Most Dangerous Programming Errors - <AUTHOR> http://cwe.mitre.org/top25/

<comment><USER4> I wonder why the discussion section for each topic tries so hard to be funny:

"Buffer overflows are Mother Nature's little reminder of that law of physics that says: if you try to put more stuff into a container than it can hold, you're going to make a mess."

"Just as you should start your day with a healthy breakfast, proper initialization helps to ensure that your software will run without fainting in the middle of an important event."

'''Spider Man, the well-known comic superhero, lives by the motto "With great power comes great responsibility." Your software may need special privileges to perform certain operations, but wielding those privileges longer than necessary can be extremely risky.'''

</comment><comment><USER4> While the effort is well meant, I find it hard to respect a list that advocates the following (in section CWE-665: Improper Initialization):

"Requirements: Use a language that forces the programmer to explicitly initialize all variables before use."

<comment><USER5> Why? Uninitialized variable attacks are a fairly recent finding. If you're a C/C++ coder, that's not at all a meaningless suggestion.

Leave an integer on the stack uninitialized:

        int offset;

Have a conditional that usually determines its value:

        if(something) offset = packet[0];

Later, use it as an index:

        buffer[offset] = data;

The "offset" variable, when uninitialized, takes its value from whatever was left on the stack. Attackers very often control that value (for instance, any time you memcpy or strncpy something out of a packet into a fixed-size buffer to parse it, you're also splashing attacker-controlled data over the stack).

You're picking on one of the few cases where the CWE 25 is actually topical.

<comment><USER4> This is indeed a valid security issue. I am picking on the simplistic recommendation ("use a language that forces explicit initialization")

<comment><USER6> And you're right. More often than not you as a coder don't have a choice in what language to use.

</comment></comment></comment></comment><comment><USER7> This is a great list which any programmer should be familiar with if they are not already.

</comment><comment><USER8> This list is correct but mostly obsolete and heavily dependent on your technologies of choice (and how well you use them).

For example, half of the first bunch (Insecure Interaction) are automatically covered for if you use (properly) a framework like Rails. The resource management bunch is also pretty much irrelevant if you're using a dynamic language like ruby.

The last bunch is the most relevant today, but those are hardly "programming errors". They are security design shortcomings... i.e. things that a security- minded application architect will be aware of, but that you need to think long before you write any code.

<comment><USER9> Could one use this list to evaluate an implementation stack? Maybe someone should evaluate LAMP, Ruby on Rails, and Django with regards to this list?

<comment><USER10> Rails: problem - who takes care of it - <USER2>

1) Input validation - programmer - validates_* and attr_accessible in the models

2) Output validation - programmer - HTML::Sanitize

3) SQL injection - rails - use ? or named_scope to construct complex queries

4) XSS - programmer - do not forget <%= h

5) Command injection - programmer - do not do it

6) Cleartext - programmer - requires_ssl module

7) CSRF - rails - uses authentication_token in all forms

8) Race conditions - rails - single threaded

9) Error info leaks - rails - use production mode

10) Memory - ruby - safe language

The rest are all on programmer - just do not do it.

<comment><USER5> First, this is like saying C takes care of buffer overflows:

1) buffer overflow - programmer - <USER3>

Conservatively, that action item cost the industry over 5 billion dollars. So, generally, "bad programming: use good programming" is not an effective answer to security.

Second:

(3) Fails on complex queries and query builders all the time; there are situations where you can't parameterize everthing that varies in a query.

(5) Would have precluded Github, which used `` expansion in its first revs to invoke git.

(8) First, Rails isn't single-threaded anymore, and second, you can end up with race conditions at the database layer if you aren't careful with transactions and isolation levels.

(9) Is only true if you not using any unaudited C extensions; quick, tell me how many of the gems you brought in have an ext/ directory with code in it?

<comment><USER10> 3) Have you tried named_scope? It solves most of the query building pain for me...</comment></comment></comment></comment></comment>


Ask HN: What to do with shitty world - <AUTHOR> Are we changing the world for the better?
What is happening with our profession?
Why the heck is autocorrect so helpful and so annoying.
Why are recommendation so successful that they create filter bubbles? Are bubbles wrong? Is making other person feel better by liking comments bad?
Are we so shitty with our process cause outages to happen. Can't we make them better? Do we use technology as substitute for human interaction? Is technology a new God, or is it just a tool?
This post is made to provoke discussion about merits of technology, why it fails when you need it the most and what is this higher power (aliens like Elon Musk says?)
Isn't it against first rule from dekalog?
I see many ways how to solve the world, can you help me?  I try to contact Bill Gates to help him with his mission, I want to contact the Pope. But I can't do it alone. Will you help me make a world a better place?
It may seem crazy, but I'm certified crazy, currently in psych hospital with other patients that are not suited for sociaty getting drugs that work jack shit. <comment><USER2> I feel like both Bill Gates and the pope are _extremely_ busy and already have untold numbers of people trying to take a moment of their time. You could contact the Bill & Melinda Gates Foundation, but I wouldn't get my hopes up.

[https://www.gatesfoundation.org/Who-We-Are/General- Informati...](https://www.gatesfoundation.org/Who-We-Are/General- Information/Contact-Us)

You can send a letter to Pope Francis, but again, I wouldn't expect any interaction given the volume of mail he probably receives...

His Holiness, Pope Francis

Apostolic Palace

00120 Vatican City

If you have many helpful ideas, why not just share them and allow people to act on them themselves?</comment>


How memory research can help you learn a new language - <AUTHOR> https://aeon.co/ideas/how-memory-research-can-help-you-learn-a-new-language <comment><USER2> I was excited to read this article because I am trying to learn a new language... but I found it quite lacking. What was the advice? Just to sleep more?

<comment><USER3> The gist of his advice, by my reading, is this: "Immersive contexts are generally helpful because they activate different neural centers in the brain -- which leads to what researchers call 'integrated' memories, which are more durable and easier to recall."

Many, many people have advocated immersive contexts for second language learning, of course. But what the author seems to be saying is that researchers are starting to find specific neural mechanisms that would support such learning approaches, based on fMRI measurements and other data.

</comment></comment><comment><USER4> > say that you bought a pair of brand Y shoes. If someone then compliments you > on the shoes, you are more likely to buy brand Y again, even if the > compliment had nothing to do with brand Y.

What? Isn't that perfectly expected and reasonable?

<comment><USER5> If I buy a pair of Merrell boots and get complimented on them, it doesn't follow that I should also buy Merrell running shoes, but per the article I'm more likely to. The brand is irrelevant to the compliment: I'm not being complimented on my Merrell's, I'm being complimented on my _boots_. The rational and reasonable thing would be to identify what about the boots is worth complimenting and aim to mimic that in future purchases. It _could_ be the brand, but likely it's the cut, the shape, or some other visual quality.

OTOH, sometimes it _is_ the brand that gets complimented.

<comment><USER6> If you like what you know of someone's work (the boots), it makes sense to try more of it (the shoes).

<comment><USER5> Yes. You're correct.

 _BUT_

What the study revealed was that people would buy more of a brand based on _compliments_ not how the product by the brand actually _functioned_ for themselves.

I have very, very blue eyes, and a generally well-shaped face (attractive, not movie star handsome, but good looking when I'm fit). But my eyes get the most compliments and notice from women. I bought a shirt from Joseph A. Banks, it happened to be blue-dominated in its coloring (checkered/plaid pattern), that quality of the shirt makes it very well liked by my girlfriend. The rational thing to do is to buy other shirts with blue in them (which may be Jos. A. Banks). The irrational thing, which people seemed to do per the study, was to buy more shirts from Jos. A. Banks. If I go back and buy a red plaid shirt, it won't get the same reaction as the original because it doesn't have the same quality that got the original compliments.

<comment><USER6> In that specific example, yes, but compliments are often given because of the design, and in those cases it makes sense to give credit to the designer.

</comment></comment></comment></comment></comment><comment><USER7> >Tell me if this sounds familiar: you just turned off the light, your head is on the pillow, your eyes are closed, and yet, instead of drifting off to dreamland, you find yourself thinking about something that happened earlier in the day.

Hmmm no, doesn't sound familiar to me. I fall asleep quickly and it has always been this way. My sleep tracker says my average time to sleep is seven minutes. I always wondered how common this is?

<comment><USER8> Since this is the internet, I am free to reply with hearsay... I read that if you fall asleep that fast, you might not be getting enough sleep the previous night.

<comment><USER9> I've heard the same thing from doctors; falling asleep in less than 10 minutes is generally considered indicative of sleep issues of one sort or another.

OTOH, ~90% of the population uses caffeine regularly, and given that it takes ~48 hours to completely purge your body of caffeine, I think that saying is only relevant to caffeine drinkers.

<comment><USER7> Coffee or no coffee, 10h sleep or 4h, it's all the same for me.

</comment></comment></comment></comment><comment><USER10> I started learning Vim a couple days ago, it feels like a new language to me also

<comment><USER11> Vim can be adventurous. [0]

[0] [http://vim-adventures.com/](http://vim-adventures.com/)</comment></comment>


Hans Rosling: Let my dataset change your mindset - <AUTHOR> http://www.ted.com/talks/hans_rosling_at_state.html

<comment><USER2> 1 hour Swedish (English subs) documentary about Hans Rosling: <http://news.ycombinator.com/item?id=776421></comment>


Show HN: Chrome/FF plugin brings the HN and Reddit conversation to you as you surf - <AUTHOR> http://www.metafruit.com/kiwi <comment><USER2> There are some pretty serious privacy issues with this extension.

There should be a way to block domains that you don't want searched, otherwise secret URLs such as youtube private links, google docs, etc are exposed. One scary thing is you are potentially exposing them to third parties, by searching reddit, HN, and google.

This is a pretty good example of why people need to be wary of chrome extensions they install. They sit in an advantageous position where violating things like SOP, CSP Rules (depending on the browser) and more is okay by using the background page.

<comment><AUTHOR> That was a major concern of mine. You can set the Research mode to "Off" by default and check URLs on a case-by-case basis and still do custom searches. Admittedly, it takes some of the serendipity out of it, but it addresses your concern.

I considered (and was planning on) adding a "block URL" feature - but the issue of how to store those sensitive URLs (to block) came up. Because localStorage and sync storage in Chrome is not sandboxed or encrypted, the blocked list would be "in the open" to other extensions. Yes, you could hash the urls you'd hope to block, but then there would be no way to read that list back to the user at a later point in time, and slight mismatches in URL schemes would lead to an imperfect system. So simply toggling Research Mode and researching pages of interest is the best option, IMO.

I don't cache any personal info in localStorage or sync storage (which at least Chrome does not encrypt :< ). The api results are stored in a local variable within the scope of the extension. And the "history" is a hashed and padded blob.

This is also why I released it for both Chrome and FF, since some people assign different use cases to different browsers. The code is also public/open-source.

<comment><USER3> Maybe I missed it, but as far as I can tell, this comment is the only documentation of what "research mode" means. You might want to address that somewhere...

<comment><AUTHOR> No, you're right. Adding it now (thanks!) (update added to landing page and pushing out to the Chrome/FF stores)

</comment></comment></comment></comment><comment><USER4> I built a kind of similar stuff as a side project in 2011 - [redacted]. It allowed you to leave notes for a URL which your friends / followers can see when they visit that URL.

In the beginning when I was testing this with my friends and colleagues, I sent every URL a user visited to the server to check if any of his friends have left any notes and then alert him via notification badges. I disabled it when I started seeing a lot of private URLs (like Google Docs links with share access) in server logs. I then changed the extension to query server only when a user clicks on extension button.

This made it a bit safer, but the extension still needed access to all the sites a user visits. And with Chrome's auto updation of extensions, one may never know if the extension author has started sending every URL back to server again.

After developing such extension, I am quite suspicious such extensions and only install extensions from trusted authors (Buffer, Pocket, etc).

<comment><AUTHOR> I agree and will say that I'm as pleasantly surprised by the review process Mozilla has for its add-ons -- as I am dismayed that Chrome has no equivalent process. I'm in-queue of the Firefox review (takes on average 10 days) and have exchanged emails with their volunteer-team on best practices to adopt.

Ultimately it comes down to winning the user's trust, and I'm trying to address as many questions as I can up front.

 __In response to another comment, I 've also un-minified the Chrome extension code and will keep it un-minified going forward (will take up to an hour to propagate [update: fresh installs are now un-minified / and the current- install base will get the update within 6 hours]) __

</comment></comment><comment><USER5> How does this make money? What's the plan?

It won't. I figure the amazing APIs made available by Algolia, Reddit, Google News (and hopefully more) are incurring the only ongoing expense, and I've done my best to design the extension to respect their needs. My only need is that people get something out of the effort. :)

Are you against making money on projects?

I hope to sell some funny stickers at some point! But in all seriousness, I'd be happy to charge for a product that doesn't depend on others' APIs. Ambitious projects that aren't concerned with revenue are (more than likely) destined to fail -> certainly there terrific exceptions to this...

I really like this idea of not charging for a service heavily based on other people's APIs. How many nodejs programmers are out there trying to make dirty money off other people's work + CSS ? It's shameful

<comment><USER6> I disagree. Unless they're breaking licenses or taking credit for someone else's work, it's not dirty money. Is it shameful for Apple to make money from an OS based on FreeBSD?

<comment><USER7> > _Is it shameful for Apple to make money from an OS based on FreeBSD?_

Yes, thankfully they aren't doing it.

<comment><USER8> They were, weren't they?

</comment></comment></comment></comment><comment><USER9> I had an extension called Deeper History which I shut down out security/privacy concerns very similar to yours. The solution I came up with half worked. I used [https://github.com/travist/jsencrypt](https://github.com/travist/jsencrypt) to encrypt the sensitive data before storing it in IndexedDB.

The problem was I couldn't get it to work with public keys I created locally. According to jsencrypt's github it should be possible. If you could get it to work you could give security conscious people a way to safely cache stuff locally.

Anyways if it would help to store user info on the client, I jut wanted to say there is a viable way forward on that. I have the code to chunk and encrypt stuff on the client if you're interested.

<comment><AUTHOR> Thanks for sharing your approach. In the end, I decided the API results didn't need to be persisted in storage -- they get stored in a local variable and jettisoned with Javascript's garbage collection. My primary concern was: to- what scope did the data belong? (Check my other comments to see my dissatisfaction with Chrome's dev-doc's language on this topic.) I decided that the user history did not need to be precisely-known, so - my strategy here was to hash the url, cut the hash to a much shorter string (to increase likelihood of collisions), and then pad the shortened-hash with a random number of characters on either side, and concatenate that string to a large blob of text. The extension would then be able to perform an indexOf search on that blob to be reasonably sure that the user had been to that URL. This uses localStorage. (This keeps the extension from repeatedly querying commonly- visited URLs but also does not prove you were at any given URL since collisions are expected to happen.)

<comment><USER9> No problem. Nice work and good luck!

<comment><AUTHOR> Thanks! BTW, I love the idea behind your extension -- because Chrome's history search is almost always a frustrating let-down. Provided you can solve the privacy issue, I'd use it in a heartbeat. I'd also be very curious to see your final implementation

<comment><USER9> Thanks. I'm currently spending my free time learning ML and strengthening up my math. I'm not sure I would want to commit to supporting DH again. Maybe one day though.

When I shut it down, DH had ~5K users and supporting it was work then. Not to mention no employers really seemed to care about it so it kind of made me wonder what I was doing it for. I made no money and I had people hitting me up to fix this or that.

Be careful what you wish for!

</comment></comment></comment></comment></comment><comment><USER10> I really liked StumbleUpon exactly for this feature until they ruined the product during the monetization phase.

Edit: Having comments is really important. Maybe marked by color of source (blue for reddit and orange for hacker news) and separated into submission sections. Also important is the preservation of the original tree structure of the submission comments.

<comment><AUTHOR> faceyspacey echoed that sentiment below too -- I've added expandable inline comments to the todo list (thanks!)

</comment></comment><comment><USER11> Great idea! I immediately thought "Why didn't I think of that!?"

With regards to the privacy concerns of Research mode, there may be a way solution. For sites like Reddit, it should be possible to build a bloom filter. Have the metafruit server actively spidering Reddit for new, popular threads and add them to a bloom filter. The plugin would download the bloom filter from the metafruit server at some regular interval. That way checking whether any particular URL has an associated conversation is just a local operation. Plus, it's faster than pinging an API, and burns less of the target API's resources.

That would also provide a way to monetize, by giving out the metafruit bloom filter to subscribers only. Or perhaps the free plugin can update its bloom filter once a day, but subscribers can update once per hour.

<comment><USER12> I might enjoy using this. But, PRIVACY! Sending back every visited URL has never been ok for any reason, first time I saw this idea shot down was in '93.

But there might be a way out:

I'd be willing to give up privacy of URL hashes. This is how I'd do it:

\- you already track a set of URLs that have discussions (I assume). If not, you need to figure out how to seed these. Volunteers, APIs....

\- hash these URLs on server, and use a not-too-unique hash function. You want to end up with a high collision rate, but not too high.

\- now, the client can query for conversations without revealing the URL it has visited: \- ask server whether there are any conversations for a particular hash. \- if server finds any, it returns { pageUrl: '', conversationsUrls[]} \- now client can decide whether the url really matches, or it was just a random hash collision.

\- I know this is not perfect. A privacy-busting determined enemy could generate hashes of large number of public sites and use statistics to infer what sites you've visited just from your hashes. But it'd be good enough for me.

Bonus money-making idea: \- offer your plugin as a paid service to different web communities. Increases their "community engagement".

I seriously contemplated starting an "annotations" startup in the 90s. Someone else did, and they folded after a few years.

<comment><USER13> This is kinda how Google's Safe Browsing[1] works, although with a few extra layers, such as (IIRC) always requesting some random hashes when confirming matches.

I read a better explanation on a mozilla mailing list once, but the key point is that it tries /really/ hard not to disclose private data.

[1] [https://developers.google.com/safe- browsing/developers_guide...](https://developers.google.com/safe- browsing/developers_guide_v3#Overview)

</comment></comment></comment><comment><USER14> Funny, the plugin works on every website that I've tested except for just one case - the plugins own homepage ;-)

<comment><AUTHOR> Ha, took a few minutes, but now it's showing up in the API results. :)

</comment></comment><comment><USER15> I have been using Reddit Check ([https://chrome.google.com/webstore/detail/reddit- check/mllce...](https://chrome.google.com/webstore/detail/reddit- check/mllceaiaedaingchlgolnfiibippgkmj?utm_source=chrome-app-launcher-info- dialog)) for over a year and it's very nice. I love finding discussion on random websites I find.

This extension appears to be better made and has more features. It's nice to see discussion on HN too.

It does not work reliably. I clicked on a bunch of links from the HN front page. Reddit check did find that they had been posted to reddit before, but Kiwi did not. However all of those links had only been posted once, and had no discussion. Still it seems strange it would say they had never been posted before.

It was also unable to find youtube videos that had been posted before. Youtube is terrible at unique URLs, and I don't blame it. However Reddit Check is able to find all the different places youtube videos have been posted.

I found a link that had been posted to reddit hundreds of times. It only found 11 results. There was also an option for "fuzzy matches" which included a few more links to the exact same URL, but also links that had nothing to do with it. Reddit Check also has a problem where it only returns the first 25 results.

Clicking on any of the links closes the menu, so you can't open many links in new tabs at once. This is also a problem with Reddit Check.

It does not find http versions of https links. Also a problem with Reddit Check.

Clicking on the "submit to reddit" option opened a submission page, but not with the URL in it.

I tried to look at the code but it was all squished together. It does not appear possible to modify it anyway.

Anyway none of these are dealbreakers. I will be using this extension alongside Reddit Check due to the extra features it has. I am concerned about sending so many requests to reddit every time I open a new tab though.

<comment><AUTHOR> Terrific comment, thank you. First, I've un-minified the Chrome extension code (only added 2kb in size), and it will remain that way going forward. It will take up to an hour for it to propagate to the Chrome Web Store, but the Firefox extension code is un-minified currently : [https://addons.mozilla.org/en-US/firefox/addon/kiwi- conversa...](https://addons.mozilla.org/en-US/firefox/addon/kiwi- conversations/) (thanks to their review process, which requires it not be minified). The Chrome code is also available on Github : [https://github.com/sdailey/kiwi](https://github.com/sdailey/kiwi)

As for the results vs Reddit check -- maybe Reddit check uses a home-rolled API that crawls more frequently than Reddit's official API? Could you either tweet me the specific links or reply to this comment?

<comment><USER15> Some links that have been posted to reddit, but it can't see:

[http://www.symmetrymagazine.org/article/july-2015/one- higgs-...](http://www.symmetrymagazine.org/article/july-2015/one-higgs-is-the- loneliest-number)

[https://medium.com/recreating-megaman-2-using-js- webgl](https://medium.com/recreating-megaman-2-using-js-webgl)

[http://calvertjournal.com/features/show/4458/owen- hatherley-...](http://calvertjournal.com/features/show/4458/owen-hatherley- postcards-landscapes-of-communism)

[https://github.com/MuseumofModernArt/collection/](https://github.com/MuseumofModernArt/collection/)

(If you search reddit for any of these URLs it goes straight to where they have been posted.)

<comment><AUTHOR> Thanks. Maybe reddit's API filters out some results that have zero comments. I looked for an attribute in their API that would ask for all results but couldn't find anything. Also - I'd like to inspect Reddit Check's code but can't find an open-source repo [https://www.reddit.com/dev/api#GET_search](https://www.reddit.com/dev/api#GET_search)

<comment><USER15> I looked at Reddit Check's background page and checked the network requests it was sending. It sends a request like this:

[https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.sy...](https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.symmetrymagazine.org%2Farticle%2Fjuly-2015%2Fone- higgs-is-the-loneliest-number)

Weirdly it seems to send the same request several times. And it should also use an &limit=100, so it gets 100 results instead of 25.

</comment></comment></comment></comment></comment><comment><AUTHOR> 3 days later: I have responded with an update to the extension that addresses the privacy concerns here. Whitelists have been implemented, privacy defaults have changed to start with Research Mode 'off', and commenter/Houshalter's problems were fixed. Now Kiwi can fetch Reddit posts that have been hidden by moderators. Full changelog report here: [http://www.metafruit.com/kiwi/changelog/2015/08/06/kiwi- conv...](http://www.metafruit.com/kiwi/changelog/2015/08/06/kiwi- conversations-graduates-to-version-1-0-0-after-user-feedback/)

</comment><comment><USER16> i'd like to be able to see comments in the widget without having to go to hacker news.

</comment><comment><USER17> does the searching happen on your machine (scrape google search results by crafting a url query) or does it get routed to a central server that we are forced to trust? If the latter, no way in hell this is going to be popular around here.

<comment><AUTHOR> It uses Reddit's API, Algolia's HN API, and the Google News Api. Any of these services can be toggled individually in settings.

[0] - Reddit - [https://github.com/reddit/reddit/wiki/API](https://github.com/reddit/reddit/wiki/API) [1] - HN - [https://hn.algolia.com/api](https://hn.algolia.com/api) [2] - [https://developers.google.com/news- search/v1/devguide#gettin...](https://developers.google.com/news- search/v1/devguide#getting-started)

Also, it can be set to search a-la-carte by toggling Research Mode.

</comment></comment><comment><USER18> Wow, so now I can read uninformed, ignorant opinions anywhere I go on the web? This is surely progress.</comment>


Is it possible to stay in business without being bit evil? - <AUTHOR> I've launched 5 companies, all profitable (200K-20M ARR). Now, I am creating a new product where we can possible do 200M ARR. Now, I am noticing a pattern that in past success, that there is a bit of evil luck. My question, is that is there any company which does no evil, not even a tiny bit? <comment><USER2> Probably violates the second law of thermodynamics.

All living things have to destroy more than they create.

if evil = chaos and chaos = heat than all living things create more evil than good.

which leads to the conclusion that I'm completely full of sh*t.

<comment><USER2> Here's some passages from the bible that rich Christian people use to justify their wealth:

[https://en.wikipedia.org/wiki/Anointing_of_Jesus](https://en.wikipedia.org/wiki/Anointing_of_Jesus)

Of course most people are Jesus Christ so take it for what it is.

</comment></comment><comment><USER2> I think if you find some customers that really like your product and you treat your employees as fairly as you can that's a pretty good starting point.</comment>


Show HN: Lean – Clean Up Live Photos – Aka Make Them Dead Photos - <AUTHOR> http://lean.tinywhale.net <comment><AUTHOR> I made this little app to help you remove unwanted video component in your Live Photos on iPhone 6s/6s Plus, thus let you have Live Photo to all the time to capture every possible moment. Super simple and free (as in free space)!</comment>


Thank you HN, sorry HN - <AUTHOR> A couple of months ago I posted a request for help here on HN [1] which somehow ended up on the front page. At that time I fought with heavy depressions - it was really bad. I did not expect my request for help to land on the front page but it did and I got what I asked for. A ton of people sent me emails with very kind words and advice. Now I am in a position where I have to do two things:
1. Thanks to everyone who offered help of any kind. I do really appreciate it.
2. Sorry that I did not respond to everyone who wrote in. I found out that reading all those email made me even more depressed somehow. I will send everyone who wrote in a personal thank you note once I am better.
With some of you I had a longer chat and one person even sent a teddy bear from the USA to Germany (where I am from). I made a picture of the teddy bear [2].
As I mentioned I got a lot of advice - even though I was not able to respond to everyone who sent me an email (sorry again). In the meantime I saw another doctor, changed the medication, changed my lifestyle and now I am feeling a bit better. I would not say that my life is worth living right now but it became better and you guys certainly helped a lot.
I would love to give something back to you but I am not sure what that should be. During the last couple of weeks I thought long and hard about that and I really would love to do something: Found a help network for hackers, somehow improve the current situation for crisis/suicide chats or something like that. So what do you think would improve the current situation of (depressed/suicidal) hackers. Please let's discuss that. Not everyone will make it on the front page when help is needed - or am I wrong?
[1] My original request for help: http://news.ycombinator.com/item?id=4928031 [2] My new friend: http://i.imgur.com/nQQAVuc.jpg <comment><USER2> "I would love to give something back to you but I am not sure what that should be."

I would worry about creating an obligation that would require you to have anxiety and other issues by not being able to fulfill the obligation. While it's nice and might make you feel good to give back it's hard to believe that it wouldn't be better to simply try to get yourself stronger without the obligation of doing for others. For now.

After all even the simple act of "replying to all that wrote" appears to be more than you can handle right now. I'm sure some of those people would want to be acknowledged for taking the time to write.

<comment><USER3> Serving others is one of the best ways to get one's mind off oneself and combat depression. I would actually exhort you to commit to doing some kind of service / help for someone else. Start small. Thank you for sharing your story.

<comment><USER4> Want to echo this and also recommend reading the book, How to Win Friends and Influence People by Dale Carnegie, for some tactical advice on how to 'serve' others in small ways. Good luck!

</comment></comment></comment><comment><USER5> "I would love to give something back to you"

You might want to help depressed hackers, but in the mean-time I'd suggest you can give far more than you'd guess. Each day, find someone you can "help" ... hold the door for someone with full arms, smile at someone who's scowling or tutor someone who's having a hard time understanding something you know well.

You'll certainly brighten their day, but you'll also find the satisfaction in being helpful (with no expectation of any compensation) will improve your mood too. Don't believe me? Try it for 30 days ... and if at some point you believe your life isn't worth living right now, think of what the people you've helped would say about your life.

<comment><USER6> Furthermore, your vocal call for help and openness toward depression may have helped many who are suffering in silence and have now gone to seek help.

</comment></comment><comment><USER7> Getting back in touch with the community to update us on your progress is more than enough. It's great to hear that you have switched doctors, meds, and changed your life style. It's even better to hear you are feeling better. Even improvement that seems marginal are land slide accomplishments. It's a sign that you are on your way, you can see the light, and I hope it gives you hope. It surely gives me hope.

What I don't think you realize is that you have already done so much. That day your story hit the front page the community came together to support one of our own, you. This was huge. What's more is it brought depression to the front of our minds. On that day a few people may have hugged their wives a little tighter, asked their teenages how they have been doing... and actually listen. Not to mention the dozens of people who are also battling depression that would have acted on the advice given to you.

You've done so much, and you are doing so great. You have helped people with your story... even though they may not come forward and say it, I guarantee you did. I can tell you that your story restored my faith in this community, which so often gets caught up in some pretty silly arguments. For this, I thank you.

You've done so much, you've done so great, and you owe us nothing. Just focus on getting better, and hold onto this passion you seem to have for helping people who are in situations similar to yours. It will come in handy...

I could write forever, so I'm going to stop now.. but just one last thing. The world needs more people like you, not less. Hang in there.

</comment><comment><USER8> > _I would love to give something back_

How about telling us what helped you the most? You mention you "changed your lifestyle"—what things did you change?

</comment><comment><USER9> I went through the same thing. A support group works. What helps me the most is vitamins, water and exercise. I also stopped spiking caffeine (I take a time release capsule) and stopped drinking alcohol.

Vitamins (every morning with food): Vitamin C 1000mg (energy and health) B-12 3000mcg (happy energy) Magnesium 400mg (focus and _mood moderation_ ) Fish Oil - EPA 120mg + DHA 900mg (memory + _mood moderation_ ) L-Carnitine 200mg (precursor for acetylcholine neurotransmitter) Time release caffeine (8 hours of stable energy with no spikes)

This has helped me completely conquer my mood swings (depression as well as ADD) and has made a huge impact on my enjoyment of life.

<comment><USER10> Yes, yes, yes a thousand times to stop drinking alcohol. My moods leveled out substantially once I stopped drinking. Granted, I have what is traditionally known as a problem with alcohol so YMMV, but from personal experience it's been the best decision I've made by far. (I could go on for paragraphs about alcohol and programming culture, but I'll shelve the off topic proselytizing for later.)

More important than anything else, if you're having depression issues, it's important to remember that you can always change your story. You're not locked into anything (well, most things) in your life. True, some things are harder to shed than others, but if you're depressed enough where it affects you on a monumental, daily basis, just remember you can change it. Stop engaging in activities that make you feel like shit. Cut acquaintances (even family) out of your life that bring you down. Drop out of life for awhile if you need to - the people who truly care about you will understand. Anything is ultimately better than the alternatives of a quick demise or a bleak existence, both for you (primarily) and the people around you.

It gets better is an overused cliche, but it holds some merit. You can make it better.

(on a side note, time release caffeine sounds incredible.)

</comment></comment><comment><USER11> The best thing you can do is take care of yourself. Seriously.

The first rule of search-and-rescue is "don't be a victim." Make sure you are taking good care of you.

</comment><comment><USER12> Please, if I was motivated by the expectation of something in return I wouldn't have mailed you.

If you are going to do something, start small, theres nothing worse than creating a huge obligation to yourself that you can't fulfill.

</comment><comment><USER13> _> Found a help network for hackers, somehow improve the current situation for crisis/suicide chats or something like that. So what do you think would improve the current situation of (depressed/suicidal) hackers._

I think one of the biggest problems here is that people with suicidal level depression lose all perspective and see the world as void of any possibility of escaping whatever box they feel trapped in. No way out or through, no light at the end of the tunnel, just trapped in a particular emotional state and perception of things. No way forward in life.

One of the best ways to help people through that is for those who have been through it to simply share, in detail, their own experience with it, how and why they felt trapped at the time, and how they made it through, and what ultimately solved it for them.

Simply demonstrate the possibility, with as much concrete detail as possible (which hackers particularly require), that there is a way through (a hack, even), that depression grossly skews your perspective of the world, and things are not as bad as they appear (especially for anyone living in a first world country and among the lucky few fluent in the empowering languages of technology).

Other options would be physically changing people's perspective by organizing some sort of multi-month aid mission to an impoverished country (maybe hook up with Engineers or Doctors Without Borders). Or alternatively a grueling, endorphin-generating Outward Bound type excursion. Anything to jolt people out of their current perspective of their relatively limited existence.

Finally, if it helps you could treat this whole idea as a startup, solving the particular problem of hacker depression. Use lean startup methodology, your hacker problem solving skills and mentality, look for hacks nobody has found yet. Document and blog it all, etc. Who knows where it might lead, but there's certainly an awareness of the problem thanks to high profile hacker suicides lately, and lots of people probably willing to help.

</comment><comment><USER14> Resources for depressed hackers are pretty poor. You hear of burnout, chronic fatigue, moving someplace isolated -- but rarely the "d-word" in hacker circles. Offering your story is a great start. There's a "Geeks and Depression" list you may be interested in.

<comment><USER15> _Resources for depressed hackers are pretty poor._

For hackers suffering from depression, please don't resist getting help because you can't find resources specifically for hackers.

In the case of support groups, it's nice to be with people who share a similar background as you. But I think you'll find that the shared experience with depression will massively overcome what shared experience you lack on the job or as a hobby.

Please get help. It's not an exaggeration to say it could be the difference between life and death. The path downward is often a long, gentle slope. While you're on it, it feels like flat ground. You don't realize you've hit the lowest elevation until... well, you just stop walking.

</comment></comment><comment><USER16> As another hacker who has suffered from depression, this is an excellent idea. I know that I'd much rather talk to someone who understands my peculiar mindset instead of yet another PhD charging too much an hour.

<comment><USER17> No no no, OP doesn't have the resources... yet. You're supposed to put on your own oxygen mask before assisting others - there's a reason for that.

<comment><USER18> That's such a great analogy. And is absolutely correct. Depressives helping depressives is a great idea on its face, but falls down quickly when you haven't given yourself the opportunity for actual, serious stability before reaching out your own hand. The process of becoming healthy becomes much more complicated and difficult if you are trying to balance your own mental welfare with the welfare of others.

I was once asked what I was doing to live up to a certain person's life with whom I was associated. I said I was doing what I could for myself today so that I could do anything at all for others in the future.

<comment><USER19> I couldn't keep up with it but <http://lift.do/> has a habit streak and motivation by seeing other people keeping on tasks.

Depression comes from not keeping up on tasks and losing your streak. That's when you start questioning yourself and the cycle keeps happening. There is definitely a niche need for a mentoring / motivational network for depressed people. This whole thread, and your last one, plus the momentum that came with them is proof.

<comment><USER20> "Depression comes from not keeping up on tasks and losing your streak."

I think you mixed up cause and effect. Depression mostly leads to not keeping up with what you're doing, which is the starting point of a downward spiral. Depression isn't "solved" by motivation. Depression is complex, but most times a common source is a overwhelming emotional event, which is re-felt in every down turn.

</comment></comment></comment></comment></comment><comment><USER21> Focus on getting better right now. You have your life in front of you and once you beat this you will have ample opportunity to pay back to the larger community. Please accept that you don't own anyone anything right now and the best you can do it focus on what you need to get better. Its ok to feel the kindness of others when you are in need.

Also, thanks for being so open. Continuing that openness and building a support group for yourself through that is something which helped me through a similar situation.

</comment><comment><USER22> Put your own oxygen mask on before helping others.

<comment><USER23> This.

The best way to reciprocate is to commit to being the best "you" you can be. Good things will flow naturally from that.

</comment></comment><comment><USER24> I don't think you should feel obligated to give back. Just focus on your recovery. Maybe the next time a "depressed hacker" thread pops up, post your own experiences and what worked for you.

</comment><comment><USER25> As someone that you corresponded with a bit I am glad to hear you got help and got your problems sorted.

I want to share a bit why I wanted to help with the rest of HN. I throughout my life thought many ailments were my "problem", ranging from simple depression, bipolar, alcoholism, drug dependancy and tried the methods successful for each one to "cure me" to no avail.

A couple of years ago however a psychologist gave me his opinion of ADD. Just simply knowing what it was has helped me enormously. It gave me a set of tools to fight the issue. It turns out that all of those other things were epiphenomena of the ADD, parts of the vicious cycle of the upswing when you start seeing the light, elation with a new achieved high you get from some measure of success, followed by the eventual downfall and depression when you see that you are still not making headway. This cycle would repeat and still affects me a bit.

In my case what helped was a stricter regiment of food supplements (especially D, Omega, B6, B12 and calcium) and using Mountain Dew (yes, I know it's a horrid substance) to elevate myself in the afternoon. This coupled with Mindfulness meditation allows me to stay relatively productive. I'm in the process of getting medication for ADD after reading Flower for Algernon and realizing that refusing medication is akin to Charlie refusing the operation (read the book if you haven't, it's remarkably well written).

Before this realization and change in behavior I was flunking out of CompSci @ University. After that change I managed a whole year of full coursework and graduation. I managed to get a job and am managing to achieve the goals we (me and my boss) set for my work.

My point is: You might think you have a specific problem but in reality you might have another problem, but the symptom is what you notice. ADD should really have been obvious when you look @ my life a certain way (having studied everything from medicine to economics to accounting to philosophy and finally CompSci). I had seen many professionals and only one of them hit the proper diagnosis. The funny thing was once I knew the problem, I had tons of tools I had learned about elsewhere to combat it and the only reason I think he was right is that the methods worked!

One of the things that keep me focused is helping others. It kinda gives me a good reason to maintain myself in fit spiritual condition (agnostic, spiritual here simply means connected with my fellow man). A friend of mine is graduating this spring and he tells me he wouldn't be, if I weren't helping him with his maths. Once he graduates, I need to find someone else to help. It gives me strength to know that the help I received, I can pay forward. I'm glad far_far_away is doing that too.

<comment><USER19> I've been neglecting my ADHD for two years now and I finally set up an appointment. I keep having the same high and lows and the cycle doesn't stop and it doesn't feel right conforming but I'm going to try the pills anyways and see if it helps.

It's nothing that I worried about but I didn't want to keep neglecting suggestions and missing an opportunity for something that can turn out to be a benefit that increases the productivity of my lifestyle.

Sometimes that's what it takes, the only way you'll figure out if you don't need them is by trying them out.

<comment><USER25> Pills are just one part of a solution. Proper framing of your routine is important. Goal-oriented training is also good. Lack of focus is our dilemma. Everything that gets us on a track and keeps us there is beneficial.

<comment><USER19> I used to use Google Tasks, and then that became a data dump of information and ideas of what to do next (personally) and what to do next (business wise) on top of what to do next (on specific projects and different projects). Then I switched to gqueues, then some other to dos that I don't remmeber, I think the standard one that comes on the iPod and other ones..the last one I used was any.do + some sort of combination of things to read with evernote.

They (any.do+evernote) are still the same data dump and nothing really beats off my current set up which is simply google calendar, post it notes on mirrors and walls, behind doors and other places. That's the reminder and keeping in focus part. What I'm really looking for is a Google Glass AR app to visualize statistics and basically the game of life and to have it in my field of vision at least turned on every 15 minutes throughout my whole day.

It's funny that people with ADHD, or any other mental condition are more prone to accept transhumanistic technology without worrying about dehumanization.

I'm completely fine walking with a Vegeta-like scouter to stay on task. Eventually it'll become habit, like the post it notes.

I can also completely accept some sort of solar powered tattoo, in the shape of a watch or anything that'll allow the tattoo to create a hologram, that beams like a simple pager of my next thing to do, powered with an API transmitted through my phone through Bluetooth.

You know one of these days I'll tackle funding a project that helps ADHD people with different ways of learning and tackling tasks.

<comment><USER25> I so totally relate to your way of thinking. For me it was Google Cal and Android sync. The droid was simply an extension of the web interface pinging me with things to do and where to go.

</comment></comment></comment></comment></comment><comment><USER26> Hi! I am really glad to read this. I remember your first post, and wanted to send you an email, but felt that I didn't have much to say and finally I didn't send it.

If you want to give something back, I would suggest to post what you did to beat your depression, it will probably help someone who goes through a similar situation.

</comment><comment><USER27> I'm not sure if you owe anyone anything. Ultimately the right kind of people lend their voice to supporting someone because someone did it for them. if you paid them back somehow, would it be the same as taking the time to support someone else in your future when you come across a situation.

Being given to or cared for unimaginably often makes us feel like sharing it, be it giving it back, or doing it for others. Whatever you do, know that there's probably more than a few people that would probably be happiest if you join them in being a giver and keeping kindness and goodness fashionable. In other words your gratitude is not a debt to repay, but maybe another chance to participate in our universal responsibility for our human family by helping others not feel alone, and maybe a little more understood.

</comment><comment><USER28> You are already helping by telling your story here. People who feel the same way you did now have a story of someone in their situation overcoming their depression. Your example is already helping others.

As such, anyone who feels the same way should feel free to comment here to reach out or just vent.

</comment><comment><USER29> First, let me say that I am so happy that the OP is doing better.

We'd love to join forces with the OP (and anyone else) to "found a help network for hackers." We actually have online discussion already planned on March 20 to begin this process:

[http://workshops.cojourneo.com/workshops/Surviving-the- Start...](http://workshops.cojourneo.com/workshops/Surviving-the-Startup-Life- The-Toll-of-Merging-Identity-and-Work-45)

It features two "legends" who are uniquely experienced to guide these efforts: Parker J. Palmer & Jerry Colonna.

Everyone is invited. I'd love for the OP or anyone else to contact me at email@example.com if you'd like to join forces. We can make a difference together.

</comment><comment><USER30> A thank you letter is not homework, and has no due date. If you feel like you have to reply to every body remember that you are not on a schedule. Take your time. You are the one in need of help.

</comment><comment><USER31> Your life is most definitely worth living, even though it may not feel like it. You can rest assured of that.

</comment><comment><USER32> HackersHelp I'm in! I really love the Idea! A good starting point for these sorts of things has always been founding an IRC-channel ;)

</comment><comment><USER33> While the HN crowd have lots of things in common, especially those things that make us human, what things are you especially proud of, strengths that you feel are somewhat unique to you, the things you really enjoy doing and the kinds of problems you prefer tackling?

</comment><comment><USER34> "I would not say that my life is worth living right now"

One day it will be, that is sure. Keep fighting.

<comment><USER34> OP, I should add that that's your sickness talking. You will beat that. It's like saying you feel cold when you have a fever: just a normal symptom of a normal illness, and like a fever it's life threatening.

</comment></comment><comment><USER35> I'm not sure how to tell you how to give back but I have a couple of suggestions that might help you figure it out on your own:

Love Does by Bob Goff - <http://bobgoff.com/love-does/>

A Million Miles in a Thousand Years by Donald Miller - [https://en.wikipedia.org/wiki/A_Million_Miles_in_a_Thousand_...](https://en.wikipedia.org/wiki/A_Million_Miles_in_a_Thousand_Years)

I just recently finished both of these and found them incredibly fun and inspiring. And contrary to what some of the posts on this thread seems to be saying, I think giving is one of the best ways to improve your life.

</comment><comment><USER36> I think you are not obligated to return back the favor to "this" community, per se. Continue live the life everyday with gratitude and love, (and remember to create something great :) ). You can return the favor by caring the people around you, those who need your help, and continue to pass on the message of love and caring.

In fact, in this world, I think somehow we are all connected. Even you in Germany and I in HK and we have never met. But like now, I am communicating with you. And hopefully thru these random and small actions everyday, we can continue to pass on the positive energy and influences to people around us.

Take care!

</comment><comment><USER37> Today you, tomorrow me. Don't worry about it.

</comment><comment><USER38> I think a support network for depressed hackers is a great idea, and I'd love to help out in some way (though I'm sort of lacking in technical skill).

That said, I also agree with what dandrews says: <http://news.ycombinator.com/item?id=5348693> Don't overexert yourself trying to help. If you think helping others will help you, then sure, go right ahead! But please be focused on your own recovery. We'll need a stable leader if we want to do this right ;)

</comment><comment><USER39> Giving up is easy, Continuing is Hard, is what most people think, but though the first part is true, Continuing in face of mounting odds is easy, if you just follow a good health regime, and keep yourself surrounded by people you can talk to and be with at ease.

Every life is worth living, you just need to ask for help at the right place, and people will help you see how important your life is.

Yes, their can be a separate tag SAVE@HN for threads from HN users in distress, If it even helps save 1 life, it would be damn worth it!

</comment><comment><USER40> The best way to give back might be to collate and share with us the advice you received (private issues anonymised), so that we and our friends who may need it can also benefit. Here on ths thread, or on its own thread, but linked here. Good luck and seriously thank you for having the courage to ask the question! There will be _many_ silent people on this board who still don't have that courage, but are longing for some help.

</comment><comment><USER41> Hi there - I am happy to see you assert yourself and come back to the community with such a positive voice. Thank you for being open to the attention people have given you. Don't worry about giving back, but look forward to it. The idea will come to you and you will know immediately that it is the right one. Believe in yourself, and keep f __*ing hacking.

</comment><comment><USER42> I'm proud of you.

</comment><comment><USER43> Just make sure you have a good life, maybe it's the best thing you can give back. A gratitude for yourself.

</comment><comment><USER44> My respect for the community just grows day after day! And, I'm happy that you feel better now, I'm sure there are hundreds of thousands who are touched by your story. Your story certainly helps them believe that it is possible to get out of depression and be happy.

</comment><comment><USER45> I'm glad the world seems like a brighter place now. I didn't see your original request, but I know some of that feeling. Keep with it. Picking yourself up, and letting others pick you up is something to be really proud of.

</comment><comment><USER46> I am one of the people who has emailed you. I am glad to hear your reply here!!! And I am glad to hear that you did get help. I understand how you feel..I really do...

</comment><comment><USER47> Very glad to hear, you are getting better now :)

</comment><comment><USER48> Volunteer somewhere like a soup kitchen or something like that on our behalf. Give love and you will feel love.

</comment><comment><USER49> <http://bluehackers.org/>

Has anyone looked into this org?

Seems like a good resource for us</comment>