both the NSA (who have secrets and who will be difficult to get information out of) and the National Geographic Channel (who don't have secrets and who might be happy to pass on some email addresses or at least names)?)

<comment><USER4> I think the word "can't" is the operative term and here it's being used to describe technical infeasibility, not legal interpretations or anything else.

I can't explain it any better than that. (see how it works, I could if I actually strived to do better)

<comment><USER5> But is it legal for the NSA not to be able to search their own email?

<comment><USER4> That's not a conversation that I think can be concisely argued, nor is it the point of the article.

<comment><USER5> It is a question that is begged, if not a buried lede.

</comment></comment></comment></comment></comment><comment><USER15> "Are you kidding me? Our systems are rigged to search _everyone else 's_ emails, we never thought about our own!"

<comment><USER16> I assure you, they were thinking about their data the whole time.

</comment></comment><comment><USER17> Don't forget that the NSA is, when all is said and done, a Government organization with all the multitudinous layers of bureaucracy. I have no doubt that their electronic mail systems are under the control of an IT staff that is just as competent as any many of us deal with in the corporate world. But they have the added restrictions that secrecy entails: it would not surprise me if the server software is a decade old because that was the version they vetted way back when and it has never been updated.

The groups that work in the basement do not have such restrictions: or at least have very different restrictions. This dichotomy is not a surprise to anyone who thinks about it for any length of time.

</comment><comment><USER18> I'm having a hard time believing that the NSA trusts it's own people so much that they tie their own hands here. Unless it's a strategy to limit the amount of internal information any one person can access (?)

<comment><USER5> One might even reflect upon their statements about knowing every little step that Edward Snowden took, and exactly which documents he took with him, when the news of his leaks first broke.

</comment></comment><comment><USER19> If you want to maintain security over classified work, segmenting it and making it impossible to search the entire outfit in one shot makes sense.

</comment><comment><USER20> I guess they don't eat their own dog food.

</comment><comment><USER21> I know it's probably not for this reason, but certainly it'd be far more secure that way. If each mailbox is encrypted with a user-provider key, that'd provide the same end result.

</comment><comment><USER22> Anyone have a mirror? All I get is:

A Database Error Occurred Error Number: 1317

Query execution was interrupted

DELETE FROM exp_freeform_params WHERE entry_date < 1374619759

</comment><comment><USER23> "NSA Says" \-- ma answer to that -- and who believes in what NSA says?

<comment><USER24> "When in doubt, lie."

-Motto of every bureaucrat in history.</comment></comment>


Ask HN: Is there a name for this semi-common debugging occurrence? - <AUTHOR> I was building an app for chess on topologies other than just the plane, and in testing I couldn't figure out why the king was disallowed from making a certain move. It turned out it was functioning perfectly, and it was just hard for a human to notice the square was rightfully in danger. I feel like there should be a name for this phenomenon where you believe there to be a bug, spend a while searching for it, only to discover your program was actually functioning perfectly. <comment><USER2> I don't know of an existing name, but I'll invent one right now that works: it's a "Scheinbug".

"Schein-" as a prefix in German means something that appears to be one thing but isn't what it appears to be. Depending on context it can be analogous to the English "sham", but the later has a more negative, manipulative connotation, whereas the German "Schein-" connotes a more neutral and complex confusion of reality and appearance.

It's pronounced exactly like the English "shine", so say "shine-bug".

</comment><comment><USER3> PEBKAC? (Problem Exists Between Keyboard And Chair)

That's an old one we used to use...

<comment><USER2> Not the same thing. PEBKAC says the operator is the bug, not that the bug only exists in the mind of the operator.

<comment><USER4> Problem Exists Between Eyes And Fingers?

So, PEBEF?</comment></comment></comment>


Turn yourself into Lego - <AUTHOR> http://www.mattiaserlo.com/blockify/blockify.html

<comment><AUTHOR> 1\. You can use your webcam, or you can upload a picture from your computer using the folder icon in the top left corner. 2\. You can change size of the blocks using the SML icons in the top right corner. 3\. You can draw on top of the canvas using the palette of colors down below. 4\. When you're done, you can upload the result to Facebook if you want to.

The app uses getUserMedia and so it works best in Chrome as of now.

Enjoy!</comment>


15 year-old considers startups 'common' - <AUTHOR> http://www.financialpost.com/small_business/story.html?id=173243 <comment><USER2> Maybe it was the article or lack of Google-able content but I just wasn't as impressed as I was prepared to be. I couldn't find a site for Cyquester Technologies other than freelance style systems and couldn't find any additional details on the sale of the Facebook app by the other kid but it seems to be a low dollar sale for a simple application. If anyone has additional information I would love to take a look!

</comment><comment><USER3> Back in my day, starting up "web design" firms on a GeoCities account was considered a success too!</comment>


The giant, prehistoric squid that ate common sense - <AUTHOR> http://arstechnica.com/science/news/2011/10/the-giant-prehistoric-squid-that-ate-common-sense.ars <comment><USER2> First, great criticism of science journalism. Mainstream science jouranlism is mainly of two strains: (1) Don't do this a home, kids! We're experts! and (2) Oh, look, that whacky scientist invented sausages made of poo! Looks like this kraken thing might be part of that.

Second, did anyone else think of the Kraken in Ken McLeod's Cosmonaut Keep ([http://literarygalaxies.blogspot.com/2011/03/engines-of- ligh...](http://literarygalaxies.blogspot.com/2011/03/engines-of-light- trilogy-ken-macleod.html))?</comment>


2015 Hackaday Prize: Calling Hackers to Fix the World - <AUTHOR> http://hackaday.io/prize

<comment><USER2> It's great to see the return of the Hackaday Prize!

</comment><comment><USER3> Good luck everyone. Will be interesting to see the community try and solve some real problems.

</comment><comment><USER4> Great job guys, looking forward to seeing the submissions to this competition!

</comment><comment><USER5> Can't wait to see what awesome projects we get

</comment><comment><USER6> Can't wait to see the projects!</comment>


How Teams Get Microservices Wrong from the Start - <AUTHOR> https://buttercms.com/books/microservices-for-startups/how-teams-get-microservices-wrong-from-the-start <comment><USER2> The biggest problem I see with microservices is the pendulum now swings way to far the other way.

Now you end up in microservice soup, too much overhead, no standards used in between them with differing levels and quality of execution.

I'm not sure what the long term answer is but remember that every decision to put code into production is a decision that not only affects you but the team and company as a whole.

<comment><AUTHOR> You're dead on. We've seen this in talking to companies and have gotten their input on how to properly scope + size services. We'll be publishing these insights in an upcoming chapter.

</comment></comment><comment><USER3> it's simple: 'micro' means you're going to need about 1000000 of them</comment>


Autopsy of a failed side project - <AUTHOR> http://subimage.com/blog/2013/10/06/autopsy-of-a-failed-side-project/#.UlImAmHds25.hackernews <comment><USER2> Has the site been put down? Why didn't you keep it as a fun little side project? I don't understand why the goal has to always be a $17 million exit. I've built things like facetache.com and openingthemes.tv cause I thought they were fun, not for some massive financial windfall.

<comment><AUTHOR> It was impossible to afford licenses for the lyrics our site contained. You can go two ways...fly illegally (which most of these sites do) and risk getting sued, or pay an outrageous copyright fee yearly to license tracks for display.

For a "fun side project" I wasn't willing to accept that risk.

[http://subimage.com/blog/2012/12/15/lyricful-looking-for- inv...](http://subimage.com/blog/2012/12/15/lyricful-looking-for- investors/#.UlJf52TXS89)

<comment><USER2> Aah, ok. Seems stupid to sue as the site promotes the songs (via iTunes, etc...) but the music industry aren't exactly known for rational decision making.

<comment><USER3> If you are successfully charging some people for a license, you really have to sue the people who don't get a license. Otherwise your licensees will stop paying.

</comment></comment></comment></comment><comment><USER4> SEO is a war of attrition more than anything. Unless you're working the blue ocean strategy, it takes up to two years to get sustained top search rankings (using legitimate SEO methods and best practices).

By the looks of it, Lyricful deserved better. Hopefully someone with deeper pockets can bring it back.

<comment><USER5> Blue ocean strategy?

<comment><USER4> Blue Ocean Strategy: Creating new demand in an uncontested market space[1]. Summon the Warrior[2] was my attempt at this.

Red Ocean Strategy is a highly competitive market space, and what Lyricful were engaged in.

[1][https://en.wikipedia.org/wiki/Blue_Ocean_Strategy](https://en.wikipedia.org/wiki/Blue_Ocean_Strategy) [2][http://summonthewarrior.com/](http://summonthewarrior.com/)

</comment></comment></comment><comment><USER6> I thought it was kind of obvious that all the sites are spammy because they are illegal anyway. Its just lazy to set up a content based business model without owning any content. Now a service to people who do own the content, that might have been worthwhile, monetise your lyrics.

</comment><comment><USER7> Sad to see this site go. Looked like a great project. So just out of pure curiosity, where would someone go to legally acquire lyrics for a particular song ? (sorry to say this but this sounds absolutely retarded to me.. what exactly are you damaging by publishing lyrics to songs ? I don't see the copyright argument at all.. it's not like someone will not buy a song because they can access the lyrics for free online ?)

<comment><AUTHOR> We didn't see a problem with it (and neither did our lawyers) until that $6.6M judgement played out against another lyric site with similar "user contributed" content.

There are a couple of routes to go legal - one being Musixmatch, which charges at minimum $20k per year for a blanket license.

An email straight from them:

"We offer data licensing packages, through our scalable Lyrics API, that are customized to meet your needs with annual fees ranging from USD $20,000 to higher depending on the audience for the data and which data are being licensed. We are not able to offer any sort of data license for less than USD $20,000."

</comment></comment><comment><USER8> It was a good try. Sometimes it works: [http://www.reddit.com/r/IAmA/comments/dpndp/i_run_one_of_tho...](http://www.reddit.com/r/IAmA/comments/dpndp/i_run_one_of_those_god_damned_awful_music_lyrics/)

</comment><comment><USER9> is it ok if I suggest "[http://sideprojectors.com"](http://sideprojectors.com")? Might be able to find others who might want to take over. :)

<comment><USER10> Fixed link: [https://www.sideprojectors.com/](https://www.sideprojectors.com/)

<comment><AUTHOR> Interesting site. Thanks

</comment></comment></comment><comment><USER11> Neat, but without the ads what was your plan for making money?

<comment><AUTHOR> We had song players for iTunes / Amazon for each song displayed, links for concert tickets, and ringtones.

Ads, but tastefully done I think. Definitely not any popups, no Google Adwords, etc.</comment></comment>


Ask HN: Is underestimating a chronic IT project problem? - <AUTHOR>

Normal A&D time allocated in my department is 6 hours. That may be enough, if you know what is going on, the code involved and potential dependencies affected. But sometimes you are given 6 hours to A&D for code you've never touched or seen. This happens a lot to me - 6 hour tasks which turn into week long mini-projects. Saying "yeah, sure that can't be too bad" only to realize that I have no idea what is going on in the 35 files, 3 namespaces, countless methods I am supposed to understand.<p>Do you encounter this in your work, and how do you deal with it? Do you estimate A&D work using the "usual" hours or realistic estimates, no matter how out of "norm" they are? <comment><USER2> It used to be for me, until I made two changes to my technique.

1\. Give a confidence value: 'this can be completed in x hours with 50% confidence, or y hours with 85% confidence (where y > x)'. If you don't want to work in 'confidence percentages', translate that to a range: 'this can be completed in x/2 - x*1.5 hours'.

2\. Never, ever quote on something you've never done before. Does the project require using a new API? Write a small, isolated test application that uses the API in similar ways. This will sharpen your confidence value. If you don't have time to exercise all the parts of the project you've never done before, shrink your confidence value but explain why: 'this can be completed in x hours with 20% confidence, but with a little more preparation time, I can get you a more accurate quote'.

Most importantly: be professional with your quotes. Don't take on too much just to be the hero who moved mountains and saved the day. No-one will thank you if you do (after all, you're just doing your job), and your professional image will take a dent when you don't. Also, as soon as you realise you can't make your confidence value, don't keep it to yourself. Yes, you'll piss people off by lagging the project, but the alternative is much worse. Not speaking up when issues arise is an ego problem (similar to being the hero who moved mountains).

Yes quoting is hard, but is required. Don't worry, developers are not the only ones who struggle with it. I work for a (non-software-) engineering firm that is currently taking a $1.6M+ bath (and rising by the hour) because they botched the quote process. Shit happens all the time.

</comment><comment><USER3> Ah, I see. Perhaps you can use Analysis & Design tasks not to estimate the actual work, but further research tasks necessary to get to a more solid answer. Setting the expectation that all issues can be analyze and designed in 6 hours seems arbitrary.

Many times the Analysis and Design of a solution encompasses trying things out and actually experimenting with changes. By the time you're done with Analysis and Design you've virtually implemented the solution. Of course there is the documentation and reviews that you could also estimate separately.

This is a classic human problem - we suck at estimation. And if some pointy haired boss is demanding perfect estimates, you should give him or her good estimates for the next piece of work you can predict rather than the finished task.

</comment><comment><USER4> I think we all start off like that. Managing expectations is the number one game here.

A simple way to combat this is to just add a multiplier to whatever your instinct is telling you.

To add to what _sh was saying, the confidence value is a good idea. If you can explain to your client that you think it could take 3 weeks, but let's set expectations for 6 assuming some things go wrong, you're going to be a lot better off and have some breathing room. If you finish earlier, all of a sudden you're awesome.

If your client doesn't want any details from you, just dumb it down to your multiplier estimate.

</comment><comment><AUTHOR> Analysis & Design? Looking at the problem at hand, looking at the code we have, what can be done to implement what the business wants, access the impacts to other layers of the application, document everything, set up reviews

</comment><comment><USER3> Can you clarify what A&D is?</comment>


CSS min() and max() functions are counterintuitive - <AUTHOR> https://webplatform.news/issues/2020-05-07 <comment><USER2> This is completely not true.

CSS min() and max() do exactly what is intuitive. The author's confusion is not understanding how to apply the results.

to be clear:

max(10px, 12px) === 12px

min(10px, 12px) === 10px

exactly as one would expect.

<comment><AUTHOR> CSS spec editor: "If that confuses you, congrats, it confuses me too, which is why I wrote that note…"

[https://twitter.com/tabatkins/status/1254149169905725440](https://twitter.com/tabatkins/status/1254149169905725440)

You can pat yourself on the back for finding it intuitive, but many people aren't. If it were just me, I would not have written about it.

Also note that in your examples you're using two literal values that share the same unit (something that wouldn't happen in real code). I think it's fairly clear what the functions do in that case, but it's less clear if the units are different:

max(80%, 200px)

Can you describe what the above value means?

<comment><USER2> Yes it returns what is expected. The maximum of those two values. I'm not trying to be smug, but honestly if max(a, b) actually returned the minimum of those arguments do you really think that would be better?

The confusion seems to stem from the uncertainty of how to apply these functions when you want to ensure a minimum threshold for a width, padding or something similar.

When you want to ensure that the width is at _least_ some size (but potentially larger) then you might want to take the maximum of the current width and some given threshold.

Conversely, when you want to ensure that the width is no larger than some threshold (but potentially smaller) you might take the minimum of of the current width and your threshold.

In either case what min() and max() do is clear.

Perhaps the demos on:

[https://developer.mozilla.org/en- US/docs/Web/CSS/max](https://developer.mozilla.org/en-US/docs/Web/CSS/max)

might help make it more clear for some.

I'm sure you understand the issue as you wrote this article. Perhaps a better title might be something about the being careful about when to use min() vs max() rather than stating that these functions are themselves counter intuitive.

<comment><AUTHOR> > Yes it returns what is expected. The maximum of those two values.

What is the maximum of those two values?

<comment><USER2> Really?

Without context it is impossible to say what 80% translates into. However, with context it will be absolutely clear what max(80%, 200px) is. It will be the greater of those two values. If you want to wish it to be the least of those two values then go ahead and wish.

Alternatively, feel free to try it out at:

[https://developer.mozilla.org/en- US/docs/Web/CSS/max](https://developer.mozilla.org/en-US/docs/Web/CSS/max)

Up until this very moment I have given you the benefit of the doubt. Do _you_ even understand what 80% means? I'm beginning to suspect that min() and max() are the least of your issues if the concept of the CSS percentage datatype has you baffled.

<comment><AUTHOR> You're right. Context would be useful. Let's use this:

.elem { width: max(80%, 200px); }

The goal is to explain what this declaration does.

<comment><USER2> We are going in circles. Without knowing anything about the lineage of an element with this class it is not possible to say.

Conceptually an element with this class will have a width of 80% of its parent or 200px whichever is larger. Hypothetically a simple parent with a width of 400px would result in this element having a width of (0.8 X 400) 320px as 320px is larger than 200px

What do you think this does if not that?

<comment><AUTHOR> > a width of 80% of its parent or 200px whichever is larger

Alternatively, "…but at least 200px" to make it more clear that 200px represents the minimum width.

Based on the linked discussion on Twitter, I suspect that most people cannot interpret this declaration correctly, at least not at first glance (i.e., instinctively).

For example, someone's thought process could be like this: "Ok, it's a width, and there is a max function, and the absolute value is 200px. So, something about max width being 200px?"

The person sees "max" and 200px, and they then have to deduce that the _minimum_ value is 200px, not maximum. This is what's counterintuitive about it.

width: max(X, 200px) → minimum width is 200px

If you are not affected by this at all, than that's great for you, but if most people are, then we can say that the feature is counterintuitive.

The only thing that matters is how actual people interpret the feature instinctively. If their gut-instinct interpretation is incorrect (or even if they're just unsure), then we have a problem.

<comment><USER2> The documentation that you link to states that there is an "occasional misinterpretation", that sometimes people don't understand how to apply max and min correctly in certain situations. That is thankfully, not "most people" nor do I believe it is even some significant number of people most of the time.

People who can't understand max() probably can't see that -10 is less than -9 either. That does not make the "<" operator counter intuitive. This actually has nothing to do with CSS and to me demonstrates a crazy fundamental mis- understanding of math and logic.

For someone confused about what max() might do, you should be clearly stating that it does exactly what is expected, however you might caution a particularity novice coder that they might want to double check that they truly want the greatest of two numbers rather than the least of two numbers. Framing these functions as counter intuitive when they are crystal clear makes it more likely that a novice gets it wrong.

"That person on hacker news told me that max does not work like I expect. I should use it to get the least of two numbers"

With advice like that I guess I can see where novices might be confused. I'm sure you believe at this point that I am some sort of ass, but truthfully I would never hire someone who could not intuit what max() did.

<comment><AUTHOR> (Of course I don't think you're an ass. You're arguing your point quite well. I couldn't ask for more.)

I think you're overestimating how flawless people are mentally.

Take a look at this: [https://twitter.com/mxstbr/status/1038073603311448064](https://twitter.com/mxstbr/status/1038073603311448064)

This is absolute HTML and CSS basics, and yet only 43% of over 14 thousand people got it right. What gives? Are most of these voters a bunch of amateurs?

I don't think so. My explanation is that people make mistakes. Constantly. Basic mistakes. That's part of being human. Our brains aren't machines that produce flawless results. We forget things. We get confused.

Is this a problem? Should all of these people be fired? No. As long as they can find and correct their mistakes, and produce a correct result in the end, it's fine.

The first sentence in my first reply to you was a quote from the CSS spec editor: "If that confuses you, congrats, it confuses me too, which is why I wrote that note…"

This is Tab Atkins. A Googler. The main CSS spec editor. Probably one of the most knowledgeable people about CSS in the world.

How is it possible that min()/max() confuses him? Is he secretly a noob that doesn't understand basic math? My explanation is the same. He's human. His brain doesn't work perfectly.

I am not suggesting that most people don't understand max(). I'm saying this:

* When people see something like max(80%, 200px), they get confused, even if it's just for a moment.

* I have explained in my previous comment why that is (max() + absolute value = minimum value)

* Then, after they look at the code for a few seconds or more, look up max() on MDN, etc., they eventually figure it out. How many do? Most? I don't know.

But in that first moment, _instinctively_ , most people get confused.

I have wasted a bunch of time on these comments, but I'm not going to let some IQ 200 genius convince me that min()/max() isn't counterintuitive in this specific scenario.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Shell programs as functions in Python - <AUTHOR> https://github.com/amoffat/pbs

<comment><USER2> Along similar lines: <http://geophile.com/osh></comment>


Show HN: Raindrop.io – Your library of knowledge and inspiration (Android) - <AUTHOR> http://raindrop.io/other/android.html

<comment><USER2> I wish this was on iOS, I've been looking for this exact solution and would love to try it out. I think you have hit a very under served market here. Well done, I'll watch for a iOS release.

<comment><AUTHOR> We have iOS app: [https://itunes.apple.com/ru/app/raindrop/id739939140?mt=8](https://itunes.apple.com/ru/app/raindrop/id739939140?mt=8) But without English translation. Will be soon.

</comment></comment><comment> saiko-chriskun How does this compare to kippt?</comment>


Laravel cookie forgery, decryption, and RCE - <AUTHOR> https://labs.mwrinfosecurity.com/blog/2014/04/11/laravel-cookie-forgery-decryption-and-rce/

<comment><USER2> This is going to sound like empty language-war rhetoric, but: PHP might be the worst mainstream language in which to implement crypto. A crappy type system is one thing, but an unpredictable type system is much worse.

<comment><USER3> The enemy of any crypto is naïve assumption. That's not unique to PHP, but I agree, the type system can make it worse.

</comment></comment><comment><USER4> As usual, HN only cares about PHP when there's some FUD to spread.

This is an old bug that was made public and fixed over a year ago [0].

[0] [http://www.reddit.com/r/PHP/comments/2332gq/laravel_cookie_f...](http://www.reddit.com/r/PHP/comments/2332gq/laravel_cookie_forgery_decryption_and_rce/cgsysne)

<comment><AUTHOR> I didn't intend to spread FUD when I posted this - I wasn't aware the equality check was also fixed. I use Laravel in a lot of projects and only saw it posted elsewhere today.

re the downvotes: fair enough I guess.

<comment><USER5> Just curious but where did you see this? This was posted last week on /r/php and the Laravel creator stepped in and pointed out that it was patched awhile ago.

<comment><AUTHOR> A php group on linkedin. Probably posted from /r/php but I haven't been there in a while.

</comment></comment></comment></comment><comment><USER6> This bug was publicly disclosed and fixed over a year ago.

<comment><USER7> Was that disclosed _by MWR_? It might just be delayed publication on their blog.

<comment><USER6> No, Jon Cave first disclosed it on his personal blog.

<comment><USER8> I published details of a separate issue on my personal blog (linked in the first paragraph of this article). This is delayed publication of a second set of issues.

</comment></comment></comment></comment><comment><USER9> Only sites which have error reporting enabled are vulnerable, so no need to panic unless you're displaying errors in production.

<comment><USER8> All sites were vulnerable to authenticating as other users or tampering with ciphertexts. Error reporting enables the RCE. However, I still hope that nobody is vulnerable or panicking since this was reported and fixed last year.</comment></comment>


A Socialist Plan to Fix the Internet - <AUTHOR> https://www.jacobinmag.com/2019/11/tech-companies-antitrust-monopolies-socialist <comment><USER2> To not even begin to poke at the obvious holes in this proposal, in this supposed utopia the government fully owns and runs the entire backbone, ISPs via municipalities, and any service that scales to serve a certain number, including hosting platforms such as AWS?

There's people out there who believe this would be a good thing? Really?

If we accept this as naive, then we accept the proposer as modernly blinkered and historically blind and can likely be dismissed as such. However, if we accept the proposal as being made with full knowledge of the eventual consequences and outcomes in mind, then we can only label those making such proposals as a danger.

</comment><comment><USER3> > In this case, a state entity takes responsibility for operating a service.

This absolutely terrifies me that someone thinks this is a good idea.

<comment><USER4> They have to gaze no further than to Havana to see how it pans out. If further interested they can go to Beijing and figure out how it's used to promote values and such. I'm sure it's can be a satisfying view to some.

While FB and Google do have some problems due to their monopolies, the answer is not in state control.

<comment><USER5> >While FB and Google do have some problems due to their monopolies, the answer is not in state control.

Although I am _not_ a proponent of state control of the net, I'm curious as to why not. If it's that the state can't be trusted, this doesn't seem to match our existing institutions; we regularly place our lives in control of the state every day, from food regulation rules to the social safety net, to defence of the country, etc. - why should something the net, which seems to hold much less in stakes than the things I listed, be an exception?

<comment><USER6> Personally, I don't trust the government to do food regulation (FDA is reactionary and IMO corruptible), social safety net (Social Security has serious issues), and defense (our military seems to be used more for offense, not defense).

In general, I find public institutions to be worse than their private alternatives. I prefer UPS/FedEx to the Postal Service and I send my child to a charter school rather than the local public school. Public institutions have shown that they don't need to be good, just good enough.

The key is making sure the incentives are right. Google and Facebook are bad because they profit from violating people's privacy, and they've developed a business model based around trading personal information for services. I don't know what the answer is necessarily, but nationalising it just turns them into surveillance networks, which is arguably worse than advertising networks.

I think we need to decide what the end goal is and define the incentives needed to get us there, and ideally we'd avoid too much use of government to get there. For Google/Facebook, I doubt advertising will go away, so we need to find a way to make privacy-preserving ads a thing while still allowing advertisers to show relevant ads to customers. Perhaps the Brave model is better than Google's model, or perhaps Google's model is acceptable with transparency and oversight. But having government deeply involved in personally identifiable activity is a bit too Orwellian for me.

<comment><USER5> > Personally, I don't trust the government to do food regulation (FDA is > reactionary and IMO corruptible), social safety net (Social Security has > serious issues), and defense (our military seems to be used more for > offense, not defense).

I accept your argument, but most people against net regulation generally have good opinions on food regulation agencies and the social safety net, so while you seem consistent, I have a feeling a lot of people aren't in this matter. I suspect the case is even greater for European countries, which do food regulation and social safety better than the US in many ways.

Either way, it would follow that a government which does those things right could, in principle, regulate the net. I think the case is stronger when one considers that everyone _except_ anarchists accepts the rule of law, and the democratic decision process to arrive to the law. I think it's very reasonable to say that there are government institutions that are run well, and those institutions have greater consequences than the regulation of the net.

The real target of my criticism was the fact that people tend to engage in special pleading when it comes to regulating the net, or regulating speech, without much reason for it. Brison has argued that there is no meaningful metaphysical difference between what we class as "speech" and "action".

<comment><USER3> Regulating a market is entirely different than regulating a right that preordains the existence of a nation state at all. We have the right to speech coded in law because it is meant to keep the state at bay - it isn't given to us by the state, it exists apriori.

<comment><USER5> >We have the right to speech coded in law because it is meant to keep the state at bay - it isn't given to us by the state, it exists apriori.

That's certainly true, but it's worth asking what the justification is for the 1st amendment, i.e. what makes speech so special (after all, we have lively debate on most other amendments, such as the 2nd and in the past the 18th), and to say that freedom of speech exists a priori is just as true of speech as it is any other action, including actions we would count as murder, or theft, etc.

<comment><USER3> The problem with this formulation is that all other laws, all other rights, only exist as a result of the first a-priori assumption: that you are allowed to engage in discussion of any idea. Without that, people self censor and can't feel free to think.

That isn't to say that there are _no regulations_ on content. Plenty of media has standards and regulations about how it produces content, rating systems for media, and a system of classifying content that is acceptable for different degrees. For instance, I could see better regulation around a rating system for YouTube content to prevent children from stumbling upon poor content. This is still different than banning speech.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Great story. Next they should describe how to privatize the government

</comment><comment><USER8> It's hard to trust the intent behind this Jacobin piece, especially because the article is unclear on what problems it is trying to solve and therefore comes off as purely ideologically motivated. It seems like this is walking exactly the path of past socialist authoritarian regimes, where eventual total public control (AKA party or ideological control) comes into being in the name of empowering the common man and "Democratizing". But how long before public control starts limiting the freedom of the internet by imposing rules on what's allowed and not allowed in even more heavy-handed ways? Given that the far left (like Jacobin) have been rallying _against_ free speech and mocking it online with "freeze peach" memes, I am terrified at the possibility of them eventually ceasing control of speech platforms. Mind you, I'm not a big fan of the current state either, with a few companies controlling everything. But we have tools for that - namely anti-trust law. So let's take incremental steps for change rather than entertaining dangerously radical changes.

<comment><USER5> >Given that the far left (like Jacobin) have been rallying _against_ free speech and mocking it online with "freeze peach" memes, I am terrified at the possibility of them eventually ceasing control of speech platforms.

Two points on this thought: there are a variety of viewpoints on the value of freedom of speech within "the left" \- needless to say, opinions range from libertarian to unlibertarian. You shouldn't get your views of leftist philosophy from Internet memes. The second point is that you should consider reading the arguments on freedom of speech, those for and against it. Most people only seem to know of the arguments _for_ it. On that point I'd recommend checking out Susan Brison's work for starters.

</comment></comment><comment><USER9> It's good to see this perspective.</comment>


Ask HN: Secure way to verify HN credentials? - <AUTHOR>

Is there a secure way or workarround to verify a HN account ( i'd like to workarround asking for a password if possible). Eg. OAuth or something else.<p>But probably that isn't possbile and i wouldn't like to do a POST request on the HN account page to verify a HN account. <comment><USER2> What is the use case? If you want to verify that someone is who they say they are, and really are a member of HN, then you can give them a string and ask them to put it in their HN profile. You can retrieve the HN profile, verify the string, and know that the person you're "talking to" is indeed a member of HN.

That may not be what you're looking for, but without more information as to what you are doing, it's hard to suggest anything else.

<comment><AUTHOR> Alternative to a login system on a seperate website, the seperate website would add functionality to HN and their would be a bot posting one valuable link to a thread ( if it's requested by the author).

It should be some sort of login, if i ask them to put it in their profile, they'll essentially would have to have 2 logins ( eg. oAuth and adding the HN profile string)... I'm thinking about an easier way to do it.

Still have to ask for permission though, but i'm first considering potential problems.

</comment></comment><comment><USER3> Generate a string of random characters and ask the user to add it to their "about" information.</comment>


Show HN: A social network/desktop utility for work - <AUTHOR> https://workola.com <comment><AUTHOR> Hey HN, I'm a solo founder and this is my first official product launch. It was designed around facilitating group discussions but I've found it to be useful as a desktop utility as well, ie, keeping desktop notes, imgur replacement, saving private notes/links, etc. I'm always open for suggestions and feedback. Best, Dave.</comment>


Show HN: One hostname to rule them all - <AUTHOR> https://onehostname.com/ <comment><USER2> All data, including user passwords, and all their content going through a third party. All exchanged for some dubious SEO benefits. What can go wrong?

<comment><USER3> At the risk of stating the obvious, the One Ring is cursed.

<comment><USER4> Oh hey, and all your js is now on one origin so if you have an xss in your third-party blog software, you now have xss in your app!

Also, good luck writing a sane content-security-policy if you do this.

</comment></comment></comment><comment><USER5> If you want to do this yourself, caddy http server [0] works really well and is incredibly easy to use / setup. They even have an example on their home page that shows this for /api and /blog

[0] [https://caddyserver.com/](https://caddyserver.com/)

<comment><AUTHOR> It works pretty well with nginx too: [https://fly.io/articles/delivering- multiple-applications-on-...](https://fly.io/articles/delivering-multiple- applications-on-one-hostname/)

It's trickier than it seems, though, because you need to get the right combination of Host/X-Forwarded-Host right for a given hosting service. And you frequently need to rewrite HTML to fix links. Not rocket surgery, but usually I'd rather put my hours into dev and not tweaking a proxy.

<comment><USER6> Which is why people just use subdomains. Far less hassle, works fine.

</comment></comment></comment><comment><USER7> What about the protections from XSS which Content Security Policies[0] can provide? It would be unfortunate when a bug in your blog engine can cause a hack of your store.

[0] [https://developer.mozilla.org/en- US/docs/Web/HTTP/CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)

<comment><AUTHOR> CSP still applies, you can apply restrictions by path and hostname. Or am I missing your meaning?

<comment><USER7> For some reason I believed that CSP rules can be hostnames but not paths. At least in Mozialla's documentation above there is not a single example of a rule with a full path. I can't check it by myself right now to find out the truth as I'm far away from my development PC.

<comment><USER8> According to the CSP2 spec, the value of a -src directive contains three parts:

        - protocol/scheme (optional)
        - hostname (mandatory)
        - path (optional)

Notably, there is no query portion or fragment portion; browsers are expected to ignore those. Path matching works like a prefix if it ends in a slash. If it doesn't, only exactly that path matches.

In CSP3, the secure protocol/scheme (https, wss) always matches, even if you explicitly specify [http://](http://). In CSP2, the implicit scheme matches either; an explicit scheme only matches that scheme. This is typically not useful behavior because you probably have HSTS anyway, so people just use hostnames and only rarely specify the protocol. Most values in practice seem to just be hostnames in general; paths too are rare.

<comment><USER7> Thank you, that was insightful.

</comment></comment></comment></comment></comment><comment><USER9> The accompanying blog post[1] might have been a better fit for submission, as it has actual content:

[1]: [https://fly.io/articles/one-hostname-to-rule-them- all/](https://fly.io/articles/one-hostname-to-rule-them-all/)

<comment><USER10> I still don't know what this is for, all the fluff (inserted to keep the reader's attention when explaining stuff that might be boring) gets in the way.

<comment><USER11> It's a service that transforms subdomains to paths.

E.g.:

blog.example.com -> example.com/blog

api.example.com -> example.com/api

docs.example.com -> example.com/docs

... and so on. Supposedly for SEO benefit, but there's the obvious security risk of running all traffic through a third-party.

<comment><USER12> A bit like CloudFlare?

<comment><USER11> They seem to work in similar ways, but Cloudflare focuses on speed and security, this just seems to focus on SEO. The security risk is in theory the same, but I'd argue that the risk from Cloudflare is lower as they're a well established service used by major companies.

</comment></comment></comment></comment></comment><comment><USER13> Okay, so the claim is subdomains = bad, subfolders = good.

Is that true? I'm seeing vague claims ("Subdomains accumulate positive signals differently than root domains") without anything of substance to back up their veracity or relevance.

<comment><USER14> Many people have tested this and written about their results:

[https://moz.com/blog/subdomains-vs-subfolders-rel- canonical-...](https://moz.com/blog/subdomains-vs-subfolders-rel-canonical- vs-301-how-to-structure-links-optimally-for-seo-whiteboard-friday)

[http://www.bloggingflail.com/subdomains-vs-subdirectories- se...](http://www.bloggingflail.com/subdomains-vs-subdirectories-seo/)

[https://medium.com/mention/how-we-increased-search- traffic-3...](https://medium.com/mention/how-we-increased-search- traffic-373-in-6-weeks-2cb342bd73ec)

<comment><USER15> Even these articles will mention that the benefits to SEO are secondary to good, relevant content that is well structured and semantic. There are downsides as well. Your ability to run paid search is limited by your domain. You can't bid for multiple positions on the same keyword with a single property. In practice, our businesses have had a much better return from the SEM benefits than the minor SEO boost.

<comment><AUTHOR> Specialized landing pages are one of the few time it makes sense to have separate hostnames. Which is why we put this on onehostname.com.

<comment><USER13> > _Specialized landing pages are one of the few time it makes sense to have > separate hostnames._

Why, what is the theory?

Do you have any concern that the "help folder-ize subdomains" business may go away with a Google algorithm update?

<comment><AUTHOR> These stylized landing pages benefit from branding, and usually aren't a tremendous amount of searchable content (I doubt anyone will ever find onehostname.com with a search engine).

I'm not too worried about Google's algorithm changes. SEO is one "free" benefit of putting everything on a single hostname, but there are lots of reasons it's desirable. You get better speed (especially with tls and http2), more control, even vanity. What we're really helping people do is manage their stuff that's scattered across 15 different services and make sure they're all delivered to end users well.

</comment></comment></comment></comment></comment></comment><comment><USER16> Ironically hosted on a different hostname than their main site.

<comment><AUTHOR> Fixed! Good thing our site's setup through fly.io!

[https://fly.io/onehostname/](https://fly.io/onehostname/)

</comment></comment><comment><USER17> I spent 30 seconds looking at this, and have no idea what they are selling. The first "usable" content was something about taking down blue towers. If you have to sell me on the basis of a stretched LOTR reference, I am going to assume your actual value proposition doesn´t really hold its´own.

<comment><USER18> It's a paths to subdomains reverse proxy service.

Or, an opportunity to completely fuck yourself when someone breaches them and starts logging all your customer login requests

</comment></comment><comment><USER19> I love the landing page story. I also strive for single hostnames, but preferably out of one's own server through a proxy in front instead of folders. Relative URLs in subfolders just don't seem to work well on dynamic websites.

One problem I haven't figured out with this app-level routing, though, is how to have a reliable status endpoint. The distance the pinging server needs from the app's running process is at odds with this routing strategy.

</comment><comment><USER20> The solution, after reading three pages of this site describing the problem very slowly, is a guide to using folders with nginx or haproxy?

HN didn't know this already?

<comment><USER18> It's <basic _nix tool> as a service.

I'm honestly not going to be surprised when "println as a service" appears AND people _use it_

</comment></comment><comment><USER21> LOVE the artwork here! Great story guys.

</comment><comment><USER22> I don't really have anything to add beside that the fly.io website is beautiful.

</comment><comment><USER23> I wish there was a way to just tell search engines whether your content should be treated as part of the parent subdomain or not for SEO purposes.

That way you'd keep the XSS protections of CSP, while still not breaking things like github pages or a zillion other subdomain hosted services.

<comment><USER24> sounds like you want [https://w3c.github.io/webappsec- suborigins/](https://w3c.github.io/webappsec-suborigins/)

<comment><USER18> I think that's the opposite: telling browsers to treat some paths as different origin

</comment></comment></comment><comment><USER25> You can do this with AWS cloudfront

</comment><comment><USER26> Badly veiled advertisement.

<comment><USER27> It's not veiled at all.

<comment><USER10> That's the bad part.

</comment></comment></comment><comment><USER28> This could be an object lesson in how not to build a landing page. What is this? What is it for? I see a cartoon...but what the hell does any of it mean? Why am I signing up? What am I signing up for?

> _Want all your applications on One Hostname?_

Uh...no? Should I? I have no idea!

Oh look. Tiny, low contrast text at the very bottom of the page linking to an article that loses my interest before it gets to the point.

This could have been 24 point bold arial black on white: "We made a service called Fly to help you convert subdomains into load-balanced subdirectories to strengthen your brand and improve[0] your SEO. yada yada yada..."

[0] - citation needed, lol

<comment><USER29> Totally disagree. The landing page is nice, is pretty, it invites you to read and has two very useful links.

If it was a black on white page I would have read it, acknowledge it and close, perhaps add it to Pinboard for later use and never look at it again. The way it is now I've clicked the links and read the whole article, almost.

<comment><USER28> It's very pretty, and it tells you absolutely nothing.

Sorry. Correction. It tells you that you can sign up for...something.</comment></comment></comment>


Tell HN : JetBlue All-You-Can-Jet Pass Sale Ends Today - <AUTHOR> http://www.jetblue.com/deals/all-you-can-jet/? <comment><USER2> They actually moved up the end date, it was originally supposed to stop on Friday. Thanks for the reminder.

</comment><comment><USER3> where do you actually buy it? I can't find a link on that page or the main one. Do you have to call them?

<comment><USER4> Yes, you have to call: 1-800-JETBLUE (538-2583), prompt 4.

I believe you also need to register for their frequent flyer program (free?), though I'm not sure if you can just do that when you call.

<comment><USER5> You can register to become a TrueBlue member online

About membership: <https://www.jetblue.com/trueblue/FF_About.aspx>

Register page: [https://www.jetblueairways.com/cgi- bin/skylights.cgi?module=...](https://www.jetblueairways.com/cgi- bin/skylights.cgi?module=MP&page=REGISTER_ID_PW&language=EN)

NOTE: they are changing the way their frequent-flyer program works this fall so you may want to read this as well to see what membership looks like in the long-term: <https://www.jetblue.com/trueblue/newprogram/>

</comment></comment></comment><comment><USER6> Hmm, here I thought I was gonna get a $600 US-China flight+, but looks like their international options are rather limited.</comment>