specialk

There is a supply and demand tension in Dublin over accommodation. Building more apartments, i.e. increasing supply, will help alleviate this tension. That doesn't mean we can't also tackle the problem from the other direction by reducing demand. AirBnB is demand.

It's hard to tell how much any government would want to pull on a lever that might reduce demand. Those tourists bring valuable outside revenue into the city. We need them too. There's lots to balance here. Let's not optimise just revenue.

Wearing headphones

Working away from normal desk

Interruptions still happen, of course. When one does, we suggest letting the person know upfront that you’re concentrating on something, and asking them if it’s urgent. And if you’re the person doing the interrupting, try not to get offended when you get asked if your needs are urgent.

OMG yes big fan of this. Setting expectations up front for this kind of behaviour is great. Without a 'culture' for allowing people to stay focused without an immediate interruption, I have always found it hard to explain to people interrupting me why they could have used an asynchronous communication tool, like Slack/HipChat/email, for non-urgent questions.

So, if you'll indulge me, your argument is essentially 'us vs them' is a bad thing. About right? If so, I agree. We're not going to solve an exclusionary tech culture by excluding people or creating two sides to a debating war.

But what strikes me is that your comment didn't even reference Nicole Sanchez by name once. Your comment was "she" and "her" time and time again. Did you even notice yourself do it? I somehow doubt it was intentional. But I'm an optimist.

> The seemingly good news is that globally, SHA-2 is supported by at least 98.31% of browsers. Cutting 1.69% off the encrypted Internet may not seem like a lot, but it represents over 37 million people.

There is also an interesting discussion in Security Now #538 [2] there is also a transcript of the show [3]. Skip to page 2 of 39 just where Leo says "Yeah". Android 2.2 and Windows XP SP 2 are on the list of things that don't support SHA-2. These devices exist particularly in the developing world. It sends the wrong message, to the developing world in particular, if we don't support HTTPS for them. It encourages websites in areas where it isn't 1.69% of their users but maybe 5% of their users to just not enforce TLS. TLS with a SHA-1 signed LV cert is better than no security at all.

Facebook's also has a cool server add-on to dynamically serve LV certs to those who need them is very promising. If it is in-production at Facebook it is bound to be good.

[1] https://blog.cloudflare.com/sha-1-deprecation-no-browser-lef...

[2] https://www.grc.com/securitynow.htm

[3] https://www.grc.com/sn/sn-538.pdf

If the pull request is small, fixes a bug or is a blocking you, then you can spend you quick-code-review-chip for the week and ask the team to look at it at their first available opportunity. (Sometimes reviewed within 15 minutes, usually an hour tops)

It allows team members to ask the rest of the team to unblock them quickly. Limiting it to one a week prevents abuse of their team mates' time and encourages all team members to plan their work out ahead as to reduce blocking.

We also wrote a quick HipChat bot that keeps track of who's spent their quick-review-chip too.

In work I currently have 3 pull requests open all touching different sections of the product. The 3 PRs are all at different stages of the review process. For example, I'll be closing one first thing tomorrow and deploying it out (don't like deploying in the evenings - its bad luck). Another I just opened as I left work today, so I doubt anyone's reviewed it yet.

I'm sure Quora has a big enough codebase and not enough developers (like most companies) that they always have a list of things a mile long that they would like to do or should do, be that new features or just refactoring.

2-3 days isn't long for a review and iteration cycle in itself. I have one PR that is currently open for 5 working days at this stage. We decided that it didn't quite fit the bill on the first draft . It is blocking progress on two other tasks in our backlog but we also have 14 things on our backlog of goals for this week. The team is working around it while we finish it off or create issues for things we think have fallen outside the scope of the initial job.

One thing we've noticed alot on my team is that we try and make our pull requests for review as small as possible. We all have a rough guide of about max 500 lines. Sometimes we do go over but its a rough guideline. Smaller PRs are just easier to review for everyone involved. Reviewers don't have walls of code to break through or need to keep tons of context in their head.

Post-commit reviews (or post-merge into master or whatever you process is) is an interesting idea. I'd be curious to see what my team think of the idea tomorrow for a small sub set of our codebase.

I noticed one more thing on the job posting text: the word-breaking is a little off. Here's a image with one example: http://i.imgur.com/Zuv1Zjc.png CSS's word-wrap: break-word is probably not want you want to be using for that container.

One other thing I noticed but that isn't a simple fix is postings like this one from HubSpot[1] list two locations Cambridge MA and Dublin Ireland but the ad only shows up in Dublin. I thought I'd point it out if you're looking for some more work :D

This is awesome.

[1] https://news.ycombinator.com/item?id=9813335

My guess is that so many users installed adblockers because of obnoxious ads on a few websites they visit without realising that it removes the non-annoying 'acceptable ads' that support the sites they love. Hopefully something like the acceptable ads manifesto will help stem the tide of quite frankly shitty ads .

[1] https://acceptableads.org/

[1] http://blog.pagefair.com/2015/adblock-users-click-more-ads/

This industry needs more social commentary along the lines of Silicon Valley on HBO and sites like this. Silicon Valley nails our industry almost every week. It's brutal, but it's reasonably accurate satire.

I'm a little concerned with a swarm of drones controlled by one human. Humans have limited attention span -- they just can't watch 30 video feeds. Could this pre-programmed approach with limited human control lead to greater civilian causalities?

I'm curious if it will catch on or if users stigma against livechat will hurt. Have to ask yourself when was the last time you used livechat? I'm having trouble remembering the last time I did.

I find it highly amusing that RMS doesn't seem to agree with Amazon's restrictive ToS agreement but his GNU software license is one of the most restrictive licenses out there. If I include a GNU licensed library I accidentally lose all my rights too. Funny that.

> "A study found that people who read novels on the Amazon Swindle remember less of the events."

Replace 'Swindle' with 'Kindle' then with any ebook reader ever. I doubt there is anything about the Kindle in particular, over other ereaders, that causes people to remember less. This is attacking Amazon with everything and hoping some of it sticks.

I'm trying not to defend Amazon but RMS's arguments are painfully bad at times.

From all the advice I've read security and crypto they don't work like that. The assumption is the other way around. A properly implemented, simple pepper can only hurt password security until proven otherwise by rigours testing and analysis.

Time and time again we read stories of a tiny implementation detail that created a sly and subtle vulnerability that simehow leaks information about original plain text by interrogating the cipher text.

bcyrpt with a large work factor and a per user salt is a PROVEN method to prevent attackers learning the plain text. Until I see evidence from a trusted cryptanalyst I'm not going to roll my own by adding in pepper they didn't plan on being there.

EDIT: sorry let me make my point a little clearer. In the event that the hacker can access the filesystem or memory -- whereever you store your pepper -- could the hacker use the pepper and an implementation detail in the peppering technique to learn information about the plaintext or the salt? This question is what needs to be answered by qualified cryptanalysts before developers start using peppers wide-spread in my opinion.

The best article I've seen against this technique is by ircmaxell [0]. Nicely summed up in this sentence "It is far better to use standard, proven algorithms then to create your own to incorporate a pepper."

Anyone have source material (academic paper, Bruce "The Crypto God" Schneier blog post) that shreds some light on peppering passwords?

I'd be much more interested in how many iterations of bcryprt Slack were using. That has a much bigger bearing on events for me. Anyone at Slack know/want to answer that question?

[0] http://blog.ircmaxell.com/2012/04/properly-salting-passwords...

I wonder is it is possible to create an apiary.io to readme.io auto-migration tool. Even if it does require me copying the markdown behind the apiary.io docs manually into some tool that spits docs into readme.io. That would honestly save me many hours, probably many hours for many folk too.

I've requested access to the open source pricing plan, after I hopefully get approved it is probably something I'll look into in more detail. I'm in need of a new (probably) needless automation side-project.

Edit: wow I completely missed the free trail. If you're an open source project they'll upgrade you to the Dev Hub pricing plan. Ugh feeling so stupid for missing that the first time around and not getting started 10 minutes ago.

It doesn't look like customers were given much warning either. This story was originally published on the 6th of Jan. Could you imagine trying to find alternate hosting setup by the weekend if you have any kind of availability expectations? It seems like madness to me. Even if you did move yourself to another host to cover this 48 hours of downtime how likely are you to move the majority of your business over to AWS, Google Cloud, Azure etc.

The lack of notice on this seems to be a bigger issue to me than the fact that Verizon is taking their whole cloud out of service for 48 straight hours.

For example in the disposal income visualisation what kind of magnitude of a difference is there. Is the average 2 thousand euro a year lower or 10 thousand euro a year?

What concerns me is that some of these stats can be massaged with the right visuals into producing a difference between East and West that isn't as big a difference as the graph makes it out to be.

Sometimes I have paid for not listening to the lecture but the majority of the time it doesn't matter. The idea that I learned my college curriculum in lectures would be a joke. As a computer science student I learnt my trade in the labs and tutorials and interactive courses rarely from listening to a lecturer explain X, Y or Z.

The better the lecturer or the harder the module the more laptops that were closed in my lectures. My compiler design course for example, infamous for being the most difficult module no one dared open the laptop as there was too much knowledge to consume.

Lecturers can easily do a self-assessment survey of how engaged their class is and how interestingly they are presenting their material but how many heads are hidden behind laptop screens.

For the one lecturer who did ban laptops I have to say I went to absolutely none of his lectures unless I had coursework to submit. I found it a bit presumptuous that he could demand I close my laptop, I was not distracting him or disturbing the class.

You don't learn in lectures where lecturers read their slides to you laptop open or not. If the lecturers are going to waste my time with pointless reading of slides then I might as well do something useful on my laptop like my coursework or just read hacker news.

Using SMS as two factor auth for a bank does seem stupid to me as I expect hackers to be more determined to crack my bank account than my Facebook account. Banks have the resources and the long account setup times to allow them to use proper auth tokens.

Is there a better solution that SMS for low risk sites like Facebook or Twitter or my blog etc? Something with the same easy of use portability etc. Is the Google Auth token app any better?

EDIT: login not logic in first paragraph

I once did create fully compliant UML diagrams for a requirements document. The next day half the team emailed me back asking what all the box types, arrow heads and broken lines meant. Honestly, simple sketches with annotations have served me so much better than following the rigid rules of UML.

This could start a vicious cycle where voting cabals of power-users form. For example if Idea X becomes popular among some members of HN they will be able to always steer the discussion to talk about Idea X or down-vote a competing valid Idea Y into oblivion. Comment readers could be converted to Idea X, as it is always appearing at the top of relevant comment threads. So now the voting cabal as even more members. Growing the dislike of Idea Y. The cycle then repeats. The discussion is then steered over time by the thoughts of a select few power-users.

Maybe this is just the natural order of things and I'm subconsciously afraid of change. Thoughts?

As a early-twenty-something I only know a relatively small number of engineers 30+, and have only worked with a handful. Compare that to the dozens of engineers my own old that I know, and have worked on projects together. If I founded a company tomorrow I know which 4 friends from college I would want on my team, they're all other twenty-somethings.

The only engineers over 25 I have worked with (excluding open source projects) were my bosses at previous companies. I simply wouldn't know who to hire. Anyway, would any self-respecting engineer take a job at a company found by one of their interns or recent graduates from a few years back? I highly doubt it.

In my hypothetical would I really hire someone who was twice my age? Probably not. To be honest I'd be afraid of their experience. I'd feel maybe their my training wheels. They have a lot more experience than me, will their experience take over my company's vision. Part of the mentality as a twenty-something founder is proving yourself, be that to your colleagues, your peers, your parents, or whoever said you just wouldn't make it.

I find it hard to find other twenty-somethings hiring many people twice their age in the early days. Maybe without even realising it a culture similar to that of college creeps in. Every new hire creates culture, and from my hypothetical I don't have a very diverse team to start with if I start with college friends and other twenty-somethings.

Somewhere in the early days no one seems to be spotting the 'culture' problem start-ups are creating. Was this problem unintentionally created? Or was this problem created sub-consciously created intentionally? Would I as a twenty-something founder sub-conciously create a company where my Dad or my even my cool Uncle wouldn't want to work at? Probably.