Codes of Misconduct - mpweiher
http://hintjens.com/blog:108
======
unimpressive
My biggest problem with this essay is the idea that in all instances of
egregious social misconduct it's the result of psychopathy. I think the
psychopath factor should be given a much higher prior, but not an absolute
one. Sometimes people didn't get the socialization that they should have
gotten in childhood or adolescence, within this industry in particular it
seems odd to ignore the possibility of social impairment through autism.
Sometimes people really do make mistakes, and sometimes those mistakes make
you go "Wow how did somebody not know this wasn't okay?"[0], and sometimes
they know better and had a lapse in judgment or read the wrong signals.

Predators exist, psychopaths exist, most harassment is probably repeat
victimization by the same bad actors, but mistakes still exist.

[0]: I know I've asked this question about _my own_ behavior before, I somehow
suspect most of us have at one point or another.

~~~
cbd1984
And you have to take into account the fact culture plays a role.

What's your personal space? It varies based on where you were born and where
you grew up. Invading someone's personal space is perceived as aggressive and
noisome and perhaps even threatening, which makes it even worse to assume it
must be based on pathology rather than "This person was born in Italy, I'm
from Norway" or similar.

Similarly, saying things like "culture doesn't excuse bigotry" is rather
pointless, given that culture defines what you consider to be bigotry in the
first place. What's perfectly tolerant and open-minded in Russia might be
unspeakable in Liberia and vice-versa.

My point is, add a culture out of step with the mainstream notions of
propriety to someone with even a relatively mild social dysfunction (not
necessarily diagnosable!) and you have a "harasser" in the making, especially
if everyone castigates them on the first offense and nobody tells them what
they're actually doing wrong.

~~~
PieterH
Here's a funny thing about culture. It distorts a lot, so some cultures accept
public stonings and lashings, while others won't let a parent slap a child.

Yet what constitutes abuse is universal, and what constitutes positive social
interaction is universal. In every culture in the world, a man putting his
hand on another's shoulder is a gesture of dominance, and putting his hand
inside a woman's knee is a gesture of intimacy.

The size of personal spaces changes per culture. Just as some cultures speak
louder than others. Yet it always follows the same dynamics, positive and
negative.

~~~
cbd1984
> Yet what constitutes abuse is universal, and what constitutes positive
> social interaction is universal.

Only if you define it down to the basics. Some jokes are considered abusive in
one culture and funny, or at least innocuous, in another. You mentioned one
man putting his hand on another man's shoulder, but back-slapping is certainly
viewed differently across cultures, and then there are the subtle rules around
eye contact which usually aren't written anywhere at all except maybe
sociological research papers. All of those things can make someone feel rather
uncomfortable if they meet exactly the wrong person, perhaps after everyone's
had a few drinks.

Abuse is culturally dependent. Some things are regarded as universally wrong,
perhaps, but vast swathes of things aren't universal in the slightest.

~~~
PieterH
Citations, please. I've grown up and lived in many cultures. Manners change.
Abuse does not. Invoking cultural relativism is not going to work here.

Let me explain: abuse is about identifying a boundary and then crossing it,
deliberately, and repeatedly, to gain control over another person.

The boundaries shift from person to person and culture to culture. Yet it
always the same dynamic, and you can see it, and you can stop it.

------
peteretep

        > The mainstream theory of harassment (let's call it
        > "Model A") has these assumptions:
        > -  Anyone can be the harasser.
        > -  Harassment is a motiveless act.
        > -  Outlawing harassment will stop it.

I don't think that's right.

I think people who want a Code of Conduct generally see the _primary reason_
for a Code of Conduct as a signal from organizers that they will take actions
listed seriously as harrassment if they happen.

It's like a sign at a small rural hotel that says "Same-sex couples welcome".
They don't mean that other couples are unwelcome, they don't mean they're
catering exclusively for same-sex couples, they don't think you should change
religion: they're just sending out a signal that if a guy and his husband stay
there, they're not going to run in to official hostility.

A CoC sends the signals that: the organizers know harrassment takes place,
they care, and they're willing to publically agree to address it and take it
seriously when it occurs.

~~~
PieterH
I think we agree that is the intention. However it's more like putting up a
sign on a hotel saying "Murder and mayhem will not be tolerated."

If there is a real risk of murder and mayhem, the sign needs to read, "If
someone tries to murder you, please call 911!"

Harassment does not simple "take place" and that's the point. Participants
enter zones of vulnerability caused by distance from home, separation from
friends, alcohol, the need to socialize, etc. This draws in predators. The
organizers need to understand that, and guard against it.

The term "code of conduct" is itself a problem as it strongly suggests "behave
or else!" while talking to the entire audience.

Do you have a better explanation for the antagonism many feel (and I
personally used to feel) towards codes of conduct?

~~~
peteretep

        > However it's more like putting up a sign on a hotel
        > saying "Murder and mayhem will not be tolerated."

I have previously held that view, but now think that was mostly a function of
my white male privilege. If you go to a hotel proprietor and report murder and
mayhew, you have a reasonable expectation that it will be dealt with properly.
Many people apparently did not have this expectation of technical conferences,
based on their experiences. Many people like myself - who hadn't had those
experiences - assumed it was so obvious it didn't need saying.

        > This draws in predators

I think that's right, but is a massive simplification. I think good people can
act in ways that make other people feel uncomfortable, without meaning to, and
that also needs some consideration.

        > The term "code of conduct" is itself a problem as it
        > strongly suggests "behave or else!"

Really? To me it says "these are our expectations".

        > Do you have a better explanation for the antagonism
        > many feel (and I personally used to feel) towards
        > codes of conduct?

I think many men growing up have negative formative experiences with certain
women who have considerably more social power than them (for simplicity: the
popular girls!) exerting it to make them feel ashamed. They see potential for
what they see as a safe space being used against them. They have a genuine
fear of their well-intentioned actions being used to label them as a _bad
person_. They see the Adria Richards and Pycon examples as a realization of
their worst fears in this area.

~~~
PieterH
Honestly, accidental discomfort is part of being grown up. To try to regulate
that is IMO both patronizing and counter productive. We need some level of
friction to socialize. A CoC that lets well-meant actions become crimes is
worse than no CoC at all. I explain this in my article: certain people will
use poorly-designed tools to harass.

The key to solving this mess is, and I stick by it, to separate accidental
clumsiness from predatory behavior. There is no grey overlap.

Once you separate these two, you can teach people to trust each other much
more, while being properly cynical of the small slice of predators.

This isn't hypothesis: we use this approach in our open source communities to
encourage and thrive on honest mistake while watching for, and blocking
predatory actions.

I may add a piece to the protocol along the lines of, "Tolerance means
accepting that people make mistakes, and working with them instead of treating
this as a violation."

------
chippy
This is a good approach to severe acts of harassment in real life meetings of
people. In particular social events involving beer.

But these acts are rare in tech events. The most common acts of behaviour we
see that some people call for Codes of Conduct are not this severe. The most
common types of things would include: telling lewd jokes, being loud and
argumentative, questioning particular religious or political beliefs, or being
not politically correct enough.

In short behaviours which do not fall into a right and wrong objective
morality, but which depend greatly on the thoughts and feelings of those
offended. They are subjective. These are the behaviours which I think many
proponents of Codes of Conduct in tech events are thinking of.

~~~
PieterH
The reason I wrote this article is because I think the mainstream is so wrong
it hurts. All the behaviors you listed are a normal and necessary part of
socialization. Without some argument there is no learning. There is a real
right to freedom of speech.

This is why I tried to define "violation" from first principles as an unwanted
intrusion into personal time and space. There must be (profoundly) the
intention of damage. Offense is not damage.

~~~
chippy
I see, thank you!

------
fche
"So the solution is to remove the incentives and opportunities for
misbehavior, and raise the risks of exposure. Then, bad actors will adapt and
self-select. Either they will behave, or they will go elsewhere."

That sounds good, but nothing in the rest of the write-up actually "removes
incentives and opportunities" etc. It's the usual sort of "don't harass, don't
touch, don't X Y Z ..." litany, without any procedural prescriptions as to
what to do in case someone does X.

~~~
PieterH
The protocol I describe is almost entirely about procedure. Was that not
clear, or not detailed enough?

Removing incentive and opportunity means recognizing what creates risk for
participants, and reducing that. Which I also did try to cover.

~~~
fche
OK, there were three bullets in the middle of the "protocol" that dealt with
procedure. ("The organizers shall provide as secure ..." through "... privacy
of all parties"). But it belabours trivia ("collect time, place, name ...")
and skips over substantial questions like burdens of proof, appeals, range of
penalties, false complaints, violations of procedure. That's the meat &
potatoes of law, amateur or professional.

~~~
PieterH
You're right, this part is thin. In terms of penalties, there is only
exclusion, or law enforcement. We can expand on the procedural part later.

------
cbd1984
> The organizers shall be aware of the risk of "date rape" drugs.

They shall be aware that the most important "date rape" drug is alcohol.
That's un-PC to say, especially around drinkers, but it's true.

~~~
PieterH
Yes, very much so. This is critical. We often depend on alcohol to relax and
socialize, when among strangers. Yet it makes us vulnerable to all kinds of
manipulation, and the next day everything is blurred and we forget.

When I see a man (or woman) offering shots, time after time, to people who are
already drunk and careless, I watch his face and his eyes.

------
pornel
> Harrasement is not a gender issue

It's interesting that it can be true, but not change much in practice due to
gender imbalance at tech conferences.

Let's assume that 1% of attendees (of any gender) are bad actors attacking the
other gender. If a conference has e.g. 800 men and 200 women, then there will
be 2 female harassers vs 800 men, and 8 male harassers vs 200 women. That's a
16 times difference in likelihood of being harassed ((8/200) / (2/800)), just
from attendee imbalance, and no fault of any gender.

~~~
PieterH
Most harassment at tech conferences is male-on-male, and it is not sexual. It
is about power and control, and perhaps amusement. Sex, gender, height, choice
of programming language: these are ways to create and exploit vulnerability.

Sometimes I don't think psychopaths, sorry, bad actors, care about sex at all,
except as a tool for controlling people.

~~~
pvdebbe
Is making fun (not constantly though) of some bad languages now harassment?

~~~
PieterH
If it's used to intimidate and isolate, then yes.

Remember school bullies? Same thing yet more subtle and stealthy.

Often the model of harassment is indirect. For instance you have a group of
people who are happy and working together. A predator arrives and sees
opportunity. He sees another guy is protecting and coaching the group. So he
slowly undermines and destroys this guy's credibility, provoking him to anger
and finally making him leave. Then, the group is exposed and easy to play
with.

You almost never see it. Even when it happens to you, you can almost not see
it. It is so slow, careful, smooth. This is why education of these patterns of
stalking, isolation, and attack are so important.

------
rl3
> _The organizers shall be aware of the risk of "date rape" drugs._

I'd love to see sensor hardware combined with computer vision techniques
employed to combat this problem.

Smart glassware already exists, but a major caveat is that it doesn't catch
the perpetrator.

------
4ad
Well, this article is interesting because it's not the typical mindless Yes We
Can article written by someone who heard that now wanting "Social Justice"
(whatever that is) is the trend of the day, without understanding the dynamics
of social interaction in the slightest.

It's also not an article written to sound like someone in the above category
wrote, but in fact is being written by someone who _understand_ the social
dynamics, and just has an agenda.

In fact the article is sincere, and correctly identifies the "problem". There
are many things I find abhorrent about the proposed world described in the
article, but I will refer to only one of them. Btw, even if I find abhorrent
this "new" world order, it's much better than the world order imposed by the
Yes We Can people.

> Additionally, they shall have one or more "hosts" who do not drink alcohol,
> and who are trained to observe and catch violations should they occur.

Yeah, this casual suggestion that some sort of "police" should exist to
_monitor_ people's behavior and catch policy violations quickly is the worst
thing that is currently happening to humanity in my opinion, and ultimately
results in a world I don't want to be part of.

The police part is bad in itself, but much worse is how casual this "final
solution" is proposed, and how little people complain about it. People were
bred into obedience and submission. We already lost.

There's very little for me to do about this. All I can do is vote with my
money, e.g. I don't go to conferences where people are not adults enough that
they don't know how to _live_ , yes, live life, without CoCs and police, even
though I am one of the nice people at those conferences, not one of the "bad
actors" the author mentions. Of course this doesn't affect the world in the
slightest.

~~~
PieterH
I've a large building and we've hosted many parties here. Almost always,
people are great, even when drunk. Alcohol does not make good people turn bad,
in my experience. Every now and then an event deteriorates. I learned that
someone has to stay sober and play host. It's not about policing. It's about
being available, and separating parties when there's an incident. That's all.
I'll modify the text to make this clear, as the notion of policing is exactly
what I'm trying to make distance from.

One example: we had a party downstairs with several hundred guests. It was a
Congolese wedding, so people were drinking a lot. I go to sleep, and around
2am get woken by extremely loud noises. I put on some clothes and go down, and
find a battle raging in the entrance to my building.

Seems two young guys (North African) had come in and were caught stealing from
peoples' jackets. The crowd had caught them. One had escaped, one was still
prisoner. The one that fled had come back with reinforcements, so I found
about eight young men hammering on the doors of my building with a steel bed
frame (don't ask me where this came from). Inside, a group held the other
young man down, while he was shrieking for help, afraid they would murder him.

It took only a few seconds to get this whole story from various people. I
picked up the young man by his arm and dragged him out, and threw him at his
friends. "You will leave now, or the police will be here," I told them. They
put the bed down and left. I told the party goers, "are you utterly insane?
What did you think was going to happen?" and ushered them back into the party
room.

It all took maybe 5 minutes.

If I'd had even a small amount to drink, no way I could have done this.

Now, such incidents are extreme. Yet when you have guests in your home or
event, and you offer them alcohol, you have (in my mind) to look after them.
No ifs or buts. Bad stuff can happen.

I also learned after this night to have professional security, which is
another thing that can help.

Hope this helps. The host absolutely does not monitor peoples' behavior.
He/she intervenes quickly when there is an issue, before it gets out of hand.

Thanks for your feedback, it was helpful.

~~~
afarrell
Wow. I admire your ability to take command of a situation.

------
stefantalpalaru
> The term "bad actors" is a convenient euphemism for sub-clinical
> psychopaths.

Nice example of dehumanizing the enemy. We now have our very own
untermenschen.

> It will speak to bad actors and say, clearly: you are welcome as long as you
> act decent. Otherwise, we are watching, and we will catch you.

Is this why we, a bunch of adults, congregate in technical conferences? So we
can hunt down the "baddies", play the policing game, recycle some old
presentations so we can feel good about our technological choices and at the
same time pat ourselves on the back for finally being able to bully someone as
a group?

~~~
PieterH
You're projecting and/or reading meaning that isn't there. Most of us
congregate to learn and open our minds. A small percentage come to prey on
others. This is just how it is, no good or bad.

My book The Psychopath Code
([http://psychopathcode.com](http://psychopathcode.com)) makes it quite clear
I don't consider psychopaths as enemy or bad guys. It's much more fun than
that.

~~~
stefantalpalaru
> Most of us congregate to learn and open our minds.

So not to feel safe and protected, like when we were children?

> I don't consider psychopaths as enemy or bad guys

But you consider them "bad actors". Furthermore, you simplified everything by
declaring that every unsavory character suffers from the same pseudo-
psychiatric pathology. And you're supposed to be an authority on the matter
because you wrote a book?

~~~
nailer
> bad actors

That's a common infosec term. Eg:
[http://www.csoonline.com/article/2124416/malware-
cybercrime/...](http://www.csoonline.com/article/2124416/malware-
cybercrime/bad-actors-exposed--mccolo--zlkon--hostfresh-and-the-damage-
done.html)

~~~
stefantalpalaru
It is. You still can't say that "bad actors" are not bad.

~~~
PieterH
I can, and do.

"Bad actor" is a term. "Bad" is an adjective. It's like saying "apple" and
"pine apple" must be the same fruit. We're smart enough to give different
meanings to the same word, in different contexts.

Bad actors act in a specific way that we can observe, model, understand, and
predict. This is independent of perspective. "Bad" is a moral judgement that
only exists in the head of the target.

A beetle parasite of an ant colony is a "bad actor." It is not "bad."

~~~
stefantalpalaru
> It's like saying "apple" and "pine apple" must be the same fruit.

No, it's like saying that a "bad apple" is not necessarily bad.

~~~
PieterH
If you're making cider, then a "bad apple" is essential.

I'm not making this up as I go along. Almost four years ago I wrote
([http://hintjens.com/blog:18](http://hintjens.com/blog:18)) "The Economics of
Evil" explaining why bad actors (I used "bad guy" in that post) were necessary
(so "good" overall).

Nothing radical here. Predators are bad for individual prey animals yet
essential for the health of the prey species.

I'm curious what you are trying to argue here because while this is
interesting stuff, it seems quite random.


Ask HN: What is ONBOARD-2698? - shay_ker
I see it in Twitter's robot.txt file, as well as many others:
https://twitter.com/robots.txt
> # Wait 1 second between successive requests. See ONBOARD-2698 for details.
Is this some internet meme?
======
detaro
I'd guess thats a reference to a twitter-internal bugtracker - JIRA issues
have that format.

------
dotti
Looks a lot like Jira ID of some bug/task


How We Think with Bodies and Things - wslh
http://www.youtube.com/user/StanfordUniversity#p/u/147/Vhcubb00g6c

======
cpaone
I don't think he's got Wittgenstein right. But it's interesting.


Real Programmers... - marcog1
http://www.pbm.com/%7Elindahl/real.programmers.html

======
raganwald
_The academics in computer science have gotten into the "_____" rut over the
past several years. They claim that programs are more easily understood if the
programmer uses some special language constructs and techniques. They don't
all agree on exactly which constructs, of course, and the example they use to
show their particular point of view invariably fit on a single page of some
obscure journal or another-- clearly not enough of an example to convince
anyone. When I got out of school, I thought I was the best programmer in the
world. I could write an unbeatable tic-tac-toe program, use five different
computer languages, and create 1000 line programs that WORKED (Really!). Then
I got out into the Real World. My first task in the Real World was to read and
understand a 200,000 line program, then speed it up by a factor of two. Any
Real Programmer will tell you that all the _____ in the world won't help you
solve a problem like that-- it takes actual talent._

This paragraph still holds, and it does so for any quiche-eating,effete value
of _____.

~~~
dkarl
Funny how often Real Programmers deride ______ while using _____ - 1. The Real
Programmer's objection to ______ is always that it isn't performant or
practical or available on the right platforms. In other words, Real
Programmers stick to mature, widely-deployed technologies and become
prodigiously adept at dealing with their (well-known) shortcomings while the
idealistic Quiche-Eaters fight against the shortcomings of immature,
incomplete systems that have unknown and often show-stopping flaws. It doesn't
sound to me like Quiche-Eating programmers (distinct from Quiche-Eating
pundits/academics) have it any easier than the Real Programmers. They may even
be a little bit braver. (You might not want them working for you, though. Let
some other company or project bear the burden of polishing immature
technologies.)

~~~
raganwald
While what you say is interesting, I consider it orthogonal to the statement
given, namely that understanding _____ without real-world programming
experience is not helpful when facing a real-world program for the first time.

Or more simply, _____ is never a silver bullet.

~~~
dkarl
I disagree. I think a programmer would be much worse off facing his first
real-world programming problem armed only with an instruction set and a hex
editor than if he had a C compiler and knowledge of C. Just knowing how
structs and functions work gives you some mental tools for solving the
problem. "Any Real Programmer will tell you that all the _____ in the world
won't help you solve a problem like that" just doesn't make sense if read
literally -- is he claiming that no set of ideas for structuring programs
actually enhances your abilities at all? "It takes actual talent" is just an
empty truism (like "______ is never a silver bullet.") So the statement falls
apart when taken seriously, which calls the attitude it expresses into doubt.

And that's the dual thrust of the article. It doesn't just make fun of Quiche-
Eaters. It also makes fun of Real Programmers. The humor is based on the
difficulty of drawing a line between progressivism and trendiness. Or, to turn
it around, the difficulty of drawing a line between pragmatism and fatalism.
The article is written from the point of view of someone who errs on the side
of fatalism (believing that no new ideas will ever prove useful) and who makes
fun of people who err on the side of trendy prissiness (turning up their noses
at anything mature enough to actually work.) The Real Programmer speaking in
the article manages, quite ironically, to make just much fun of Real
Programmers as Quiche-Eaters. Consider the paragraph you quoted. Of _course_
the most appropriate ideas for finding your way around a legacy system are the
ideas that were used to _create_ that system! That illustrates how the
(caricature) Real Programmer's perception of technical superiority is skewed
by a lack of historical perspective (quite funny given his relish for
history.) Quiche-eating, effete values of _____ have a way of turning into
Real Programmer stuff when they became widespread and uncool. That means a lot
of today's Real Programmer stuff consists of yesterday's quiche. Structured
programming? That's _C_! The present-day Real Programmer sees himself as the
inheritor of the guy who scorned present-day tools as effete, not as the
inheritor of the Quiche-Eaters who pushed the development of present-day
tools. (Likewise, one might parody Quiche-Eaters as not _wanting_ their ideas
to suffer the indignity of becoming mature and practical.)

------
russell
1983? It's obvious this guy is just a kid. The stuff he talks about is new
stuff. OS/370, 029 keypunches, Fortran 66, Quiche, for god's sake? I started
programming in college in Fortran II on a 7094 running UMES (University of
Michigan Executive System). The 360 let alone the 370 was yet to appear.
Quiche had yet to make it across the Atlantic. My roommate told tales of his
summer job in high school, programming an IBM 650 for NASA. The 650 didn't
even have core memory, just a drum.

It wasn't "Real Programmers". It was "Real Men" programmed in Assembly
Language. "Boys" programmed in Fortran. We had our testosterone unadulterated.
Except an old coot told me, "Real Men do it in binary."

None of this Pac-Man stuff. We played baseball using the index register lights
on the 7094 console and Space War on the PDP-1. We didnt use terminals or even
the newfangled terminals, just the trusty 026 keypunch.

I tell you, we were Real Men, even the girls.

~~~
MaysonL
Fortran II? Real Programmers used FAP! [EDIT: Fortran Assembly Program]

I have fond memories of the Bendix G15 - a drum memory machine where each
instruction included the address of the next instruction.

------
Xichekolas
Honestly, I sat down to read this with the preconceived notion that it would
be part of an ancient language war, but instead discovered one of the most
cleverly written pieces of satire I can remember.

I especially like how the things he derides as belonging to "quiche eaters"
(notably Unix, Emacs, and Vi), are what we consider 'hardcore tools for real
programmers' today.

~~~
jamesk2
In 20 years real programmers will program in Visual Basic and Quiche
eaters/script kiddies will just go brain-to-binary with a SQUID.

------
ori_b
I still think my favorite "hackers of old" story is The Story of Mel:
<http://www.pbm.com/~lindahl/mel.html>

------
smanek
_If there is not enough schedule pressure on the Real Programmer, he tends to
make things more challenging by working on some small but interesting part of
the problem for the first nine weeks, then finishing the rest in the last
week, in two or three 50-hour marathons. This not only impresses the hell out
of his manager, who was despairing of ever getting the project done on time,
but creates a convenient excuse for not doing the documentation._

Wow, some things never change ;-)

------
huhtenberg
_If you can't do it in Fortran, do it in assembly language. If you can't do it
in assembly language, it isn't worth doing._

Physics department guys in my university had this printed out and stapled to
the wall. Pretty much all math modeling libraries they wrote were in Fortran
with some bottlenecks redone in assembly. It was more than 20 years ago though
:)

~~~
pmjordan
It hasn't changed that much, at least not at the University where I got my
Computational Physics degree in 2006. Instead of FORTRAN70 everyone was using
Fortran 90 (using F70-era libraries) and I don't think anyone was doing any
assembly language programming as the modern compilers even do
autovectorisation.

------
verdant
Seems to parallel how some of the Pascal/C/C++ era programmers feel about
Python/Ruby/PHP web developers of today.

~~~
dryicerx
There had been a Pascal era, but C and especially C++ are still alive and very
much current.

Even then, those two sets of languages aren't really comparable. Where it does
hold true is how lot of the C and C++ programmers feel about Java and C#.

~~~
verdant
I didn't mean to imply that C and C++ were from a bygone era. Even Fortran is
still used today, (though of course C and C++ are still in very wide use).

I just meant to draw a parallel about those who learned to program after the
era of mainframes and terminals, on operating systems like Unix, Windows, and
Mac OS but before the Web really became a true platform and how they would
feel about web programmers. I included Pascal because it was discussed in the
article extensively.

------
Hexstream
I liked this:

"Nicklaus Wirth, the designer of Pascal, gave a talk once at which he was
asked, "How do you pronounce your name?". He replied, "You can either call me
by name, pronouncing it 'Veert', or call me by value, 'Worth'.""

------
rvirding
A true classic, and wonderfully funny. Though I prefer tea.


Ask HN: Comercial software protection - ukmar
As a side project I developed an application which update after update turned out quite nice.
Since I know it fits a niche market I would like to make it comercial ($50) per license.
However what bothers me is the protecion.
What type of protection can I use that:
1) does not use a dongle
2) should not take more than 2 months to implement.
I'd like if you pointed to materials to read and implementations examples.
======
azeirah
What exactly do you want to protect against?

In my personal experience, customers can be trusted and hackers don't care
about your software. For my own software I've implemented an extremely basic
licensing system. I've collected data about how many unique mac addresses use
each unique license, so I can count what licenses are used by multiple
computers. I've just done a simple filter on all my licenses to see which ones
are used by over 5 mac-addresses. I expected there to be more, but the result
was 13. There are 13 licenses that are being used by more than 5 computers,
none of those licenses are used by over 14 computers.

That's 13 out of about 3500 licenses mind you.

This is just my reality, maybe your target niche is script kiddies or broke CS
students, consider your target group, but I suggest you not to worry too much
about it, just implement a really basic licensing system to prevent no-effort
abuse and you'll be fine.

~~~
ukmar
Exactly, I want to protect from multiple installation with one license.

Do you have a server that you use for the licensing? How did you come up with
such statistic?

How do you handle if one client changes pc (MAC changes), does he really
change pc?

~~~
azeirah
I have a server, yes, every time someone starts up my application, it sends a
request to my server to with a (LICENSE, MAC-ADDRESS) tuple, which I store.

So far, I've never acted on MAC changes. If I saw a license that was used by
say 50 MAC-addresses, I would disable it and send an email to the original
buyer, scoff at him and give him a new license. But so far no-one has done
this, not one person out of ~3500 has shared their license with a larger group
of people.

Just trust your users for now, collect some statistics if you're really
concerned, and act if someone is really abusing your system. Don't ever go
after ambiguous cases, ever. I made this mistake in the beginning, got many
MANY false flags.

I think collecting the statistics is a really good idea, because it will show
you that your userbase is trustable, and you will change your perspective on
software protection :)

~~~
danieltillett
You do realise crackers strip out your server request code. This is trivial to
do. You really have no idea of how many people are using your program.

~~~
azeirah
Oh yeah true, but I know I can't project against that anyway, pirates gonna
pirate, and I'm not against that.

But tbf, I don't think there are any people who even bothered cracking my
program...

~~~
danieltillett
You can, but it is not easy, simple, or very user friendly.

It really depends on your market and software. For most software it doesn't
make sense to bother with anything other than the most basic licensing system,
but for some software it does. I sell quite a lot of software in China and
India and I would not be able to do this unless I spent a lot of time and
money on anti-cracking activities.

------
brudgers
The best way to protect commercial software from piracy is to sell into
markets where piracy is against market practice. For example, enterprise and
government institutions often have license compliance policies accompanied by
audits and trainings and memoranda and scoldings.

Part of that means that the pricing policy should discourage piracy. An
institution for which the difference between $50 per seat and $500 per seat is
a big deal for a product that provides $10k+ of value is more likely to pirate
as a matter of cultural ambiance. And a price of $500 per seat increases the
likelihood of having the resources to provide $10k+ of value over the long
term. $500 per seat also means that piracy is less likely to take food off the
table even if a substantial fraction of use is unlicensed.

Good luck.

------
danieltillett
It depends on what market you sell into. If you are selling niche software in
the USA and Europe then don't worry too much about piracy. If you are planning
on selling in China and India then you need to think very seriously about how
to protecting your software.

My company sells a lot of expensive niche software into the Chinese and Indian
market and about 50% of our development effort goes into software protection.
Unfortunately there is no easy solution, but if you want to contact me offline
I can suggest some solutions.

~~~
ukmar
Actually the thing that bothers me is not protection per se as I know that
someone with enough determinism will crack it.

I am curious how do you handle license revocation or when you detect if
someone is using an illegal license.

What about offline users? How to handle licensing?

~~~
danieltillett
Sure if someone puts enough effort into something anything can be cracked, but
you can make it long and slow job. This is 99% of the job done if you have
niche software.

In regards what protection we use, I am not too keen to list them in public,
but my basic principle is layering. Use enough different systems and layers
and you are going to make life very hard for a cracker.

------
BjoernKW
For Java there's License4J:
[http://www.license4j.com/](http://www.license4j.com/)

There should be similar tools for other languages as well.

My suggestion is to not overthink it. There's no perfect solution that will
prevent your software from being copied in every scenario imaginable. Just use
common sense. It certainly shouldn't take 2 months to implement. Your
customers aren't paying for copy protection after all.

------
dsl
See if you can sell it first. When piracy becomes a problem, then look into
software protection.

Niche software rarely gets pirated because the demand is low.


The Great Lakes: An Ojibwe Perspective - bookofjoe
https://decolonialatlas.wordpress.com/2015/04/14/the-great-lakes-in-ojibwe-v2/
======
bookofjoe
Map toponyms here: [https://decolonialatlas.wordpress.com/2015/04/14/the-
great-l...](https://decolonialatlas.wordpress.com/2015/04/14/the-great-lakes-
in-ojibwe-v2/)


How to conduct a good programming interview - lihaoyi
http://www.lihaoyi.com/post/HowtoconductagoodProgrammingInterview.html
======
thiscatis2
So reading over some of the questions posted on technical programming
interviews I must say that I would definitely fail such an interview without
studying for it for a month first. Having recently discussed job interviews of
ex-colleagues that went to EBay, Facebook, Google, etc.. I wouldn't even pass
the whiteboard test.

However I'm shipping scaleable API's used by web and native apps, using
Continuous Integration and Deployment on an AWS infrastructure that I set up
myself. Furthermore I'm responsible for hiring developers that I work with on
agency projects and most important of all getting projects delivered within
time, scope and budget AND getting paid for it. Yet I would fail most
technical interviews.

I've been doing this for about 10 years and never ran into any major problems.
I've worked both as a freelancer and in-house permanent dev and never had any
complaints about my work. (Feedback and improvements yes, big failures never).
Yet I would fail most technical interviews.

I talk directly to clients and vendors, I sell projects, I take over projects,
I end projects and I've created 2 startups, one of which I sold but I would
definitely fail a purely technical interview.

I completely understand the need for these technical interviews and weed out
obvious bad programmers and get experts on board but sometimes from a business
point of view it just doesn't make sense.

At a previous company I worked for the team almost crashed & burned because of
the TL's focus purely on technical skills. No code was being shipped but hours
of meetings and Slack conversations and discussions on PR's for no good reason
about 0.01% improvement gains.

I know I'm not the best developer out there and never will be. Often I'm in
awe of the technical skills of people out there but I rather have a less
skilled dev with great "people & shipping" skills as I call it than some of
the people that would pass all these tests but that I couldn't put in front of
a client or even let them email a vendor.

~~~
nolemurs
> I completely understand the need for these technical interviews and weed out
> obvious bad programmers and get experts on board but sometimes from a
> business point of view it just doesn't make sense.

The thing is that the main goal of the technical interview is _not_ to hire
all good candidates. The main goal is to _avoid_ hiring bad candidates. A
large high paying company like Facebook has plenty of candidates to choose
from, and the main priority is avoiding expensive bad hires. The cost of
failing to hire a good engineer is small - they can just take the next guy.
The cost of hiring a bad engineer is large.

With this in mind, the process makes a lot of business sense. Someone who is
capable of learning what's needed to do well on a technical interview has
demonstrated a fairly high level of competence, and is (relatively) unlikely
to be a really bad hire.

This filter does limit your applicant pool a little, but if you're Facebook,
the largest chunk of your applicant pool are recent comp. sci. graduates. If
they can't solve an algorithms problem reasonably gracefully then that's a bit
of a red flag. For non-recent-comp-sci-graduates, a competent candidate really
should be able to prepare pretty well in a month or two of spare time.

Facebook might miss out on hires like you who would likely be quite good at
the job but aren't willing to put in the effort to prep for the interview, but
that's a trade off they'll make happily if they minimize bad hires.

Smaller companies with lower pay and access to fewer qualified candidates
would probably be ill advised to copy the Facebooks and Googles of the world
though. I'll grant that.

~~~
sidlls
> Someone who is capable of learning what's needed to do well on a technical
> interview has demonstrated a fairly high level of competence, and is
> (relatively) unlikely to be a really bad hire.

Sure, as long as their only role is repetitive coding tasks that require
limited amounts of broadening their experience beyond the DS&A trivia places
like Facebook require.

However then Facebook ends up with stuff like their iOS app ("iOS can't handle
our scale"), which had a lot of (probably) very talented CS folks putting
together an app that was pure garbage (from an engineering and usability
perspective).

The filter limits the applicant pool to that set of people uninterested in
solving problems outside the scope of a CS textbook. Capability has little to
do with it.

~~~
nolemurs
> The filter limits the applicant pool to that set of people uninterested in
> solving problems outside the scope of a CS textbook.

The only way this would be true is if being good at textbook CS makes you bad
at solving other problems. I'm assuming you don't actually think that, 'cause
it's kind of crazy.

Even giving the benefit of the doubt and assuming you mean that the filter
makes the pool less likely to contain good problem solvers, it's hard to see
where this idea is coming from. In my experience, being good at one sort of
problem solving makes someone _more_ likely to be good at other sorts of
problem solving. The correlation between skill in problem solving across
domains is weak sometimes, but it's definitely not negative!

~~~
ubernostrum
_The only way this would be true is if being good at textbook CS makes you bad
at solving other problems._

The way the typical interview process works, basically, is "we have a list of
6-12 algorithms we will ask about; if you have memorized implementations of
them, and certain key phrases to identify which one to regurgitate on command,
you pass the interview".

This is then touted as a test of "CS knowledge" and "problem-solving ability".

Tech interviewing is Goodhart's law in action.

------
tptacek
It's good to think carefully about how you interview candidates. Most of the
ideas in this post are good. You should definitely let candidates type answers
on computers. You should definitely work to put them at ease, in an
environment that approximates their actual working environment.

But really, this is window dressing. The problem is that technical interviews
just don't work reliably. We have better ways to qualify candidates.

Rather than trying to read subjective, noisy signals from in-person
interviews, give candidates a small battery of _work-sample tests_. These can
be bug-fixes, small features, diagnostic challenges, or even specification
writing assignments.

A properly designed work-sample challenge has a _rubric_ : a set of
instructions for scoring a result. Ideally, the rubric is straightforward
enough for someone who hasn't met the candidate to quickly score their result.
"Runs correctly". "Passes a battery of unit tests". "Includes appropriate
documentation". Whatever is important for your team.

Work to give every candidate the same set of challenges, so you can track
results over time. You'll find that after refining and iterating for a few
months, you'll rapidly build confidence in the tests, to the point where in-
person interviews become superfluous for technical qualification.

Working on technical qualifiers is stressful. Most candidates will perform
more poorly on them than they would on normal work. You should build that into
your rubric (though, really, data from candidates will ultimately determine
how strict the rubric becomes).

Understanding how stressful qualifying work is, you should consider not
requiring candidates to work on problems on-site. Instead, administer them
online. Suggest the amount of time you expect the problems to take to finish,
and offset that amount of time from the amount you demand on-site.

When you must interview, you should work hard to _standardize the interview_.
Interviewers _hate_ this. Everyone has their favorite questions. People want
interviews to be conversational and adaptive. Interviewing isn't supposed to
be fun for the interviewer; it's supposed to be reliable.

~~~
balls187
Other than the pain of being rejected (or rather the lack of validation),
where does this reliability problem manifest?

Elite tech companies have no problem with the current implementation of
technical interviews.

Engineers whos skills range from Great to Mediocre don't have a problem
finding a job.

Software quality has generally improved or stayed the same.

~~~
tptacek
This is demonstrably false. Lots of great engineers are terrible at
interviewing. If you ask around, you can get even some very high-profile devs
to tell you stories about why they're not working at Google or Facebook or
Amazon because of how badly their interviews went. Equally importantly: lots
of terrible engineers are _great_ at interviewing, and most people in the
industry have had the experience of working alongside someone who is failing
up, 2-year-stints at a time.

What's true is that Google and Facebook have such enormous budgets and such
huge positive profiles in the talent market that they don't need to work hard
to put together functioning teams. They're paying more than they need to and
having to deal with more bad hires than they should, but it's for them a
marginal problem.

~~~
balls187
> lots of terrible engineers are great at interviewing and most people in the
> industry have had the experience of working alongside someone who is failing
> up, 2-year-stints at a time.

You mean lots of companies are terrible at firing terrible engineers.

The argument is basically the current implementation leads to false negatives.
What impacts does that have?

Presumably those very high-profile devs aren't lacking employment
opportunities, even if it isn't at the elite tech companies.

Companies, from Elites down to pleb-tier, while perhaps pressed for resources,
are still able to execute.

So why is the problem of false negatives a problem we should focus on?

~~~
tptacek
Almost every company is terrible at firing ineffective engineers. Even some of
the companies that are famous for doing so ("'meets expectations' earns a
generous severance package!") don't necessarily manage to accomplish that in
less than a year. This stuff sounds very simple on message boards, but is much
harder to do in real life.

The first N months of a developer's tenure at a job is difficult to measure
because of ramp-up and calibration (even good developers might hop to
different teams after getting hired based on work style fit issues). Whole
projects can flounder and need rescuing so that attention to ineffectiveness
gets deflected to group leads. Most good development shops will try to make
things work for a new hire that isn't performing at the 6 month mark, and that
process takes a few months.

Once the decision is made to fire, most big companies will PIP rather than
fire. Sure, once you've hit the 7-8 month mark of poor performance, your
severance from the firm may be a fait accompli. But the ultimate process to
make that happen can easily be made to take more than 12 months.

Once you have a year-long stint at a company on your resume, you can bank that
"experience" on your resume.

And that assumes a relatively well-run companies. Most companies aren't well
run in this regard, and you can be a terrible developer but last 2+ years in
most jobs. If you can reliably put more 2+ year jobs on your resume than
1-year jobs, you will end up with what will appear to most companies to be an
extremely attractive resume.

Remember, many management-track developers only write code for ~8-10 years.
Once you fail up to Dir/Eng, you're basically tenured.

Since almost nobody qualifies candidates effectively, failing up is a super
powerful strategy for this field.

~~~
balls187
Why are the terrible engineers terrible, leading to them being fired (after
1-2 years?)

I've not hired anyone who turned out to be bad at coding, but I have hired
people who had other performance related issues, which were difficult to suss
out during an interview.

From my own personal performance, my approach to interviewing has led to far
more true positives, than false positives, so I am biased towards continuing.

~~~
Jhsto
> other performance related issues

What are some examples of these?

~~~
balls187
Typically it's patterns of repeated performance issues, such as providing
estimates then routinely not completing work on time.

Or, failing to complete tasks they've taken on, requiring other teammembers to
step up in order to meet deadlines.

There are more extreme cases, like insubordination, theft etc, but they are
pretty rare.

------
sillysaurus3
_While there are a variety of ways you can conduct a programming interview,
the goals typically are the same:

Will the candidate be able to write working code if they join the team?

Can the candidate discuss code and problems with the people they'll be working
with?

Can the candidate reason about arbitrary problems and constraints?

Is the candidate someone we would enjoy working with?_

All of these can be solved directly by asking the candidate if they'd be
comfortable doing an actual task on the actual codebase, having them sign an
NDA, and then giving them a bugfix to perform. They're compensated for their
time, of course.

I'm doing it right now as a candidate and it's by far the best interview
experience I've had. The others were all artificial.

A lot of people have a problem with this model for one reason or another, but
in terms of effectiveness it's probably at the top 1%.

~~~
wjossey
I also agree. As someone who has recently co-founded a startup, this is
something my co-founder and I have spent a lot of discussing and exploring.

My personal experience with this style of interview was that it really helped
me to personally demonstrate my abilities. I was interviewing at a startup in
San Francisco in 2012 who wanted me to do a quick version of "battleship" as
part of their hiring exercise. I proposed, mid interview, "how about I help
you solve a performance problem with your current system. What's your biggest
issue right now?" My interviewer actually showed me, and we ended up solving
the problem together and then deploying out the change.

The funny thing about that experience was that when we were done improving
their platform, the VP of engineering was told what I did, and then had the
interviewer go back and do the battleship exercise anyway. They needed to
"benchmark" me against other candidates, and the only way to do that was with
a consistent "test". I did far more poorly with the battleship exercise than I
did helping them on their platform.

~~~
ThrowawayR2
> _They needed to "benchmark" me against other candidates, and the only way to
> do that was with a consistent "test"._

If your employer were ever sued by a candidate for discrimination and it came
to light that you had received different treatment than other candidates, some
very uncomfortable questions regarding the reason would be asked in the
courtroom. An unfortunate bit of fallout from the litigious environment we
live in today, but it is what it is.

~~~
e12e
Wouldn't it be (well, look) even worse if any number of the non-hires dud
great on the battleship test?

------
kevmo314
> If you ask the candidate the define the requirements for the task you're
> going to give them, you can't be surprised if the candidate imagines a use
> case with entirely different requirements from what you expected!

This section really resonated with me. I've had a few interviews where I came
up with a different answer than what the interviewer expected and this
resulted in a lot of tension, as the interviewer asserted they were correct
with zero exception. This often led to a lot of dead-end scenarios and the
interviewer trying to get me to see an alternate solution without telling me
explicitly.

I once had an interviewer tell me that O(k) was constant if k was a config
parameter (I disagreed because in practice, k would need to be tuned as a
function of the size of the data, and it would be like saying O(n) is constant
if you just fix n = 1M), and an interviewer tell me that you could solve an
optimization problem without an objective function (in actuality, he had an
objective function, he just thought it was obvious and didn't want to specify
it). In both cases, I understood what they were trying to get at _after_ they
explained their solutions, but in the process it was incredibly frustrating as
they seemed to just disregard my answer all together.

~~~
baddox
I love interview horror stories! In my most recent job search, which was early
this year, I debated with one interviewer whether checking for key existence
in a hash was a constant time operation. I insisted it was, and the
interviewer insisted otherwise with the same amount of conviction. That was
just a small portion of an all-day onsite interview. After leaving, I was told
they were looking for a more senior candidate. I was not upset.

~~~
GeneralMayhem
Could just be a terminology mismatch. Checking for hash existence should
always be constant, but checking for _key_ existence is generally only
amortized constant (that is to say, not constant across all lookups) - he may
have wanted you to talk about addressing schemes and degradation at high load
factors?

~~~
baddox
There was no subtle argument. It only came up because I was on the whiteboard
solving some simple word game that involved matching user input against a list
of valid words (e.g. the Scrabble dictionary). When asked to explain the
running time of the various operations, I said that we can store the
dictionary in, well, a _dictionary_ , and checking whether the user input is a
valid word will be a constant time operation. The interviewer insisted, with
no subtle argument about amortization or collisions or addressing, that this
was in fact a linear time operation.

~~~
fencepost
So likely thinking of it in terms of checking a tree based on characters
instead of hashes of full words. Which is more viable would likely depend on
what kind of memory constraints and dictionary size was being considered. Also
very implementation dependent, what's the size of the hashes generated?

Edit: curiosity got me looking at this for Python, with an answer of "it
depends, and both have correct aspects" based on Python's implementation [1].
The hashing varies by string length, the lookup is fixed unless there's a
collision and probing, probing will be minimized by growing the dictionary as
items are added. In any case, better than O(n) but worse than O(1) and with
some possible slowdowns during loading unless you can set an expected final
size during initialization.

Edit again: since I brought it up, turns out initialization doesn't really
matter, resizing is not a speed factor. Relevant discussion starts from
[https://stackoverflow.com/questions/1298636/how-to-set-
initi...](https://stackoverflow.com/questions/1298636/how-to-set-initial-size-
for-a-dictionary-in-python)

[1] [http://www.laurentluce.com/posts/python-dictionary-
implement...](http://www.laurentluce.com/posts/python-dictionary-
implementation/)

~~~
kevmo314
It's also possible the interviewer meant linear time as a function of the
length of the word, which would be true. Regardless, not being able to express
this clearly is a sign of a poor interviewer which unfortunately the candidate
takes the hit for.

~~~
baddox
That was certainly not the case. Multiple times the interviewer "explained"
that with my approach you have to run through every entry in the word list
which is linear time. My guess is that the interviewer wanted me to mention a
prefix tree of some type, and was completely blind to any other approach.

------
Goopplesoft
> 5 minutes of resume discussion > 45 minutes of coding

As anyone else found that a good resume discussion is often much better than
the coding component? I've concluded that implementation difficulties,
decisions made (tradeoffs, technologies, etc.) and the collaborative
environment around projects, are much better signals than the code part of my
interviews.

If you've dealt with a broad range of tech and can ask the right questions,
it's relatively easy to get a strong signal from a candidate by having a deep
discussion on their work on prior projects. Both are needed and very useful.

~~~
majormajor
Yeah. If they can't tell me about what they've built before, and aren't a
less-than-one-year-away-from-school new grad, I'm going to be wondering how
they deal with real problems regardless of whatever they can do algorithm-
wise.

If someone can talk about what approach they took, what other approaches they
considered, what made it hard, what made it easy, how often the requirements
changed, etc, then I'd rather ask them questions about that then spend the
whole time in code. Just do some small spot checks to make sure they aren't
taking credit for the work of others.

~~~
Goopplesoft
> Just do some small spot checks to make sure they aren't taking credit for
> the work of others.

Agreed, asking tough technical questions on this front gives a really solid
indicator of a 'bullshitter'. For example, I often ask people to diagram a
prior project architecture they worked on, and then ask them very fine details
of how things work and try to challenge them with alternative approaches to
see how they react. I get to experience working with them during the interview
through which I learn if they're smart and capable.

------
HugoDaniel
Here is how to do a good coding interview if you are a recruiter:

1\. Do your homework: know what projects drive the interviewee (what kind of
things she likes to code, what recent projects has she been involved in), make
sure they are a match for your company projects and goals

2\. Ask the interviewee for a git repository and take a careful holistic look
at it (commit messages and code, timespan, branches, merges etc...)

3\. Go for a 2h lunch with the interviewee in a relaxed environment to check
speak communication skills (talk about whatever you think is interesting, if
you can't have or don't know how to have 2h lunches you shouldn't be
interviewing, check your life first and learn how to enjoy it before doing
interviews).

4\. Stop asking programmers to write code in 40 minutes. Learn how to respect
before expecting respect in return, if you didn't take the time to read
through their code repositories then don't ask for a 40 minute code problems.

~~~
mwcampbell
I think you missed the part where the OP said not all candidates are willing
or able to work on open source projects.

~~~
HugoDaniel
Well the .2 "Ask the interviewee for a git repository" can be a private
repository. It is a very hard problem to solve if they have no visible code to
show but it does happen in other areas. Imagine asking for a management
candidate for the private e-mails he shared in certain tricky situations of
previous jobs. Or even public e-mails. Or even to take 40 minutes to write in
a whiteboard a team statement for a certain conflict scenario.

Trust is entailed when recruiting in most areas. But in programming not as
much.

~~~
jonathankoren
> Well the .2 "Ask the interviewee for a git repository" can be a private
> repository.

If someone shares a private git repo, they should not be hired, and in fact
should be fired from their current job, and possibly sued. (Think Anthony
Levandowski sharing Google lidar designs as an example of his work with Uber.)

This isn't promoting trust. This is a violation of trust.

~~~
HugoDaniel
Yes I agree with you but I was not making the point of sharing a repository
you shouldn't share to a recruiter (I do own a few private repositories that I
wouldn't mind sharing to recruiters).

My point was that seeing code is not as mandatory for a recruitment as we
currently make it so. I gave the comparison to management but it happens even
in engineering areas. It is worth to know your candidate before asking to
write a solution to an air conditioning problem in a whiteboard in 40 minutes
when applying to a mechanical engineering position. Specially if your company
never solves air conditioning problems.

------
XCSme
Interviews suck for both parties, a world without interviews would be a better
world. Why can't we just hire someone based on his experience and projects he
previously worked on? You can have a first month as a "trial" where both
parties can cancel the contract.

Why interviews suck is because they are very, very biased and subjective and
also not a good way to estimate the actual performance of a candidate.

Say no to interviews! If you like what someone did, hire him. You can't get to
know a person after 1 or even 10 interviews, because the interview environment
is totally different from the work environment.

PS: I have been interviewed by 14 different people at Google. I didn't get the
job. The overall conclusion was that some interviewers loved me, my skill and
my work, others didn't like me from the start or simply didn't care about me.
Some of them had a good day so they gave a good "review" even though I made
mistakes, some of them had a really bad day (one fell of the chair) and gave
me a really bad review even though, related to the actual interview questions,
I did really well.

(14 interviews = applied twice, 2 x (5 on-site + 1 online), and they also
wanted 2 extra interviews to take a decision)

~~~
CJefferson
I'm sure most businesses would love that situation, but for employees it would
require you quit your current job, but have a good chance of being fired after
a month at your new job.

I imagine young employees would be happy (I did a bunch of short-term
contracts myself), but once you have a mortgage and kids, it's nice to be a
little more certain about your new job, before quitting your old one.

~~~
nolemurs
> I imagine young employees would be happy (I did a bunch of short-term
> contracts myself), but once you have a mortgage and kids, it's nice to be a
> little more certain about your new job, before quitting your old one.

And just to make this really explicit - this means that a company with this
hiring practice would have a _very_ hard time hiring experienced competent
engineers. If I were looking for a job, I'd have lots of options, and I would
_not_ waste time on a company that demanded this.

------
sidlls
Some points are quite good, and in particular the author calling out the
rubbish of asking "neat little algorithmic" questions (e.g. asking things like
"implement mergesort").

However one thing I'd point out is that this guide still falls far short of
being a good guide for finding _engineers_. Particularly noteworthy, in my
opinion, is that the measurement criteria are still applicable only to the
coding question itself. For example, "how well the candidate manages time"
still applies only to this limited 40-60 minute question. It doesn't really
help evaluate how the candidate might consider prioritization of tasks
(implementation or otherwise) in a broader, bigger sense.

------
mwcampbell
Here's another disadvantage of whiteboard coding: it's inaccessible to blind
people, and impractical (even more than usual) for people with only a little
vision (like me). Such candidates will need to do the coding on a computer, so
one might as well make that the default, as the OP recommends, and eliminate
one variable and a possible source of bias. Of course, once a blind or low-
vision programmer stays at a given company long enough, they'll probably be on
the other side of the interview at some point. So for consistency among a team
of interviewers, I imagine it would be best if all of them have their
candidates do coding problems on a computer, not just one of them.

I'm curious about why whiteboard coding is still a thing in the first place.
Is it a matter of convenience or cost? If so, surely that equation has changed
now that we have ubiquitous, cheap, portable computers. Or do some
interviewers really think that it's good to deny a candidate access to a real
computer while solving a coding problem during the interview?

~~~
mahyarm
These places use the computer for interviews already for the visually
impaired. It's just a name for a type of interview.

I even give people the option to use the computer if they are more comfortable
with that or a whiteboard. It can be 50:50 in who choses what.

------
Xoros
Those white board stuff reminds me when I was a CS student in the beginning of
the 90's in France.

We had our exams on paper. And believe me, writing LISP on paper, knowing if
you forgot one parenthesis you got 0 point ("if I type it on a computer, it
fails !"), was pretty and unnecessary stressful.

So I relate with candidate facing that. Dude, on your day to day work, you
WILL have a computer to check those !

How can you decently check those skill on a white board ? I totally agree with
what's stated in this post.

~~~
e12e
If you think writing lisp by hand is bad, try implementing a linked list
interface in java on paper... _shudder_. (in fairness, we were sanely graded,
minor syntax errors didn't subtract terribly from the grade...).

------
bostik
A year ago I wrote a (shorter) post on the same topic:
[https://smarketshq.com/notes-on-interviewing-
engineers-a4fa4...](https://smarketshq.com/notes-on-interviewing-
engineers-a4fa4383968a)

A reasonable question should never require the candidate to know "just a
single trick". Questions that require to combine approaches are far better -
they can actually measure if the interviewee can reason about the problem and
identify the points for trade-offs.

Btw: if you're interviewing more senior candidates, a code review question is
often a good idea. It turns the situation around, from "how do you build
this?" to "how would you fix this?"

------
balls187
Being a better interviewer is important.

As stated, some types of questions aren't good judge of skills, like implement
mergesort. If you can implement mergesort, you probably studied up for your
interview. You're not testing anything, other than did the candidate care
enough to study.

Interviewing should test the candidates ability to write code that is:

1\. Correct (solves the problem)

2\. Efficient (solves the problem without unnecessarily wasting resources)

3\. Understandable (goes hand in hand with maintainable)

4\. Maintainable (can be modified by another developer, or even yourself after
a few months)

Coding on a computer can lend itself to all of these (no brainer there), but
you lose a key aspect of whiteboarding that I think is really important--how a
candidate approaches solving a problem.

Knowing how to implement merge sort, or memorizing every possible linked-list
question isn't all that valuable--but having a concrete approach to tackling
problems is, and I want to understand that process from my candidates. I want
to know the design tradeoffs you make, how you think about optimization, how
do you reason about constraints as you learn about them.

It seems that explaining your process while coding on a computer would be
difficult to do without practice--and if you're going to practice, why not
instead just practice whiteboard coding, which is how most tech companies
interview.

~~~
rimliu
So do you want someone who is good at explaining how they are looking for the
solutions, or someone who is good at finding the solution? For me personally
approaching a problem never involves a whiteboard.

~~~
balls187
I don't think I've ever been at an engineering company that didn't have
whiteboards, at the very least in conference rooms--I infer from that that
some portion of employees find them valuable.

Clearly someone who is good at solving problems is preferred. However, between
someone who is good at solving problems, and someone who is good and can
explain/demonstrate their process is more desirable.

------
jonathankoren
I have to disagree with this trend of having people write code on a computer
instead of a whiteboard. Sure, it mimics the real world, but in practice you
spend a bunch of time dealing with crap about syntax errors, and argument
order mismatch instead of dealing with the actual underlying algorithm. Even
worse, you may end up with a candidate that realizes that there's probably a
library that would be really useful for this, but then has to spend time
googling for the name of the library, then installing it, and then desperately
skimming for a quick start in documentation because the question isn't, "Can
you work google and run pip install?", but rather some other task. So now
you've probably lost 15 minutes just dealing with that shit.

If you're going to do this, it simply doesn't work in a 40 minute setup
without some sort of provided scaffolding and test cases.

~~~
jpatokal
Is doing interviews in an IDE and expecting fully functional code actually a
thing? My company uses a simple text editor: perfection is not expected, and
it's still way better than a whiteboard.

~~~
jonathankoren
I can confirm that this is a thing at multiple companies. Instead of of
testing the actual algorithm, you'll encounter such blasts from the past like:
"Network Socket Debugging", "How The Fuck Does Java Read From STDIN?", and
everyone's favorite, "Why The Fuck Did You Give Me Text Data In CSV Format?"

I have seen this go well exactly once. And they provided an environment with a
working (albeit do nothing) scaffold along with test data. Also it was like a
three hours in a room.

------
cbanek
> Hopefully in your realistic setting, the challenge comes from the difficult
> tasks you are given to solve, not some jerk that's sniping at you from the
> sidelines.

I wish I could say that's true. If you're getting sniped from the sidelines in
your interview, it's probably a part of the culture where you are
interviewing. So it's quite likely to be a non trivial part of the problem
you're solving.

------
pnw_hazor
There is no reason to haze potential employees.

Just fire them if they don't work out. You set expections by telling them up
front they are on probation and that they will be fired if they fail to live
up to their resume.

Some of the worst programmers I ever worked with could pass hazing interviews
like a champ. Whereas some of the best would refuse to step foot in companies
with a reputation for hazing their prospects.

~~~
Clubber
That's a funny term to apply to this type of interview process, but it fits.
Kudos.

Agree on the invalidity of technical interviews. We hired a guy who correctly
answered every question I asked, but he could never ship a product. He always
got distracted by silly things. He was great at solving tough little problems,
but never could grasp the big picture.

------
amriksohata
For me I have interviewed many people with a technical test, that was the
easiest part i.e determining their competency. The hardest part is figuring
out what their work ethic is, can they pull their own weight and will they
cause friction in a team, sadly you only find that out often AFTER hiring
them.

------
zerr
_Small_ take-home _paid_ project.

------
Jemaclus
I have a lot of thoughts about this particular topic, probably ideas that are
unpopular and definitely go against the grain, at least in the way the Bay
Area operates.

In my opinion, if you bring a candidate on-site for a 4+ hour interview and
you ask them to write code, you've failed to properly vet the top of your
recruitment funnel. As a software engineer, writing code is the BARE MINIMUM
of your job. Imagine hiring a construction worker by merely asking them to
hammer a nail for 4 hours.

You should have a thorough understanding, through various means such as phone
screens, code samples, portfolio work, and simple tech challenge, to determine
whether they can write code _before you even bring them on-site_. Once they're
on-site, you should _quickly_ verify that they can actually do what you
previously learned that they can do. I'm talking 15-20 minutes worth of time.
The remaining time should be 100% on the "soft skills" and other things
mentioned, including but not limited to my big criteria: "Can you quickly get
up to speed and learn the things you don't already know?" and "Do I want to
sit next to you for the next 6 months of my work-life?"

If your on-site interview includes 45 minutes of coding (much less multiple
sets of 45 minutes of coding!), you're doing it wrong. Very wrong.

Keep in mind you've asked your candidate to effectively take a day off work
from their current job. They're calling in sick, taking a vacation day, or
somehow lying to their boss and taking a risk of not being in their office
when they're in yours for the interview. If they're smart, they've lined up
multiple interviews with multiple companies, because putting all their eggs in
your basket is just a terrible idea. Imagine having to take four days off to
interview with four companies. And they probably aren't four days in a row, so
you can't just pretend to have the bubonic plague or something.

You're asking them for a huge commitment of their time. And if you're willing
to kick out a candidate because they didn't know how to invert a binary tree,
then you should have found that out before they even walked in the door and
saved everyone a whole bunch of time.

IMO, an interview should be a _max_ of 4 hours. Any more than that and the
candidate is simply repeating themselves over and over to different people,
potentially solving the same tech problems (that should have been evaluated
beforehand), and generally making it a huge waste of time.

My two cents. Happy to debate these ideas with anyone interested.

------
ilaksh
Mostly makes sense but your ability to write a parser is still going to depend
on how many parsers you wrote or when you wrote them or whether you are able
to use a framework/tool to do it.

------
the_mint
All his example interview questions are stuff that were actually used at
Dropbox!

~~~
kevmo314
His resume ([http://www.lihaoyi.com/Resume/](http://www.lihaoyi.com/Resume/))
suggests he worked at Dropbox for quite a while. :)

------
spraak
What are some good resources for developing good algorithm skills for a non CS
grad? Examples in JS, Python or Go preferred.

~~~
SmirkingRevenge
There's lots of stuff online.

Check out hackerrank.com for example. There are other sites like that out
there.

Its becoming a real cottage industry, this whole IT interview prep thing.


Why People Become Internet Trolls - rchaudhary
https://dradambell.com/why-people-become-internet-trolls/
======
WheelsAtLarge
One that was not emphasized enough is that people have learned that you can
get a lot of attention by being a troll. You speak out without regards to
other people and you'll get people to follow you just because you are saying
what other wished they could say. A lot of internet influencers have created a
career by doing that.

The article is right, Empathy deficit, is definitely a cause. I know that for
many people it is hard to understand that there is a human with feelings on
the other side of the internet. Having a real picture of the other person
would solve a small bit of that. But ultimately the only thing that would help
would be to figure out how to get users to get to know each other better.

------
umvi
Trolling has existed long before the internet. Prank phone calls, ding dong
ditch, antagonizing your younger siblings... there's a certain satisfaction
with experiencing the fruits of your virtually consequence-free social
manipulation efforts.

It makes you think "wow, with just words I was able to rile someone up into
conniptions" while simultaneously thinking "how are these people taking this
so seriously? _I_ am able to keep my cool on the internet"

~~~
happytoexplain
>wow, with just words I was able to rile someone up into conniptions

Your description of the mindset is accurate. What's interesting to me is how
common it is, considering how irrational it is. Scoffing at the emotional
result of "just words" is like scoffing at the physical result of "just
bombs". At its root, it's usually a hypocritical expression along the lines of
"people are too sensitive", but also, "I want to provoke people as much as
possible".

------
Simulacra
I always thought people became trolls for the passive aggressive power. It's
like telling a manager an employee did something really bad when all they did
was tell you that you couldn't do/say/whatever something. It's a weird sort of
fetish.

------
sleepysysadmin
"Trolling" has very little to do with Sadism, psychopathy, narcissism, or
machiavellianism.

An troll has there priorities, they target a certain group of people just to
get a rise out of them.

------
cercatrova
Because it's fun? That's the main reason I can see.

------
greesil
For the lulz? Less idiomatically, to relieve boredom with no consideration
that their victims are real people.

~~~
happytoexplain
I feel like this used to account for nearly all trolling, whereas now a
significant portion of it crosses over into an expression of hatred, if the
troll perceives the target to be of an opposing ideological group.

------
keyle
Site overwhelmed, cache here

[https://webcache.googleusercontent.com/search?q=cache:DwqAFQ...](https://webcache.googleusercontent.com/search?q=cache:DwqAFQJS05QJ:https://dradambell.com/why-
people-become-internet-trolls/+&cd=1&hl=en&ct=clnk&gl=au)

Great read!

------
Svperstar
When I was 14 and got online I liked trolling websites that I knew had older
userbases. Like one time I had a 50 year old man reacting to my troll posts it
was hilarious to see

------
RickJWagner
Because some people are just juvenile, and are a little broken inside. It's
not complicated.


What Keynes Knew About Bitcoin - petethomas
https://www.bloomberg.com/news/articles/2017-11-09/keynes-worked-out-the-bitcoin-interest-rate-it-s-57
======
thisisit
Just another clickbait headline article which barely mentions Keynes for the
"effect" while explaining one of the terms in a futures market -
backwardation.

The explanation is also incomplete. No mention of "cost of carry" or contango.
While forgetting backwardation doesn't imply _only_ interest rate but risk
premiums too.

To top it, the implication of the so-called _interest_ is from an exchange
called Deribit. The 24-hr volume on the market is ~3.8 million or 1% of last
24 hr BTC volume (from coinmarketcap). Not to mention the contract size is $10
which 0.0014 BTC at current prices. The market is super illiquid to be use for
any kind of useful analysis.

~~~
empath75
So what do you think the cost of borrowing bitcoin should be?

~~~
eigenvalue
The whole thing is absurd because we don't have to guess or speculate-- just
look at what the actual historical rates have been for BTC margin loans on
exchanges such as Poloniex. Nowadays the rate is pretty low, 3.5% to 5%, but
it can spike to much higher levels based on supply and demand (for example,
leading into the bitcoin gold fork, rates spiked because the exchange wouldn't
credit BTC balances with the fork if the coins were being lent at the time).

------
empath75
[https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iI77KmfJdUn...](https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iI77KmfJdUn0/v1/1800x-1.png)
that is not what line charts are for.


Studio History - Delta Versioning in JS - Hunterhdolan
https://github.com/Studio182/Studio-History

======
chi_h
When i first saw it, I wondered why they didn't just use google's awesome
diff-match-patch library - <http://code.google.com/p/google-diff-match-patch/>

Then, I looked at the source code and saw that it actually was just a thin
wrapper around diff-match-patch.

:(


Metabolic Pathways - Tomte
http://www.cc.gatech.edu/~turk/bio_sim/articles/metabolic_pathways.png

======
dalke
For some context, this is the Roche Biochemical Pathways Wall Chart for
Metabolic Pathways. It is available in interactive form, including search
support, from [http://biochemical-pathways.com/#/map/1](http://biochemical-
pathways.com/#/map/1) .

Note that this link from Georgia Tech manages to omit the copyright notice and
most of the notes. It also has alignment problems. On the other hand, it can
be printed directly as a poster.


Nanoparticles awaken immune cells to fight cancer - DrScump
http://www.sciencemag.org/news/2017/01/nanoparticles-awaken-immune-cells-fight-cancer
======
DrScump
Related Papers:

[http://www.nature.com/articles/ncomms12499](http://www.nature.com/articles/ncomms12499)

[http://pubs.acs.org/doi/abs/10.1021/jacs.6b09538](http://pubs.acs.org/doi/abs/10.1021/jacs.6b09538)


Out with BTFD, in with BTFR - Four_Star
http://thesoundingline.com/taps-coogan-out-with-btfd-in-with-btfr/
======
atomical
> Those policies were met by snarky critiques from a slew of traders and
> bloggers who remarked that ‘you can’t fix a debt crisis with more debt’ and
> that ‘you can’t print your way to prosperity.’

I thought it was well accepted that austerity measures in a depression are a
really horrible idea. Greece may be the most recent example. Is that not the
case?


World Record for Compact Particle Accelerator - jonbaer
http://newscenter.lbl.gov/2014/12/08/world-record-for-compact-particle-accelerator/
======
twic
The accelerator is pretty tiny! Unless you count the FREAKING GIANT LASER
sitting next to it. Seriously, it's not just big, it's old-computer big:

[http://www2.lbl.gov/ehs/news/assets/img/news/setupBELLA.jpg](http://www2.lbl.gov/ehs/news/assets/img/news/setupBELLA.jpg)
[http://www2.lbl.gov/ehs/news/assets/img/news/finalBELLA.jpg](http://www2.lbl.gov/ehs/news/assets/img/news/finalBELLA.jpg)

Although smaller than the LHC, i guess.

------
yummybear
Non-physicist here: Can this be used for science in the same way as LHC or are
the applications totally different?

~~~
FiatLuxDave
Physicist here, typing from the room next door to a linac. For the sake of
full disclosure, I work in the low energy (nuclear) regime, and I am not a
qualified high energy physicist.

The short answer is yes and maybe yes.

The primary intention behind researching laser wakefield accelerators is to
provide a way to get to higher energies, like at LHC or beyond, without the
huge cost. Physicists would love to test theories at higher energies than LHC
is capable of, but the budgets for building a normal accelerator of that size
are prohibitive. You don't necessarily need to figure out a way to make the
beam go in a circular method to do this; linacs like SLAC just collide the
beam with a stationary target. An effective wakefield accelerator would save
$billions.

However, what this article doesn't say is what are the efficiency and
luminosity of this accelerator. Just like a car is measured by more than just
horsepower alone, accelerators need high efficiency (amount of power to run
them, and cool them) and high luminosity (how much of your beam can be
usefully put on target). I can't comment on this yet, because I'm not up on
current wakefield research.

If you have good efficiency and luminosity as well as acceleration gradient,
it might be valuable in the medical linac field. Much of the cost of medical
linacs is in controls and software, but having a smaller head makes the whole
linac cheaper. You can move it around and do stuff like Cyberknife does. It
may provide a cost advantage which allows a new company to compete with Varian
and Elekta. But reducing the size of a 1 meter object to a 1 cm object is not
as valuable as reducing a 100 km object to 1 km.

------
earljwagner
So how are the portable ectoplasmic containment units coming along?


De-batching, or how to juggle too many balls - swombat
http://www.inter-sections.net/2008/04/23/de-batching-or-how-to-juggle-too-many-balls

======
kirubakaran
I started using similar method few months ago and it works well for me. I
wrote a simple web app to help me with this... Smacklet
<http://www.smacklet.com>


Communication with the User: Some Examples from the Lisa - pcr910303
https://systemfolder.wordpress.com/2009/11/14/lisa-ui-examples/
======
ktpsns
Wow. This kind of lessons from the past, unrevealed by a person from today, is
really instructive. We have Personal Computers since decades. Many problems
have been already solved and are solved again worse then they used to be.
That's what "old people" complain as "culture being lost", but it's really up
to us, the old ones, to explain the culture of the past. (Lisa was before my
time anyway. I will tell tales about Win95 when it is about time ;-). )


2000 shell companies at one address in Wyoming - hendler
http://news.yahoo.com/special-report-little-house-secrets-great-plains-113759191.html
======
sivers
I used Wyoming Corporate Services (the company at this address) to set up an
LLC a couple years ago, and they were the most wonderful people to work with.

(I would only contact them a few times a year, but when I did, the lady on the
phone would remember me, "Oh hi Derek! How are things in the music biz?")

Their service is 100% legit, they're prompt and friendly, and I recommend them
highly.

<http://www.wyomingcompany.com/>

As most of us know here, there are many valid reasons to set up your
corporation in a neutral place that is not your current residence.

Maybe you're online-only and traveling the world.

Maybe you're starting your business in one place for now, but you feel kinda
"one foot out the door", and feel you're going to move it somewhere else some
day.

Or maybe just because you want to, it's legal, and you need no other reason
than that.

~~~
chopsueyar
As I was reading the article I thought about how trying to increase regulation
of this type of activity would kill entrepreneurship in this country.

The article had a negative slant to it, and there are legitimate benefits to
this service.

Perhaps some are upset because only the ultra-wealthy should be allowed such
privilege?

[http://www.rollingstone.com/politics/news/the-real-
housewive...](http://www.rollingstone.com/politics/news/the-real-housewives-
of-wall-street-look-whos-cashing-in-on-the-bailout-20110411)

~~~
davidw
In Italy, you have to have thousands of Euros available to start a limited
liability company and _it sucks_. It's just a complete and total negative in
my opinion.

We can all argue about the ideal level of taxation, but don't tax companies
until they're actually making money.

~~~
arethuza
In the UK setting up a limited company is extremely easy - here is one site
offering limited companies for £2.99 in 3 hours:

<http://www.eacbs.com/>

~~~
StavrosK
I've set up my company (Stochastic Technologies) using one of these services
and I can attest to it. I paid about 15 GBP, not 3, but it was ready in half
an hour. The HMRC (the equivalent of the IRS) people are as polite and
accommodating as people who take your money should be, and everything was very
straightforward to do.

~~~
ashleyw
Can I just ask something on an unrelated note, since you've been down this
road: what are the costs of a Limited Company, in the long run? I've read that
when tax time arrives, it's nearly impossible for a non-accountant to do, and
so it'll cost a minimum of £400 for even the smallest company. Not a crazy
amount, of course, but it'd put a dent in the profits of a young startup or
side project. What's your experience been like?

~~~
StavrosK
That is accurate, I had accountants quote me £1,000 or more for ten invoices a
year. It's absolutely crazy for something that takes two hours a year to do,
and it seems to me like the space is ripe for disruption.

Fortunately, I found a much, much cheaper accountant. I don't know if it'll
come back to bite me in the long run, but it was the only way to keep the
company profitable.

~~~
ashleyw
By cheap, is that near to my £400, or even less?

------
zach
Wait until you hear about 2711 Centerville Road, Wilmington, Delaware.

Such shady entities registered there include "Level 3 Communications",
"California Pizza Kitchen", "The Walt Disney Company", "Dole Food" and
"Qualcomm".

Seriously, all those companies are Delaware corporations who maintain their
registered office at that address, despite the fact that their CEO has
probably never visited that address in their lives.

This is such a common occurrence that it hardly merits notice. Even if you
throw in the observation that dubious businesses favor incorporation in
Wyoming (which has no corporate income tax, franchise tax or tax on corporate
shares), that's still not saying much.

~~~
ihodes
I'll be registering my company in Delaware. Why the hell wouldn't I?

~~~
tzs
Why Delaware over the state you are in? (Assuming you aren't actually in
Delaware).

~~~
dunham
They have a different legal system (a court of chancery) that businesses
prefer when resolving disputes. See "Delaware Court of Chancery" on Wikipedia.

------
sdfjkl
Such special purpose companies[1] are quite common and don't necessarily
indicate any "shady" practices.

[1] <http://en.wikipedia.org/wiki/Special_purpose_entity>

------
joe42
Business hackers.

~~~
hendler
My favorite use of shell corporations in fiction so far is in Accelerando [1]
- corporations start out as python scripts:

[1] - [http://www.amazon.com/Accelerando-Singularity-Charles-
Stross...](http://www.amazon.com/Accelerando-Singularity-Charles-
Stross/dp/0441014151/ref=sr_1_1?s=books&ie=UTF8&qid=1309324277&sr=1-1)

~~~
JeremyBanks
Available for free on the author's website:
[http://www.antipope.org/charlie/blog-
static/fiction/accelera...](http://www.antipope.org/charlie/blog-
static/fiction/accelerando/accelerando-intro.html)

------
mynewcompany
I think this article is inaccurate and overhyped. First of all, I run a
similar company that does this in Nevada. We are the "Registered Agent" for
thousands of companies. All it means is that we are the address the state can
send their "Annual Report" paperwork to and a process server can deliver and
have legal docs signed for. The Registered Agent must have an address in the
state and be available during business hours. These aren't "shell" companies -
every company in NV from Amazon to Zappos has to have an agent.

------
cheez
At some point, I hope people realize that the tax code is for the rich.

~~~
chopsueyar
I think that is the problem the government has with these services. They are
too affordable.

Only $10k for an LLC from 1997, plus $2,500 to have attorney client privilege?

Only the ultra-rich should be allowed to do stuff like this.

~~~
cheez
Pardon me but it only makes sense to do this if you are making mounds of cash.
Otherwise the cost for compliance will easily eat up any excess profit. Even
very profitable companies don't do this, so you should ask yourself why.

------
rovar
Seriously, how did this make the front page?

~~~
Sukotto
I upvoted it based on the many extremely useful comments. Perhaps other people
did too?

------
georgieporgie
...and there are plenty of shared offices and pseudo-offices in the
Embarcadero Center in San Francisco. Unexpected != shady.

I started a Wyoming "close corporation" (unique to WY and awesome for small
businesses) last spring, and used FreeRegisteredAgent.com aka Incorp.com as my
registered agent. They do the first year free, $99/yr after that. They weren't
the fastest responders, but when I dissolved the company a year later they
_did_ get back to me, and it _didn't_ prove to be a scam.

I don't have my numbers handy, but in the end I calculated that it would cost
something like $1,000 per year to even _begin_ to legitimize a presence in
Wyoming. You'd need a mail forwarding service in the state, of which there are
few. You'd also almost certainly want a state driver's license, and some of
the mail forwarding and registered agent companies will let you use their
address for that!

Incidentally, I went with Wyoming because NV and DE have both started charging
rather steep annual licensing fees.

(the reason for all this, by the way, is because my plan was to live abroad
and do some coding on the side, which puts me in a strange tax situation, and
costs had to be extremely low.)


Show HN: TorProxy, a kernel module which routes all network traffic through Tor - raw23
https://github.com/r-a-w/TorProxy
======
bjpbakker
Interesting but I doubt whether you really want to route /all/ your network
traffic through Tor.

As soon as some packet that reaches the internet (through an exit node) that
includes some identity information your Tor connection is no longer private.
Routing all your traffic via Tor, increases the chance this will happen.

Also if many people use Tor for all their traffic, this will become a
scalability problem for Tor (lack of exit nodes).

~~~
giancarlostoro
I would assume if you're going this far you're likely running this module
under a Linux VM so only specifics go through Tor.

~~~
fmx
If you do that then you may as well just use two VMs - Tor router and client -
and that's basically Whonix.

------
acebarry
It's a terrible idea to route _all_ your traffic over tor. If you have any
expectation of anonymity you'll be disappointed. Since tor does not do any
application level filtering, it is easy for exit nodes to track you.

It's a neat idea but has the same problems as network wide tor routers.

~~~
nikcub
Exactly. Good implementations like Whonix take steps to isolate your circuits
between different applications and profiles[0].

Further in those cases you're isolating your identities with virtual machines
by default, which helps enforce good compartmentalization.

Forcing all traffic into one environment and then over a single circuit means
everything you ever access is linked together. The other story on the front of
HN is the accused stalker who was caught partly for doing exactly this (would
access his real Gmail and then "stalker" Gmail over the same connection)

Whonix also provides a model of enforcing Tor by using an isolated proxy -
which doesn't require kernel modules and also allows firewall policies

I'd classify this as a naive approach that sounds like a good idea at first
inspection - but the Whonix developers have _really_ thought this through and
their Wiki[1] is a tremendous resource that explains why they use the model
they do.

Qubes OS is another similar approach[2]

[0]
[https://www.whonix.org/wiki/Stream_Isolation](https://www.whonix.org/wiki/Stream_Isolation)

[1]
[https://www.whonix.org/wiki/Main_Page](https://www.whonix.org/wiki/Main_Page)

[2] [https://www.qubes-os.org/](https://www.qubes-os.org/)

------
CodesInChaos
How does this compare to Tails? Conceptually they look similar, both having
the kernel enforce that all traffic goes through Tor.

But Tails is a configured with security and Tor in mind. I don't see when I'd
want to install such a kernel module on a normal distribution over a
specialized distribution. (Or a multi-vm setup like whonix, instead of
trusting the kernel)

------
tgragnato
Is there any particular reason for being IPv4-only?

> /* Drop all ipv6 traffic */

~~~
hendi_
Yes.

> The Tor network currently only supports TCP ipv4 traffic

~~~
tgragnato
TCP IPv6 traffic is supported.
[[https://trac.torproject.org/projects/tor/ticket/5547](https://trac.torproject.org/projects/tor/ticket/5547)]

Only relay to relay traffic is actually IPv4 only.
[[https://trac.torproject.org/projects/tor/ticket/4565](https://trac.torproject.org/projects/tor/ticket/4565)]

------
aminorex
We need to pump this. Anonymity only protects the vulnerable in inverse
proportion to it's ubiquity.

~~~
cisanti
I can't even comment here when I use my homemade vpn, hosted digital ocean or
linode. And HN is not the only place... I understand spam is a problem, but it
feels like a hammer solution.