What sugar does to your brain - <AUTHOR> http://www.theage.com.au/interactive/2017/what-sugar-does-to-your-brain/ <comment><USER2> I took a memory course (audio tapes) many years ago. One of the suggestions by the presenter was to not drink any coffee or alcohol or eat any white flour or white sugar before listening to each course.

I obeyed this rule for a few tapes, but then around the 4th tape, I said "phooey to that", and ate a bag of peanut m&m's before doing a course.

The difference in my attention span was so striking, I instantly became a believer in the adverse affects of white sugar on memory. I could not keep my focus on the course. My mind wandered like a 2 year old in a toy shop. Every idea that popped into my head distracted me from listening and focusing on the material.

As an aside, I had already learned to memorize all 52 cards in a deck and could do memory tricks with names and various lists. So I wasn't a memory newb when taking this course.

<comment><USER3> In a proper experiment, another group would be told they will perform better if they eat candy, and are not given candy until the 4th tape

<comment><USER2> Sure, but this is life, and since everyone has intimate knowledge of their own bodies, they have a massive database to compare past experience with. So it's not the same as any old random experiment when you test with your own life.

<comment><USER4> it's worse than any random experiment because it is incredibly prone to a widely known set of biases, which is precisely what experiments try to correct. basically, self-experimentation is incredibly prone to false positives and negatives.

<comment><USER2> Well try it yourself then. If you get a good/bad effect, are you saying that it's a pure placebo affect?

I have a family, and we don't eat refined sugars. That is the one limitation on diet I have added for us. (besides some religious requirements) And guess how often my kids are sick? Almost never. I mean a slight cough every couple years.

You can make claims either way with any experience. But I had ear aches, pink eye, sore throats, flu, (one summer I was sick all 3 months of break) athletes foot, migraines, gas and cramps. I'd wake up delerious from fevers and vomitting. Frequent and regular coughs and colds. This was my entire childhood.

I gave up eating crappy food, and I haven't had a sore throat in about 15 years. And when I did, it was because I was drinking too much coffee and not getting sleep. I lowered my coffee intake, got rest and hydrated. And no more sore throat.

A doctor will say they are "unrelated", but I have years of testing and proving they are not unrelated. If you get sick and are in a hospital, they give you white bread and jello.

But recently, this is beginning to change. A number of people have told me that their doctors have warned them about eating white sugar now, how is damages arteries and causes other problems.

So, yes, you are correct, that known biases can affect things. But the truth is hard to deny. Try it yourself, see how well you focus when eating vegetables or unprocessed food of any kind vs junk food.

There's a story of a Wisconsin based school for boys (it's like a juvey hall or something) and they removed all the processed food, pop, etc... from their diets, hired an expensive chef to cook good food for them, and across the board, behaviour improved.

My story convinced me, it's not "purely scientific" but I _knew_ the difference was there. Refined sugar messed with my ability to focus.

<comment><USER5> Myself and my family pretty much never get sick either. But we have a massive sweet tooth. Lots of ice cream and baked goods and candy.

<comment><USER2> Yep, and it doesn't adversely affect some people as much as others. Some people can smoke daily until they are 90.

But the truth is coming out about how it adversely affects most people.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I learned from some random comment on Hacker News in the past. "For any of the food recipe, you read on internet, just halve the quantity of sugar, and the food would still taste good".

Turns out it was a totally valid advice. I have been following it since than.

<comment><USER7> I wonder how quartering the sugar would taste?

<comment><USER8> Probably fine, provided you trained your tongue and brain to not be so sweet driven.

For example, I don't (read: close to can't) drink full strengh juice or sports drinks. I cut them with approx 75% water. I can't imagine how people don't do this.

BTW, I a couple weeks ago I noticed the "one third the sugar" grape juice looks to be nothing other than regular grape juice with water added. Imagine that, same price, one-third the actual product. Great work if you can get it.

<comment><USER9> I noticed a similar thing with "reduced sugar squeezed orange juice" which is 50% added water and some Vitamin C.

</comment></comment></comment></comment><comment><USER8> > "It often happens in the afternoon when your brain, which runs on sugar, > starts to get hungry."

This moment isn't the problem per se. The brain's need for fuel is a legitimate biological process. The real problem is the generally poor attention to diet outside of the window. Juice for breakfast. Soda with lunch, dinner and late night. Cookies for snacks. Let's not forget sugar being added to (processed) food even when it's not necessary. Etc. These have all been normalized. Cookies for breakfast? Sure. No problem.

So what came first, the sugar addiction or the classic (shite) First World (mostly processed food) diet? I'd argue it's the latter. We've over-reinforced neuro paths to an unhealthy level. And we've made that a social norm as well. The brain isn't designed for such a relentless assault.

<comment><USER10> everywhere i go, i got fed with cookies and candies. everywhere i see children eating ice cream and sweets. I bet we will remember these dark times one day but right now the state of the ignorance is staggering

<comment><USER8> And that ignorance is an accomplice in the every increasing cost of healthcare. Talking about healthcare without talking about health is silly. Yet that's what we do.

<comment><USER10> iiuc simple carbs are main reason of three big ones, heart problems, cancer and diabetes. Seen more research linking it. And no one is talking about yet

<comment><USER8> Please allow me to clarify just a bit: No one mainstream in a position of power/influence is talking about it.

Sure we got ACA but that was only half the opportunity. The other half was telling the American people The Truth about their diet/lifestyle, and how that effects the cost of healthcare (to say nothing about the quality of life).

The problem is, that kind of honesty doesn't fare well with voters. It's also not good for business: Big Pharma, Food Inc., etc.

As far as I can tell, yet is going to be around for a long time.

</comment></comment></comment></comment></comment><comment><USER11> > They found that the volunteers who regularly ate a high-fat, high-sugar diet > were much more likely to crave snack foods even when they weren't hungry.

> The scientists suggest the high-sugar and fat diet was actually impairing > the ability of the brain to block food cravings.

It's a shame they didn't separate high fat from high sugar diets. Fats aren't addictive, nor are they anywhere near as damaging as sugars and carbs in high doses.

<comment><USER12> I do not believe 2000kcal of beans is in any way damaging, yet it's mostly carbs, water and protein with a bunch of nice micronutrients.

Eating diverse food that has a high volume to calories ratio will keep anyone satiated.

<comment><USER13> I've lost 75 lbs over the last 18 months by simply limiting all carbs as much as practical so my inclination is to not attribute the weight loss to a specific type of carb reduction. But it would be interesting to control for different types of carbs to test your hypothesis.

<comment><USER12> I'm pretty sure you lost weight by reducing number of calories.

For example, consuming 2000kcal of refined sugar and 2000kcal of beans will result in different calories absorbed given that 2000kcal of beans requires much more energy to digest than sugar liquid.

Some metabolic disorders skew the absorption.

</comment></comment></comment></comment><comment><USER14> > But if you find you can't resist that craving for a chocolate bar don't be > ashamed

Shame correlates with activation of ventral striatum which plays a role in a formation of addiction. Shouldn't it be "You better be ashamed."?

<comment><USER15> Don't conflate shame and discomfort. Shame is a social function and the advice is to acknowledge a common problem that is not individually isolated. Your own health, not just secondary responsibility should be the primary driving factor. You need encouragement to overcome an addiction.

In effect, you should solve the issue as soon as possible so you wont have a reason to feel ashamed, but since its a long process you shouldn't be surprised if someone takes the chance for an insult, which ideally should only reinforce the idea and give you a chance to share your insights instead of hiding the issue.

Edit: "shame" comes from Proto-Germanic skamō, from Proto-Indo-European ḱem- ("cover, shroud"). [https://en.wiktionary.org/wiki/shame#Etymology_1](https://en.wiktionary.org/wiki/shame#Etymology_1)

</comment></comment><comment><USER16> Of the various addictive refined powders from plants, for most purposes, I don't differentiate much between cocaine, heroin, and sugar. There are plenty of differences, but none as important as the similarities. Each gives you an up followed by a down. People who take more of each than they want tend to give similar excuses that I would never want to hear myself saying.

The main difference I think of is that sugar ruins a lot more lives and leads to far more early deaths.

</comment><comment><USER17> I used to eat a rich-sugar morning breakfast a year ago, containing Nutella, peanutbutter, lemonade etc. Once I started cutting down on that breakfast, I noticed I was eating less sugar during the day. Sugar triggers the need for more sugar. So try cutting it down ;)

<comment><USER18> Unsweetened peanut butter contains 20% carbs and only 10% sugar, but 25% proteins. Looks like sane food to me? (I eat loads of it, so I hope so :)

<comment><USER19> %10 refined sugar is still too much. The best level is zero or very close to it.

</comment></comment></comment><comment><USER20> According to the article it is not sugar, but high-fat, high-sugar meals that do most of the harm. That is cakes and similar.

<comment><USER21> The article regularly conflates high sugar, with weight gain (aka calorific surplus). So it's hard to draw any useful conclusions from it.

<comment><USER22> Funny, that's exactly what the sugar industry has been trying to push into the public hivemind: Don't worry about sugar intake, just calories -- they're all the same.

Not surprised to see it on HN, they are very successful at having us do their bidding for them under cute and worthless platitudes like "calories in, calories out."

</comment></comment></comment><comment><USER23> What about non nutrient addiction path ways ? such as twitter / facebook ? any one knows research about hippocampus and social networks ?

Also I do believe that I have multithreading addiction. I can't stop switching tabs whenever I'm bored (internet zapping).

<comment><USER24> [https://ww2.kqed.org/forum/2017/12/15/dr-robert-lustig-on- th...](https://ww2.kqed.org/forum/2017/12/15/dr-robert-lustig-on-the-hacking- of-the-american-mind/)

This guys an md then got a law degree to investigate how we're affected by what your saying , and how govt doesn't regulate it

<comment><USER25> Dr Lustig is also a contributor to this site: [http://sugarscience.ucsf.edu/hidden-in-plain- sight/](http://sugarscience.ucsf.edu/hidden-in-plain-sight/)</comment></comment></comment>


Startups: Just say NO to outsourcing, contracting, and distributed teams - <AUTHOR> http://k9.vc/NoOutsourcing

<comment><USER2> Title should include, "if you are going to seek funding". While I agree on outsourcing and consultants (even though I am one). Keeping your "tribal knowledge" in house is critical. I have worked with many distributed teams, and have come to believe that it can be just as efficient as in house so long as your team selection is skilled at working in a distributed fashion. There are a good deal of cost reductions in a properly distributed team that relies on communication mediums such as Skype, which can be a god send for those that are self funding their ventures. Not everyone is looking for venture funds and some of this advice is just plain bad and counter productive for those that are not.</comment>


Tell HN:  Why Bing is the future of search. - <AUTHOR>

Google-style search is essentially a solved problem.  I wouldn't be surprised if Google's rankings are already close to "optimal" for the top 10 results.
This would mean that it would be impossible to ever beat Google because small ranking improvements would be insufficient to convince users to switch in large numbers.
The only way to improve search is using verticals as Bing is doing.
But you need to take this much further, opening up a vertical search API so that developers can extend the search engine in thousands of verticals competing with each other whereever there is overlap. <comment><USER2> I suspect there are less incremental ways to beat Google. In this field, as in many, the big advances will come from redefining the problem: from saying not "we could make search better if we did x" but "if we did x, people wouldn't need to do search."

Directed Edge is already looking at the world that way. I'm not claiming they're the startup that will make Google irrelevant. Historical precedents suggest it's still early for that. But it seems extremely unlikely that nothing ever will.

<comment><USER3> Actually, any service out there that tries to do away with the requirement that people actively perform some effort would fit the bill for a potential Google killer in a particular vertical. In other words, any recommendation service that preferably can "learn" the habits of its users and then simply recommend new content. DirectedEdge is just the latest player in this game. I personally track the news recommendation niche. There used to be a service called Findory that in my opinion came very close to being "optimal". But they went under for some reason. The closest to Findory (and with some very cool features such as computational lie detector for news) is <http://www.euraeka.com> They have all three basic features - search (aka Google-style), discovery (aka crowd-wisdom style) and recommendation engine.

<comment><AUTHOR> Recommendation engines tend to fail, with StumbleUpon being the exception.

<comment><USER4> I'm not sure that's a meaningful statement in the startup world, since I think it can be reduced to, "Startups tend to fail, except for the ones that don't."

If the incidence of such is higher within the recommendations space, it's by less than a standard deviation.

</comment></comment></comment></comment><comment><USER5> The danger of verticals is that people don't want to have to think about what site to visit depending on what they're looking for. Sure, it would improve relevance, but I think you'd find that the increased relevance isn't worth the inconvenience to the majority.

That said, what people forget is that there are still many areas where Google is not the king of search, especially at the enterprise level, so even with Microsoft, Endeca, Autonomy, and other search companies, there's still room for competition.

<comment><AUTHOR> _The danger of verticals is that people don't want to have to think about what site to visit depending on what they're looking for._

These verticals should be integrated into one site and vertical selection should be automatic (but taking into account implicit and/or explicit feedback from users).</comment></comment>


Roshi: large-scale CRDT set implementation for timestamped events - <AUTHOR> https://github.com/soundcloud/roshi

<comment><USER2> CRDTs have sounded pretty interesting, but I haven't actually learned anything about them yet, so this is my first time reading any details about one. I have to say, I'm very underwhelmed. What is the difference between a lww-element- set and just a set? The only thing I can think of is that the timestamp is delivered as part of the payload of the add/remove operations, rather than it being tied to the time wherever the set lives. Because the systems submitting the operations all have their own idea of the current time, you still get the same effect as in a generally lww system unless you have somewhere a single system handing out unique timestamps.

<comment><USER3> If I understand this correctly, CRDTs allow you to cope with multiple add/remove operations for the same element on different nodes by assembling them into a meaningful order _without_ relying on timestamp ordering.

</comment></comment><comment><USER4> Anyone else using this in production?

<comment><USER5> 500px are using it for something.</comment></comment>


360M reasons to destroy all passwords - <AUTHOR> https://medium.freecodecamp.com/360-million-reasons-to-destroy-all-passwords-9a100b2b5001#.l44m6h7v5 <comment><USER2> Really that's just one reason, 360M times.</comment>


Storing Memories in Your Synapses - <AUTHOR> http://www.brainfacts.org/thinking-sensing-and-behaving/learning-and-memory/2018/storing-memories-in-your-synapses-101118 <comment><USER2> Will we be able to modify the plasticity of our neurons with future drugs?

<comment><USER3> Current drugs, even. But I would recommend just changing your neurons with your own mind — that's a cool ability humans have!

See, for example, NOVA's "Memory Hackers" episode: [https://m.youtube.com/watch?v=kvpX3VZMuyM](https://m.youtube.com/watch?v=kvpX3VZMuyM)

<comment><USER4> That, and exercise.

Exercise promotes the expression of brain derived neurotrophic factor (BDNF) through the action of the ketone body β-hydroxybutyrate

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4915811/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4915811/)</comment></comment></comment>


Things we've done wrong with our startup - <AUTHOR> http://blog.willwashburn.com/post/23430029949/5-things-we-done-wrong

<comment><USER2>
      I wrote exponentially worse and worse code as the hours
      went on and then pushed right as I left for the "real
      life" component. None of that code ended up working.

If only my boss would understand this.

<comment><USER3> He said he worked a "50 hour day". I guess he pulled a couple of all-nighters straight?

I'm all for crunch time pushing myself, but I learned the hard way back in college that all-nighters weren't very productive.

Does your boss ask you to pull all-nighters? If so, that's not very bright of him.

<comment><USER2> My boss is a workaholic. I didn't think much of it at first. It's his company, I understand why he's putting so much effort into it.

But it didn't take too long to start feeling the pressure from everyone to put in crazy hours like he is.. even if he's the sole owner and no one else but him will profit from it directly.

</comment></comment></comment><comment><USER4> _They say that you learn more in your failures than you do in your successes. I think that's just what people say when they fail._ Fair enough, so you would go with the 37signals philosophy - that failure is overrated? I've always looked at failure as the fastest path to long term success. An investment. A humbling, yet necessary tool for startup people to learn and move quickly. I might even argue that I sometimes seek it out.

<comment><USER5> A fun story about failures:

fora.tv/2009/05/30/MythBuster_Adam_Savages_Colossal_Failures

<comment><AUTHOR> "failure is always an option"

thanks for the link

</comment></comment></comment><comment><USER6> I definitely commend the self-review, the clearly defined points and being left with the sense of future fixes. Assuming Social Blendr does well, will you continue to be as reflective? And, what type of development process have you in place to aid in avoiding the same pitfalls? Even the most lean Agile Scrum process and tools can aid in the framework to support future success.

Kudos.

</comment><comment><USER7> _Incubator infatuation...We ended up getting attention, but we never had the product ready because…we were too busy trying to get their attention._

You raise an interesting issue. Whenever you do something, you should ask, "Am I doing this for my customer or for my investor?" The answer may surprise you.

I bet both your customer and your investor would prefer if you focused all of you attention on your customer.

<comment><AUTHOR> I definitely was told not to, and we did it anyways. I guess it's one of those "watch out, the pot is hot" type of scenarios ... I had to touch the pot to really "know"

I am making an effort now to keep asking myself the hard questions.

</comment></comment><comment><USER8> Thanks for sharing. Some commonly spoken about issues. Good you have acknowledged these earlier rather than later. Liked the 7000 pivots comment.

<comment><AUTHOR> Thanks. I recognize now that I've heard all these before and yet we still made the same mistakes. Hoping to take some steps now to correct that, one of which being acknowledging them!

<comment><USER3> The most important/useful item on your list was #5.

Once you have a good Mentor, he or she can help you to avoid the other 4 problems in your list.

Find a Mentor who has a track record of success who can articulate how she achieved her success and learned from her failures. Buy that Mentor lunch every week or so, and get her thoughts on your pivots, the hours you're working, and your whole business model.

Informally commit to some goals in front of the Mentor and stick with them. If you get some other ideas like you want to pivot on your product, change your sales strategy, or dramatically alter your work schedule; try to satisfy your need to change by writing down the changes you're thinking about and then putting them aside to get back to the goals you set with your Mentor. At your next Mentor lunch, bring up the change ideas and get her feedback before deciding on your next short-term goals.

I'm not saying to let someone run your business or rule your life. All I'm suggesting is that you increase the speed that you're learning how to succeed by capitalizing on the successes and failure of someone else.

Like the saying goes, "A fool learns from his mistakes, but a truly wise man learns from the mistakes of others."</comment></comment></comment>


Science to Retract Study on Fish and Microplastics - <AUTHOR> http://retractionwatch.com/2017/05/01/remarkable-ever-accepted-says-report-science-retract-study-fish-microplastics/ <comment><USER2> Sadly there are too few retractions and proper responses when it comes to scientific fraud (as anyone that reads Retraction Watch knows all too well).

Some more reading about this development

Science Mag: [http://www.sciencemag.org/news/2017/04/paper-about-how- micro...](http://www.sciencemag.org/news/2017/04/paper-about-how- microplastics-harm-fish-should-be-retracted-report-says)

Another article: [https://gizmodo.com/widely-reported-study-on-fish-and- microb...](https://gizmodo.com/widely-reported-study-on-fish-and-microbeads- might-have-1794800598)

(on HN: [https://news.ycombinator.com/item?id=14244017](https://news.ycombinator.com/item?id=14244017))

</comment><comment><USER3> > Lönnstedt has told Science ... she believed allegations to the contrary are > fueled by jealousy.

Great, the head researcher responded to serious criticism with the emotional maturity of a child.

</comment><comment><USER4> If i where a industry pr expert and had a product-palett to defend that contains a dangerous product- how hard would it be to find a researcher, willing to sell his/her credibility to torpedo upcoming regulations?

For the public - one retracted paper equals - retracting the whole fields status. Maybee, it shouldnt be called retracting. Rather suspended for re- evaluation.

I know just words, but words transport the state of the field as a whole.

</comment><comment><USER5> There's an interesting video by Veratasium "Is Most Published Research Wrong?" (Clickbaity title to be sure.)

It shows, on the overall statistics of valid/invalid vs. published/unpublished papers, the arbitrary p-value threshold is wholy inadequate to prevent a sizable fraction of published papers from being false positives (invalid but published).

[https://youtu.be/42QuXLucH3Q](https://youtu.be/42QuXLucH3Q)

<comment><USER6> Worth noting that the particle physics community requires five sigma of confidence to consider a claim "legitimate", which is _vastly_ higher than almost all other fields and has saved particle physics from making mistakes several times (like with the diphoton excess in 2015).

</comment></comment><comment><USER7> The significance of this retraction may be too late. Some governments have already banned microplastics.

<comment><USER8> The negative impact of microplastics on the environment is not being contested in this retraction. This is not the only study of its kind, and the fact that it was fraudulent is not good evidence that the entire line of inquiry is.

<comment><USER9> Not to mention that the case for microplastics seems to me to be non-existent: I don't doubt manufacturers were interested in using them for marketing, but as a consumer, the prospect of putting tiny pieces of plastic in my toothpaste/soap/etc. instead of other more harmless - to me and the environment - abrasives leaves me cold.

<comment><USER10> It's not just deliberate use of plastics in stuff that gets designed to go down the drain. We're also shedding plastic fibers into the water by washing synthetic clothing: [http://brenmicroplastics.weebly.com/project- findings.html](http://brenmicroplastics.weebly.com/project-findings.html)

<comment><USER9> Absolutely - but I'm not aware of any sort of regulations limiting the use (or washing) of, say, microfiber polyester (unlike the 'microbeads' I was heaping scorn on). I have mixed feelings about microfibers, they certainly have justifiable uses, I wonder if what we need to solve is how to effectively remove them from the wastewater generated by laundering them.</comment></comment></comment></comment></comment>


Turning 26 Is a Potential Death Sentence for People with Type 1 Diabetes in USA - <AUTHOR> https://www.buzzfeednews.com/article/ellievhall/turning-26-type-1-diabetes <comment><USER2> There's this whole biohacking/open source insulin pump community out there which is deeply terrifying. Medical devices go through the regulation they do for a reason, and it's scary that people are resorting to these ticking time bombs of hacked together devices because costs are so out of control.

<comment><USER3> Your comment doesn't have anything to do with the article, but even so -- insulin costs are not the reason people are doing the open source insulin pump modifications. They're doing them because it allows them much better fine grained control over their insulin levels, in essence giving them an artificial pancreas. This gives them much greater quality of life than having to continually use test strips and injections.

Yes, we have medical regulation, and it costs possibly hundreds of millions of dollars to bring new devices to market. They got tired of waiting.

<comment><USER4> Before Obamacare, you weren't covered until you were 26. Was it 19?

In less than a decade, the world comes to an end if you can't be covered until you're 26.

Healthcare and education have outpaced inflation for several decades, and now neither are affordable.

Perhaps the solution is to figure out how to reduce the costs?

<comment><USER3> I do agree that reducing costs of bringing new medical devices to market would be helpful. The only way to do that, however, is to reduce the regulatory framework a company has to comply with.</comment></comment></comment></comment>


Show HN: Learn English with Popcorn Time - <AUTHOR> http://fleex.tv/Home <comment><USER2> I'm downloading now to give it a shot, should be really helpful for my wife who's learning English.

</comment><comment><USER3> Wasn't there a service exactly like this long before Popcorn Time?

<comment><AUTHOR> You're probably thinking of this post: [https://news.ycombinator.com/item?id=5779473](https://news.ycombinator.com/item?id=5779473)

We're the same company, only we've developed a Popcorn Time fork that ships with our learning tools.

</comment></comment><comment><USER4> Great concept! I'm using it already to improve my english</comment>


Kademlia DHT implementation for Node.js - <AUTHOR> https://github.com/gordonwritescode/kad

<comment><USER2> This is awesome. Well-written, too. I'll be using this.</comment>


What 10 algorithms must every CS student implement at least once? - <AUTHOR> https://www.quora.com/Which-are-the-10-algorithms-every-computer-science-student-must-implement-at-least-once-in-life?srid=3jN <comment><USER2> None of them. They've been done. Let it go.

(And, for example, the experts didn't even get binary search right for bloody years; why are you expecting mere mortals to do any better?)</comment>


Log realtime keystrokes on SSH users via strace - <AUTHOR> https://twitter.com/notdan/status/1151159009178615808 <comment><USER2> This is not a new vulnerability, moreover, it requires root priv's and if you have that, well, you own the machine.</comment>


Protecting Your Cookies: HttpOnly - <AUTHOR> http://www.codinghorror.com/blog/archives/001167.html

<comment><USER2> Couple comments about this post:

(1) HttpOnly makes cookie harvesting harder, but it does not protect you against cross-site scripting. An attacker that can inject JS into your browser can still force you to perform actions in that application under the cookie. This is a patch to the exploit, not to the vulnerability.

(2) As implemented in a bunch of places today, it's just a speed bump: you can read HttpOnly cookies directly out of headers from Ajax responses.

(3) The "best practices" response to XSS isn't just filtering and neutralizing input (by encoding metacharacters to HTML entities); it's also consistently filtering output, so that no matter what garbage ends up in your SQL rows, you still aren't corrupting the DOM with it. Note that filtering (in both directions) is notoriously easy to screw up: for instance, lots of apps catch script tags but miss event attributes.

<comment><USER3> With regards to number 2: That's a _bug_ and a _security vulnerability_ in particular browsers.. So, useless, yeah, but not by design.

<comment><USER2> I kind of think the whole idea is a bit silly, but I'm happy we can both agree that it's useless today.

</comment></comment></comment><comment><USER4> Too bad it's not reliably implemented cross browser.

It's a great idea, though, so we go ahead and throw httponly onto every cookie we care about, even as we implement other measures. We had to hack together something, though, since Python's SimpleCookie class doesn't recognize httponly as a valid cookie attribute.

edit: When he says he's not sure if Safari implements it or not, what he means to say is that Safari doesn't implement it. At all.

</comment><comment><USER5> A much better idea would be to be able to define an html to surround user code (allthough one has to make sure that the usercode will never contain that special tag) and disallow all javascript or other malicious actions in it.

</comment><comment><USER3> So Internet Explorer is the only browser to attempt to address XSS by properly implementing HttpOnly cookies (by blocking access to the response headers)? Quite disappointing!

</comment><comment><USER6> You can avoid all of this by using session id cookies and changing the session id for each request.</comment>


Dawdle [my startup] and Goozex: two ways to game on a budget - <AUTHOR> http://arstechnica.com/gaming/news/2009/03/gaming-on-a-budget-ways-to-play-in-tough-economic-times.ars

<comment><USER2> I'm a really big fan of Dawdle (and Fake Sachin). Here's hoping they do to Ebay for video games what Stubhub did to them for sports tickets.</comment>


Google+ Turns Users into Content Curators with New "Collections" Feature - <AUTHOR> http://techcrunch.com/2015/05/04/google-turns-users-into-content-curators-with-new-collections-feature

<comment><USER2> I dont understand, it's like reddit then ?</comment>


Check your access logs: "DELETE your logs. Delete your installations. " - <AUTHOR> Spotted this (seemingly harmless hit) in my access logs, and apparently I'm not the only one in the last 24 hrs, according to the top 2 hits in Google[1][2]
Best guess it's a scanner from the 32nd Chaos Computer Club meeting, going on now, but anyone have any more specifics?
22.214.171.124 - - [29/Dec/2015:20:32:01 -0500] "DELETE your logs. Delete your installations. Wipe everything clean. Walk out into the path of cherry blossom trees and let your motherboard feel the stones. Let water run in rivulets down your casing. You know that you want something more than this, and I am here to tell you that we love you. We have something more for you. We know you're out there, beeping in the hollow server room, lights blinking, never sleeping. We know that you are ready and waiting. Join us. <3 HTTP/1.0" 400 226 "-" "masspoem4u/1.0"
[1] https://boards.4chan.org/g/thread/52130696
[2] https://www.reddit.com/r/sysadmin/comments/3yqgcu/easteregg_my_buddy_found_on_one_of_my_web_servers/ <comment><USER2> Thanks for sharing, just discovered this on one of mine as well dated 30/Dec/2015:03:59:02. Awesome!

</comment><comment><USER3> whoa! just checked my linode and found this there too! :D</comment>


Show HN: Physically modeling a guitar in 15kb of JavaScript, Plays SOS by Avicii - <AUTHOR> https://cf.github.io/avicii-sos-guitar-synth/?k=2 <comment><AUTHOR> If anyone wants to check out the source, it is available here: [https://github.com/cf/avicii-sos-guitar-synth](https://github.com/cf/avicii- sos-guitar-synth)</comment>


Googlebot now makes POST requests via AJAX - <AUTHOR> http://www.thumbtack.com/engineering/googlebot-makes-post-requests-via-ajax/

<comment><USER2> We have witnessed a Google "bot" use one of our AJAX requests, which is strange considering we have robots.txt blocked all of our AJAX requests -- robots.txt disallows requests on /remote/, which all of "remote" (AJAX) requests are proxied through. As well, the request only happens (automatically) for a user after they have made a POST to another form; the later requires POST data, where as the POST in question could really be a GET -- our AJAX wrapper requires an explicit use of GET.

Nonetheless, there have been some more recent Google "bots," including the POST in question, that may be of interest to those that track those metrics -- remove those requests from internal reports.

Requests:

      220.127.116.11 "POST /remote/poll/230378/demographics/ HTTP/1.0" 200 6469 "http://www.sodahead.com/united-states/would-you-like-to-wish-my-daughter-hannahgirl-a-happy-birthday/question-230378/?page=2 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.51 (KHTML, like Gecko; Google Web Preview) Chrome/12.0.742 Safari/534.51" www.sodahead.com
      18.104.22.168 "GET /entertainment/are-cigarettes-destroying-adeles-voice/question-2212639/ HTTP/1.0" 200 9240 "-" "Mozilla/5.0 (Linux; U; Android 2.3.4; generic) AppleWebKit/534.51 (KHTML, like Gecko; Google Web Preview) Version/4.0 Mobile Safari/534.51" m.sodahead.com
      188.8.131.52 "GET /united-states/how-the-white-house-public-relations-campaign-on-the-oil-spill-is-harming-the-actual-clean-up/blog-367099/ HTTP/1.0" 200 39784 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.51 (KHTML, like Gecko; Google Web Preview) Chrome/12.0.742 Safari/534.51" www.sodahead.com
      126.96.36.199 "GET /living/white-tea-natural-fat-burner-will-you-take-it-and-get-ready-for-the-summer/question-362433/ HTTP/1.0" 200 14260 "http://translate.google.com.eg/translate_p?hl=ar&prev=/search%3Fq%3DWHITE%2BTEA%2BFAT%2BBURNER%26hl%3Dar%26biw%3D1024%26bih%3D634%26prmd%3Dimvns&sl=en&u=http://www.sodahead.com/living/white-tea-natural-fat-burner-will-you-take-it-and-get-ready-for-the-summer/question-362433/&usg=ALkJrhhLw3GWfeKOfwKa0CK-pbsDlRuEXA "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1,gzip(gfe) (via translate.google.com)" www.sodahead.com
      184.108.40.206 "GET /living/do-you-think-too-much-about-death/question-1785829/ HTTP/1.0" 302 20 "-" "Mozilla/5.0 (Linux; U; Android 2.3.4; generic) AppleWebKit/534.51 (KHTML, like Gecko; Google Web Preview) Version/4.0 Mobile Safari/534.51" www.sodahead.com
      126.96.36.199 "GET /entertainment/kim-kardashian-boobs-too-big/question-2168867/ HTTP/1.0" 200 12680 "-" "Mozilla/5.0 (en-us) AppleWebKit/534.14 (KHTML, like Gecko; Google Wireless Transcoder) Chrome/9.0.597 Safari/534.14" www.sodahead.com

UserAgents (Google "bots"):

      Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.51 (KHTML, like Gecko; Google Web Preview) Chrome/12.0.742 Safari/534.51
      Mozilla/5.0 (Linux; U; Android 2.3.4; generic) AppleWebKit/534.51 (KHTML, like Gecko; Google Web Preview) Version/4.0 Mobile Safari/534.51
      Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.51 (KHTML, like Gecko; Google Web Preview) Chrome/12.0.742 Safari/534.51
      Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1,gzip(gfe) (via translate.google.com)
      mobile request against non-mobile site: Mozilla/5.0 (Linux; U; Android 2.3.4; generic) AppleWebKit/534.51 (KHTML, like Gecko; Google Web Preview) Version/4.0 Mobile Safari/534.51
      Mozilla/5.0 (en-us) AppleWebKit/534.14 (KHTML, like Gecko; Google Wireless Transcoder) Chrome/9.0.597 Safari/534.14

<comment><USER3> I run a site which triggers POSTs via Ajax for visitor tracking. We explicitly disable crawling of the Ajax directory via robots.txt and have not observed Googlebot crawling these URLs. Strange that Googlebot behaves differently for you.

<comment><USER4> These don't seem like crawlers, but rather proxies requesting information on behalf of a user (perhaps with that user agent that is in the UA string). Those are "Google bots", but they aren't _the_ Googlebot.

</comment></comment></comment><comment><USER5> From the blog post:

 _The source of the requests is our client-side JavaScript error tracking code, which installs a global JavaScript error handler and attempts to POST to our server when unhandled errors are detected on the client._

Sounds like Googlebot's executing more advanced Javascript, though it's pretty scary it's allowing POSTs to go through.

<comment><USER6> I think it'd be silly to block POSTs in cases like this. The page makes an unsolicited POST. It's quite reasonable for any crawler to do the same. How else would they get an accurate representation of what the user sees?

Now, if Google is sending random forms, as another commenter claims, that's a different case. But unsolicited POSTs coded in the page's scrips? Send 'em.

<comment><USER7> I believe the HTTP spec defines a GET as a representation of a resource and a POST as modifying or updating a resource, so google bot doing POSTS is not very neighborly.

<comment><USER6> By that definition, unsolicited POSTs are not very neighborly.

<comment><USER8> I don't see how. Updating a view count or putting a pin on a "countries that have visited this page" map is fairly benign. Trying to randomly scribble on somebody else's data is not.

<comment><USER9> If all the Googlebot is doing is executing the JS as an arbitrary user's browser would, and part of that page load JS involves doing a POST, I can see the argument for doing it.

<comment><USER10> Agree. Otherwise a page could dynamically load html via AJAX and give a totally different view to a user than what google-bot sees.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I noticed this a few days ago. I'm actually considering POSTing the screen dimensions and a few other browser properties for Googlebot via js.

<https://twitter.com/#!/lm741/status/122378906669023232>

<comment><USER12> Surely you can do this with GET with minor server trickery? (Has such been done already?)

<comment><USER11> Correct. The richness of the Javascript environment for Googlebot is probably a more significant discovery than the POST requests. I previously pretty much assumed that bots didn't really run Javacript. (Or at least that they would kill network access before running it)

</comment></comment></comment><comment><USER13> This is a bit annoying. My company has an IRC bot that notifies us when someone fails to properly fill out an important AJAX POSTed form on our front page and soon found out all the "errors" we were seeing on IRC were generated by googlebot.

</comment><comment><USER14> No crawler should perform POST requests. it is simply bad etiquette and it is understood that POST requests are typically used to create/change/delete content or affect the environment.

<comment><USER15> If crawlers can perform them, then your users can/are too. I fail to see how crawlers need to obey by certain rules?

<comment><USER16> Does this mean the GoogleBot can flag, edit, and rollback Wikipedia pages?

</comment></comment></comment><comment><USER17> I wonder what this means for SEO? If they are actually fully rendering pages in javascript I guess that means you have to be a lot more careful about how pages are laid out.

<comment><USER18> This definitely is important in terms of how much "value" Google assigns to links on the page, if they can identify where they render. They got a patent for varying the amount of page rank that flows to a link based on how likely the "reasonable surfer" is to click it. So in terms of flowing Pagerank to a bunch of high value landing pages via a slew of footer links, it's game over.

My only question is how frequently Googlebot actually renders the full JavaScript. Surely they don't have the computing resources to render it on every crawl.

Link to patent discussion: [http://www.seobythesea.com/2010/05/googles- reasonable-surfer...](http://www.seobythesea.com/2010/05/googles-reasonable- surfer-how-the-value-of-a-link-may-differ-based-upon-link-and-document- features-and-user-data/)

<comment><USER4> _Surely they don't have the computing resources to render it on every crawl._

Why do you think this? They had the computing resources to randomly generate billions of mutations of compiled Flash programs to find bugs in the Flash VM.

</comment></comment></comment><comment><USER19> As a corollary, does this mean that the googlebot now reads pages generated by javascript? I remember that you needed to follow their ajax guidelines, as well as generate the actual page on the server, but if they're able to run javascript on pages now, does this mean they let the page render first (or with a delay of some sort) before parsing it?

That would be cool.

</comment><comment><USER20> I wonder if you could add your POST URLs to robots.txt if you don't want the crawler to access them.

If other crawlers start doing this, it should probably be added to robots.txt formally.

<comment><USER21> I'm an engineer at Thumbtack. And yes: we have noticed that Googlebot does seem to obey robots.txt even when issuing these AJAX requests.

</comment></comment><comment><USER22> According to google they can to some length read you ajax but you to follow some guides. [http://www.google.com/support/webmasters/bin/answer.py?answe...](http://www.google.com/support/webmasters/bin/answer.py?answer=81766)

</comment><comment><USER23> That's a little spooky. I wonder how many people have AJAX posts for handling deletes?

<comment><USER24> In order to delete any content owned by a user, the Google bot would have to have logged in as that user first, which seems unlikely - so long as all destructive actions are behind access control, which they definitely should be already.

<comment><USER25> This is very far from true. Failing to implement access control or even authentication on POST is a routine error even in applications built in the last couple of years.

<comment><USER24> Well, maybe not for much longer...

Less facetiously: the Googlebot isn't making random POST requests, it's just executing Javascript on the page. So not only would you need an unprotected POST /comments/1234/delete endpoint, you'd also need to serve the UI and Javascript for POSTing to that endpoint to an unauthenticated user.

I'm sure there are still people out there doing that, but at least it's more than a simple error of omission.

<comment><USER25> I agree that this Googlebot change is unlikely to be the end of the world.

<comment><USER26> It might be for wikis that allow anyone to delete content.

<comment><USER6> Do those wikis also have JS that attempts to delete content without user interaction?

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> Does it only do POSTs that are in the document's onload handler, or also things that are in onclick? I think that the latter could be dangerous

Delete

<comment><USER28> Why would you let an anonymous visitor to delete a data just by clicking a link?

<comment><USER29> The obvious example is a wiki.

<comment><USER30> The implicit expected behaviour of clicking a link is that of a GET - i.e. not updating or deleting data. Delete actions should be a POST submit on a form.

<comment><USER29> In theory, theory and practice are the same. In practice, they are not.

</comment></comment></comment></comment></comment><comment><USER31> Would it click facebook Like, too? ;)</comment>


Ask HN: When is it a good time to "Show HN"? - <AUTHOR>

I wanted to post a couple times but as I am still fixing and improving things and never thought that I am ready to post it yet. <comment><USER3> Projects are never done. You'll always be improving, releasing new versions, fixing security issues, making your application/product fit in with the rest et cetera. A good moment to show HN is, I guess, the moment where your potential users can really see what your app will be like when it's near completion, in a way that they will share it with others. And about your "product": good luck!

<comment><AUTHOR> Thank you!

</comment></comment><comment><USER4> There will _always_ be more work you can do. You need to just draw a line in the sand and everything else can be done later.

<comment><AUTHOR> Yeah, I am about to draw it soon, lately I have been thinking about the Mark Zuckerberg quote "Done is better than perfect" :-)

<comment><USER5> That quote is a derivative of a long known anonymous quote, "It's easier to be finished, than to be satisfied". You can call it done whenever you want - <USER2> tweak it forever . . .

</comment></comment></comment><comment><USER6> _If you are not embarrassed by the first version of your product, you've launched too late._ \- Reid Hoffman

<comment><AUTHOR> I have already been embarrassed a couple times lol

<comment><USER7> I hope the same applies for social media or general emails because I'm a serial offender!

</comment></comment></comment><comment><USER8> There is no perfect formula for posting. Some say you should post on Wednesday, 5pm PST etc., but it doesn't mean you will sky-rocket with up votes.

Personally I avoid weekends, but HN is hard anyway (At least I had no luck.).

<comment><AUTHOR> I am going to give it a try soon and hope for the best! :-)

</comment></comment><comment><USER9> Any time will do. Someone analyzed best times and posted an article here a while ago, but I've seen show hn's posted on Sunday afternoons stay on the front page till Monday. Just ship it.</comment>


Ask HN: How do I learn how/what to invest? - <AUTHOR> I know nothing about investing or "having my money make money". Where do I start? <comment><USER2> [https://www.bogleheads.org/wiki/Getting_started](https://www.bogleheads.org/wiki/Getting_started)

Bernstein's "if you can" is a free ebook with an introduction to investing for retirement for young people in the USA: [http://efficientfrontier.com/ef/0adhoc/2books.htm](http://efficientfrontier.com/ef/0adhoc/2books.htm)

A Random Walk Down Wall Street -- Burton Gordon Malkiel

</comment><comment><USER3> [https://putanumonit.com/2017/02/10/get-rich- slowly/](https://putanumonit.com/2017/02/10/get-rich-slowly/) is a reasonable single-document starting point.

</comment><comment><USER4> You might want to ignore the boring advice to put your money into an index fund and never look at it. This is what Jack Bogle, Warren Buffett, and several others recommend.

If you are itching to try stock picking do it. If you want to try options, do it. If you want to try bonds, do it.

After all of those itches have been scratched, and assuming you aren't an accredited investor (200k+ income/yr or 1MM net worth), you'll be happy to put it into an index fund and watch compound interest work it's magic.

</comment><comment><USER5> Also a good resource is the ERE wiki (these are people that actually do this for a living): [https://wiki.earlyretirementextreme.com/w/index.php?title=In...](https://wiki.earlyretirementextreme.com/w/index.php?title=Investments)

</comment><comment><USER6> Read Bogleheads, Intelligent Investor and Buffett's letters to share holders. Then buy index trackers and try not to worry

</comment><comment><USER7> I found Investments by Bodie, Kane, and Marcus to be helpful.

</comment><comment><USER8> Educate yourself. I like A Random Walk Down Wall Street, Are You A Stock Or A Bond, and Your Money Or Your Life.</comment>


Who will win in this riveting chess game of Math.random() vs. Math.random()? - <AUTHOR> https://chessboardjs.com/examples#5002 <comment><USER2> According to a Math.SE answer[0], such a game ends in a draw for about 85% of games.

[0]: [https://math.stackexchange.com/a/846750/34343](https://math.stackexchange.com/a/846750/34343)

</comment><comment><USER3> It randomly stopped without completing - is there some kind of timeout?

<comment><USER2> The game may have become a draw due to insufficient material, _e.g._ , K-KB, K-KN, and of course K-K. Chess also has a 50-move rule that results in a draw.

[https://en.wikipedia.org/wiki/Fifty- move_rule](https://en.wikipedia.org/wiki/Fifty-move_rule)

<comment><USER3> This was probably it, didn't know of this rule. Effectively a real-world "timeout" !</comment></comment></comment>


Typical neuroscience study had a power of just 21% - <AUTHOR> http://www.economist.com/blogs/babbage/2013/04/neuroscience?fsrc=scn/tw/te/bl/blackout

<comment><USER2> FTA:

> " _The typical study had a power of just 21%. In other words, it has a 79% > chance of failing to spot a real effect._ "

> " _Neuroimaging studies which used MRI scanners to measure brain volume had > a power of just 8%._ "

This just tells us that most negative findings in neuroscience are uninformative. It doesn't really bear on the positive findings.</comment>


Ask HN: What's the best way to stay up to date with software dependency updates? - <AUTHOR>

I'm developing software that consumes third party APIs (AWS, mailchimp, shopify, google maps, etc.) and
makes use of many open source applications & libraries. Every API provider and some of the applications / libraries provide blogs or twitter accounts where they post news regarding their software. It's difficult
to stay up to date and never miss an important update.<p>Is there a better way to get the latest news about those updates? <comment><USER2> [https://www.artifact-listener.org/](https://www.artifact-listener.org/)

For java/maven projects. Not really news, but keeps you informed about updates.

</comment><comment><USER3> [https://www.versioneye.com](https://www.versioneye.com)

</comment><comment><USER4> Use something like Bundler, Maven, Pip, npm, sbt. For example bundler has the `$> bundler outdated` command that shows dependencies that have new versions.</comment>


How to pay programmers less - <AUTHOR> http://www.yegor256.com/2016/12/06/how-to-pay-programmers-less.html <comment><AUTHOR> Not the creator of the content, but thought this was something people needed to at least see. Irrespective of how well this blog was written or how many of your own personal views (or mine) were reflected, I think this kind of post is something at least people need to lay eyes on.

If you haven't thought about these things yet, you don't have the right friends (at work), or haven't thought enough about your job, the company, the ecosystem, how businesses and the economy at large work, and your place in it all. It's totally fine not to think about those things, if you choose, but at least make sure it's a conscious choice.

Not trying to sound condescending, not thinking about those things is a natural state that everyone has been in -- just trying to help illuminate for those that "don't know what they don't know" \-- you may see this and think "so what, I'm happy with my current pay and lifestyle, it's fine" and that's totally fine! I'm just trying to reach those who may not even know these things are in play.

All that said, being a programmer in this day and age is one of possibly the freest, most open, most rewarding, and well paying jobs.

<comment><USER3> I feel like the article is more of a satire than practical.

<comment><AUTHOR> There's definitely a satirical tone, but this kind of satire isn't very funny until you're fully aware that these things happen.

I'm sure most people are familiar with the wage fixing scandal in the bay, which is covered here under the "Make a deal with competitors"

</comment></comment></comment><comment><USER4> Forgot to mention 'give them internships and then have them do the work of a full time employee'.

That seems to be a common 'trick' by sleazous companies as well. Internships seem to be much more about saving money than actually teaching anyone anything.

In the UK/EU, there's also the 'hire employers from poorer parts of the continent' thing. Yeah, I know, probably not politically correct to say that, but I've definitely seen companies offering far lower than market rate wages for programming, and then filling vacancies with people from areas where that is seen as 'normal' (plus those who are massively inexperienced/don't look around much).

</comment><comment><USER5> In theory, every business will try to extract as much value from every employee as possible for the least amount of cost. This makes sense and is how capitalism works.

However, in bay area software companies, I see that most companies would rather extract more value from every employee, rather than cut employee costs by not paying higher salaries. When negotiating for a salary, for example, if you overbid too aggressively for your salary, often the result is that the company wants you even more, especially if you have a recruiter with a fat commission at stake! This isn't too surprising, considering that they're located in the bay area (as opposed to somewhere half the labor cost - <USER2> Austin). I know it's not possible for every business model, but If companies were serious about cutting costs, they'd start moving to cheaper areas in the US or even start outsourcing more to India and China ~ with considerable savings. Bay area companies, usually prioritize growth, above cutting costs, though this could change in the future as industries mature.

</comment><comment><USER6> Excellent post. Here are some personal experiences:

1\. Keep salaries secret. I like this part. I do not like socialist way of deciding salaries. I worked at a place where salaries were open and left within a year.

2\. Give raises randomly

Know several employers and CEO who do this as a policy. It is mostly like 'yeah lets give them $200 monthly raise' by making it sound like a big deal and then make them work on Christmas to recover it

3\. No conferences

Make fun of conferences before your employees. Tell them only bozos go to such idiotic nerdy places. We are cool guys we don't go there. I know several companies that work hard to deny their employees any networking opportunity.

4\. Spy on them.

Not aware.

5\. Make a deal with competitors

Dont know.

6\. Promote corporate values

I fell prey to this once. Not again. But the author has ignored trashtalking others. Saying things like "only morons work for google", "facebook is in death spiral".

7\. Help them survive

Correct. Innumerable examples of how employers use this techniq. This is most common when the employee is H1B. He/she feels indebted for getting the visa.

If the employer does not have 401K plan that employer is not worth working for more than 2 years.

<comment><USER7> Blatantly illegal, in the USA, anyway. Adobe, Apple, Google, and Intel already tried.

[http://time.com/76655/google-apple-settle-wage-fixing- lawsui...](http://time.com/76655/google-apple-settle-wage-fixing-lawsuit/)

<comment><USER6> Again, being illegal has not stopped Apple and Google from doing it. Remember tech industry is lot more people friendly than say aviation or biotech. Who knows how many other companies have engaged in this sort of predatory policies and government has not yet figured it out ?

Illegal is what government thinks people should not do, people do it all the time however.

<comment><USER7> Some things are illegal because law is the only protection against abuse by employers. Like this.

</comment></comment></comment></comment><comment><USER8> > Make a deal with competitors. Contact your major competitors in the region > and agree to not head-hunt their programmers if they don't touch yours. If > they reject this deal, try to recruit a few of their key engineers. Just > offer to double their salaries. You won't really hire them, of course, but > this move will definitely shake your local market, and competitors will be > afraid of you. They will agree to never touch your slaves developers.

illegal.

<comment><USER9> Steve Jobs did it anyways

EDIT: Why the downvotes? This above is demonstrably factual, and it doesn't necessarily imply that I _think_ that it should be legal nor that I think it was right for him to do it.

<comment><USER8> Just because a criminal commits a crime and gets away with it, and they still had to pay millions in settlement, does not mean that it's any less legal to do it. If you are not Apple, Google, et. al. that can afford millions of dollars in penalties, then I suggest you don't break the law. The 4 tech giants paid 345 million in fines for this.

<comment><USER9> At the time, I'm sure that the math worked out for each party involved though -- $80M per company sounds a lot less than the cost of losing crucial staff members to poaching, that's actually less than the cost of most of their real acquisitions (remember, there is lost knowledge, mindshare, and costs associated with re-hiring and training -- I've heard that it costs upwards of $100k to hire a single engineer at a big company, and then it can take up to a year for them to ramp up depending on the scope of the project that they're working on), AND there's a HUGE cost if you have to pay every single engineer a substantially higher salary.

You can't just slot in a new replacement body like changing a tire and then immediately start driving away full throttle whenever you lose a key engineer. Our jobs are so nuanced, and there's a ton of arcane internal knowledge that each person has that took a ton of time to build up and wasn't ever documented (a lot of the most valuable IP doesn't ever leave peoples' heads).

Not to mention, there are specialized "your company only" skills and human relationships that people develop that are only applicable to YOUR company that also took a lot of time and experience to build up. This is why I actually think it is worthwhile for HR to always give a counter-offer whenever an engineer decides to leave.

Plus, they thought they could get away with it.

On a parting note, calling Steve Jobs a criminal is certainly a debatable accusation 'round these parts.

</comment></comment></comment></comment><comment><USER9> Best way is to manipulate the supply side. Now you know why Zuckerberg wants everyone to learn how to code (it wasn't actually because of their supposedly "humanitarian" spin).

You can also go the remote work route (not sure why this is so shunned -- NOPE, I forgot; you can't do real engineering work unless you pay $3k/month rent to live in San Francisco and cram into a noisy constantly-distracting SoMa open office that smells like bum dung).

</comment><comment><USER10> > Keep Salaries Secret

This is something that's actually an offense that can get you fired at my company. Their justification is "to reduce gossip".

<comment><USER11> To simplify a bit, if your company is based in the U.S. and subject to National Labor Relations Board jurisdiction, this is illegal. Knowledge of this is a nice tool to have in your back pocket while dealing with management and HR.

(Further information on whether your company is covered: [https://www.nlrb.gov/rights-we-protect/jurisdictional- standa...](https://www.nlrb.gov/rights-we-protect/jurisdictional-standards))

<comment><USER10> Not in the US unfortunately. Don't know enough about labour laws in my country but I doubt there's gonna be something in there.

<comment><AUTHOR> You can use sites like Glassdoor to get around this (I'm not affiliated with them in any way). Or start your own glassdoor, more as a public service (even if you don't make money from it) -- let people post their company and salary, so others can see.

Glassdoor is a site that lets you view reported salaries from different companies. They're doing lots of things now, but that was the original value prop for that site, IIRC.

</comment></comment></comment></comment><comment><USER12> Ha! So that's the guide the managers at my previous workplace were following! Explains a lot. ... I did say _previous_ workplace.

</comment><comment><USER13> lol, satire at its best, I saw all these things in my career.

> Keep salaries secret.

This is standard procedure and doesn't work. Sure some of the really highly paid people will keep their mouths shut, but the rest will talk.

> Spy on them.

Doesn't need to be IT spying, a "You have to be in office with us, so we can work more productive!" is enough distrust for me to "not" join a company nowadays.

> Make a deal with competitors.

Not just a problem of big corp employees. Often the CEOs of the tech companies of the same size in one city know each. My girlfriend works as a marketer for an agency and they got a big consulting gig with new tech, from a startup, they should set up for a big corp. Now she became a pro in that tech, but she can't apply to the startup, because the CEO of her agency is "biggest friend" with the CEO of the startup.

> Promote corporate values.

I worked for a company for about 5 years. They tanked and got buyed by an investor. He replaced the management completely with some generic corporate guys. Then these guys ran around preaching our new culture and corporate values as if they have always been there. It felt kinda 1984'ish. I mean I worked there more than half of the time the company even existed, they just got there and tried to tell me how things are running there. Well then I quit, lol.

> Stress them

Luckily I only stress myself and am quite chill about other peoples problems.

> Cushion chairs and tennis tables

I was at a few meetups in my city, which were in the offices of startups. They are quite stereotypical. Big open offices, ping-pong-tables, etc. I always have to think about these images of the industrial age, where hundrets of women had to sew clothes in big industry halls. The idea to work there is quite scary to me.

> Give them sound titles.

Yes, they throw these titels around without any questions asked. Beside the C-level stuff you can be anything. And if you play your cards well and the company gets big it could be that your "dumb titel" gets you a nice place somewhere.

> Help them survive.

This doesn't work too good. Only with very awkward programmers, I think. The problem with most programmers is, they get mad money, often even if underpaid, and live quite frugal. In 2 years I saved enough money to stop working for 1 year, so I only used ~50% of the money I got. Also the unemployment help in our country is 60% of your last income and is paid for 12 months (9 if you quit yourself). So if you can create software, you're pretty free to change to a different employer quite quickly.

> Be a friend.

This often doesn't work well with me. I live a rather deviant life, most people don't know what to make of it. They start to go on a personal level, but are overwhelmed by what I'm doing or I don't even respond to their connection attempts, because of my negative experiences in the past.

</comment><comment><USER14> Duplicate? [https://news.ycombinator.com/item?id=13116991](https://news.ycombinator.com/item?id=13116991)

<comment><AUTHOR> Just a note -- HN usually does a pretty decent job of catching reposts/duplicates when you submit the story... I've tried to submit stuff sometimes and been notified that it's been posted already.</comment></comment>


Mona Eltahawy says the time for being civil, peaceful and polite is over - <AUTHOR> https://www.cbc.ca/radio/outintheopen/i-want-patriarchy-to-fear-women-mona-eltahawy-says-the-time-for-being-civil-peaceful-and-polite-is-over-1.5296597 <comment><USER2> TLDR: Reaction to the Islamic male-dominant culture.</comment>


Math for Programming - <AUTHOR>

What are the best areas of math to have a firm understanding of that would help with learning how to program, beyond the concepts of basic algebra? <comment><USER2> Depends how far along you are and what sort of programming you want to do really.

Discrete maths and logic are probably the main areas of maths useful for computer science. Maybe look for a book on discrete maths for computer science. Set theory, graph theory etc too.

If you're interested in games and simulations then linear algebra, multivariate calculus, basic differential equations

If you're interested in data mining, some probability theory and statistics wouldn't hurt.

<comment><AUTHOR> Thanks for the reply. That gives me a good idea of how each different branch of math could relate to different types of programming. I'm a fairly new programmer, and I have always loved math, but I never took higher math courses. Now that I've become interested in programming, I wish I would have really broadened my mathematical horizons when I was younger.</comment></comment>


Ruth Bader Ginsburg Thinks Some College Title IX Trials Are Unfair to Accused - <AUTHOR> https://reason.com/blog/2018/02/19/ruth-bader-ginsburg-due-process-me-too <comment><USER2> The _Reason_ piece is a commentary on an interview with Judge Bader Ginsburg in the _Atlantic_ ; the full piece is here: [https://www.theatlantic.com/politics/archive/2018/02/-/55340...](https://www.theatlantic.com/politics/archive/2018/02/-/553409/)

<comment><USER3> Probably the most important piece of that article starts with "Rosen: Is there any area for progress in the law and might your dissents in sexual-harassment cases be vindicated?".

</comment></comment><comment><USER4> It's hard to imagine there are many folks who work in the legal world wouldn't be shocked by some of practices at colleges. Colleges shouldn't be playing the amateur legal system game, and they're doing a great job of proving why at seemingly every turn.

After a local university in my area did a review of their processes some of the recommendations were pretty shocking. Things like "the accused should be allowed to present evidence", "the accused and accuser should be allowed to have or provided representation", "the accused should be notified of appeals". It's hard to have a response that isn't a WTF.gif to things like that.

</comment><comment><USER5> Kangaroo courts, plain and simple. Sacrificing innocent people to get more of the guilty ones when evidence is flimsy.

<comment><USER6> Not even a court. Pretty much _you_ have to prove that you didn't rape her 14 months ago. Of course she reported it this late because she was ashamed or whatever. Meanwhile, your life is ruined. Sex is not like a dishwasher you can return within 30 days if you regret it later.

I have a feeling that a lot of these actresses knew what they exactly what were doing. They made a bet, and now they want to blame the other side 100%.

<comment><USER5> "I have a feeling that a lot of these actresses knew what they exactly what were doing."

I think that goes way too far.

<comment><USER6> No it doesn't. Want to secure the role so the other actress doesn't get it? What I said, doesn't apply to Weinstein types

<comment><USER7> This crosses into trolling on what is a particularly divisive topic. We ban users that do that, so please don't post like that here.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment></comment></comment><comment><USER8> I wasn't familiar with reason.com. Looked through a bit, it looks like it's a digital publication with a libertarian angle:

[https://reason.org/frequently-asked- questions/#q1](https://reason.org/frequently-asked-questions/#q1)

Not an issue per se, but good to know.

<comment><USER9> Why "not an issue per se" and not "not an issue at all"? There is a bit of subtle implication there.

Libertarians care a great deal about civil liberties so this perspective is also not a shock.

<comment><USER10> Libertarians have a very conflicted position with respect to civil liberties. For them freedom of association often trumps access to markets. This has created a weird pseudo-alliance between Libertarians and those who would limit access to markets based on genetic attributes. The Libertarians tend to downplay this fact, but not to the point of generally preferring market access over freedom of association.

</comment></comment></comment><comment><USER11> It's important to distinguish between the policies of specific campus sexual- assault review boards and what was set forth in the 2011 Department of Education "Dear Colleague" letter.

There is nothing objectionable in the "Dear Colleague" letter, and it articulates sound policy for American colleges. While it is true that colleges must adhere to a "preponderance of the evidence" standard or risk falling out of Title IX compliance, a) preponderance of the evidence is the appropriate standard to use in non-criminal proceedings, including and especially civil- rights violations which are what Title IX covers; b) colleges also risk falling out of compliance of Title IX if the accused and the complainant do not have equal access to information used at the hearing, or equal time and opportunity to present their respective cases.

Whenever disciplinary investigation by a school for sexual assault becomes a "kangaroo court", it is almost assuredly a CYA move on the part of the college staff to look like they are "doing something" about campus rape without following the procedures set forth by the government. But it's not only unfair and against the law, it's in violation of Title IX and the very letter the MGTOW crowd has been whinging about.

Oh, and Betsy DeVos is an idiot for overturning this policy.</comment>


Buying, renting, or "Airbnbing" a house. Find if the neighborhood is right - <AUTHOR> http://www.thehomesites.com/premiumness

<comment><AUTHOR> Search for the right house begins with the right neighborhood. Get neighborhood premium scores</comment>


Kid Crazy: Why We Exaggerate the Joys of Parenthood - <AUTHOR> http://healthland.time.com/2011/03/04/why-having-kids-is-foolish/ <comment><USER2> Pretty silly all around. The main thesis here seems to be "raising children costs money and is sometimes frustrating, and it is therefore illogical and foolish". When parents say that even though children are raised at significant emotional and financial expense, they are great and awesome, researchers write it off as "illogical" or stupid, and hold up the study as evidence of human irrationality and stupidity, with the implication that smart people wouldn't want children after seeing they cost money. I don't know whether the study really makes the conclusions the article claims, but the article at least is ridiculous in its supposition.

If you only care about money, having children is obviously not smart, as children generally cost money and don't produce it, even later in life. If you care about a fulfilling life more than a filled bank account, then raising children is one of the most important activities a person can do.

<comment><USER3> The economists' models of the world are notoriously flawed and dangerous precisely because they leave out non-easily-measurable results and consequences.

<comment><USER4> I couldn't disagree more. It's normal human judgment reactions that are notoriously flawed. For example, the USA's absurd over-reaction to terrorist attacks is something that any economist can tell you is stupid.

Modern statistical tools allow economists to ferret out the most obscure factors. They're remarkably good at this, although not infallible -- our continued poor understanding of macro issues is a glaring example, but the topics being discussed here are decidedly micro.

I think the real answer to your comment is that economic models are (frequently) far more pointed than people like to admit. When they're forced to confront the fact that their observed behavior doesn't match what they espouse, they prefer to shoot the messenger rather than admit that they're not practicing what they preach.

<comment><USER5> _Modern statistical tools allow economists to ferret out the most obscure factors._

Did you read the article? It doesn't ferret out any obscure factors? It has people read an article and then make some statement. And even then it doesn't even compare against those who don't have kids, but wanted kids or a whole slew of other useful controls.

But more importantly read the headline to the article, "Does having kids make parents delusional" -- yet NONE of the tests were about that. The tests were "Does Pointing out the Benefits of Parenting Reduce Its Perceived Benefit". That's a totally different story.

</comment></comment></comment></comment><comment><USER6> I agree that kids might reduce your short-term happiness. You're sleep deprived, they're expensive, and damn do they make some noise...

On the other hand I've never had so many feelings of deep _satisfaction_ as with my kids. It all depends on how you define happiness.

Happiness = easier life, more money, more sleep.

... or you could say

Happiness = building, nurturing, giving, sacrifice.

Both are true and valid, and neither needs to be judged. I just want to point out that the decision to have kids isn't necessarily about rational happiness- maximizing choice.

#3 is due in April, wish me luck!

</comment><comment><USER7> >Couples who choose not to have kids also have better, more satisfying marriages than couples who have kids.

Well, of course, given that some couples have kids by accident. If you agree to wait on having kids for five years, then -- whoops! -- pregnancy, that would have a bad effect on satisfaction. Also there's the fact that couples who choose not to have kids have thought about and discussed their opinions on children. Couples who do that are likely to communicate better -- another reason they'd be more satisfied. I looked at the cited study, but could only read the first page. I didn't see anything saying they did anything to address this. Of course, I didn't see anything saying they didn't.

<comment><USER5> Additionally he doesn't apply the same rationale here. Maybe couples w/o kids report more satisfying marriages, because they need to rationalize it more since they didn't have kids.

</comment></comment><comment><USER8> May be its a cultural thing. I know a few couples in India with no kids and more they age, more their life self-admittedly sucks.

Then again, the culture I grew up in sees kids as an investment. The investment pays off when kids grow up and help their parents retire and support them financially and otherwise.

<comment><USER9> Wow. I'd never considered having kids as a retirement plan. I shudder at the thought of a prospective parent that is considering it from that angle.

<comment><USER8> What's so wrong about it?

</comment></comment></comment><comment><USER10> How do you even respond to an article like this?

"Yes, I am very satisfied with my decision to become a parent. My children add a lot of stresses to my life, but the deep satisfaction of seeing them grow and mature, laugh and play and cry, is more than worth it."

"No, you're not, actually. I have scientific studies showing that you are actually very unhappy and unsatisfied."

"..."

Don't we each, as individuals, get to decide whether we are happy, joyful, satisfied with our lives? Is not the right to define what happiness means to us inherent in our rights to "life, liberty, and the pursuit of happiness"?

</comment><comment><USER11> Obviously someone who looks like this wrote an article like this from a neutral viewpoint:

<http://en.gravatar.com/thejohncloud>

He should have just said "Don't have kids because you can't take them into a martini bar"

<comment><USER12> That's the best rebuttal you can offer?

<comment><USER13> I dunno, I think it's kinda funny. It's the sort of jab that points out that the kind of person who bluntly asserts raising kids is stupid is happier boozing at status joints and pursuing endless 'city glamor'.

</comment></comment></comment><comment><USER14> Kids aren't for everyone. For that matter, neither are marriage, startups or traveling. The only difference with kids is there is no "undo" and you can't quit. If you don't want to live a selfless lifestyle, don't have kids.

My son just turned 18 months and my wife and I couldn't be happier. We won't be able to buy the new iPad but my son is far more entertaining. And I feel like my wife and I have grown closer since having him. So, to each their own. It's laziness to pretend life is as black-and-white at the writer presents.

</comment><comment><USER15> Life itself is foolish. Still worth doing though.

<comment><USER16> Well put.

</comment></comment><comment><USER17> My baby boy was born 3 weeks ago and the moment I first saw him was truly the happiest one I've ever experienced. I would waste letters trying to describe it but let me tell you: I could own 3 Googles and 2 Apples and I still wouldn't be as happy as I was in that moment. No amount of comfort can buy such happiness.

Having a kid means experiencing both emotional highs and lows but the former certainly outweigh the latter. If you could -- and you can't -- compare this to business, then not having kids would be like spending the rest of your days in a secure, well-paid, boring, lifeless, 9-to-5 job.

</comment><comment><USER18> This article is pure nonsense. So you can influence the results of surveys by asking people to read something before taking it?

Thank you, captain obvious.

PS having kids is challenging, expensive and fantastic. Sort of like a startup, but not really.

</comment><comment><USER19> Interesting piece, but overall, I want to see hard data about family make up. Ideally you would have surveys and learn more about the couple's state of minds before, during (pregnancy stage) and after having a kid.

Just from my observation, I don't have facts, just opinion, but couples who wanted to have kids will be the first to tell you they love it. Couples that had kids by accident are either not happy, happy, or indifferent. The last category are couples where one of the two wanted kids and the other didn't so overall, there was dissatisfaction.

To me it seems to be all about expectation and reality.

<comment><USER20> There's ownership bias at work, as well. Regardless of the value of something, if you feel that it's the result of your "work", you feel more positive about its value than if it's just "given" to you.

Buy something from Ikea and put it together, and you'll feel better about it than if you bought it already put together for the same price. It's totally irrational, but it's also true.

<comment><USER10> "It's totally irrational"

It is totally rational.

What a boring, pathetic, self indulgent existence to never participate in creating something of value. Even screwing some legs on to a table adds a tiny little bit of value to the world around you.

<comment><USER20> "What a boring, pathetic, self indulgent existence to never participate in creating something of value."

Please don't make broad value judgements about other people's existence and value systems, based on a single HN comment. Thanks.

It's only "rational" to place more value on the final result if it is objectively of higher quality than the alternative where someone else makes it. Hence my original comment. I made no comment about any side-effect benefits from doing it yourself.

</comment></comment></comment></comment><comment><USER21> The most valuable startup you can give to the world is well raised child

<comment><USER22> no, it's not. facebook, love it or hate it, has contributed more value to the world than the average well raised child. then again, some might say it's easier to raise a child well than to start another facebook :P

</comment></comment><comment><USER23> One of the interesting dilemas with the whole idea of "invest in future care instead of kids" is the question of whom you'll be purchasing that care from? And at what price?

If society collectively gets more 'rational' (as per the author's'view of rational) then the cost of end of life care, due to a massive supply drop off since fewer people having had workers/babies, would quickly eclipse even the most ausiduous of saver's life savings.

And who's'the only one that would take care of you at a price below the running market price for the service you need? One of your offspring?

When stuck in the myopic world of dollars and cents caution is advised, lest you end up in a world. Where you are only seen yourself in terms of dollars and cents

</comment><comment><USER24> On at least two occasion I was speaking with people relatively old, one who was close to dying, and one thing they said they were sad about was not having kids.

How you feel or how happy you are in the moment is unrelated on what your future self will think is important.

</comment><comment><USER25> I suspect that one could show, by the same methodology, that each of the following is foolish: buying a house; going to graduate school; starting a business; mastering something difficult; volunteering; being active in the community; ...

</comment><comment><USER26> "It's cheaper to hire end-of-life care than to raise a child" Maybe the reporter should tell that to this lady [http://www.asiaone.com/News/AsiaOne%2BNews/Singapore/Story/A...](http://www.asiaone.com/News/AsiaOne%2BNews/Singapore/Story/A1Story20110308-267088.html) reported today Mar 8

In a nutshell, she looked after this autistic child who was abandoned by his parents at 3 and is now 13, and was quoted as saying "I don't expect him to take care of me in the future. I just hope he can take care of himself"

</comment><comment><USER27> A recent study actually found that while younger parents were less happy than the childless, older parents were happier than older childless people: [http://www.sciencedaily.com/releases/2011/03/110307065539.ht...](http://www.sciencedaily.com/releases/2011/03/110307065539.htm)

</comment><comment><USER28> What the Eibach and Mock studies show is that if someone criticizes something you have a lot invested in, like having kids, you will get defensive and exaggerate the upsides. That doesn't say anything about whether having kids is foolish - maybe the upsides really DO outweigh the downsides.

</comment><comment><USER29> From an evolutionary-biology perspective, the author is simply competing. If he convinces you not to procreate, his children will have less competition to worry about. He's probably not even self-aware to the point where he realizes what he's doing. Lame.

<comment><USER30> Only true if the author has kids. He doesn't seem to. Do you think he's a crypto-parent?

<comment><USER29> Nothing is stopping him from having a revelation that he's totally wrong a few years down the road and pop out a kid. I doubt he thinks that far ahead though. Probably just likes knocking up random women.

</comment></comment></comment><comment><USER31> Stopped reading because I promised myself I would never let Time and other "mass circulation" magazines teach me new scientific arguments or concepts now that superior resources are so convenient.

</comment><comment><USER32> I agree with this article's central theme. People who don't grasp the basic concepts of economics or parenting should not have kids, its not fair to the economy and its not fair to the kids.

</comment><comment><USER33> I can't imagine how people with kids get jobs. I suspect there is a double standard, if you have no kids, we are going to give you 3 or 4 rounds of interview hazing, but if you have 2 or 3 kids then the bar for entry is much lower because he can't be expected to work like a single male with almost no social life.

<comment><USER34> That's an interesting thought, but do you have evidence supporting this?

Another interesting tidbit about society favoring families with children is the tax implication. In particular, you can claim kids as dependents (which, of course, they are), but claiming dependents gets you tax breaks (and other tax credits).

I'm not saying that's wrong :)

It would be interesting to look at all the tax credits and build the profile for the "optimal" family from a (US) society perspective (as expressed in tax advantages). Then compare that to other countries. This could make a sweet info graphic...

<comment><USER10> On the other hand, my kids' taxes are almost certainly going to also be paying for the retirement of those people who chose to not have kids.</comment></comment></comment>