When it comes to internet privacy, be afraid, analyst suggests - <AUTHOR> https://news.harvard.edu/gazette/story/2017/08/when-it-comes-to-internet-privacy-be-very-afraid-analyst-suggests/ <comment><USER4> "Opting out doesn't work. It's nonsense to tell people not to carry a credit card or not to have an email address. And "buyer beware" is putting too much onus on the individual. People don't test their food for pathogens or their airlines for safety."

This is a brilliant line and it works so well because he is absolutely right: it should not be on the burden of the consumer to make sure their products are safe, be it from listeria or a spy device disguised as a children's toy.

I don't know what needs to happen for people to get outraged, but privacy _needs_ to be a mainstream political issue. Perhaps we need to see what Google and Facebook actually have on us...

<comment><USER5> The comparison that Bruce Schneider makes is not correct.

Governments are likely to control food pathogens and airline risks because they need living, productive, happy voters.

But governments have also a fundamental distrust for all individuals and therefore want as much surveillance as possible. By allowing big companies to collect that, they have access as well.

Therefore I think governments are not motivated to improve privacy at all. On the contrary.

<comment><USER6> People downvoting you are probably taking your statement as normative, whereas it's purely positive. It's not about what the govt should do. It is what it does.

For example, the police, the IRS, DHS etc etc. (and hence the state) WILL be helped in their jobs by increasing surveillance, and so will always be trying to increase its scope.

Whether it's _worth_ the loss of privacy is of course a valid debate.

<comment><USER7> It is not a positive statement. It sounds like one, by it's actually a judgement about how effective government is. I'm quite certain that it is false.

<comment><USER8> It would certainly be interesting to hear some evidence or justification for this position, given that the record of governments with respect to privacy over the Internet era (at least) has been uniformly dismal and getting worse.

It certainly seems like the positive statement "government is not motivated to protect individual privacy and will not effectively do so" is well-supported by current experience.

</comment></comment></comment></comment></comment><comment><USER9> I appreciate Bruce Schneier's pragmatism and his acknowledgement that the problem is bigger than an individual can reasonably be expected to solve, if that individual wishes to participate in modern society. Too often, privacy concerns are met with, "Use Tails + Tor + a hosts file + a burner phone + a burner laptop, etc. etc." But Grandma isn't going to do that, and frankly neither am I. While an individual chooses to use online services, at a certain point societal and career expectations make it not really much of a choice at all. There must be a better way than placing all of the burden on the individual.

<comment><USER10> Perhaps this is a good reason to have some sort of technocracy element to the federal government. I lean extremely far right, but in this case, this seems like one of the few things that the federal government should be doing-- breaking up stout monopolies that can't be competed with.

I'm unfamiliar with the decision, but why split up a company like Microsoft in 1999, but leave Facebook and Google alone?

<comment><USER11> It's not against the law to have a monopoly - it's against the law to exploit having a monopoly to enter another market.

Microsoft was seen to be exploiting it's consumer OS market share to gain a monopoly in the browser market and the productivity software market, AIUI.

<comment><USER12> _" It's not against the law to have a monopoly - it's against the law to exploit having a monopoly to enter another market."_

What about the breakup of Ma Bell?

<comment><USER13> > What about the breakup of Ma Bell?

 _" AT&T was, at the time, the sole provider of telephone service throughout most of the United States. Furthermore, most telephonic equipment in the United States was produced by its subsidiary, Western Electric. This vertical integration led AT&T to have almost total control over communication technology in the country, which led to the antitrust case, United States v. AT&T. The plaintiff in the court complaint asked the court to order AT&T to divest ownership of Western Electric"_

i.e. AT&T used its network monopoly to maintain control over hardware manufacture.

[https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System](https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System)

</comment></comment></comment></comment></comment><comment><USER14> > Snowden's revelations made people aware of what was happening, but little > changed as a result.

Things got worse and that's expected. After all these things were made public, if there was no mass outrage the perpetrators learned a valuable lesson - <USER2> can increase their activities without much fear. Pretty sure at this point NSA doesn't even have to play games with masking / unmasking filtering US citizens, they might as well stop jumping through hoops and just record and search everything they like.

</comment><comment><USER15> Mobile has certainly made things worse.

I recently kicked off every google app from my phone. The dark UX pattern of shared logins (login to google express = login to gmaps etc) was too annoying to deal with.

It's not that I've stopped using their services, but instead switched to their web version. Same with Twitter et al. Even Uber has very serviceable web versions of their app.

As a bonus I get better battery life, and the use of Safari's content blocker, so YouTube web is even better than the app. I'm also able to silo these services into their own browser if don't want to keep logging in every time due to private browsing.

<comment><USER16> > Mobile has certainly made things worse.

I totally agree! It's easy and convenient to run a PC on FOSS, but it's a real pain to do the same with a smart phone. I just tried to run a FOS OS on my phone. I gave up because in order to flash the OS image I had to install non- reproducible binaries from some website and there was no sane way around.

</comment></comment><comment><USER10> The difficult part isn't getting people to understand that Internet privacy is important or at risk; nearly every person that I know (tech-savvy or not) understands that companies like Google and Facebook are in the business of collecting their data, and don't want them to. However, companies like these have human habit on their side: most people use these services daily, and will continue doing so unless it's easier or more convenient to do otherwise. That means that in order to reverse the trend of users continuously using these services, an alternative must be created that's better in every way, and default on all platforms that people use.

In the case of Facebook, it's a chicken-and-egg problem: many people that I know will not use another social media platform because nobody else that they know uses it, but nobody else that they know uses it because they don't use it.

<comment><USER17> It's worth remembering how Facebook got to the userbase that it currently has -- they didn't start out targeting "everyone on the planet", which is an almost impossibly hard challenge because of the network effects you note.

Instead, they started off providing closed social networks for existing groups of users -- colleges, starting with a small number of elite colleges and slowly broadening out from there -- until eventually it became a public social network and the de facto standard at least within the US.

The networks that have attempted from the start to get everyone to sign up have mostly failed. E.g. Google Plus, which had some feature advantages over FB at the time, started out much too ambitiously in my opinion and suffered from a "Potemkin village" issue where (unless you had a circle of friends who all joined it) it felt empty, and I suspect many users never used it more than a few times.

The only recent network I've seen to go the Facebook route is Nextdoor, which at least in my anecdotal experience seems to be becoming a thing. By providing a semi-closed social network based on physical proximity (neighborhoods), it provides immediate value to a new user. I'm not sure of the details of their rollout strategy, but at least at one point they insisted on mailing you a physical postcard in order to verify your address (much like FB's original validation on specific .edu email domains).

Anyway, if anyone out there is thinking of challenging Facebook on the social- network front, I would put some significant thought into the rollout strategy and aim _not_ to compete with Facebook circa 2017, but instead to compete with Facebook circa 2004. As other networks have opened themselves up, there's a constant vacuum at the lower, more-specific, more-exclusive, closed end of the spectrum which provides a lower barrier to entry.

<comment><USER18> I think discord has better potential to be the next social media juggernaut, I know most of my social media interaction goes through discord. As our lives move more and more online discord seems to be the digital equivalent of the roman forums and I appreciate the ability to jump into a conversation with my friends in the same way I would IRL.

Mostly I appreciate the ability to be parts of different groups, the ease with which you can join groups, and the fact that you can host your own friend group. I realize this isn't Discord's mission statement or intent but it is a position they find themselves in.

<comment><USER19> I love how, in a thread about the uncertainty of internet privacy, you're here slinging praises to a walled garden service that owns all of your chats. Another walled garden interested in collecting information and slinging adds to pay back VC funds is the last thing the internet needs and the fact that it's so successful is a better indicator than anything else that the consumer doesn't care a lick about privacy.

<comment><USER18> You can't unopen Pandora's Box, and trying to close it is a bit of a sisphyian task. Might as well enjoy the terrors of the box.

<comment><USER19> But there are better chat solutions out there. Discord is pretty awful, terrible audio quality, limited room sizes, the aforementioned privacy concerns stemming from no self hosting and lack of interoperability with other chat protocols.

When technologies like Matrix [matrix.org] exist and we've had superior dedicated voip programs (mumble et al) for decades there's nothing appealing about discord is the AoL mail of chat clients; great for people with 0 interest in technology, but, why.

<comment><USER18> Free, browser based, integrated well with games, widespread.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> One resource I haven't seen mentioned on HN much: Michael Bazzell is an expert on both sides of internet privacy.

[https://privacy-training.com/](https://privacy-training.com/) vs. [https://inteltechniques.com/](https://inteltechniques.com/)

"Hiding from the Internet" vs. "Open Source Intelligence Techniques"

[https://www.amazon.com/Michael- Bazzell/e/B007GNUI92/](https://www.amazon.com/Michael-Bazzell/e/B007GNUI92/)

"The Complete Privacy & Security Podcast" (42 episodes so far)

[https://inteltechniques.com/podcast.html](https://inteltechniques.com/podcast.html)

<comment><USER21> Definitely interested in that podcast, but I must say I find it ironic that they're running JS from Google Analytics and Scorecard Research. :D

</comment></comment><comment><USER22> I'm already extremely pessimistic about these things.

Computers were a mistake and represent the greatest threat to freedom in human history. The ability of those in power to mass produce perfectly obedient machines that can perform complex tasks without rest allow for a nightmare society. Additionally machine learning asymmetrically benefits those with the resources to fully leverage large amounts of data collection and compute power AKA not you or me.

Any state in history would have loved to have been able to watch its citizens at all times and know what they're doing and likely thinking. It just wasn't feasible until now. The big last line we haven't but will inevitably crossed will be the automation of force.

At least suicide is always an option.

<comment><USER23> > Computers were a mistake and represent the greatest threat to freedom in > human history. The ability of those in power to mass produce perfectly > obedient machines that can perform complex tasks without rest allow for a > nightmare society.

I think about that a lot. It suggests to me that the real problem lies not with technology, but with something unavoidable and self-destructive about human nature.

<comment><USER24> > It suggests to me that the real problem lies not with technology, but with > something unavoidable and self-destructive about human nature.

Or the people in power not being fully clear about their means.

<comment> crush-n-spread Look at the root cause. Humans are driven by the exact forces that caused evolution. Those forces are to gather resources and maintain social dominance. Anything other than that will never be a force that shapes the world.

"Not being fully clear about their means" is just a manifestation or symptom of someone's quest to acquire more resources. I repeat that you must look at the root force and not the symptom.

</comment></comment></comment></comment><comment><USER25> "Snowden's revelations made people aware of what was happening, but little changed as a result."

Actually I'd be willing to bet the level of spying the alphabet agencies are doing now is 10 times worse than it was when Snowden stole those documents.

</comment><comment> rm_-rf_slash I once asked Bruce Schneier at a conference to scare me.

He told me to consider the associations between data. Bits and pieces that Google knows about me, that Facebook knows about me, that Amazon knows about me...think of all of those little meaningless bits of data being associated all together to build a picture perfect model of my life, and then sold to advertisers, who know enough about your life to attempt to manipulate it at every step. And if advertisers can pull up every saleable bit of data about me with enough accuracy to sell me products that I actually want, then anyone with enough money and desire can get that same data, use the same associations, and understand more about me than most of my closest friends, all before taking one step away from the computer.

I'm still afraid.

<comment><USER17> I am honestly surprised there is not more ultra-targeted advertising to either ultra-high-net-worth individuals, or to individuals in key positions within large institutions.

E.g., there are ads all over the DC Metro for huge defense-sector projects, like a particular company's bid for fighter-jet engines. They're spending huge sums on these ad buys, which presumably are aimed at only a handful of people who actually have influence over the procurement process. Similarly, there are lots of ads in trade publications aimed at buyers, of whom there might only be a few dozen in a particular niche industry. It only follows that this is, the ad-buyers believe, the best they can do.

But consider what they could do if they really drilled down and tried to target the specific individuals with control over the money: instead of a shotgun ad buy in the subway or in a magazine, they could build a model of that person's life -- where they go, what they buy, what makes them happy (at least, happy enough to be externally perceptible), what pisses them off enough to complain about it, etc. And then you could Skinner-box the living shit out of them.

In the limiting case -- I'm thinking here of someone who works in government procurement; maybe not even the person who makes the ultimate decision, but the person who builds the briefing slide deck for the person who makes the decision, or the advisor, or the advisor's assistants -- for the price of a big ad buy, you could probably hire up a bunch of unemployed acting students and follow them around for a few months. Every time something good happens to the contract or in negotiations, make sure they have a really, really good day. Someone offers them a seat on the train, or lets them into traffic, anonymously buys them coffee, randomly compliments their shoes, pulls out of a parking space just as they're looking for one... every little thing just goes right. And every time the negotiations _aren 't_ going well, make sure they have a really _shit_ day. They get cut off in traffic, get coffee spilled on them, yelling everywhere, can't even get the machine they want at the gym, takeout place is closed for a special event, rental house down the street is having a loud all-night party _again_... Pretty soon you'd condition them that when things go right for your company, and when things move fractionally closer to the outcome you want, they have a good day. And when they don't, _they_ don't. It's advertising by gaslighting, basically.

AFAICT the only reason this isn't done is because nobody's really tried it yet, perhaps out of some remaining shred of propriety. I'm not even sure it would be illegal, necessarily (you'd have to get some lawyers to work around anti-stalking laws, I suppose, but they are pretty weak in a lot of states). While there's nothing that would have prevented you from doing this 50 years ago with an army of P.I.s to gather the information, now you could build up all the dossiers in advance and have them ready to go, pretty much turnkey, on anyone you thought you might want to influence. Or, more likely, a company could set all of that up and then offer it as an arms-length service to other companies looking to achieve a particular outcome.

No reason, I suppose, why it might not be going on right now.

<comment> rm_-rf_slash Interesting premise. Could even be the plot of a present day sci-fi novel (an executive goes about their day of seemingly random inconveniences amidst a high-stakes battle between advertising firms directing the exec towards their clients). Almost reminds me of The Game, which was the greatest film ever made and I will hear NO argument.

That being said, most of the wealthy people I know personally tend not to use computers when they can call up concierge services to handle complex tasks for them. That most wealthy people I know happen to be older and not as used to using computers for every problem may just be more of an age rather than economic dissonance.

</comment></comment></comment><comment><USER26> One point that I think comes too short in every discussion on privacy is that you are not always in control of your data and you never can be fully.

Say we consider a privacy-paranoid individual who is taking great care not to put his personal data online. And then we take a look at his or her parents or friends or colleagues who most certainly will keep his or her real name bundled with phone number(s) and (e-mail) address(es) in their address book synced to their Google or Apple or Microsoft account. It just happens, there is only so much you can do about it. Your data is out there and it's only the question of the security measures the data holder implemented that's keeping it safe.

(Basically, it's nothing new, many people have your data, but possibly only in the "offline world" \-- think insurance, prospective or current employers, even your go-to car repair guy. It's just that we normally have a law for protecting the offline data and ways to enforce it and almost nothing alike in the online world.)

Privacy is something that has to be enforced on a population, and not simply recommended to an individual. The only institution that can reasonably do that is the government, by introducing data protection laws, abiding by them and allowing a third-party to verify they really keep their promise. Until then, we might not have a choice.

</comment><comment><USER27> They caught me at line 1 with a curious thought:

>and have grudgingly accepted that being monitored by corporations and even governments is just a fact of modern life.

I wonder which is the more "shocking" or "surprising" that society deems it acceptable - monitoring by corporations, or monitoring by governments?

<comment><USER28> Just because people have accepted something doesn't mean they deem it "acceptable".

When your choices are "use a service and be monitored" or "don't use the service", it can be quite limiting if you really need that service to, say, do your job and feed your family. Yes I know there are alternative services, but often they either 1) don't work well enough to really be a viable alternative and/or 2) don't provide any more confidence that they are not monitoring you also.

Of course all of this is made worse by the fact that the monitoring is mostly happening in the background, so it isn't "in your face" all of the time. I think most people who are aware of it have chosen to just ignore it as best they can, because there doesn't appear to be any practical way of avoiding it.

<comment><USER29> > _Just because people have accepted something doesn 't mean they deem it > "acceptable"._

Actually, that is exactly, literally what it means. Perhaps you mean that just because we find something acceptable, we don't deem it moral, or optimal, or desirable. The distressing reality presented in the interview is that we accept non-benevolent, non-ideal options because they are good enough to be accepted, and not bad enough to be rejected. But accepting something, by definition, means you consider it accept-able, or, "able to be accepted."

<comment><USER28> Yeah I knew someone would come back with that -- but that's only true if you tie a very strict one-to-one meaning between every use of the verb "accept" and the adjective "acceptable".

Words have subtle meanings. If you paid attention to my post, I was clearly drawing a line between the fact that people _accept_ the fact that they really don't have a good alternative to using, say, Google. But they may not find it _acceptable_ that Google data mines their searches to sell their info to advertisers.

So while they "accept" their situation, they clearly don't find it "acceptable". Much as you might accept the fact that you have to work for a boss who is a jerk, because you have no other employment options. So you don't find the situation acceptable, but you have to accept it anyway.

<comment><USER30> I don't think people in an unacceptable situation 'accept' it. With your example of unacceptable workplaces, they express their resentment in other ways. Maybe they find the minimum they can produce without being disciplined and only do that much. Maybe they spread malicious gossip at the office. Maybe they go home and abuse their spouse or children. Maybe they become alcoholics, or political extremists, or religious fanatics. Maybe they become depressed and commit suicide. The world offers plenty of examples. People trapped in situations they find unacceptable don't suffer in silence; they become pathological, dangerous people.

The issues of unacceptable mass surveillance can and will, eventually, cause some kind of response by people who don't accept it. If there are a lot of those people, I doubt the response will be pretty.

<comment><USER28> Here again is another example of the subtlety of words. The fact that someone "accepts" a situation doesn't automatically mean that they are happy about it, and it also doesn't mean that they do nothing to change it. It can just mean that they realize that is the way it is for now, and they deal with it as best they can -- often while looking for ways to change the situation.

Also, while it is true that people do often respond to unacceptable situations in extreme ways, it is most definitely not the case that people _always_ do so. There is a such thing as patience and perseverance, and people do often accept that they are in an unacceptable situation for a time (often a very long time), while actively seeking to change the situation. People can overcome adversity.

The phrase "People trapped in situations they find unacceptable don't suffer in silence; they become pathological, dangerous people." is most definitely not universally true. It does happen yes, but many people also just press on and keep looking for a way out until they find it.

And yes, some of them _do_ suffer in silence without becoming "pathological, dangerous people". One common example is a case where an unacceptable situation permits them to achieve something that is more important to them. For instance, people work some pretty nasty jobs (either due to jerk employers/employees, or just the necessary work conditions of the job -- some jobs are hot/smelly/hard-on-the-body, etc). But there are people who take and/or keep these kind of jobs in order to feed their families. Often they have tried to find other work, but lack the necessary skills, or there just isn't any other work available. So these people work under these conditions only because that's the only route to feeding their families. It is an admirable thing to do, and I find it sad that so many people don't respect others who make that kind of sacrifice in order to take care of others.

</comment></comment></comment></comment></comment></comment><comment><USER31> When I place a sticker over my laptop's camera, people think I am freak or acting like a hacker. In fact, I just want to protect my freedom. However, society doesn't care freedom. They care just their popularity and don't want to be alienated. I think this is where problems come from.

<comment><USER32> I could wear a tinfoil hat and claim I was protecting my freedom. That doesn't make it a great idea.

Of course nobody wants to be alienated. We do a lot of stupid shit to fit into society. But with the range of potential attacks on your freedom, putting a post-it note on your webcam is right up there with tinfoil hats.

There are real actions you could be taking to defend your freedom - <USER3> contacting your representatives in government, or donating to organizations that fight for your rights, or telling your friends and family why they should care. You can vote with your dollars, and vote with your actual vote, and your feedback.

After all that's done, fine, put up the post-it note. But you can at least write "remember to get milk" on it so people don't assume it's a tinfoil hat.

<comment><USER33> I wouldn't call it "tinfoil hat" because the cost/benefit is extremely low. Negligible effort in exchange for piece of mind. It's a reasonable trade-off. You can never be sure what all your software is doing unless you piece together your own linux system from scratch.

<comment><USER32> That's what a tinfoil hat is. Nobody wants to watch your particular webcam, just like the government does not want to influence your particular brain. But people put on the tinfoil hat anyway because it's cheap and it gives them piece of mind.

You could also just implement strong security guarantees according to best practice for your OS, but the piece of paper is definitely much cheaper and more effective for this one purpose.

<comment><USER33> I believe "tinfoil hat" implies illogic as well. Reasonable trade-offs aren't illogical. Also, it's been proven that it's entirely inside the realm of possibility that state agents are infiltrating our systems and gathering sensor data, and it's far more likely than alien mind probes that can be thwarted with tinfoil...

</comment></comment></comment></comment></comment><comment><USER34> When a company includes in their TOS a clause that prohibits their customer to speak online negatively about their product, everyone draw the pitchforks because that's an unacceptable violation of the freedom of speech. Why doesn't it happen for the right to privacy?

Perhaps people feel powerless or don't care. People are also powerless against the food industry or don't always care about security. One of the roles of states and governments is to fix those situations.

Law makers should focus their efforts on strongly protecting the fundamental right to privacy. It should be made easy (and free) for anyone to challenge those abusive EULAs, TOS and other contracts that require end users to abandon their rights in order to use a service. If the contract is deemed abusive, the service should be blocked until the contract is rewritten.

</comment><comment><USER32> > In the 1970s, Congress passed a law to make a particular form of subliminal > advertising illegal because it was believed to be morally wrong. That > advertising technique is child's play compared to the kind of personalized > manipulation that companies do today. The legal question is whether this > kind of cyber-manipulation is an unfair and deceptive business practice, > and, if so, can the Federal Trade Commission step in and prohibit a lot of > these practices.

Three things here:

1\. Nobody has ever proved subliminal messaging can actually subvert a person's will, which was reflected in court cases. Even a modern experiment set up by the BBC (apparently the only such study since the 50's) showed no effect.

2\. The FTC has never said anything about subliminal messaging, so it's unlikely they would now.

3\. Subliminal messaging never helped pay for users' free services.

Let's face it - we live in a different world. The old ideas of privacy, whatever they were, are erased when there's a carrot attached to it, and no stick. Schneider is doing a great deed in trying to drum up support for increased privacy regulations, but this is a stupid argument toward that end.

</comment><comment><USER35> I'm dejected by two things - that privacy invasions are increasing over time and that there's barely any outrage (or outrage that lasts) against these. I feel more and more trapped when I see that most people I know don't care about privacy on the Internet or Internet based services. I point them to how it could be bad for them (including Martin Fowler's excellent article, "Privacy protects bothersome people" [1]), but it all falls on deaf ears. Or they shrug their shoulders in defeat saying it's a lost cause and that it's better not even to think about it.

I'm truly stumped, and can't imagine what tragic event or events will wake people up and get them to take action at a personal level, along with organizing and campaigning for privacy. As of now, I doubt if there will ever be a mass resistance for several decades (leaving the gates wide open for more invasions and power grabs).

[1]: [https://www.martinfowler.com/articles/bothersome- privacy.htm...](https://www.martinfowler.com/articles/bothersome-privacy.html)

</comment><comment><USER36> I think there's something to be said about looking at the business incentives of the people you deal with on the Internet. Google, plain as day, is using you as training data. DuckDuckGo bills itself as the privacy-minded alternative. You shouldn't be surprised if Google violates your privacy. If DuckDuckGo does, that's the end of their business model.

</comment><comment><USER37> Only thing people should fear are the downside risks of submitting themselves and becoming reliant upon walled gardens, people in mass only give such their power… perhaps most have decided that the convenience of such gardens are worth it for now.

The mass surveillance/advertising state runs on abundant and prevalent hardware and software full of flaws that can be used in favor for those who seek to exploit such, from nation states, to well financed actors, to individuals.

The common man has less to loose, than an general's affair with his aid conducted over gmail… and hey, when you are a relative nobody in a society, whats sitting on a couple of iOS 0days from your dev exp, waiting for a better day? I guess succumbing to fear porn from our best institutions is an option…

</comment><comment><USER38> "Internet privacy" is an oxymoron.

I've come to believe that total surveillance is the perfection of democracy, not its antithesis.

We are experiencing a fundamental phase shift in the entire structure of society.

The true horror of technological omniscience is that it shall force us for once to live according to our own rules. For the first time in history we shall have to do without hypocrisy and privilege. The new equilibrium will not involve tilting at the windmills of ubiquitous sensors and processing power but rather learning what explicit rules we can actually live by, finding, in effect, the real shape of human society.

</comment><comment><USER39> Internet privacy is a farce. From the way the technology was designed to the way the information that's collected is used/misused. I do think there are equal parts buyer beware on the client side as well as ethics on the implementation side.

I think that "internet privacy" will be akin to "the war on drugs" in the long term. A good idea but in the end just another way for government line it's pockets.

Until the internet is completely redesigned the best hope we've got it encryption and VPN's and that's a strech.

</comment><comment><USER40> > My hope is that technologists also get involved in the political process — > in government, in think-tanks, universities, and so on.

How does one do this? What might Bruce Schneier be thinking of that the EFF, Liberty, Privacy International, etc... are currently not doing?

In some sense, it seems like this might be solved "generationally", once the majority of elected representatives are "natively" computer-literate. Based on the average age of politicians, that might take 30-40 years.

</comment><comment><USER41> Google, for instance, has a ton of data about me. They don't sell that data directly to advertisers, because if they give up that data then it loses all value to Google because the advertisers would then be able to resell it. So instead they let advertisers target specific demographics of people, leveraging what they know about me. As long as I use an adblocker and individual information isn't sold to insurers for example, what's the harm to me?

<comment><USER35> Democracy and freedom, in general, depend on people who fight against the powers of the time from trampling rights and controlling people through different means. So even if you're somehow not troubled by anyone who has or can obtain more (aka damaging) information to use against you, there are many people who struggle all the time so your life can be better (and not get worse). And for those people, corporations that collect a lot of data, who are in turn answerable to government requests (like NSLs in the U.S.), are landmines that could trip any moment and endanger them and everyone else they work with. Society has a lot to lose if we don't value privacy, because privacy is fundamental to have and to retain freedom in the constant struggle that we have with various entities.

So if you care about freedom for humans, you must care about privacy. Otherwise it'd be hypocritical.

For a better and concise article on this, read "Privacy protects bothersome people" [1] by Martin Fowler.

[1]: [https://www.martinfowler.com/articles/bothersome- privacy.htm...](https://www.martinfowler.com/articles/bothersome-privacy.html)

</comment></comment><comment><USER42> Check this out. [https://stallman.org/stallman- computing.html](https://stallman.org/stallman-computing.html)

</comment><comment><USER43> Consider lobbying your government officials to improve regulations concerning this. Maybe get together with other people in your city who care about this particular issue.

This needs to be changed at a _regulatory_ national level, but it's usually the case that major cities or states lead the charge in the US.

The system _can_ be made to work for you, if you're willing to work with it.

</comment><comment><USER44> I've gone down the rabbit hole of trying to protect my privacy. Basically, unless you move to the mountains with no cell phone, no internet access, and grow your own food, someone somewhere will be tracking you. You'll go crazy trying to close all the loopholes (ready to fry the RFID chips on your car tires?)

</comment><comment><USER45> The problem is, many people know how much they're being monitored each day, and simply don't care.

</comment><comment><USER46> Really enjoyed William Hertling's Kill Process on this very subject.

[https://www.goodreads.com/book/show/30658546-kill- process](https://www.goodreads.com/book/show/30658546-kill-process)

</comment><comment><USER47> We're all screwed. But at least we're all screwed together!

<comment><USER48> And there's a great many HN users/readers who've been happy to write the code that is totally f-ing us over.

</comment></comment><comment><USER49> What internet privacy?

I seemed to have it a dozen years ago, but I must have misplaced it because I haven't seen it in a long, long time.

</comment><comment><USER50> What does a post-privacy world look like?

<comment><USER51> Roll up the shades.

<comment><USER50> Maybe fear isn't the right reaction. We have almost no privacy, and the world isn't ending. Many of us goto work or school, just as before we were so heavily surveiled.

Also, who makes money off us being afraid of not having privacy?

<comment><USER52> The already linked Panopticon shows that a lack of privacy can lead to severe mental problems.

The Stasi subdued an entire country via surveillance and that before the internet, before CCTV and before everyone voluntarily carried a microphone in their pocket.

<comment><USER51> Watching The Lives of Others (Das Leben der Anderen) had a profound impact on me. I was aware of ECHELON, Carnivore, DCS, Wm. Binney, etc. before Snowden, but since Snowden/Greenwald, it really became visceral. It's been a rough ride for me, and many people I know.

</comment></comment></comment></comment></comment><comment><USER53> No one I know in my world uses Facebook and we only use Google for search because the experience with other engines are lackluster. Give me a better search engine and I'll use that if the obvious abuses aren't too egregious.

There is another way to opt out of data collection and that is to deep packet rewrite every communication out of your computer from every application (where suddenly encryption is your enemy) :P

<comment><USER54> Use www.startpage.com, you search Google via a proxy.

</comment></comment><comment><USER55> There is no such thing as privacy anymore. Even the encrypted communication is not private as far as i know.

</comment><comment><USER56> a Basket of Figs and a Letter, did by the way eat up a great part of his Carriage, conveying the remainder unto the Perfon to whom he was di- rected, who when he had read the Letter, and not finding the quantity of Figs anfwerable to what was there fpoken of, he accufes the Slave of eating them, telling him what the Letter faid againft him. But the In- dian (notwithftanding this proof) did confidently abjure the Fa&, curling the Paper, as being a falfe and lying Witnefs. After this, being lent again with the like Carriage, and a Letter expreffing the juft number of Figs that were to be delivered, he did again, according to his former Pra- ctice, devour a great part of them by the way.

<comment><USER57> Censorship is a valid concern, but I'm not sure what it has to do with on-line privacy.

</comment></comment><comment><USER58> Can someone explain to me why this so-called "privacy" is such a big deal on internet? Can't internet, or at least a major part of it, be considered a public place? I mean, when I walk in the street, I do not wear a mask (I suspect that'd be illegal in my country), yet I do not worry about someone using surveillance cameras to track all my activities. Sure, it _could_ technically be done but I'm not _that_ important : nobody would bother. Therefore I vaguely consider myself anonymous when I walk in the street, not because my identity is hidden, but because it's mixed in thousands of others : "hidden in plain sight", as they say.

Couldn't things be similar on internet? Or do we really all have to hide our identity like criminals?

<comment><USER59> ok go ahead and publish all your email, chat messages and bank account details here now

<comment><USER58> Continuing with my analogy that would be like shouting my name and address in the street. Why would I do that?

My point is that I tend to consider myself as anonymous on the internet because I believe nobody is interested enough in me to bother gathering the data. Or if it's done, it's a robot that does it for statistical purpose[1]. No human cares.

But if I publish personal infos in plain text, like email, phone number and stuff, surely there will be trolls that will have fun with it, or thieves that will try to use it for profit. I have zero reason to do that.

1\. BTW I believe this has tremendous scientific value, from an anthropological point of view. It'd be a shame not to do it.

<comment><USER60> So you don't think it is a big deal because you believe your private data is not important.

The issue is that perhaps your data is not as important right now, but it is possible that one day you might do something that might upset someone in the power and any information about you might be used against you (and that would be years and years of your past since that data wouldn't be gone).

Just look at Snowden, how they tried to use every petty detail about him. He was careful though and did not leave much, but there were strong forces trying to discredit him.

Maybe you think you would never did anything like what Snowden did, but what's considered bad depends on what current administration thinks. With our current president it feels like insulting him on twitter might be good enough cause.

Second issue is that Big Data done on you, it can infer a lot about you based on the data that you provided, often it can know more about you than yourself.

That data then can be used against you, here's one example of a company that does this and in fact not only tries to learn about people but actually influence them[1]. It's suspected that they are behind Bexit and Trump victory.

[1] [https://motherboard.vice.com/en_us/article/mg9vvn/how-our- li...](https://motherboard.vice.com/en_us/article/mg9vvn/how-our-likes-helped- trump-win)</comment></comment></comment></comment>


What makes Lisp macros so special? - <AUTHOR> https://stackoverflow.com/questions/267862/what-makes-lisp-macros-so-special <comment><USER2> In Lisp macros you have access to the Lisp language... Which means Lisp macros are insanely powerful.

Code is data.</comment>


Ask HN: Should I believe the results of our A/B testing? - <AUTHOR>

Over the last few weeks our little app got written up on some blogs around the web.  It boosted our traffic levels significantly for around a week and the conversion rates from the referring blogs were extremely high.  I'm attributing the high conversion rates to the fact that after someone read a review about our app, they wanted to come to our site and try it.  So before they even became a 'user' the conversion was already there, just waiting to be registered.
So lets say we had 100 users reading one of our mentions on a blog that click through to our site to give the app a try...Does the download button or headline of the landing page (which we are A/B testing) really matter that much at this point? These users had a pretty clear goal of trying our app. The conversion rates from these visitors were around 75-85% across about 10 blogs (about 4,000 visitors in total). The app has no registration or credit card required barriers.  The only requirement is that the user needs to have Firefox (which all of the blogs clearly mentioned before sending the users).
So should I be making judgment calls about the most effective headline or the color of the download button?  Or should I just throw away this data and look at other traffic sources before making the decision of which headline to set as the next control? <comment><USER2> So you're saying the sale was basically yours to lose? I would think that if the results of your tests say it was significant (assuming you ran them correctly), then it probably was. If you have data, then you should use it to your advantage. What exactly makes you not trust it?

It sounds like the question you mean to be asking is more like: Do I have bigger fish to fry than playing with the color of the buttons on the site?</comment>


Ask HN: Entrepreneurs, how is your sex life while running a startup - <AUTHOR> Understanding that a good personal space and sex life is important for our mental health. What is the situation among the startup entrepreneurs? <comment><USER2> Amazing actually.

I got laid way more being a broke entrepreneur (or the best: being in massive debt) than when I was a wage slave.

Anything that boosts your "aliveness", like being on the edge of survival and success, controlling your own destiny, etc, makes you more attractive to women. Women love novelty, let me tell you. They also love leaders, and potential.

<comment><USER3> Wow, just about everything in this comment is ridiculously demeaning.

</comment></comment><comment><USER4> As someone who is working 70 hours a week and whose girlfriend just broke up with him because she wants to settle down, it's non-existent currently compared to every day before.

<comment><USER5> Pro tip: Don't work 70 hours a week. Beyond the impact on your social life, it also makes you a less effective worker ([http://www.igda.org/?page=crunchsixlessons](http://www.igda.org/?page=crunchsixlessons)), so it's really not good for _anything_.

Seriously. Don't do this.

<comment><USER6> Any decent startup tries to build a product faster than a Google team could. Sometimes your main advantage over a ten man elite team is the willingness to work harder.

<comment><USER7> At least one person from that elite team would also be pulling 70 hour work weeks at google. That means 10 hours a day, google serves free lunch on weekends too, albeit with less opulence.

Work life balance in a startup is an exception, not the norm. The tech industry is simply too competitive for any slack.</comment></comment></comment></comment>


Show HN: 140 Stories – Authorless Collaborative stories 140 characters at a time - <AUTHOR> https://140stori.es/ <comment><AUTHOR> Submit your story and send the link to your friends! They can continue writing it.</comment>


Managing Engineers: Perfecting the "Stay Interview" - <AUTHOR> https://medium.com/@bradvogel/how-to-perfect-the-stay-interview-8fa1ebbda907

<comment><USER2> Or to sum up: show real interest in their well-being and their career plans. It's that simple.</comment>


Couchsurfing Privacy Issues - <AUTHOR> http://www.shakedos.com/couchsurfing-privacy-issues

<comment><USER2> You might want to tweet this to their VP of Engineering - [https://twitter.com/ngn33r](https://twitter.com/ngn33r)</comment>


Trump-Ukraine Impeachment Inquiry Report - <AUTHOR> https://intelligence.house.gov/report/ <comment><USER2> They couldnt even refrain from prtisain name calling in the document. What a farce. While I am sure the POTUS has done some impeachable things, this does not look like the methphorical smoking gun it is being hailed as. I honestly fear this is just going to make it more difficult to bring the hammer down in the future when the sitution is indeed dire. Democrats, you had it in the bag, but this will temper the election results. I will not vote for those who choose to posture and prostitute their time for image and money, rather than spend it working on the real and pressing issues of the nation.</comment>


Ask HN: Multiple Monitors vs. One Big Screen - <AUTHOR> I've always bought 27" iMacs (or used 27" or larger external displays on GNU/Linux boxes) but I see setups with two side-by-side monitors (or every three) everywhere. What are the pros & cons? Don't the bezels drive you nuts? Does anyone use a vertically oriented monitor? (Portrait mode). (Side note: remember that CRT monitor from the 1990s for use with the original Mac that you could rotate to landscape or portrait mode?) <comment><USER2> How about both? The QM49F and there is a Dell version,P4317Q, which works well also. You can have multiple (up to 4 inputs) and 1 big screen. It works for me. I also have another monitor connected so I can look at code vertically, best of both worlds. See the other thread [https://news.ycombinator.com/item?id=19540939](https://news.ycombinator.com/item?id=19540939)

<comment><USER3> Agreed, one large 4k monitor is the way to go for me as well.

As I posted in that other thread... When working, I typically split it into thirds (so mostly portrait mode for each application). And this is the key advantage for me:

With multiple monitors, you're confined into smaller, "hard-coded" boxes that can't be changed. With a single large screen you have much more flexibility.

</comment></comment><comment><USER4> At work, I use a 27" 4k display front-and-center with a 15" MBP on the side (makes Slack less noticeable).

At home, I've been using a 28" 4k display with sometimes a laptop display on the side (other times just a desktop driving the display).

As an experiment, I just ordered an LG 43UD79-B (43" IPS monitor) to replace my 28" and also serve as my entertainment. Previously I had a 32" TV and a 50" in another room. I got a lot of good feedback[0]. I'll try mostly just using the middle of the screen with a window manager that makes it easy to do.

[0] [https://news.ycombinator.com/item?id=19540939](https://news.ycombinator.com/item?id=19540939)

</comment><comment><USER5> I have always had 2 monitors. At work I use 3. You can get the same effect with a BIG monitor and knowing the keys to manipulate the window frames.

Psychologically, it is common to 'Max' the window. With one big monitor it becomes an issue. But like I said above it is more of a management issue.

If you can sub your screen into 4, not overlapped windows, without much work, then one big one can work.

The bezels do not bother me, usually because I usually do not have a window spanning 2 monitors.

I have set up a monitor vertical. Typically when doing 'new' code, or writing a document. Not so much when debugging or editing. And it is usually just one of the monitors. Other(s) are set normally.

</comment><comment><USER6> IMO the physical separation of multiple monitors helps with cognitive load. Work GREAT when you need to look at some kind of references often. You don't need to think about window switching at all, you _just_ know what you need is there, ready for you to glance at anytime. Also work great with program that consists of multiple panels e.g. After Effects/Premiere Pro.

You can do that with one big screen and a good window manager, but the effect may not be the same.

One extra monitor is good enough for most people, but to each his own. The downside is of course, it's not the most minimal setup. But when you're in the zone, you don't care about the aesthetic anyway.

</comment><comment><USER7> I use three 4K monitors. The middle one is portrait mode, which is great for writing code and preferable for reading articles/documents, which accounts for 90%+ of what I do every day. The two monitors on either side are landscape mode and I use them for displaying the UI of apps I'm working on, Inspect & other Chrome developer tools, API docs, etc. The middle monitor runs at 1080*1920 resolution (because I'm old and that's the best combination of comfort and crisp text for my eyes) while the two side ones are 2560x1440.

The bezels are completely irrelevant; I never notice them at all.

</comment><comment><USER8> I definitely like 1 big monitor. My company recently went from 2 27" inchers at each desk to 1 34" curved monitor. I like the 34" much better, since there aren't bezels anymore!

</comment><comment><USER9> More than one external monitor is overkill. Might be useful just for gaming (racing sims, perhaps).

I use two setups:

Work setup: 13" laptop and 24" monitor in portrait. External monitor displays only tmux in full screen.

Home setup: 15" laptop and 29" monitor in landscape. The monitor is the de facto main screen, I only use the laptop one for recording or browsing while gaming.

I'm intrigued by super wide monitors. My desk currently doesn't fit one though.

<comment><USER10> I have a ultra-wide screen and I sort of regret buying it. I think it messes up my sleeping pattern. Artificial light flooding one's entire field of visual probably ain't healthy in the evening hours.

</comment></comment><comment> d-sc It's mostly personal preference.

I prefer two identical monitors next to each other which works well for multitasking with two different applications, eg IDE + safari. In this setup, the bezels help separate the contexts for each application. However two monitors don't work as well for one single application spanning between them, eg giant Minecraft.

</comment><comment><USER11> I think it's always better to have just one big screen.

Using multiple monitors come as a merit when someone needs to have multiple windows displayed at all times.

I think one way you can make this by using a single screen is to use a tiling windows manager.

</comment><comment><USER12> I use a 43" 4k TV as my second screen. Once I tried large format 4k, never went back. Amazing how much more code you can see at once.

<comment><USER13> How is the big TV as a monitor? do you keep it on your desk or further behind?</comment></comment>


A Tiny Minority of Elite Grad Schools Produce Most Tenured Academics - <AUTHOR> http://www.slate.com/articles/life/education/2015/02/university_hiring_if_you_didn_t_get_your_ph_d_at_an_elite_university_good.single.html <comment><USER2> The tenure system really needs to go. The idea was to set up a system where it would be difficult to stifle dissent.

But the _structure_ of the system guarantees over time there won't be any dissent to stifle, because tenure committees don't allow anyone who isn't like everyone else into the clubhouse.

<comment><USER3> When I was in graduate school, I was somewhat involved in the process of hiring a few professors. Whoever we would have hired was probably going to get tenure and remain in the department for decades. Intangible personal and interpersonal aspects of the candidates were therefore about as important as the quality of their research, because nobody wants to be stuck working for 20 years with someone they don't feel comfortable with. Naturally, this has a tendency to perpetuate the gender and race imbalances in academia.

<comment><USER2> Gender and race imbalances are much less important to me than ideological imbalances. What's the point of having different sexes and skin colors if they're all part of an echo chamber?

<comment><USER4> What fields do you find having an academic "echo chamber"?

<comment><USER5> I've seen it in theoretical physics as well. There are 'schools of thought', for example at my alma mater most of the professors doing theoretical particle physics are phenomenologists and tend to regard people doing say string theory as cranks.

This means it's very hard for those people to get hired, and there is also the effect of them not wanting to apply to a university that doesn't have a strong tradition or a strong group in their subfield.

</comment></comment></comment></comment></comment><comment><USER3> As a former grad student, I am not at all surprised by this. Academia is a very personality-driven world where prestige, connections, and social capital matter at least as much as the quality of one's work. The prestige, influence, and connections of one's department and dissertation advisor make a huge difference, and the most prestigious advisors tend to work at the most prestigious universities.

In a job market with so few openings, especially in the humanities, this clearly has a distorting effect. I suspect that if the job market were not so bad, the effects described in this study would be reduced.

<comment><USER6> Just want to point out that the job market is not neccisarily 'bad'. There was a huge period of growth in the post WWII era as the university ecosystem expanded with the economy, continuing along later with the boomers' expectation that their children do as they did. Now we live in a post-boomer, globalized economy where the low hanging fruit has all been plucked.

That's not 'bad', more likely just the new normal.

<comment><USER3> I was referring specifically to the academic job market, which is about as bad as it has ever been. In humanities disciplines, there are hundreds more graduates than jobs every year.

<comment><USER6> I was referring to academics specifically. While I agree 'bad' isn't an unfair way to feel about the market, I would say it's because expectations have been set by boomer mentors (in their 50s and 60s) that graduated into a job market that was expanding and could absorb them.

Now we have hit equilibrium, and there isn't demand for people who study Foucault, Jung, or build a career around authors from 1850-1950 anymore. The gig is up, and graduating from anything other than a the most famous names just want get you a job anymore.

Not 'good' or 'bad', but certainly 'is', for better or worse.

</comment></comment></comment></comment><comment><USER7> I went to a low, low ranked US state school for undergrad and moreover I graduated with a bad GPA (2.9).

I'm now in industry doing a job that I enjoy, and I'm continuing to take classes at the local university.

I would like to go to back to school for a Masters and then possibly a PhD after that.

However, this article fills me with a great deal of despair. I had hoped that I could "redeem" myself by working exceptionally hard in whatever Masters program would let me in, and then possibly have a shot at a more prestigious program.

Now knowing that both Silicon Valley and higher ed will laugh me out of the room if I don't come from some name brand university is a sad thought.

I think that I care enough about the subject matter itself to try for a Masters but it's sad nonetheless to know that basically no matter how hard I work, or how good my work is, that I'm forever locked out of certain circles.

<comment><USER8> The article only talks about where tenured professors get their phds. If your goal is a phd, but not a tenured academic position, you may well be fine.

That said... my experience is the coursework at top universities is significantly harder than at poorer universities. When I look at what math is required for eg an MS at various okay universities such as SJSU or SFSU, it seems to be about equivalent to the undergrad at my top 15 university.

Interviewing lots of engineers and ML people has also turned me into much more of a school snob than I used to be. My experience has been that graduates of top10 ML schools know the material cold, but graduates of, say, a school ranked 50-30th can produce PhDs in stats that struggle to explain a linear regression. Which should be very easy.

<comment><USER7> Having watched MIT and Stanford lectures online, I was quite taken by the level of depth that is expected, so I understand your comment regarding that.

That's the beauty of those online courses, I suppose. I now know exactly what is required at Stanford and MIT.

</comment></comment></comment><comment><USER9> This really isn't that surprising. It could also be explained largely by self selection. If one believes that top schools by prestige also attract the top students, and that these schools are reasonable efficient at selecting among these applicants we'd expect a strongly one sided distribution of talent.

If the top 10 institutions have the vast majority of the top 1% of grad students, I'd expect they produce the vast majority of professors.

<comment><USER10> There's also something else at play that isn't just "cream rises."

If you're a top student who chose a slightly suboptimal grad school for personal reasons (to be near a significant other, taking care of a family member, already have a house somewhere, etc.), you may not realize that the game became cripplingly hard for you until you're near the end of your program.

The top universities often: (1) send grad students to conferences (including travel costs) whether or not they have results to present that year, (2) hire lab techs and admins, which allows grad students more time to do actual research, and (3) make it more likely that the student gets a grant proposal accepted by the NIH/NSF/other agency.

And you know, maybe you hold out hope because your advisor let you and your lab mates volunteer stuffing all the swag bags the night before a conference that happens to be in your city that year so you can go talk to all the other folks at the top of your field. Maybe you actually get a grant funded, unlike your classmates. Maybe you put in that many more hours so you can handle your share of the grunt work on top of research you'll actually get published. No weekends for five years. Do you do it? Maybe.

<comment><USER2> You might do it if you were sure you'd actually land on the tenure track and get tenure. That's far from assured, though. Seems like most people reach 35 or 40 before they're officially denied tenure, meaning you've wasted your most productive years chasing a career that's not going to happen.

</comment></comment></comment><comment><USER11> My professor told me there is a bus that goes from the Bay Area to Boston and back. It doesn't stop anywhere else.

<comment><USER12> Roadway bus or network bus? The former would be rather surprising considering the existence of both stomachs and airplanes.

<comment><USER13> It's a metaphor.

</comment></comment></comment><comment><USER14> The author states "...the data suggest that faculty hiring isn't a simple meritocracy. The top schools generate far more professors than even just slightly less prestigious schools. For example, in history, the top 10 schools produce three times as many future professors as those ranked 11 through 20."

I don't think this is adequate evidence, and my own experience is that it's very hard to compare, after all most people only went to one grad school. I know that my grad school had much better students than my undergraduate school, but it's almost impossible to quantify how much. Even hard still to compare the top 10 to 11-20. I do believe that it's possible that the top 10 schools produce 3 times more "professor tier" students. Even though application to a particular school has a lot of randomness, most students apply to 10-20 grad schools when they apply, and this removes some of the randomness.

It's actually very hard to measure the true bias towards top schools, if it exists. I don't the the "send out resumes and change the school" trick is a good approach, because most of the signal is going to be in the school. The question of whether schools adequately update their information once they have the full picture of the candidate, remains unanswered.

Also, at least in my field, schools advertise their "placement" of students in academic positions to prospective grad students. So students are well aware of the job prospects when they start grad school.

<comment><USER10> As someone who has experienced schools in both top 10 and 11-20 range, I can tell you it's a lot like the challenges faced by kids from lower socio- economic circumstances in K-12 schooling, and that the quality of the students alone are not enough to account for the differences.

The top universities often:

1\. Send grad students to conferences (including travel costs) whether or not they have results to present that year. (If you're at a slightly suboptimal school, you might only get to go if you have results to present, which you probably don't your first year. My labmates and I would volunteer and spent a day and a half stuffing swag bags and registering attendees/handing out badges for a conference so that we could get access. Students from better schools just had their tickets covered by their schools.)

2\. Hire lab techs and admins, giving grad students more time to do actual research or write papers. (Otherwise, you might spend more than 40% of your time doing work that doesn't move the needle for you, professionally. You may be picking up your professor's dry cleaning, or taking care of administrivia around getting them a visa for their next talk in another country, or booking them plane tickets.)

3\. The name of the school makes it more likely that the student gets a grant proposal accepted by the NIH/NSF/other agency, even if the quality of the grant proposal itself is the same. Getting a grant/fellowship/award on your CV makes a HUGE difference when applying to post-docs or faculty positions. (You'll also have access to more people who will give you more valuable feedback for how to write a better grant proposal.)

4\. Top schools often protect students from bureaucracy and streamline the procedures in place for everything from getting access to a new facility, to what happens when you need to replace your student ID. (See (2) above.)

5\. You're more likely to get a smarter or harder working undergraduate student to mentor and help out with your research. This matters more in the life sciences and fields with "benchwork," (e.g., wielding pipettes) but it applies to tasks that involve coding as well. In better schools, a larger percentage of undergraduates opt to get some experience in a research group, and you get both someone to delegate actual research tasks to, and you get to level-up in people-management.

Essentially, if you opted for a school in the 8-15 range for personal reasons (e.g., family, proximity to significant other, other obligations), you've opted into playing on super-hard mode, where you have to work twice as hard and be twice as good to get as far as someone who opted for the best school to which they were accepted.

And if you're female, you'll get extra pressure from family, friends, significant other, etc., to choose the school that is close to them. And there are no extra points for playing in hard mode. I definitely don't think I would have appreciated the difference if I hadn't experienced both in such a short time frame.

(Sorry for slight repetition from my comment in a thread lower down. Edited for clarity.)

</comment></comment><comment><USER15> I got my PhD at a second tier university, 20+ years ago. We had a hallway where there were pictures of the faculty with their names and where they got their degrees.

That was one of maybe two or three data points, that confirmed my decision to pursue an industry job. Another was the average age of post-docs in the department.

<comment><USER16> Was your degree in CS? Curious how thing turned out for you in industry? Did you ever teach courses on the side? Did you ever consider or dip your foot into entrepreneurship?

<comment><USER15> My degree was in physics, but my thesis project was a fairly technology intensive experiment, where I was able to develop my chops in electronics, programming, etc. I intensified my focus on those things as it became clear that an academic career was not in my stars. No regrets. I know some of the qualities of successful academics, and I don't possess them. I do enjoy being involved in making things.

And it was 20+ years ago, when there was maybe a bit more migration between physics and engineering, and not so damn many specialized tools to learn.

They say "luck is the residue of design," but I sure owe a lot to pure luck. I was graduating into a rotten job market, but got my first job through a friend-of-a-friend sort of deal. It was a small company where a jack of all trades could be of value, though the pay wasn't great. When things began looking better job-market-wise, my spouse and I moved to a new town.

I actually did teach a couple of courses as an adjunct during a brief period of unemployment. It was hard work because I was doing it for the first time. Now I'm back in industry, doing a sort of systems architect thing for a company that makes measurement equipment.

As for entrepreneurship, yes, I have a very small side-business making an electronic gadget, but it is for a very specialized and mature market, so it's not start-up material. The good thing is that I've actually learned a lot about running a small business.

The biggest, and perhaps only, barrier to me starting a start-up is that I don't have a good idea. I've racked my brain, read all of PG's essays, and so forth, and a compelling idea just hasn't assembled itself in my brain yet.

</comment></comment></comment><comment><USER17> I was surprised when I found out that there were faculty candidates from University of Washington at both Berkeley and Stanford.

This is amazing, and shows that Tier 2 schools can send students to become profs at the 'top 4'

<comment><USER18> In computer science, UW is pretty good. (In other fields, not so much.)

<comment><USER19> UW is also considered one of the best medical schools (when I was applying, their matriculant MCAT score was a standard deviation above the national matriculant average. Even Harvard couldn't make that claim).

</comment></comment></comment><comment><USER20> This could be a place for students to apply social pressure on the university they are attending. How can the university program claim to be good if they don't hire their own?

</comment><comment><USER21> The fact that this looks at grad schools rather than undergraduate schools weakens its argument substantially. Students of all capability levels end up in all sorts of undergraduate institutions -- some community college students are brilliant, but didn't have the resources to go to fancy private colleges, while some students at Ivy League colleges struggle to keep up.

The PhD programs, however, eliminate quite a bit of this variation in their own admissions. The student I know who got into Harvard but took the full ride to UCLA excelled at UCLA and had PhD programs actively recruiting her -- she had her pick of the "tiny minority" listed in this article. City College of New York has more undergraduate alumni who have won Nobel Prizes than almost any other university in the world. And since PhD programs are generally funded through fellowships, students don't have to come from wealthy families or take on large loans to attend.

My pet theory is that the top PhD programs basically execute the main selection force -- identifying the students most likely to be tenured academics from hundreds of public and private colleges nationwide -- and thus it's no surprise that there appears to be a direct pipeline between them and university faculties.

<comment><USER10> I wrote this elsewhere, but there's actually a lot else at play. And if you're female, you'll get extra pressure from family, friends, significant other, etc., to choose the school that is close to them. Essentially, if you opted for a school in the 10-20 range for personal reasons (e.g., family, proximity to significant other, other obligations), you've opted into playing on super- hard mode, where you have to work twice as hard and be twice as good to get as far as someone who opted for the best school to which they were accepted.

I definitely don't think I would have appreciated the difference if I hadn't experienced both in such a short time frame.

The top universities often:

1\. Send grad students to conferences (including travel costs) whether or not they have results to present that year. (If you're at a slightly suboptimal school, you might only get to go if you have results to present, which you probably don't your first year. My labmates and I would volunteer and spent a day and a half stuffing swag bags and registering attendees/handing out badges for a conference so that we could get access. Students from better schools just had their tickets covered by their schools.)

2\. Hire lab techs and admins, giving grad students more time to do actual research or write papers. (Otherwise, you might spend more than 40% of your time doing work that doesn't move the needle for you, professionally. You may be picking up your professor's dry cleaning, or taking care of administrivia around getting them a visa for their next talk in another country, or booking them plane tickets.)

3\. The name of the school makes it more likely that the student gets a grant proposal accepted by the NIH/NSF/other agency, even if the quality of the grant proposal itself is the same. Getting a grant/fellowship/award on your CV makes a HUGE difference when applying to post-docs or faculty positions. (You'll also have access to more people who will give you more valuable feedback for how to write a better grant proposal.)

4\. Top schools often protect students from bureaucracy and streamline the procedures in place for everything from getting access to a new facility, to what happens when you need to replace your student ID. (See (2) above.)

5\. You're more likely to get a smarter or harder working undergraduate student to mentor and help out with your research. This matters more in the life sciences and fields with "benchwork," (e.g., wielding pipettes) but it applies to tasks that involve coding as well. In better schools, a larger percentage of undergraduates opt to get some experience in a research group, and you get both someone to delegate actual research tasks to, and you get to level-up in people-management.

There's a lot more, but you get the idea, I think.

<comment><USER22> > you've opted into playing on super-hard mode, where you have to work twice > as hard and be twice as good to get as far as someone who opted for the best > school to which they were accepted.

Does this matter very much if the PhD student is not looking for a job in academia?

<comment><USER10> Most of my classmates were, in fact, looking for jobs in academia. And there is the commonly held fear (due to lack of role models) that if you leave academia, you may as well be eaten by wolves.

FWIW, I'm glad I left academia.</comment></comment></comment></comment>


Passwords For Your Facebook Account - <AUTHOR> http://www.labnol.org/internet/facebook-account-passwords/21241/

<comment><USER2> Ignoring the security implications for a moment, this is a very nice UX enhancement, I do imagine that it would eliminate the vast majority of the invalid password attempts thus making people's experience much better.

Now, the question is, just how much security are you losing by allowing this? Assuming the passwords are stored correctly my guess would be that passwords that are considered secure already would only be marginally less secure because of this, however non secure passwords (common ones) are a hell of a lot less secure but only in a relative context, they're still just as insecure as the original insecure password.

I'm not sure I articulated this properly so if I didn't let me know.

<comment><USER3> I would also argue that the security implications of this are largely positive. It removes less than two bits of entropy even from a randomly generated password, but it means that users reset their passwords less often, and I would guess that when users reset a "forgotten" password, they usually choose something weaker (and thus more memorable).

</comment></comment><comment><USER4> I'd like to note, their assumptions on caps lock does not apply to Mac. If you hold shift while caps lock on a mac, it still gives uppercase.

Of course, if they implemented this, it would turn it into a case insensitive password with much bigger security implications. So, this isn't a criticism of their decision. Only an observation.

</comment><comment><USER5> This raises several questions:

Have they always done this, or is this new?

For those of us who haven't changed our Facebook password in years, does this mean that we don't get this option, or do we? And if we do, is Facebook storing our passwords in plaintext?

<comment><AUTHOR> They dont need to store your pasword in plaintext for this, but it does raise a security concern. 3 times the chances to have your password guessed by brute force!

<comment><USER6> It's actually much more than 3 times the chance; this rule allows you to restrict your brute force search to only check passwords with no uppercase characters (or no lowercase characters) which reduces the key space for a given maximum password length quite a bit. (e.g., if there were normally 100 characters allowed and n is the max length, taking out 26 characters reduces the search space from 100^n to 74^n - not that an intelligent password cracker would ever try to iterate straight through the actual space of all allowable passwords)

<comment><USER7> Read the article again, its not making the passwords case insensitive, merely allowing you to invert the case. i.e. if your password was "aSdf" neither "ASDF" nor "asdf" would work.

<comment><USER6> Well I feel dumb, sorry. I thought he meant original casing + all lowercase version + all uppercase version were all acceptable (which isn't the same as case insensitive but for the purposes of cracking it is just as bad).

<comment><USER8> If you don't use Windows you definitely shouldn't feel dumb: if caps lock is enabled on Windows shift will cause you to type a lower case letter, thus inverting what you intended to type rather than uppercasing everything.

I was confused until I realized the caps lock case only applies to Windows users.

<comment><USER6> I've been using OSX as my primary OS for about a year (other than using Linux exclusively on every machine I SSH into for dev), but I just found out from your post that caps lock + shift _doesn't_ make things lowercase on Mac. So, nope, I have no excuses :P

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> There's a nice article about this on the AgileBits blog [1]. In summary they say it's a net gain for security because trying variations on a supplied password doesn't help an attack much and reducing the number of password resets is a positive from a security perspective.

[1] [http://blog.agilebits.com/2011/09/13/facebook-and-caps- lock-...](http://blog.agilebits.com/2011/09/13/facebook-and-caps-lock- unintuitive-security/)

</comment><comment><USER10> While obviously Facebook will be storing this as hash(normal), hash(upper(normal)), and hash(lower(normal)), there's an interesting security benefit to storing this in 3 columns, 'password1', 'password2' and 'password3'. The trick then is to randomise which hash gets stored in which column, i.e., password1 doesn't always correspond to hash(normal).

The slight benefit of this being that if your database is leaked, then the attacker won't have his/her brute forcing job made easier by knowing that the password3 hash only contains lowercase alphanumeric characters.

Edit: Apparently I suck at reading, it's not upper() and lower(). Woops :). Well, if any other sites do store upper() and lower() variations, I wonder if they use this idea?

<comment><USER11> I don't think they store three hashes though. Just the original one and they check against that. Only if that fails they proceed to verify other variants. There are only two - first letter uppercase (presumably for stupid phones) and inverse password (for caps lock on PCs). Both of these variants are reversible (i.e. you can revert the change to get original the password).

</comment></comment><comment><USER12> You can also login with your profile name, which I didnt know until very recently when I mistakenly dropped the @domain.com and was initially surprised to find it worked.

<comment> why-el That only works if you actually change your profile name to something meaningful like facebook.com/yourname. A lot of people don't do that (they have an autogenerated id) and in that case the email is mandatory. I should also note that you can only change your profile name, i.e. facebook.com/profilename, twice. That is, going from something like facebook.com/profile.php?id=34534643 to facebook.com/profileName1 to facebook.com/profilename2. After that Facebook won't allow you, for some reason.

</comment></comment><comment><USER13> Also, I just noticed this evening that Facebook explicitly notifies you of incorrectly using your old password. Not sure how long far back they go to check.

</comment><comment><USER14> The question is, what IS the value of the true password? How do you define "something and its inverse?"

<comment><USER11> I don't think I follow. What is the question?

(To get inverse password you simply reverse the case on all letters.)

<comment><USER14> I mean that while facebook prompts you for a password in a single field, if you enter "passWORD" the true value of your password is both "passWORD" and "PASSword", but there's no way to express that idea in the english language. If someone asked you what your password was, what would you say if you wanted to be completely accurate?

It's just a dumb philosophical thought I had.

</comment></comment></comment><comment><USER15> One interesting observation from the comments:

On a Mac, shift with caps-lock on doesn't toggle to lower-case, so they would need to store a fourth version for this to work.

OPERATI@NGERONIMO

Overall it's a clever UX hack, though I worry they came to it by observing invalid password attempts which seems slightly outside of appropriate, although it doesn't particularly bother me in this case.

<comment><USER16> That would make all passwords essentially case-insensitive (all uppercase would work) and that would make it much easier to brute force than the inverted version.

<comment><USER15> True, and a good reason not to implement this solution.

</comment></comment></comment><comment><USER17> My capslock key is backspace, so this feature is useless to me.</comment>


Techcrunch vs. Reality - <AUTHOR> http://www.reddit.com/r/startups/comments/2btjd2/techcrunch_vs_reality/

<comment><USER2> I think this is a very important point to remember. Successful company histories are often glossy because the beautiful stories are easier to digest and are what we would prefer to believe. Success can sometimes take a lot of time. A successful friend of mine has a poster in his office. It's a cowboy and a horse and it says "if you've never been bucked then you've never ridden."</comment>


How to fit an elephant - <AUTHOR> http://www.johndcook.com/blog/2011/06/21/how-to-fit-an-elephant/

<comment><USER2> _It turns out you can literally fit an elephant with four parameters if you allow the parameters to be complex numbers._

That's cool and all, but it kind of strikes me as cheating, given that complex numbers are vectors. I mean, heck, with four parameters I can fit three elephants, if you allow the parameters to be vectors in 6-space.

<comment><USER3> You can fit any finite number of elephants with one paramter once you put it that way :)

<comment><USER4> Infinite too

</comment></comment></comment><comment><USER5> I would've had so much fun with this on a ti83 back in high school... But more seriously: kind of makes you wonder even more, how people can believe those doomsday proclamations based on _patterns_ in centuries-old texts.

<comment><USER6> Those types of people also believe that it's elephants all the way down. Four and a half parameters?

</comment></comment><comment><USER7> So, now, the trunk? Let's see it wiggle!</comment>


Visualise the module tree of browserify project bundles and track down bloat - <AUTHOR> http://hughsk.github.io/disc

<comment><USER2> Very cool!</comment>