josephwegner

I am about 6mo into a job with weekly 1:1s, and am coming from a job that did them every other week. I am always excited for my weekly 1:1.

As a disclaimer, my boss scheduled a weekly 30min 1:1 when I started, but with the caveat that we could make it less often if I found it not useful. He just preferred weekly during the "settling in" phase.

Almost without fail, our 1:1s go over time, totaling between 45min and 1hr. I can't imagine how my boss finds the time, but I so appreciate that he does.

I keep a pinned slack message in our DM, of priority-ordered things to discuss. Often these are things like:

- Something went wrong this week. How did I do? How could I have performed better?

- I noticed something unhealthy with our team, how can we fix it?

- You did something that surprised me as a manager, what was your thought process (this is sometimes critical feedback, sometimes curiousity)

- Is this thing I want to do a good idea?

- Debrief on progress (or lack thereof) on a predefined goal.

- Help me with this stupid HR/Expense report thing

And the list always ends with:

- leave space for <BOSS> to discuss things he wants

This is easily the most valuable growth time of my week. I appreciate my IC time to do an excellent job, but the 1:1s help me pick my head up and think about bigger things.

I appreciate all of these distributed social networks (Mastodon, Peepeth, Diaspora, etc.) getting some buzz right now. I think distributed hosting of social networks is an important step forward.

However, they're all lacking one major thing that needs to happen in order for a true Facebook Exodus to take place - distributed discovery and consumption. Facebook has a HUGE network effect, and simply put there is no way any of my acquaintances are going to leave Facebook just because of the recent news. I can start a Mastodon node, but I would be shouting into a void - there's no one there to see my content, and no incentive for someone to move over. If I _did_ convince anyone to move, they'd be shouting into the same void, and get bored. There needs to be a way for us early adopters to post content, but let it still reach people that haven't jumped yet.

Right now the best solution I have for this is something pull-based like RSS. Even that's not a great solution, though - my average acquaintance no longer uses RSS. I might be able to get my mom to install Feedly, but no way is my old friend from High School going to install it. Open to hear ideas around this.

This is not an unintended feature - it is a gaping privacy gap. That data is not intended to be public, and is in fact dangerous when made public. It's _especially_ creepy that this detailed data is available to someone who has unsuccessfully interacted with you on a dating website. All that aside from this likely being against the terms & conditions provided by OkCupid, meaning their user's data was being used against the contractual limits.

There was no real-world case where this data was useful in a non-creepy way.

Interestingly, this is the opposite of the direction much of the tech industry has been moving with post-mortems.

- http://firstround.com/review/this-is-how-effective-leaders-m...

- http://code.hootsuite.com/blameless-post-mortems/

- https://codeascraft.com/2012/05/22/blameless-postmortems/

FYI, the author of this has started the Growth Coaching Institute, if anyone wants to start providing their "free lunch".

https://www.growthcoachinginstitute.org

This reads pretty similar to the cries that come out whenever Google updates their search algorithm. It's as if people believe there is some code big internet companies must live by, that ensures they never change.

These companies live by the code of the market - they will happily make changes that make them more profitable. It does not make them evil if a small customer gets caught in the crosshairs - it just means that small customers need to be resilient to change.

The specifics of it escape me at this point. My guess is that it was a hash of the incorrect password. That wasn't necessarily the security risk, but it did spark my curiosity that led to the rest.

> For instance, in Chrome for Android 80% of the touch events that block scrolling never actually prevent it

I'm curious how they get at this data. I haven't fully thought it through, but something about this raises the "creepy flag" in my head.

Does this data come through the "Automatically send usage statistics and crash reports to Google" setting? Google's help page [1] regarding that doesn't seem to indicate it's recording information about website's javascript.

[1]: https://support.google.com/a/answer/151135?hl=en

EDIT: I'd also be curious if they have done any analysis to see if the mechanism that gathers this data is related to the performance implications of touchEvent listeners.

Somehow I managed to land my first programming job in the most stereotypical means possible.

I had connected with this young startup through my budding network. I was young, they were young, and we were both involved in TeensInTech (formerly a community of teens interested in startups). I had done a couple rounds of UI/UX feedback for them, that they had requested via TinT. The company made a password & bookmark manager (not one of the ones that is available today. They want out of business).

One day they launched a major website overhaul. Excitedly, I went to their website to play around with it. Purely by chance, I fat fingered my password as I was entering it in. The login failed, obviously, but I was surprised to see that the password input on the failed login page was now filled with a mysterious looking hash. My assumption was that was my hashed password.

This spurred me to open my dev tools and look at the network requests to figure out what was going on. It turned out that their new website was powered by a new API which hadn't really been hardened at all. Within about an hour I was able to find an endpoint that allowed me to enumerate all of the users on their site, and another endpoint that returned a user's stored authentication details (hashed passwords, full usernames & URLs). I wrote a few lines of javascript that looped through all of the users, and fearfully received a dump of their entire credentials table. Obviously that is bad bad bad.

I sent them an email explaining the issue. Their website was promptly taken offline, hardened, and then I received a job offer.

tl;dr; I hacked my first employer's website, and they offered me a job for it.

I put a 2-year time box on it - my guess is that that's short enough that will make most of the learnings still mostly relevant. https://hn.algolia.com/?query=%22things%20i%20wish%22&sort=b...

5 days uptime, 310GB

I don't list to _that much_ music?!

Glad it was helpful. I wrote it for the same reason - needing real words for what was happening in my head.

<3

I've been procrastinating (for obvious reasons) sharing this for quite some time... but this seems like as good of a kick in the pants as any.

I wrote a bit of a short story about my shyness/social anxiety. Hope helps people understand what goes on in the brain when anxiety strikes: https://stories.wegnerdesign.com/how-i-party

Yes, you can, very simply. Just turn off learning and don't put in any schedule.

Late Labs was a really stellar idea... I followed it pretty closely for awhile (even rocked a sticker on my laptop!). I was sad to see it go, but it's interesting to see this post-mortem.

It does sound super tough, and a scary environment for a VC to get involved. Double taxing sounds pretty bad, and is one more reason for a VC to avoid the risk.

I know Assembly is a somewhat similar idea, and they've raised a bit of funding. I wonder if they got around that limitation somehow.

Most closed-source products have very different management styles than open-source products.

If you're interested in the topic, check out the book "The Cathedral and the Bazaar" - it talks at length about the different styles of building products (Cathedral generally being closed-source stuff, while Bazaar is generally open-source)

Apparently they hired these guys to help with "protection against cyber attacks"

http://www.conosco.com/case-studies/moonpig-outsourced-it/

Awful...

I'm hoping that you're kidding, but in case you're not, this is definitely not secure. It's only marginally more secure than just sending it in a regular font.

If anyone were trying to intercept that document in order to steal passwords, the font would have absolutely no bearing on their ability to find the password. In plaintext (ie: document opened in Sublime, or other plaintext editor) the password would be very obvious. And even if the interceptor didn't open it in plaintext, it would be incredibly easy for them to just... change the font.

Using a "password" font would only decrease the likelihood of someone reading the password over your shoulder. I guess that has value, but I think you'd be way better off finding a real encryption solution.

My coworkers and I use Keybase for sending secure info back and forth. The UI there is super simple for people that don't actually understand PGP, but it's (almost) just as secure. You could even do something simple like `keybase decrypt password.txt | pbcopy` on a mac, and that would take the encrypted text and put it in your clipboard - it would never show the password on your screen in plaintext.

On a similar topic, I seem to have broken something by putting a javascript:alert in the embed field:

http://sitekite.com/test-V2IjEA

I believe you're over-thinking it. You don't need to install it in your floor, you could simply place it on top of your floor.

And it's not that hard to make it easy for people to line up - modern docks use a sort of fuzzy connector that doesn't need to lock in perfectly, just as long as you are within a certain range.

The roomba is the best example that I can think of for this - I can pretty much set my roomba down anywhere roughly on the dock, and it will start charging. I could definitely park my car with the same accuracy.

What a bummer that the tuition for this is still $30k for a year. I just can't imagine that $30k/year is a sustainable economic model for higher education. Especially in the technical arena, you can become proficient enough to get a junior-level engineering job pretty easily. Definitely for a lot cheaper than $30k.

I say this as a self-taught engineer - never went to college, and I've now got a pretty great software engineering job. Dropping $30k for a year of training (or, even worse, $30k/year for 4 years!) would have been a huge waste.

I can't help but think about the plot of Tom Clancy's Rainbow Six.

Love the staged roll out idea. You could probably also use user agents to recognize scrapers from real users (could also be helpful for slowly rolling out to older browsers).

I really appreciate giving a 3 week heads up before moving to a new frontend structure. It's a nice gesture, but I have this horrible feeling that there's only about a 10% chance that my Hacker News app gets updated in time.

I know you can't not iterate because people are scraping, but it does stink. At least this will make everything more future-proof going forward.

However, it may be nice to give a bit more heads up than 3 weeks. I know a lot of apps can take ~2 weeks to get through the review process for iOS.

The description of Eve seems pretty vague, which I'm sure is intentional, but it'd be nice to get a bit of clarification.

It sounds like Eve will essentially be a visual programming language, similar to the many others that have come across Hacker News.

Chris - is Eve a visual programming language? If so, what makes it better than all the others that have tried and failed?

"onboarding" has become somewhat of a UX term. It refers to the process of taking a non-customer and turning them into a customer that understands and can use the product.

There's actually a website that gives examples of different company's "onboarding" experiences: http://www.useronboard.com/

:) Just gotta say it - KFC is a bad example here.

It stands for Kentucky Fried Chicken, which is pretty much exactly their product.

They do actually give you the ability to make this totally secure. They mentioned in the post that they will provide instructions on how to install a CloudFlare certificate on your server - this will allow CloudFlare to communicate securely with your server as it attempts to cache your content.

Then when the user makes the request to CloudFlare, they return the content that they received over SSL, on an SSL connection. It's like magic.

CloudFlare just made a HGUE impact on the internet, IMO.

I've thought for a long while that Jeff Atwood was a bit egotistical - I've mostly kept it to myself, but this really takes the cake.

There's a few key things you need to have to properly apologize[1]:

- a detailed account of the situation

- acknowledgement of the hurt or damage done

- taking responsibility for the situation

- recognition of your role in the event

- a statement of regret

- asking for forgiveness

- a promise that it won't happen again

- a form of restitution whenever possible

Most of those things aren't there. And, most notably, Jeff spent the majority of this post explaining why he wasn't at fault. That may be a fair opinion, but keep your ego to yourself - don't post an apology if you don't mean it, and don't act like this fulfills Gruber's request just because you put it on the internet.

Furthermore, Gruber is right. He has a license on the name Markdown[2] - the name is not up for grabs. And the name "Standard Markdown" very directly implies that the rest of the "flavors" of Markdown are wrong. I would say "Common Markdown" is no better - it implies that all other flavors of Markdown are uncommon. If Jeff really had any intention of making things right, the least he could have done was wait more than a day to hear back from Gruber - it's not like this is really a time-sensitive matter.

[1] http://www.perfectapology.com/how-to-say-im-sorry.html

[2] http://daringfireball.net/projects/markdown/license

I've been seeing this as a default behavior for some static site hosts. If you don't supply them with an error.html, they redirect 404s back to the homepage by default - but with a 302, not a 404 + meta redirect.

I'd much prefer a generic error page supplied by the host, even if it doesn't match the brand of the rest of my site - 404s are a pretty important piece of the internet.