SaaS CTO Security Checklist - <AUTHOR> https://www.sqreen.com/checklists/saas-cto-security-checklist <comment><USER2> > Enforce a password policy

> (links to [https://www.digicert.com/blog/creating-password-policy- > best-...](https://www.digicert.com/blog/creating-password-policy-best- > practices/)) where they give the usual (at least 2 special characters, but > not " or \\) advice

This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1].

[1] [https://auth0.com/blog/dont-pass-on-the-new-nist-password- gu...](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/)

<comment><USER3> Starting to feel like this is one of those things that people just blindly parrot all over the Internet without understanding the full context of the NIST guidelines, and as a result are actually causing many security problems.

You can't take one recommendation that you like out of a whole body of work and start running around telling everyone to do this one thing. If you're going to follow NIST, you need to do all of it. MFA is a big part of why complexity is reduced in the NIST guide, and you MUST have it if you're going to remove complexity requirements. If you can't have MFA for some reason (and yes, there are legitimate reasons for this), then you still need to use complexity, expiration, etc.

<comment><USER4> If for some reason you're stuck without MFA (and I appreciate why it happens), I can't agree short expiration adds value.

I've done brute force exercises. Some people always pick bad passwords. Tell an organisation to change every 60 days and a lot more people give up and land on May2019!.

<comment><USER5> This 100%.

I have a complicated google password - I use it no where else. I have a security key. In 12 years I've NEVER had to change my google account password AND I have not been hacked. This works well. Because google is resistant to brute force I don't even bother adding tons of weird special characters.

I worked at a govt related agency. They had to change passwords every 30 days and there was a dual password requirement (one to login to the VPN, the next for the app). Result?

      - Many folks used a shared account with a public password emailed out every 30 days so everyone else did not have to deal with all the hassles of the password expiration dance. It was also super hard to onboard anyone new (ie, 3-4 months for staff with 12 month projects) This account ended up posted next to every computer.

The idea that making security so user unfriendly will makes folks like and use security is a ridiculous approach.

\- Rate limit attempts \- Block after 4 tries for an hour, after 8 tries till a reset \- Screen against password lists \- Screen out other obviously bad (ie, too short etc). \- Allow hardware 2fa BUT allow staff to validate computer.

This alone gets you a ton of mileage

<comment><USER6> So much this.

If you make your security policies into a problem for your people trying to do their work, they'll find ways to work around it.

That either means 1) your policies are misplaced and you need to relax then, or 2) you need to fire everybody who creatively works around them.

If your adversary is Mossad, the option 2 is the right one. If your adversary is not-Mossad, you can almost certainly have a security policy that people won't feel the need to work around.

There are, of course, shades of grey below "Mossad adversaries", but in my opinion at the upper end of that you have policies that include providing every employee with a good password manager, TOTP apps/devices, and/or USB 2FA keys - and choosing services which integrate properly with them.

"Change your password every X days" is an admission that you're going to leak passwords somehow, and that you only care about your data/systems enough to close the attack window down to X days. Which means you're screwed before you start, and may as well just turn everything off now.

</comment></comment></comment></comment></comment><comment><USER7> Discussed previously:

[https://news.ycombinator.com/item?id=16615593](https://news.ycombinator.com/item?id=16615593)

In the year this has percolated with me, I've grown to actively dislike it. I have three major problems with it:

1\. This cutesey "seed, A, B" triage scheme is misleading. In reality, you can break everything down into just two categories: "do it before product/market fit" and "do it after product/market fit" (or "now" and "later", or whatever you'd like to call them).

2\. Most of what this list defers to later phases shouldn't be deferred --- or at least, if you're going to do it at all, there's benefit to doing it early. Monitoring computers? Much harder to start at "series B". SDLC? Same. Share accounts until "series A"? I like how their product category, "RASP", is assigned "seed" stage, though.

3\. It's not internally consistent, or, at least, to make it internally consistent you would have to make silly decisions. For instance: use 2FA where possible early, and _later_ centralize authentication?

I feel like this list is unserious, and serves essentially the sole purpose of putting "RASP" on the "do now" agenda.

<comment><USER8> 2FA on SaaS applications is free and easy, while centralising authentication is much harder - you need to manage an authentication platform instead of just using the application's own authentication.

Taken by itself the suggestion is odd, but in concert with the next entry "use password management software" it makes for a low-cost, zero management, higher security stance than not suggesting 2FA by itself. Noone should _ever_ ignore the option to turn on 2FA.

</comment></comment><comment><USER9> This list seems incredible helpful. As a security-conscientious CTO, one of the challenges I faced was determining how much we should be doing now (during YC and while raising our seed round) versus pushing down the line. For example, we obviously should be monitoring outdated and insecure dependencies from the outset, but when is the right time to switch our servers and external tools to centralized account management, or to pay for an external pen test.

Now, I would probably move the external pen test up to seed if the company is well-funded (e.g. post demo day) and holding PHI. But that's personal preference and my security paranoia talking. Overall I think this list really gets it right.

I also liked seeing a recommendation against sharing your WiFi network in the seed stage. Network segmentation to separate your computers and IoT devices, printers, etc. should probably appear somewhere in series A/B.

<comment><USER7> The best indication that you need an external penetration test is that you have client prospects demanding to see the output of those tests. A less important indication would be that you (1) have product/market fit, (2) have implemented your core product, (3) can predict what development on that product will look like for the next 12 months, and (4) have revenue sufficient to eat the $20-30k cost of a penetration test.

I would not generally recommend that seed-stage companies contract out penetration tests simply because they've raised enough money to do so. You should be on a relatively stable, predictable path with regard to product engineering before you start asking contract pentesters to beat you up.

I feel like this is a pretty good illustration of how _not_ useful lists like these are. It's simplified down to this "seed", "series A", "series B" thing in order to suit the format and make it punchy; the real, serious advice isn't as slick, and doesn't showcase their product, so it's nowhere to be found.

</comment></comment><comment><USER10> I really like this idea - alot.

But aimed perhaps at everyone, not just the CTO.

In fact the CTO probably needs one thing on their checklist.

Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly".

And if the company has the financial resources:

Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist quarterly".

I don't see any value in relating anything to the financial stage of the company because it's irrelevant.

Security also needs a time and priority aspect to it. For example if your company hasn't done anything on the checklist yet then what should come first, what is most important? Also it would be good to know what are the biggest typical weaknesses - a security chedclist can have so much stuff on it that it becomes hard to know where to focus.

<comment><USER11> > Checklist item 1: Hire an outside security auditing firm to report on the > state of this checklist quarterly

Security auditing firms cost a lot of money. Money you don't have when you're a small startup. Besides, an auditor _audits_ and the hard part about this list is implementing it. Until you can afford to hire someone to take care of security, it's usually the CTO's job to make sure security is not an afterthought.

> I don't see any value in relating anything to the financial stage of the > company because it's irrelevant.

It is extremely relevant, for at least two reasons. The first one is that the company's financial resources dictate what you can or cannot do (e.g. hire a dedicated security resource, pay for pen testing). The second is that some recommendations just don't make sense before a certain size (e.g. there's no sense in setting up an AD and GPOs when there's just 3 of you in the company).

<comment><USER12> How lucrative is security work? It's a direction I've been considering moving towards but the salary info I've seen is not great. Am I looking up the wrong terms/titles?

<comment><USER7> As an employee, application and infrastructure security work pays somewhat better than normal product engineering work (there are good jobs and bad jobs, of course).

There are lots of security jobs that don't pay especially well and are career dead-ends --- enteprise IT security isn't a good place to end up, nor is sales engineering ("security engineer") for security product companies, nor is malware analysis.

My feeling is that software/application security consulting is a reasonable route to go, if you want to work for a consultancy, but I'd be wary of any other kind of security consulting.

<comment><USER12> Thanks for the insight!

</comment></comment></comment></comment></comment><comment><USER13> "At Sqreen, for example, if someone catches another person's laptop unlocked while they're AFK, they can type "Cookies!" in that person's Slack. That person will then have to bring in cookies for the office!"

This sounds like a fun idea, but has anyone ever refused to bring in cookies?

<comment><USER14> I'd be more inclined to do a "drinks" option.

<comment><USER15> Except for those that obstain. Of course, not all people can eat cookies either, I suppose.

<comment><USER16> Psst…I think you meant "abstain".

<comment><USER15> whoops

</comment></comment></comment></comment></comment><comment><USER17> The slider of funding rounds is a neat idea but it's kind of hard to read in chronological order without mentally keeping track of which items appeared each time I slid it forward.

Would love to see a plain, non-javascript version of this content.

</comment><comment><USER18> Don't know if the post author is the one who submitted it here, if so, it would be way nicer to read the list if items within each category (employees, code, ..) would be sorted by timeline (seed, series a, series b+).

<comment><USER19> Thanks for the feedback! That makes complete sense. We are going to update that

<comment><USER20> While you're at it, "Monitor your user's computers" appears twice. The first time under your users appears to be correct, but the second occurence has a description about how lets encrypt is a free, easy to use option. I'm guessing the second heading should be "Use encryption on all your web sites and APIs" or similar?

<comment><USER19> Thanks! Deploying the fix and stealing your heading suggestion :)

</comment></comment></comment></comment><comment><USER21> > Connections to your infrastructure and non-public properties (hosted CIs, > admin interfaces, databases etc.) should only be accessible through a bounce > host (in a VPC, behind a bastion host or VPN, etc.).

How valuable is this?

I see articles for [1] and against [2] this practice.

And not a lot of interest in the subject from security SE. [3]

[1] [https://cloudacademy.com/blog/aws-bastion-host-nat- instances...](https://cloudacademy.com/blog/aws-bastion-host-nat-instances- vpc-peering-security/)

[2] [https://medium.com/@henriksylvesterpedersen/you-dont-need- th...](https://medium.com/@henriksylvesterpedersen/you-dont-need-that-bastion- host-cd1b1717a9e7)

[3] [https://security.stackexchange.com/questions/194024/should-i...](https://security.stackexchange.com/questions/194024/should- i-have-an-ssh-bastion)

</comment><comment><USER22> Lots of talk about passwords, but fewer about password managers. The password managers listed in this do not protect against backdoors. Lastpass, for example keeps all your passwords in plain text once you've unlocked it. Passwords stored in Apples Keychain can be synced across devices and a remote attacker can do something like a sim port, gain access to your iCloud account and then sync to their computer leaving you vulnerable.

Password managers should be bound to hardware tokens and each password should be individually encrypted, as well and individually decrypted that also force physical tap.

Password Store is a perfect example of this. Physical password managers are also on the rise, see: Ledger and Mooltipass

<comment><USER16> I think you need to provide approval from one of your other devices, or enter your iCloud security code before the sync can occur.

<comment><USER22> iCloud security code can come over SMS if your account is configured as such, therefore the above example of a SIM port applies

<comment><USER7> No, the iCloud second factor can come over SMS. That's not the same thing as your iCloud password.

</comment></comment></comment></comment><comment><USER21> They also have a good free site security eval:

[https://www.sqreen.com/scan](https://www.sqreen.com/scan)

It was after that I found out the only way to have HSTS for Cloudfront/S3 is creating your own Lambda@Edge function [1] :/

[1] [https://aws.amazon.com/blogs/networking-and-content- delivery...](https://aws.amazon.com/blogs/networking-and-content- delivery/adding-http-security-headers-using-lambdaedge-and-amazon-cloudfront/)

<comment><USER23> The correct entry URL appears to be [https://www.sqreen.com/scanner](https://www.sqreen.com/scanner) .

<comment><USER24> This is... not a useful general-purpose scan tool for web APIs. A warning because port 443 is open, no kidding? And a lot of carping about HTTP headers relevant to frontend apps.

</comment></comment></comment><comment><USER25> While it's easy to pick holes in specific areas of this, overall I really like the layout and presentation of the advice.

</comment><comment><USER26> [The SaaS] CTO Security Checklist

Just a small correction.

<comment><USER27> The majority of these items are applicable to any startup.

</comment></comment><comment><USER28> It kinda reminds me of TwistLock (which just got bought for a boatload of money).

</comment><comment><USER29> SAASPASS can do most of the items covered. 2FA Computer Protection with 2FA Enterprise Password Manager Single Sign On Directory Services

<comment><USER30> It's not exactly sporting to plug the product you work on without disclaiming that you do[0].

It also seems half-baked, to be frank, and really doesn't seem like it does "most of the items covered". The badly-written marketing all over your website immediately makes me think you're borderline scammers, too--I've got my beefs with Okta but they aren't trying to scare me about "man-in-the-mobile" attacks just because they use push notifications rather than SMS.

If you're serious about putting forward your product as a serious option in this space, can you tell us why we should trust you and how you're demonstrating that you deserve it?

[0] - [https://news.ycombinator.com/item?id=19714999](https://news.ycombinator.com/item?id=19714999)</comment></comment>


What's best payment gateway for startup? - <AUTHOR>

For my startup, I'm looking for payment gateway. what would be ideal gateway for every transaction between $8 - $10 and monthly volume of $100K? Also which should be scalable.. <comment><USER2> country?

<comment><AUTHOR> It's for USA</comment></comment>


How to make a voice activated LED facemask - <AUTHOR> https://medium.com/@tglaiel/how-to-make-a-voice-activated-led-facemask-diy-guide-b300bc146f38 <comment><AUTHOR> See also this tweet: [https://twitter.com/TylerGlaiel/status/1265035386109128704](https://twitter.com/TylerGlaiel/status/1265035386109128704)</comment>


IOTA Flaw Mails Leaked - <AUTHOR> https://twitter.com/tangleblog/status/967513038374031360?s=08 <comment><USER2> Maybe instead of whipping up a pdf like Manafort that requires trust in the authors copy/paste & editing process it would be better to see the real email conversations incl. message headers. Not saying this isn't how it unfolded but this isn't <evidence> either.

Why go through the trouble of creating a pdf from different emails (he calls "letters") when he could just save the messages verbatim as plain text incl timestamps & other metadata. This sure smells like nonsense.

</comment><comment><USER3> Main discussion (135 points, over 80 comments): [https://news.ycombinator.com/item?id=16457120](https://news.ycombinator.com/item?id=16457120)</comment>


Why Germany Educates International Students for Free - <AUTHOR> https://www.insidehighered.com/news/2017/04/27/germany-sees-benefits-educating-international-students-free <comment><USER2> My personal experience says, that it is not working out. I cannot tell for the whole country, but I do have some insights, since I am hiring and interviewing students and studied in one of the universities mentioned elsewhere in the thread. There is an English speaking Master program, consisting almost entirely of Pakistani and Indian students. Some facts about them:

\- They are not required to learn German, so they speak very little to sometimes none at all. \- They can only pick companies where speaking only English is tolerated. \- Since they speak English, they tend to stick to themselves and cannot integrate. Some of them have a hard time even ordering food. \- Indian Bachelor degrees are not comparable to German degrees. I have the feeling that there are some good universities, but others are nowhere near the German standard. Their skill levels are usually lower than these of their German counterparts. It makes sense: I have talked to people, who came from a small village and used a computer in their undergraduate course for the first time. \- When you talk about their plans, it becomes clear, that they aimed for the US or the UK and took Germany only for the price and are often not planning to stay, but to take the next opportunity to board a plane to the US.

At the moment I do not think it makes any economical sense for Germany. I would do the following:

\- mandatory German language courses \- mandatory German language knowledge, even for English speaking courses \- much stricter admission standards, individual tests instead of trusting non-EU standards \- better integration with the labor market \- maximum to the number of months you can stay in a dorm (already the case for German students) \- initiatives to form German + foreign flat shares (primary way of living for students in Germany)

At the moment we are just sending the bad students back home and the good students to the US, after they got a free education here.

The local university close by reacted and increased the required GRE test scores to Ivy League level. The admissions dropped by an order of magnitude.

Germany is very social-democratic when it comes to education, so politicians avoid the word "elite", but when it comes to picking talent, you really should not. I think Germany should capitalize on the political climate in other countries and pick quality over quantity. A tax paid university should not be a third-world aid program.

<comment><USER3> This comment is so German on so many levels.

The reason those people aim for jobs in the UK or US is because there aren't good tech jobs in Germany. Arguing for mandatory German classes to 'lock in' talent somehow is simiarly uninspired as tech companies here. What about creating jobs that good people are willing to work at?

<comment><USER4> If you'd double my salary I still wouldn't move to Germany. Learning a new language is too big investment.

<comment><USER5> I can't speak for Germany, but e.g. in Norway and the Netherlands which I know best, there are a lot of nice tech jobs and you don't have to speak a word of the native language. I know because I've had colleagues over a decade who don't speak the native language and who are still just fine.

Most tech companies today use english as work language anyway. Not necessarily social talk among people, but usually in meetings, emails, documentation etc.

Still I recommend learning the local language. It has advantages but it is not something you are completely dependent on.

<comment><USER4> You can survive sure, but I'd be really hard and expensive to start a company. How am I suppose to read german law and fill government forms? Have a lawyer to everything for me? Thanks no thanks.

<comment><USER6> You'll have a hard time starting a company or anything without consulting a lawyer or legal service in Germany. And you won't be taken seriously e.g. by banks etc. Fortunately, cost for legal advice on this matter is significantly less than in the US, AFAIK. Plus, you have the bonus of being able to do business in 27+ countries with marginal or no extra effort.

<comment><USER4> In that case I'd prefer to start a company in Poland. Much lower taxes, cost of infrastructure, legal, labour, capital requirement for LTD (25000 EUR vs 1200 EUR).

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> The article is wrong on so many ways.

The author states that foreign students _plan_ on staying in Germany, however that is not what is actually happening. 41% of students abandon their studies before they have a degree. Out of the students that finish their degree, only 36% remain in Germany. Out of those remaining, more than half of them need more than 1 year(!) to land a job, indicating that they may not have the best grades or skills.

Furthermore, many seem to assume that Germany somehow needs to offer this tax payer subsidized "free" university program to attract foreign students to fill shortages in the workforce. This is not the case. First, despite constant media reports saying otherwise, there is no major talent shortage expect in very few niches. Second, any EU-citizen (thats 600+ million people outside of Germany) can work in Germany without any permission required. Third, for non- EU citizens there already is a visa program (the "blue card") that allows them to work in the EU if they are qualified, e.g. have a Masters degree from their home country.

In summary: German tax payers are asked to fund the education of foreigners at little to no return. Given the "free" nature of the program, it attracts rather unqualified students (or, lets say at least not the top notch).

All this may sound harsh but it is simply not the job of German tax payers to provide some sort of indirect third-world aid to middle/upper-class students from foreign countries.

<comment><USER8> _> First, despite constant media reports saying otherwise, there is no major talent shortage expect in very few niches._

"Shortage" is not the right frame of refrence here, because it implies a fixed-size pie. Having an educated population tends to grow the pie for everyone (on average over a longer observation period).

It's not like there is a fixed number of jobs mined from the soil of each country. This sort of flawed thinking is at the core of most "immigrants are taking our jobs" sort of fears.

<comment><USER9> >It's not like there is a fixed number of jobs mined from the soil of each country.

This is so true. It applies to any system with competition. People tend to treat things like jobs and startups like natural resources, and tend to assume that competition is necessarily bad. In reality, feedback processes and strong interactions between players turn economies into highly unpredictable emergent phenomena. It's more like a flock of geese than an elementary chemical reaction.

For such large systems, it's hard to tell what the Nash equilibrium is, and whether it matches with the optimum global outcome. Animals (especially humans) have evolved to cooperate well in small groups (e.g. tribes, families). Over larger scales (e.g. countries, between language families), we have a strange balance between distrust, competition, and compassion.

</comment></comment></comment><comment><USER10> If you are a young person living in a poor country, the two best investments you can make to improve your standard of living are (a) get a university education; and (b) immigrate to a rich country.

Germany offers both:

1\. A free undergraduate university degree

2\. For every graduate: 18 month work visa after graduation

3\. For every STEM graduate who earns more than EUR 40,000 per year: approval to work in Germany forever (ie. a 'blue card')

Yes, you must first learn German, have good high school grades and be able to borrow EUR 9,000 to apply for the student visa. But for millions of people living in third-world countries that is achievable and a great investment given the enormous returns on offer.

So why isn't Germany flooded with foreign university students?

<comment><USER11> > Yes, you must first learn German,

Maybe because of this?

> be able to borrow EUR 9,000 to apply for the student visa

Also, this. 9,000 euros does not seem like too much for people from first- world countries, but for people coming from relatively speaking much poorer countries that sum is quite high.

<comment><USER12> Why learning German is a big issue? These are young people who can learn a language easily and in the beginning nobody expects you so high proficiency and people will always help and encourage you to learn the language. In Europe many educated folks know min 2 languages more and very open to learn more, you just need to leave your comfort zone. Learning languages also develops intellectually.

<comment><USER11> > In Europe many educated folks know min 2 languages more and very open to > learn more

Am Eastern-European, my mother tongue is a Romance language, I speak and read English, read and understand Italian, French and Spanish. German has proved too much of a hurdle for me.

<comment><USER13> > Am Eastern-European, my mother tongue is a Romance language, I speak and > read English, read and understand Italian, French and Spanish. German has > proved too much of a hurdle for me.

Of course if you speak some Romance language natively, other Romance languages will be a lot easier than a Germanic language as German. Here you should rather compare German with a language from a different language family, such as some Slavic language.

I (native German speaker) think that at least for English speakers French and German are about equally hard. The main difference is that French has a "smoother" learning curve, while German's grammar is really grueling at the beginning (but this is also said of the Russian grammar).

What in my opinion many people don't get is learning German means learning the unpleasant grammar (IMHO best by rote drill) inside out. Concentrating on the vocabulary and getting the grammar later might work for other languages that are less grammar-centric than German, but I can imagine German is very confusing for non-native speakers, if they are not rather certain in the grammar.

As soon as one is sufficiently certain in German's grammar (i.e. you don't have to think about conjugation and declination anymore), the learning experience will become much more pleasant, since in my opinion how words are "built up from parts" (in German in particular prominently by juxtaposition) is "in some sense much more logical and memorable" than how words are built in English or Romance language. A rather funny take on this for German animal names can be found under [https://www.babbel.com/en/magazine/funny-animal- names-in-ger...](https://www.babbel.com/en/magazine/funny-animal-names-in- german)

</comment></comment></comment></comment></comment><comment><USER14> For a point of comparison, the annual tuition prices for colleges in Massachusetts:

[http://www.collegecalc.org/lists/massachusetts/most- affordab...](http://www.collegecalc.org/lists/massachusetts/most-affordable- in-state-tuition/?view=all)

Tufts, BC, BU, Olin, MIT, Northeastern, Brandeis all between 45k and 50k. Harvard 41k. When room, board, and books are factored in it's a quarter million dollars over four years.

Public colleges (Umass) are a lot cheaper but I've heard "fees" can run up to 10K a semester.

Lucrative for U.S. schools, ludicrous for students and families.

<comment><USER15> Some of those schools are unlike the others. It makes absolute sense to go $250k in debt for an MIT or Harvard degree, makes less but still some sense for Tufts and Olin, and makes no sense at all for the rest. And the average college that Americans experience is a 2 year community college; very, very few attend schools of the caliber you're mentioning. It makes no sense to lump all these different schools together when arguing for your position on tuition prices and their effects on students and families.

<comment><USER16> > It makes absolute sense to go $250k in debt for an MIT or Harvard degree

No it doesn't? I think we should stop putting schools on a pedestal because of their name. I admire some of the research and work that comes out of those schools, but in the end their degrees are no better or worse than other schools' (regarding undergraduate, I can't speak for graduate).

The only differences come down to network and academic history. If you're justifying that level of debt purely on those two criteria, then I understand that's the value those things mean to you -- and that's okay. Personally, that's not worth it to me. I'm not sure there's "absolute sense" here.

<comment><USER17> There can be an "absolute sense" from a financial perspective. For better or worse, having a degree from Harvard/Stanford/MIT can open a number of doors that may be otherwise shut. Doors which can be very financially lucrative.

For example, suppose you want to work in finance/law. Most prestigious firms place a very high premium on having a degree from a top university, and pay extremely generously if you get your foot in the door. In these contexts, the $250k investment on your college will easily pay for itself within 10 years.

Conversely, suppose you're trying to break into a field that's extremely hard to crack (writing?). In such situations, you'll need every edge you can get, and having a great network or an eye-catching degree in your resume can make the difference between you getting a toe-hold and you calling it quits.

To be sure, it certainly is very context dependent. Getting a cheap Bachelor's degree from a public university, and a Master's degree from a brand name university, might be a good way to get the best of both worlds. In general though, anyone who's smart enough to get admission into Harvard/Stanford is likely going to make multiple millions of dollars over the course of their lifetime. Given this baseline, investing 250k for a top-notch education/network/resume certainly seems well worth it.

<comment><USER18> _Can_ and will pay off is not exactly the same thing. To break even on an extra 100k within 10 years of graduating, the pre-tax premium on your salary needs to $1.5k -$2k on gross monthly salary. I wouldn't call that a brilliant investment even if it was a lot more certain than it is in reality.

But importantly, there are lot of potential loss scenarios. The student could drop out, get sick at some point in the next 15 years. They could decide they don't want to be a lawyer, get pregnant, go to jail. Anything that gets them off a high earning path becomes a disaster with that kind of debt.

A debt burden like this taken on by young people seems to me to be incompatible with the concept of free society. I can't understand how Americans tolerate it. In most countries, I think the public outcry would be too great.

<comment><USER17> > _" To break even on an extra 100k within 10 years of graduating_"

Why are you limiting yourself to a 10 year window? The average career last 30+ years. Over a time period that long, it's much easier to recoup the initial investment costs.

> _" The student could drop out... get pregnant, go to jail"_

Ironically, many of these dangers are much more likely to occur at non-elite universities, due to peer-influence and peer-pressure. This is actually a great reason to attend elite universities where you'll be ensconced in a ivory-tower-bubble.

> _" A debt burden like this taken on by young people seems to me to be > incompatible with the concept of free society."_

I guess you and I define freedom differently. A society where only the ultra- wealthy attend elite universities, doesn't sound nearly as free to me. Allowing extremely bright middle-class kids to invest $0.25M in their education, so that they can optimize for their millions of dollars of lifetime earnings, as well as get the education they've dreamed of, sounds perfectly reasonable to me.

Would I prefer it if elite schools like Harvard weren't so damn expensive? Of course. But the current situation still sounds far better than getting rid of student loans entirely.

</comment></comment></comment></comment></comment></comment><comment><USER19> > Why Germany Educates International Students for Free

One thing to remember: That university education may not be that expensive does not mean everybody is allowed to study. Universities often set high barriers.

In Germany 27% of young adults get an university degree. OECD average is 40%. It's not because Germans are more stupid, but because there are less students allowed to enter University education. Also there are other means of advanced education outside of traditional Universities. Many jobs base their education on the dual education system.

[https://en.wikipedia.org/wiki/Dual_education_system](https://en.wikipedia.org/wiki/Dual_education_system)

<comment><USER20> That's interesting. Are there options for the 73% that don't go to Uni? Trade schools?

What about at lower levels (ages 5-12)... do kids get to progress to the next level regardless of performance in an annual exam (like the US "no child left behind" policy), or do they have to have to repeat a year/level if they fail?

<comment><USER21> Yes, nearly everyone in Germany either has a university degree or a so called "Berufsausbildung". The Berufsausbildung is a specific training to do a certain kind of occupation (craftsman, computer programmer, carpenter) and is based on approximately 50% of schooling and 50% of hands-on work in a company. It typically takes three years and usually you stay at that company as a worker afterwards

<comment><USER20> Interesting. Thank you.

</comment></comment></comment></comment><comment><USER22> While I think it is good for both Germany and students, it probably has a bit of geopolitics mixed in. All those young people, if they return to their home countries, will be naturally more oriented toward German products thus indirectly making German economy stronger. I saw a similar theme in Russia, where there is even a specialized university for this [1]

[1] [https://en.wikipedia.org/wiki/Peoples%27_Friendship_Universi...](https://en.wikipedia.org/wiki/Peoples%27_Friendship_University_of_Russia)

<comment><USER23> Very odd statement to include economical geopolitics here. Do you really believe that German companies lobbied each of the 16 German state-governments to lure in foreign students just so they buy German stuff back at home? Wouldn't it make more sense to influence foreigners directly with this thing called "marketing"?

If you're Adidas, why the hell go through this hassle and conspire with << all the other german companies >> to use the german education system as a proxy for getting a little bit of good PR - not even for your product, just German products in general.

If there's a geopolitical factor involved at all it's inter-cultural relations, which for a country that ruined most of Europe once is a rather good thing.

<comment><USER22> Not just common consumer goods, but say, electrical engineer educated in Germany would be inclined to use Siemens software and hardware, and he/she would need to put extra effort to learn about alternatives.

</comment></comment></comment><comment><USER24> The thing is, the fees discussed in Germany ( ~1000€ / semester) are no where near covering the costs of a seat for one student. It's just a drop in the ocean, so they might as well keep it free. And when tutition is free for Germans, it seems wierd and discriminatory to take fees from foreigners. I grew up in Germany, but don't have a German passport. Should I pay more? Where do you draw the line?

I was studying when they introduced the tutition fees around 2006, and protested against them. We strongly had the impression that it was never about covering costs, but rather an "educating" measure: to teach students that education has a monetary value, and so that they view themselves as customers.

In the US, people view their education usually as an investment on which they expect return (from this thread, "It makes absolute sense to go $250k in debt for an MIT or Harvard degree, makes less but still some sense for Tufts and Olin, and makes no sense at all for the rest."). Some people view it that way in Germany, too, but I think many others, like me, find that very strange. We study mainly whatever we are talented at, and what we enjoy. Financial considerations are made, but not the main driver.

I believe certain people find that mindset threatening or wrong, and work(ed) actively against it. In Germany most notably neoliberal and center/conservative think tanks, like Bertelsmann foundation. These organisations lobbied for tutition fees, but also for the introduction of the Bachelor+Master system, which is much more schoolish and streamlined than the old Diplom/Magister system (which let you more freedom to study at your own pace and according to our interests).

When I look at how the money from tutition fees was used, it didn't improve teaching at all (which was the stated goal), but we got fancy new desks and cashback for books (ridiculously). This reinforces my feeling that it was driven by ideology and not by necessity.

<comment><USER7> > when tutition is free for Germans, it seems wierd and discriminatory to take > fees from foreigners

German citizens subsidize this "free" university with their taxes. This includes low-level workers who have never visited a university. So essentially you are asking poor people in Germany to pay for the education of middle-class or rich people from other countries.

<comment><USER25> The poor dont pay much taxes in germany either. So its the middle class supporting a open world view. And i found it quite enriching. Sorry, that WYSIWYG doesent work with universitys, because you have by condition of usefullness not yet seen what you get and can only afterward value it apropriatly.

I love the german enducation system. In it great endavours may still be possible.

</comment></comment></comment><comment><USER26> Should I study engineering in Germany?

I'm looking at undergrad programs in California right now and the numbers don't add up for me. Not just tuition, but cost of living as a full time student as well. I also feel like it would be much easier for me (a non- traditional student) to get into a better university over there, as they pretty much just look at your test scores. Not all this GPA/extra-curricular "well rounded" stuff they do here. Do they provide many undergrad programs in English? Are the degrees accredited in the US?

<comment><USER27> AFAIK only the GPA matters as you have said (it's called Numerus Clausus or NC in Germany). If you look it up in a list, keep in mind that the German scale and the US 4 point GPA scale are reversed. 4.0 is the worst passing grade here and a 4.0 was an A+ at my US high school (I think there are different scales in different states?).

For many degrees there's no GPA requirement at all. Engineering might very well be one of the cases as it tends to be one of the "harder" degrees (natural sciences, math, engineering etc.) and GPA requirements are mostly for the "popular" ones like business, social sciences etc. Always depends how many slots are available at a given university, too.

Also: if your GPA isn't good enough you can get on a list and "wait" a couple of semesters and for each semester your GPA is virtually improved.

Note: that's how it works for German students but I'm pretty sure it's the same for foreign students (but most will have a requirement of C1 or sometimes B2 German skills). All universities have international offices that you can contact though.

I think Germany is still very much considered an "engineering country". Career wise it's probably going to be a very good thing to hold a German engineering degree. The education is good and there's usually great contacts to engineering companies. I'd be shocked if the degrees weren't accredited in the US. If you can pick a university I'd go with a "TU" (Technische Universität). Also note that we have two different kinds of universities. Universität = "proper" university and Fachhochschule aka FH or Hochschule = university of applied sciences...I'd stay away from these mostly because there's subtle differences that will probably make it harder to have the degree accredited in the US (and they are usually considered lower tier by employers as well).

University regulations differ on a state level so it might be wise to check out different German states. If saving money is one of the focus points I'd advise against Munich. RWTH Aachen is probably the best university in that field, TU Dresden and TU Dortmund are relatively cheap from a cost of living point of view and still good universities.

<comment><USER28> Don't discount FHs, especially for engineering. With the right niche you can out-earn almost every other graduate - say in chemical engineering, in some EE niches or with economics degrees that focus on a particular industry.

Also, rents in Jena, Tübingen or Ilmenau are often on a Munich level, but you can always find a few shortcuts (like living in Weimar and taking the train to Jena).

Lastly, if the bachelor isn't meant to be your final degree it doesn't matter as much where you got it.

</comment></comment></comment><comment><USER29> One thing to consider is the very trade-focused nature of the degree.

My son is a German citizen, educated until high school in the German language, but he enrolled in a US university. Why? The US system offers a broader education at the undergraduate level. In fact there aren't undergraduate medical or law degrees the way there are in Germany (where you graduate and start practicing / start residency).

Honestly I think this distinction is part of a cluster of characteristics that make the US more entrepreneurial than Germany(and why I'd rather drive a German car than an American).

(This isn't an argument that one country is better than the other, just that they've picked different local maxima on various issues. FWIW I'm not a citizen of either).

<comment><USER26> >Honestly I think this distinction is part of a cluster of characteristics that make the US more entrepreneurial than Germany(and why I'd rather drive a German car than an American).

There's a bit of trade off involved with this though. Not everyone is suited for entrepreneurship, nor would a healthy economy encourage _most people_ to become entrepreneurs. The stable middle class of highly trained, well paid technical workers in Germany is precisely what the US needs right now. It seems that both systems could benefit from each other's strengths. A liberal education founded in general studies is valuable for many, but most people will spend their lives working technical jobs.

<comment><USER29> But that's my point: people seem generally happy with the respective systems. Americans by and large seem to like their system, but while I love _working_ in Silicon Valley it's pretty hard not to notice every day that it has a pretty low quality of life versus other OECD countries. If people like it who am I to complain?

</comment></comment></comment><comment><USER30> > in Germany, students -- on the whole -- famously pay no tuition fees, > regardless of where they come from. Seen from the U.S. or Britain, this > policy may appear either supremely principled or incredibly naïve

"Britain"? Do they perhaps mean England?

The other three nations of the United Kingdom have either free (Scotland) or vastly cheaper (Wales, Northern Ireland) university tuition fees.

<comment> stable-point I think the key part is "regardless of where they come from". For instance, Scotland has free tuition for the Scottish and other EU citizens, but not for citizens of England/Wales/NI or international students. (The fees for an English person are typically cheaper than other English universities, but still not to be sniffed at).

I am not sure about NI or Wales, but I imagine there's a similar situation.

<comment><USER31> Scotland and free tuition? I was thinking about a MSc in computer science at the University of Edinburgh, and it's definitely not free, even for EU citizens: [http://www.ed.ac.uk/studying/postgraduate/fees?programme_cod...](http://www.ed.ac.uk/studying/postgraduate/fees?programme_code=PTMSCCMPSI1F).

<comment><USER30> That's a postgraduate course. I guess free tuition applies only to undergraduates.

</comment></comment></comment></comment><comment><USER32> The article has many points that are not correct. I was a foreign student who did studienkolleg (preparatory university course), bachelor and master degrees in German in Bavaria. In total, I spent 6 years in their educational system.

One thing to highlight is that German universities are very different to the American system of small groups, interaction with students, labs, hand- holding, etc. Traditional German education is one where you are not obliged to go to classes and you only have one final exam at the end of the semester. Some classes had up to 800 students. In other classes, we never got to see the professor and we were taught by a PhD student. Nobody knew your name and you were just another face, if you ever showed up to class. Thus, the marginal cost of having an additional local or foreign student is minimum.

This system is not for everyone and given that my classes were all in German, it was very challenging. University-level German (vocabulary, idioms, etc) is very different from the one you learn at the Sprachkurs. Most foreign students dropped out and went back home. This is also accentuated by the fact that if you fail an exam 3 times, you are expelled from the university and you are banned from studying that study field for life across all German universities.

Moreover, German universities do not have their own sport facilities and luxurious campuses as their American counterparts. Normally, for sports, there is a shared facility for all local universities and you pay an extra semester ticket to have access. The average German university has old facilities and no luxuries. Thus, the cost base is completely different to universities in the US.

Back then, we were told that Germany offers education to foreigners to foster relations with foreign countries. If we foreigners study in Germany and are shaped the German way, once we go home, not only we will be well qualified, but also we will be keen to establish business relations with German companies.

During my study times, around 2006, they introduced at my university fees for everyone. The idea was not popular and it was not covering the cost of education. The idea did not last long. Some years later it went back to be free for everyone. German universities are very left-leaning and in the German society there is a wide consensus that university education should be free for all.

The CDU and FDP, two political parties on the right spectrum, constantly push the idea of charging foreign students to help finance public education, but the idea has never gotten any type of support in the society.

</comment><comment><USER33> It is the same situation in Norway. International students pay no tuition (and we have the same debate here whether to continue this situation...).

On the other hand, living costs in Norway are quite high.

<comment><USER34> Are courses in Norwegian?

<comment><USER35> None of the comp. sci. courses I have been to at least. Norwegian lecturers will usually ask if anyone does not speak Norwegian. This is at masters level at UiO; I am not sure about bachelor courses.

<comment><USER36> Bachelor's level courses are in Norwegian.

</comment></comment></comment></comment><comment><USER37> One argument, not made, is that it may help German students too. Having various nationalities at home expose them to other ways of thinking. And it increases their abilities to deal with them culturally later in life/business.

I do find a parallel, at a completely different scale, with the strategy of Loh, the coach of the US high-school team for the Math Olympiads. An important part of his strategy is to invite his international opponents to train with his team. It is counter intuitive, but he says it makes his team better, and they're less scared of competition. They won twice in a row since.

NYT article: [https://mobile.nytimes.com/blogs/wordplay/2016/07/18/imo-201...](https://mobile.nytimes.com/blogs/wordplay/2016/07/18/imo-2016/)

</comment><comment><USER10> > starting in fall 2017, the southwestern state of Baden-Württemberg will > start charging non-E.U. students 1,500 euros ($1,634) per semester

That's still incredibly cheap for a quality university degree.

<comment><USER38> It's cheap but not quality.

<comment><USER39> > It's cheap but not quality.

Do you care to elaborate on that? If I look at the Times Higher Education ranking for Teaching, I see e.g. Heidelberg University on world rank 43:

[https://www.timeshighereducation.com/world-university- rankin...](https://www.timeshighereducation.com/world-university- rankings/universitat-heidelberg#ranking-dataset/589595)

(Just picked because it's the first university in Baden-Württemberg I found; obviously, for specific subjects the rankings might vary a bit.)

That's not MIT or Harvard, but if that's your standard of "quality" than very few people in the world will have "quality" education.

<comment><USER40> In Baden-Württemberg, KIT (Karlsruhe Institute of Technology) is the "place to go" in computer science.

</comment></comment></comment></comment><comment><USER41> My country, Argentina, does the same just in case you want to study here. The courses are obviously in Spanish. Postgraduate studies are paid.

<comment><USER42> Would you have more information? Definitely interested!

<comment><USER41> Information from the government here: [http://elbno.cancilleria.gov.ar/en/node/5176](http://elbno.cancilleria.gov.ar/en/node/5176)

</comment></comment></comment><comment><USER43> In my opinion, unless German IT companies accept to work in English because available workforce in neighbor countries already know English, or they're going to have problems attracting world-class talent. I.e. accepting as "acceptable behavior" people not willing to learn German as a requirement.

<comment><USER13> > German IT companies accept to work in English because available workforce in > neighbor countries already know English

Let's look at the neighbor countries of Germany and my impressions of their German language skills:

Austria: German is spoken there

Belgium: ?

Czechia: Czechs who want to work in Germany often know German (to me) surprisingly well (this can perhaps be explained by German history (keyword: Sudetenland))

Denmark: ?

France: French people IMHO are typically neither good at English nor German

Luxembourg: German is one of the languages spoken there

the Netherlands: They typically know German quite well (though they often don't like using this language)

Poland: Poles who want to work in Germany often know German (to me) surprisingly well (this can perhaps be explained by the German history with the historical expanse of the German Reich)

Switzerland: German is one of the languages spoken there (not that the Swiss would prefer to work in Germany over their own country for obvious reasons)

TLDR: In many Germany's neighboring countries it is common to know German on a decent level - at least if you plan to work in Germany. If there was I second language from a neighboring country in which work should be accepted, this should rather be French (for France and Belgium) instead of English.

<comment><USER43> > TLDR: In many Germany's neighboring countries it is common to know German on > a decent level - at least if you plan to work in Germany. If there was I > second language from a neighboring country in which work should be accepted, > this should rather be French (for France and Belgium) instead of English.

Sure, e.g. I did myself one year of German courses (I forgot most of it, because it was long time ago). In my opinion the point is to make attractive world-class talent for working in Germany, even for short periods of time. I.e. the "nationalist barrier", that is still very strong in Germany and also e.g. in France, in my opinion hurts badly IT companies (fortunately, now is a much smaller problem versus how it was 15-20 years ago, when it was very difficult to work in Germany or France with just English).

In my opinion, unless European Union countries become more pragmatic, accepting the English as the "IT language", or the handicap for hiring world- class talent will still be a issue, for both the internal EU job market, and also for getting international talent (e.g. a talented Indian would try first to work in the USA or the UK just because he already did English in the school, being ha handicap having to learn French or German for a temporary job).

<comment><USER13> You explicitly talked of "neighboring countries" of Germany - here I provided evidence that the situation is different.

> being ha handicap having to learn French or German for a temporary job

Here I rather see the problem: The people only want a temporary job in Germany - so they see Germany just as a stepping stone for their career. If I were a staff manager at a company, I would be very cautious to hire such a person, since in Germany it is seen as a desirable trait that a person does not switch jobs every few years. There are "legal period of notice" which hold for _bot_ h sides: An employer can after some probation period not simply fire an employee without a period of notice, but the other implication does also hold: After the probation period an employee cannot simply quit the job without a period of notice, too.

<comment><USER43> Well, for neighboring countries I meant EU countries. You can have near unlimited low-qualification worker supply from your strictly speaking neighboring countries, but not necessarily world-class skilled workers, specially, if those workers willing to move from one country to another can pick options with less conditions. Also, you can have potential supply, not willing to move, just because of nationalist stuff (forced "integration") or other elements that could make a country less attractive than another.

Don't get me wrong: I would love Germany, and all EU countries getting as much talent as possible, from the internal EU area, and also from other countries as well. I'm worried about nationalism and the lack of pragmatism ruining job flexibility and business attractiveness, so European companies have such a huge handicap for competing in the international market.

<comment><USER13> > Well, for neighboring countries I meant EU countries.

There are only three EU countries (UK, Ireland, Malta) where English is an official language - soon there will be only two. For comparison: German is official language in four EU countries (Germany, Austria, Belgium, Luxembourg) and French in three (France, Belgium, Luxembourg).

Now let's look at data for language knowledge in the EU:

> > [https://en.wikipedia.org/w/index.php?title=Languages_of_the_...](https://en.wikipedia.org/w/index.php?title=Languages_of_the_European_Union&oldid=776168976#Knowledge)

The most common first language in the EU is German. Other important first languages are English, French and Italian (this table has not yet included the fact that soon for English this number has to be much lower).

Totally (in number of native and non-native speakers) English (51%) looks more important than German (32%) or French (26%).

Now I tell you an observation: When (EU) people are talking that they know English as an additional language, this often means "really bad English" (just try to converse with Italians in English ;-) ). This is clearly not sufficient knowledge for using English in a professional environment. On the other hand when they claim to know German or French as an additional language, this typically promises much better language skills than if such a claim is made for English by some person. So I would argue that "people knowing enough of the language such that in, say, half a year they could use this language in a professional environment" for English the "51%" must be made smaller by a lot, while for German and French a similar correction should be much more minor.

Really: On a wordwide scale English might have a large role, but if you talk about _EU_ , there are other languages (in particular German and French) that are at least of similar importance "for EU purposes" (just as in South America Spanish and Portuguese are the important languages and not English) - and with Brexit their importance will surely even increase.

<comment><USER43> English is the lingua franca in IT, worldwide. Everyone in IT knows it, to some extent. And even general population get English as second or third language. English teaching is generalized at developed countries, while German it is not.

P.S. My English is also "bad", being a Spaniard myself, but enough for working in English in IT (not for writing novels, obviously).

<comment><USER13> > English is the lingua franca in IT, worldwide. Everyone in IT knows it, to > some extent.

At an internship at a German-French software company there also was a French programming department (alongside the German one, where I interned). I can assure you: They hardly knew English, at best it was a mixture between French and English, where to understand the English (in the source code) you often had to translate it back to French in your mind (because otherwise it made no sense).

<comment><USER43> Sure, that's precisely what I'm warning about: if you need to adapt to the international market you can not wait 2 or 3 years for someone to adapt to a local "circumstance". Not taking advance that in all EU countries English is at least in primary and secondary education, it is a mistake, in my opinion. More pragmatism in IT through the EU would increase the capability for reaching regional full potential.

E.g. Imagine you're in Germany and you can not hire an expert in some specific specialty because language issues (i.e. because your staff is not able to work in English). Also, when doing collaboration between European companies: imagine having to deal with documentation written in French, German, Italian, Spanish, Dutch, Swedish, etc. Fortunately, most European IT companies do most of the code and documentation in English (that was not the case of 20-30 years ago, e.g. Imagine having to reprogram 6502 assembly stuff commented in French -or a CPU-less logic circuit, for adding more fun-, or understanding the German documentation for a 25 year old ticket issue machine built in Austria).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I'm interested in setting up a small non-profit school for poor, young adults in Indonesia to teach them German and other skills necessary for admission to Studienkolleg (the one-year preparatory course for foreign students wishing to apply to a German university).

The main goal is to get the student a good IT job in Germany within 5 or 6 years. In return, the student must commit to giving a percentage of his or her income back to the school, so the school can grow without requiring external donations.

What does HN think of this plan? Is it achievable? If not, what is the most likely cause of failure?

PS: If anyone knows a good lawyer in Indonesia for setting up a yayasan or obtaining KITAS please contact me - see profile.

</comment><comment><USER10> Is there a fixed quota for the number of international students studying at German universities?

That is, if the number of international student applications doubled would it make it harder for German students to be accepted into university?

<comment><USER44> To my knowledge there is no quota either for foreign students or students in general. If we'd get twice as many applications in one year, we have to fit twice as many people in the lecture halls. In Germany, education is actually a right and a lot of people sue their way into universities when they are rejected based on their grades.

</comment></comment><comment><USER45> I'm a graduating senior in India, interested in studying math as an undergraduate.

Considering that I know some German (~B1), could this work out for me?

<comment><USER46> I would advice you to learn till C1 level. B1 is not enough and Bachelor in Math is mostly in German and you must take TestDAF, so I think you should spend one year or so clearing upto C1 and TestDAF, which is highly advisable. But you can also do the same in Germany, but you have to spend more money in Germany. Since your German level is good, maybe you can find a part time job, but that's no guaranteed thing.

</comment></comment><comment><USER47> Certainly laudable. How does one "stick around" after graduation - do you have to learn German?

<comment><USER48> _do you have to learn German?_

Why wouldn't you want to? It's a lovely country, with a huge body of literature that you'd deprive yourself of if you refuse to learn the language. And why isolate yourself from the locals? Weird attitude, that.

<comment><USER49> They didn't say they didn't want to did they? You imagined that. It'd be fantastic to be able to learn the languages of all the countries you visit, but not everyone finds that easy do they.

<comment><USER48> The OP didn't talk about visiting a country, he asked about settling in Germany. The words were "do you have to", not "I wish I could"; he made learning your adopted country's language sound like a chore instead of a challenge. Full immersion makes the learning process much easier.

Besides, taking citizenship of any country requires a language exam.

</comment></comment></comment></comment><comment><USER5> Several places in Europe are like this. E.g. in my home country Norway you also don't have to pay tuition: [https://www.studyinnorway.no/study-in- norway/Tuition](https://www.studyinnorway.no/study-in-norway/Tuition), and a lot of courses are taught in english. In the Netherlands all master level degrees at all universities are taught in english if there are any non-dutch speakers in class.

Both Norway and the Netherlands are perhaps easier if you don't speak the native language than Germany as pretty much everybody speaks quite good english in both places. I have friends in Norway I've known over decades who still don't speak a word of Norwegian.

For an english speaker dutch is probably easier to learn than German, as dutch is closer to english. E.g. "I sit in the train and drink water", in dutch becomes something like "Ik sit in de trein en drink water". Not sure about Norwegian, but it is probably an easier language than German. Not quite as complicated grammar.

Having studied at very different universities with respect to ranking, I got to say I don't think ranking means very much for the average student. It is overhyped, I can't see a huge difference. Ultimately results are going to depend on you and your efforts.

In fact there has been studies of this. Ivy League universities don't actually improve your grades or earning prospects. It just looks like that due to creaming. But when they compare SAT scores of students who could get into an Ivy League but chose not to with those who did, one doesn't see a difference in salary afterwards: [https://www.usnews.com/education/blogs/the-college- solution/...](https://www.usnews.com/education/blogs/the-college- solution/2011/03/01/the-ivy-league-earnings-myth)

I read in another study that if you are at the lower tier in an ivy league you will actually end up worse, because it will kill your confidence to be around so many people smarter than you. Go to a normal college where you are among the better and it will boost your confidence and ability to excel.

And many might already have read that Google does in fact not favor ivy league students as they are typically to dependent on external drive, grades etc, rather than internal drive to make good products which is what matters at google.

Anyway I think people should focus more on going a place they would enjoy. I think many European universities are very nice to attend because in Europe there are lots of cities which are easy to walk and with great public transport. That makes life a lot nicer for students. You can easily get around town and do all sorts of stuff, either, with bike, walking, tram, bus etc. Also at least in northern Europe societies tend to offer more freedom for youngsters. I've studied in the US for a year and found it too restrictive. There is too much control on young people. You can't drink until 21. Dormitories have a lot of rules and are gender segregated. In e.g. Norway or the Netherlands, student housing means sharing a real apartment with people. You got mixed gender and you cook food together, can invite people over, come and go when you like.

</comment><comment><USER50> You still need rich parents, because you're not allowed to work much to support yourself.

<comment><USER10> A German student visa allows you to work 120 days per year [0]. At minimum wage [1] that is about EUR 9,000 per year. I think there would be many international students who could support themselves with that. Standard of living would be low compared to Germans, but it's possible.

You do however need to show you have EUR 8,640 before you get the student visa [2]. Very poor families would not be able to borrow this amount, so it acts as a barrier for them.

[0] [https://www.daad.de/deutschland/in- deutschland/arbeit/en/914...](https://www.daad.de/deutschland/in- deutschland/arbeit/en/9148-earning-money/)

[1] [https://www.google.com.au/publicdata/explore?ds=ml9s8a132hlg...](https://www.google.com.au/publicdata/explore?ds=ml9s8a132hlg_&met_y=minimum_wage&idim=country:de:fr:uk&fdim_y=currency:eur&hl=en&dl=en)

[2] [https://www.daad.de/deutschland/nach- deutschland/bewerbung/e...](https://www.daad.de/deutschland/nach- deutschland/bewerbung/en/9199-visa-application/)

<comment><USER51> At least minimum wage. You can aern a lot more as a computer science student and probably in other fields.

</comment></comment></comment><comment><USER25> You grow them, we poach them, they build it, you buy it. What a nice little buisness model. Could be very historic soon.

I wonder if with youtube lectures and automated courseware- open source universitys could be errected in nearly any country. Finance the food, finance the healthcare and roof, and those students could study anywhere.

</comment><comment><USER52> Another possible reason - they may well have little choice! Lists of top ranked universities are generally dominated by the US/UK. In this list the highest ranked German institution is at number 30: [https://www.timeshighereducation.com/world-university- rankin...](https://www.timeshighereducation.com/world-university- rankings/2017/world- ranking#!/page/0/length/25/sort_by/rank/sort_order/asc/cols/stats)

It's always going to be hard to charge the same as a competitor when your product is inferior.

<comment><USER53> Most of the top universities in the US are effectively free. The pool of students they get to choose from would enter with a basket of scholarship money to the point they wouldn't have to pay. The other group is so wealthy the price of tuition is the cost of a new luxury car, every year. Effectively a single percentage expense.

Germany doesn't have to make their schools to compete free because the schools they compete against are basically free to the type of students they are pursuing.

<comment><USER52> I seriously doubt the average Ivy League/Oxbridge aspirant would ever consider a Germany university as an alternative. Below these few elite universities you have another upper tier which in the UK would be Imperial/UCL/Durham etc. (although some departments in this supposedly lower tier are superior to the top tier). Below that you have another tier, and looking at this tier in the global rankings you are starting to see some German universities crop up. Basically, and I'm not looking to be offensive, but with these universities your market is by definition the more mediocre students, and it is in this group that I think you would start to find students for whom price is more of a priority than quality. Students at the better than average universities expect their degree to deliver a premium that will easily wipe out the cost.

<comment><USER54> Just because some students don't aspire to go to a German university doesn't mean the quality of education would be any worse. Many of my close friends (and me personally as well) did their undergrad in Germany and then a semester abroad and/or their Master's in top-10 universities in the US. I have yet to hear from anyone that they felt in any way more challenged in the US (typically the opposite). Yes studying in the US is great fun compared to Germany (sports, extracurriculars, nice spirit of community, ...) but in terms of learning I doubt there is much of a difference

<comment><USER5> Same experience. I think despite the ranking, European universities are actually higher quality. American universities use too much student assistants. Too much of the teaching is hand holding and high school like. When I compare my dutch university experience with my American, it was more research oriented in the Netherlands. You learned to think more scientifically. In the US it felt like it was just about learning lots of stuff. Also the grading system in the US is a weak spot. It is usually far too easy to get an A in the US.

I've also have friends who have gone to top US universities, but who mainly can speak of the advantage being that, because they are big, they can offer more variation of course, but with respect to quality there was little difference.

<comment><USER53> It's a double edged sword. I didn't attend a European university but I have many friends who have. Their complaints were the subjects were book heavy with very little practical overlap. Professors were unreachable, office hours did not exist.

This was for the normal universities. The technical schools are a different animal. Extrememly competitive to the point of mental breakdown. And if that happened? Tough luck, they don't care.</comment></comment></comment></comment></comment></comment>


It's never too late to start exercising, new study shows - <AUTHOR> https://www.birmingham.ac.uk/news/latest/2019/08/never-too-late-to-start-exercising-new-study-shows.aspx <comment><USER2> I've exercised at low and high intensities for years. Whether it's hiking, biking, running, yoga, or weights, exercise is an _INCREDIBLY_ inefficient way to lose weight.

It does however promote muscle growth/stability and heart function when done properly.

If you are looking to lose weight and greatly improve your health and longevity, eat one meal per day. Seriously. I have lost 40 pounds like this and now I have excellent kidney function (it used to be bad), normal cholesterol, no athsma, no sleep apnea, and a very healthy BMI.

The secret is restoring the proper function of insulin in your body, which is a very powerful hormone that can cause weight gain and cardiovascular inflammation when not properly controlled.

The Western diet of 3 meals per day, of virtually any type/size, is bad for insulin function.

Conversely, even a Western diet of any type/size, when eaten in one sitting per day (fasting 23 hours otherwise), has been incredible for my health.

<comment><USER3> You are practicing a form of time-restricted feeding (TRF).</comment></comment>


Young Internet stars wait out the crash in Cyprus, make video - <AUTHOR> http://www.alleyinsider.com/2008/10/what-me-worry-young-internet-stars-spend-wait-out-the-crash-in-cyprus-make-video

<comment><USER2> could they be the seven horsemen of the startup apocalypse?</comment>


What Should We Teach New Software Developers? (2010) - <AUTHOR> http://cacm.acm.org/magazines/2010/1/55760-what-should-we-teach-new-software-developers-why/fulltext?otl=0493ZFSF#.VLvsXE9JecM.twitter

<comment><USER2> Much better reading experience as PDF article: [http://dl.acm.org/ft_gateway.cfm?id=1629192&ftid=693559&dwn=...](http://dl.acm.org/ft_gateway.cfm?id=1629192&ftid=693559&dwn=1&CFID=472938838&CFTOKEN=25076998)

<comment><USER3> Oh this is so much better, than you.

<comment><USER2> Hmm, succinct difference between "than you" and "thank you". Never noticed so far. :P

</comment></comment></comment><comment><USER4> What we need is better programming languages. Languages that can bridge the gap between academia and industry.</comment>


FBI Director Ducks the Most Important Question in the Apple Fight - <AUTHOR> http://www.motherjones.com/mojo/2016/02/james-comey-ducks-most-important-question-in-apple-fbi-fight <comment><USER2> This part is interesting:

Another committee member, Rep. Jim Himes (D-Conn.), later tried again. "Where does this authority end?" he asked Comey. "Can you paint a very bright line for us with respect to where you think that authority ends?"

"I don't think I can," Comey replied. "I'm really not qualified as someone to give you a good answer to that one." When Himes attempted to clarify, asking if the FBI thought its ability to request help stopped with just Farook's iPhone—a position Comey has taken over the past week—Comey again ducked. "I actually have not thought of it," he told Himes. "The FBI focuses on case and then case and then case."

\---

Does he really think the American people are that stupid?</comment>


Show HN: Automatic detection of non-colorblind safe colors - <AUTHOR> https://www.vis4.net/blog/2018/02/automate-colorblind-checking/ <comment><USER2> Really cool. I showed the a11y geeks in our design group this and they're already thinking about approaches they could take to embed this into the CI process for our UI libraries.

</comment><comment><USER3> An interesting question might be, which is the best approach: having designers alter their designs (which means everyone is affected), vs. client side settings that alter the appearance just for those affected?

I just am not so fond of the idea that all designs must be compromised (both aesthetically and functionally) for everyone else, if there are solutions that work as well without affecting everyone.

<comment><USER4> Disclaimer: I'm colorblind.

There are SO MANY designs that use indistinguishable colors for no good reason at all. It's perverse that League of Legends uses blue and purple as its team colors—literally anything else (blue and red is my vote) would be easier for many colorblind users to tell apart. And a lot of heatmaps use gradients that go from blue to purple or from red to green…why‽

I'm willing to admit that the very occasional design might Really Just Work Better with particular colorblind-incompatible colors, but I feel like I'm being affected by it awfully frequently. The primary point of design is to communicate information; why restrict a substantial minority from easy access to that information?

<comment><USER5> League of Legends offers a colorblind mode in game that does exactly that - changes the teams to Blue and Red from Blue and Purple.

IIRC, they even use that mode for their E-sports tournament streams - but I might be wrong on that as I haven't watched any LoL tournaments in quite some time.

E: Just tuned into the EU LCS to take a screenshot - and it has colorblind mode on: [https://vgy.me/ijQgrR.png](https://vgy.me/ijQgrR.png)

<comment><USER6> World of Warcraft got colorblind mode in patch 6.1 (around feb 2015) [1]. Before that, one needed to achieve this via addons (with varying effect).

[1] [https://worldofwarcraft.com/en- us/news/17964863](https://worldofwarcraft.com/en-us/news/17964863)

</comment></comment></comment></comment><comment><USER7> The author uses CMC I:c (and somewhat incorrectly claims it's also called Delta E, which normally refers to one of the CIELAB metrics). Then he notes the asymmetry of that quasimetric, and a workaround -- averaging the C1,C2 and C2,C1 distances.

I wonder if perhaps he would be better served by simply using the actual "Delta E" metric, specifically ΔE*₀₀, which doesn't have this symmetry problem?

PS. Sexy interactive color matrix table. Small error in the text below -- values >=40 are highlighted, not >45.

<comment><AUTHOR> Author here, thanks for the feedback.

Well the only thing I know about DeltaE I know from Bruce Lindbloom's website, where he uses the terms interchangably. [http://brucelindbloom.com/Eqn_DeltaE_CMC.html](http://brucelindbloom.com/Eqn_DeltaE_CMC.html)

But I'm happy to try out the CIELAB deltaE as well. I can already see another dropdown for comparing difference metrics coming up :)

Will fix the text error you found.

\--edit: after reading again I see that he used DeltaE as a sort of broader category. worth fixing as well

</comment></comment><comment><USER8> Excellent tool. Our organization is AAA compliant with the ADA section 508 (details for anyone who needs them: [https://www.section508.gov/content/build/website- accessibili...](https://www.section508.gov/content/build/website- accessibility-improvement/WCAG-conformance)), and color is a major issue.

One suggestion for designers & developers who need to be ADA-compliant: part of the spec is the level of contrast between different colors. We currently use WebAIM to check our color contrast: [https://webaim.org/resources/contrastchecker/](https://webaim.org/resources/contrastchecker/)

I'd recommend looking at the contrast levels needed to achieve ADA compliance, or any other compliance needed depending on the regulations in various countries, to make it easy for designers & devs.

</comment><comment><USER9> I kind of wish the OS Vendors were not asleep at the wheel, and had features to address these issues as a 'built-in' value proposition for their products.

I mean, it seems to me the sort of thing that a computer ought to know how to deal with, inherently .. and sure, some vendors do make an effort to make these kinds of human differences accessible.

But its just .. well maybe there is a broader malaise with OS vendors, asleep at the wheel, not caring too much about this on the OS level any more. We've moved on and its all web now, I guess.

I say this, as my first thought while reading this article was "surely this is just a hash-table away from being applicable everywhere ..." ..

<comment><USER10> Not sure about iOS, but Android has multiple color blind settings built in.

<comment><USER11> iOS does too, along with a number of other display accommodations. It has adjustable filters for specific forms of color blindness, along with an Ishihara-like test pattern to help tune the filter to your specific needs.

</comment></comment></comment><comment><USER12> Thank you, this is great work.

While implementing the UI for a medical device I had the disappointing experience of having to work with a UX company that designed an interface that relied almost exclusively on _colors_ to indicate results and state (red, green, orange, blue, yellow...). When I pointed out that the color blind would not be able to understand their color-based system they refused to make any changes -- not even adding distinct icons for distinct results. These people claim to be UX specialists for medical devices.

</comment><comment><USER13> FYI, you should reissue your certificate. Chrome 66 is already blocking it (because of the Symantec fiasco). [https://i.imgur.com/dWqeK74.png](https://i.imgur.com/dWqeK74.png)

<comment><AUTHOR> er, I switched to firefox when it became a good browser again. will see what I can do about the cert. thx

</comment></comment><comment><USER14> I have a legit question. Do colorblind people use some extension in their browser? This post gave me the idea that maybe some extension could show them the warnings and some options to scale the colors in an appropiate manner. My first idea was to try using it in development, to check how colorblind people see our apps and provide a solution. Do you have any further plans or ideas with this? (It's an interesting topic, but I'm not very informed)

<comment><USER15> I suffer from deuteranopia and use the Spectrum extension in Chrome from Yehor Lvivski.

It's ok for switching between different color modes so I can see differences in them.

I am intrigued by the Enchroma glasses, haven't wanted to gamble $300+ on them yet.

<comment><USER16> Not colorblind myself, but I often use spectrum as a final pass to make sure any colors I've chosen for a UI aren't going to cause issues. I just hope it's decently accurate.

I'm also a very heavy F.lux user, so all my color choices have to be usable with an orange filter as well.

</comment></comment></comment><comment><USER17> Would love for someone to do a similar analysis on the Overwatch colorblind modes (and why they don't work and Blizzard needs to improve them)

</comment><comment><USER18> This is a very informative and well structured post. The clarity of thought and experimentation methods that led to the final solution was a pleasure to read.

Also, the problem space is one that I haven't thought about, but probably should. After all, accessibility should be important to all of us.

</comment><comment><USER19> Now that I've detected my color ramp is inadequate, where can I find a good one? Am I limited to greyscale or other single-hue ramps? Do I need multiple color ramps for deuteranopia vs protanopia?

<comment><USER20> Depends, I assume. The original Destiny had color palettes for every type of color blindness iirc, you could select whichever one you wanted. That was a really nice feature for a FPS, where you need to be able to determine allies/enemies at a glance.

If you didn't want to do separate palettes, which I imagine could be a lot of work, you could create your own. I imagine if you varied the tint/shade/tone enough you could (probably?) get a set of colors (with different hues) that would be differentiable across all forms of colorblindness.

Disclaimer: I'm not a designer _at all_. Somewhat on topic, my favorite quick tool for colors is colorhexa dot com. At the bottom of each color page they have a color blindness simulator.</comment></comment>


Enterprise Sales Guide: The Process of Selling Enterprise Software Demystified - <AUTHOR> http://www.enterprisesales.nyc/ <comment><USER2> I'm in technical presales and have been in and out for about 10 years. It's a very rewarding career, if you like socializing and are particularly interested in tying your individual/team efforts with your pay (vs. the RSU/option lottery).

These are all good articles, though I'd particularly point to the a16z articles and Ben Horowitz' book "The Hard thing about Hard Things" for an appreciation of what sales brings to a company that needs enterprise customers.

Also, sales can be learned by anyone. Some of the best sales people I know (earning $400k most years to upwards of $1m in a year if they hit a home run) are deeply technical.

<comment><USER3> As someone on the implementation side I have a sour taste for Sales and Sales Engineers. Always selling features we do not have or things we cannot do. Then they mock it up and leave and I have to break the news to the customer.

<comment><USER4> You may wish to consider your sour taste to be less targeted at Sales and SEs and more around (broken) company-wide processes and (lack of) clout the implementation teams wield.

I'm also on the implementation side (sometimes referred to as professional services), and two immediate thoughts jump to mind:

1) Unless you're a practice manager directly responsible for maintaining a targeted book-to-bill ratio or other quota metric (which usually entails account and long-term customer relationship management), your management should _not_ be throwing you under the bus and exposing you to break that news to the customer. Nothing destroys a booking pipeline faster than customers with mismanaged expectations.

2) This type of behaviour from Sales teams is usually indicative of misaligned incentives. A concrete example of this type of situation could be company in an early "hyper-growth" phase where they only comp on new bookings, and don't comp Sales on contract renewals.

<comment><USER3> Is it common for managers to actually get involved in projects in other organizations?

<comment><USER4> I had a long response written out but my browser barfed. Short answer is "yes". Longer answer is "it depends" on the size of the budget/deal, the business function that the manager fulfills, and the size of your organization as a whole:

* Business function: If you're customer facing, most [project|practice|field|support]managers should be sticking their nose into day-to-day projects, especially when a bad message needs to be delivered (e.g. the product we sold you will fall short of your expectations). This is not only because the customer will be incensed, but because there may also be commercial repercussions (e.g. SLA penalties) that you may not be aware of in umbrella master [service|support|license] agreements.

* Deal/budget size: Typically, the larger a manager's deal or budget, the more headcount they have. And the more headcount on a project|team|division, the more intermediate managers there will be to layer the manager in question. Hence, if the deal size is rather large, in most cases managers will _not_ get involved on a day-to-day basis, but should be available for escalations (presuming an account management role for larger deal sizes). If the deal size is usually smaller, more than likely the manager will be more involved (e.g. as a project manager).

* Org size: BDC - not usually. Startup - usually yes.

</comment></comment></comment></comment></comment><comment><USER5> Working in an enterprise and having bought enterprise software, my suggestion to the sales staff would be: Learn to say "no"!

If we send you twenty pages of requirements, we do _not_ expect your product to cover each and every one of them (especially not those labeled as "nice to have", and also not those that were inserted just to please some internal egos and will be ignored in the decision-making altogether... although I grant you that this will be hard to judge from the outside). Nevertheless, I have experienced time and time again that sales agents waste 45 minutes of their two hour presentation to try to explain some clumsy workaround for something their software cannot do instead of spending that time to focus on what their software _can_ do. Also, a software that supposedly can do everything makes me wonder if it can do these things _well_... or if we might end up with a solution so customized that every upgrade turns into a nightmare.

</comment><comment><USER6> I was absolutely expecting this site to be satire. In my experience, enterprise sales involves building a great demo, lying through your teeth and cashing the checks.

<comment><USER7> this is an antiquated point of view.

<comment><USER6> I have seen it with my eyes in the last 6 months and it seems to be a model that never stops working. I'll specifically name Adobe, HP and Oracle as offenders. There is only 1 sales model I'll accept. A 30-day limited developer license to install/access and tinker with your product. Maybe companies exist that are "doing it right" but the old way is still alive and kicking and raking in millions.

EDIT: Exhibit A-Z is the current $240M lawsuit by the State of Oregon v Oracle: [http://www.bizjournals.com/portland/blog/health-care- inc/201...](http://www.bizjournals.com/portland/blog/health-care- inc/2015/02/oracle-v-oregon-101-a-primer-on-the-4-so-far-court.html)

<comment><USER8> Any sufficiently advanced technology takes more than 30 days to customise, never mind decide it's the optimum solution...

<comment><USER6> It's not a matter of building out your entire project, it's just to get a feel for the quality and decide if it's complete bullshit. If you think 30 days isn't enough time, then a vendor demo is worth less than zero.

</comment></comment></comment></comment></comment><comment><USER9> By the way: The Sales subreddit has some very good information regarding sales. A good amount of knowledgeable people visit it. They've helped me before to get over my self-inflicted sale issues (due to my introverted nature).

[http://reddit.com/r/sales](http://reddit.com/r/sales)

<comment><USER10> Do you mind linking to the thread where they helped you? Sounds like it'd be very useful to me too.

<comment><USER9> I'm afraid of asking questions publicly, so all is done through PMs. Most people will gladly answer and help. I find helpful people by combing the most commented on threads and reading the answers. Thoughtful answers tend to be written by people with a sincere desire to help. I don't usually ask the same person for more feedback to respect their time. To get the best advice ask actionable questions. Like "I'm using this this email script to land cold leads from small businesses. People are not replying much. What call to action can I include to get replies?"

</comment></comment></comment><comment><USER11> There's a lot of SaaS articles in an Enterprise selling article list. I'm curious how many SaaS products have broken the Enterprise market that people know of? And by Enterprise, I mean at least 6 figure annual price tag, not a few sales to 10 person teams that happen to work within an Enterprise. I guess Google for Work and Salesforce are two...

<comment><USER12> ServiceNow - ITSM / ITOM Workday - HCM / ERP NetSuite - ERP, Commerce, CRM

</comment></comment><comment><USER13> [http://a16z.com/2015/05/20/enterprise-sales-for-product- peop...](http://a16z.com/2015/05/20/enterprise-sales-for-product-people/)

This article by Steve Sinofsky provides a broader framework to understand Enterprise sales.

</comment><comment><USER14> Very interesting.

</comment><comment><USER15> lol, enterprise tech sales needs a guide?

1) Wear douchy leather shoes, slacks, look smart 2) BS and make stuff up on software you 20% understand until the client nods 3) Keep going 4) Call client, every, freaking, month, for 2 years 5) Do this enough - Sale!

<comment><USER16> ha ha! I get it! Cause the job title you have determines your personality and style and ethics and morals. And all sales guys are slimy, not like us pure, rational engineers.

</comment></comment><comment><USER17> 1\. Go to expensive golf course, 2. Propose large software purchase, 3. Large envelope stuffed with cash, 4. Profit! Rinse repeat.

<comment><USER15> haha I said almost the same thing above.</comment></comment>


Between Sinew and Spirit: Are You a Body with a Mind or a Mind with a Body? - <AUTHOR> https://www.brainpickings.org/2017/11/13/mind-body-ted-ed/ <comment><USER2> tldr: ¯\\_(ツ)_/¯ This is an interesting question, but I don't feel like this offered anything new towards an answer.</comment>


Secrets of the "New Music Industry" - <AUTHOR> https://www.eff.org/deeplinks/2010/11/secrets-new-music-industry-old-music-industry <comment><USER2> As a member of an indie rock band, I can say that it is nice to see the majority of our album sales going directly into our pockets. I can't imagine making pennies on an album sale, though, the band completely funded the recording studio time and production costs of both vinyl and CD, so we are entitled to make more profit off of album sales.

But, our problem isn't making the highest profit from selling our music. The biggest problem is how to grow our fan base and effectively reach out to new listeners who would be interested in our sound, but haven't discovered us.

I feel like the "old music industry" had a way of solving the 2nd problem as it seems to be analogous to winning a popularity contest and straight up brain-washing young children into liking something by making it look or sound cool.

Anyone can create music and get it into the iTunes store these days. The margins are great, but you still need tons of people to like and buy your music to actually make a living out of it.

<comment><USER3> My impression is that the iPhone App Store does a much better job of letting small developers make money than the iTunes music store does of letting small bands make money. I wonder what the core difference is?

<comment><USER4> I don't think small developers would be as successful on the app store had there been a record label equivalent in place. The app industry was virtually created with the app store. By the time iTunes came around, however, the music industry had already been operating in its current form for ~50 years.

If there was a Warner Music of app development, their products would muscle out indie developers just as record music does for indie music.

</comment></comment></comment><comment><USER5> It's extremely frustrating to actually interpret the information in this article and at its linked-to articles.

The basis of this article's claim is that "music purchases" are up by 50% since 2006. Except, even ignoring revenue, a "music purchase" nowadays is typically one song, not one album. In their own words, if an independent artist sells two songs on iTunes, they make as much money as if they sold a whole CD.

But selling two songs instead of one album would be a _100%_ increase in purchases, not a 50% increase!

The numbers they give neither support nor refute their point; I have no idea whose side I should believe. Neither, I suspect.

<comment> Trey-Jackson The two statistics you cite are independent.

Purchases are up 50%. period. the end.

Independent of that is the fact that when an artist sells two songs on Itunes they make as much money as if they sold a whole CD. period. the end.

The second fact does not refute first, it is orthogonal.

The point they're making is that purchases are _shifting_ from albums to tracks (as you mention), and because of the higher revenue generated (for the artist) by selling tracks, artists are winning in this scenario and the record labels are losing money.

This point is clearly made in the first bullet of the EFF article.

The larger point isn't about artists at all, but that the old school music industry is waging (and winning) a war using copyright laws, and this is having disastrous effects on free speech. The example in the first paragraph was about the seizure of 82 domains, without any due process, and this was basically because the government enforced (without question) the claims of the music industry.

Imagine if it happened to you, your domain was seized because a company with some lawyers said it was infringing on their copyright. Think you'd be miffed?

Other countries are enacting 3-strikes laws (e.g. France), where if you were accused of copyright violation (downloading illegal mp3/mp4) 3 times (accused, not even convicted), then your IP is blocked, and you can no longer access the internet from that connection.

And the EFF is saying that the music industry is getting these kinds of legislation passed on the false premise that "piracy" is harming artists' livelihoods, when in fact margins on money from sales of music is _increasing_ for artists.

Obviously you can disagree with their points, but the facts they've presented do not conflict.</comment></comment>


MIT licence can be community hostile - <AUTHOR> https://www.lesinskis.com/MIT-licence-community-hostile.html <comment><USER2> As a counterpoint, I generally prefer using MIT repos/libraries because cognitively I don't need to think or worry about how/when/where/underwhatconditions I can use the repo. I don't contribute as much as I could (due to my employer) but the little that I have and the few repos I've made have all been under MIT because I want to perpetuate this cognitive freedom for others.

<comment><AUTHOR> But this "cognitive freedom" is an illusion because for many people in many jurisdictions the lack of explicit patent clauses in the MIT license causes potential patent issues. As a business owner I'm actually increasingly worried about the patent trolling angle with MIT derivatives as time goes on (I believe MIT has legal precedent regarding patents in some places like the USA but not others). If you want a permissive license that's easy for people to use then you can always use Apache version 2 or the MPLv2, with these there's less worries of patent issues.</comment></comment>