AM Analytics, an incubated startup, seeks a lead developer / co-founder - <AUTHOR>

AM Analytics (amanalytics.com) was recently admitted into the Berkeley Ventures (berkeleyventures.com) incubator program.  AM Analytics is seeking a talented web application developer / co-founder to lead the development of our social media and market intelligence dashboard.
About me:  I'm a recent college graduate and I moved from the east coast to the Bay Area to work on the venture full-time.  We have one adviser in the Bay Area, and two part-time employees on the east coast.  I am ideally looking for someone who lives in the Bay Area to work with me full-time in our Berkeley Ventures office.
Please see below for more details:
AM Analytics is a web startup committed to building the most comprehensive social media and market intelligence dashboard available. The AM Analytics team is a combination of individuals passionate about leveraging social media to help businesses make informed decisions. Our current team has backgrounds in internet technology, government security, financial analysis, market intelligence. Although our team's education and experience is diverse, our goal is to deliver a single, integrated social media analytics platform to our customers.
Responsibilities:
As the lead web application developer, you will own the application design, implementation, and maintenance of the AM Analytics platform.
Requirements:
1.  Experience with web scripting and application languages (Python, Ruby, etc)
2.  Experience working in an open source development environment (Linux, Apache, SVN)
3.  Experience with Model-View-Controller (MVC) web frameworks (Django, Ruby on Rails)
4.  Experience with REST(like) API's, XML parsing / handling, JSON, etc.
5.  Expertise in HTML/CSS, including familiarity with good
information and aesthetic design principles.
6.  Experience with Flash / Action Script
Big Plus:
1.  Prior social media application development experience.
2.  Fun person to hang out with.
3.  Enjoy building an innovative web application that makes customers happy.
Interested? Please email firstname.lastname@example.com for details. <comment><USER2> Hey Alex, congratulations for getting admitted into Berkeley Ventures. AM analytics is very cool/useful concept. I would be more than willing to try/pay for the product when you alpha/beta launch.</comment>


Should My Kid Learn Mandarin Chinese? - <AUTHOR> http://blogs.wsj.com/speakeasy/2011/08/17/should-my-kid-learn-mandarin-chinese/?mod=wsj_share_twitter <comment><USER2> If you know Mandarin Chinese there are are about 5-locations in China where you can communicate or do business: [https://en.wikipedia.org/wiki/List_of_territorial_entities_w...](https://en.wikipedia.org/wiki/List_of_territorial_entities_where_Chinese_is_an_official_language)

If you know English you can communicate or do business with 67 sovereign states and 27 non-sovereign entities where English was an official language. [https://en.wikipedia.org/wiki/List_of_territorial_entities_w...](https://en.wikipedia.org/wiki/List_of_territorial_entities_where_English_is_an_official_language)

If you know French you can communicate or do business with about 29 countries: [https://en.wikipedia.org/wiki/List_of_territorial_entities_w...](https://en.wikipedia.org/wiki/List_of_territorial_entities_where_French_is_an_official_language)

If you know German you can communicate or do business in about 12 countries: [https://en.wikipedia.org/wiki/List_of_territorial_entities_w...](https://en.wikipedia.org/wiki/List_of_territorial_entities_where_German_is_an_official_language)</comment>


Best Buy Sitting on a Pile of HP Tablets - <AUTHOR> http://allthingsd.com/20110816/ouchpad-best-buy-sitting-on-a-pile-of-unsold-hp-tablets/ <comment><USER2> HP should just give a tablet away to anyone who signs up to be a developer even if it is a back door for consumers to get a nearly free tablet. Maybe even put the free tablet at the end of an Ares tutorial [1].

It's a little late for a back to school bundle sale. At this point we might see TouchPads go for insane prices on Black Friday. But that's still a couple months away.

HP needs to be more aggressive about give aways. Google has been giving away Android devices to thousands if not tens of thousands of people. This excess stock is a pretty good opportunity to get devices in the right hands.

[1] <http://ares.palm.com/Ares/about.html>

</comment><comment><USER3> I wonder if sales of these devices are slow in part because of the OS it runs on. Everything cool in mobile seems to be either Android or iOS. If developers don't do webOS, there aren't going to be killer apps for it. And apps sell devices.

<comment><USER4> I've always wondered how valid the 'apps sell devices' theory is. In the 80s/90s, I think it had merit as you bought a computer for the capabilities provided by the apps. But I look at the apps on my phone (WP7) and with the exception of games, a fitness tracker and some photo editing apps, I don't have anything that couldn't be run in the browser. I'd go so far to say that I often find myself on a web page and then realize that I've got an app that does offers the same functionality.

Browser, email, maps, media player are the killer apps, and every device has them. I think games is the downfall of some devices.

Blackberry Playbook not having an email client, that I would call an app that would prevent a sale, but does anybody really look at the app catalog and say to themselves "if it hasn't got angry birds, I'm not buying it"?

I've played with webOS, and I wasn't wowed, but anybody I know who as owned a webOS device (and has had both Android and iOS) are adamant that it is the best OS experience out there.</comment></comment>


Many Psychology Findings Not as Strong as Claimed, Study Says - <AUTHOR> http://www.nytimes.com/2015/08/28/science/many-social-science-findings-not-as-strong-as-claimed-study-says.html <comment><USER2> Take the time to read the story (many comments don't reflect more than the headline), which is far more complex and interesting than the headline. For one thing, almost all studies' effects were reproduced, but they were generally weaker.

* Most importantly, from the Times: _Strictly on the basis of significance — a statistical measure of how likely it is that a result did not occur by chance — 35 of the studies held up, and 62 did not. (Three were excluded because their significance was not clear.) The overall "effect size," a measure of the strength of a finding, dropped by about half across all of the studies. Yet very few of the redone studies contradicted the original ones; their results were simply weaker._

* Also: _The research team also measured whether the prestige of the original research group, rated by measures of expertise and academic affiliation, had any effect on the likelihood that its work stood up. It did not._

* And: _The only factor that did [affect the likelihood of successful reproduction] was the strength of the original effect — that is, the most robust findings tended to remain easily detectable, if not necessarily as strong._

* Finally: _The project's authors write that, despite the painstaking effort to duplicate the original research, there could be differences in the design or context of the reproduced work that account for the different findings. Many of the original authors certainly agree._

* According to several experts, there is no reason to think the problems are confined to psychology, and it could be worse in other fields. The researchers chose psychology merely because that is their field of expertise.

* I haven't seen anything indicating the 100 studies are a representative sample of the population of published research, and at least one scientist raised this question.

<comment><USER3> > The only factor that did [affect the likelihood of successful reproduction] > was the strength of the original effect — that is, the most robust findings > tended to remain easily detectable, if not necessarily as strong.

This is probably just regression to the mean. The comment above suggests to me that the tendency for the findings in replicated experiments to be weaker does NOT necessarily come from any flaw in the experimental design, but from the criteria for findings to be published.

You would expect any given effect to show some variation around a mean effect size. My lab and your lab might arrive at slightly different results, varying around some mean/expected result. If your lab's results meet statistical significance, you get to publish. If my lab's don't, I don't get to. So the published results are the studies that, on average, show a stronger effect than you might see if you ran the study 100 times.

> Yet very few of the redone studies contradicted the original ones; their > results were simply weaker.

If a third lab replicates the experiment, their results are more likely to be close to the (possibly non-publishable) mean value than the (publishable) outlier value. So on average, repeating an experiment will give you a LESS significant result.

If the strength of the original effect (and thus probably the mean effect strength over many repeated experiments) is larger, the chance of replicated experiments also being statistically significant is higher.

In other words, these new results are very predictable and don't _necessarily_ indicate that anything is wrong.

<comment><USER4> For an example of this effect in physics, look at the Millikan experiment

[https://en.wikipedia.org/wiki/Oil_drop_experiment#Millikan.2...](https://en.wikipedia.org/wiki/Oil_drop_experiment#Millikan.27s_experiment_as_an_example_of_psychological_effects_in_scientific_methodology)

<comment><USER5> Oh, the Millikan experiment. I had to do it in uni lab as a 4 hour long experiment. It's impossible to gather enough data in this short time and your eyes figuratively falls out by staring into the microscope measuring the drops' velocity. I can assure that this is the worst experiment one can do as a student.

</comment></comment></comment></comment><comment><USER6> As a marketer, I have long given up on psychology as a field. The practitioners are too wishy-washy, the experiments too prone to confirmation bias, and the results too unusable.

I feel behavioral economists cover many of the same subjects, but their work is much more interesting and scientific. The experiments are tighter and ask better questions. And they focus more on specific characteristics in decision making, and less on asking big questions.

<comment><USER7> > _And they focus more on specific characteristics in decision making, and > less on asking big questions._

It seems more that it's behavioural economists that do studies relevant to your marketing, not a flaw in psychology itself. Psychology is an incredibly broad field, and it asks questions both big and small. Plenty of psychology studies ask very specific questions looking for very specific effects.

<comment><USER8> My place of employment was funded a grant, and did a study to show that teens were using mobile devices more often than they did years ago (I don't remember the timeframe). I believe they got something like a 200k+ grant for this. A team of like 10 PhD psychologists to show something we already know.

Not saying psychology as a field is pointless, or anything, just that they do occasionally do some silly studies.

<comment><USER7> You're probably oversimplifying the study considerably, but even so, even things that "everyone knows" need to be formally studied. All across science, non-intuitive results happen all the time. In psychology, it's even more common, since biology doesn't play by the relatively clean rules of materials physics.

After all, "everyone knows" that blacks are inferior and only useful as slaves (they even want to be, deep down); "everyone knows" that women are too temperamental to vote sensibly; "everyone knows" that people of that religion over there eat babies and we should destroy them before they destroy us...

For a more recent example, "everyone knows" that young people use condoms more often now, given the higher levels of sex education about pregnancy and STIs they've grown up with - yet regional studies often show significantly decreased levels of condom use. Another one is the assumption that the current crop of young'uns are fantastic with understanding computers due to growing up with them, yet this hasn't been borne out in studies. Turned out that consuming from a device doesn't mean you understand how it works any better.

Such studies are _particularly_ important at ferretting out what's happening with people who aren't society's favourites - we all know what a man is, right? Always looking to get laid, not afraid to get physical, plays sport, drinks beer. Most men are like that, right? Not really; there's actually a huge variety of interests and desires. Studies of 'obvious!' things are just as necessary as fringe things, because sometimes the results are really quite unexpected.

<comment><USER8> "After all, "everyone knows" that blacks are inferior and only useful as slaves (they even want to be, deep down); "everyone knows" that women are too temperamental to vote sensibly; "everyone knows" that people of that religion over there eat babies and we should destroy them before they destroy us..."

This is simply not true at all these days, and I don't like that HN users would push a normal conversation into one where you imply your "opponent" is racist, sexist, or a religious bigot. Might as well have called me a Nazi or brought Hitler into the conversation.

And I don't believe you need Psychologists or a peer reviewed study to discern mobile platform usage, we have other ways to getting said metrics.

<comment><USER9> She was saying that society in general was racist back in the day when they believed that conditions such as Drapetomania.

<comment><USER8> Thanks for the downvote, if she was saying that, why did she say "Everybody Knows" rather than "Everybody Knew." No, I see a distinct verbal jab in that statement, but whatever, I'd downvote her if I could, but you in power like to keep everybody but those in the click down by downvoting even when we contribute to the conversation. Hey, I have 351 karma, why don't you get your friends over here and bring me down to nothing!

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Perhaps the biggest take away I found while studying psychology is that a lot of research in the field just couldn't be trusted until you vetted it. Political pressures are too great a corrupting factor. Words would be redefined. Conclusions overstated or over applied. This is on top of the already existing 'publish or perish' issue that impacts science as a whole.

The closer one was to neurology (like physiological psychology), the better it became. The closer one was to sociology (like IO psychology) or to a politically charged issue, the worse it became.

Also applies to psychiatry. I remember reading some of the papers published related to the DSM-V and at one point it looked like little more than peer reviewed version of two siblings fighting (though that was the worse case, not the average).

One big thing is to look at how the researchers defined words and look into how things translate when multiple languages were involved.

<comment><USER11> > Words would be redefined. Conclusions overstated or over applied.

Even neuroscience has a hearty helping of this. The data itself is one thing, but what it's sold as showing is quite another. For example if you read a claim that neuroscience has discovered something about "addiction", "free will", "motivation", "friendship", "love", etc., dig into how they've chosen to define those terms for the purpose of the study.

There's often a bit of concept-laundering going on, where a common term is defined using a very narrow (and often conveniently chosen) definition to show a result, but then the implications of that result are discussed with reference to the original, more general sense of the term. News articles about neuroscience are the worst, of course, but even quite a few scientists themselves do this.

</comment></comment><comment><USER9> Here is the paper the Reproducability Project just released on Estimating the reproducibility of psychological science: [http://www.sciencemag.org/content/349/6251/aac4716](http://www.sciencemag.org/content/349/6251/aac4716)

</comment><comment><USER12> Here's a nice, approachable treatment of some of the ways psych studies can go wrong; it also offers concrete suggestions for fixes:

      Joseph P. Simmons, Leif D. Nelson, and Uri Simonsohn
      "False-Positive Psychology: Undisclosed Flexibility in Data Collection and Analysis Allows Presenting Anything as Significant"
      Psychological Science November 2011 22: 1359-1366,

Free full-text (no paywall): [http://pss.sagepub.com/content/22/11/1359](http://pss.sagepub.com/content/22/11/1359)

(via: [http://bahanonu.com/brain/#c20150315](http://bahanonu.com/brain/#c20150315) )

</comment><comment><USER13> There has been a backlash against attempts at replication in psychology: [http://phenomena.nationalgeographic.com/.../failed.../](http://phenomena.nationalgeographic.com/.../failed.../) [http://andrewgelman.com/2013/12/17/replication- backlash/](http://andrewgelman.com/2013/12/17/replication-backlash/) and even a backlash to the backlash: [http://phenomena.nationalgeographic.com/.../failed.../](http://phenomena.nationalgeographic.com/.../failed.../)

<comment><USER14> One of the weird critisisms I've heard (and reflected in your first link) is "but the reproduced study had some slight difference". If a slight difference can make an effect disappear then it's not such an interesting or general effect as the original study claimed to show! Why didn't they already test for the effect of slight differences themselves?

<comment><USER15> You can't evaluate every single slight variation on your testing environment. That's just the nature of the field.

</comment></comment></comment><comment><USER16> The replication effect sizes are almost all positive [1]. This study represents very strong validation that the published results were qualitatively true, in the main.

The regression to the mean effect is unsurprising and doesn't diminish this finding. Given the difficulty of performing this kind of research, this is a very positive result for the field.

[1][http://m.sciencemag.org/content/349/6251/aac4716/F1.expansio...](http://m.sciencemag.org/content/349/6251/aac4716/F1.expansion.html)

</comment><comment><USER17> For anyone interested in more information on this topic, the book "Psychology Gone Wrong" by Tomasz Witkowski and Maciej Zatonski is a very in depth look into the problems in this field.

</comment><comment><USER18> This is how I evaluate studies, "are the data and code made available?" It's a simple request and this study is the first I've ever seen offer both. Bravo!

</comment><comment><USER19> "Study says other studies are flawed"....

Didn't read the article, but couldn't help but comment on the title, good laughs.

<comment><USER20> "Many Findings About Psychology Findings Not Being as Strong as Claimed Not as Strong as Claimed, Study Says"

<comment><USER21> This chain of logic was covered in a 2011 fiction piece published in Science's competing journal Nature: [http://www.nature.com/nature/journal/v477/n7363/full/477244a...](http://www.nature.com/nature/journal/v477/n7363/full/477244a.html)

"Although it is nonsensical to rely on evidence provided by human-based research when judging whether humans are themselves inept, in doing so, the editors (all human, I note) provide a perfect example of the feebleness of human reasoning, thereby validating their claims."

</comment></comment></comment><comment><USER22> Psychology is more like religion than science.

</comment><comment><USER23> And of the 40 that turned the same results, a fair chunk might be just by chance.</comment>


Why are some of my submission Greyed out? - <AUTHOR> I noticed some of my news submissions and questions and polls are grey and other are black.  Does this mean no one can see the greyed out submission?  Thanks for the help. <comment><USER2> no, the "greyed out" ones are simply items you have already viewed!

I can see at least 7 more of yours recently on the 'live' page

<comment><AUTHOR> Thanks for the info! thought I was wasting time posting links.

</comment></comment><comment><USER3> Yup, the 'followed link' is grey. So those are links you have visited.</comment>


Ask HN: Alternative to Google play music once they close? - <AUTHOR> I've been using google play music for about 6 years. It's a convenient way for me to access all my music (mostly ripped CDs).<p>Google is shutting down this product at the end of the year. Any suggestions for an alternative? I like being able to access my own collection and not crazy about paying a second time to access music I already bought. But if I am going to pay for a service, which one? <comment><USER2> I hate Google for this. I love Google Play Music, and have had a premium subscription for many, many years. Youtube Music doesn't come close, the interface is absolutely horrible, a UX disaster. Way to go in alienating your paying customers, Google.

Sorry for the rant. I know it is not what you were looking for. I have no solutions for people that use the upload stuff (which I don't).

<comment><USER3> I've switched to YouTube Music recently and it was pretty good for me. For me it's mostly on par with Google Play Music and on top of that it has a deep integration with Youtube. It allows you to play songs which are uploaded as videos on YouTube which is quite useful if some song/album is missed in the library. The only noticeable downside for me is that your YouTube Music subscriptions appear in YouTube subscriptions list which makes it harder to look for non-music stuff.

</comment></comment><comment><USER3> What about YouTube Music? Google recently added a possibility to transfer your library there from Google Play Music: [https://music.youtube.com/transfer](https://music.youtube.com/transfer) This should work for purchased and uploaded songs as well([https://support.google.com/youtubemusic/answer/9698084?hl=en](https://support.google.com/youtubemusic/answer/9698084?hl=en))

</comment><comment><USER4> I like Spotify.

<comment><USER5> Same; I paid premium and haven't looked back. Apps are fantastic and the service itself is super straigtforward and has a great catalog.

(Feels so strange to "review" Spotify, haha)

</comment></comment><comment><USER6> Honestly I'm just back to storing my own music and gave up on streaming services. To discover new music though i use mostly Hype Machine, Deezer and Youtube music, just get the actual mp3 for the stuff I like so I am not at the mercy of changing licenses etc.

</comment><comment><USER7> Nicotine+, dump files to Google drive, and use Cloudplayer on Android or other desktop program like Clementine to stream your music from.your Google storage.

</comment><comment><USER8> I bought an app Neutron and just play my own music from the hd from my phone. As soon as google music announced this was going to happen I immediately looked for some other solution.

</comment><comment><USER9> VLC ?</comment>


Using Subversion for graphic design files and other binary assets - <AUTHOR> http://subversion.wandisco.com/component/content/article/1/32.html Anatoly Paraev talks about how his company, PixelNovel, is getting their developers to use Subversion. <comment><USER3> I've worked with a large team of artists and we had an art repository of around 125GB and maybe 10000 changes. Subversion worked really well. We used the tortoise interface and after a few weeks everyone got used to it.

Adding plugins for specific apps is a good idea. I had previously used Alienbrain and the only real difference was the plugins (AB had plugins for MS Office, 3DSMax, Dev Studio and Maya) and an interesting bucket backup system where you could back up legacy checkings making the database smaller and significantly faster. At the time we had a database of about 1TB and most of it was in bucket backups.

Another interesting feature was the workflow where an artist would checkin an item but it wouldn't go into the main development branch until a senior artist has checked the work. This was a nice idea but proved to be too time expensive for our senior artists who of course were not paid to be gatekeepers and were the best artist we had so management preferred them to actually make things!

The least interesting thing was the price per seat which was around £1000 per year and a support contract which grew depending on the size of your team (this was about 8 years ago so I may be off on the prices then and now).

Although Alienbrain was cool my personal feeling was that the money was better spent on a little bit of training and a subversion system. As long as your team is smaller then say 50 artists and developers.

</comment><comment><USER4> As an IT consultant, I once got a completely non-technical client using SVN for all their documents. With a little guidance on the use of TortoiseSVN, they soon came to love it. Years later, they're still using it. SVN isn't just for developers!

<comment><USER5> I've had similar reactions from Project Managers after I showed them some versioned Excel files. They were blown away by the ability to go "back in time without having to manage copies". The revision graph totally floored them.

There's an opportunity here somewhere... take TortoiseSVN, remove all ability to branch/merge and anything beyond taking a file forward and backward in a timeline, make it stupidly simple and use words that non-technical people understand. And then sell it as the "time machine for files".

For recurring income, make it a DVCS (so start with TortoiseHG instead of TortoiseSVN) and offer to back up their files for $5/mo and make the "backup" a `hg push remote`

I'm telling you, it's amazing how few people who work with computers and digital files all day long have _no_ idea about cvs,svn,hg,git, etc.

They think that if it's not handled by the display application (Excel, Word, etc), it's not possible. They have no conception of doing stuff on the file level.

<comment><USER4> The GPL license may be an impediment to this plan, and the DVCS concepts will probably be far too complex when dealing with non-technical people who just want to work together.

My experiences suggest that the money would be in setting up and training, rather than a product as such. I did think about it carefully and design something (easier tools, server side search), but really it didn't seem worth it.

</comment></comment></comment><comment><USER6> If the overhead of a subversion checkout storing each file twice is too much for your dataset and drive, you might take a look using scord with subversion, which allows your checkout to store only one copy of each unmodified file. <http://scord.sourceforge.net/>

A little more detail: In addition to the working copy of a file, a subversion checkout includes a pristine version of each file for diffing (e.g., 'svn diff', as well as to make 'svn update' and 'svn commit' more efficient). scord is a Linux and Mac OS X FUSE file system that mediates access to a directory tree, detects when a pristine and working copy pair contain the same content, and keeps only one copy around in these cases.

I store my photo album in subversion - I love not having to worry about accidentally losing a photo. Halving the disk space needed for the checkout lets me fit my photo album into my laptop harddrive.

Disclaimer: I'm the primary author of scord.

</comment><comment><USER7> I work for a dev company that does a lot of Photoshop and have pointed our head of design at this product.

PixelNovel should look to integrate their ComparePSD product into the plugin as well. It would be quite beneficial to be able to do a granular diff of the photo properties across two versions of the .psd.

We also noted in a discussion, it'd be beneficial if you could overlay two versions of the .psd file and have the system highlight the differences. (E.g. you darken the eyes in the latest version, and when overlayed over the previous version, there'd be a light yellow circle drown around the eyes to make the change apparent).

<comment><USER8> Hi, Thanks for your suggestions.

We are going to integrate ComparePSD into Timeline very soon - in fact the integration was the reason we created comparePSD in the first place, it's just that we keep having higher priorities all the time.

We'll think about your overlay suggestion though I have to say it's bit more difficult than just comparing layers. Please let us know if you have any other suggestions or questions: support at pixelnovel dot you-know-what

<comment><USER7> As for diff'ing two images (image A and B), assuming there's a picture that represents the diffs (image D), if you did a pixel by pixel comparison of the two images (A & B), if the two pixels differed in color, you could simply display that pixel in a complimentary third color on image D (or allow the designer to see all conflicting pixel in a single, consistent color which would show clusters of colors where changes had been made). Just a thought.

</comment></comment></comment><comment><USER9> It has always seemed to me that a traditional CMS was a better path for creative archiving than a version control system, but that may just be me. A CMS can do things like allow you to manage a PS document while publishing it's flatter JPEG to your web site or a print image in a Quark layout. I guess if you just want to back up different version than a version control system would do just fine and is simple but a CMS can save so much time and there are plenty of good ones that are free.

</comment><comment><USER10> Very nice plugin for photoshop! I don't have a lot of experience with this, but anecdotally I've had better experiences using git with bunches of binary files than SVN. Maybe it had something to do with the structure of the binaries, but I was always and forever getting conflicts and such in SVN - <USER2> maybe it was the way my old company set it up, who knows.

</comment><comment><USER11> a photoshop plugin is genius. the graphic designer on our team was able to use an eclipse plugin to update/commit. we've switched to git which doesn't have any nice gui's (smart git is best so far...thinking of buying it) so i do all his pulls/pushes.

<comment><USER12> We just taught our graphic designers how to use git. Yeah, it's a command line interface, but really once you've had an hours training on the basic concept and been given a cheatsheet it's not difficult.

</comment></comment><comment><USER13> I wonder if anyone here could comment on using subversion with mod_dav_svn. One downside is that you lose the ability to comment on changes, but the upside is that your users just see it as a regular web folder.

Thoughts?

<comment><USER14> It works pretty well within its limitations, but other downsides are:

* If your program creates a temporary file on the webdav file system, it ain't temporary, it just became version controlled. :-(

* You tend to get a _lot_ of versions, all looking alike. It becomes somewhat more difficult to determine _which_ version you want to roll back to if you need to. In addition, it takes up a lot of disk space to maintain lots of (unnecessary) versions, especially if they are binary blobs.

Both of the above drawbacks can be worked around by copying the file off the webdav file system, editing it, and then copying it back on. In the case where I saw this done, most (all?) of the users ended up switching to TortoiseSVN and stopped using the webdav interface.

</comment></comment><comment><USER15> Also on HN:

"Git: A Designer's Perpective": <http://news.ycombinator.com/item?id=774983></comment>


Deis open source PaaS now ready for dev, test apps - <AUTHOR> http://deis.io/deis-0-1-0-ready-for-devtest/#

<comment><USER2> I checked this out a while ago but found it only works (out of the box) on EC2. Eagerly awaiting support for other environments.

<comment><USER3> Indeed. If they can add Openstack support I'd personally be more interested in it than Flynn, as Opdemand actually has a history...

<comment><AUTHOR> To be clear you can use Openstack today, you just can't automatically provision Openstack instances. You have to construct your formation manually. However, you still get most of the platform benefits. :)</comment></comment></comment>


Story Points and Sizing Complexity - <AUTHOR> https://grip.qa/story-points-sizing-complexity/ <comment><USER2> I would argue that point-based estimation is just as inaccurate as time-based estimation in that it only serves as a proxy for effort, which is done over time. Point systems (and time systems) have two big issues

      * You're throwing away all your data points when you condense a story down to a single point. Systems exist to try and avoid things like anchoring bias, but you just throw it away.
      * You imply uncertainty exists about the task duration, but don't try and measure how uncertain you are.

Using Monte Carlo simulation here can really help address these two issues.</comment>


Atheism is an old boys' club. More women should admit to being Godless - <AUTHOR> http://www.telegraph.co.uk/women/life/atheism-is-an-old-boys-club-more-women-should-admit-to-being-god/ <comment><USER2> Atheism isn't a club though. You just... don't go to church. I don't think I've ever felt the need to read a book about atheism - what would it say? "There is no God"? Well, obviously, I didn't need a book to tell me that.

<comment><AUTHOR> I agree. It's kind a dilemma - seeing atheism as a movement or ideological group with (inofficial) "leaders" turns it into just another type of institutionalized herd mentality thing. Yet if people don't do that but just don't go to church, institutional religion always will be stronger and better at bringing people together, which in turn makes it harder for people who just don't go to church (or mosque or whatever) to defend the freedom to not do that without being bothered.</comment></comment>


Perspectives of Using Oscillators for Computing and Signal Processing - <AUTHOR> https://arxiv.org/abs/1805.09056 <comment> 52-6F-62 So if I'm to understand this correctly, the proposition would involve designing new chips based not on transistors but an oscillating component made out of something like [probably uneducated example] quartz crystal? Or just to also include something like the latter? For the purpose of manipulating data flow? Or is this all a network of transformers inducing the flow on each other?

edit: This helps, I guess there's no sound, practical solution yet. _Clearly, LC oscillators have serious practical limitations: inductors remain a major challenge in any planar and miniaturized technology. "_

I'm at work and I've only read into the second page so far, but it's interesting. I didn't know Van Neumann had an oscillatory computer design.

Very interesting!

</comment><comment><USER2> Reminds me of the gelatin analog computer [http://hplusmagazine.com/2014/01/10/defend-your-network- with...](http://hplusmagazine.com/2014/01/10/defend-your-network-with-a- bucket-of-jell-o/)

</comment><comment> bra-ket amazing, I was just thinking about neural-like computation using phase-locking oscillators and here it is, in a patent from 1957 filed by none other than Von Neumann: [https://patents.google.com/patent/US2815488](https://patents.google.com/patent/US2815488)

thanks a lot for the link!

</comment><comment><USER3> Fascinating</comment>


Ask HN: How do you discover great podcast episodes? - <AUTHOR> I'm willing to spend 5 hours per week listening to podcasts. Not every episode of a podcast is of the same quality, and ideally I'd like to listen to only the best 2-3 episodes from each of ~100 podcasts.<p>(It would be even better to only listen to episodes that are most relevant to my specific interests, but let's put that aside for the moment.)<p>Given 100 podcasts, each with ~100 past episodes, how can I get the best 2-3 episodes of each, so that I can just hit 'play', instead of spending half my podcast listening time choosing an episode and/or skipping a few duds? <comment><USER2> Not a perfect system, but you can see each episode's approximate popularity in iTunes, which gives you some idea. Then, do a quick look at the summaries to see which episodes seem interesting. Add only those episodes to your Up Next queue.

</comment><comment><USER3> i am also looking for opinions on this :)</comment>


The nutrition study the $30B supplement industry doesn't want you to see - <AUTHOR> https://arstechnica.com/science/2019/04/the-nutrition-study-the-30b-supplement-industry-doesnt-want-you-to-see/ <comment><USER2> Like most studies on the value of supplements, it was solely focused on whether the minerals "extend life" or "prevent cardiovascular disease." The research on that has been well settled that supplements do neither, so this study was just a waste of time and money.

First, structural, flaw in the study: its actually just a statistical analysis of another study...which was based on self-reporting of diets and exercise habits.

Second, fatal, flaw in the study: they actually found a positive correlation between supplements and health...until they "adjusted" for demographic data and activity levels. In other words, they p-hacked until they found the result they wanted. The big problem? They filtered out everyone who uses supplements _because_ they derive health benefits from using them. Obviously, once you filter out all the people who benefit from supplements you're left with the people who didn't...

Supplements do have benefits with respect to addressing nutrition deficiencies related to diet, which is the whole point of using supplements in the first place. And that's the reason that people with higher incomes and activity levels use them...

All in all, this is just another case of bad science issued by researchers needing more grant money (or tenure) and being promulgated by the media .

<comment><USER3> Fatal? Really?

That kind of adjustment is necessary to get meaningful results.

Like many men my age, I have developed an autoimmune reaction to the bits that are supposed to absorb B12, so I have to take 5000ug to absorb the 2ug I need. Should I be counted as benefiting from supplements? Lab tests showed an elevated homocysteine level, an indication of B12 deficiency. I would say not.

Testing everybody for every possible deficiency, or need for a more than normal amount, of any particular thing would be very expensive, and inconclusive. Taking a multi supplement might take care of many such problems without the analysis, but there is now plenty of evidence for harm in megadoses. (Maybe I got my auroimmune reaction from megadoses?) In any case, a multi doesn't have enough to fix my problem.

What is clear from many, many careful studies is that many particular supplements utterly fail to provide the benefits expected, for most people, and actually harm some people. That includes particularly vitamins C, D, and E, and fish oil extracts.

</comment></comment><comment><USER4> This is not just a problem with pills - it could be a problem for processed food.

Look at the ingredients used in the 'Impossible Burger' to replicate the vitamins and minerals found in real meat:

Mixed Tocopherols (Vitamin E), Zinc Gluconate, Thiamine Hydrochloride (Vitamin B1), Sodium Ascorbate (Vitamin C), Niacin, Pyridoxine Hydrochloride (Vitamin B6), Riboflavin (Vitamin B2), Vitamin B12

Or the additives found in products like Soylent.

If these vitamins and minerals don't work with pills, do they work with processed food?

Its already clear that you should take supplement pills at the same time as eating - so these processed foods at least avoid that problem.

<comment><USER5> Oh wow, I didn't realize how much processing went into the Impossible Burger. Seems to me that meat substitutes might be a coming threat to peoples health. People want to eat healthily but we are heading in the wrong direction. Thanks for the info.

</comment></comment><comment><USER6> There's thousands of nutritional supplements. Particular vitamins can have dozens of "vitamers," each exhibiting different properties. There's countless minerals, herbs, and novel compounds that people take for countless reasons.

There's also countless manufacturers, with wildly varying degrees of reputability.

To make sweeping claims about "supplements" is kind of like making claims about "Europeans" or "Asians" or whatever. It's such a ridiculously broad term.

</comment><comment><USER7> Does this mean that the only effective way to get our Vitamin D is from sun exposure?

</comment><comment><USER8> Here's the published abstract of the study: [https://annals.org/aim/article- abstract/2730525/association-...](https://annals.org/aim/article- abstract/2730525/association-among-dietary-supplement-use-nutrient-intake- mortality-among-u)

The full text is behind a paywall.

</comment><comment><USER9> It's okay, the people who turn to the unregulated and unscientific supplement industry weren't ever going to read this anyway.

edit:Can I have feedback about what I have wrong or have misunderstood?

<comment><USER10> For an example of how silly what you're saying is, I've known several doctors that have prescribed supplements to my friends and family members. Eating different diet can be an alternative, but thinking that no supplements work, or that anyone who takes them is an idiot, is really simplifying the situation.</comment></comment>


Story of a failed pentest - <AUTHOR> https://threader.app/thread/1063423110513418240 <comment><USER2> Great story, but I wouldn't call it "failed" because it showed that the company has really good security procedures. I don't know many companies that could have resisted this sort of internal threat.

I've had pentests that found nothing before but I had logs full of attempts to compromise the app, including in some ways I'd never even heard of before. I didn't consider them to be failures either.

<comment><USER3> Let's be honest. No company would have resisted this sort of internal threat. This is either fiction (which it sounds like it is) or this is just a lack of time. The difference between pentesters vs real hackers are that hackers have as much time as they want.

<comment><USER4> I agree this reads like fiction. Strange capitalization, and no technical person I know or know of would write this way; it all seems very cavalier and not the careful writing of someone who actually does this for a living. Not that I know better.

<comment><USER5> I found this odd:

> spent some time hunting the Domain Controller

The DC address(es) are trivial to find.

<comment><USER6> They _can_ be. But here's the problem:

You have a GPO that turns on command and ps logging. Ok, so if you _type_ those commands, you alert script logging engines.

And then you search how to find the DC: [https://serverfault.com/questions/78089/find-name-of- active-...](https://serverfault.com/questions/78089/find-name-of-active- directory-domain-controller)

It's all PS or cmd. Trapped.

You might find the DC listed in the registry if you look for key "DCname". However again, that's another thing you'd use app whitelisting for, and catch every invocation of regedit. A lot of unattended driveby attacks attempt to do bad things here, so you catch/trap them.

Again, dead end.

So, I'd love to see a good walkthrough how to find the DC if these avenues don't work.

<comment><USER7> I think this one won't get you caught:

Explorer address bar (or start>run) > %logonserver%

<comment><USER6> True, for smaller orgs.

When you get to larger orgs, the DC doesnt always have to be the logon server. In fact, you're liable to see a slew of logon kerb redirectors talking to a few ldap backends running as pri and secondary AD.

<comment><USER7> I have to admit I'm not familiar with anything in your comment. Is this different terminology for a RODCs? I was also under the impression that AD didn't have a primary DC, the only vestige of that is the PDC Emulator FSMO role.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Meanwhile 4 put of 5 webshops we check have critical vulnerabilities and half the owners don't care because "it just costs money to fix it and things have been fine so we'd rather spend more on Adwords"

Security, no scratch that - the human psyche works in mysterious ways :)

This company seems to run a tight ship though!

<comment><USER9> Frankly, that's an entirely appropriate way to deal with security. You can make the most secure product in the universe, but no one will use it if it takes forever to develop or is unnecessarily difficult to work with. Of course, how much security is enough is a multi-variable problem, but in general I find that "security people", who for obvious reasons want to sell you on security, way over-estimate its value.

<comment><USER10>
      no one will use it if it [...] is unnecessarily
      difficult to work with

In some aspects of security, you can trade off inconvenience for cost, instead of trading off against security.

For example, imagine an office with a security gate, but it takes a few days for new employees to be issued with a working gate pass.

One way to reduce that inconvenience would be to trade off security, by having staff members buzz strangers in if they know the magic words "I just started, my pass hasn't arrived yet".

An alternative way would be to trade off cost, by having while-you-wait gate pass printing, and every gate having a guard who can check an online employee directory before buzzing someone in without a pass.

I feel a lot of people say "Security is a trade-off with convenience" when they actually mean "Security is a trade-off with convenience and spending, but we've already taken spending off the table"

<comment><USER11> There is another option here. Have security passes issued promptly. It's possible, I've worked at a bank where it took all of 5 minutes. (Not that I disagree with the general point, just the example)

<comment><USER12> I had a meeting at a major UK broadcaster in London the other day. Arriving at reception I had my photo taken, a visitor pass printed, and put in a pass with a guest RFID enabled card, and to top it all a voucher for a free cup of coffee from the canteen.

No reason that such a system can't be done for the first week or so, even if you don't want to have the facility to print permanent cards in every office.

</comment></comment></comment></comment></comment><comment><USER13> The problem I have with pen tests is that they're not systematic and rely on the cleverness and knowledged of the tester. Even if they identify an issue, it's often hard or impossible to ensure it doesn't regress, and if it's an inhouse or custom software they've never seen before they likely won't be of much help without a lot of effort.

I think one step forward would be also approaching security the same way epidemiologist track down causes of diseases. In that they take patient data and trace back the factors that caused it, just instead of patients we're talking about security vulnerabilities and breaches. Having a corpus of causal diagrams that then we can develop software to analyze risk factors that we can then systematically test for.

<comment><USER8> I agree and from a purely rational standpoint you are correct. However in my experience the main benefit of a successful pentest is to achieve a change in culture and the perception of security of staff across the entire workforce where before it was deemed "taken care of" or non-important.

In short, people won't change before shit has hit the fan, and a pentest is the closest you can get to a controlled shit-hit-fan situation without it being a meaningless drill :) How, and what is uncovered is besides the point and merely secondary when viewed from that perspective.

<comment><USER14> >> the main benefit of a successful pentest is to achieve a change in culture

Is there much (any?) _public_ evidence that this tends to happen after a successful pentest, though?

One of my friends used to be a pentester. He said (I paraphrase) "we go in, break stuff, write a report, go home".

What's the betting that in a company with poor security culture that the pentester's report might just end up locked in a safe?

<comment><USER15> I did a website for Visa a few years ago, and it required a pentest before launch. We tried to find a loophole to justify it not needing a pentest (because that would give us 3 more weeks to develop the site), but no luck. It was such a simple site with no database, but they required it to go through pentest anyways.

The pentest came back with some recommendations. Mostly to do with the use of HTTP headers. Absolutely we fixed them, and made damn sure that the next time we had a site to be pentested those unforced errors were not repeated.

So on a small scale, yes. Pentesting improved the way we developed websites. I don't know about how it affected the "culture". Visa has a really strong security culture already.

<comment><USER14> >> Pentesting improved the way we developed websites. I don't know about how it affected the "culture". Visa has a really strong security culture already.

So if the security culture is strong, the pentesters reports are read and implemented; if the security culture is weak-to-completely-non-existant, they'll likely be ignored?

<comment><USER6> > if the security culture is weak-to-completely-non-existant, they'll likely > be ignored?

\---->

> if the security culture is weak-to-completely-non-existant, they'll likely > not even be budgeted or done.

</comment></comment></comment></comment></comment></comment><comment><USER16> _I could 've run "net accounts" on my workstation to query Active Directory directly & see their password policy, but decided to look elsewhere first. I didn't want to set off any alerts or logging._

I know nothing about Windows, but I'd have thought checking password policies far less likely to alert than plugging in your own device on the network.

Anyway, my favourite bit was that they didn't stop the people in Accounts running Powershell, they just raised an alert. I much prefer that approach to blocking people most likely just doing their job.

<comment><USER6> If PowerShell and cmd logging is turned on (and I'm sure it is) then seeing net * commands run from a marketing machine is hella bad. Its similar to "HEY LOOK AT ME IM HACKED!"

These logging things do get in the way of devs. They run PowerShell after ps... Its not uncommon for MB's a day of log per dev. So if you're wanting to run crap and get away with it, hack a dev machine and bury your commands in there.

<comment> no-s So true. Just write an innocuous automation script that will fail on privs generating massive logs and then use debugging as an excuse when you try to systematically audit capabilities. Often helpful IT staff will open up vulns for ya to put an end to the noise. Of course in many orgs it's necessary to do this in order to get legitimate work done too...

</comment></comment></comment><comment><USER17> The author confirmed on Twitter that "aside from the beating up and tying down" this is a true story[0].

[0][https://twitter.com/TinkerSec/status/1063781216128835584](https://twitter.com/TinkerSec/status/1063781216128835584)

</comment><comment><USER17> > I woke up, bloody, in an ergonomic office chair, my hands zipped tied behind > me with the same zip ties they used to manage the server ethernet cables.

I didn't realize this story was fiction until I got to this sentence.

Update: The author confirmed on Twitter that other than the dramatization, this story is in fact true.

> And, aside from the beating up and tying down, it was true![0]

I can admit when I'm wrong. I stand corrected.

[0][https://twitter.com/TinkerSec/status/1063781216128835584](https://twitter.com/TinkerSec/status/1063781216128835584)

<comment><USER18> Read a bit further; the story is not fiction, only that specific incident.

<comment><USER17> I read it all before posting here. I assume you're referring to this part:

> The DFIR lead leaned down next to my ear and whispered, "No one in Accounts > Payable ever runs Powershell..."

> Alright... That last part had a bit of dramatization added to it.

I interpretted the "last part" to mean the part where the DFIR whispers in his ear.

I'm still not convinced this is real. It smells like fiction.

<comment><USER19> Dramatization === Fiction ?

Storytelling as a knowledge share is fundamental to human culture. Drama and story refinement are required to make the knowledge easy to remember and spread.

As for you being convinced, my personal experience is that this story is entirely believable. Many of us in security have stories we cannot share that would make this one look like a Saturday morning cartoon.

<comment><USER17> > Dramatization === Fiction ?

Certainly not. But at the very least, dramatization decreases the credibility of a story.

<comment><USER19> Dramatization has nothing to do with credibility. It is a memory facilitation technique. Because you the reader can remove the drama and distill the critical story elements for further inspection of credibility.

Credibility is found in the citations, which here is only the story teller. As that is only one data point, I totally understand doubting its credibility because one needs more citations and voices for proof.

Further, I never stated I found the story creditable. I was operating from a believability standpoint. Inferring one's experience to weight if the story could possibly be believed. You shared you found it hard to believe based on it's dramatization. Where I shared that I found it completely plausible based on my experience.

And that is my main argument, that in this equation drama shouldn't be used as a weight. Positive or negative.

Edit: For the folks down voting this. Please don't conflate dramatization with persuaion, propaganda, or fake news. Dramatization is a tool used in those techniques.

</comment></comment></comment></comment></comment></comment><comment><USER20> This doesn't seem at all realistic. Tight security and people are actually getting work done? Inconceivable!

<comment> ju-st And IT has time to check alarms, very unrealistic.

<comment><USER21> Plus, budget to hire a pen tester?!?

<comment><USER22> A bank!

<comment><USER23> Nah, I've worked with some banks here and there. Amazing lack of security. Can't talk specifics, but yeah, just wow....

</comment></comment></comment></comment></comment><comment><USER24> Nice story and a good illustration that a lot of good IT Security isn't buying fancy "next gen" products, it's doing the basics of managing your systems well.

It costs more to run IT well, but there are good payoffs, like this.

<comment><USER25> I would imagine that it was just one of these "next gen" products that identified the fact that Powershell was running on a machine that normally would not run Powershell.

<comment><USER24> Why would you need anything "next gen" for that?

Just log use of powershell then have your good old SIEM system alert when it's used by a group outside of the IT dept.

</comment></comment></comment><comment><USER26> I love reading factual hacker stories that read like fiction. very entertaining. A brutal 5-7 year on ramp of learning what computers actually do on the inside... but understanding what the story about is worth it.

</comment><comment><USER27> During pentests most testers run the usual route of attacking the domain. In my opinion it's not realistic, because most attackers don't attack domains. They attack applications.

<comment><USER24> That is true but if you can get Domain Admin access, generally getting application access is pretty simple after that, and as getting DA is pretty simple if the domain hasn't been locked down (like the one in the post had), it's a reasonable place to go...

<comment><USER28> Things like 2FA greatly limit the damage of a compromised domain and give defenders time to react.

<comment><USER24> I'm a great fan of 2FA for all administrative access. It's not a panacea for sure, but a definite good layer of defence

</comment></comment></comment></comment><comment><USER29> I must be missing something; but why not plug keyloggers on IT's computers?

<comment><USER30> I believe the thing you're missing is known colloquially as 'antivirus'

<comment><USER31> I think GP was referring to a hardware keylogger - antivirus wouldn't help.

</comment></comment></comment><comment><USER32> That was a good fun read. Especially where they zip tied him. Good change of pace.

<comment><USER33> Pretty sure he was joking about that.

<comment><USER32> Yeah, I know. I believed it until I read it further.

</comment></comment></comment><comment><USER17> This story is also available as a series of tweets in case anyone prefers to consume it that way.

[https://twitter.com/TinkerSec/status/1063423110513418240](https://twitter.com/TinkerSec/status/1063423110513418240)

<comment><USER34> Does anybody prefer to consume it that way?

<comment><USER17> It's actually the original format in which the author published this content. It was auto-converted to the blog style format linked here on HN by [https://twitter.com/threader_app](https://twitter.com/threader_app).

> Want to see some magic? See a thread. Mention @threader_app with the word > "compile". Get a reply from our bot with the link to the thread[0]

[0][https://twitter.com/threader_app/status/1041712862295666690](https://twitter.com/threader_app/status/1041712862295666690)

</comment></comment></comment><comment><USER35> Really? A Twitter thread? This could have been a blog post.

<comment><USER29> Disable Javascript, you won't even notice it's not a blog post. (After reading your comment I had to whitelist the website to realize it actually was a bunch of tweets)

</comment></comment><comment><USER36> So if he ran the powershell at midnight he could have potentially gone unnoticed until the IT guys got back in the office?

What if this was a global Corp, would someone be monitoring this 24/7 across timezones?

What kind of damage could he have done if he had, say, 1 hour of unfettered access?

</comment><comment><USER37> > On most Internal Pentests, I generally get Domain Admin within a day or two. > Enterprise Admin shortly thereafter.

Sounds realistic, from how most Windows shops are run.

Would it help to stop using AD to manage the IT infra, or have tiny domains (say, max 10 computers) without centralised control, and no company-internal workstation networks? Maybe throw in a rule that devices are recycled (to be wiped) frequently, say every 6 months.

<comment><USER38> > Maybe throw in a rule that devices are recycled (to be wiped) frequently, > say every 6 months.

That would be doable if setting up devtools at most places didn't take an entire day.

<comment><USER37> The first choice strategy obviously would be to automate this stuff.

Because it's hard to mandate a flag day where everything must be automated, a transitional strategy might be: document each dev setup so well stepwise that you can outsource it to the IT dept or other internal support org. Maybe the dev team can provide a screencast of it, for example. The support org would then have an incentive to automate it to replace manual work, along with a measurable payoff for it.

<comment><USER38> NO! now the automation has to be maintained and set up. The first choice strategy is to simplify the tools and application!

Always with software people there is this tendency to add more abstraction and machinery when encountering complex abstractions and machinery. You only exacerbate the problem by doing this!

</comment></comment></comment></comment><comment><USER39> Smells like a CISO suck-up job. Doesn't mention that the developers are paralyzed and unable to work.

</comment><comment><USER6> Ok, wow. That story is pure gold. And when your shop is really on its toes, this is how you run Opsec.

</comment><comment><USER40> > I had already tried various things to my own employee laptop, but I was not > local admin and the disk was fully encrypted.

Hang on, if he can boot his laptop does it not follow that he has the necessary information to decrypt the drive?

<comment><USER41> Probably standard bitlocker. You get decrypted drive automatically, windows can use it, but you only get access to your files, and you can't decrypt and not boot windows. You have to hack local admin for that.

<comment><USER42> Because of the TPM right? If you use bitlocker without a TPM you could boot to a live Linux USB and decrypt the bitlocker drive with dislocker.

<comment><USER43> USB boot most probably disabled in bios

<comment><USER42> Ok, then physically remove the drive and plug it into a Linux computer.

<comment><USER43> Right, hence why nobody uses bitlocker without a TPM ;)

<comment><USER44> I have, because the laptop I was using didn't have a TPM.

Also (possibly wrongly), I trust my ability to remember a good passphrase more than I trust the TPM to not have bugs.

</comment></comment></comment></comment></comment></comment></comment><comment><USER45> Excellent reading. In my experience,internal politics is the greatest threat against companies.

Most of us here can walk into most companies and engineer end to end encrypted,least access,zero trust,mfa authenticated network using strictly foss tools and methodologies. Question: Who will let you?

No joke,OP wasn't exaggerating about how easy most of his pentests are. Most companies throw money at it,do risk analysis and say "hmm,this is enough,a compromise is tolerable".

IMO, when it rains,it pours. Risk analysis only tells you what the risk is based on known data. Unknown unknowns will be your doom. Best to build things right even without an incentive.

</comment><comment><USER46> As a security student, reading his methodology was invaluable.

</comment><comment><USER47> It would be interesting to see the MacOS version of this story, say hacking an office full of Macs, like a Digital Agency or something...

</comment><comment><USER48> He should've joined as a dev instead of marketing. Access to so much more systems to begin with.

<comment><USER49> His dev coworkers would ask him dev questions and look up his online identity.

</comment></comment><comment><USER50> Nice story while educating people on security ... Thanks!

</comment><comment><USER51> How did they even notice Powershell?

<comment><USER52> Endpoint detection picks up stuff like this all the time.

</comment></comment><comment><USER53> Wonderful:))

</comment><comment><USER54> Story of a failed pentester, perhaps?

Social engineered their way into an unlikely scenario bound to raise suspicion.

Tests and methods were pretty successful, otherwise.

Still, I cannot fathom why companies insist on the rickety tinkertoy that is Microsoft Windows.

</comment><comment><USER55> > hauling armloads of old laptops from the IT shack to my cubicle, a small > Leaning Tower of Pisa forming under my desk

that sounds more unrealistic than properly protected Windows systems tbh. New marketing employee hauling lots of laptops, no one noticed? Like, people that work nearby might've noticed that?

<comment><USER56> It was in the middle of the night after even the cleaning crew left.

Tho, I don't know how he managed to carry 30 of them in one go, or what he did with them after he left. I guess the number is a bit dramatized.

<comment><USER57> I didn't see mention of doing it in one go. I presumed he went at least three times.</comment></comment></comment>


The key to good UI design is not simplicity - <AUTHOR>

...it's familiarity.
I wrote a comment (http://news.ycombinator.com/item?id=2044399) in regard to simple CMS systems (and why restaurant websites suck). The key to remember is that the computer illiterate population (e.g. small businesses) have such a problem with technology, that commonly perceived "simple systems" are still too advanced. "As simple as email" is an oxymoron to the small business owner. Email wasn't ever simple, it was a huge pain to figure out! It's just something they suffered through because they needed it.
So the next time you design something for a small business owner (or similar market), don't design for simplicity because it's a nirvana you will never achieve. Design for familiarity with something your target market already knows.
One case in point is Posterous. Tumblr has a pretty simple interface, but it isn't familiar to what we already knew. Posterous used email, which was familiar, not simple. <comment><USER2> And yet, Tumblr is better than Posterous.

I know this is subjective, but my point is: maybe the use of email in Posterous appeals to you, but it never appealed to me.

</comment><comment><USER3> Agreed and well stated. However, since, the concept of "familiarity" will continue to change, how will modern UI designers understand what their end- users know, relative to what they should know? In order for the design to evolve, people must often be led. I whole-heatedly agree with you that simplicity is a relative term, but truly finding the nexus of your users' understanding vs. what they need to know is difficult.

</comment><comment><USER4> The offer.

They suffered through email? The necessity.

The success/failure of your simplified (not simplistic) UI rests on, I'd say, the true value of the offer it is presenting to the user.

I'm separating learning curve from usable-"ness"

</comment><comment><USER5> Also the money they spend on their website (may be they dont need to spend that much) does not allow them to work with people who are good at whet they are doing .

</comment><comment><USER6> So what's "familiar" to the IT-illiterate?

<comment><AUTHOR> Email is one. Outlook is another. Many small business owners are decent at Microsoft products because of previous day jobs. I'm sure it pains you to think that your next startup could look like Word's interface, but that could be the meal ticket.</comment></comment>


Kevin Mitnick's Business Card - <AUTHOR> http://www.flickr.com/photo_zoom.gne?id=106709219&size=o This is pretty cool... <comment><AUTHOR> Even if you think he gets more hype then he deserves, this is pretty cool. It always pays to have a lock-pick set with you at all times...

<comment><USER2> Yeah, it pays in possible jail time:

From Wikipedia: <http://en.wikipedia.org/wiki/Lock_picking>

"In United States, laws concerning possession of lock picks vary from state to state. Generally, possession and use of lock picks is considered equivalent to the possession of a crowbar or other tool that may or may not be used in a burglary. Illegal possession of lock picks is generally prosecuted as a felony under the category of possession of burglary tools or similar statutes. In many states, simple possession is completely legal as their statutes require proof of intent. In some states, however, possession without appropriate licensure is considered prima facie evidence of intent to commit a crime (in California for example), rendering simple possession a crime"

<comment><USER3> It's a business card. I hope you can't be jailed for possessing a business card.

(Yes, it's convenient that it's possible to turn the business card into other tools.)

<comment><USER4> <http://www.knifezone.ca/toollogic/toolcreditcard.htm>

</comment></comment></comment></comment><comment><USER2> Here is the original: [http://gizmodo.com/gadgets/heavy-metal/lock-pick- business-ca...](http://gizmodo.com/gadgets/heavy-metal/lock-pick-business- card-sweet-form-solid-function-265401.php)

<comment><USER5> Original?

gizmodo [via] [http://www.techeblog.com/index.php/tech-gadget/how-lock- pick...](http://www.techeblog.com/index.php/tech-gadget/how-lock-pickers- design-business-cards) [via] <http://www.jenimattson.com/pages/identity/melvin.shtml></comment></comment>


Ask HN: An idea for a web develoment collective - <AUTHOR>

The economy seems to be picking up.  I am getting hit left and right with offers to do web development, whether they're from people who just want to hire me on an hourly basis, people who want to retain me for X number of hours a month, or people who are looking for a technical co-founder.
I also have a few of my own ideas I'd like to develop ( but not a lot of money to pay for the things I lack, i.e. good domain names, graphic designers, iphone developers. )
On top of this, I have a decent client base already and am steadily pulling in about 100k a year.
How many other developers are in the same situation? What would be a good model for partnering up with other freelance developers in similar situations?
My thinking is if we combine income, combine clients, and combine man power, we can work a lot more efficiently, and with more security and stability.  Having partners with redundant skill sets would also free each other up to go on extended vacations comfortably.
Also we could set aside a few hours a day to work on projects which we own, and which over time turn into a portfolio of money making assets.
Are there any existing collectives like this? Any good models to base this type of organization off of? I'm thinking if successful, we'd want to hire additional people but not necessarily make them equal partners off the bat. <comment><USER2> There are lots of companies like this.

Adaptive Path - been around long enough that many of the original partners have left. Took one foray into product development, MeasureMap (acquired by google).

Pivotal Labs - have one product, Pivotal Tracker, that's been well received but doesn't seem to generate revenue. Good reputation as Rails consultants.

MailChimp - Now just a product but was originally The Rocket Science Group doing web development.

37signals - All product now but originally was a consulting partnership. Not sure what happened to the original partners. Seems like only Jason is still active.

ENTP - Rails consulting and makers of Lighthouse.

I only have anecdotal info on those companies, but have a few thoughts.

The biggest seems to be that you need to have provisions for handling new and leaving partners. For example DHH is new to 37signals but got cut in enough that he now owns a Lamborghini. It seems important that you could allow for that.

On the leaving side, I think at least three of the original Adaptive Path partners have left. AP is still going strong, so you know they did the partnership in a way where they aren't burdened with non-contributing partners taking all the profit.

On the other hand, those three partners left to start their own startups, so there was something in the dynamic where doing product work required leaving. I think this might have been a lesson they learned during MeasureMap. They were so big that only a few people were working on the cool sexy project and I think it might have caused conflict.

I think the other big issue is leadership. I think AP had a rotating CEO position. I guess other partnerships might have a more clear leader. But regardless of the structure, I'm pretty sure that you need to make sure there's a clear and transparent accounting system that everyone buys into. I've heard lots of problems cropping up around financial misunderstanding.

Email me, I'd like to talk more about this: email@example.com

</comment><comment><USER3> I am in the exact same boat, I left my corp job and started looking around for a CTO position with some start-ups (east coast). I started freelancing in the mean time to buy time to find something I really wanted to get into. Did not see anything, so I just continued on with the freelancing. I am doing about 200k a year, but man, I don't think I have seen a week under 80hr in 3 months. I would be interested, but I am rooted in the east coast, I have aging grandparents that I am the caretaker of. If you are looking to do the whole thing distributed, let me know I might be interested.

<comment><AUTHOR> Hit me up @soederpop</comment></comment>


Are Those Yahoo Layoffs Starting To Roll Out Today? - <AUTHOR> http://techcrunch.com/2010/11/30/yahoo-layoffs/ <comment><USER2> This is a good example of how to create chaos and panic in your company.

A couple people come in to work and find something odd. Due to past rumors of a layoff, and the company's refusal to deny the rumors, they are now starting a full-on panic about layoffs that will infect everyone.

Now, it could be true... But it might not be.

I think you can pretty much guarantee that today will not be a productive day at Yahoo.

</comment><comment><USER3> Why is it that corporations, specifically Yahoo!, have a tendency to lay folks off right in the middle of the holidays?

If I recall they had huge layoffs in '07 right before their infamous Xmas party.

All this does is destroy morale, produce more rumors, and takes a big hit on the company's overall image.

<comment><USER4> I do believe it has to do with the Tax code in the US, but I can't remember exactly why. The other thing is that it probably makes the quarterly numbers look better.

</comment></comment><comment><USER5> Just in time for the holidays (in my world, Christmas). Epic. Fail.

<comment><USER6> It's terrible to lose your job but this time of year is not the worst. A lot of budgets are started or renewed at the beginning of the calendar year. You have a better chance to land a new position than in spring or summer.

I'm writing this not to lessen the raspberries for Yahoo but to offer some light to those affected.

<comment><USER7> Also good to lose the job before holiday spending ramps up.

</comment></comment></comment><comment><USER8> Best of luck to all involved.</comment>


Solicitation for US Propaganda Disruption Ideas - <AUTHOR> http://cryptome.org/2013/07/bbg-otf.htm

<comment><USER2> Look interesting, but I'm not quite sure how this has to do with "propaganda disruption." Could somebody please enlighten me?

<comment><USER3> Misleading title. It's a solicitation for entries to a contest (the Open Technology Fund) that awards money to _disruptive_ technology projects for advancing Internet freedom and human rights.

The contest is being administered by an organization (Radio Free Asia) that has been criticized as _propagandistic_ in its charter to provide information to people in Asia who lack adequate protections for freedom of expression, free speech, and a free press. See: [https://en.wikipedia.org/wiki/Radio_Free_Asia#Criticism](https://en.wikipedia.org/wiki/Radio_Free_Asia#Criticism)

The contest has in the past provided funding to projects like Cryptocat; see a list here: [https://opentechfund.org/projects](https://opentechfund.org/projects)

</comment></comment><comment><USER4> I have no idea how they derived that title from the email.

I also object to the use of the word "propaganda". In fact, ironically enough, I think that singling out US propaganda is itself kind of propaganda. I have little love for the USA but be fair: to reach out to the types of people who'd be listening to "Radio Free Asia" you need to fight fire with fire.

</comment><comment><USER5> Soliciting for a drone strike more like it.

<comment><USER6> "Radio Free Asia is a _US-government funded_ , non-profit organization, incorporated in March 1996, and began broadcasting in September 1996" [0]

[0] [https://en.wikipedia.org/wiki/Radio_Free_Asia](https://en.wikipedia.org/wiki/Radio_Free_Asia)</comment></comment>


Ask HN: What is the simplest stack to learn? - <AUTHOR> I have been using MySQL/PHP/jQuery for many years now in almost all my web projects. But reading around the web I feel outdated, and different solutions/options are popping up everyday.
I want to update my toolbox without having to deal with a steep learning curve.
What does HN use? <comment><USER2> It depends where you're at with the PHP stuff. If you're using a LAMP stack (as you mention) but using something like MAMP/XAMPP and keeping it simple, staying away from the terminal or PHP frameworks like Laravel, etc then most of this other stuff will be hard for a bit. Ruby on Rails is always talked about as being "easy" but it's really not at first if you're lacking knowledge of things like package managers, command-line tools, deployment that involves application servers and deployment scripts, MVC patterns, etc.

I'll say this: if you've been sticking to PHP to avoid all these things I mentioned then you'll do yourself a favor by picking almost anything (I'd say Rails or a Node stack) and getting into it. Once you get the concepts of these stacks you can use that knowledge to jump to other stacks a lot easier as well. Eventually it all feels kind of similar. You'd even be fine to stick to PHP but would be a much better PHP developer after nailing some of those concepts.

<comment><AUTHOR> I'm quite familiar with the CLI, composer, Lumen, Slim, Symfony, Laravel.. This is not the issue.

The thing is that I'm stating to feel that PHP bundles are getting "outdated". Where in Django or RoR you could set-up an oauth server and link it to your app in 20 minutes, in PHP the quality of the bundles and documentation make using stuff like that "hard".

I'm starting to see that maybe Node (sails.js) + Angular are probably a good starting point.

</comment></comment><comment><USER3> Use whatever you want and ignore what the rest of the internet says.

<comment><AUTHOR> This was my original thought as well. But then you have to think about employability.

<comment><USER3> MySQL, PHP and JavaScript are all jobs that you can easily get employment in. As long as you understand the actual languages rather than just frameworks you should be fine.

<comment><USER4> If you look at the hugely successful companies like Facebook, Uber, Google, Stackoverflow, etc. they all use the likes of mysql, php, python, ASP, javascript, etc. Airbnb uses RoR, which although fairly new is now pretty mainstream.

I can't think of any really successful companies that use new-fangled frameworks and the latest rockstar languages.

<comment><USER5> Eh, rails is ten years old now. That's pretty respectable, and it actually seems like it's on its way out.

It's also worth noting that Facebook is built on React for javascript, which falls under 'new-fangled frameworks'.

It's also also worth noting that MANY companies are still using a Java stack (with Tomcat or JBoss).

<comment><AUTHOR> I never understood why "new" companies would go to JAVA.

<comment><USER6> I know of at least a few new startups started by old guard that used to work at IBM and Blackberry. Many stuck with Java because they were already familiar with it and adopting something new would have slowed them down.

You can argue that this would hurt hiring prospects. But many had their sights on attracting more engineers from these big tech as their first employees, who would have the same reasons for sticking with Java.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'd pick a stack with a steep learning curve.

After all, the two most important skills in software development are the ability to learn and the ability to solve problems.

A stack with a steep learning curve is likely to improve both of these skills.

<comment><USER8> This is certainly one way to set yourself apart from the crowd.

</comment></comment><comment><USER9> PHP (Laravel 4)/Postgresql or Cassandra/jquery

For back end, I run Vagrant + Ansible with PHP composer

Front end, it's bower + grunt

My other tools are Vim + Tmux.

For data and webscrapping I use scrapy (python framework).

The current project I have is what I've listed and going to learn Apache Spark and Elasticsearch. I'm currently stuck on learning Ansible to provision stuff.

I think many worthwhile things are going to require some learning curve whether it's steep or not is more up to the individual.

I'm putting off AngularJS, EmberJS, React stuff. I think it's to early. Likewise Docker and container are too early. I'm waiting on perhaps Docker 2.0 and some technical book out. Kubernates in my personal opinion is really an Alpha software there are many caveats.

I'm thinking of moving to Django/Python stack in my next project and tinkering with Apache Accumulo.

<comment><USER10> If OP knows PHP then Laravel is a good choice.

I love Ansible, it's the only provisioning tool that really clicked for me.

I tried Chef a few years back to provision a single server and there were just too many moving parts - chef, chef-solo, chef-zero, knife, knife-solo, berkshelf.

I gave it a go again last week and it's gotten easier, although I still think the docs for chef-zero are not that good.

</comment></comment><comment><USER11> Learn the new "HTML5" JavaScript APIs: Canvas, WebSocket, WebRTC, Web Workers, File API, Geolocation, Web Storage, etc.

They're relatively easy to learn, well-documented, and are pretty in demand on the job market.

If you want to take things a step up, learn ES6 JavaScript. It has a lot of very nice improvements, but is a steeper learning curve than just learning new JS APIs.

Regardless of what you do, learn how to use modern, vanilla JS in place of jQuery. There is often no reason to use jQuery these days if you're targeting modern browsers. With `document.querySelector`, you can even replicate the selection capabilities of the jQuery `$`.

</comment><comment><USER12> Depends what you want to do.

That's it.

Don't obsess about changing too much. Speaking with a colleague, he was asked why he chose mainframe as his career.

"It doesn't change much. COBOL, DB2, CICS, JCL, etc. I can learn them and the applications to a deep level, and not worry about that learning going out of date. That lets me focus on getting deeper and understanding the business applications of why we do what we do."

</comment><comment><USER13> Every answer you get here will be pretty much useless to you unless you describe the kinds of web projects you expect to do going forward. Your current stack may be perfectly suited, or you may have been using an inappropriate stack for a lomg time and making life harder for yourself.

"The right tool for the job" requires consideration of both the tool _and_ the job.

</comment><comment><USER14> HN uses Arc ([http://arclanguage.org](http://arclanguage.org)) :-)

Seriously: if you fear a steep learning curve, replace one item of what you use now. For example, replace MySQL by PostgreSQL, then replace PHP by something else, then move out JQuery.

</comment><comment><USER15> I do a lot of work using Postgres -> Grails -> jQuery, and I'm just now starting to think a lot more about picking a fancy new JS front-end framework to focus on. I'm torn between React and Angular, but leaning towards starting to invest time learning React.

<comment><USER16> I found this tutorial featured previously on HN really helpful to start my transition from jQuery to React.

[http://reactfordesigners.com/labs/reactjs-introduction- for-p...](http://reactfordesigners.com/labs/reactjs-introduction-for-people- who-know-just-enough-jquery-to-get-by/)

<comment><AUTHOR> I actually enjoyed this intro to react. (Even tho PrivacyBadger gave me a hard time with JSBin).

</comment></comment></comment><comment><USER17> Ember and rails compliment each other very well with many gems like active_model_serializers and devise on the rails side and many add-ons for ember like ember-simple-auth-devise. ember-cli saves weeks of environment setup and includes automated test support.

<comment><USER18> > Ember and rails compliment each other very well

Is there any JS MVC framework which compliments well with Django?

<comment><USER19> Both Angular and React are very easy to drop in and integrate with Django. Ember isn't a big stretch either, as you can use any framework with anything that serves up a restful API

</comment></comment></comment><comment><USER20> I have been working with MongoDB/Node.js/Express/Angularjs and I think it is one of the easier stacks to work with because you are using javascript for the database, client-side, and server-side.

</comment><comment><USER21> Learn C#. It is a beautiful well formed language. The concepts are seen in a lot of other languages. Also it is now open source and about to blow up 100x because it runs on Linux.

Don't learn JavaScript until you have understood C#.</comment>


Why it's time to lay the Selfish Gene to rest - <AUTHOR> http://aeon.co/magazine/nature-and-cosmos/why-its-time-to-lay-the-selfish-gene-to-rest/

<comment><USER2> See Dawkin's response at [http://www.richarddawkins.net/foundation_articles/2013/12/6/...](http://www.richarddawkins.net/foundation_articles/2013/12/6/adversarial- journalism-and-the-selfish-gene)

 _The Y in Dobbs' article is my book, The Selfish Gene, and his main X is the important but far from new point that genes are not always expressed in the same way. He calls it phenotypic plasticity. Locusts are transformed grasshoppers: same genes, differently expressed. A caterpillar and the butterfly it morphs into have exactly the same genome, expressed in different ways. An animal is the way it is, not just because of the genes it possesses but because the context in which a gene sits affects how – and indeed whether – it is expressed. Dobbs makes some sensible points about all this, but there's not a single one of them that I wouldn't be happy to make myself – and in most cases did make, either in The Selfish Gene itself or in my other books. But his headline conclusion, namely that recent findings negate the thesis of The Selfish Gene, is not just untrue but deeply and perversely untrue._

 _The Selfish Gene has a lot to say about the social insects, laying particular stress on the fact that the difference between a queen and a sterile worker is non-genetic. Indeed, it has got to be non-genetic. If a gene were unconditionally "for" sterility it couldn't be favoured by natural selection. It has to be conditionally expressed, conditional upon the environment. The difference between a massive-jawed soldier ant and the tiny minor worker riding shotgun on its head, is nongenetic too. As far as its genes are concerned, any female ant could have become any caste of worker or a queen. Genes express themselves differently when switched, by environmental triggers, into different embryological pathways. It's a special case of another idea that received prominence in The Selfish Gene, the "conditional strategy" concept of John Maynard Smith._

</comment><comment><USER3> Jerry Coyne's response to this took up two posts on his website:

[http://whyevolutionistrue.wordpress.com/2013/12/05/david- dob...](http://whyevolutionistrue.wordpress.com/2013/12/05/david-dobbs-mucks- up-evolution-part-i/)

[http://whyevolutionistrue.wordpress.com/2013/12/06/david- dob...](http://whyevolutionistrue.wordpress.com/2013/12/06/david-dobbs-mucks- up-evoution-part-ii/)

On his part, Dawkins has commented that his famous book could have had the title _The Cooperative Gene_ chosen for it by the publisher without any change of text in the book itself.

</comment><comment><USER4> The Selfish Gene is one of those books that has an uncanny ability to provoke truly awful criticism, both from people who should know better and people who quite evidently never will. To be fair to him, David Dobbs is merely in the former category.

</comment><comment><USER5> Genes, gene expression, immune system learning, changes in symbiotic baterial flora, memory in neurons, culture. All of those are systems work towards survival and are always/sometimes/possibly passed down to offspring with mixing and random noise to help their surival. Inheritance of genes expression is interesting but does not negate importance of genes no more that inheriting bacterial flora from mother (or a surgeon doing c-section) does that. Genes are uniquely important because they are the base system.

</comment><comment><USER6> The explanation of "genetic assimilation" seems bogus to me. The expression- based trait doesn't need the gene change to propogate. The genetic change doesn't need to wait for the expression-based trait to appear. Why are we looking at them as being part of the same process, instead of coincidentally parallel ones?

</comment><comment><USER7> How many of these controllable genes do we humans have? How can I turn some on and off to see what will happen?

</comment><comment><USER8> tl;dr "I haven't yet read _The Extended Phenotype_".</comment>


4 Simple Habits to Power Up Your Negotiation - <AUTHOR> http://www.thenegotiationguru.com/4-simple-habits-to-power-up-your-negotiation <comment><USER2> so fluffy</comment>


Automatic Bug Repair with Genetic Programming (source code) - <AUTHOR> http://genprog.adaptive.cs.unm.edu/ <comment><USER2> I see genetic programming as an interesting solution to lots of different problems, but I don't think debugging is one of them.

Bugs in my code usually reflect errors in my thinking (or typos). The genetic program would likely come up with the quickest hack that will get the code working, not the correct redesign that will be easiest to read and maintain for humans.

<comment><USER3> Genetic approaches will get you whatever you design them to do - in cell biology, we call that "you get what you evolve for". If you want code to do a particular task, and write a fitness score that only reflects that, you'll get a hack that does that. If you want readability, you add constraints to the mutation parameters that enforce that requirement at every generation, and you'll get readability.

The hard part becomes writing those constraints, not writing the actual solution.

<comment><USER4> _"The hard part becomes writing those constraints, not writing the actual solution."_

Yes, writing constraints can be difficult, as can figuring out which constraints you need, and coming up with fitness functions for figuring out how good a given solution is.

Other difficulties include tweaking the various parameters of the GP to perform well enough to get reasonable solutions in a reasonable amount of time, and making sure you're not overoptimizing, etc...

The other thing I'd mention is that one should always take the results of AI research with a big grain of salt. Often the problems they work on are unrealistic toy problems that have little relevance to anything you'd actually do in the real world, and their statistical methods leave a lot to be desired.

There's huge pressure to get funding, so many papers tend to be unrealistically optimistic and misleading (but get published anyway).

</comment></comment></comment><comment><USER5> Why are programmers constantly trying to program themselves out of having jobs? While I am joking here, it is interesting to consider that debugging is one of the most complex aspects of programming, and if you took that away from programmers, they might spend their time actually doing something useful... like creating software.

</comment><comment><USER6> Evolution is too inefficient

<comment><USER7> Before you get downvoted for sounding glib, allow me to elaborate on what you said: "The search space for evolving bug fixes in a program is likely to be extraordinarily large. Furthermore there will be places of sharp division in the fitness landscape between working programs and nonworking programs. Therefore I'm skeptical whether evolving bug fixes is likely to be computationally tractable in the general case."

<comment><USER8> Well said.

I'd add that evolution works for organisms because they have evolved evolvability. By this I mean that the source code isn't fragile, so that you can take the source code from two organisms of the same (sexually reproducing) species, mix and match them together, and the resulting DNA codes for a viable organism. This even works for closely related species as the existance of mules demonstrates.

Programs written by humans in the sort of programming languages we use do not have this characteristic of robustness.

Genetic programming would work better using languages specifically designed to be robust in this sense.</comment></comment></comment>


Average Is Over: Why The Skills Required For Great Jobs Are Changing - <AUTHOR> http://www.farnamstreetblog.com/2014/04/average-is-over/

<comment><USER2> Average is over? If anything this shows a below average understanding of statistics.</comment>


Ask HN: Any Alternatives to Hotjar? - <AUTHOR> Any Alternatives to Hotjar? <comment><USER2> I am working on one: [https://www.usertrack.net](https://www.usertrack.net) (you have probably already seen this link in your previous "Any Alternatives to Google Analytics" post)</comment>


Inflammation's Hidden Role in Weight Loss - <AUTHOR> https://www.theatlantic.com/health/archive/2019/08/inflammations-immune-system-obesity-microbiome/595384/ <comment><USER2> The new title of this article is `The Fundamental Link Between Body Weight and the Immune System`

</comment><comment><USER3> What are these miracle bacteria and how do I get them into my own gut (preferably without a fecal transplant)?

</comment><comment><USER4> I guess this just goes to show further how the proper diet for a person is highly individual.

</comment><comment><USER5> Ah yes, finally, the one weird trick that explains why my pants don't fit anymore. In mice.

Yawn. Wake me up when there's some _real_ proof that improper diet and exercise have no negative health implications. I'm anxiously awaiting with my doughnuts.</comment>


Only 8+ Years of Rails Experience Required - <AUTHOR> http://jobs.37signals.com/jobs/10823 Guess they're only willing to hire DHH <comment><USER2> ..which would mean you'd have to be David Heinemeier Hansson himself, seeing how Rails is just short of 8 years old.[1]

[1] <http://en.wikipedia.org/wiki/Ruby_on_rails>

<comment><USER3> A very long-winded way of asking.

</comment></comment><comment><USER4> Related is this listing for a java dev with 68 years of experience. <http://thugbot.net/useful/?p=774>

</comment><comment><USER5> Also wanted: young developer age 23-29 to work on an exciting startup. Minimum of 42 years exp required.

</comment><comment><USER6> HR to Director of Application Development : The closest candidate we had was David Heinemeier Hansson but we rejected him as, like all the others, he also fell below the 8+ years requisite

</comment><comment><USER7> I've seen a post for a sharepoint admin with at least 5+ years of experience...

<comment><USER8> I first started working with SharePoint in 2001.

</comment></comment><comment><USER9> I need SDFRY devs with 6+ years experience for an upcoming project.

</comment><comment><USER10> lolz good luck recruiting dhh

</comment><comment><USER11> The notion of putting the phrase "x+ years of technology y" on a job description always makes me roll my eyes. Some people have 2 years experience with say RoR, and could be lightyears ahead of another RoR dev who has 6 years experience. Is it so hard to say what you want: "we want a developer who is in the top 10% or top 40% in solving x kinds of problems?

The reason why this bone headed measure is used is because even the most elite coder on the planet does not have the required number of years experience, it helps managers keep salaries low. X years experience in Y is an HR trick.

</comment><comment><USER12> 10 years of CoffeeScript experience required. 5+ years of working with HTML5 Audio is preferred.</comment>


Python course in Bioinformatics - <AUTHOR> http://www.pasteur.fr/recherche/unites/sis/formation/python/index.html

<comment><USER2> for those looking for the 'next big thing', forget nanotech for the next 5 years and concentrate on Bioinformatics.

<comment><USER3> Wow, flashback from 1999

<comment><USER2> Why ? Flashback to '78 when the term was coined maybe, but since roughly 2004 there has been an enormous acceleration in the amount of funds that are poured into this field.

Right now a large number of companies is actively building solutions to deal with enormous amounts of genetic data, pattern matching (see the various iterations of 'blast'), very rapid sequencing (a complete human genome now in about 14 days, possibly already faster).

Nanotech is still in its infancy in comparision, and major breakthroughs in nano machinery seem to be forever about 10 years in to the future (a bit like real A.I.).

<comment><USER4> _since roughly 2004 there has been an enormous acceleration in the amount of funds that are poured into this field._

Really? Because I left the field in 2004 partially because funding was drying up.

Some of the big ideas in bioinformatics are interesting but most of the grunt work is not very interesting or fun. And, the "bioinformaticist" on the team is the one responsible for the grunt work. The actual work is mostly 1990s style java, perl and visual basic programming.

Maybe things have significantly changed over the past five years but I doubt it since I've hired a number of refugees from various biopharm firms.

<comment><USER2> Where are you located ?

I know lots of the code is in Java, the people that I know that are active in the field are complaining about that more than I care for.

here is an overview of the UFT faculty for Genome Biology and Bioinformatics:

[http://www.biochemistry.utoronto.ca/cgb/index.php/Category:F...](http://www.biochemistry.utoronto.ca/cgb/index.php/Category:Faculty_Members)

They added a whole new wing to their campus...</comment></comment></comment></comment></comment>


How To Design a Maintainable Web Page - <AUTHOR> http://blog.chodounsky.net/2010/08/14/how-to-design-maintainable-web-page/

<comment><USER2> Wrong, wrong, wrong.

1) Forget about XHTML, it's dead, use the HTML5 doctype it works well with even older browsers

2) From building a semantic form you gain exactly: nothing. Search engines won't give you traffic because you got a semantic form, and browsers won't render them better.

3) SPECIFICITY will help you produce huge CSS, that will make your life a living hell. [http://www.stubbornella.org/content/2010/07/01/top-5-mistake...](http://www.stubbornella.org/content/2010/07/01/top-5-mistakes- of-massive-css/)

4) You should NOT CARE about whether the device is a handled or a tablet, you SHOULD care about it's screen size, aspect ratio, whether it has a mouse etc.</comment>


Who still faxes? (search results) - <AUTHOR> http://www.google.com/search?q=%22please+fax%22 <comment><USER2> Faxes have a place in the legal world. It has been established by precedent that the fax of a signed document is a legitimate proxy for the real document. This is not true for the pdf of a scanned document.</comment>


Fluent, The Startup Promising The Future Of Email - <AUTHOR> http://techcrunch.com/2012/05/31/first-impressions-on-fluent-the-startup-promising-the-future-of-email/ <comment><USER2> How is slapping a new UI on top of email 'revolutionary' and lead to the 'future of email'?

I think a lot of us are living under the delusion that we can fix any problem with a new UI.</comment>