Why we look at job applicants' Github or 'What's your excuse?' - <AUTHOR> http://www.bayesianwitch.com/blog/2013/why_we_look_at_github.html?utm_source=hackernews <comment><USER2> I think he misses the point of at least some of the criticism. It's not a matter of fairness, it's a question of whether it's a good idea for employers. You want to exclude all of the brilliant engineers who work on proprietary software? Go right ahead. But then don't turn around and complain about the "shortage of qualified engineers."

This part of a broader problem with the industry. Tech companies subscribe to stupid hiring fads (see Google's earlier reliance on brain teasers) and apply hyper-specific screening criteria (10+ years of .NET experience), then bitch and moan when they have winnowed their applicant pool to nothing and can't meet their recruitment goals.

<comment><USER3> None of my code is available to be open sourced, our github repo's are private (when sharing is required with outside parties) or self hosted internally. If a company looks at my github, you'll see a few contributions to some projects but very minor and few.

If you're making the decision to hire me based on my public github, you're making a mistake.

<comment><USER4> Indeed. I've been using github lately too, writing code for a charity even, but it's not code that can or should be open sourced.

Github-ism is a bit like credentialism, it lowers your risk but risk is where the interesting stuff happens.

There are two ways to hire, the lazy risk-minimizing way and the non-lazy investment minded way. If you put a maximum amount of effort into trying to reduce the risk of hiring you're going to cut your potential RoI off at the knees. You only hire people that are currently employed, because you want to rely on someone else's work in evaluating a potential employee. You only hire people with the right credentials who have relevant experience in exactly the technologies your company is using right now. You only hire people with very explicit demonstrations of their coding capability. Candidates that have such an easy time proving themselves are naturally going to be the easiest to hire. Not just by you, by everyone. Which means it's going to be more expensive to acquire them.

You should still acquire employees such as these, but if that's all you're doing you're throwing away a lot of potential. If you can manage to put together enough internal talent to be able to interview candidates even remotely well enough to make an independent and more or less objective check on their skills and capabilities then that gives you a potentially very significant competitive advantage.

Some of the best coders I've worked with came from diverse backgrounds and didn't have the "right" credentials or resumes. Several of the smartest and proficient programmers I've worked with have not had college degrees. Many others didn't have CS degrees.

Being able to find these folks and hire them because you can tell they have talent is a great opportunity to extract RoI from the hiring process, which is normally seen as just a cost-center.

</comment></comment></comment><comment><USER5> What a load of asinine drivel. Posts like this never fail to upset me.

What's my excuse you ask?

I write highly proprietary software for algorithmic trading 10 hours a day and have zero time and inclination to work on an open source project in whatever little free time I have. I'd rather spend that time on hanging out with my buddies or girlfriend, hobbies, travel etc. Life is too short to waste solely on work and work related activities.

> You can come up with excuses all day about why you can't show me your code. > I'm going to hire the person who doesn't make excuses and gets the job done.

Well good luck to you then, judging by the way you talk, it seems that you likely run a sweatshop and are screening for submissive people who are willing to work for free and bend over backwards. I wouldn't work for you even if my livelihood depended on it and I'm sure there are a lot of other self respecting developers out there who feel the same. Though we'd probably never meet because there is likely zero overlap between our respective fields of work. I'd never apply for a job with some Rails sweatshop run by a bunch of clueless hipsters. What a joke.

</comment><comment><USER6> This line was really interesting to me:

> From the perspective of the employer, Github, Bitbucket and other code > sharing sites simply do not have these biases - when employers look at these > sites, there is no demographic information on users to look at other than > what the user voluntarily puts up.

But there is demographic information there. Ashe Dryden's original article ([http://ashedryden.com/blog/the-ethics-of-unpaid-labor-and- th...](http://ashedryden.com/blog/the-ethics-of-unpaid-labor-and-the-oss- community)) called it out in this paper on gender in FLOSS: [http://flosspols.org/deliverables/D16HTML/FLOSSPOLS-D16-Gend...](http://flosspols.org/deliverables/D16HTML/FLOSSPOLS-D16-Gender_Integrated_Report_of_Findings.htm)

Essentially, I can guess that any particular GitHub user is a white, upper- middle class man and be right most of the time.

I understand that this article isn't saying "We Use Only GitHub Profiles" when hiring but acting as though the code present there exists with zero social context seems willfully wrongheaded.

<comment><AUTHOR> There is demographic information, but you aren't using it. Fundamentally the equation holds:

        hiring_procedureX(Candidate(github, male)) == hiring_procedureX(candidate(github, female))

There is nothing whatsoever preventing a person of any sort from creating a code portfolio, and it's pretty easy to browse a github profile without learning anything about the demographics of the coder.

In contrast, basically every other screening procedure out there is potentially influenced by the demographics of an applicant. Prior employers/educators might have been racist/sexist, interviews are potentially subject to similar biases, etc.

<comment><USER6> > There is nothing whatsoever preventing a person of any sort from creating a > code portfolio

You're wrong. Here are some likely hypotheticals:

* I'm lower middle class with four kids and don't own a computer that isn't owned by work. They own all the code I write on that machine and I'd be fired if they found out I was using it recreationally.

* My security clearance prevents me from publicly contributing for fear of getting swept in a security audit and losing my job.

* I've been harassed in the past by dogged pursuers who have doxed me and SWATed me. Publishing anything under my name is a no-go. If I don't use my real name, how do I participate on mailing lists and collaborate with other users?

So, yeah, I _choose_ not to contribute and I own those choices. But pretending like there's "nothing whatsoever preventing a person" from open source contribution is, like I said, willfully wrongheaded.

That's the point of this article and Ashe Dryden's and the others linked before: there _is_ demographic information associated with open source work in that a particular demographic _overwhelmingly_ is able to contribute vs. others. They're not making idle suppositions; they're backing this stuff up.

<comment><AUTHOR> Ashe Dryden and others conflate _able to contribute_ with _do contribute_. They aren't the same thing.

<comment><USER6> From the perspective of someone who can make hiring decisions, how do you differentiate the two?

Besides, I see it the other way around: they're identifying "can't contribute" instead of "don't contribute" and asking people who make hiring decisions not to assume "don't".

<comment><AUTHOR> Near as I can tell, all Ashe Dryden does is digs up some statistics about the overall population (women choose to be caregivers and earn less than men on average) and declares victory.

Among other things, if these statistics implied women can't create content and push it to free internet services, wouldn't that imply women couldn't contribute to facebook/instagram/etc?

As for distinguishing the two, I don't. My goal is to find good coders, simple as that. In the absence of information suggesting someone is good, I need to assume they aren't.

<comment><USER6> In the quest of finding "information suggesting someone is good", ignoring the known, recognized biases inherent in your sampling method seems like not such a good idea. You're throwing away data and then saying you have an absence of information.

Additionally, her statistics are not solely about women. They are about the multiple, separate groups that encounter obstacles when trying to contribute to open source projects. They include not just gender but race and health.

You're brushing away a lot of the subtlety of her argument and then misrepresenting her stance as "victory". On the contrary, she's exhorting us to work together to make our field more equitable and to recognize the deeper social realities underneath the shallow veneer of meritocracy.

Two things about your comparison:

1\. There's a huge difference between contributing to Instagram/Facebook and contributing to GitHub that I'm sure I don't have to explain to you.

2\. Dryden's blog post is not about "creating content and pushing it to free services". It is _specifically_ about contributions to OSS not being inherently meritocratic.

I'm not sure why you'd conflate the two.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> You can stop reading after the picture, which happens to be at the top.

Why doesn't every programmer have a great GitHub profile? The same reason not every mother of 3 children looks like a fitness instructor. Priorities.

You write C++ all day at a bank, can't use any open source, and your mind is filled with the intractable legacy issues, politics, etc. Maybe you're married and your spouse wants to go salsa dancing on Tuesdays. Should you prioritize throwing some Ruby into GitHub? If you want to work for a startup, yes, you should. If you don't care, don't bother.

<comment><USER8> "Why doesn't every programmer have a great GitHub profile? The same reason not every mother of 3 children looks like a fitness instructor."

Exactly this.

</comment></comment><comment><USER9> I find that this whole Github portfolio thing is getting blown out of proportions. A Github profile is a useful extra, but shouldn't be the only indicator of programming capability.

Neither should education and previous experience.

When hiring, people should talk to each other about something they've done (be it public code or private code). That should give a first impression.

Then you either hire or not on that first impression, and use the following 6 months re-evaluating your first impression. That's what it's there for.

If either side is not fully content, then's the time to decide to keep or fire.

<comment><USER10> You're asking people to _think_? People don't have time to _think_!

<comment><USER11> I just checking in my thinking to GitHub, hopefully I'm now covered.

</comment></comment></comment><comment><USER12> > Perhaps the candidate has little experience because previous employers he > interviewed at did not wish to hire a Black Muslim Lesbian T____ due to > fears of getting sued.

First of all, I'm confused about how someone can be a lesbian and take 'he' pronouns. Second, 'black', 'muslim', and 'lesbian' are names for identities, while 't____' is a slur. Its presence in your post is _incredibly_ jarring and I nearly stopped reading there.

<comment><AUTHOR> I can change the language, though I don't know what the right term is. Transsexual?

I've only met one person of that category in my life, and she referred to herself by the same term used in the post. What's the official term to use? I don't want this distracting from the actual point being made.

<comment><USER10> Nice to start off the morning with a laugh. I'm not interested in the boring conversation about whether _trannie_ is an acceptable term to our society, but the idea you had no idea what it is short for is a joke. As a graduate in Sociology, how can you understand "how technology shapes culture" and obviously never have bothered to _know the name for_ large subsets of our culture?

<comment><AUTHOR> I wrote most of this, but the name on the page is my cofounder. I just forgot to create a tagline for myself before posting it. My background is math/physics/trading.

<comment><USER10> That's not an excuse. You seem to have an ignorance about a whole group of people. I'm fairly sure even the Pope could come up with the word "transsexual".

I don't mean to imply that ignorance implies anything else about you, but it's ignorance. You can alleviate it by: 1\. Meeting some people outside of your apparently somewhat homogeneous bubble 2\. Reading books

<comment><AUTHOR> I'm not making excuses, I'm pointing blame at the right person. (The tagline describes my cofounder or a fictional person, probabilistically. Haven't updated it yet. )

</comment></comment></comment></comment></comment></comment><comment><USER13> "Just please don't send us proprietary code that you have written because we don't want to be sued by your former company."

This is the gist of the problem. The last time I did any serious development unencumbered by IP constraints was 15 years ago. Anything indicative of what I write professionally, I can't send you.

If you are fine with ruling me out of your hiring process (and everyone in a similar situation to me) that is fine. When I'm hiring, I don't like to restrict my pipeline that much.

Maybe this is my own biases showing, but it seems like the main proponents of the Github hiring practice are folks who don't have a lot of experience writing software. For inexperienced developers, I can think of nothing better than a github profile to prove your worth, but nearly everyone who has written a lot of software will have been encumbered by IP agreements at some point in their career and I'm never surprised when someone says they can't show/talk about something they've worked on.

</comment><comment><USER14> Stopped reading at the unnecessary photo. Sorry, this is getting stupid.

On topic though, I didn't see where he linked to his "portfolio" or his company's body of OSS work that these OSS rockstars he's planning on hiring will be able to continue the great work they have been doing. Seems to be all talk no action here.

I think most of us can agree that FOSS contribution is relevant and interesting and we'd certainly pay it due notice. I would always consider it, check it out and even in some cases expect it from any senior hire. However, I don't think this is a very groundbreaking or controversial idea on it's own. The idea that it's mandatory on the other hand... well honestly the entire post is click-bait crap so way comment on that thought any further.

</comment><comment><USER15> This blog post really misses the point of the previous discussions about using Github as a recruiting screening tool. It's fine to use it as a small 'plus' factor, but to screen candidates who have no public code portfolio out is silly, counterproductive, and discriminatory.

Also, for a guy who graduated with a degree in Sociology he sure does talk like an asshole.

<comment><USER16> Well, of course it's discriminatory. The purpose of a hiring process is to discriminate in favour of the kind of people you want to hire and against the kind of people that you don't.

I don't think this article really misses the point of the previous discussions so much as it argues that the issues raised in the earlier discussions are outweighed by the usefulness of a code portfolio as part of a hiring process. That's still debatable but it's something that reasonable people can disagree on.

<comment><USER17> I believe the parent was trying to say that it's potentially illegally discriminatory in the US due to the fact that FOSS is gender and racially biased hugely in favor of white male participation. If you use it is a screening tool to cull candidates, there's probably a case for you breaking US hiring laws.

<comment><USER16> That strikes me as unlikely. I might just be naive, but I can't imagine being sued for filtering candidates on their code portfolios.

This is a genuine and non-rhetorical question: how does it differ from academic qualifications? Both are unpaid work that a person undertakes [partly] in order to prove their value to potential employers, but nobody is getting sued for filtering candidates based on academic qualifications.

</comment></comment></comment></comment><comment><USER18> This relatively new "show me your github or I'm not interested" fad is getting old. If you are so narrow minded to judge development proficiency based on having an open source portfolio, then sorry I'm not even interested in working for you. You are more than likely going to lose some talented developers with this approach. I get the fact you want to see some code, there are other ways though than taking this hardliner approach. Not two days ago I ran across a job posting on SE that was very clear that if you did not maintain a public github profile they weren't interested at all, just shocking to me.

My Excuse? My previous employment I coded in .net and php for nearly 5 years as the only developer at the company. Personally wrote thousands of lines of proprietary business code I simply can't show you. Routinely put in a lot of time in and outside of work. I was coding and committing code before GitHub was cool, hell, before it was even founded. I work on my own now getting a few ideas off the ground and doing freelancing. I just checked my local SVN repo, I have about 25 projects in there over a few years (some massive). I routinely work 12 hours a day for clients and moving my projects forward. None of this code is public.

1\. I don't use github, nothing again git or github at all. SVN works well for me, fits my use case and I know it well. I know how to use git, I have a github account with a few small contribs to javascript libraries I've help extend, but that is all. It is simply .01% of a reflection of the code I've written.

2\. I would love to contribute to open source more, but I have priorities, life, family, my own goals. There simply isn't enough hours in the day.

3\. I could talk ALL DAY LONG about my experiences coding various projects using whatever framework you want to talk about. I can show you code for my personal projects, although it isn't public. However, if you want to judge me on my lack of github/bitbucket, then so be it.

</comment><comment><USER19> Last week I worked about 80 hours (salaried, large co.). I have a wife and three kids. Any time not spent at work is spent with kids or chores, usually simultaneously. GitHub is somewhere south of these priorities. If you as a potential employer are not ok with this, that is certainly your prerogative; I would even agree that spending that amount of time at work is not ideal.

</comment><comment><USER20> Lede photo says: _" Hot woman still looks hot like a good woman should look, even after having babies. So why can't you code more?"_

Amusingly enough, that photo stoked a fat-shaming controversy, something acknowledged by the OP. I guess there's a great meta-explanation for using the photo or something [http://www.kjrh.com/dpp/news/health/Maria-Kang-Fitness- lovin...](http://www.kjrh.com/dpp/news/health/Maria-Kang-Fitness-loving-mom- posts-controversial-Facebook-photo-accused-of-fat-shaming-women)

</comment><comment><USER21> In my opinion, GitHub is not at all a "code portfolio". It is a "social git application", or a "social collaborative version control system".

My GitHub page is not my portfolio, neither a Coding Museum of Myself. GitHub is made for easily writing and sharing code, not __showing off__.

Except from that fundamental misunderstanding, the rest of the argumentation seems valid, and I agree: a code portfolio can be a good hiring tool.

But GitHub isn't one.

</comment><comment><USER22> Firstly I don't think anyone really needed a 1000 word essay on why hiring is inherently probabilistic, I think that much is obvious.

The ultimate issue surrounding using github as signal is whether the presence of a github profile is inherently meaningful signal independent of every other factor. People who advocate github are usually implying (either explicitly or implicitly) that someone who codes outside of their day job (and then uploads it to share with the world) is more "passionate" and therefore a better coder. Many people disagree with this. It's been repeated ad nauseum why this reasoning is faulty: everything from getting your fill of creative work during your 9-5 to maintaining good work/life balance. Just the presence of a github with some activity is not an indication of passion or more importantly quality code.

Of course, people who defend using github like to say well I can know a candidate better by looking at their code samples before hiring them. Again, this absolutely goes without saying. If you want a code sample, just ask for one. I'm sure most people can provide _something_ for you to peruse. If not, keep a simple task handy that you can give them to crank out in a few hours. Such an easy solution to this non-problem.

The reality is this is all just the rationalization here. What's really going on is people use github because that's what they're into. "It's _obvious_ that I'm a top developer, therefore my behaviors are indications of top developers". Bullshit. This is just another symptom of the "hiring in my own image" phenomenon that's rampant in this world. Those of us who claim to be rational must recognize this and realize it's nothing but narcissism.

And no, the claim that anyone who is against using github as signal are people who aren't passionate/would be rejected/etc. I have plenty of code that I write on my own to scratch particular itches. Everything from machine learning scripts to greasemonkey scripts to patches to borked java applications. None of them were written with wider consumption in mind, and so I am not prepared to release them to the world. If you want to see it I have no problem showing it to you with the understanding that it may not be polished and not always follow best-practices when working on a team. Anything I produce is a reflection of myself so anything I release to the world must have a certain level of effort and polish put into it, otherwise I simply would not be comfortable.

</comment><comment><USER23> _If you do the coding test before interviewing the candidate, you are wasting the time of many candidates who will be screened out for being insufficiently hipster, having Windows on their resume, and similar non-coding related reasons._

Is he being cheeky? Why would you screen someone out for not being a hipster or having Windows on their resume?

<comment><AUTHOR> I've gone through the whole hiring rigamarole, done the coding test, etc, and been rejected at the last minute due to a lack of culture fit. (And justifiably so.)

The point is that I'd rather have that happen after a 20 minute phone interview than after a 2 hour code test.

<comment><USER24> Looking at your blog, I wouldn't want to work anywhere that would consider you a culture fit.

</comment></comment></comment><comment><USER25> Humm. First, this blog post was not a quick read while taking a quick break to read a hackernews post, so read if you have time. Second, while being able to see what a developer's programming style and their interests are like via a code repository, not having a code repository does not mean someone is not a good programmer worth hiring. It seems like those who will ONLY hire someone if they have an amazing github are asking for people who do NOTHING but breath, eat, and sleep code; someone without a life, someone who does not cook, have pets, loves someone, or has other interests than being in front of a computer uploading code to github. When you leave home at 7AM to be be at work at 8AM, and work until 5:30PM, and then you get home to cook dinner, feed your pets, clean a little, MAYBE get to the gym, it's already 11PM or midnight. When exactly do these employers think someone has time to do stuff other than work and take care of real-life responsibilities? I mean, yes, programmers could use the weekend and some if not most do, but if moving to another job means having an amazing code repository, this would not be built over one weekend, maybe not even several. There are brilliant programmers out there who simply do NOT have TIME to spend it creating code for employers to see on a code repository site, so requiring one is in fact discriminatory to those programmers who just cannot spend the time adding to the code repository.

I have personally seen how employers think they are so awesome that they will not even consider a programmer for hiring because of lack of a github. All I can see say is that in the case I have seen, all those employers missed out on hiring a great programmer, one who is truly dedicated to work and programming, one who really does live programming while still having and enjoying life.

</comment><comment><USER26> While _" [l]ooking at a code portfolio for people who program is fundamentally no different from looking at past experience, at educational credentials, or at any of the other standard resume screening techniques..."_ may be true, I think that it sidesteps another important consideration: What does requiring a code portfolio signal to potential applicants about the employer? Does it signal that the employer will be inconsiderate of those who can't share their professional work, or those who don't have lots of spare time for side projects? Does it signal that an employer is more interested in the placement of curly-braces than the ability to communicate verbally? Does it signal that the employer is solely interested in getting tomorrow's work done, or do they balance increasing the value of their codebase with increasing the value of their employees?

</comment><comment><USER27> Maria Kang makes no excuses, unlike developers without github profiles.

It's pretty ironic you used this picture, since she got a lot of negative press for it, and she mostly used it to promote herself and her blog.

Women are already under enough pressure in society to look "perfect" and this picture shamed them into not looking like the model. So women software engineer are supposed to spend tons of time at the gym to look like the model. They already do most of the child rearing (as well as house keeping and errands), and on top of that in order to get a job they are _required_ to code in their spare time just to get a job.

I live pretty far away from my parents (about 200 miles), and my dad is in poor health. He almost died a few months ago. I spend a lot of weekends visiting because I don't think I have much time left with him. Yes, that is my choice.

Factors outside of my control prevent me from moving anywhere else.

</comment><comment><USER28> There are tons of potentially good candidates you would miss by rejecting per default when there is no public code to see. Just look into the comments here.

The group I want to point out. Very experienced programmers who have been in the business more than a decade who get paid for doing what they think is interesting and challenging because they are so good so that they can choose their job and still get paid. Most of the time they throw themselves into work and their current project. Why on earth would they want to invest more time into a little pet project which is probably ten times less interesting than their current job?

</comment><comment><USER29> A little googling suggests that the author does not have a Github profile.

</comment><comment><USER30> Should we use the same approach for determining which products or services we should use?

If so, Mr. Carp and his company BayesianWitch are in trouble. I can't find either of them on github.

<comment><USER31> Good point - it doesn't seem unreasonable to demand to see BayesianWitch's source code in Github to see why anyone would want to work there?

<comment><AUTHOR> The company hasn't existed long enough to have much of anything.

This blog post (with some example code) can give you a flavor of the sorts of things we do: [http://www.chrisstucchio.com/blog/2013/time_varying_conversi...](http://www.chrisstucchio.com/blog/2013/time_varying_conversion_rates.html)

<comment><USER32> No excuses, remember. What about your personal Github profiles?

<comment><AUTHOR> It'll take you a minute to find if you are interested. Have at it - more eyes make code better and all that.

</comment></comment></comment></comment></comment><comment><USER33> From my perspective a GitHub portfolio might not be required to get hired, but if the code you've shared is bad code then it could keep you from getting hired.

Edit: That doesn't mean I wouldn't have one. I do have one. I just imagine that a bunch of developers sitting around judging someone on publicly available code may not always be considered a positive.

</comment><comment><USER34> I don't write open-source software. I also have a backlog of potential clients. If a company demands a Github, I say thanks, but no thanks.

</comment><comment><USER35> BaynesianWitch - The company that used the word 'tranny' in an A/B tested public statement intended to incite and offend their audience. Stay classy, BaynesianWitch.

</comment><comment><USER36> From the blog, it has the following piece of code:

def outcome(hiring_procedure): allowable_candidates = [c for c in all_candidates if hiring_procedure(c)] candidate_values = [risk_profile(value(c)) for c in allowable_candidates] return candidate_values.sum() / len(candidate_values)

What happens if we get to the return line, with an empty candidate_values? ZeroDivisionError ?

<comment><AUTHOR> The short answer is, that code is a lie. It should actually have been the integral of risk_profile(value(c)) dP(c).

But the python code is close enough to illustrate the point, and I've found people are far more likely to read and understand python code than equations.</comment></comment>


Arthur Conan Doyle and the Boer War - <AUTHOR> https://www.historytoday.com/miscellanies/arthur-conan-doyle-and-adventure-boer-war <comment><USER2> I like this quote of his about the boers.. disclaimer I have some boer blood myself.. "Take a community of Dutchmen of the type of those who defended themselves for fifty years against all the power of Spain at a time when Spain was the greatest power in the world. Intermix with them a strain of those inflexible French Huguenots who gave up home and fortune and left their country for ever at the time of the revocation of the Edict of Nantes. The product must obviously be one of the most rugged, virile, unconquerable races ever seen upon earth. Take this formidable people and train them for seven generations in constant warfare against savage men and ferocious beasts, in circumstances under which no weakling could survive, place them so that they acquire exceptional skill with weapons and in horsemanship, give them a country which is eminently suited to the tactics of the huntsman, the marksman, and the rider. Then, finally, put a finer temper upon their military qualities by a dour fatalistic Old Testament religion and an ardent and consuming patriotism. Combine all these qualities and all these impulses in one individual, and you have the modern Boer—the most formidable antagonist who ever crossed the path of Imperial Britain. Our military history has largely consisted in our conflicts with France, but Napoleon and all his veterans have never treated us so roughly as these hard-bitten farmers with their ancient theology and their inconveniently modern rifles."

<comment><USER3> A similar sentiment about South African rugby players; you may score more points than them, but you never actually _beat_ them :)

</comment></comment><comment><USER4> Also now known as the South African war, since many black South Africans also took part in the hostilities and were interned. It was the most significant historical event in South African history.

An interesting fact is that approx 450 000 horses died during the conflict(!) [https://jsava.co.za/index.php/jsava/article/view/147](https://jsava.co.za/index.php/jsava/article/view/147) [https://www.bwm.org.au/horses.php](https://www.bwm.org.au/horses.php)

</comment><comment><USER5> > Desperately thirsty men were now drinking contaminated water from old > abandoned wells and from the River Modder.

'Modder' means 'mud' in Afrikaans and Dutch, which certainly doesn't sound like a river you would want to drink from. :)

</comment><comment><USER6> This is not related to the Boer War specifically, but I was excessively amused when the BBC's last Sherlock Holmes series (set in the modern era) proved faithful to the original by opening with Dr. Watson's return home from the war in Afghanistan.

Geopolitics. Go figure.

</comment><comment><USER7> I live near the Modder River mentioned in the article. Currently working on an AI system that predicts the dam levels in the Modder River.

</comment><comment><USER8> When I went on safari to Madikwe, north of Johanessburg the local families were always light heartedly teasing me, because I was British.

One example being on a tour there was a scrapped Land Rover Defender at the side of the trail that had broken down a while ago. They said "never drive anything British, if you want to survive in the bush".

Land Rover quality aside, a bloody war should warrant a bit more than teasing.

<comment><USER9> So what should WWII warrant today?</comment></comment>


Feds say they can search your laptop at the border but won't say why - Suraj-Sun http://arstechnica.com/tech-policy/2013/06/feds-say-they-can-search-your-laptop-at-the-border-but-wont-say-why/

<comment><AUTHOR> If there's been any government anywhere in the world, at any time in history, that hasn't asserted an absolute right to minutely inspect anything that enters their territory, I'm not aware of it.

There are exceptions for items under diplomatic immunity, but that's about it.</comment>


Show HN: Avsc – a pure JavaScript Avro implementation - <AUTHOR> https://github.com/mtth/avsc <comment><USER2> I poked around your code; it's quite clean and readable!

I've never heard of Avro, but it looks really interesting. Could you enlighten me on some use cases, and situations where it really shines?

<comment><AUTHOR> Thanks!

I like to think of Avro in two (related) parts:

\+ A very compact binary serialization, which lets you efficiently store or transfer data over the wire. (Avro actually also defines a way to encode your data as JSON in cases when you need a human-readable representation.)

\+ A way to define "data types". For example this schema [1] defines what we expect a "Human" entry to look like, and we can now do things like check whether we are missing any information, make sure all fields are valid, sort, efficiently copy objects, etc.

This is glossing over many things (files, RPC, ...) but I hope this helps a bit! You can find a lot more information in the official Avro documentation [2] if you're curious.

[1] [https://github.com/mtth/avsc/blob/master/etc/benchmarks/sche...](https://github.com/mtth/avsc/blob/master/etc/benchmarks/schemas/Human.avsc)

[2] [https://avro.apache.org/docs/current/index.html](https://avro.apache.org/docs/current/index.html)

</comment></comment><comment><USER3> This is terrific if the benchmarks are accurate. The vast majority of these types of libraries end up slower than JSON when implemented in JS. What were the key performance tricks?

The benchmarks show a fair number of -1s (not supported). What isn't supported exactly? I don't see these limitations listed in the limitations section.

<comment><AUTHOR> I'll start with the second question since it's easier to answer: some of the other libraries don't support all Avro features (for example I don't think `node-avro-io` supports encoding records defined inside arrays), so they're unable to run some of the benchmarks. Both the reference Java implementation and `avsc` are able to parse all these schemas so don't have any -1s in their columns.

Performance-wise, the main benefits came from doing as much preprocessing as possible. Here are a couple examples of what is done when a schema is parsed:

\+ All methods for encoding and decoding nested types get fully resolved, removing the need for lookups (for example an array of integers would have a reference to the method for encoding integers).

\+ A constructor, and encoding/decoding methods gets programmatically generated for each record type. This avoids having to iterate over the fields each time. Same for unions. (Having a "Class" for each record type also lets us attach useful methods to its prototype, available for all record instances.)

Then there are a few other general ideas like making sure v8 is able to optimize all the methods on the critical path, or reusing buffers as much as possible to avoid allocating too many objects.

</comment></comment><comment><USER4> Would you expect Chrome browser performance to be similar to node performance? My use case involves shipping large arrays of doubles to the browser, and JSON read/write is a bottleneck.

<comment><AUTHOR> I haven't tested this but my guess would be that performance would be similar as they both run on v8. The only difference is the buffer implementation which is roughly as fast it seems (benchmarks here [1]).

[1] [https://github.com/feross/buffer#performance](https://github.com/feross/buffer#performance)

</comment></comment><comment><AUTHOR> Creator here. If you have any questions, please ask!

<comment><USER5> Why did you name it avsc? Are you concerned that it might cause confusion with the avsc file extension that avro uses for schema files?

[https://avro.apache.org/docs/1.7.7/gettingstartedjava.html](https://avro.apache.org/docs/1.7.7/gettingstartedjava.html)

<comment><AUTHOR> Mostly because `avro` was already taken on NPM and I wanted a short name to `require`. Since schemas (and schema files) seemed to me to be at the heart of Avro, I thought it was a reasonable option.

</comment></comment></comment><comment><USER6> Why is Avro better than Thrift?

<comment><USER7> Not that it's better, but Avro is a widely supported format in open source 'big data' tools.</comment></comment>


Open Sourcing Mantis - <AUTHOR> https://medium.com/@NetflixTechBlog/open-sourcing-mantis-a-platform-for-building-cost-effective-realtime-operations-focused-5b8ff387813a <comment><AUTHOR> Hey everyone, one of the Mantis maintainers here. There are a few of us standing by to answer your questions about why we created Mantis and what you can use it for.

In short Mantis is a Platform For Building Cost-Effective, Realtime, Operations-Focused Applications. Internally it has been used for alerting in real-time on KPIs such as Stream Starts per Second [0], our outlier detection platform [1] and scalable anomaly detection with zero machine learning. [2]

[0] [https://medium.com/netflix-techblog/sps-the-pulse-of- netflix...](https://medium.com/netflix-techblog/sps-the-pulse-of-netflix- streaming-ae4db0e05f8a)

[1] [https://medium.com/netflix-techblog/tracking-down-the- villai...](https://medium.com/netflix-techblog/tracking-down-the-villains- outlier-detection-at-netflix-40360b31732)

[2] [https://www.youtube.com/watch?v=6UwcqiNsZ8U](https://www.youtube.com/watch?v=6UwcqiNsZ8U)</comment>


Discord server for 3D Printing community real time chat - <AUTHOR> https://discord.gg/CMEaYrq <comment><AUTHOR> Hi Everyone

I started up a Discord server for anyone that wants to talk about 3d printing in real time.

I've currently created channels for:

General [https://discord.gg/CMEaYrq](https://discord.gg/CMEaYrq)

Delta [https://discord.gg/hXtTGRD](https://discord.gg/hXtTGRD)

Cartesian [https://discord.gg/2meJvmm](https://discord.gg/2meJvmm)

SLA [https://discord.gg/NzUf4ud](https://discord.gg/NzUf4ud)

Feel free to let me know if you think other channels should be created.

Cheers Brian</comment>


User's Guide to zsh - <AUTHOR> http://zsh.sourceforge.net/Guide/zshguide.html

<comment><USER2> What is the advantage of using zsh versus the omnipresent bash ? I mean there is something that can be done only in zsh and not in bash; or something that is straightforward to do in zsh and cumbersome in bash ?

Of course I can learn zsh to increase my knowledge, but it will be nice to see some clear advantage of using zsh.

<comment><AUTHOR> At the risk of starting a religious war...

zsh is a little snappier than bash and offers some neat options which are not present in bash (at least not out of the box AFAIK - e.g. spellcheck).

From my experience, zsh targets power users (and people who really don't like to type). For most people sticking with bash is probably leaving well enough alone.

From my POV it's not a religious issue, though in just a short while of using zsh I find it more productive than bash.</comment></comment>


How To: Make A VPN - <AUTHOR> http://www.geekyportal.com/2011/12/how-to-make-vpn.html

<comment><USER2> 1\. Windows only.

2\. Stupid website insists on obscuring the left of the article with "Like" buttons.</comment>


Open Conference Expectations - <AUTHOR> https://gist.github.com/3098860

<comment><USER2> I wrote a response to this ([http://tech.puredanger.com/2012/07/12/conference- expectation...](http://tech.puredanger.com/2012/07/12/conference-expectations- from-speakers/)) but I think mikeal's comment here gets at the heart of it better: <https://gist.github.com/3098860#gistcomment-370439>

</comment><comment><USER3> As a conference organizer for PyCon, I wrote a piece on this last year when the same types of questions arose from a series of Node/JS/Ruby conferences (Non-Profit/Community Python conferences did not, as far as I know, spark the debate).

<http://jessenoller.com/2011/05/25/pycon-everybody-pays/>

It's a different community/conference and ethos going back the 10 years of PyCon.</comment>


Tell HN: I blocked HN, etc. during work today. It was a whole new world. Try it - <AUTHOR> https://addons.mozilla.org/en-US/firefox/addon/4476

<comment><USER2> Chris Sacca (awesome guy and investor in a few YC companies, including ours) said to us something like, "People have these moments of strength where they can say something like, 'block me from this site so I can focus' and they have moments of weakness where they break down and try to go to that site."

RescueTime will have this feature pretty soon where you can voluntarily block or limit distracting stuff on a voluntary basis IN ANY BROWSER.

[https://www.rescuetime.com/blocked/url/http://news.ycombinat...](https://www.rescuetime.com/blocked/url/http://news.ycombinator.com/)

There's an example block page that you'd see if you blocked Hacker News (we have a few custom ones in the works).

<comment><USER3> I love that picture:

<http://danhau.posterous.com/our-fearless-investor-paul-gra>

</comment></comment><comment><USER4> I tried this last week but found myself browsing in a VM so finally decided to just not fight it.

So if you do want to try this, make sure you block all possible ways you can access the sites (various browsers, various VMs). Kind of a pain.

<comment> brown9-2 This story is astonishing.

You were successful at preventing yourself from browsing from your main machine, but fired up a a virtual machine to circumvent yourself?

<comment><USER4> I always am running the VM anyway (Linux guest on Windows host); it's not like I started it just to browse. Just saying if you feel the need to block yourself programmatically you probably need to do so on all routes by which you can reasonably access the sites, e.g., various browsers and various VMs.

</comment></comment></comment><comment><USER5> A year ago, I tried the same thing, and I agreed with what you're saying. Then I got rid of it. Then I started using Instapaper to browse and read things later. Then I stopped doing that.

Then I got a job that I didn't hate. I don't accidentally waste too much time on HN anymore :)

</comment><comment><USER6> A great app for OS X that will block all connections to a specific server for a specific length of time (not just in firefox) is Self Control: <http://visitsteve.com/work/selfcontrol/>

</comment><comment><USER7> Interesting. It is similar to the "noprocrast" feature on YCN, but applicable to a variety of sites. Nice work!

</comment><comment> matthew-wegner Is it _that_ hard to spend fewer hours at work and more, guilt-free time doing your own thing later? We run regular M-Thu 10:00-3:30 production hours. The trade-off, of course, is that people agree to save Twitter/RSS/browsing for their own time at home. We get a lot done.

<comment><USER8> M-Th 10:0-3:30? Sure, I won't open a social website. M-F 8:30-5:00? Different story

<comment> matthew-wegner That's 10:00am to 3:30pm (just making sure you didn't think it was 10pm-3am).

<comment><USER9> I think his point is that not everybody can set their own hours that way.

</comment></comment></comment></comment><comment><USER10> No

</comment><comment><USER11> Agreed; I block sites from myself, and my increase in productivity (and morale) is amazing.

I use this plugin instead:

<https://addons.mozilla.org/en-US/firefox/addon/3145>

You can turn on password protection, so that you can't turn off the plugin.

</comment><comment><USER12> One useful side-effect of a time-tracking tool such as JotBot (note: I'm the developer) is that it routinely prompts me for input on what I'm doing.

Now, that sort of thing can be annoying to some (as opposed to some passive activity tracker), but the upside is that it makes me aware of when I'm dicking around _at the time I'm doing it_ , rather than at the end of the day when it's too late to correct it.

I've tried blocking tools; hated them. I'd rather be allowed to make these decisions, but with a nudge that reminds me when maybe I'm getting too distracted.

</comment><comment><USER13> Most sites that I read are through RSS feeds in a desktop client (Newsgator). My RSS client typically remains shut during the work day (except for those occasional really boring moments). That way I don't miss anything neither do I "waste" time. I make it a habit to catch up in the night or before starting to work. An empty RSS feed would make sure I don't get distracted and let me feel contented as well.

</comment><comment><USER14> I found the only time this was remotely rewarding was when I noticed I hadn't checked HN for an entire day because I was just too wrapped up in work.

Plus, I have way too many browsers installed for a Firefox addon to ever stop me. I don't even _use_ Firefox as my primary browser.

</comment><comment><USER15> hmm browser plugin is ok. But I have like 6 browsers installed and sometimes I REALLY want to see it :)

I use hosts file, but I haven't put HN there just yet. Just most of the news site (so I can only access the really crappy ones with boring articles). Hosts file works for virtual machine as well since I used a bridged connection :)

</comment><comment><USER16> I used HNs built in productivity features (No procrast, min away) during exam days it was quite good.

</comment><comment><USER17> I can't do it. I just can't.

</comment><comment><USER18> Do people really have such little self-control that they need to block a particular internet site via a tool like this? Just don't type news.ycombinator.com or click your bookmark for it. Simple as that.

<comment><AUTHOR> I don't think this is a question of self-control. I noticed (only after I installed this plug-in) that sometimes when I got frustrated with a problem I would type in news.ycombinator.com by habit.

Breaking that habit definitely helped my cause.

<comment><USER19> Exactly, almost like you need the endorphin so you rush to the easiest source of satisfaction. Probably similar to a smoking or eating habit, you just need an easy win so you click on the site. Same here.

</comment></comment></comment><comment><USER20> Why did you block them instead of just not visit them?

<comment><USER21> You have asked a truly profound question. I don't know the answer, but it's got something to do with how brains work.

This might be relevant: <http://en.wikipedia.org/wiki/Executive_function>

</comment></comment><comment><USER22> my hosts file is riddled with all the sites i visit on a regular basis.. in fact just today I had enabled everything (except my personal email) it's interesting because i found myself checking my email once every 10 seconds for lack of any other site to go to. Sometimes its really hard to get motivated to work on a project you hate.</comment>


Video from 100 years ago shows a car with parking assist technology - <AUTHOR> Not all modern visionaries look to the past. But in vain: in the past, you can draw a lot of interesting solutions.
I think that this is a great opportunity to create a vintage series of cars.
What do you think of it?
https://youtu.be/el-5IYMevyM <comment><USER2> Back in the 90's I saw someone had tried to build a car project like that. Ironically I commented that the idea seemed so very 70's (when there was a DIY for just about anything imaginable). Seems it's a whole lot older than I expected.

About vintage series cars, I honestly thought the PT Cruiser was going to go in that direction. They had that mobster-lite look to them.

</comment><comment><USER3> That's brilliant and useful!</comment>


Show HN: Error 500 on YouTube for certain query - <AUTHOR> http://www.youtube.com/results?search_query=neotechnologies

<comment><AUTHOR> query can by modified, eg. "neo technologies", "technologies neo".</comment>


How We Get Stronger - <AUTHOR> https://www.nytimes.com/2020/07/01/well/move/how-we-get-stronger.html <comment><AUTHOR> "Perhaps more poetically, the data tell us that strength may be even more fundamental to our well-being than we already expect, since gaining it involves and alters some of the most ancient components of our central nervous system."</comment>


Oh no! Hackers! - <AUTHOR> http://blogrium.wordpress.com/2009/06/17/oh-no-hackers/

<comment><AUTHOR> Despite the introduction, this is not really about the controversy around the word "hacker" ... it's about hacker culture and making it more explicit. Perhaps I'm preaching to the choir here, and I'm sure you're sick of the semantics discussion ... but my point is that I'm sure some of us self- identify as hackers. Why not make it more explicit? Why don't we encourage the values of this culture more?</comment>


How political data teams game Google to fool people - <AUTHOR> https://www.pastemagazine.com/articles/2017/06/how-the-trump-russia-data-machine-games-google-to.html <comment><USER2> As someone who has been on the publication side of digital media: Never ascribe to propaganda what you can explain by greed.

News is fundamentally broken, all those sites linking to each other are probably doing it to increase the "trending" part of the news which will push all of them up the google rankings.

The reason why Russians, and Eastern Europeans in general, are more highly represented as owners of these places is because the cost of living is so low there. That you make $2,000 from add revenue in the US would mean you can afford to eat out a few more times a month. When you can do the same thing in a country where this is double the average wage you can spend all your time doing it and be better off than if you tried doing anything else.

<comment><USER3> >As someone who has been on the publication side of digital media: Never ascribe to propaganda what you can explain by greed.

A great documentary on the interplay between investigative journalism, government lies, and infotainment (greed based media guised as "news" or "journalism" is

All Governments Lie: Truth, Deception and the Spirit of IF Stone [https://www.youtube.com/watch?v=C_cKC0_sGu0](https://www.youtube.com/watch?v=C_cKC0_sGu0)

</comment></comment><comment><USER4> > Why aren't Democrats paying people to do this kind of thing with the truth? > No idea. None. They can do it, just like that other company crushed us, but > they haven't learned.

As a casual observer, it certainly does seem like the political right in America has consistently been more willing and eager to bend the rules of the information game - up to and including willfully propagating falsehoods. This has at a minimum been repeatedly evidenced over the last 20 years, first in cable news and now online.

Is the solution - as the OP implies - for the left / center left to adopt the same dirty tactics as their counterparts? Is there any alternative? I'm sure every rational individual (a group in which I hope to include myself), would really just prefer if everyone started behaving like adults and returned to discussing issues in what at least looks like good faith. Is that at this point a pipe dream?

<comment><USER5> The problem is that the tactics work best for fake stories, because they can be pre-loaded and coordinated. True news is worked out between competing outlets and breaks messily.

<comment><USER6> Fake stories are also quicker to write. Truth requires careful research, which takes time. Fake news can be written as fast as fingers can strike the keyboard.

Fake stories can be tuned for maximal appeal to people's existing opinions, preconceptions and prejudices. Truth has a habit of telling us things other than what we want to hear.

</comment></comment></comment><comment><USER7> "Left wing media" lost me a few years ago to no credit of "Right wing media". They're shamelessly embracing polarization and every time I decide to take another peek at it, it seems it's sunken further.

Journalism is broken, completely broken, and as long as people are trying to figure out how to fling mud at other publications rather than rise above the sea of trash they'll keep losing to ever less credible sources.

<comment><USER8> > as long as people are trying to figure out how to fling mud at other > publications

And that's half of what this article boils down to, "as if _these_ websites are above _these_ ". Google rankings for one story - the author is very specific in fetching that story - aren't going to strictly follow alexa rankings of entire websites. I can see pro-trump users clicking "No evidence of trump-russia collaboration" much more commonly than people who don't want to believe it is true. The author is onto something very believable, but he doesn't so much have evidence as whining.

<comment><USER9> From TFA:

> Now let's see exactly what's up here. Together, we're going to Google the > phrase "trump no evidence collusion." (And because Google searches change > over time, I'll drop screenshots of my results here.) What will emerge is a > picture of an invisible hand writing a specific argument, over and over and > over. That hand belongs to Robert Mercer, Trump's data man, who gamed Google > and fake news during the campaign and whose return to the scene is heralded > by Trump's war room and bot boom. If you want, you can read more about this > crazyAF, richAF, crackpot genius with a heart of shit.

> Before we begin, though, we need to establish the fact that this statement > is a lie: "There's no evidence of collusion!" The reason I'm using this > specific example is because this highly nuanced claim is the perfect > loophole to exploit for misinformation, to shade the truth as lie and get > away with it clean.

> The truth: no one in the intelligence community and no one on any of the > Congressional committees looking into this thing, be they Democrat or > Republican, none of them have said categorically, flat-out, "There is no > evidence of collusion." Period. People investigating the case will only go > so far as to say they haven't seen any evidence. Or that there hasn't been > any evidence made available to them yet. But they don't ever say there flat- > out isn't any evidence of collusion. Ever. Read this if you don't believe > me.

Maybe I misread/skimmed the article, or misunderstood the premise, but are these statements not more or less guilty of the same thing? Most any left- leaning (or at least anti-Trump) person I know is _highly_ certain that Trump/Russia collusion is a fact, despite (as far as I know) no hard evidence being found. So to my mind, accusing pro-Trump people of being intellectually dishonest by saying "There's no evidence of collusion!" is _at least_ as great of a crime as whatever it is the pro-Trump side is doing. When we have reporting 24x7 on numerous news networks and casual news shows like the Daily Show repeating the Trump-Rusia story ad nauseum, stating the _correct_ (is it not?) fact that no hard evidence of Trump/Russia collusion has _so far at least_ been found seems like the lesser of two crimes. (Being pedantic, it is actually a true statement as far as the public record is concerned, based on my understanding).

But them maybe I'm misunderstanding.

If one wants to see something truly illuminating, set aside a few hours some evening, go on YouTube and watch some Noam Chomsky interviews, especially the more recent ones. Indeed I'm sure my mind is biased, but what you will see, albeit skewed by Noam's political leanings, is pretty damning to both sides. The hypocrisy of Americans being so incredibly morally outraged at election tampering is probably one of the biggest recurring gems you will come across, this whole thing borders on hilarious if you take off your partisan hat and actually think about it.

About the only thing I feel quite confident about, is that anyone who has very strong leanings to one side or the other is likely wrong (compared to the actual omniscient truth).

</comment></comment></comment><comment><USER10> Why does Google prioritize freshness so much? In some domains (i.e. Tech developments), freshness is very important.

But in most, old content (the classics) is likely to be better than most new content.

<comment><USER11> To me, this seems like one of those issues that's easy for a human to parse, but hard for a computer. For example:

* Terrorist attack in London

* Terrorist attacks in London

The only difference is the plural. However, the first is probably time- sensitive, looking for the most recent attack that's in the news right now. The second is more general.

<comment><USER12> Those categories are fast whittling down, as the terrorist attacks are now apparently a weekly occurrence.

</comment></comment></comment><comment><USER13> The thing that scares me the most, let's say Trump IS impeached. Not outside the realm of possibility. This group of people, they literally live in a different reality, and in their reality this impeachment would be a coup.

People don't just silently stand by when that happens. This is a heavily armed group of people, who's been "riled" up for literally years. Go to their discussions about the "free speech rallies" online. Look up based stickman. A lot of people are eager.

When the stakes reach the climax, we could see this "information" war turn into a real life war. Conspiracies, whether right or wrong, play HUGE roles in significant parts of history.

</comment><comment><USER14> This is not new or unique. According to Wikipedia, "Google bomb" was added to the Oxford Dictionary in 2005.[1] The first instance I remember was "miserable failure" linking to Bush 43's biography.. so probably not Republicans.

1 - [https://en.wikipedia.org/wiki/Google_bomb](https://en.wikipedia.org/wiki/Google_bomb)

</comment><comment><USER15> The UK has the concept, at least for televised news, of "Due Impartiality and Due Accuracy and Undue Prominence of Views and Opinions" [1]. I know the US loves its first amendment, but such a law could really help to have better televised debates and opinion programs on cable news (I'm obviously thinking of Fox News, but the problem exists for the other news channels). Other European-inspired laws like no political ads or limited amount of money spent during the campaign [2] would also help to have a better political environment.

[1] [https://www.ofcom.org.uk/__data/assets/pdf_file/0024/86307/b...](https://www.ofcom.org.uk/__data/assets/pdf_file/0024/86307/bc2015-07-section_5_due_impartialitiy.pdf) [2] Still can't understand Citizens United with my European point of view

</comment><comment><USER16> I am wondering why for factual statements like X is Y that are provable as false can't the entity damaged by the publication ask for a retraction and/or damages ? As a person if you denigrate other person you are in trouble.

<comment><USER17> "A lie can travel half way around the world while the truth is putting on its shoes." -Mark Twain

<comment><USER18> "Falsehood flies, and truth comes limping after" \- Jonathon Swift

[http://www.bartleby.com/209/633.html](http://www.bartleby.com/209/633.html)

</comment></comment></comment><comment><USER19> Well if you google for "no evidence collusion", and if you get evidence for collusion there is something wrong with the algorithm don't you think?

</comment><comment><USER8> >the way those results are ordered isn't exactly organic. Alexa ranks the NYT at 120 globally; WaPo at 190. Now, what about the illustrious townhall.com, which had not one but two hits on page one? It's ranked at 9,109. In other words, those first four pages (four full pages of synchronized bullshit) are evidence of a massive and centrally managed strategic misinformation campaign being waged on your brain.

Granted.

>These dozens of sites are all peddling the same lie...

Uh, the headlines provided range from "No evidence of trump-russia collusion" (page 1) all the way to... "lack of evidence on trump-russia collusion" (page 4).

>If you read closely (which they're betting you won't) they all include the proper, honest caveats: no evidence YET; no one says they've SEEN evidence; etc.

The jump from that, to "No evidence" in the headline, is _the_ most humdrum of spin used in every media article written every day, it's the background noise of journalism.

You're onto something big, don't mire your articles in blue tribe whining.

</comment><comment><USER20> maskirovka has been used for centuries. The fact is, the internet makes it as easy for someone with a youtube channel on the other side of the world to be more effective at disseminating disinformation as a state sponsored newspaper in the 1920s.

If the WWW is to remain unregulated, then get used to it.

<comment><USER21> It was used to great effect after the American Revolutionary war. Competing presses would print all manner of slander against monarchist and anti- monarchist factions, seeking to impact public opinion.

</comment></comment><comment><AUTHOR> I hope everyone is keeping in mind that constant conversion + more traffic = more users.

<comment><USER22> Yep. This is no different than any marketing campaign. Trump builds the product, and people set up websites "selling" it.

I've been in marketing a long time, and everything I've seen reinforces my cynical view that people are nothing but a bunch of sheep waiting to be herded. As a convoluted example, consider the fact that simply changing the color or position of a button on a webpage can measurably alter the rate of people who click on it. Looking at it this way, one begins to wonder when free will ends and conformity begins.

</comment></comment><comment><USER23> Nigritude ultramarine, but for control of the United States of America.

</comment><comment><USER24> the only thing Russia hacked was how stupid Americans are and how addicted they are to using quick quotes to signal a false intelligence... so that's on us. As far as the DNC... those emails should be public from the moment they are sent. All government emails should reside on a public searchable database... content is king.

</comment><comment><USER25> from Australia, I'm seeing the credible results on the first page (both logged in and incognito), how does it look from elsewhere? Has Google already tweaked their algorithm?

</comment><comment><USER26> Why has the title been changed from the original "How the Trump-Russia Data Machine Games Google to Fool Americans"?

<comment><USER27> Because it implies that Trump and Russia are somehow parts of the same evil rightwing-shilling machine. That meme is getting ridiculous.

<comment><USER17> Given that it's under active investigation, "meme" might be wrong word.

<comment><USER28> Like WMDs were under active investigation, with agencies checking on them, the NYT, CNN and other "serious" outlets informing the public about them, and even a whole war (and tons of lives lost, not to mention a trillion dollars spent) was justified on their presence?

Yeah, "BS excuse of large part of the establishment for their own incompetence and disconnect" would be a better moniker.</comment></comment></comment></comment>


The death of RSS in a single graph - <AUTHOR> http://andrewchen.co/2013/04/29/the-death-of-rss-in-a-single-graph/ <comment><USER2> I closed the page as soon as that full-width pop-over came up [http://uk.omg.li/R3mQ](http://uk.omg.li/R3mQ)</comment>


Web apps: taking five years to get to where desktop apps were a decade earlier? - <AUTHOR> http://pinderkent.blogsavy.com/archives/131 <comment><USER2> There are certain types of apps that will probably never reside in a browser, and certainly never with AJAX. Heavy-duty stuff like Final Cut Pro and the Adobe CS springs immediately to mind. I know a lot of people use GMail as their primary mail client, but to me, it can't touch Mac Mail. From a UI perspective, freedom from the browser is the ultimate trump card.

Obviously, there are plenty of apps that make more sense to have exclusively on the web (like, say, the good old Google search engine), but there's a lot that will always belong on the desktop.

The mistake AJAX zealots make is an overly broad view of the web's value. The web is valuable as a back end. That's it. As a front end for apps, the desktop's possibilities are comparatively limitless.

If, for instance, Word featured remote access and collaboration (i.e. use the web as its back end), Google Docs would be in serious trouble. The same goes for almost every major desktop app (including OSes) whose death knell the web 2.0 crowd is so eager to ring. In the next few years, using the web simply as a back end for the desktop is going to be a huge area of innovation.</comment>


Geek Politics FTL - <AUTHOR> http://gilesbowkett.blogspot.com/2008/04/geek-politics-ftl.html

<comment><USER2> Too much whining. Don't like it? Don't use it. They will likely support other languages in the future.</comment>


Protecting sshd using spiped - <AUTHOR> http://www.daemonology.net/blog/2012-08-30-protecting-sshd-using-spiped.html <comment><USER2> I have only recently started casually studying cryptography. I just yesterday learned about GCM mode, which provides similar features to CTR with GMAC. Is there any specific reason you chose to use CTR with HMAC in spiped rather than GCM?

I ask because I have the impression that using GCM would further simplify/reduce the amount of code and because I'm interested in learning what goes into these decisions. BTW, I'm perfectly happy with an answer of "I can't even explain it because you don't know enough yet." if that's the case.

[EDIT] Extra information for not-yet-crypto-nerds:

The "modes" i'm referring to are cipher block modes. Cipher block modes allow repeated application of a block cipher to long messages (because a block cipher's input must be a fixed length - that's what makes it a "block" cipher rather than a "stream" cipher).

Using a block cipher only gives you confidentiality; it does not verify the inegrity or the source of the message. For those, a message authentication code (MAC) is needed. There are several MAC algorithms.

There are some block cipher modes (including GCM) that provide both authentication and encryption because they include a MAC algorithm.

<http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation>

<http://en.wikipedia.org/wiki/Message_authentication_code>

<comment><AUTHOR> I covered this in a blog post a few years ago -- probably best if I point you at it rather than trying to cover everything here: [http://www.daemonology.net/blog/2009-06-24-encrypt-then- mac....](http://www.daemonology.net/blog/2009-06-24-encrypt-then-mac.html)

<comment><USER2> Wow. That was more than I hoped for. I especially appreciated the closing paragraph. Thanks for taking the time to write it and to point it out here.

However, one of the points you made as an argument against authenticated encryption modes is actually a point for it, unless I'm not getting something. The point I'm referring to is that people write bad code and that every line of code includes a potential security vulnerability. Every time someone uses CTR+MAC, they're writing code to glue those together, and there are opportunities for missteps. Furthermore, that code that is viewed by a small number of people. By using an authenitcated encrytion mode, one can reduce the lines of code you're writing because it the functionality is provided by the implementation, which will certainly have been looked at more times than one's own project.

[Edit]

Maybe this is what I was missing: "Encrypt-then-MAC is essentially impossible to get cryptologically wrong."

</comment></comment></comment><comment><USER3> Here is a better idea. If it looks like a duck, walks like a duck and quacks like a duck, is it a duck? Run ssh on port 443 at the same time you run a web server on the same port. <http://www.rutschle.net/tech/sslh.shtml> I've seen implementatios in about a page of C, which I can vet.

<comment><AUTHOR> That is terrifyingly evil. And I mean that in the best possible way.

<comment><USER4> As someone who doesn't have a very subtle understanding in English, I can't figure out if this is an endorsement, or very much not one? (serious question! I'd rather fly by your crypto-intuitions than my own...)

<comment><AUTHOR> It's incredibly cool. Not something I'd necessarily want to actually use in production, though.

</comment></comment></comment></comment><comment><USER5> I can't help but notice that this tool was created to circumvent private networks. If you just wanted to write a crypto tool, kudos, but this is not a good idea for production data. I also recommend focusing on system hardening versus throwing crypto and fewer lines of code at the problem. The net benefit is ten times that of a more complex set-up that only protects a corner case.

Take your original example: 17 servers and you want to share data between them on the internet. The most effective way to do this is to put them all on one or two hosting providers and use private IPs to connect them all via the same backend. This way there is no surface to attack (if the hoster VLAN'd your hosts correctly). Back in the day we used to do this by putting a private switch in a rack that nothing else could touch, but it seems the days of private cage monkeying has disappeared.

The other way is by using a VPN. A VPN is simply a network interconnect. Based on some authentication data, allow a host to connect to a private network. If done properly, there is no service to take advantage of and the daemon can run completely without any capabilities or system access, save of course network traffic. You then add firewalling to ensure only the right hosts get to the right services. You can even make this a single stand-alone VPS host to add granularity and separation of privilege, not to mention reduced attack surface.

Your tool is theoretically simpler in practice than either of those methods (I don't find setting up a VPN to be complex, but others might). But it comes with the same risks as OpenSSH, save that (I imagine?) you could set it up to be network-access-only like a VPN. The difference for a VPN being you wouldn't need to configure multiple instances of an application.

<comment><AUTHOR> You seem to be under the misapprehension that VPN code never has any bugs in it.

<comment><USER5> Everything has bugs. If you're trying to make a point about the idea that this software was created with the intent that "it's small so it can't have any bugs", you're right, that probably has bugs too, and relying on that factor alone would be a horrible way to secure a network service. Hence why I suggested a VPN segregated from the rest of the system, or systems on the whole.

</comment></comment></comment><comment><USER6> Colin, I've always thought of running SSH on some other port as the equivalent of painting your front door camouflage with the hope attackers might overlook it -- in other words, pointless. It might stop some of the "log spam" from dumb brute force attacks on port 22, but if a port scan was done to find the sshd listening port (i.e. a smart attacker), then you still get attacked and log spammed. As far as I know, this issue is best handled by pf.

I'm probably missing something obvious, but I don't understand how spipe/spiped on another port fixes (or helps) the brute force problem?

<comment><AUTHOR> People can connect to spiped, but nothing will go through to sshd unless they can complete the handshake (which requires an unfeasible amount of work unless the person connecting holds the spiped secret).

<comment><USER6> Interesting. I'll check it out. Thanks!

I've always wanted something like spamd(8) for ssh, so everyone who normally blocks inbound port 22 can work together to thwart the brute force attacks by providing a honeypot/sandtrap/tarpit for the attack scripts to waste all of their time and resources.

</comment></comment></comment><comment><USER7> The title made me laugh. Let's protect a very secure, well tested and popular codebase by one that isn't as well tested or popular. Hmmmmm.

<comment><AUTHOR> Let's protect a large and complicated codebase which has a long history of security vulnerabilities with a very small and easily audited utility.

<comment><USER7> What are you protecting? You _can't_ brute force key-based authentication for SSHd.

<comment><AUTHOR> I'm talking about security vulnerabilities in OpenSSH.

<comment><USER8> Is there really a history of security vulnerabilities in OpenSSH? (not openssh as patched by idiotic linux distributions)

<comment><USER7> There have been problems... <http://www.openssh.org/security.html>

<comment><USER8> So technically those are all "vulnerabilities in openssh", but most of those are either attacks on the key generation process, X11 forwarding, or privilege escalation on the host machine from a legitimate login - none of which would be protected against by the suggestion in the story.

The first one I see where this defense would actually be helpful is the "September 23, 2003: Portable OpenSSH Multiple PAM vulnerabilities", which only applies against a nonstandard PAM configuration, where enabling PAM at all is something openssh doesn't recommend. The next is "April 21, 2002: Buffer overflow in AFS/Kerberos token passing code" - again, an obscure login protocol that's disabled by default.

The first vulnerability that would affect "normal" users is the "Feb 8, 2001: SSH-1 Daemon CRC32 Compensation Attack Detector Vulnerability", 11 years ago. Even if you want to count the "nonstandard config" vulnerabilities, we're still talking 8 years since any real attack, for possibly the most high- profile encryption software in the world. That's a track record I'd put more faith in than spiped's.

If you want to secure your openssh you'd get a better return on your time (IMO) by disabling any login methods you don't use (or, even better, switching entirely to single-use keys), and rate limiting login attempts from a single IP.

<comment><USER7> I completely agree, but I thought it only fair to list the vulnerabilities. On the other hand, most of it didn't make sense to me... Though that should worry me more than you and thanks for your explanation. :)

Having said that, the vulnerability you pointed out was in SSH1, right? Isn't that depreciated?

<comment><USER8> >Having said that, the vulnerability you pointed out was in SSH1, right? Isn't that depreciated?

It is now. I'm not sure it was in 2001.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This feature seems to be offering similar functionality to OpenVPN's tls-auth which requires an additional key before a connection is allowed. Another option to get similar functionality would be to use port knocking [1][2] but spiped gives other useful functionality too.

[1] <http://www.portknocking.org/> [2] <http://www.thoughtcrime.org/software/knockknock/>

<comment><AUTHOR> I was intending to mention port knocking in that blog post but didn't find a convenient point to fit it in. Yes, it's definitely an alternative solution to the "let me connect to sshd but not anyone else" problem.

</comment></comment><comment><USER10> This looks incredibly useful, thanks.

I'd been kinda using two methods to do this already

      * OpenVPN plus tun firewalling
      * stunnel

Your solution is just so much a better fit for small-scale ( socket level protection ), it hurts.

How ready-for-production is the toolset ?

<comment><AUTHOR> Yeah, there's several ways to do this -- 'ssh -L' is probably the most common, followed by stunnel, followed by various types of VPN -- but for the use cases I care about none of them fit very well.

 _How ready-for-production is the toolset?_

I've been using spiped in production for the past year. I've been using spipe for about two days (since I only wrote it two days ago). I'd characterize both as being very production-ready; the amount of code is small enough (about 4000 lines of code, of which 3/4 is library code shared with other projects I've released) that there's very little room for bugs to hide.

</comment></comment><comment><USER11> I realize it's not quite the same thing, but how do you think this compares to Port Knocking?</comment>


You Might Need JQuery - <AUTHOR> https://medium.com/@ui_market/you-might-need-jquery-5b6c0c757e61 <comment><USER2> The points in the article is quite fair, but I'd disagree with the newbies part. A great learner will always dig deep and therefore propably would not need jQuery to succeed.</comment>


Rebooting is for Windows - <AUTHOR> http://www.zdnet.co.uk/blogs/the-open-source-revolution-10014902/rebooting-is-for-windows-10018087/

<comment><USER2> One of the comment refers to netcraft for example of long Linux uptimes. According to <http://uptime.netcraft.com/up/today/top.avg.html> Windows have better or just as good uptime as Linux servers. (maybe I am missing something)

The last time I used a MS web-server was ~10 years ago. I have almost exclusively used debian/ubuntu servers most of the time. Apart from the Linux fanboyism, what advantages does MSFT have as a server OS?

<comment><USER3> Exchange; that is quite a huge one for businesses where I am. Many people are just so used to outlook for email that when it comes for them to put in some kind of email management architecture they will always go exchange.

<comment><USER4> There are some non-Windows Exchange alternatives that would be transparent to Outlook users, but it's probably an uphill battle selling them to management.

<comment><USER5> Yes. You'll have better chance selling a new paradigm (cloud based, no clients to deploy, no individual mail server mattering) than a opened version of the old paradigm (which is still controlled by the proprietary vendor).

</comment></comment></comment></comment><comment><USER5> Yes. Shutting down every app, the OS kernel, and firmware, and restarting them for anything beyond a major OS upgrade is a reminder that Windows remains a desktop class OS.

</comment><comment><USER6> While Windows has (and probably always will be) an OS that requires reboots for certain patches, it seems a bit biased of the article to ignore much of the work that's been done in recent (>= Server 2003) versions of the OS to minimize this, while highlighting improvements such as KSlice in Linux.

<comment><USER7> Can you move, rename or replace an open file with current Windows? That's possibly one of the reasons why it's so hard to apply patches without rebooting a Windows box. And an endless annoyance when using a Windows desktop.

<comment><USER8> Can you remove a logfile on linux/unix while something is using it? Of course you can but the open file will stay around in limbo. It wont free up space, the program that holds it open will write to the deleted file, etc. Most linux programs will let you send it a nohup and it will close and reopen the logfile, that's something I haven't a clue about on windows.

I still pipe logs to a separate process that checks if the logfile is deleted and reopens/creates the logfile, its just easier.

<comment><USER9> If your intention is to totally remove the space that's occupied by the log file, you'll probably want to pipe /dev/null into the file:

cat /dev/null > /path/to/logfile

<comment><USER10> That does not do what you think it does.

Your command will make /path/to/logfile fill up all available space on the disk. To truncate that file, which is probably what you wanted to do, you should

`echo > /path/to/logfile`

<comment><USER11> His command does exactly what he says it does. Your command truncates the file and then writes a newline into it.

</comment></comment></comment></comment></comment></comment><comment><USER12> Eventually your hardware will fail. If you can't even safely reboot your machines under controlled circumstances, you've already lost the uptime battle.

<comment><USER13> I have run into problems where the machine would not survive reboot after updates but did not find this out after months.

<comment><USER7> It's OK to reboot from time to time. What is not OK is to have a reboot imposed on you when you would rather continue running. It's not a huge disruption to reboot a cluster node, as long as the rest of the cluster takes the load.

Rebooting makes sure the filesystem is properly scrubbed, temporary files are removed and any stale data in memory gets removed.

Uptime competitions are pointless.

But forced downtime (Windows Update-style) is unacceptable.

<comment><USER14> _> Uptime competitions are pointless._

While uptime competitions don't indicate availability very well, they do show how much time happened since the last kernel crash or the last kernel security hole that required a kernel upgrade and thus a reboot.

(Unless, of course, someone is trading security for uptime, which is luckily the exception rather the norm, at least among responsible admins.)

It appears that neither Windows nor Linux work particularly well here, but the BSD systems are quite impressive in that regard, especially OpenBSD.

<comment><USER7> Good thing in ksplice is that not all kernel updates will require a restart. I see the Ubuntu folks got very bold in pushing new kernels down the update pipe in the last couple releases.

Availablity is also somewhat overrated. Like I said, it's not the downtime that kills you, but the forced, unpredicted downtime.

</comment></comment></comment></comment></comment><comment><USER15> I agree with the people who are disparaging Windows Server OSes as still being desktop class. Coming from a VMS/VAX background, I feel much the same towards Linux.

<comment><USER16> The biggest thing about Windows (and what I think makes it an unavoidably desktop-class environment) is that there's no kernel-level support for alternate filesystems.

The various Unix-likes have a variety of filesystems with a lot of innovation going on. Windows basically just has NTFS, which while ok for the desktop is only going to serve well for some types of servers.

<comment><USER15> Yes, hopefully somebody will work on this some day.

<http://www.microsoft.com/whdc/devtools/ifskit/default.mspx> [http://www.microsoft.com/whdc/devtools/IFSKit/ifskit_about.m...](http://www.microsoft.com/whdc/devtools/IFSKit/ifskit_about.mspx) <http://www.fs-driver.org/> <http://www.microsoft.com/whdc/DevTools/WDK/WDKpkg.mspx> <http://www.acc.umu.se/~bosse/> <http://www.osr.com/seminars.html>

<comment><USER16> Sorry, is that sarcasm? I honestly can't tell. Yes, people have implemented filesystems other than NTFS for Windows. NTFS is however the only one I personally would trust on a production server, especially for the system partition.

Linux, by contrast, has a variety of filesystems that are as stable if not more so than NTFS, and ready for production use on your root partition.

Linux probably has some catching up to do with respect to Solaris and the BSDs, but it has a good cut above desktop class filesystem support.

<comment><USER15> I was referring to your original point that Windows didn't not have kernel- level support for alternate filesystems.

Obviously I don't know your use scenarios, but I can think of 2 Linux filesystems that I'd trust to varying extents and they both begin with "ext".

That said, I use the right tool for the right job. Much of the time it's Linux, and sometimes it's Windows 2008. Thank FSM the VMS boxes are gone.Platform agnosticism is a valuable trait to have.

Professionally, I haven't had a real use for anything other than NTFS on a wide variety of Windows servers, all the way up to double-digit TBs of data. What situations have you found NTFS inadequate for your needs?

My desktop has no direct need to handle millions of database transactions and terabytes of data, but it's nice that it can with NTFS.

<comment><USER17> Why the obsession with using one or the other? Why not see that both have their appropriate uses, strengths and weaknesses?

My focus as a Sysadmin is Linux, purely by nature of the type of work I'm in, so I tend to keep up only with the benchmarks relevant to me.

If you're only seeing ext2 & 3 as mature and stable you've missed great file systems like XFS.

ext2 & 3 are great all-rounders, but XFS will knock them into a top hat when it comes to larger files, with lower CPU usage and disk ops. It'll also beat ext2 and ext3 if you're creating and deleting lots of small files (like on an e-mail server) as the delete will take place in the background without impacting the front end systems. It's nice and mature too (16 years old). ext2 & 3 have slightly better error recovery though. XFS is journalled so very little should go wrong that would impact it.

JFS has strengths when large files are moved around on it, extremely low sector overhead (less than 1%) and very low CPU usage, amongst the lowest of any of the main Linux ones.

NTFS has no knowledge of checksumming, something ZFS, ext4 and btrfs handle (the latter two I wouldn't trust yet in production environments), but it does have integrated snapshots, something you generally have to use LVM for under Linux, and native encryption, and from Vista/2003 onwards supports shrinking and expansion directly on the fly (again LVM is necessary to do this under linux, and is best done with filesystem offline).

You chose your operating system and file system to suit the task (for example I'd use OpenBSD on a gateway machine instead of Linux as it's more suited to the role).

It's such a simple concept, like how you wouldn't use a hammer to crack an egg. You could, but you might find the edge of a knife or a spoon a lot easier and neater.

</comment></comment></comment></comment></comment></comment><comment><USER18> I don't keep up on enterprise Linux stuff much but after reading this it concerns me that Linux seems to have better in-place upgrade support than most of Cisco's big iron stuff I've worked with. The 10000 series routers I presently work with only recently got support for in-place upgrades and it has a list of caveats a mile long. From a network architecture standpoint you can't always (affordably) design around downtime but at least your servers can stay up while your network is done now.

</comment><comment><USER19> Not to say it's not cool, but saying "Look how much cooler linux is because of ksplice" is kind of silly considering determina was doing this years ago for Windows.

</comment><comment><USER20> Well, that is at least one of the advantages of Common Lisp… ;)

</comment><comment><USER21> Windows has greatly improved in this regard but it's still a huge pain point. I believe that the frequency of required reboots after patches is likely a leading cause for machines remaining unpatched.

Ultimately it comes down to lack of having "no reboots" as a clear goal. SQL Server has a pretty strong goal of being able to patch a running server without rebooting and they do a good job meeting that goal. For Windows OS it comes down to programmer laziness winning over in the absence of a directive to avoid reboots.</comment>