Mathematical Education (1990) - <AUTHOR> https://arxiv.org/abs/math/0503081 <comment><USER2> There is actually a whole field of research on mathematics education. I'm sure this 28 year old essay is nice, but probably the most up to date and comprehensive guide to evidence-based teaching of college math is this free Instructional Practices Guide from the MAA: [https://www.maa.org/programs-and- communities/curriculum%20re...](https://www.maa.org/programs-and- communities/curriculum%20resources/instructional-practices-guide)

For K-12 math education, I haven't been keeping as close an eye, but there are several books and resources, such as work by Jo Boaler: [https://www.youcubed.org/resource/books/](https://www.youcubed.org/resource/books/)

<comment><USER3> Math education research is not math research: it's education research, which is among the worst among social science, which is among the worst of all sciences in evidentiary practices. There are almost no valid RCT's in educational research by the standards of non-social science researchers. My own impression is that folks who publish on this sort of thing and not mathematics, like education and do not like mathematics per se.

I've read Boaler's stuff. I agree mostly in form with RJ Milgram's attack on her claims, which basically accuse her of statistical incompetence.

It is possible to be a great research mathematician and to be an awful mathematics teacher. It is not possible to teach great research mathematics without being a great research mathematician. I also do not believe it possible to inculcate in younger students an enduring love of mathematics without having oneself an enduring love of mathematics.

<comment><USER4> > It is not possible to teach great research mathematics without being a great > research mathematician.

I'm not sure it makes any sense to talk about "teaching research mathematics". If it's research mathematics (as in, discovering new math), it should not and cannot be done in a classroom setting.

With that in mind, it is certainly possible to be a good math teacher while being a poor or mediocre researcher. Their students are probably not be prepared for an academic math career, but they can walk away with a solid understanding of established mathematics nonetheless.

<comment><USER5> I mean, if we are talking about teaching elementary school, then you don't need to be world class researcher to get them ready for next level. You need to like math and, imo, you need to like problem solving, you need to understand math instead of having it memorize etc.

However, you definitely don't need to be actual researcher. I would even argue that it will be more beneficial to study psychology, child development, child behavior etc then spending time doing serious math research.

<comment><USER4> I'm not talking about elementary school, I'm talking about masters or bachelor's level advanced mathematics that has nonetheless been established for decades or centuries.

All I'm saying is that teaching and researching are different skill sets. One does not prepare you for the other except indirectly, nor is one a prerequisite for the other. One could just as easily say some pedagogy is required to communicate original research. It's true to an extent, but you don't need to be a excellent teacher to be an excellent researcher, or vice versa.

<comment><USER5> Boaler work is all about children, so I interpreted it in that context. I mostly agree with you.

</comment></comment></comment></comment></comment></comment><comment><USER6> This is a nice article. I teach mathematics at a community college and the last section of article resonated with me. What can we do about education of mathematics to improve it?

Years ago it dawned on me that most of the students taking a class of mine needed the class so that they could take physics. It's been a long time since I took physics and I don't really know what math problems students in physics classes have. I went to the physics department and asked for a list of types of mathematical mistakes that are common. Give me the list and I'll make sure I emphasize this in my classes. No response.

I've since learned that what my students really need to know to be successful in physics really isn't covered in course that is a prerequisite. I'm not really sure why I teach the topics I'm required to cover. They mostly are to give my students enough knowledge to take calculus and almost none of them end up taking calculus. I think things are done the way they are because it's always been done this way.

Change is slow and hard.

<comment><USER7> >>> I went to the physics department and asked for a list of types of mathematical mistakes that are common.

A couple of ideas. First, ask the students. Second, see if you can join in the grading of physics exams, as an observer.

20 years ago, I spent a semester as an adjunct, teaching electrodynamics in the electrical engineering department at a big university. The same semester, I also taught two sections of the freshman college algebra course.

I'm going to make some educated guesses here. The math that's used in physics isn't really high level, but because you're using math en route to something else, you have to be fluent enough that it's not an obstacle to understanding the physics concepts. So for me, just being able to crank through algebraic manipulation using odd symbols _and getting it right_ were important.

My EE students used a handful of basic differential equations that were actually given short shrift in the math curriculum, namely simple linear equations that are conveniently solved using complex exponentials. An example would be any kind of wave phenomena. Being able to bounce back and forth between time space and frequency space got my EE students hung up.

I agree with you about the college math topics. As I understand it, certain topics have to be covered in order to meet the accreditation requirements, which makes it hard to develop new curriculum at the lowest levels where it's the most needed.

I think that for students who aren't going to be STEM majors, I'd rather spend the same course time getting them fluent with Excel. That's how they're going to do math anyway.

</comment></comment><comment><USER8> That's _the_ Bill Thurston! He's the guy that practically invented low- dimensional topology. He sewed up the entire field of foliation theory, and showed that most knots are hyperbolic. He won the Field's Medal ... he's someone to listen to!

<comment><USER9> And I believe this is _the_ [https://en.wikipedia.org/wiki/Clifford_Stoll](https://en.wikipedia.org/wiki/Clifford_Stoll) !

<comment><USER10> HFS! I just watched the Numberphile video literally today with those two _incredible_ wire memory, oscilloscope display calculators from the 60s. What a phenomenal piece of engineering! Cliff needs his own channel. I could listen to him talk all day.

</comment></comment></comment><comment><USER9> In this context I highly recommend Lockhart's Lament: [https://www.maa.org/external_archive/devlin/LockhartsLament....](https://www.maa.org/external_archive/devlin/LockhartsLament.pdf)

<comment><USER11> I was actually expecting this when I clicked on the post. I don't think that Lockhart's criticisms are unique to mathematics, I think it's an endemic problem with the educational system.

Music is more or less taught as Lockhart describes in in the musicians nightmare. Art education isn't quite that dire, but it's close.

If you can't use a standardised test to evaluate somebody in a subject, it's of no value to the educational system.

<comment><USER9> I completely agree (though it is some years since I was at school).

Still, as Lockhart points out: _at least art and music are recognised as arts_. Surely even the ropiest music and art educations at least admit that these arts are:

      1. ends in themselves, because

      2. they are beautiful.

I believe these opinions are entirely absent from most mathematics education.

<comment><USER11> Maybe I was asleep in the class, but I think they skipped this part for English Literature.

</comment></comment></comment></comment><comment><USER12> > Mathematics education is in an unacceptable state

it's not halting?

</comment><comment><USER13> The following quote from the paper in my opinion applies to coding interview tests:

"The competitions reinforce the notion that either you 'have good math genes', or you do not. They put an emphasis on being quick, at the expense of being deep and thoughtful. They emphasize questions which are puzzles with some hidden trick, rather than more realistic problems where a systematic and persistent approach is important"

<comment><USER14> Decades ago when I was in school, East Germany's "polytechnical" 10 year elementary school they sent me to "Mathe-Olympiaden" (at least county-level math contests) and to after-school math courses because they thought I had talent. Maybe I did, but when I saw the tasks they gave us, and when I saw how the others solved it I simply stopped caring and just wasted time. We got a nice food bag with sweets and the day off school, that was good enough for me.

For example, loooong before we ever heard anything about this mathematical field, and this was way before the Internet so unless somebody tells you about something you have no chance of having heard about it as a young kid, we got a combinatorics question. Everybody in the room started writing down every single combination - which is why I knew what they were doing, neat columns and rows filling several pages that could only have been for this particular problem, and I had _almost_ started doing the same. I thought it was WAY beyond silly that I should spend my time on this problem. I knew how to solve it in this simple fashion, there was no chance to come up with the _real_ solution on the spot, so I switched to "annoyed" mode and gave up.

The after-hours math club wasn't much better, nothing deep or substantial, just some riddles.

TODAY I'd just go to Khan Academy, edX, Coursera and ignore my teachers. The Internet is great. Oh and cat pictures.</comment></comment>


Protect your Wordpress wp-config.php file against pirates - <AUTHOR> https://bunkerify.com/blog/protect-your-wordpress-wp-config-php-file-against-pirates <comment><USER2> This will do _nothing_ to improve the security of Wordpress applications. If "pirates" can read your source code, you're already screwed, either your server is very poorly configured, or there's a privilege escalation exploit somewhere and they already have root and can run any process they like. Obfuscating the source code doesn't make it any more secure, at best it's a minor inconvenience.

You can change the name of commonly targeted files like wp-login or wp-config and even leave dummies with the original names in place for script kiddies to waste their time on, but you don't need to. More effective plugins and methods to secure Wordpress exist[0], and the biggest holes are in plugins themselves.

For example:

        $url = "https://api.bunkerify.com/1.0/get/" . $lic . "/" . $domain . "/bunker_wp.php";
        $json = file_get_contents($url);
        $result = json_decode($json);

        if($result->code == 0)
        {
             eval(base64_decode($result->data));
             (...)

[0][https://medium.com/@AmDee_Elyssa/10-wordpress-tips-to- make-y...](https://medium.com/@AmDee_Elyssa/10-wordpress-tips-to-make-your- website-secure-133ffc35f27a)

</comment><comment><USER3> how does it work ?

<comment><AUTHOR> deep obfuscation, and some dark box algorithms</comment></comment>


Ask HN: Are Angel investors interested on startups selling hardware? - <AUTHOR>

I see that many Angel investors are investing in many companies, however, it seems that most of these companies sell a software services. Is there any interest from Angels for startups with new and innovative products? Most successful tech companies sell hardware (i.e. Dell, Apple, HP, etc...) <comment><USER2> i'm not an angel, but i would think that at least some would be. depends on the idea, just like software.

the problem of software vs hardware, though, is simply the fact that software will scale easier than an item that you must manufacture/produce/distribute. give someone $5k (for example) and a software company will probably be able to run further with it than a hardware company.

<comment><AUTHOR> It is a valid point. However, having a hardware product might help raise more capital for the same reasons you mentioned above. Thanks!

<comment><USER3> You're saying needing more money might help raise more money? I suppose. Hardware products are tough to bootstrap, and tough to flesh out issues with before having volume... and they don't get software margins. That said, I'm sure there's interest.. and it's probably inflated when the hardware is well understood, and maybe driven by software margins (Square comes to mind).

</comment></comment></comment><comment><USER4> How many or what class of hardware companies would angels have enough money to make a difference in? Aren't we talking a difference between investing 5-6 figures vs. 7-8?

<comment><AUTHOR> Remember, we are talking about seed stage companies, the money from an Angel will help get at least a prototype out the door... and some PR depending on the Angel.

<comment><USER4> Getting a processor/ASIC taped out and fabricated, even if you use MOSIS, it not cheap. As I understand it, the cost of the necessary seat licenses for the design and verification tools would be beyond what we think of normal (non- Space X/Tesla) angel investments, even syndicated.

So, again, I ask "what class[es] of hardware companies would angels have enough money to make a difference in"?

Or to repeat a question I've been pounding on, where will the next thing in the class of the FPGA come from? As far as I can tell, the answer for the US is that "the future isn't going to be invented here".</comment></comment></comment>


Who really gets hurt when startups blow up, and what to do about it - <AUTHOR> https://medium.com/@stuartawillson/therohnos-who-really-gets-hurt-when-startups-blow-up-and-what-to-do-about-it-2110330d7880 <comment><USER2> As an employee, I would advise positioning yourself not to be the one that gets hurt. For example, if you want to be an entrepreneur, then be one and start a company (ideally with other people's money). But if you want to be a programmer, then focus on that. Work in interesting places with interesting people. Build your career based on the work you are doing. If the work you are doing is crap, do everything in your power to move to a place where it is not crap.

The golden handcuffs are more handcuffs than gold. Ask for a reasonable wage and make sure you get it. Anything else is gravy. Understand when you join a start up that it might disappear under your feet and make sure you have a plan B. But, always, always make sure that you are building the career you want.

In startups I have seen so many people (employee #single-digit, usually) who get promoted out of the job they want to do. They hang around doing stuff they hate because, "It might be a big deal in a few years". If there is a downturn, then they are the first ones to be asked to work months (or years!) with no salary because, "I'm sure we can turn it around and they are giving me equity!"

Obviously, it's up to the person, but if I could sum up the antidote for the misery I've seen in my career: 1. Cash on the barrel head, 2. freedom to do good work, 3. interesting co-workers. As a programmer, I never ask for more (or less). (and seriously... if you miss payroll... I'll still be your friend, but I won't be working for you... sorry. See rule 1.)

<comment><USER3> Interesting co-workers is a big one. Very hard to vet before accepting a job, however. You won't know how uninteresting they are until after you start.

<comment><USER4> YES. This is impossible to gauge during an interview or even within the first week on the job. The only way to de-risk this is to have known the team members for some time prior to working with them (hence Buffer's bring-your- own-team experiment).

<comment><USER2> To some extent you can at least gauge management's attitude to hiring in the interview. Are they hiring anybody they can get? Or are they being choosy? If the latter, what is it that they are looking for? Do you feel confident that they can discriminate and find those people?

Some questions I recommend asking are: What attributes are you looking for in candidates? Have you ever hired someone and wished that you hadn't? How do you resolve that problem? What are the best attributes of the people on the team for which you are hiring? During this interview process, you are obviously trying to make sure I'm a good fit for the team. How do you normally recognize this?

The last question is quite cheeky because you can then change your behaviour to what they are looking for ;-) But the main thing you are trying to discover is: Have they thought hard about their team composition and do they understand what it is they want? Do they hire all the exact same people (good if you like that kind of thing, but potentially very boring)? Have they thought about the difficult problem of recognizing the attributes that they are looking for?

</comment></comment></comment></comment><comment><USER5> Interesting that the author mentions disclosing financial performance data but not capital structure. Many startups attempt to induce employees to trade salary (or time) for equity, without making it easy or even possible to understand the company's capital structure, i.e. how many preferred shares have been issued, what the preferences are, etc. I was recently recruited by a startup that made noise about my trading salary for equity, but had been through four institutional rounds. I wanted to know what the preferences were and what would be left for the common if the company sold tomorrow at various valuations. They brushed me off and I haven't heard from them since. If you're going to ask me to basically invest in your company by either working for less money or working longer than usual hours then you had better be prepared to disclose your capital structure. As a former founder myself, and someone who is probably older than the average startup employee, I know to ask these questions. The majority of younger colleagues whom I have discussed the issue with don't even know what I'm talking about.

<comment><USER6> I advise my friends to do the same, but often realize that like you have found, they aren't really equipped to ask the question in an effective manner even if I tell them what they need to ask.

In that light the "assume your equity is worth zero" really starts to be a good self protection mechanism.

<comment><USER5> That's the approach I take. I tell them that I will think of their equity like a bonus, and I will be happy to work hard in anticipation of getting something from it, but probably will not trade real dollars in return.

</comment></comment></comment><comment><USER7> "The real losers are the employees," fourteen paragraphs in.

O that more writers would rediscover the format of the inverted pyramid (think news stories, lead first).

Instead so many are following the format of: dump to paper the entire warm-up process. This warm-up is often necessary. It's fine to even write it in your first draft. Before publication, excise the long intro.

<comment><USER8> I'd also argue the customers are also real losers, more so than employees sometimes that often times can find another job really easy.

<comment><USER9> In the specific case of Theranos I'd agree, but almost everywhere else it's exactly the opposite. If a company's services are irreplaceable they likely wouldn't be going out of business, so going out of business means there are better alternatives.

Again Theranos is unique: The product they served may have costed customers dearly either financially or worse.

</comment></comment></comment><comment><USER10> > The real losers are the employees

It is true that employees are often at the bad end of a power imbalance - which often creates information asymmetry, among other problems - surly the "real losers" are the people who just had their test results voided.

> Who Really Gets Hurt When Startups Blow Up?

Depending on what the startup does, one of the groups that is hurt is "the users". I encourage everybody in a startup to listen to one of Jason Scott's talks[1]. He is the Angel Of Death that descends on failed internet startups with his Archive Team that tries to move as much data as possible into the Internet Archive before the servers are shut off. A lot of ordinary people can be caught in the crossfire when the businesses they trusted with their data and infrastructure are sold off as scrap.

I'm not trying to diminish the problems that employees face in the same situations. Being laid off sucks. Knowing that years of your own work will end up unfinished is terrible. Instead, I'm suggesting that the users should also be considered in that analysis.

[1] [https://www.youtube.com/watch?v=aNeE8-iVkwY](https://www.youtube.com/watch?v=aNeE8-iVkwY)

</comment><comment><USER11> Non-US businesses find it baffling that transparency is so extraordinarily low in the US. Even the smallest UK company has to publish information on fundraising and basic finances (admittedly, with quite a big lag). The same applies basically everywhere in Europe. Russia is in many ways far more transparent than the US for company data (both financials and ownership/funding).

Given the regulatory attitude to small business secrecy in the US, it's not at all surprising that companies can implode even when there is a lot of noise and publicity.

Typically the rationale for this though is to protect counterparties, not employees per se as the author suggests. (And also just that sunlight is the best disinfectant).

<comment><USER12> you're not seeing it from the other side.

in those countries, you couldn't hope to land your first client if you are a small unfunded startup with no brand-name investors or significant revenue. i.e. you have to be connected to start a business, good luck trying to bootstrap anything. i believe this is a net negative.

in the US, you can, because nobody can just click a few buttons and see you have no significant customer base or brand name investors.

<comment><USER13> How is it a net negative? Should people not have the right to know exactly what kind of company they are about to do business with? When you invest in a product or platform, do you not want to be able to evaluate whether it will be around in 3 years?

<comment><USER14> > When you invest in a product or platform, do you not want to be able to > evaluate whether it will be around in 3 years?

How do you judge based on that? Even Apple had a customer #1.

<comment><USER15> There are fundamental differences between tangible products and services - change and company shutdown. Tangible goods are sold as-is, can be evaluated as such and remain functional even in the event of company shutdown (unless its heavily backend dependent). Services, on the other hand, are expected to receive improvements (and startup services are quite often sold with future improvement roadmap) and die with the parent company, possibly with all your data.

<comment><USER12> and when google/apple/facebook buys your service and shuts your service down, where does this logic leave your customers?

these heuristics are completely invalid in today's economy. sure they sound intuitive, but they're not.

[http://ourincrediblejourney.tumblr.com/](http://ourincrediblejourney.tumblr.com/)

in fact i could make a reasonable case _that having brand name funding means you 're more likely to NOT be around in 3 years_

</comment></comment></comment></comment></comment></comment><comment><USER16> But professional investors value companies as a full-time job and still get it wrong a lot of the time. My full-time job is writing computer programs, not investment banking or venture capital. So even if I have access to this information, how can I know what to make of it? I don't know what's important, which little number might be the secret sauce or the torpedo in the engine room. And any company will choose and frame those metrics that make its future look brightest. I think this is a fundamental problem with equity as a form of compensation. As the article points out, I can only invest in one job at a time. Even if it's a good job, how do I know what the future will bring in terms of option value?

As for making me feel like an owner, an oft-cited benefit of equity, I think that's a social phenomenon and not something you can conjure up with a piece of paped. Just as putting a ping pong table in the office doesn't guarantee a laid-back culture, issuing RSUs doesn't guarantee that each employee will feel like an integral part of the mission rather than a cog in the wheel. Both come from the relationships you build up as you go along.

<comment><USER17> Feeling like an owner is not a benefit, except arguably in the very rare cases where it is true. In all other cases it is a delusion that benefits someone else. If you are getting that feeling, ask yourself if you can act like an owner.

</comment></comment><comment><USER18> According to this article it's the employees, but in the case of Theranos I would have expected the answer to be the patients who made decisions based on bad test results.

</comment><comment><USER19> Isn't this simply an issue of risk preference? Working for privately held startups is more risky than working for established businesses. Presumably employees are willing to stomach this additional risk for the presumed upsides.

Is the answer really to burden employees with even more data, or just for them to be smarter about where they choose to work?

<comment><USER20> By "burden employees with more data" I assume you mean:

"Give employees concrete information that they can use to make financial decisions."

</comment></comment><comment><USER21> > The real losers are the employees.

Why victimize the employees so much? It isn't like you go to work for the startup and when it implodes you are left with nothing and no options -- far from it, you likely made a good salary while you worked there and are likely very employable afterwards.

> They are investing their time and their careers without access to any > information.

Being that employees ARE investors (their time), they should do their due diligence, too. A company not being transparent about whatever information you need to make a good investment decision should be a reason not to work there ie as a prospective employee you should evaluate how the company shares information with its employees.

<comment><USER22> "It isn't like you go to work for the startup and when it implodes you are left with nothing and no options -- far from it, you likely made a good salary while you worked there"

Aren't startups notorious for paying crappy, below market wages?

"Being that employees ARE investors (their time), they should do their due diligence, too. A company not being transparent about whatever information you need to make a good investment decision should be a reason not to work there ie as a prospective employee you should evaluate how the company shares information with its employees."

Maybe. But given that they are required to give that information to investors who invest with money, why shouldn't they be required to give that information to investors who invest with time and effort?

<comment><USER23> They aren't legally required to provide _any_ particular set of information to an investor. (They are, though, forbidden from mis-representation and fraud).

The investors ask for it, and if management wants the investor's money, they provide it.

Employees could easily drive the same bargain.

What about periodic updates? Investors are often board members as well as shareholders. Certain amounts of disclosure may be made to the first (depends on the by laws) and must be made to the second.

On might say that the employee is working for stock, but they really aren't: stock would be taxable income with no cash with which to pay the tax. They're really working for stock options, which are not stock. Which means the employee isn't a shareholder. So they don't get the same shareholder disclosure. This is easily fixed: exercise an option for one share. You even then have "your board member" to represent you! Or course, that's probably one of the founders (common stock), so your day-to-day experience may not change much.

In my (limited) experience with founding a company, raising angel investments, restarting it with the person who would then be CEO (the old investors were made whole) and then raising equity from outside investors in multiple rounds... the biggest problem with employee disclosure is that they are financially functionally illiterate. It's a bit burden! We chose to be fully transparent (for good or bad) where the entire sales pipeline was printed and posted every Friday, together with the balance sheet and the income statement. We summarized this with a one-weekly-tick-update on a large (and maybe grim?) "days-to-death" chart. In short -- just everybody "knew the deal". Not everybody "understood the deal", but whaddyagonna do?

As the number grew lower, people would (rationally) become concerned. Sometimes (not often) I had a line outside my door from people wanting a private session to discuss "what should I do?". And although the real answer was "Leave me alone and let me work on closing this deal", I never said that! :-)

As a person being asked to work for free ("just until we get funding!"), I can't remember the last time I was refused a chance to glance over the cap table and balance sheet.

Maybe the answer is: Just ask. If they say "no", that may be all you need to know.

</comment></comment></comment><comment><USER24> There are inherent risks in startups. Those may be better manageable from an employee perspective with more disclosure. A fundamental problem with startup is that data is backward looking, extremely noisy and is not really a good predictor of what's to come. Considering the need of high level negotiations about funding often at the brink of shutting down financial disclosure at the wrong point in time can put the startup at a disadvantage.

There are also risks of misrepresentation and outright fraud. Those can't be solved with data room access but only fact finding audits from the outside and whistle blowers from the inside.

</comment><comment><USER25> I find some of the attitudes towards equity / cash salary baffling.

If you care about the "safety" of a cash salary, join a big, established company. You'll have limited upside but a more stable cash income. No risk, no reward.

If you are joining a startup, it is by definition because you want to take on risk. The reward for that risk is by far captured in the increase in the value of the equity, not the cash compensation.

It does not make sense to join a startup and not want to maximize your exposure to the upside in the form of equity.

</comment><comment><USER26> > The real losers are the employees. They are investing their time and their > careers without access to any information. Unlike a fund who may have a > portfolio of dozens or hundreds of investments, an employee can only make > one investment at a time. The cost of a mistaken investment can be > unemployment and the opportunity cost of foregone opportunities.

This right here is why I've never worked full-time at a start-up with a large percentage of total compensation coming from un-tradable private stock. I won't be someone else's dart. My current employer pays out a substantial part of compensation in RSUs, which I have set to auto-sell the day they are rewarded. It's almost the same as getting cash salary, except with some market variance (that fortunately has paid off for me so far, as the stock price has increased over time).

</comment><comment><USER27> "Startups" and "Theranos" are not the same thing.

<comment><USER26> There are plenty of other start-ups similar to Theranos that have gone bust and also caused harm to their employees. Hell, it's the way of most start-ups.

What distinction are you trying to draw here? That Theranos was particularly egregious, more so than just most start-ups simply failing to gain traction and closing for reasons of unprofitability?

</comment></comment><comment><USER28> A fair explanation of the problem. I imagine most start-ups would not easily stomach the proposed solution.

<comment><USER29> Most private companies of any kind would rather share nothing about their performance with anyone.

Heck, many private companies have terrible metrics on overall performance because they're not really required to do any bookkeeping past tax purposes.

</comment></comment><comment><USER30> Often, the founders are permitted to embezzle the last 5-10% of the capital by walk away investors. Sometimes, the founders own and profit from vendors to their venture, which dies. Sometimes, a tiny, viable business is started within the venture, whose main business plan fails. The little business survives and feeds the founder and a few cronies. Sometimes, the founder goes back to her lucrative university professorship which she was "on leave" from.

The founders never get hurt.

<comment><USER31> Often the founders have trust funds and connected families, so never have to worry a day in their lives about missing rent or going hungry.

<comment><USER32> As a current founder in a startup, these comments are hilarious.

Yea, I'm definitely a trust funder, my parents know the Kennedys, and I have at least 10 shell companies set up. /s

In reality I'm broke because I've been taking an extremely low salary for almost a year now, my parents are about as connected as a pair of sea turtles, and my rent/next meal is a daily concern.

Lot's of undeserved hate for 'founders' here it seems.</comment></comment></comment>


Notes on Go - <AUTHOR> https://brandur.org/go <comment><USER2> Good article. It seems fair and well-thought-out. I do disagree with some of his criticisms of the language, specifically:

> interfaces are always references

How does one expect a dynamic-dispatch interface to be implemented in a static language if not by reference? This is the most common case, and it's how dynamic-dispatch is implemented in every language with which I'm well acquainted.

> comparing interfaces to nil is allowed by the compiler, but apparently not a > good idea, and can lead to some strange bugs

This was strange to me at first, but when you realize that an interface is a reference, it makes sense that an interface can be nil. If you don't know that interfaces are reference types and your interface is implemented by a pointer, you might think that `if myInterfaceVar == nil` is testing the nullity of the underlying pointer when it's really testing the nullity of the interface. Because Go programmers are expected to know that interfaces are reference types (just like maps, pointers, slices, etc), it's perfectly idiomatic to test them against nil.

> channels without size are blocking

Channels are a synchronization mechanism, so it seems natural that they would block when full. What other behavior makes sense? Grow infinitely, possibly until the program runs out of memory? Write over unread values?

This isn't to say that the author isn't allowed to find these details surprising or unintuitive; only that the more "intuitive" thing isn't obviously easy and/or it might not be universally intuitive.</comment>


Android: I don't need your permission - <AUTHOR> http://blog.danlew.net/2014/11/26/i-dont-need-your-permission/ <comment><USER3> I wish it was that easy in all cases.

For VLC on Android, we need the READ_PHONE_STATE permission, in order to stop the music when a phone call is coming in. We just use it to make pause on incoming call. (VLC on Android is also an audio player, with a background audio service).

The catch is, this is not an Intent you can send or request easily. We tried so many other ways, but none work.

But on the play store it's written "read phone status and identity" and that's really really scary for the users.

And even if we're 100% open source, so people can check the application, and even people recompile VLC, this is a complaint we receive a lot...

<comment><USER4> This. This is why I am moving to iOS.

I installed Pocket. It wanted permission Contacts and Calendar. Contacts, I understand for sharing purposes. Calendar? Yeah, fuck off.

Maybe they are bundled together like "read phone status and identity" and Pocket has no way around it. Maybe it is not. As a user, I should not have to worry about that.

Contact and Calendar in no way should be bundled together.

<comment><USER5> _Maybe they are bundled together like "read phone status and identity" and Pocket has no way around it._

They aren't.

<comment><USER6> They are

<comment><USER5> No, they aren't. READ_CALENDAR is a separate permission from READ_CONTACTS.

<comment><USER7> You're correct that they are indeed separate permissions but I think when Google started putting them in buckets for displaying to the user they lumped the two together.

For instance on one address book app the website currently shows them asking for: Contacts/Calendar -read your contacts -modify your contacts

While the app on my phone says: Contacts -read your contacts -modify your contacts

According to Android Police an update earlier this month to the Play Store app appears to have separated them again: [http://www.androidpolice.com/2014/12/06/apk-teardown-play- st...](http://www.androidpolice.com/2014/12/06/apk-teardown-play- store-v5-1-11-adds-support-for-discounts-through-reward-vouchers/#changing- permission-buckets)

</comment></comment></comment></comment></comment></comment><comment><USER8> > If your app is closed-source then they have no way of verifying you're not > downloading all their contacts to their servers.

That's a common fallacy. Even if it is open source someone could still be doing that. In order to be secure you would have to:

A) Download the source yourself B) Inspect the source C) Compile the source

Just because you have the source doesn't mean what you get from the Play Store/Amazon App store is 1:1 identical or even similar.

There is secret option D, have someone you trust do A through C and then give you the hash of the resulting compiled file. But two programs compiled on two machines often give different results due to library versions, compiler versions, environmental settings, and so on.

<comment><USER9> In practice you can disassemble Java apps to pseudo source code anyway. I've done it several times to APKs to see what is going on under the covers. Deliberate obfuscation would be immediately suspicious.

<comment><USER10> 1\. How closely would you have to look to notice something like a weak crypto setup or other "accidental" change less obvious than sending everything to "all-your-bytes.nsa.gov"?

2\. How many people other than blackhats actually have the time to do this for every single automatic update?

<comment><USER11> It's actually really easy.

I tried understanding the APIs several phone apps are using, (the apps are heavily obfuscated), so I decompiled them and hacked my own small deobfuscater where I could rename stuff half-automatically.

Then I went through the code of Google Apps with this, and it's actually really nice. Although kinda surprising how many Google Apps have hardcoded API keys for their services floating around, for example there is one Google App which has a hardcoded key that allows full unthrottled API access to all of the Google Maps APIs. For free.

I just did this out of fun, as I'm mostly working on Android OpenSource apps, but it was quite easy and interesting to see how Google obfuscates their apps.

<comment><USER10> Finding predictable things like hard-coded strings is a significantly easier task than proving that none of the code is doing something sneaky. It's much easier to look for something like an access key than confirm that the numeric constants being passed to a crypto function are the correct ones or that it's not leaking something which would make it much easier to crack.

<comment><USER11> We're not talking about hardcoded strings, lol.

This is encryption and obfuscation on multiple levels, classes passing each others state through hashing and encryption schemes on multiple levels, added bytecode hackery, etc.

<comment><USER10> Exactly my point – it's unreasonable to expect that higher level of reverse engineering will be done reliably for every release of even a small percentage of the apps being published.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> > Case in point: android.permission.CALL_PHONE. You need it to initiate phone > calls from your app, right?

This kind of thing is why I can't see myself switching to Android as my primary mobile OS any time soon. If anything, I can see a bright future for Microsoft. In spite of the fact Windows Phone exists, Android is very much the Windows of the mobile ecosystem.

Permissions on Android are horrendous for developers. But they are even worse for users. If a developer can't tell the difference between ACTION_CALL and ACTION_DIAL, what chance does the average end-user have?

And when every app requests at least half a dozen permissions, how many users are going to carefully review each and every permission and how many are just going to give up and grant all requested permissions to every app the way that everyone reflexively clicks "agree" to every online ToS? Even if Android actually had a working method to deny individuals permissions, nobody ever has any idea which permissions are essential to which classes of app and which should be treated with suspicion.

Compare this to iOS, where you may occasionally get asked to grant an app access to contacts or location - this is a rare occurrence and you can choose deny every time with no negative consequences (except for restricting that functionality).

The comment by jbk illustrates just how big a mess permissions on Android are, beyond just being confusing. On top of that you've got custom intents, which while a great idea on paper, just pile more complexity on top of a broken foundation of complexity and obfuscation.

This IMO is the single biggest thing wrong with Android, which Google should prioritise fixing like Microsoft in 2002. Never mind signed-app stores like Play: the fundamentally broken security model is the reason why Android is the only mobile platform to have a problem with malware. It's also a brilliant case study in over-engineering with a complete failure to consider human psychology.

<comment><USER13> I' an Android (Cyanogenmod) user and agree with your point, this could--and should--be done a lot better.

I am not familiar with iOS and iPhones at all. You state iOS apps only rarely need to be granted permissions, how do they make that work? I can see only three ways that could happen:

Either the app can do most things without asking permissions (bad for the user --there'd be malware). Or the app simply can't ask for permission to do a lot of things (bad for the developer, and ultimately the user--because less functionality). Or it's a combination of the first combined with the iOS App Store's walled-garden quality check approach (bad for everybody, and the biggest reason I got an Android instead of iOS device).

I could be wrong but I'm guessing it's the third option?

I'm going to try to be objective here, crazy how I can just _feel_ that seed of fanboiism in my head, let me just leave it at me being idealistically opposed to the walled garden approach for reasons that have been rehashed on HN for ages now :)

 _That said,_ there's also a few practical things the iOS walled-garden App Store could improve upon. First one being the $99 developer fee. I teach kids computerstuff and one time a particularly clever 11-year old needed some help setting up Eclipse, I didn't have a smartphone myself back then, I wasn't sure what he was trying to do, so I just helped him navigate the English menus, install the proper Java things and let him at it. Sure enough, an hour later he proudly showed me his Android phone. "Hello World", it said.

Another thing, this iOS App Store review process, it's done by humans yes? Does it scale? From what I've heard, even though I mostly heard it in the form of complaints, you get rejected by _actual humans_ , yes? That's obviously never going to happen to Google's Play Store. But then again, the Google Play Store isn't quite as deeply engrained into Android as the iOS App Store, you don't _need_ to use it, you can even completely step out of Google's ecosystem and still use Android (though it's hard, a bit like using Linux 15 years ago). Does the iOS App Store also use scanners and automated tests for new applications? I bet they do, do we know what kinds? Like it could test for certain kinds of API calls so the human reviewers know what sort of thing to look for.

One funny thing is, I used to have to explain people what "repositories" are in Linux, what they do, what they're used for and why they're so much cooler than (Windows) having to download .exe installers from all sorts of websites to get your software. Nowadays I can just tell people "it's pretty much like an app store", and they know all they need to know. That Ubuntu Software Centre even _looks_ like an app store, with all the stars and ratings (blegh).

However, the repositories in Linux, are _not_ quite like either the Google Play Store _or_ iOS App Store. They obviously do not have the walled-garden approach, it's entirely open. Linux software from the repositories doesn't need to ask for permission for anything (except sudo). Still, there is no malware in the repositories, at all. I admit I am a little bit vague on how this works too, perhaps I'm missing something obvious, but how do they do that?

<comment><USER14> > I could be wrong but I'm guessing it's the third option?

Nah, it's a combination of two things:

1\. Applications are granted internet access by default. It's possible to disable _cellular_ access on a per-application basis, but not networking in general

2\. Permissions are asked for at point of use with a big allow/deny dialog. This has several consequences

* it's easier for the user to understand why the application would want to e.g. access their contacts

* the user only gets the dialog if they're accessing a feature which claims a need for it, no paying a privacy/permission cost for stuff you don't do

* the more stuff an application wants access to the more scary dialogs they'll prompt, so application developers have tended to not go overboard

Also all permissions can be revoked (or granted) afterwards, aside from cellular they all live in Settings > Privacy, and inside each permission is the list of applications which asked for it, and whether they're allowed or denied access

<comment><USER13> Thanks, that makes sense. Better option than what Android does too, IMO.

Especially if the permissions are also more granular than they are on Android. Otherwise I could imagine an evil app prompting a type of permission in the context of something completely innocuous and reasonable (say, to pre-fill contact data to some input field), only to use that very same permission immediately afterwards for something evil (sending all contacts data to their servers).

</comment></comment></comment></comment><comment><USER15> There are two additions to the permissions API that I think would be very helpful:

1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission. 2) One-time auth - allow an Android app to do something once. Say, scan your contacts one time. This gives you a little more control, so you know the dev isn't monitoring your phone at 3am.

Here is the problem though: most people don't actually care. The vocal minority cares, but most Android users don't know what a permission is if you ask them. So all that developers get for trying to work around permissions is less people using their app or less features in the app. Sadly there is no real incentive for a developer to be sparing with permissions for apps that target the mass market.

<comment><USER16> 1) Incremental Authorization - let Android apps ask for permissions only as they need them. So if you never use the phone dialing feature, they never ask for the permission.

Not only incremental authorization, but the ability of denying specific permissions.

<comment><USER15> Well with incremental the developer would put what is 'required' into the manifest for install-time prompt and incremental the rest.

You can't expect a developer to allow you to deny any permission, the whole app would be a giant if-statement spaghetti accounting for all of the permission combinations and workarounds.

<comment><USER16> As a user, I don't care if your app will self-destruct if you don't get access to permissions like "read and send SMSs". I simply don't want a free to play game to scan my SMSs for advertisement purposes.

</comment></comment></comment></comment><comment><USER17> This is the another reason I use CyanogenMod. It has Privacy Guard and I can disable the nasty permissions as I please. If you have Android 4.3+, you can also install it indivudally [https://play.google.com/store/apps/details?id=com.findsdk.ap...](https://play.google.com/store/apps/details?id=com.findsdk.apppermission) (requires root I guess)

The most helpful one, even if you are not privacy/security concerned is to disable wake up/keep awake requests, which Facebook and FB Messenger used it apporximately 6800 times since I installed my clean rom 1 week ago.

<comment><USER18> I love CyanogenMod (or at least the concept...I'm over dealing with the headache in practice), but the reason I used it was certainly not for improved stability and security.

Not that I particularly trust OEMs/carriers, but the only way I'd feel _more_ secure with CyanogenMod is if I had time to audit the source _and_ build the kernel and OS binaries myself, and that includes whatever code is used to root and unlock your device in the first place. If you do that though, more power to ya.

Also, disabling permissions at runtime is a foolproof way to make an app crash, as the _vast_ majority of apps will assume they're granted the permissions hardcoded in the manifest at compile time.

One last point - rooting your phone and granting apps root access just to disable crucial permissions such as holding a wakelock seems pretty reckless - have you personally seen the source code for that app? At least the dev's website seems legit: [http://www.findsdk.com/](http://www.findsdk.com/)

EDIT: Even better, looks like the author of App Ops, or at least the owner if the findsdk.com domain, is in China :) [https://who.is/whois/findsdk](https://who.is/whois/findsdk)

<comment><USER19> Privacy Guard does not require rooting your phone and can easily be enabled in stock ASOP Android phones:

[http://www.guidingtech.com/23409/enable-android- permissions-...](http://www.guidingtech.com/23409/enable-android-permissions- manager/)

It is really a shame that Android doesn't provide this feature enabled by default anymore (as they did for at one point). It could easily be provided with a warning that this might break your apps and use with caution.

Security often has a UX trade-off, that doesn't mean it can't be handled well by good design.

As someone who is working on a (secure) Android ROM, I don't recommend trying to build the kernel from source unless you're serious about doing it, the Android repo build system is a mess and will take you hours to get working right.

<comment><USER20> Unfortunately you do need root as of 4.4, IIRC.

</comment></comment></comment></comment><comment><USER21> This makes it all the more egregious that so many applications ask for permission to access contacts and similar.

Perhaps Android should rephrase these permissions as, for instance "direct access to contacts without your knowledge", as opposed to "access to user- selected contacts upon request" (which, as demonstrated, does not need permission).

<comment><USER22> Given that Google has gone to lengths to obfuscate the permissions further in Play, i don't think that is likely to ever happen...

</comment></comment><comment><USER23> I would be very happy if instead of preventing me from installing apps which require a given permission, Android would let me install them at my own risk in a sandbox which provides the app with dummy data and interactions (whether from a sensor, contacts db, camera etc).

It would be even better if the framework explicitly supported running apps without the necessary permissions and simply threw some sort of PermissionException. This would cripple some functionality while preserving the rest.

Developers could of course write the apps to not work under such reduced conditions, but Google Play could reject such apps.

<comment><USER24> This sounds like a great way for paranoid but uninformed users to break lots of apps, and then blame the developer/phone/carrier (in any random order).

We sometimes forget that really with smartphones the manufacturers are trying to produce something for the masses. This would also seem to include reducing the amount of security consciousness the user needs to have in order to have an "acceptable" experience with the device.

<comment><USER25> And yet, the iPhone basically does this for a number of permissions (location, push notifications, contacts access, etc.), and for the most part it seems to work for even uneducated users of iOS.

For most permissions, you might not want this, but for some of the more sensitive and personal-information rich sources, this is a really highly desirable feature.

</comment></comment></comment><comment><USER26> I made app ethics[1] a while back in hopes to surface what some of the android permissions mean.

[1] [http://appethics.org](http://appethics.org)

</comment><comment><USER27> Crazy theory but stick with me please -

Why aren't we as users allowed to fine grain the data on our device that we want the app to have access to?

A benign example would be a camera app; it wants access to my camera and mic, perhaps the local storage. It may have further features to store images in it's cloud service, assign the image to a contact and so forth.

But as a user I only want the app for it's picture taking ability - the app requests at the point of installation the permissions it requires, and I only grant it access to the camera.

It's then down to the app / developer to handle the exceptions and offer a message saying "You have taken a picture, but the app doesn't have permission to save it to storage. Please allow access by clicking here, otherwise this feature will not work/be unavailable".

A bit more of effort on the developers part, no question - but a user than has complete control over what an app can access.

I'm not an app developer, but skimming over how intents work and chiming along with this article - I don't think it would be a significant change to the underlying structure of android to hand back specific permission controls to a user.

<comment><USER28> I guess the app would have to handle not being allowed permission to do these things gracefully.

That's possibly a tall order based on my experience with apps these days, although for a difference reason: a lot of them assume there's internet connectivity, which isn't always the case, and a lot of apps don't handle this gracefully at all, even for doing things like opening maps, finding location, turning data off, going to another app, then back to maps again, and it takes ages for it to display because it's expecting to have network access.

</comment></comment><comment><USER22> Best i can tell, quite a few requested permissions do not come from the developer. Instead it is the defaults of some framework or other the developer used to handle some of the nitty gritty details, like the ads.

<comment><USER29> Another angle being missed is that Android won't auto-update apps if they have new permissions (modulo some minor details). The developers I worked with always added more permissions to their initial app versions for things they weren't using, but might in the future.

<comment><USER22> That is a Play thing, not a Android thing, iirc.

Still, with the latest change in permissions handling in Play, it will happily auto-update an app if the new permission(s) are in the same category as a previous one...

</comment></comment></comment><comment><USER30> Another reminder of how eagerly I await Xposed / Xprivacy on ART for 5.0... that said, his examples are fairly benign, I agree that if your app needs to initiate a call, it should show me the dialer to see if I would like to do that now, or some other time (including never).

<comment><USER31> If you're just waiting for permission controls, App Ops [1] should work just fine on 5.0. There are other comparable apps that also don't require Xposed.

[1] [https://play.google.com/store/apps/details?id=com.findsdk.ap...](https://play.google.com/store/apps/details?id=com.findsdk.apppermission)

</comment></comment><comment><USER32> In the case of bluetooth, you can either (1) request BLUETOOTH_ADMIN permission and enable BT yourself, or (2) ask Android to show an "Enable Bluetooth Dialog" (BluetoothAdapter.ACTION_REQUEST_ENABLE) which doesn't require that permission.

But #2 has been busted for a while [https://code.google.com/p/android/issues/detail?id=60002](https://code.google.com/p/android/issues/detail?id=60002)

They didn't fix it, and marked it obsolete. So I guess we need BLUETOOTH_ADMIN after all.

</comment><comment><USER33> Good article. As good as Google's permission system is, it lacks obvious features. Maybe I'm missing something, but I think that Android permission are overly general and not specific enough in a majority of apps.

<comment><USER34> As good as it is? I find it pretty terrible, at least for me it singlehandedly makes me not want to use Android.

</comment></comment><comment><USER35> This is interesting because it's essentially the same security model as the web.

Your app runs in a controlled environment, and it has the option to nest another app (on the web, in an iframe) which it can send messages to, but can't affect the code _or UI_ of.

The fact that the UI cannot be manipulated by the nesting app, is crucial, since it allows the security model to tie certain user actions, like pressing dial, to certain actions, like making a phone call.

</comment><comment><USER36> I think all apps should be given a choice to have ephimeral permission. For example I dont want someone to find an exploit in my app and steal my user's contacts.

I would only take contacts permission when I need and keep it for a short duration and then willingly give it up. User can be explicitly prompted.

Also, Camera and Microphones should have only this sort of permissions other than for those which are explictily whitelisted by Google.

</comment><comment><USER37> In the example about the phone call, you could give the user the option to hit the call button, but once this is complete a dialog should popup saying, "Do you want this to happen automagically henceforth?" which would then take full use of the Phone permission. This would also allow permissions to be toggled on/off, which a feature I really want in Android.

</comment><comment><USER38> Just curious though for these specific examples as it says "if you read the source", could these intent's change in future releases, or is it documented outside of the source and accepted that using these intents is not relying on Android internals that could change?

</comment><comment><USER39> This is why I love xprivacy. It gives me a popup when an app tries to access something, and I can whitelist or blacklist it, either on a temporary or permanent basis. Unlike google's halfarsed attempt at a privacy layer, it also doesn't give an exception when an app tries to access restricted data as that can cause apps to crash; it just sends back fake data (device ID is DEFACE, contacts are empty, location is christmas island, etc.). It also covers just about every permission you can think of, unlike app ops/privacy guard that are just a few.

Although really, what needs to change isn't just in android itself; it's also developer behaviour. Stop _trying_ to do intrusive things like prefilling forms, as it doesn't benefit the user in any real way.

<comment><USER40> > Stop trying to do intrusive things like prefilling forms, as it doesn't > benefit the user in any real way.

Speak for yourself -- I find prefilled forms to be a time-saver.

However, I don't want apps trying to read through my contacts in order to do it. What I want (but haven't actually configured) is xprivacy configured to make contacts appear empty.

<comment><USER39> When an app tries to read your contacts, it gives a popup showing contacts as the item accessed; uncheck 'once' and click deny.

</comment></comment></comment><comment><USER41> This is classic privilege elevation via a 3rd party privileged process. I thought Android's permission system carrying the security context from app to app through Intent. Guess the assumption is wrong.

In most OS, the security token/context of the initiating process is carried over to the target process when it's asked to do something on behalf of the initiating process via IPC so that the target process runs at the privilege level of the initiating process even if the target process has a higher privilege to start with.

</comment><comment><USER42> The same goes for android.permission.INTERNET. Apps can open arbitrary URLs in the browser (which load without user intervention).

<comment><USER43> However that's not the only use case for android.permission.INTERNET - <USER2> need it for anything that does networking on the internet, such as API calls to your web application.

<comment> lucas-be So the entire computer world had run like this for decade. why are people complaining about that now? Because Apple is doing strict verification of your code behaviour?

Yesterday adobe pdf viewer tell me that an update was available both on my mac and pc! So without asking my permission, this computer application (and many others) are querying the web...

<comment><USER44> The PCs didn't sit in your pocket all data with sensing GPS location, mic, camera, footsteps, discovery of bluetooth and wifi devices around you; neither were they single point of communication with the rest of the world.

<comment> lucas-be Not as long as you have not synchronized your phone with a cloud service (ICloud, Google drive, etc.) on which your PC/MAC is connect too.

</comment></comment></comment></comment></comment><comment><USER45> The theory seems great. The reality is not.

When you do that, you delegate your UX and proper functionning of your app to a third-party app.

The UX can vary according the app. One thing is certain, it won't always be consistent with your app. It is also going to be more complicated for the user (more actions to make, more choices, just because you don't want to add permissions).

The proper functionning is even worse. Did you ever heard about the fragmentation of Android? Well, Intents are where it's worse. Some apps plainly don't work, or are buggy.

Intents are great to save time prototyping something. However, if a feature is central to your app, you are better off ensuring yourself that it works well and is easy to use, something that Intents can't guarantee.

Of course, the permission system is far from ideal, and some people will not install your app because you ask for some permissions. I'd say that's a price to pay for developping on Android.

P.S.: some examples of Intents that don't work so well:

1) sending a mail. Good luck finding how to properly use an Intent that is not handled by text apps and allow you to put attachments

2) picking a photo from gallery and resize. A lot of photo apps are plain broken for that Intent. And I'm not talking about some obscure device on a rooted Android, I'm talking about Google's Nexus, with stock apps.

<comment><USER46> Thinking like this is what led to so many terrible '90s windows apps eschewing the Common Dialog box for file management.

We all eventually accepted that you should let the OS do its native thing. Android is no different.

</comment></comment><comment><USER47> I recently got a Moto E as my first smart phone, ever, and after checking out some apps, I was astounded and befuddled by the access permissions that it seems every app needs.

Take ESPN's fantasy football app, which requires: device and app history - whats apps are running, browsing history, bookmarks identity - accounts on the device, profile data photo/media/files - access to files on the device and the device's external storage wi-fi connection information - whether wi-fi is enabled, names of connected wi-fi devices device ID and call information - determine the phone number and device IDs, whether a call is active, and the remote number connected by a call

I can understand why it might need access to the file system to, for example, upload an avatar. The access to wi-fi seems innocuous, although I would expect something like network connectivity and status to be delegated to a kernel module or background daemon with which an app interfaces.

But is there any legitimate (i.e. some non-financial oriented mine as much data as possible) reason it needs to be able to see what other apps are running, my browser history or who is on the other end of a call? There might not be any reason, and ESPN could potentially build the app to have as many or as few permissions as they deem valuable, because people want an app to manage fantasy football teams first. While this example might not be the best, since ESPN is a huge brand and there is no alternative if they are hosting your league, the situation was the same with so many other apps; just absurd permission requirements.

None were installed.</comment>


San Francisco – where drug addicts outnumber high school students - <AUTHOR> https://www.sfchronicle.com/bayarea/philmatier/article/San-Francisco-where-street-addicts-outnumber-13571702.php <comment><USER2> With rents the way they are, where do all these 25K people live?

Market and 5th for example is this very specific hot spot of crazy folks, the man in the back of the subway sandwiches talking to himself, the jack-in-the- box I dare not enter ... but where do they all come from given the environs are so crazy expensive?

I'm surprised this activity hasn't coalesced somewhere in on the peninsula or south bay, or even out in sunset.

<comment><USER3> There is such a thing as a functional heroin addict [https://www.cnn.com/2018/02/27/health/functioning-heroin- add...](https://www.cnn.com/2018/02/27/health/functioning-heroin- addicts/index.html)

For the ones that can no longer function, they can't get to or around the suburbs without a car so they become the urban homeless.

</comment></comment><comment><USER3> The other side of the comparison is that SF has fewer families than other major cities.

[https://www.huffingtonpost.com/2012/03/09/families-flee- san-...](https://www.huffingtonpost.com/2012/03/09/families-flee-san- francisco_n_1335639.html)

</comment><comment><USER4> [https://news.ycombinator.com/item?id=19055734](https://news.ycombinator.com/item?id=19055734)</comment>


Idea Inclusion and Team Thinking for Scale - <AUTHOR> https://medium.com/@stevemoffatt/idea-inclusion-team-thinking-for-scale-3cf55b43854c <comment><AUTHOR> How often is it that we dismiss the uniqueness of a problem, over-simplify and jump to actions, only to be found out later that we acted incorrectly? When you are moving fast this can be the default, but it doesn't have to be.

Last week I talked about starting with scale in mind to ensure that when we do achieve product<>market fit, there is a path to scale instead of toiling for incremental gains. This week I shift focus to a theme of inclusiveness for ideas and rewards that encourages talent to compete as a unit, not as individuals, towards a common external purpose.</comment>


Beware of MBAs - <AUTHOR> http://humbledmba.com/beware-of-mbas-the-business-school-curriculum <comment><USER2> The original discussion: [https://news.ycombinator.com/item?id=1402475](https://news.ycombinator.com/item?id=1402475)</comment>


Feud Over Netflix Traffic Leads to Video Slowdown - <AUTHOR> http://wsj.com/news/articles/SB10001424052702304899704579391223249896550?mg=reno64-wsj&url=http%3A%2F%2Fonline.wsj.com%2Farticle%2FSB10001424052702304899704579391223249896550.html <comment><USER2> Better title: "VZW continue to be complete dickbags who've forgotten that their customers are the people paying to get bits from Netflix"</comment>


Recovering Fossil Data on IBM 8" Floppies [video] - <AUTHOR> https://www.youtube.com/watch?v=5FVwheTVWko <comment><USER2> I retrieved my files off of old PDP-11 8" floppies by contacting a friend of mine at cheshireeng.com who had an old 11 in a closet. He didn't know if it still worked, but it did (yay for DEC quality!), and was able to transfer the disk contents out via serial line. He was able to retrieve files and images from all my disks, didn't lose a bit (yay for DEC floppy quality!). This was after 30 years of sitting in a box.

Anyhow, I was able to retrieve my original 11 version of Empire this way:

[https://github.com/DigitalMars/Empire-for- PDP-11](https://github.com/DigitalMars/Empire-for-PDP-11)

DEC made good machines. Not one of my machines from the 80s or 90s would power up, though I stored them in working condition in warm and dry places. But the 30 year old DEC worked great.

<comment><USER3> The typical thing that goes wrong with computers from the 80's and 90's is the electrolytic capacitors dry out and go bad. This got even worse with the "capacitor plague" of the late 90's/2000's.

I would guess the PDP-11 has fewer capacitors or of a different design.

<comment><USER4> Higher quality caps

<comment><USER2> My vintage 1981 Carver amp still runs all day every day.

</comment></comment></comment></comment><comment><USER5> I love his videos he has a webpage with merch if you want to support him [https://www.curiousmarc.com/](https://www.curiousmarc.com/)

If you are new to his channel I cannot recommend enough the Apollo AGC videos [https://www.youtube.com/watch?v=2KSahAoOLdU&list=PL-_93BVApb...](https://www.youtube.com/watch?v=2KSahAoOLdU&list=PL-_93BVApb59FWrLZfdlisi_x7-Ut_-w7)

</comment><comment><USER6> Somewhat related, I have a couple of tapes from the 80s that contained software for the ZX Spectrum (mostly my first attempts at writing code). They were written in a custom format by a custom device I no longer have, and of which I have very little information (I managed to track down one of the engineers who designed the thing some 30 years ago).

I have raw audio files of these tapes. I have managed to convert some other tapes in standard ZX Spectrum format to readable files I can load in an emulator. However, for the special tapes, there's no tooling available - all I have is a waveform.

If I had an array of bits, I could start trying to figure out the format of this thing. However, I have no idea how to go from a raw waveform to the zeros and ones it encodes. My best idea so far is to write a small program that looks for zero crossings, and depending on the timing output zeros or ones, but I suspect there might exist some software that does this already? I have next to no knowledge of signal processing.

Any suggestions on how to go about this?

<comment><USER7> I'd recommend asking people at [https://www.worldofspectrum.org/forums/](https://www.worldofspectrum.org/forums/). This forum has been around since the 90s (iirc). I'd expect the kind of detailed knowledge you're after to be present there.

<comment><USER8> Interesting Q uestion you posed in your deleted comment. Unlikely to get traction in this forum, but interesting nonetheless.

<comment><USER9> Now I'm curious.

</comment></comment></comment></comment><comment><USER10> They should try Dave Dunfield's ImageDisk:

[http://www.classiccmp.org/dunfield/img/index.htm](http://www.classiccmp.org/dunfield/img/index.htm)

This is used by bitsavers to preserve old data from 8 inch floppy disks. I was able to write an emulator for a Motorola 6800 "Exorciser" that could boot disks saved this way.

<comment><USER11> I don't think it handles IBM formatted disks. You can use it with you have an FDC that does some handling for you. Problem is that those disks are practically 'punchcards-on-disk' for mainframes, not PC-based at all. Oddly enough, it does know about paper tape.

Then again, OmniDisk can't autodetect it initially either, so perhaps the whole concept of reading mainframe formatted disks and mainframe encoded data on a non-mainframe system was rather problematic anyway.

<comment><USER10> It does, IBM format is the most basic floppy standard (same for ASCII and EBCDIC). I watched the video again- they did use ImageDisk for the bulk of the transfer- you can see it flashed a few times (13:46 is one point). It's the mostly blue screen with the red bar on the top.

</comment></comment></comment><comment><USER12> Part 1 for a more detailed introduction to the situation: [https://www.youtube.com/watch?v=MPOYHQTMnf8](https://www.youtube.com/watch?v=MPOYHQTMnf8)

</comment><comment><USER13> If you haven't seen this already, CuriousMarc has also done this awesome series on the restoration of an original AGC - Apollo Guidance Computer last year.

[https://www.youtube.com/watch?v=2KSahAoOLdU&list=PL-_93BVApb...](https://www.youtube.com/watch?v=2KSahAoOLdU&list=PL-_93BVApb59FWrLZfdlisi_x7-Ut_-w7)

And then there are real treats such as the restoration of a Teletype 33 ASR:

[https://www.youtube.com/watch?v=QzfjT1mCRww&list=PL-_93BVApb...](https://www.youtube.com/watch?v=QzfjT1mCRww&list=PL-_93BVApb5-84G5kmgfuu7TQduTMc73H)

Or them trying to get Fortran to compile on an IBM 1401 Mainframe dated 1959. [https://www.youtube.com/watch?v=uFQ3sajIdaM](https://www.youtube.com/watch?v=uFQ3sajIdaM)

</comment><comment><USER14> This skewers the notion that old programmers were honed and refined by their resource constraints. Whoever wrote these files was using a slow, expensive physical format and wasting virtually all of it on padding.

<comment><USER15> All data was typed in by hand, and the entire dataset fit into a few boxes. Resources were never an issue, so why optimize for them?

<comment><USER14> I think there's a practical difference between a folder full of data and a wheelbarrow full of data.

</comment></comment></comment><comment><USER16> About six years ago I found several 8" floppies for the 1970s Ohio Scientific system. These had been in storage since the late 1980s and contained games and utilities. One disk label was dated 1/31/1979.

I sent them to the author of the OSI emulator and I believe all but one of them were fully readable and dumped for emulation.

[http://osi.marks-lab.com/](http://osi.marks-lab.com/)</comment>