Life Inside the RVs of Silicon Valley - <AUTHOR> https://www.topic.com/life-inside-the-rvs-of-silicon-valley <comment><USER2> _Their precarious living situation became a catch 22: while the truck allowed them to live near the hospital, when the social worker found out Isidoro was living in a truck, the hospital kicked Isidoro off the transplant list: he needed to live indoors to recover from a potential surgery to be eligible for a transplant. Luckily, after weeks of looking, Silvia's sister in nearby Milpitas rented her a bedroom for $700 /month this fall, where they've been staying since. The last she heard, they had to stay inside for a year for Isidoro to get back on the list._

Well, I think I officially feel ashamed to be an American now.

I slept in a tent for nearly six years to work on getting healthier, but I was not seeing a doctor. I was doing my own thing. That was frustrating enough, what with not getting taken seriously by a lot of people and facing classism online, etc. But, I kind of understand why I get given so much flak: people genuinely think what I am doing simply cannot be done. They have no mental framework for effectively engaging with me.

But to have a specialty hospital someplace so expensive and a requirement to live near it to get treatment and no help for complying with this expectation, then delist them for sleeping in a truck, it just seems monstrous. The hospital has to know that normal, healthy people can't afford housing here. They should also be fully well aware that people with health problems face the double whammy of high medical expenses plus reduced earnings.

America needs to fix both the medical system and affordable housing. It doesn't really deserve to be seen as a civilized, first world nation as things stand currently. I don't care what our GDP is. We are failing to take care of our people and it is monstrous.

<comment><USER3> _Well, I think I officially feel ashamed to be an American now...America needs to fix both the medical system and affordable housing. It doesn 't really deserve to be seen as a civilized, first world nation as things stand currently._

California in particular is worse of in many of these regards. The imbalance of political power in California, skewed to the urban population centers, to the affluent, and to the left has resulted in policies that disadvantage the less educated, lower income, and rural populace. If you go out into the countryside, you can find an anger which can only be explained by people who have been beleaguered on a fundamental level, that of culture and livelihood. On top of that, there are definite non-governmental socio-cultural systems which further work against them. (It is much easier to see these things when you are outside them or have been cast out of them. Let's just say that I've had the misfortune of a broader point of view.)

What I see happening in California is a cultural and political ascendancy of the left, which has become drunk on power which it is abusing. The political right aren't saints, but no faction of human beings are saints and the corruption of power is universal. While we nerds spend our attention on esoteric fripperies like IPAs and keyboards, our society is starting to resemble France when someone said, "after me, the deluge."

[https://www.youtube.com/watch?v=7n-xhFLkgiE](https://www.youtube.com/watch?v=7n-xhFLkgiE)

[http://www.mercurynews.com/2017/01/05/california-schools- ear...](http://www.mercurynews.com/2017/01/05/california-schools-earn-c-in- national-ranking/)

<comment><USER2> There are things I like about California and I lived there for a total of around 12 years. I recently left and I am shocked at how much nicer people are where I currently live.

I don't know what California needs to do to get its head out of its butt. These are clearly systemic problems. I am incredibly concerned about the trend of tech giants who are, for example, pro Basic Income while they live in the San Francisco Bay Area and can't treat their own employees decently and can't solve problems locally.

I am baffled as to why anyone takes their social theories at all seriously. They are, to some degree, the architects of the dire situation in the SFBA, but they think they can cure the country of its social woes by throwing money at the problem.

This sounds to me like virtue signalling, not like they have any clue what they are talking about. It sounds like trying to deflect the justified anger of the masses with Good Intentions while continuing to be part of the problem.

On the one hand, some of them make the news for how much they want to give to charity or whatever. On the other, some of the same names make the news for how badly they treat their own employees. Sometimes people point this out, but, more often, people debate the so called merits of their proposed solutions without going "Hey, isn't this the same guy who just did [shitty thing du jour] to their own employees?"

I am pretty fed up. I have started fussing at the president via tweet. I am waiting for the FBI to show up at my door. Because silencing (or turning a deaf ear to) the people being crapped on in this country instead if taking their problems seriously seems to be par for the course for the rich, including our real estate mogul president.

I wish someone would make me look like a fool by proving such assertions wrong. Sadly, I think that is increasingly unlikely.

<comment><USER4> > I wish someone would make me look like a fool by proving such assertions > wrong. Sadly, I think that is increasingly unlikely.

I'm sorry to say no such reprieve is on the way. The situation is as dire as you make it out to be. Silicon Valley, tech culture as a whole, can either be the new master or the savior, it just hasn't collectively made up its mind yet.

<comment><USER3> _Silicon Valley, tech culture as a whole, can either be the new master or the savior, it just hasn't collectively made up its mind yet._

Oh it's made up it's mind. It's just a question of what kind of master it's going to be while it also makes up its mind about what kind of savior it will claim to be while it's at it.

<comment><USER4> Unfortunately, I agree with you; its time we start finding ways to cut Silicon Valley off at the knees [1].

[1] I'm aware of the irony of the forum I'm posting that statement in.

</comment></comment></comment></comment></comment></comment><comment><USER5> SF Bay area (Nine-county) is 25 times the size of Singapore and 11 times that of London. Its population at 7.7 million is only 1.4 times as large as Singapore's (5.6 million) and less than London's (8.8 million). Its GDP at $721 billion is 2.4 times that of Singapore's ($297 billion) and 1.3 times London's ($542 billion).

Solutions should be possible if rational negotiations could be carried out and affected parties could be compensated adequately. I understand that older residents wish to retain their lifestyle and community character. Could any amount of money and other concessions from new developments compensate them for the potential change that will come quite gradually in any case? Could the new developments be constructed in an area that wouldn't have a direct impact on their daily lives?

More practical concerns like increased traffic jam and effect on property value should be addressable with the tens of billions of economic benefits that could be realized from new, denser developments. Finding a way to equitably distribute these benefits would be a huge headache but since the net results are likely positive, the solution should be possible with the right organization and efforts.

<comment><USER6> There's always eminent domain, aka Theft By Government.

"Screw you all, we gave you a chance to play ball and you didn't. So now we have to do things the hard way."

Or, more reasonably, just stay the fuck away from silicon valley if you're looking at starting a business or working for a tech company. Things will even out eventually. Or not, but the market can stay irrational longer than you can stay solvent.

I don't get what's so great about the area, anyways. Every time I've been it's just seemed like an insanely expensive shithole...but I guess I'm not the one splashing billions of dollars around.

<comment><USER5> If you are an entrepreneur in a certain field, such as deep learning, and need to stay at the bleeding edge by having people with extensive experience to bump ideas off and hire as employees or partner with, it is one of the best, if not the best, areas in the world. For example, the number of AI meetups in Silicon Valley proper is many times that of East Bay, which is a hub in its own right.

If you work in a right position for one of the tech giants in the area, the compensation you get will leave you with more savings than working in a much cheaper place with smaller salary.

Correct me if I'm wrong. I wish to have other options as well.

<comment><USER7> >> I don't get what's so great about the area, anyways. Every time I've been it's just seemed like an insanely expensive shithole...but I guess I'm not the one splashing billions of dollars around.

> If you are an entrepreneur in a certain field...

more prosaic: sure, it's changed some, but it's still pretty hard to beat culturally for certain sorts of people. if you like both art and technology, especially if you want access to both internationally recognized things and little-known indie things, the only other places in the US that feel like they really compete with SF are LA and NY.

i don't have a job at a tech giant, but i do have what i think is a very interesting software development job, that'd be harder (but not impossible) to find in other places. realistically, because i'm cheap/frugal and interested in saving money, rent control is the only reason i can still afford to live here. but i also really take advantage of the city that i live in: in the past couple months, i've seen p-funk, actress, flying lotus, a local industrial-ish electronic duo, a handful of local noise acts, JLin, hauschka, a screening of "sun ra's space is the place", pharaoh sanders, philip glass & kronos quartet, curren$y, and a bunch i'm forgetting since i'm just listing stuff off-hand. that's an especially good few weeks in an especially good year, but even in slower times, i'm usually going to at least one show i'm really excited about every two weeks to one month. i can also eat delicious food for cheap either from taquerias or by going to the grocery store, or if i have the disposable cash, i can choose from a wide variety of higher-end options across a range of prices. i get to meet people from all over the world. i went to college here, and because of all the above, a number of my good friends from school stuck around, and so i have a very solid social network here. i volunteer at a great community radio station, where i met my girlfriend.

so, for a lot of people, even transplants, wanting to stay isn't so crazy. if my GF and i both happened to get evicted, i'm not sure what we'd do. that seems unlikely, but it does always feel like a bit of a worry.

i don't quite understand the resistance of the natives to the influx of new people, esp since this has literally always been kind of a gold rush town. but hey, i moved around a bunch as a kid, and i like meeting people from different places.

when i told a cabdriver that i'd lived in SF for 11 years, he joked that i wasn't a native, but that i could say i was a local. so as a local, i'd say i'm very strongly YIMBY. fucking build. build housing. build better/faster/more regional transit. e.g., make it fast and easy to get from the SJ suburbs to SF and vice versa, whether it's rush hour or post-last-call. some old stuff will have to come down, some neighborhoods will change character. so it goes. better than steadily pricing out all but the most affluent and pushing them to the far edges (or entirely out of) the region.

<comment><USER6> As someone who is really into artsy stuff, that scene is _dead_ in SF. Seattle, too. A whiff of tech or electricity, and you'll be ostracized in a flash.

I've been really disappointed with these ostensibly libertine cities; weirdly, I'm thinking of heading back to the _Midwest_ for tolerance and creativity.

Dafuq? But them's the breaks...people in the PNW are indifferent to the point of cruelty, on the off chance that they aren't being extremely hostile for the hell of it.

Sorry, but I disagree. Wanting to stay is very crazy. If _I_ got evicted, I'd give a week's notice and take the opportunity to pack a U-haul and leave for greener pastures. What is it with people being content where they are, even when it's a creatively destitute skidrow? Not that I'm one to talk...

</comment></comment></comment></comment></comment><comment><USER8> It's worth noting that even for folks who have enough income to afford an RV park, there are effectively none in the Bay Area. The ones that exist are either: Booked solid with a long waiting list, don't allow old RVs (I found this out when I passed through the area with my 34 year old Avion travel trailer), or are so far from everything as to be useless for most of the folks covered in the article. Or, most likely, all three. Also, among the most expensive RV parks in the country.

I'm pleasantly surprised the city of Palo Alto isn't ticketing or arresting or towing these folks. They passed a law against sleeping in vehicles a few years ago, as I recall. It's deeply troubling, to me, that the solution to homelessness (or near homelessness) is often to make mere existence illegal.

I spent a couple of weeks parking around the University Ave./Downtown area in Palo Alto a few months after I moved into my first RV (a nice/newish motorhome), about eight years ago, to visit with a friend who lived on University, and I didn't have any trouble with police or neighbors, even parked among multimillion dollar homes (it certainly helped that the RV was nice...I got questions from residents but they were of the form "Where've you been?" and "Where are you going next?"), but I'd read there'd been a crackdown on it. I haven't been back in an RV since then.

Last time I was in the area earlier this year, I parked _way_ outside of the valley (about a 1.5 hour drive away, which was literally the closest I could get) and rented a car to drive in (rather than driving my very large F250; the fuel savings paid for the car rental), but I saw that there were little RV villages in a few locations in Mountain View and Palo Alto. If I'd been in a motorhome and didn't have a girlfriend that liked having limitless power and water with me, I would have spent a night or two on those streets just to avoid making that ridiculous drive several times. But, with a trailer, it's just not a great idea to park on streets. Even in places that tolerate motorhomes and vans, they might not tolerate a truck and trailer, and its length often makes it subject to other street parking laws.

<comment><USER9> I vaguely recall an HN discussion recommending rest stops; I wonder if those near SF have near-permanent residents.

<comment><USER10> I can't think of a single rest area that's within a 1.5 hour drive of Mountain View.

<comment><USER8> There's one just north of San Francisco on 101 (probably a little over an hour from Mountain View if not driving during rush hour), but nobody is living there. It's very crowded every night, and I've heard time limits are enforced. Truckers complain a lot about any routes through the SF Bay area, as there are very few places for them to rest or even park for a short time.

There's also a couple on I-5, but they might be a 1.5 hour drive from Mountain View.

</comment></comment></comment></comment><comment><USER11> I'm sympathetic because the wealth inequality Silicon Valley is extremely vast, and these people are on the losing end of the inequity. But truthfully, about half of the people in the article made bad decisions in simply moving to the Bay Area in the last few years, even though it's one of the most expensive areas in the world.

That said, if you are determined to live here when you don't make a lot of money, living living in an RV makes a lot more sense than paying ridiculous rent. Their rent is almost nil, and they get to save money based on a higher wage than they would get in other areas of the country.

<comment><USER8> California, in general, has seen massive housing price increases. A lot of them came from other expensive places, and it sounds like often they came for a specific job or opportunity or need (medical care is a recurring theme).

I find it sort of horrific that folks are having to make decisions like, "Do I get good health care and live in a van or do I live in an apartment I can afford?"

I still can't get over the guy who was on a transplant list but was removed from the list because he lived in a box truck. There's something sick about a society that lets that happen, but I don't know what the cure is.

</comment></comment><comment><USER12> Another interesting profile is that of the Google engineer living in the parking lot:

[http://www.businessinsider.com/google-employee-lives-in- truc...](http://www.businessinsider.com/google-employee-lives-in-truck-in- parking-lot-2015-10)

<comment><USER13> Interesring. It seems... Very practical and economical? I would wager a lot of people would do that if only they weren't afraid of a stigma.

Those living and working in SV are among the richest people to ever live. But studies of happinesss suggest we're not really happier for being richer--it appears people get caught up in "buying things we don't need, to impress people we don't like."

<comment><USER14> There's a huge difference between the Googler who lives at the Googleplex (with showers, cafeteria, plenty of rooms to hang out, etc.) and only sleeps in his RV and the Standford admin who has nowhere else to go than her RV.

<comment><USER9> > showers, cafeteria, plenty of rooms to hang out

I think I understand where you're coming from, but Stanford does not have these things?

<comment><USER15> The woman is 60. Most people taking showers in the university showers are undergrads in the dorms. The age difference would make it uncomfortable and admin staff do not get the same privileges as current students anyways because they don't pay tuition. Stanford has a dining hall, but you need a meal plan, it's not free.

Google offers those things if you're an employee.

</comment></comment></comment></comment></comment><comment><USER16> As a side point: the "history" and "significance" of El Camino Real was invented less than a century ago as a marketin* effort: [https://www.kcet.org/shows/lost-la/how-el-camino-real- califo...](https://www.kcet.org/shows/lost-la/how-el-camino-real-californias- royal-road-was-invented)

</comment><comment><USER17> Oh man. I was driving right by there the other day, and it was the Friday before a Stanford home football game.

I thought those RVs were all tailgaters who were just trying to get a good spot.

I feel terrible now.

<comment><USER18> Palo Alto is one of the few places it's actually legal to sleep in a vehicle. El Camino is a good (but loud) spot to sleep at where you won't get hassled by cops.

</comment></comment><comment><USER14> What I don't understand is: why do these people live in SV? I can understand tech worker staying with their big salary, but non-tech workers would live a much better life in a more "normal" place.

Then after they all move out, maybe the tech industry will figure out a way to make it livable for those people when they realise they need them too.

<comment><USER19> Several of the people interviewed in the article mentioned the proximity of the hospital where they get their medical needs taken care of. One mentioned having to be nearby because they were waiting for a liver transplant.

I don't know the intricacies of the US health care system, but I think it might be a major setback for their healthcare if they relocated.

And they might not be any more well off if they relocated. They might have slightly higher wages living in SV. Moving elsewhere might mean they couldn't even afford living in a vehicle.

</comment></comment><comment><USER20> It seems like for most entry level engineers ranged at $100-120k who wants to live in a one bedroom apartment in SF, a 30% off in rent could potentially be better than 30% cut in salary, considering the current tax rate.

In China, there have been attempts by startup companies offering employees sleeping pods near the office, while providing water and shower so that the employee can simply stay around the office during the course of a year long employment with occasional "offsite" airbnb living. But unfortunately such attempt was shut down: [https://www.techinasia.com/china-napping-pods-startup- forced...](https://www.techinasia.com/china-napping-pods-startup-forced- shutdown)

<comment><USER21> Company housing is a bad idea, it's already bad enough in the us that your health insurance and retirement savings are tied to your employer, it makes it very hard to go and start something yourself or change jobs, not to mention abruptly losing your job since you have to find a new place to live.

</comment></comment><comment><USER22> There's really two Californias. This talk by VDH digs into this some more.

[https://www.youtube.com/watch?v=v1eNcuGcPW4](https://www.youtube.com/watch?v=v1eNcuGcPW4)

</comment><comment><USER23> For those who don't have a RV or car to sleep in, some of them use "Hotel 22", the only 24-hour bus line in the area as a shelter at night.

Short video documentary on the NYT:

[https://www.nytimes.com/2015/01/28/opinion/hotel-22.html](https://www.nytimes.com/2015/01/28/opinion/hotel-22.html)

They ride the bus back and forth throughout the night getting off at each end usually several times.

</comment><comment><USER24> The junky RVs seem extremely out of place lined up together on El Camino. I've always assumed they only get away with this because they're on the Stanford side of the border between Stanford and the City of Palo Alto. Palo Alto NIMBYs would have run them out long ago.

<comment><USER12> Gee, have some compassion. After all, someone's got to be the janitor or the cashier, and it's tough to pay sky-high rent on that kind of pay.

There's actually a substantial debate about car camping in Palo Alto. A parking/camping ban was floated, then repealed; these spaces on El Camino seem like a compromise, and are in a bit of a jurisdictional gray-area between Stanford, Palo Alto, and the California Highway Patrol.

[https://www.paloaltoonline.com/news/2014/11/18/palo-alto- str...](https://www.paloaltoonline.com/news/2014/11/18/palo-alto-strikes-down- car-camping-ban)

</comment></comment><comment><USER25> It's like something from 'The Grapes of Wrath'.

</comment><comment><USER26> This reminds me of the "first world problems" meme only in this instance it's more like a first world shanty town.

<comment><USER27> The Bay area has a huge homeless population with shanty towns all over the place (just hidden).

</comment></comment><comment><USER28> Am I missing something? Why are they staying in these areas? They can do the same jobs where RV parks nearby.

</comment><comment><USER29> How many of us clicked on the link expecting decked out airstreams? Great article showing the struggle of people dealing with insane housing prices.

</comment><comment><USER30> Someone go put a $100 gift card on their windshield.

Seriously, why cant there be an easy app with shameless reputation to allow anonymous tiny donations? Maybe they can pick up $$ at a Walmart</comment>


Giteveryday – A useful minimum set of commands for Everyday Git - <AUTHOR> https://www.kernel.org/pub/software/scm/git/docs/giteveryday.html <comment><USER2> Wow, a man page that is actually readable and understandable.

I've been using Linux for years, and never once have I seriously looked at a man page. One of the more useless pieces of advice Linux beginners are given is to `man [tool]`. The documentation often has tonnes of useless information and no examples. It's frustrating, and it's also why projects like tldr[0] have gotten so popular.

But, the page linked in the OP is actually brilliant. It's easy to read, has examples, compartmentalises into sections that are relevant to different people. It's a step in the right direction.

Note: I'm not saying there aren't other pages like OP. There probably are, but the vast majority are not.

[0] [https://github.com/tldr-pages/tldr](https://github.com/tldr-pages/tldr)

<comment><USER3> One place where the MSDN docs is way ahead of the manpages is the documentation of function paramters. For instance, here's the ouput of _man 2 write_.

      ssize_t write(int fd, const void *buf, size_t count);

      DESCRIPTION
      write()  writes  up  to  count  bytes  from  the buffer pointed buf to the file referred to by the file descriptor fd.

      The number of bytes written may be less than count if, for example, there is insufficient space on  the underlying  physical  medium,  or the RLIMIT_FSIZE resource limit is encountered (see setrlimit(2)), or call was interrupted by a signal handler after having written less than  count  bytes.   (See  also (7).)

      For  a  seekable file (i.e., one to which lseek(2) may be applied, for example, a regular file) writing takes place at the file offset, and the file offset is incremented by  the  number  of  bytes  actually written. If the file was open(2)ed with O_APPEND, the file offset is first set to the end of the file before writing.  The adjustment of the file offset and the write operation are performed as  an  atomic step.

I have to go through a block of text scanning for the parameter I'm interested in. When I'm using the manpage as a reference (which is most of the time), this is less than ideal.

MSDN indexes the documentation by parameter so you can quickly find what you're interested in.

LE. Sample msdn link for comparison: [https://msdn.microsoft.com/en- us/library/windows/desktop/aa3...](https://msdn.microsoft.com/en- us/library/windows/desktop/aa365747\(v=vs.85\).aspx) .

<comment><USER4> That's actually just one sentence you have to scan, so I don't totally see the issue.

<comment><USER5> It could still be better. It could be 0 sentences to scan it it was formatted in a better way.

</comment></comment></comment></comment><comment><USER6> I love that they try to make it assessible. But I disagree with that it would be an acceptable goal in git just to understand a subset of it. You need to understand nearly everything, even the internals. Only then it can really become useful to you.

The mistake the community made is putting git on the throne of version control. It's not. It's a tool for experts that can do a lot for you if you know how to use it. But to achieve that it pays the price of not really being assessible.

Now that it's in its position, the best thing you can do is to learn it. There is the git book. Read it. Annoying, I know. But that's the gameplan. Not doing it is just dragging out the inevitable.

<comment><USER7> This is a very useful comment.

I think the same could be said about C. It should not be put on the throne of "programming language" \- you need to actually read and understand what it does internally. (pointers etc) - it's not enough to learn some incantations.

So then let me ask: is there a room for x, where git:x::C:python (git is to x, as C is to Python).

People everywhere deserve to have x. Not just right-clicking a file in Dropbox or OS X for previous versions, but a full commandline and detailed history including commit messages, and many other aspects of git.

In a way this is completely orthogonal to your comment, just as Python is to C.

EDIT: I've thought more about it and I no longer agree. The "language" presented here is a subset of C/C++ - not everything is mentioned or taught: [https://www.arduino.cc/en/Reference/HomePage](https://www.arduino.cc/en/Reference/HomePage)

It is in fact exactly this type of simplified subset. Not even malloc and free are mentioned... So while what you wrote is true for this audience (HN) there is room to learn less or a subset.

<comment><USER8> Mercurial. I'm not being flippant; the UX is light years ahead in terms of accessibility to newcomers to dvcs. With a ui like tortoisehg, even five years ago, someone without any prior experience in any vcs at all could become productive after a fifteen minute primer. Git does not compare.

<comment><USER9> It also makes sense, I think, considering that Git consists of small tools interacting with each other, while Hg is written as a whole application/system by itself, which can then be extended as needed.

</comment></comment></comment></comment><comment> guard-of-terra Both merge and rebase, but no cherry-pick. Goodbye then, I guess.

I've seen a dozen of those tools wishing to "simplify" git and they all fail my workflow, which is pretty common I guess, team git with central server and source control.

What I use:

        git push with target

        git fetch

        git checkout

        git cherry-pick

        git reflog

        git log, status, diff obviously.

<comment><USER10> The difference between rebase and cherry pick is very very slim, rebase is in a sense just a convenience frontend for cherry-pick..

<comment> guard-of-terra For rebase I can _never_ figure out what should go in all its parameters. It has defaults sure, that are impossible to figure out either.

With cherry-pick you have no parameters and no defaults, it's basically _cp <commit> ._ for SCM.

</comment></comment></comment><comment><USER11> Useful commands for everyday GitHub usage:

# apt-get remove git

# apt-get install svn

Then use svn. You can receive and send code to GitHub. GitHub is fully svn compatible =)

That can be especially handy for non-tech folks who would have an impossible time with git.

</comment><comment><USER12> This is my favorite documentation link I give to others when teaching git.

<comment><USER13> Have you considered helping to complete [https://en.wikibooks.org/wiki/Git](https://en.wikibooks.org/wiki/Git) ?</comment></comment>


Ask HN: How saturated is the market for offensive security/pentesting? - <AUTHOR> Answers relevant to the UK would be good, but if not then any info at all would be better than nothing. <comment><USER2> I don't think that's the right question. The better question is "How strong is the competition in the <XYZ> market".

If the market is saturated but companies are weak you can easily grab market share. If the market is unsaturated but a very strong competitor currently aims it your attempt will probably just lose money.

And the answer is often analysing google keywords, requesting a few security checks yourself from the google leaders, investigating who appears often in related media, and asking possible customers who they know and how they evaluate their options.

PS: If you "Ask HN" your market research, you'll either find out about together with us that there's no opportunity in the given market, or you create competitors by highlighting an opportunity.

<comment><USER3> Another factor to consider is how unsaturated a market is (how much unmet opportunity is available). It's easier to break into a field, and get good at working in that field, if you're competing with anyone. Most (all?) fields have room for people at the top of their game, but some fields are simply lacking enough people to do the work.

<comment><USER2> Agreed. Also unsaturated markets may mean that there is either not enough potential or there is a huge problem that isn't resolved yet. So yeah, I agree that having at least some saturation is necessary.

</comment></comment></comment><comment><USER4> I used to be in security auditing. I don't know about market saturation – that would depend heavily on your location, as it often requires some face-to-face discussion – but I think for security the saturation is less relevant than your credentials. Once a company decides to spend some money on outside security, they tend to go for a name-company with good credentials and certifications such as approval for PCI-DSS compliance checking. Once you provide the needed services, your name needs comes up as one of the go-to companies. Reputation and word-of-mouth are pretty important. For instance in the CC and banking sector companies are very aware whose services are being used by other companies. No company wants to give a good chunk of money away on something as sensitive and invasive as security checks without being sure they're receiving quality service and not some random script-kiddie with an automated security scanner.

If your company (or the company you want to work for) floats up as one of the top security firms in your region, you will probably get a lot of business. If you start from zero with no reputation, you're going to have fight hard to get your name on the map.

<comment><USER5> Naive question: what if you just hack your prospect, without causing unrecoverable damages and show them you've hacked them, do they hire you?

EDIT: ok thats illegal but isnt it in the interest of the prospect to hire you more than seeing you in jail? Also, I was wondering if there were some loopholes or field practices one can use to hack for being hired? Something like: "I may have hacked you, do you wanna hire me?"

Just curious, because it seems to me every company should welcome that. I might be wrong.

<comment><USER6> If you want to try that route, there's an ethical way: look for companies with vulnerability disclosure programs on HackerOne or Bugcrowd.

Being well-written in your interactions with companies on those platforms would go a long way in improving your credibility.

<comment><USER7> Sign up here: [https://www.hackerone.com/resources/hack-learn- earn](https://www.hackerone.com/resources/hack-learn-earn)

</comment></comment></comment></comment><comment><USER8> My perspective comes from doing hardware and vmware installs at businesses for a Dell partner in the US. The problem is that, as far as many small businesses are concerned, there's only two options: get a full, comprehensive, money- paid-if-we're-wrong-guarantee-backed pentest that's way too expensive, or do nothing.

There's a lot of places that would just like some idea how vulnerable they are on the basics. Something the IT admin can show management. If you can come up with a decent suite for a reasonable price with the legalese to say this is for informational purposes and a starting point but not comprehensive, you could carve out a sustainable niche.

Edit to say: in person. Shake hands, tour the facility, ret to know how they operate, and test inside and out. Online automated scanners are a dime a dozen and no one would seriously trust them.

<comment><USER9> of course there's a third option, one that small businesses are opting for en masse: pay for a well-known 3rd party to run a simple remote vulnerability scan, pass the results (full of false positives and just plain wrong information) to someone else to deal with, and pretend like you just accomplished something useful, and reject all recommendations for anything that costs more.

</comment></comment><comment><USER10> The market is not nearly saturated with firms capable of delivering security assessments (penetration tests + source code reviews) with high technical proficiency. I started a consultancy several years ago which has done very well among smaller tech companies, and I know of at least two new consulting practices started this year by ex-NCC folks.

There are many, many firms that bill for web scanning and static analysis. Their business model boils down to, buy a bunch of tools for <$10,000, resell their usage on engagements for >$5,000 per week. They leave a trail of horror stories in their wake eventually. Starting a consulting shop is a great opportunity if you have the requisite skill/experience, and can differentiate yourself from the snake oil salesmen of the industry and the monolithic firms everyone knows.

The industry for internal security engineers as well as outside security consultants is growing at a healthy pace. In my circles, people usually need to widely advertise a position to get it filled by someone qualified. In one case, a friend of mine at a tech company informed me that he had only one candidate pass the phone screen in three months despite posting the position here on HN, on /r/netsec, etc.

Consulting firms are a different sort of beast because they are usually always hiring. Every security consultant added to a growing firm directly increases the total amount of potential revenue, and most successful firms have to start turning away work at a certain point (for example, I no longer take on work for network security because I find it unenjoyable, I would much rather work on reverse engineering and application security engagements).

Everything I've said is US-centric, but hopefully it's reasonably helpful and relevant to you in the UK. I know a few bug bounty-turned-security-consultant people in the UK and they seem to be reasonably well off, but they could be outliers (in fact they are, skill-wise).

<comment><USER11> As a small company with limited budget who is looking to have its application tested, how can we differentiate between good firms and firms that will just run a scanner and charge you $5000?

Also, is it a good idea to hire a freelancer to pen-test your application?

<comment><USER10> _> As a small company with limited budget who is looking to have its application tested, how can we differentiate between good firms and firms that will just run a scanner and charge you $5000?_

Reputation, mostly. It's easier for the large firms that everyone is familiar with. For smaller firms, you probably want to get a strong referral from someone who has been through this before. Also, ask the consultant(s) performing the assessment what they'll be doing in some technical depth to see how familiar they are with a penetration test/source code review outside of running Acunetix or Burp Suite Scanner. They shouldn't shy away from talking about what specific technical vulnerabilities they feel they're likely to find when you describe your app and its stack off the top of their heads.

 _> Also, is it a good idea to hire a freelancer to pen-test your application?_

Theoretically, this is a good cost savings versus a firm. But in practice, it's hard to do correctly because you really need to be sure that the person knows what they're doing. If you want to hire a freelancer, I would suggest looking for very well-known/successful bug bounty participants and security researchers who opened their own solo shops.

Also, shameless plug: if you're looking for a security assessment I'm happy to help you (and if I can't directly, I am nearly positive I can refer you to very competent smaller firms for your budget). Feel free to get in touch.

</comment></comment></comment><comment><USER12> Interestingly most of the comments in this thread are about the quality of existing organisations in this space. My experience echoes this sentiment.

Over the years I've worked on systems that have been pen-tested and it's always been the same thing. The testing picks up a bunch of standard/generic and not all that important issues, while missing much worse and glaring specific issues. I've sat in meetings with people from pentesting companies who couldn't describe the attack vector/risk of an exploit they'd said needed patching.

I'm sure there are some companies that do it properly but I guess the good ones charge a load more money. Then again, as a lay-enterprise, how do you know who to hire? I know that if I was hired to pentest various systems I've had to work on in the past I'd have picked holes in them all over the place.

</comment><comment><USER13> I am a professional penetration tester right now in the US. I got into the field from education, but once I got my OSCP I had multiple offers from different companies.

There are a ton of "boutique" firms in the space right now, but there are quite a few who seemed to be popular and then died off right away.

One of the big market gaps I see is the ability to provide really good tactical feedback but also package it in a way that it provides value to the actual decision-makers at the top. There are so many pentesting firms that are extremely talented at breaking in, but are really lacking at helping to actually implement cultural and program-level changes so that it doesn't happen again. There are also firms whose idea of a penetration test is just running Metasploit/Nessus/Acunetix and then packing it up without a lot of insight.

Compliance is a huge driver right now, meaning some companies just want to check the boxes and be done with it. However, just because you are PCI compliant doesn't mean you are actually secure. It takes a special set of "soft skills" to be able to help companies truly improve their posture.

</comment><comment><USER14> The problem appears to be how to sort the bad security assessment firms from the good. There are thousands of firms out there that make grand promises, but how does anyone without the required knowledge to not need such a firm know which ones are good and which one are bad. Rather than add yet another firm, it would be better to work on a startup than can objectively sort those that already exist.

Edit. If anyone wants to work on this problem I have a clever way of solving it (I of course don't have the time to work on it myself).

<comment><USER15> Can you share more thoughts on this ?

<comment><USER13> Say you need to get a penetration test for PCI compliance. There are literally hundreds of vendors that offer these services. Your CTO would like to use X vendor because he read a paper / saw their name at Defcon / recommended by a partner.

When the vendor comes to perform a penetration test, they launch a Nessus scan against the target ranges. They compile the results and manually validate the findings to ensure they are not false positives. The end product is a report that looks something like a checklist: SSLv1 in use, self-signed certificates internally, missing the latest third party software patch on a server.

According to the penetration testing firm, you are probably at a low / medium risk level. The tacit implication is that as long as you fix those issues, you should be good to go.

The problem is that first, a vulnerability scanner is an imperfect piece of software and does not test anything a real attacker would. A real attacker might try phishing, or guess "Password1" on a user account. Maybe the attacker would attempt a man in the middle attack or set up an evil hotspot. Once you have AD credentials, now you can find which users have local administrator access, which then you can see if there is a shared Administrator password across all workstations.

The other problem is that the first penetration test does nothing to address potentially systemic issues for why the security vulnerabilities occurred in the first place. The patches could have been missing because there is no formalized patch management program, or inaccurate change management, or an issue with their Puppet config.

Currently there's no way to separate the "good" (read: thorough) from the bad other than direct referral or looking at a sample report.

</comment></comment></comment><comment><USER16> My notes from working at a pentesting consultancy during an internship (in the UK):

\- There are plenty of SaaS offerings, but they aren't VC-backed with flashy websites, they are much more corporate.

\- Lots of the SaaS offerings are just an automated Nessus or equivalent, and only really look at servers/operating systems, not actual web apps.

\- The consultancy side is pretty saturated, but most of them are crap, new- grads, pentesting Java/PHP apps.

\- There is a strong market for the trickier stuff – hardware pentesting, pentesting more interesting environments/languages, etc.

\- Pentesting is ridiculously expensive, to the point that the startup I work for would never consider it at our size – making that more affordable is a hard problem, but would be very valuable to lots of companies.

<comment><USER17> Veracode was VC backed and had a $600million exit this year.

<comment><USER18> They were not just a pentesting shop though.

</comment></comment></comment><comment><USER19> There are thousands of firms who will happily run a vuln scan or webapp crawler and send you a crappy canned report. There are less who can really perform a comprehensive test and document the hell out of it.

I personally think pen testing is not very useful, except as a 3rd party check to tell you if you've done a reasonable job at protecting your software (and if you get a bad tester, you literally won't know!). We need more people in InfoSec who can explain how to build defensible software - finding holes is the easy part.

<comment><USER20> These things are not really mutually exclusive. Defense in depth. Getting more information on building defensible software does not preclude the need to have someone knowledgeable try to rip it apart afterwards.

<comment><USER19> I don't disagree on this, but the mentality of pentesting (as I have seen it conducted) is wrong. Typically a firm wants to find a way in, and snatch the Crown Jewels. Once they achieve that, the level of effort goes way down, and they often leave a lot of surface area unchecked.

Or maybe more succinctly: they are incentivized to find SOMETHING quickly, rather than EVERYTHING.

I think it can help if the testers are internal and not quite under the same time pressure / engagement limits though.

</comment></comment></comment><comment><USER21> Consumer of pen testing services here. I feel like it's saturated with sales- driven companies. Basically, "call us so we can figure out how much to charge you".

If there was a pen testing company with no annoying sales people and transparent pricing I think it could do well.

</comment><comment><USER22> I've been in the UK pentesting market since the closing of the dotcom days, and run a small boutique pentesting outfit.

In all honesty, this is not an industry you want to build a company around. There's a lot of smaller players that are getting by on a small client base and subbing. There's a massive amount of box-ticking compliance companies out there that offer differing shades of the same awful service. There are a smaller number of larger companies that offer box ticking and bespoke stuff, then right at the top of the market you have NCC Group.

The market itself is dominated by compliance work. I spent several years trying to scale the company I run up by working towards getting more badges, then doing more compliance work, and repeating. In the process I ended up realising that we were turning into one of those mid-tier box-tickers, and that's not where I'd want to be, any more than if I was a mid-sized accountancy. Unless you enjoy mediocre work, it's not a good look.

If you're an experienced tester with a bunch of friendly customers, I suspect you could set up something small and go contracting, but you're unlikely to grow too quickly without going through that box-ticking phase.

The main box ticks to get are (in no particular order):

* CHECK

* CREST

* PCI

* Cyber Essentials Plus

Check licenses you to do certain types of government work. Most of the market is sewn up by outsourcers and big boys thanks to government cuts and it puts massive constraints on employment.

CREST is an odd-fish. It's built mostly by mid-large size CHECK companies fed up with the way that scheme was going when it was run by CESG (now NCSC). There's a few things they've build to seal off parts of the market (like CBEST and STAR) from non-CREST players. Competing schemes like Tiger and Cyber schemes offer equivalence for CHECK-type roles but lack some of the market advantages CREST offers. It's best to think of CREST as a one-stop shop for Meta-box-ticking in some respects. To be fair, they've done a good job in some areas, come across as a little bit cartel-like in others but on the whole have done what other standards bodies have failed to achieve, which is to have a cross-discipline certification curriculum that's respected at a technical level.

PCI is for payment data and is absolutely saturated with low-end box-tickers flogging rebadged Qualys scans. The Local Authority market (good god, the horror) is the closest thing to this in terms of sheer volume of WTFs per minute you'll encounter.

Cyber Security Essentials is a scheme that nobody wanted, that CREST picked up with IASME and is now being rolled out by force via backdoor programmes like DCPP.

OSCP is gaining, but not really popular here because of the abundance of other schemes.

Prices are all over the place, but depend on market segment and the box being ticked but have generally been relatively stagnant or lowering since around 2004. When I went full time pentesting, average rates were around £1250-£2000 per day. These days expect between £700-£1250 depending on the market in which you're operating.

So, in a market that sells things people don't want to buy at prices they don't want to pay to tick boxes nobody enjoys ticking, is it worth going into?

There are a lot of companies looking to consolidate testing firms into their portfolios. Blackberry bought Encription a while back for a fair old wedge. Digital Assurance were recently acquired by F-Secure. NCC appear to have stopped acquiring companies at the rate they were previously, possibly connected to decreasing profits.

You _could_ spin up a company and if well connected grow it to about 500k-1million in revenue, possibly sell for 750k-2 million and work for about 5 years extending a services portfolio at a Cybersecurity distributor or reseller before cashing out.

Realistically, the money in the compliance end of the market is in services that support the compliance management side, while the money in the technical end of the market is going to be in making tools that do something new for people who consume testing services as well as the testers themselves.

A good example of the former is probably Canopy[1] or Dradis[2], reporting toolsets that integrate various scanners. The best example of the latter is Burp suite[3], which is a web app testing tool used by both testers and developers. A lesser example would be Nipper (for network infrastructure config review) or Matasano playbook (sadly now gone).

So, in conclusion:

1\. The market is highly divisible based on compliance targets, with associated badge-based barriers to entry, low margins and high salary costs.

2\. There are a huge amount of companies (e.g. scanner firms) in some areas of the market. There are few in certain niches but they tend to have barriers to entry.

3\. It is still possible to build a small firm that is a cheap acquisition target for a larger firm and make out and there is scope for consolidation.

4\. You are more likely to have longer term growth looking at the market and seeing how to provide to it rather than providing the service yourself.

[1] - [https://www.checksec.com/canopy.html](https://www.checksec.com/canopy.html)

[2] - [https://dradisframework.com/ce/](https://dradisframework.com/ce/)

[3] - [https://portswigger.net/](https://portswigger.net/)

<comment><USER23> Not OP, but this was really insightful and useful. Thank you.

</comment></comment><comment><USER24> You could also ask: Is the market saturated with electronic calculators or guitars. It's depend on what you do with such a tool and if you are able to decide between the several variations. And sure there experts and there are experts. Some are better to impress other are better in doing.If you make a good and honestly job you will not fail. Mostly.

<comment><USER25> I love your answer. I always use restaurants as my example! If you want to open a restaurant, do it! Don't let the fact that there are already a lot of restaurants stop you! (Or don't open one!)

</comment></comment><comment><USER26> If you look at it in terms of open positions then the market appears to be growing.

I imagine finding experienced people would be difficult for employers. The learning curve is relatively small for an experienced developer to pick up something like metasploit. Finding someone who can creatively come up with zero days etc probably very difficult.

<comment><AUTHOR> This is exactly my position on it right now, thinking about a pivot into security from application programming as it seems to be dawning on industry that it's no longer a nice-to-have.

<comment><USER26> I would recommend some Metasploit tutorials on YouTube. There's already a metasploit module for some of the NSA stuff that got released. Topical.

</comment></comment></comment><comment><USER27> I think it greatly depends on the kind of pentesting. A military network is different from a bank, or an AWS site, or a social network.

It's a guess, but I would suspect the market is saturated -- by opportunists, not talent -- leading to necessarily high-touch sales and high barrier to entry, but not oversupply.

<comment><AUTHOR> What sorts of barriers to entry? Purely the fact that there is a lot of noise vs. signal in terms of low-grade operators? Or is it more to do with learning the requisite skills?

<comment><USER28> Selling the service to end customers has a high barrier of entry, in part due to chicken-and-egg problem of reputation and connections.

Doing work for/with someone who is doing the sales part well doesn't have a big barrier of entry IMHO.

</comment></comment></comment><comment><USER29> For consulting work? Not at all saturated.

</comment><comment><USER30> There are plenty of companies who perform pen testing and security. Their biggest deficiency right now is understanding new emerging cloud technologies. We have been working with some pretty big name security companies around the globe and very few of them understand AWS or Azure adequately.

</comment><comment><USER31> Hey hd4. Can you leave your contact details here or on your profile? Or contact me (keybase in my profile).

<comment><AUTHOR> Sure, I'll have to wait till I get home to use keybase, this is a work computer.

</comment></comment><comment><USER32> I'm in the same position thinking of making a pivot into the security sector (coming from a mobile developer background). I think if you're good and always on top of infosec stuff and contribute to the community, you'll always have work.

</comment><comment><USER33> The market for infosec in the UK and internationally is pretty healthy, if that's where you want to build your career I wouldn't worry about the size of the market, but finding yourself a good consultancy firm to start your career at.

</comment><comment><USER34> Oversaturated as hell. Everyone & their mother that thinks just because they can code or use a computer, they can use metasploit or (insert tool here). There's more to it than that.

</comment><comment><USER35> I spent twelve years as a "security guy" before becoming employee #1 at a now- wildly-successful security startup five years ago. I've spent a lot of time in the last year "professionalizing" our security program, now that we've grown large enough to need repeatable security procedures. I am intimately familiar with the domain.

Three things to segment the space:

\- Clients are typically driven by compliance or practical security value. Understanding who you cater to and qualifying your customers will save a lot of pain.

\- Many/most "pentesting" firms are focused on the corporate enterprise and IT people, not SaaS and dev people. Recognizing the difference in yourself and your customer needs will save a lot of pain.

\- Many/most of the traditional IT enterprise security best practices & tools do not apply to a well-managed SaaS platform. e.g., I do not need a traditional vuln scanner to check for unnecessary and vulnerable services when I have one domain that's terminated at an AWS ELB.

Some industry color:

\- The 2013 Target compromise root cause was not Target themselves, but their HVAC contractor who maintained trusted access. As a result, third party vendor risk assessment is becoming "standard practice" during the procurement process of any technology vendor, including SaaS applications.

\- The vendor risk assessment teams expect all vendors to have mature security programs - SSAE-16 SOC2 audits, full Secure Development Lifecycle practices and customer-facing documentation to describe it all in detail.

\- The result is a growing demand amongst smallish SaaS vendors for more professional security guidance.

With that context, some commentary on your original question:

\- There are very few firms that provide good "practical security value." I cannot find enough good pen-testing firms that are a reasonable proxy for a capable attacker.

\- The market for firms providing "compliance" services to "corporate enterprise IT" shops is noisy and full. The market for providing similar services to smallish SaaS vendors/developers is very sparse.

\- The security tooling for dev is pretty good - static & dynamic source code analysis, tied into the build pipeline, etc. The security tooling for devops is not. There is a large gap in security tooling for devops/SaaS vendors - distinguished by automation and focus.

Finally, commentary on the question you're really asking:

\- If you are world-class good, or can build a world-class team, you can build an outstanding company providing practical security value pentest services. Scale will be limited by the number of world-class staff you can hire/train.

\- There is a gap in providing higher-level services to smallish startups to help them navigate third party risk assessment procedures from their customers. HN's tptacek and elptacek recently launched a new consultancy with this focus. They _nailed_ the product/market fit. [a, b] Again, scale will be limited by the number of staff you can hire/train, but it is an easier team to grow than world-class attackers.

\- There is a gap in security toolchains for devops/SaaS providers. Review the public projects from Netflix, Facebook and the other SaaS heavies for specific gaps _they_ had to fill. Every one is a product waiting to happen.

Cheers, and good luck.

a - [https://latacora.com/](https://latacora.com/)

b - [https://news.ycombinator.com/item?id=12567578](https://news.ycombinator.com/item?id=12567578)

</comment><comment><USER36> No one has bottled this yet and made it cheap. If you could do a saas of automated kali and ssllabs scans, for example, I think there is a huge market. If you want to start a consultancy, the market is saturated.

<comment><USER34> services like penteston.com will make bank doing this. It should be free, but I'm very biased. It's geared toward smallest pentesting consultants or people who don't know what they are doing. Seems to do a lot of the heavy lifting. Saying nobody has 'bottled' it is silly. People here in YC have done half the work, or will figure out how to do half of it for you as a pentester. The rest is validating those results, which is where a bulk of pentesting comes in.</comment></comment>


Ask HN: Inhouse collaborative app - <AUTHOR>

My team of 10 have a need to make daily updates to the same spreadsheet. Ideal way of doing this would be to use Google Spreadsheets where multiple users can make changes to the same spreadsheet...but our company doesn't allow us to put data on Google Docs. Is there any alternative software that I can use for my team by hosting it within the company firewall? Thank you very much in advance. <comment><USER2> For a spreadsheet in particular, I'm not 100% sure what's out there for doing this (other than the obvious solution of just putting the file on shared drive and emailing or yelling over the cube walls to arrange access). But, in a more general sense, there's a bunch of "stuff" out there that deals with collaborative editing of documents... here are some pointers that _might_ be useful:

<http://en.wikipedia.org/wiki/Operational_transformation>

<http://en.wikipedia.org/wiki/Apache_Wave>

<http://etherpad.org/>

<http://en.wikipedia.org/wiki/Collaborative_real-time_editor>

You might also consider a wiki... I _think_ there are some wikis that will let you use tables, and then export the resulting data in Excel format. XWiki might have that, can't remember offhand.

<comment><AUTHOR> Thank you very much. I'll try them.</comment></comment>


FriendDA -- Slightly more than a hearty handshake - <AUTHOR> http://www.friendda.org/ <comment><USER2> I like the _don't be a douche_ clause. If only more laws were that clear-cut.

<comment><USER3> I'd like to see someone go to court with this and set a precedent for a legal definition of "douche".

<comment><USER4> "I sentence you to five years in Federal, Pound-Me-In-The-Ass Prison for being a Douche. You... are a _very_ bad man..."

<comment><USER5> Downmodded; joking about prison rape, or any kind of rape, is beneath the dignity of this forum.

<comment><USER4> Downmodded for not getting the Office Space joke?

<comment><USER5> Ok, fine... can I downmod the line in the movie instead of your comment?

</comment></comment></comment></comment></comment></comment><comment><USER6> this is excellent. 'curse you under my breath' will henceforth be in every contract i write. they're pretty simple to begin with, but that's choice.

i'd correct the first paragraph (emphasis for clarity):

'... entered into _today_ and between _you_ (hereinafter "The Advisor") and _I_ (hereinafter "The Keeper of the Idea" ...'

then keep it around, laminated, to show folks.

</comment><comment><USER7> I am planning to get Print-outs now. Now all my not-so-creative friends can't steal my creative ideas. ;)

</comment><comment><USER8> What I want to know is what a VC would say if presented with this prior to receiving a business plan.</comment>


EU set to agree on new data privacy law with stiff penalties - <AUTHOR> http://www.reuters.com/article/us-eu-dataprotection-idUSKBN0TX29020151215 <comment><USER2> How would this contrast with the CISA bill that Congress is going to pass this week?</comment>


Google Mugs Father Christmas - <AUTHOR> http://www.characterweb.com/characterweblog/2012/12/google-mugs-father-christmas.html

<comment><AUTHOR> Apologies for the link bait style title (just using the original article title) but I think the challenges of projecting branding to consumers without this kind of faux pas (however subtle) are fascinating</comment>


Project Ara Lives: Google's Modular Phone - <AUTHOR> http://www.wired.com/2016/05/project-ara-lives-googles-modular-phone-is-ready/ <comment><USER2> Link to Project Ara Developer Edition page: [https://atap.google.com/ara/](https://atap.google.com/ara/)

r/android seems unimpressed because many of the initially removable components are no longer removable (at least, as indicated by marketing videos) [1]. However, it seems silly to me to get upset about this because this is a Developer Edition and Google clearly had to limit the scope of the project in order to ship. Though, one wonders if there are physical limits causing the CPU, GPU, battery, and display to be non-removable. We'll see.

[1] [https://www.reddit.com/r/Android/comments/4k9bwr/project_ara...](https://www.reddit.com/r/Android/comments/4k9bwr/project_ara_developer_edition_coming_fall_2016/)

<comment> squeaky-clean > because many of the initially removable components are no longer removable

It's not that "many" of the components aren't available, it's all the components anyone cared about. It seems like you won't be able to swap out the CPU, GPU, RAM, battery or screen. So if you want a phone with a faster CPU, you need to buy an entirely new phone, which goes against all the hype for these modular phone plans.

From the venturebeat article linked below: "The idea of Ara is to ensure that your devices are future-proofed, meaning that the whole "upgrade every two years" mentality is no longer a thing. ". This certainly isn't true. Though I guess it could be slightly cheaper, since you would be just buying a frame, and could pop in your old camera module.

There also aren't any modules being shown that can clue you into what the potential is. The only thing recognizable is a camera module, and what I'm guessing is a small e-ink display., every other module is just an unlabeled colored/textured rectangle. In every article about it the only example ever used is a camera.

The module idea actually seems really cool, a standard way for anyone to create hardware for your phone. But I think the "modular phone. Upgrade one bit a time. Never obsolete." marketing angle is a blatant lie.

Edit: I agree with one of the jokes in that Reddit thread about this

        Here's what I want for my six modules:
          1. Camera
          2. Battery
          3. Battery
          4. Battery
          5. Battery
          6. Battery

Because really, what else is there?

<comment><USER3> Different types of cameras such as night vision or infrared heat camera. Also laser range finder modules or something capable of stereoscopic vision. Altimeters. Barometric pressure sensors. Communicator modules for other peripherals when Bluetooth isn't appropriate. Temperature sensor. Wind speed device (would have to protrude beyond the phone's edge so wind can pass through). Light sensor for automatic white balance measurements. Chording keypads to enable more interesting input for power users.

Anyways that's just a stream of conscious I came up with in 5 minutes of noodling. There is potential. Maybe not as much for day to day, but definitely options for professionals that make their living outdoors.

<comment><USER4> Medical sensors -- eg. portable blood analyzer.

<comment><USER5> Theranos can pivot!

</comment></comment></comment></comment></comment><comment><USER6> Non-wired link: [http://venturebeat.com/2016/05/20/google-working-on- consumer...](http://venturebeat.com/2016/05/20/google-working-on-consumer- version-of-project-ara-smartphone-module-platform/)

Not going to disable my adblocker just to read a story. I consider it to be an anti-malware tool at this point.

<comment><USER7> What adblocker do you use? I use google-chrome on linux with uBlock Origin addon and the site renders perfectly for me.

The addon says it blocked 32 elements.

<comment><USER8> I believe that uBlock Origin includes an Anti-Anti-Adblock filter by default in the filter list.

<comment><USER9> Not by default, but I have it enabled and it does block the Wired one. Just wait until we need anti-anti-anti-anti-adblock!

<comment><USER10> due to the proliferation of nodeJS and how horrible malvertising has become, our children will only know Javascript as a backend programming language.

</comment></comment></comment></comment></comment><comment><USER11> >They're also building "style" modules, which don't do anything except look nice.

This is underrated, at least in the article. People love customizing. They'll spend money on that. Wood, gold, ceramic, organic-whatever, glass-with-bits- of-Holy-Land, and on and on. Even for basic parts, like the camera, people will pay just to have different colored rings around the lens.

Phone cases are one obvious example of all this, but being able to replace the materials of different parts of the phone seems like the next step.

I'm not convinced this project has much use otherwise, though. Would love to be wrong. But even their demo video shows nothing useful at all.

<comment><USER12> Small companies can now develop phone modules and release products with more advanced technology in a specific area (battery tech, camera, etc) without designing the rest of the phone. It would ideally be compatible with any unipro phone. This is important because a lot of technologies that would normally make it into phones doesn't because of how difficult designing and launching a phone is. You definitely don't need to do all that work if all you want to do is make a phone with a smaller/better camera.

Another benefit is being able to repair your phone by swapping out a broken module rather than replacing the whole thing. This should reduce waste. Also, you don't need to get new phones every two years, you can just replace modules as they get outdated.

If done well enough, this could shift phones out of excessive consumerism, where buying a new phone is often cheaper than replacing an old one (or where repairing a phone is impossible).

<comment><USER13> Since the CPU, RAM and screen can't be updated, your phone will definitely get outdated after 2 years.

<comment><USER14> I am not convinced people are still on 2 year phone upgrade cycles. Worse, Intel already dropped the Tick-Tock cycle and phones are not that far behind.

I have a 4s, skipped 5s, thought about 6 or 6s, now I am going to wait for the 7. I just got the new 9.7 inch apple pro tablet and I don't notice it being all that much faster browsing the web.

</comment></comment></comment></comment><comment><USER15> I think this project would get a lot more love if it was presented as a modular "tricorder", rather than a modular phone.

I imagine that there's a pretty interesting collection of niche markets for a capable, connected mobile device with interchangeable sensors.

<comment><USER16> I was thinking pretty much the same, a oscilloscope module or an android module could be pretty handy at times.

<comment><USER17> Scientists aren't as frugal as consumers either, so you could add a zero onto the sticker.

<comment><USER18> Scientists also like their devices calibrated, so add several more zeros, a yearly contract and a pelican box to keep it from sinking when you're taking lava samples on your alien moon.

</comment></comment></comment></comment><comment><USER19> Ugh, this has always been a terrible idea - apparently a vanity project by people who know nothing about how manufacturing works.

Every piece they make modular adds cost - cost of connectors, weight of the frame to support them, cost of support when the connectors fail.

You can go on about "waste" all you want, but the lowest cost, lowest material devices are rated for single-insertion connections along with components both stacked and heavily integrated.

The reason they could not do displays, RAM, etc is that these components are tightly integrated to the SOC selected, and change regularly. This was true when they announced, even more true now.

Truly Google is the new Microsoft if they devote such time to obvious executive vanity projects, untouched by the taint of reality.

<comment><USER20> Right, because we all know the most important feature of smart phones is their cost savings, which is why Apple phones sell close to their marginal cost and don't have 30% margins.

And this kind of device, while it may not be interesting for many consumers, will be very interested for industrial, enterprise, or medical users.

<comment><USER19> There's a graveyard of phones that thought there was a market for a wider variety of form factors. This is a variation on that theme.

To put it another way, if you were running a medical devices company with limited resources, would you bet on this or bluetooth?

<comment><USER21> There are lots of mobile devices specifically designed for industrial and commercial use. Usually they are much more expensive, but add few additional components. It would be useful to be able to build up your own devices from standalone components. But I doubt it is really in the interest of the manufacturers who want to be able to offer a complete "solution".

<comment><USER22> >But I doubt it is really in the interest of the manufacturers who want to be able to offer a complete "solution".

Then they'll be leaving room for a newcomer to do it.

</comment></comment></comment></comment></comment><comment><USER23> I think that if this project succeeds, it will be as a standard phone you plug into a lot of different devices. Ara could be generic compute/storage/networking, and cheap enough for you to click one into your sprinkler system, your refrigerator, your car, and perhaps commercial equipment like your alarm system, security camera system, etc... All talking to each other and sharing a common uplink.

<comment><USER24> Now THIS here is the interesting idea, the ARA becomes the local compute component in a larger system, rather than having smaller components attaching to the ARA!

<comment><USER23> Yes, I'm thinking in particular of my wife's digital piano, which has some horrific obsolete Yamaha software to transfer files, and my 2006 Acura, which has a completely crummy in-dash navigation system. Both would have been much better served by a plug-in compute module that had its own networking and could be upgraded independently.

</comment></comment></comment><comment><USER25> It's not very nice looking. For aesthetics, they will need to ship it with a case or skin that's thin & strong.

I don't often wish for mandatory bundling, but I hope that's what this is about: [http://techcrunch.com/2016/04/14/google-now-lets-you- design-...](http://techcrunch.com/2016/04/14/google-now-lets-you-design- custom-cases-for-your-nexus-phones/)

</comment><comment><USER26> I'd settle for a phone that just lets me have source to everything that can be reflashed and allows me to practically modify and reflash as desired. I feel USB host would be good enough so that I can add peripherals as needed, I don't need fancy magnetic connectors.

</comment><comment><USER27> I think the main thing this structure brings is the unbundling of camera module from the handset, so that larger sensor/lens modules can be offered. As it is, manufacturers are afraid that protrusions will hurt sales and are therefore hesitant to go with large sensors.

edit: On second thought, this may end up just being the foundation of Android- based camera backs. Should be a bit of help for camera makers, so that they can focus on the camera module.

<comment><USER28> > Should be a bit of help for camera makers, so that they can focus on the > camera module.

Why would camera makers want to give up on the pattern of tying a new firmware feature to a minor case facelift to celebrate it as a new camera generation? Cameras are a market where a few compulsive update-buyers seem to greatly outweigh the masses of thrice-in-a-lifetime buyers in terms of number of devices sold.

</comment></comment><comment><USER29> Open hardware, or closed hardware? Can I run what I want on it, and will I be able to buy modules from unlicensed third party developers?

</comment><comment><USER30> Apparently, Google controls the frame and the core components. The "base unit" is not, apparently, separate from the frame, so you can't build frames in different sizes. You can't build a tablet size frame, or use the form factor as a packaging standard for embedded control or lab instruments.

As a mobile device, it should be heavier, bigger, and less rugged than an integrated unit, so that may not be a win.

</comment><comment><USER31> This is the game-changer the last 3 billion need.

I really hope it works out. (I expect that if it does, then over time everything will be swappable.)

<comment><USER32> The phone's going to be priced at the mid to high range. Including all the important components pre-built means that it can't be sold at a low price. 'A single phone for everyone' was the original idea, but it seems they've given up on it.

</comment></comment><comment><USER33> I love it. The fact that this idea isn't necessarily constrained to a phone form factor is also pretty inspirational.

</comment><comment><USER34> As expected, the stuff that you really want to be able to replace (Screen, SoC, and RAM) are the ones you can't.

</comment><comment><USER10> physical apps store will be a cool idea, especially with a macguiver-esque iot swiss army knife of add ons for health, security, communication & interacting with physical environment.

</comment><comment><USER35> 'Ara' is racist for 'Armenian' in Russia. Its a pity 'Modo' is trademark of Swedish pulp and paper giant.

</comment><comment><USER36> The idea is great for many reasons (value, environment, etc) but god, that phone is ugly.

<comment><USER37> I actually think it looks kinda of cool.

<comment><USER29> Nothing wrong with a little Mondrian.</comment></comment></comment>


The Mystery of Tetrachromacy - <AUTHOR> http://theneurosphere.com/2015/12/17/the-mystery-of-tetrachromacy-if-12-of-women-have-four-cone-types-in-their-eyes-why-do-so-few-of-them-actually-see-more-colours/ <comment><USER2> I learned the importance of trichromacy when a friend and I came across a patch of wild strawberries. I'm partially red-green colorblind and for every strawberry I found, my friend found ten. They were almost invisible to me. It's neat to see that the fourth cone's response curve peaks right between the red and green cones' curves in tetrachromats. I bet they are amazing at finding berries.

<comment><USER3> What does it mean to be partially red-green colobrlind? Isn't it the case that you either have the red-green cone or you don't?

<comment><USER4> I don't know how it works, but I have it - I can see red and green and pink in big blobs, but when there's lots of small red and green (or pink) details mixed - they seem the same to me (if their darkness is similar).

Also I have problems with big uniform colour areas it there's small amount of green mixed with pink or red and vice-versa. I was making a sunset skybox for a game, and friends were wondering why the sky is slightly green - for me it was pinkish-red-yellow, but I put there some green by mistake.

<comment><USER3> That sounds like standard red-green colorblindness.

<comment><USER4> Good to know, I thought standard red-green color blindness is when you don't recognize these colors at all.

</comment></comment></comment></comment></comment><comment><USER5> Very inaccurate summary, since I skimmed: Up to 12% of women have an X chromosome mutation that creates a fourth cone. This cone generally overlaps the spectral region covered by the cones sensitive to red and green. The exact area of overlap determines whether or not each woman sees "more": If the fourth cone completely overlaps the region covered by an existing cone, no new information is presented to the visual system and the input is effectively discarded (she sees "just as much" red or green, not more, not less). If, however, the fourth cone has peak sensitivity in the gap between the cones covering red and green, she will she up to 100% more colour than women with normal vision.

<comment><USER6> That's not quite correct. Where one cone type has a peak response, another may respond with a signal that is only one percent or less of its peak response, but the frequency regions in which hey have _any_ response basically overlap. Given the sensitivity curves, that difference is academic for blue versus red and green sensitive cones, but not quite for red versus green sensitive cones.

What differs is the amount in which having a fourth type of come allows one to get rid of metameries ([https://en.m.wikipedia.org/wiki/Metamerism_(color)](https://en.m.wikipedia.org/wiki/Metamerism_\(color\)), a term that the article surprisingly doesn't mention)

If your fourth come type has a response curve that is very similar to one of te 'normal' three, there should still be _some_ effect, but it will be hard to devise an experiment that shows the ability to discriminate additional colors.

But given the impact that not having red or green cones with their fairly similar sensitivity curves has, I suspect having a fourth curve, even if it falls between the two, will have a measurable (in the lab) effect on one's ability to discriminate colors.

</comment></comment><comment><USER7> Scientists are looking at direct delivery of gene therapy to retinal cells to cure serious eye diseases like macular degeneration, pigmentosa blindness, etc. Should this work well, then the next step would be lesser conditions like male color blindness. I read of some successful attempts to give dicromatic animals, genrally carnovoires, the trichromatic gene directly to the retina. These subjects can be tested by giving rewards hidden in standard color blindess test images.

The next step, more controversial, would be super-vision of tetrachromacity, perhaps infra-red and ultra-violet sensitivity. Night vision glasses no longer needed for enhanced soldiers.

<comment><USER8> > The next step, more controversial, would be super-vision of tetrachromacity, > perhaps infra-red and ultra-violet sensitivity. Night vision glasses no > longer needed for enhanced soldiers.

Utter poppycock.

The cornea and lens in humans are UV opaque, which is a very good thing because UV light is damaging. People without a lens (aphakia) are reported to perceive UV light, but this is otherwise an undesirable condition. As to infrared, some people can already see up to around 750nm or so (NIR) with awful quantum efficiency. Pit vipers and some fish have limited perception of IR, but I'm not aware of any animals that can see IR in the conventional sense… being warm blooded presents a real problem, for one.

Plainly, there are limits to what can be achieved in hyperspectral imaging due to materials, and that's without the constraints of biology thrown in the mix.

<comment><USER9> _Utter poppycock._

That seems... strong, especially if referring to the "Night vision glasses no longer needed for enhanced soldiers" bit.

 _They eventually formulate a chlorin e6 solution for human use. A few drops are dripped into Licina's eyes, and they had him look for people hidden among trees as well as symbols on objects in dim light. Licina seemed to perform a lot better than the four other people who did not get eyedrops._

[http://gizmodo.com/the-real-science-behind-the-crazy- night-v...](http://gizmodo.com/the-real-science-behind-the-crazy-night-vision- eyedrops-1694955347)

<comment><USER8> My frustration was more directed towards the UV-Vis-NIR part (and I read night vision as thermal IR, but who knows), but I wouldn't say that your linked article is something of substance. To quote the article, quoting the experimenter/ee, "In Licina's own words: 'Let's be fair here. It's kind of crap science.'"

I wouldn't even know where to begin in criticizing their study as disseminated on their website except to say it is completely unscientific. There are no proper controls, for one. I think it's wholly irresponsible of the press to report on this work in this fashion at such a premature stage. I respect the enthusiasm of the citizen science crowd and think it's a neat idea, but stuff like this is going to quickly earn it a very bad reputation.

</comment></comment></comment></comment><comment><USER10> First thought:

The _usual_ pattern is that only one X chromosome gets transcribed in any given cell.[1] This keeps the dosage of all those proteins correct. Otherwise there would need to be a separate set of dosage controls for XX and XY people.

The inactivation occurs pretty early in life, and when cells replicate they keep the inactivation. This results in macroscopic regions of the body with consistent inactivation. Usually this isn't noticeable, but in cats coat pigment is on the X chromosome, and heterozygous cats often show "tortoiseshell" or "calico" coloring. The patches of contiguous color there are larger than a retina.

So it seems entirely likely that all the cells in a human woman's retina would use the same X chromosome.

On the other hand, that predicts half of het women would be colorblind, which isn't observed. So maybe not so simple...

I have a second thought about downstream neural hookups and the mechanisms for those, but it'll have to wait for later.

[1] [https://en.wikipedia.org/wiki/X-inactivation](https://en.wikipedia.org/wiki/X-inactivation)

<comment><USER11> The article explains X-inactivation, and it doesn't play the role you think here: both copies are broadly equally expressed among retinal cells. Also even if all cells in a retina used the same X-chromosome copy it doesn't predict color-blindness, since we would still have a trichromatic system.

The answer to the question posed by the title is simply that all mutant fourth cone types are not created equal. Most have a spectral response curve similar enough to an existing type not to make a real difference; a few have peak responses more squarely in-between those of the usual trichromat photopigments, allowing more finely graded color perception. (The article takes its time getting round to explaining this, but it's all there.)

</comment></comment><comment><USER12> I wonder how those poor women deal with RGB displays. It must feel _weird_ to see a difference between red+green and actual yellow.

Although, on second thought, color vision doesn't seem to work perfectly anyway. I never understood how red+blue can be perceived the same as far violet, it just doesn't make sense if you look at those frequency response curves.

<comment><USER13> I doubt it will be that bad. It will probably seem a little more dull, like some of the colorblind simulators you can find around the net. It's probably not just screens; pigments have the color they have because they reflect certain wavelengths, tuned to the proportion that a trichromat would consider identical. A tetrachromat is almost certain to notice that pigments of pictures on paper might be drastically different in color to the color of the objects the pictures are supposed to represent.

The brain doesn't perceive color just by addition of the stimulation of the cones. Your red and green cones are still (slightly) stimulated when you see blue, and your brain tells you that blue is the color; with violet, the stimulation among the cones have a different proportion, hence violet. Incidentally, this is also why the sky appears blue; the sky is too polluted by other wavelengths to appear violet.

<comment><USER12> Actual violet (like UV LED or mercury lamp) should stimulate almost exclusively S cones. But it turns out that if you take blue, which stimulates M and L more than violet, and then add even more L stimulation, you end up with something that "feels" more violet than blue (at least to me). This is what bothers me. It looks like two distinct inputs producing the same output, even though there exists an intermediate input which produces different output.

<comment><USER6> Two distinct inputs producing the same output is metamery. [https://en.m.wikipedia.org/wiki/Metamerism_(color)](https://en.m.wikipedia.org/wiki/Metamerism_\(color\)).

Without it, color printing and color televisions would be way harder to create.

<comment><USER12> You aren't paying attention, by "inputs" I meant "inputs from retina to the nervous system", not "inputs to the eye".

Most metamerism can be trivially explained by different combinations of light stimulating cones in the same way. But it looks like red+blue and violet are different and there is just no reason for them to be perceived the same, except that apparently there is also no reason to distinguish between them.

<comment><USER6> The sensitivity of the red cones appears to go up near violet ([http://www.yorku.ca/eye/specsens.htm](http://www.yorku.ca/eye/specsens.htm))

Wikipedia claims that is because of _" a second resonancy of the red-sensitive cone cells."_ ([https://en.m.wikipedia.org/wiki/Violet_light](https://en.m.wikipedia.org/wiki/Violet_light))

<comment><USER12> Well, this finally makes sense.

None of the red cone sensitivity plots I've seen previously showed secondary peak, but that's because they were always cut somewhere in the blue region.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> It opens with an Australian painter who displays her extraordinary vidual experiences in her art. But if she was born this way, why would she find it extraordinary?

<comment><USER15> Hi! I wrote the Neurosphere article you're discussing, and noticed this lively comments section. I agree with the question you're asking - if she was born this way, why did she question it? From the research I did on her life, it appears that she always assumed people could see these colours, and apparently when teaching her students in art school she would try to say things like "Try to depict all the colours you see in this leaf, like the turquoise and orange on the sides..." and her students often just found it too embarassing to tell her they didn't see any of these colours. She slowly started realising that her colour perception may be different, until one day a neurology student taking her class suggested she took a genetic test. That's it. Since then I suppose she has really harnessed the results of the test to market her vibrant art as reflecting her 'tetrachromatic reality'. Some people have commented on Twitter questioning this, and it's something I think I will write about in the near future because it's a completely fair point.

</comment></comment><comment><USER7> I thought in females half of X chromosomes are deactivated as to not producing conflicting similar proteins. If the extra cone gene is on the deactivated half, then it is not produced. It is suggested that imperfect deactivation leads to female increased occurrence of autoimmune syndromes over males.

<comment><USER16> The key is that _which_ X chromosome is deactivated is not the same in all cells.

It does occurs fairly early in the development process (a stage called gastrulation), and the deactivation does persist for all cells that descend from a given cell present. But critically, it's late enough that a retina could conceivably possess cells descending from two different "lineages".

You can actually visibly see the "resolution" of the deactivation by looking at tortoiseshell cats. Each blotch of orange/black represents one cell present at the deactivation stage.</comment></comment>


The Best Part About Github - <AUTHOR> https://github.com/search?type=Code&language&q=fucking&repo&langOverride&x=22&y=4&start_value=1

<comment><USER2> How is this news? Coders put swear words into their code...big deal....

</comment><comment><USER3> someone was looking for git-porn</comment>


Ask HN: What is a good local Web app development environment(node/mongo/redis)?  - <AUTHOR>

Instead of installing a full web app backend stack directly on my MacBook Pro, I'd much rather have it run inside a virtual machine on my local system to keep coding and testing seperatly.
I'd like to:
* keep everything local (so that it works without external network access)
* avoid cluttering my develpoment system with different installations of node/mongodb/etc.
* make it easy for new team members to get started developing in the exact same environment as the rest of the team
* protect my coding environment from experimental software or potential mistakes in scripts (imagine a "clean build" wiping out the entire system by accident)
What does your coding/local test environment look like? Any recommendations? <comment><USER2> I'm running my local development environment off of my MacBook Pro.

It consists of:

* Built in Apache/PHP, both configured how I like it

* MySQL installed via the DMG download from mysql.com

* Postgres installed via DMG download

* Redis, MongoDB, Node installed via Homebrew

* Git installed via Homebrew

* Ruby 1.8.7, 1.9.2, 1.9.3 installed and managed by RVM

* Rails and other gems installed and managed by RubyGems

* IE7, IE8, IE9 virtual machines installed via <https://github.com/xdissent/ievms/>

<comment><AUTHOR> Thanks! A while back I came across a project that provided a simple command line API for installing various components. It was pretty much a wrapper for a virtual machine without having to worry about configuring one. I can't recall what project it was...

<comment><USER2> I know you made this comment a while ago, but you're probably talking about [1]Vagrant. It's pretty fantastic.

[1] <http://vagrantup.com/>

</comment></comment></comment><comment><USER3> based on your attempt at embedded HTML, I'd say just shut up and do it.

<comment><AUTHOR> Very kind reply. Thank you very much.

I wrote the question right inside the HN form without any HTML tags. However, submitting failed once because the title had more than 80 characters. I assume that the tags were inserted automatically upon resubmitting with an edited title.</comment></comment>