Electrical Engineering student – When do I learn how to make stuff people want? - <AUTHOR>

I feel like I don't have much of a grip on how to design hardware and it's sad how little I know about programming, but I absolutely love entrepreneurship and creation.
Also not sure if my year round school/co-op program leads me to not have much free time to learn programming.
Can anyone lend me some sage-like advice to help me move forward on my path to learn how to make stuff people want? <comment><USER2> I am becoming of the opinion that at this point in time, given how easy it is to make new gadgets, and how many people are doing it, it's not about engineering, it's about marketing.

Take a look at this site. [https://www.chinavasion.com/china/wholesale/Electronic_Gadge...](https://www.chinavasion.com/china/wholesale/Electronic_Gadgets/) Those products are pretty cool, and there are thousands of them that you've never heard of. Having a cool product is a necessary but not sufficient condition of having a product that people want. You also have to have a marketing story that excites people. A cool product without a marketing story that excites people, will be lost in a vast sea of other products.

As people are exposed to more and more products, they're harder and harder to impress. In 2001, just having a blue LED on your product was magical, since blue LEDs were rare at that time. In 2015, you need pulsing RGBW just to be in the game. In 2006, a bluetooth speaker was a big deal. Now, it better be submersible, very loud, and run on rechargeable batteries that last over 10 hours.

You'll spend your life designing products that are obsolete ewaste two years after you release them. How many years of my life I spent designing mp3 players and ipod speakers, all of which are rubbish now.

I guess this went a bit darker than I intended. It is fun to see your stuff in stores and hear people's delight when they are interacting with something you have created. Perhaps it doesn't matter that what delights them today will bore them tomorrow. You delighted them today.

So, to answer your question, build things that delight people. Make it magical. Create an experience for the user that is not a common experience that other products can give them. Then they will want what you built.

<comment><USER3> >Having a cool product is a necessary but not sufficient condition of having a product that people want.

Make stuff that people need and want to have. It's apparently tough , unless you are not aiming making tons of money.

</comment></comment><comment><USER4> You are the 'people'. Ask youself what You want. Look around and imagine what future will be like.Make something, make anything.start is important. End is never known.

</comment><comment><USER5> I'm not sure how sage my advice is, but apparently I feel like pontificating.

Although you are as old as you have ever been, you're probably not nearly as old as you're going to get. Since you're the type of person who knows they don't know as much as they will know, use that knowledge to plan to know the things you want to know.

There's a reason Norvig recommends ten years to learn programming...he has steely eyed high standards for what it means to learn something.

</comment><comment><USER6> If you're wondering _what_ to make, then pg's essay on startup ideas seems relevant:

[http://paulgraham.com/startupideas.html](http://paulgraham.com/startupideas.html)

</comment><comment><USER7> Try learning how to sell. Sell as a job, sell your ideas to people, sell yourself by asking someone out. Practice and learn what people want.

</comment><comment><USER8> Read about things, and use things, and you will find out about what's missing from those things (and therefore what people want).

</comment><comment><USER9> I am a little unclear about your question. Are you asking how to get the kind of _real_ hardware skills that you think is missing from school? I think the much harder problem is figuring out _what_ to make, not _how_ to make it.

If the question is really about how, then I would say to just dive in. Think of your own fun project, and build the hardware/software to work with it. I think there is a lot more work involved in a good hobby project than there is even in most senior design projects in undergrad.

I recommend thinking full one full project to invest a little time/money into. Plan everything from the enclosure to the hardware and software. For example: make a dorm room security system that displays the time since the last person was in your room. Now you will know if someone snuck in while you were in class. Start with a box[1], layout[2] and order[3] a pcb. Interface with some hardware[4], and then write the software to tie it all together. If you want a little help with the soldering then you can also have seeed solder on the microcontroller for you for just a few dollars more.

Sparkfun also has some great resources if you need tips on how to layout PCBs.

Don't be surprised if you actually need a few revisions on the board before you get it working, especially on your first one. Its easy to forget something like the programming port...

Starting from scratch, doing a full buildup, and having a professional looking finished product will give you a lot of confidence.

If your question was _what_ to make then you are on your own. I have no clue.

[1] [http://serpac.com/wm031x.aspx](http://serpac.com/wm031x.aspx)

[2] [http://www.cadsoftusa.com/download- eagle/](http://www.cadsoftusa.com/download-eagle/)

[3] [http://dirtypcbs.com](http://dirtypcbs.com) or [http://www.seeedstudio.com/service/index.php?r=pcb](http://www.seeedstudio.com/service/index.php?r=pcb)

[4] [https://www.sparkfun.com/products/13285](https://www.sparkfun.com/products/13285) [https://www.sparkfun.com/products/9261](https://www.sparkfun.com/products/9261) [https://www.sparkfun.com/products/9393](https://www.sparkfun.com/products/9393) [https://www.sparkfun.com/products/11993](https://www.sparkfun.com/products/11993) and [https://www.sparkfun.com/products/9276](https://www.sparkfun.com/products/9276)

</comment><comment><USER10> You literally have to ask, and ask, and ask. Getting people to give you specific information about their needs (or feedback on your existing work) is time-consuming and frustrating, and that's one reason many people just settle into a job where they just have to please a few colleagues and a manager or two.

Also, while it's good to be capable and execution is important, don't feel that you need to be good at everything, because that often leads to biting off more than you can chew, followed by disillusion and disappointment. I've had huge struggles with this and so does any curious person - because you can easily get interested in many things and because you enjoy learning and problem-solving, you could become very very good at many different things, and soon you end up feeling that you have to be good at everything, even though this is not actually practical. It's an extra risk for technically inclined people, because dealing with technical problems is often easier than dealing with human problems, and it was your DIY tendencies that led towards studying engineering in the first place, no? So when you have to deal with people who are not wired the same way, it can get frustrating, and you have to fight against the desire to take over everything and Do It Better, (except that you can't do everything better because there's too much of it).

So two valuable skills to develop are to a) cultivate insight into why you think you could do any given thing better than you see it being done now, and b) develop your ability to communicate those insights to other people who are happy or even anxious to focus on one particular task rather than the whole ball of wax - and to radically adjust your insights and ideas in (a) because they will often turn out to be wrong or shallow.

Back at the quotidian but-what-do-i-do-today level, learn to cultivate your own taste and develop simple things that amuse you rather than looking for the thing that will allow you to make a spectacular debut. You probably don't have enough experience yet to imagine those really big things and project your imagination into all the levels of detail required. So set aside time to make simple things well. games are good for this - look at Flappy Bird, which is only a few steps above 'hello world' in game terms - it's just a simple loop featuring input, update, and collision detection, the absolute bare minimum for a real-time game. Angry Birds is just a physics library one simple game mechanism, and some very basic ideas of character animation. And so on.

Since you're an electrical engineering student, you probably know plenty about topics form hysteresis to antenna design to power supplies to lasers and so on (my wife's an EE so I know it's a broad umbrella of electives after the core engineering stuff). Think of something that you found cool but challenging, and think how could you make a game out of it that would expose the basic concept to a 6-year old, like where it basically comes down to some non-linear equation with only two variables or something. Then find a way to get that working on your phone and call it a game. Give it a silly name and add bright colors and bold patterns. Consult actual 6-year olds. One great thing about them is that they haven't fully developed their social conscience yet so if your idea is overly complex they will tell you that it is stupid. Making toys is a good way to learn about making tools, and people want both.</comment>


Apple's Steve Wozniak: 'We've lost a lot of control' - <AUTHOR> http://articles.cnn.com/2010-12-08/tech/steve.wozniak.computers_1_computer-whiz-computer-history-museum-apple-shares?_s=PM:TECH

<comment><USER2> > "All of a sudden, we've lost a lot of control," he said. "We can't turn off > our internet; we can't turn off our smartphones; we can't turn off our > computers."

How is this a loss of control? Using technology to make our lives easier or more enjoyable doesn't force you to relinquish control of your actions. If anything, it gives you greater control because you have more options and flexibility. For instance, GPS enabled phones allow me to walk or drive wherever I please without much thought, because it's so easy to get directions back.

Before my brother bought an android device, he was afraid that always having access to work email would be a big burden. What he found was the complete opposite; instead of being tied down to a computer, he now had the flexibility to move around, without being anxious about missing an important message.

In many ways, technology gives us more control of our lives, not less.

> "You used to ask a smart person a question. Now, who do you ask? It starts > with g-o, and it's not God," he quipped.

What if you don't have access to a smart person? What if this 'smart person' isn't smart? What if this smart person is manipulative? With the internet, the collective knowledge of millions of people are a mouse click away, and it's nearly impossible for any one person to control this information. How on Earth is this something to be afraid of?

He then decides to complain about Slingbox. He claims that because it has bugs, and because all software has bugs, all computers will fail. But all technology ever created by humans is faulty, so I'm not sure what's so significant about this. I'm betting Sling Box breaks less than a record player.

There's nothing insightful about this. He's just rambling about how the times are changing, without citing anything substantial.

<comment><USER3> <http://www.paulgraham.com/addiction.html>

</comment></comment><comment><USER4> "You used to ask a smart person a question. Now, who do you ask? It starts with g-o, and it's not God," he quipped.

I saw a quote once and it went something like this: "Genius in the future will not be determined by what you know but by if you can find it."

I can see part of his point about the "loss of control"...just try and take an X-Box away from a teen. It will only get worse as technology encroaches more and more but there is the flip side that some technology frees us up to do other things.

<comment><USER5> You still need to be able to understand it.

</comment></comment><comment><USER6> >>"You used to ask a smart person a question. Now, who do you ask? It starts with g-o, and it's not God," he quipped.

What he mean by this? Is he not daring to say he use google or is he trying to say Google is not God or entirely something else that I am not getting.

<comment><USER7> He's saying you used to ask an expert. Now you Google until you find an answer (I say: not necessarily the same answer..)

He doesn't want to say Google, so he's saying g-o instead. The g-o joke is an allusion to Google being similar to God in some ways (everywhere, source of infinite knowledge, etc).

<comment><USER6> Thank You.

</comment></comment></comment><comment><USER8> The source article seems to have disappeared from the original link. Does anyone have a copy of it?

<comment><USER9> [http://www.cnn.com/2010/TECH/innovation/12/08/steve.wozniak....](http://www.cnn.com/2010/TECH/innovation/12/08/steve.wozniak.computers/)</comment></comment>


IPad's privacy sucks - <AUTHOR> http://privacysucks.com/blog/2011/04/ipads-privacy-sucks/

<comment><USER2> The article's title is clearly linkbait. The gist of the article is that mobile safari is open to Evercookies. I wouldn't call the directly "sucking" at privacy.

<http://en.wikipedia.org/wiki/Evercookie>

There are ways of tracking users even in browsers that don't suffer from Evercookie. If someone _really_ wants to track you, they're going to be able to.

<comment><AUTHOR> The problem is that iPad does not clear your private information even if you insist on doing so. It is possible to prevent tracking just by using simple technics and by following general rules.

Check out this link too: [http://radar.oreilly.com/2011/04/apple-location- tracking.htm...](http://radar.oreilly.com/2011/04/apple-location- tracking.html)

<comment><USER2> Unless your simple techniques and general rules include disabling cookies, disabling javascript, disabling images, changing your IP between requests, changing your MAC between requests, and changing your User Agent between requests, you're still going to be trackable by anyone intent on doing so.

<comment><AUTHOR> Everything that you've described actually helps to track users better, because it contains a unique set of information. The simple technique is to be like everybody.</comment></comment></comment></comment>


AT&T Has Shared Data Plans in the Works - <AUTHOR> http://www.macobserver.com/tmo/article/att_has_shared_data_plans_in_the_works/ <comment><USER2> OK, good, but how much thinking really needs to go into this?

Make it simple: You can link up to 4 devices on a single data account, and you get an aggregate XX GB amongst them per month.</comment>


The Development of the C Language - <AUTHOR> http://cm.bell-labs.com/cm/cs/who/dmr/chist.html

<comment><USER2> This is a great article. Just started learning C a couple of weeks ago. The peculiarities pointed out in the article make much more sense now. It's great to read about original hackers long before there was HN.</comment>


Apple wants to reinvent keyboards, making them even thinner - <AUTHOR> http://www.appleinsider.com/articles/12/02/23/apple_wants_to_reinvent_keyboards_making_them_even_thinner.html <comment><USER2> How does a keyboard (even one fashioned from "polished meteorite") with a mere 0.2mm travel distance _not_ compromise tactile feel?</comment>


Over 80 Percent of Dark-Web Visits Relate to Pedophilia, Study Finds - <AUTHOR> http://www.wired.com/2014/12/80-percent-dark-web-visits-relate-pedophilia-study-finds/ <comment><USER2> Here's the torproject's response to this article. I think they bring up valid points about not drawing decisive conclusions based on this study.

"Tor hidden service traffic, which Dr. Gareth Owen discussed in his talk this afternooon, is only 1.5% of all Tor traffic. Tor gets about 2 million users per day total.

The researcher ran a set of Tor relays for a six month period, and recorded how many times somebody attempted to look up a hidden service (this lookup is one of the steps in visiting a hidden service). Then at the end of that period, he scanned the hidden services he'd learned about, to find out what sort of content was on them.

Dr. Owen's data shows that there's a lot of churn in hidden services, so nearly all of the sites were gone by the time he did these scans. His graphs only show data about the sites that were still up many months later: so his data could either show a lot of people visiting abuse-related hidden services, or it could simply show that abuse-related hidden services are more long-lived than others. We can't tell from the data.

Without knowing how many sites disappeared before he got around to looking at them, it's impossible to know what percentage of fetches went to abuse sites.

There are important uses for hidden services, such as when human rights activists use them to access Facebook or to blog anonymously. These uses for hidden services are new and have great potential.

PS: Law enforcement agencies use Tor to stay anonymous while they catch bad guys. Law enforcement agencies use and run hidden services, too." [https://blog.torproject.org/blog/tor-80-percent- percent-1-2-...](https://blog.torproject.org/blog/tor-80-percent- percent-1-2-percent-abusive)

<comment><USER3> I agree with promoting caution when drawing conclusions on that data. We don't know how much of that data is generated by people, by bots, or what purpose they had. For example, I would assume that any national agency whose job it is identify and catch child abuse would run web scrapers at pedophilia sites.

Wasn't there a article a while back that said around 95% of all internet traffic was imitated by computers and not humans? What would the percentage be for hidden services?

</comment></comment><comment><USER4> It's an uncomfortable truth that Tor is enabling people to engage is activities that are the result and cause of human suffering, and it's something that doesn't sit well with me. That's said, Tor is a noble project with a noble cause and these side effects aren't unique to Tor. Anything that gives people true anonymity is going to result in people using it to do things most people would find disturbing.

There's a parallel here with the "guns don't kill people" sentiment that's often brought up when people call for stricter gun controls. And here I fnd myself exhibiting some cognitive dissonance; I could say "Tor doesn't exploit and abuse children, people do" and I believe that, but I also believe that guns are inherently bad and I would like to see stricter controls. I'm not sure there's a solution to this moral puzzle and I find myself actively choosing hippocracy. I'll keep on advocating stricter gun laws whilst vehemently opposing stricter controls on the freedom of information.

So if anyone has a logical or philosophical solution to this mini moral crisis of mine, I'd really love to hear it.

<comment><USER5> Tor is designed and engineered to allow anonymity.

Handguns and semi-automatics are designed and engineered to kill humans.

If the creators intent matters, then there is a moral difference between the two.

<comment><USER6> I would actually disagree; handguns and semi-automatics are designed to be _able_ to kill humans, but that is not their _purpose_. Their purpose, like that of many other offensive technologies, is deterrence (i.e. cooperation in iterated prisoner's dilemmas).

In other words: if you know I have a gun, the weights on what strategies you will consider for selfish gain shift away from those where I would shoot you with the gun, and toward those where I wouldn't. A gun can "do its job" while never being fired once over its service life!

The game theory of guns is basically a smaller-scale replica of the game theory of nuclear weapons—except that it's actually really easy, in the modern day, to ensure a power imbalance (no non-military force has a military level of gunpower), so you don't end up in the particular nuclear Nash equilibrium of everyone having the best weapon and nobody using it (you used to, though; "mutually-assured destruction" was previously known as "a Mexican standoff.")

<comment><USER7> The problem of guns is a bit deeper than iterated prisoners dillema (or actually, more literate).

If you have a gun and I have a gun I have to take into account that you may use it. Which motivates me to preemtivly use it to prevent you from killing me. Of course you can think the same way and I can think that you can think the same way.

Either way, if we both have a gun and I want to maximize my chance of staying alive (thus, fulfilling my survivial instinct), I should shoot.

The difference between that and Nash's equilibrium is quite drastic in that: a) large scale is in play triggering empathic/humanistic thinking b) the person that is in position to use it is usually less desperate and or in personal danger, so it's more "you kill my people" than "you kill me".

So, while I understand your logic, I would argue that the purpose of developing a weapon is to enable killing someone. The purpose of developing TOR is to enable privacy and anonimity.

<comment><USER8> I'm not going to argue with the game theory, it's correct and in essence, guns create the situation where by things escalate faster, when there are conflicts. We've seen this is various popular media events over the last few years, people end up dead when they shouldn't.

What I will say is the intent of the creators is being completely misrepresented here. Guns are designed to satisfy a feeling of fear that may or may not be rational. Most guns never kill anyone and most aren't involved in any conflicts. They are made and sold to satisfy fears, their peddlers cater to those fears. This is also why ar-15 style carbines and other nearly useless weapons (you can't hunt with them, they have hardened core ammo that will penetrate all sorts of things after hitting the target.. ) are so popular, they are "more powerful" and satisfy a deeper or more broad fear. Almost nobody buys a gun with the intent to kill someone and I think that's an important distinction.

I'd argue that tor and pgp/gnupg are used in nearly identical ways for most geeks, we're afraid to not have access to them but I don't know anybody that regularly uses tor or pgp for emails and such. It is oddly isomorphic now that I think about it, if you say the purpose of a handgun is to kill a human, I wonder what percentage of their regular use for that purpose is by criminals, it has to be pretty high, much higher than non-criminal use.

<comment><USER7> I think your logic is a little bit overcomplex. I understand what you are saying - nobody wants to kill, people want to feel safe. They buy guns to feel safe, not to kill. I believe that to be true.

At the same time, guns are designed to kill, not to satisfy your need of safety.

There are many other items that work in a similar manner - airbags are designed to save you in an accident, but you want them in your car to feel safer. Burgler alarms are designed to react when someone is breaking into your house, but you install them to reduce the risk that someone will even try, contracts are designed to cover your ass in case of a court case, but they are signed in hope that it makes court case less likely etc.

But coming back to wepons, they are designed to kill. You can argue that fake guns are designed to scare attackers, but real guns are designed to kill. Their parameters, their tests, their ads, their designs, are all focus on precision of shooting, targeting, and efficency of the bullet to penetrate the target. They are designed to be a good tool for killing.

Tor is designed to be a good tool for privacy and anonimity.

You can test it using a simple mental experiment - if the needs of pedophiles and people needing anonimity diverged and became incompatible, I honestly believe that Tor would be developed to fulfill the needs of the latter group. If the need of people looking to feel safe would diverge from the efficency of a weapon in killing, then I honestly believe that the weapon manufacturers would keep designing weapons to be efficient in killing.

> but I don't know anybody that regularly uses tor or pgp for emails and such.

That's a fallacy here. You may not know people who use it, because you may, guessing here, not spend time with people who have a reason to be afraid of their governments. You may not be part of the wikileaks movement. You may not know journalists who track mafia in Italy or Russia. Those are just examples. And, because I work on multiple open source projects, I definitely know many people using PGP on daily basis.

> if you say the purpose of a handgun is to kill a human, I wonder what > percentage of their regular use for that purpose is by criminals, it has to > be pretty high, much higher than non-criminal use.

I guess you are right. :)

But I'm not sure how it relates to the topic of authors intentions.

</comment></comment></comment></comment></comment></comment><comment><USER9> As ~linksbro points out, hidden sites have a huge amount of churn. In fact, back in the days when I used to frequent the darker side of things most hacking forums would change addresses monthly/weekly/sometimes daily. A lot of various hidden sites are ad hoc communication platforms, put up and taken down as needed. And yet, even still, there is a large amount that are incredibly well hidden and require several jumps/prior knowledge to get to (i.e. not just hitting a certain url).

Ignoring all hits that went to sites dead after six months (an eternity for hidden services) is akin to the weight loss studies that throw out the data points representing people that dropped out when they didn't lose weight. Almost blatantly dishonest and shows a pretty superficial understanding of that which they are trying to study.

Beyond that there are still so many statistical fallacies and logical leaps going on in this article it's pretty astounding... for instance the author editorializes that:

>>> What they may instead show is that Tor users who seek child abuse materials use Tor much more often and visit sites much more frequently than those seeking to buy drugs or leak sensitive documents to a journalist.

Completely ignoring the possibility that these pedophilic sites are comprised of images, which could artificially increase the amount of requests (i.e. one person looking at 10 images = 10 unique hits in the study). I could go on and on here, but I think this money quote from the study principal sheds some light upon the true objectives at play:

>>> "Before we did this study, it was certainly my view that the dark net is a good thing," says Owen. "But it's hampering the rights of children and creating a place where pedophiles can act with impunity."

Edit: In my mind, the real takeaway from this article is that the FBI/Interpol seem pretty content leaving these sites up for extended periods of time while they go after the drug marketplaces, carders, and counterfeiters

</comment><comment><USER10> I don't see any slides posted, but video of the talk will be here eventually (probably by tomorrow) under the title "Tor: Hidden Services and Deanonymisation" [http://media.ccc.de/browse/congress/2014](http://media.ccc.de/browse/congress/2014)

<comment><USER11> Their streaming site seems to be having reliability issues, but seems it's still there. You can watch the raw recording at [http://streaming.media.ccc.de/relive/6112/](http://streaming.media.ccc.de/relive/6112/) already

</comment></comment><comment><USER12> The good news is that law enforcement agencies aren't completely helpless in these cases and are actively developing technology (a la Torpedo†) to infiltrate these sites and prosecute their users.

† [http://www.wired.com/2014/08/operation_torpedo/](http://www.wired.com/2014/08/operation_torpedo/)

<comment><USER13> Good news? If LE can deanonymize pedophiles with malware they can deanonymize dissidents with malware. The capability is the problem, if it wasn't, we wouldn't need Tor.

As much as people don't want it to be true, this is an all or nothing situation. Tor is secure for everyone, or no one.

You've got to crack a few eggs to make an omelet...

<comment><USER14> I'm a little wary of having a 100% bullet-proof tool given its potential for abuse. I also feel that anonymity should incur a certain cost. It shouldn't be as simple as simply firing up tor if you want to leak launch codes. It should be one step of a process (like losing a tail) rather than some magic cloak of invisibility.

<comment><USER13> There is no middle ground, though.

</comment></comment></comment></comment><comment><USER15> Wow thats truly a bit shocking , I dont think its surprising that visits to Whistleblower sites are less than 1% , if it was more we would live in an other world.

About the high percent of visits to those abuse-related hidden services , which is a horrible fact , is mostly related to the kind of service provided ...

whistleblower sites are veeery special in a way and not that many people even have any motivation to use them . All of those illegal markets get far more visits naturally but those who use them as buyers(which must be the main group of visiters )maybe only check them out like once a week ( maybe like most of us use amazon maybe even a bit less).

But now think of youtube or sex related video Sites ... they naturally get more visits from 1 user in a week than any other service ... so i think thats a huge chunk of it.

So just to get this right , i really think its disgusting and shocking how much visits these sites seem to generate, but i think its not necessary related that most user in the dark Web use these services , but maybe just more like those who use them are using them much more exessive than any other service. Also we have to mind the factors mentioned in the article like DOS attacks etc...

</comment><comment><USER16> Can we kill the phrase "dark web" somehow? It seems to be used to mean at least 4 different things, some of them vague and unspecified.

<comment><USER17> The only thing I've personally heard it refer to is Tor, Freenet, etc. What else has it been used for?

<comment><USER18> The other definitions that I've encountered are:

\- Any part of the internet which isn't indexed by search engines. By this definition, the profiles on a dating site that requires a login are part of the darkweb.

\- Any data on the internet not accessible via HTTP/FTP. Copying a file off a server via SCP then becomes a visit to the dark web.

What's most frustrating is when people jump between the definitions mid- discussion.

<comment><USER16> Yes, that.

And the people jumping between the definitions mid-sentence are doing so because they don't understand what they are talking about. And by uttering such sentences, contribute to others misunderstanding too.

</comment></comment></comment></comment><comment><USER19> The other 20 percent are probably 404 errors.

</comment><comment><USER20> >Whistleblower sites like SecureDrop and Globaleaks, which allow anonymous users to upload sensitive documents to news organizations, accounted for 5 percent of Tor hidden service sites, but less than a tenth of a percent of site visits.

The impact is not proportional to number of visits. One whistleblower has a larger positve effect than one pedo looking at child porn has a negative effect. I wonder if an 800:1 ratio can be justified though.

<comment><USER21> Really? That's a stunning claim. You're comfortable making this judgement call that whisteblowers are more positive than child rape is negative?

<comment><USER22> There is a difference between viewing and creating pedophilic pornography. Certainly, demand drives creation, but one pageview is not one child raped.

One whistleblower pageview is much more likely to be one whistle blown, which can have impact ranging from nothing to an arbitrary number of lives saved.

<comment><USER21> I'm sympathetic to your suggestion that a whistle blow _may_ have far reaching consequences. But as you suggest, it may not. It may have no impact at all. It may be wholly inconsequential. It may be a misunderstanding, a hoax.

Meanwhile, a child was abused to make kiddy porn. No equivocation there. To suggest that the aforementioned whistleblower is _always_ more positive than the kiddy porn is negative is shocking. To then try put a ratio on it seems particularly callous.

<comment><USER23> > Meanwhile, a child was abused to make kiddy porn.

Drawn pictures (e.g. manga) are absolutely considered child porn in large parts of the world (e.g. the UK).</comment></comment></comment></comment></comment>


Deep Learning – Review by LeCun, Bengio, and Hinton - <AUTHOR> http://www.nature.com/nature/journal/v521/n7553/full/nature14539.html <comment><USER2> Has LeCun changed his position on open access? He'd previously "pledged to no longer do any volunteer work, including reviewing, for non-open access publications." [1] A major part of his reasoning was, "Why should people pay $31 to read individual papers when they could get them for free if they were published by JMLR?"

I had assumed that meant he wouldn't write for them either (and thus wouldn't enlist other people to volunteer as reviewers when the final product would cost $32 to read).

[1] [https://plus.google.com/+YannLeCunPhD/posts/WStiQ38Hioy](https://plus.google.com/+YannLeCunPhD/posts/WStiQ38Hioy)

<comment><USER3> The publishers aren't the problem, and the authors aren't the problem. We the readers are the problem. Seriously. Let me explain.

I have to admit, when I saw "LeCun, Hinton, in Nature" I thought "That must be an important article, I need to read it". I haven't read every single paper by LeCun or Hinton. The Nature name affected me. That's why it's rational to publish there.

There's still no effective alternative to the journal system to identify what papers are important to read. There have been attempts, Google Scholar and Citeseer for example.

A voting system like HackerNews wouldn't work, because Geoff Hinton's vote should count for a lot more than my vote. Pagerank solved that problem for web pages (a link from Yahoo indicates more value than a link from my blog). How can scientific publication move to such a system?

<comment><USER4> > How can scientific publication move to such a system?

Complete amatuer speculation: Scientists' professional societies could create elite, free, online journals, with a limited number of articles per month (to ensure only the best are published there), openly stating that they intend these to be the new elite journals in their respective fields.

<comment><USER5> PLoS has tried to do that, with journals like PLoS Biology.

Hypothetically, AAAS is in the best position to pull something like this off, but as the publishers of Science, they're sadly very committed to preserving the status quo...

<comment><USER6> PLoS is actually a pretty nice success. It's more than an experiment at this point.

</comment></comment></comment></comment></comment><comment><USER7> $32 seems steep for one article. Does anyone know if Nature allows authors to publish on their websites? Nothing so far on Hinton's, LeCun's, or Bengio's page.

<comment><USER8> [https://www.dropbox.com/s/fmc3e4ackcf74lo/2015-lecun.pdf](https://www.dropbox.com/s/fmc3e4ackcf74lo/2015-lecun.pdf) / [http://sci-hub.org/downloads/d397/lecun2015.pdf](http://sci- hub.org/downloads/d397/lecun2015.pdf)

<comment><USER9> gwern saves the day once again.

</comment></comment></comment><comment><USER10> Hurray for science behind paywalls!

<comment><USER11> Here's a link where you can read it: [http://www.nature.com/articles/nature14539.epdf?referrer_acc...](http://www.nature.com/articles/nature14539.epdf?referrer_access_token=K4awZz78b5Yn2_AoPV_4Y9RgN0jAjWel9jnR3ZoTv0PU8PImtLRceRBJ32CtadUBVOwHuxbf2QgphMCsA6eTOw64kccq9ihWSKdxZpGPn2fn3B_8bxaYh0svGFqgRLgaiyW6CBFAb3Fpm6GbL8a_TtQQDWKuhD1XKh_wxLReRpGbR_NdccoaiKP5xvzbV-x7b_7Y64ZSpqG6kmfwS6Q1rw%3D%3D&tracking_referrer=www.nature.com)

</comment></comment><comment><USER12> There is a whole session on machine intelligence in this issue. Just curious, is there more CS-related research on Nature now than before?

<comment><AUTHOR> Nature and Science both generally have only a few CS-focused papers per year. This issue has a special theme (Machine learning and robots), so it breaks that general pattern. I regularly read Nature and Science for general science news, commentary, etc.

<comment><USER12> Thanks.

</comment></comment></comment><comment><USER3> If you only have time to read one paper on Deep Learning, read this paper.

A few quotes:

"This rather naive way of performing machine translation has quickly become competitive with the state-of-the-art, and raises serious doubts about whether understanding a sentence requires anything like the internal symbolic expressions that are manipulated by using inference rules. It is more compatible with the view that everyday reasoning involves many simultaneous analogies that each contribute plausibility to a conclusion"

"The issue of representation lies at the heart of the debate between the logic-inspired and the neural-network-inspired paradigms for cognition. In the logic-inspired paradigm, an instance of a symbol is something for which the only property is that it is either identical or non-identical to other symbol instances. It has no internal structure that is relevant to its use; and to reason with symbols, they must be bound to the variables in judiciously chosen rules of inference. By contrast, neural networks just use big activity vectors, big weight matrices and scalar non-linearities to perform the type of fast 'intuitive' inference that underpins effortless commonsense reasoning."

"Problems such as image and speech recognition require the input–output function to be insensitive to irrelevant variations of the input, such as variations in position, orientation or illumination of an object, or variations in the pitch or accent of speech, while being very sensitive to particular minute variations (for example, the difference between a white wolf and a breed of wolf-like white dog called a Samoyed). At the pixel level, images of two Samoyeds in different poses and in different environments may be very different from each other, whereas two images of a Samoyed and a wolf in the same position and on similar backgrounds may be very similar to each other. A linear classifier, or any other 'shallow' classifier operating on raw pixels could not possibly distinguish the latter two, while putting the former two in the same category.... The conventional option is to hand design good feature extractors, which requires a considerable amount of engineering skill and domain expertise. But this can all be avoided if good features can be learned automatically using a general-purpose learning procedure. This is the key advantage of deep learning."

"Deep neural networks exploit the property that many natural signals are compositional hierarchies, in which higher-level features are obtained by composing lower-level ones. In images, local combinations of edges form motifs, motifs assemble into parts, and parts form objects. Similar hierarchies exist in speech and text from sounds to phones, phonemes, syllables, words and sentences. The pooling allows representations to vary very little when elements in the previous layer vary in position and appearance"

<comment><USER13> Don't miss C Olah's blog where Figure.1 was copied from

[http://colah.github.io/](http://colah.github.io/)

Very very visually insightful on the nature of Neural Nets, Convnets, Deep Nets...

</comment></comment><comment><USER14> Nature should just use targeted advertising to make their journals free, similar to the way google/facebook make their services free using targeted ads.

<comment><USER15> I think you're overestimating the number of people that read Nature.

</comment></comment><comment><USER16> Very Helpful review.

</comment><comment><USER17> Why do these articles on RNNs and "Deep Learning" never mention Hierarchical Temporal Memory?

[https://en.wikipedia.org/wiki/Hierarchical_temporal_memory#D...](https://en.wikipedia.org/wiki/Hierarchical_temporal_memory#Deep_Learning)

<comment><USER18> It seems like theres a kind of taboo against HTM in the ML community. I guess it stems from their lack of impressive benchmarks, but I think that's kind of missing the point when it comes to HTM. Maybe HTM isn't the right solution, but I think there is a lot to be learned by using neocortex inspired models, and HTM is at least a solid step in that direction. And the work Numenta has contributed on Sparse Codings shouldn't be overlooked.

<comment><USER19> I don't think most ML people are actively hostile to HTM, just indifferent until they show some results. For example, Yann Lecun in his Reddit AMA: [http://www.reddit.com/r/MachineLearning/comments/25lnbt/ama_...](http://www.reddit.com/r/MachineLearning/comments/25lnbt/ama_yann_lecun/chisjsc)</comment></comment></comment>


Sweden's prized herd immunity is nowhere in sight - <AUTHOR> https://journals.sagepub.com/doi/full/10.1177/0141076820945282 <comment><USER2> Sweden appears to be doing fine.

[https://ourworldindata.org/grapher/daily-covid-deaths-per- mi...](https://ourworldindata.org/grapher/daily-covid-deaths-per- million-7-day- average?time=2020-03-31..latest&country=BEL~CAN~FRA~DEU~ITA~ESP~SWE~GBR)

They reached no excess mortality in June

[https://ourworldindata.org/excess-mortality- covid](https://ourworldindata.org/excess-mortality-covid)

If it's not herd immunity, what is it?</comment>


Algorithm Basics? - <AUTHOR>

To all hackers out there. I am a self taught programmer who wants to start with the very basics of algorithms and data structures. I took a look at "Introduction to Algorithms" but it came across as more academic than practical. Any suggestions? <comment><USER3> "start with the very basics of algorithms and data structures" ,"more academic than practical", "something to get my hands dirty with vs mathematical theories" etc _seems_ to me to indicate that you want to write code rather than work with proofs, runtime analysis etc.

Take it from someone who tried this path and failed. In algorithms, the long path is the shortest path.

If I were advising someone on how to go about learning algorithms today, I would ask him to first learn the basics of proofs ("The Hsskell Road to Logic Maths and Programming" by Doets and Van ejck is a good book as is Velleman's "How To Prove It"), then work through (at least) the first three chapters of Knuth et al's "Concrete Mathematics" - to get a handle on recurrences - <USER2> then tackle "Introduction to Algorithms" , probably supplemented by Skiena's "Algorithm Design Manual".

Avoiding the "academic" parts is (imho) a big mistake. As with compilers, the core of algorithms __is __"academic" and you can't avoid that (imho).

And once you get your head around proofs etc you may find this aspect a lot of fun. I certainly did.

my 2 cents. fwiw.

<comment><AUTHOR> I have an engineering degree, both undergrad and masters, so I am well versed with proofs. After all the suggestions fellow hackers have put in (including you), I am convinced to pick up "Introduction to Algorithms" and take it from there.

Thank you (all of you). Though I think this was the answer I was looking for.

</comment></comment><comment><USER4> "Introduction to Algorithms" by Cormen, et al came across as not practical? That book is personally my favorite. What are your criteria when judging a book as practical?

As someone else mentioned, you might like Sedgewick's books, but it's hard to tell without knowing what your criteria are.

<comment><AUTHOR> Hey jey, I came across that book at the local bookstore, and perused it for a while. What I meant by practical was a book that gave me something to get my hands dirty with vs mathematical theories, thats all. Maybe that was a little shortsighted, and considering a lot of the other comments suggest the very same book, I will take a look at it again. Thanks!

<comment><USER5> Algorithms _are_ mathematical theories. You're not going to be able to learn them through code alone.

There are certainly less dense introductions to the subject, but Cormen is the classic that you'll see on every good programmer's shelf (and they even read it, too!)

Edit -- "Data Structures and Algorithm Analysis" by Mark Allen Weiss is an example of a common, less-dense introductory text. It's actually not bad, given its intent.

<comment><USER6> What other books does every serious programmer need?

<comment><USER5> Are you being snarky or sincere? It's a good question, if it's an honest one.

<comment><USER6> No please. I am a slowly reforming chemical engineering student.

</comment></comment></comment></comment></comment></comment><comment><USER7> I have a grad degree in algorithms and the best book on algorithms is Cormen et all's "Introduction to Algorithms". You will be able to keep this book around forever and you won't outgrow it that easily. Definitely the best book on algos and an excellent reference.

<http://projects.csail.mit.edu/clrs/>

Google Books: [http://books.google.com/books?id=NLngYyWFl_YC&dq=&pg...](http://books.google.com/books?id=NLngYyWFl_YC&dq=&pg=PP1&ots=BvWnDC2fI7&sig=p_2EGqf4Kw-A1ukQXUhgJ6LiVN8)

</comment><comment><USER8> Take a look at this: <http://www.cs.berkeley.edu/~vazirani/algorithms.html>

<comment><AUTHOR> From the site it looks like the book is yet to be published, but its available in print...<http://tinyurl.com/2kg6to>

Though having the draft is quite nice...Thank you

<comment><USER8> _Though having the draft is quite nice_

Yes, it certainly gives you get a sense of their approach to the subject (as one of Amazon reviewers said it's not a substitute for CLRS, but a good supplement).

</comment></comment></comment><comment><USER9> Robert Sedgewick's _Algorithms_ :

<http://www.amazon.com/exec/obidos/ASIN/0201066726>

<comment><USER10> Sedgewick is good. I learned a lot from this book, which is tailored for C++ [http://www.amazon.com/Algorithms-C%2B%2B-Parts-1-4-Fundament...](http://www.amazon.com/Algorithms-C%2B%2B-Parts-1-4-Fundamentals/dp/0201350882/ref=sr_1_2/103-1426490-1539834?ie=UTF8&s=books&qid=1191341985&sr=1-2)

<comment><USER9> I'm the process of reading the _Algorithms_ book and converting some of the functions to Scheme :D

</comment></comment></comment><comment><USER11> I agree with CLRS.

It might be good to look into the mathematical side of the algorithms though, so that you know how they work inside. This way, you can manipulate the algorithms and fine tune it to something you want later on.

</comment><comment><USER12> MIT's Intro to Algorithms class lectures are a available in video: [http://ocw.mit.edu/OcwWeb/Electrical-Engineering-and- Compute...](http://ocw.mit.edu/OcwWeb/Electrical-Engineering-and-Computer- Science/6-046JFall-2005/LectureNotes/index.htm)

</comment><comment><USER13> Find a problem you want to solve, ideally in a public project with good senior maintainers... you'll learn everything you need by doing.

<comment><USER14> orph recommended being an apprentice, which is a good approach

</comment></comment><comment><USER15> I have to agree that CLRS is probably the most thorough, but as a bare introductory book to someone learning on their own (who probably is not currently in a computer science program) I would recommend Introduction to the Design and Analysis of Algorithms by Anany Levitin. Good luck!

</comment><comment><USER16> <http://en.wikipedia.org/wiki/List_of_data_structures> and <http://en.wikipedia.org/wiki/Algorithm>

</comment><comment><USER17> Go to the source "Art of Computer Programming" Get your hands dirty with MIX

<comment><USER4> I hope the parent comment is intended to be sarcastic.

If you're not familiar with _The Art of Computer Programming_ ("TAOCP"), it is an unreadable dense and heavily theoretical treatment of much of the fundamental data structures and algorithms in CS. It's definitely a classic, but I wouldn't try to learn from it if I wanted to be 'practical'. TAOCP is much worse than Intro to Algorithms in readability and practicality.

The most practical use for TAOCP is to display it prominently on your bookshelf to impress your colleagues. :P

<comment><USER18> A friend of mine is buying the full set of Knuth's books because some algorithms are only discussed here. So if you're a completist, these are for you.

<comment><USER4> I have yet to find a use for a tape sorting algorithm. ;-)

Yes, TAOCP is comprehensive and thorough. It's a useful resource, but pedantic and difficult.

</comment></comment></comment></comment><comment><USER19> How about this?

[http://www.amazon.com/Algorithm-Design-Manual-Steve- Skiena/d...](http://www.amazon.com/Algorithm-Design-Manual-Steve- Skiena/dp/0387948600)

<comment><AUTHOR> Thanks amichail. I will look into it. It does look interesting.

</comment></comment><comment><USER20> +1 for CLRS. You may run into CLR, but that's an older edition

</comment><comment><USER21> How about the Wizard book? It's not so much centered on algorithms - but about how to organize your programs.

Or is it to hard for a beginner?

</comment><comment><USER22> Anyone else annoyed at these "I'm not a programmer, no that's too hard, make me a programmer the easy way" posts?

<comment><USER8> I'm not sure the O.P. fits that profile.

Also, none of the books recommended here fall into the "Learn Blub in 21 Days" category.

<comment><USER22> Yeah you're probably right, I'm just irritable.

</comment></comment></comment><comment><USER23> You might need something one step below CLRS. Try a good CS2 book.

The only algorithms I use regularly at a boring blub coding job is quicksort and binary search. The only data structures I use are hashes, arrays, and binary trees. Other niche data structures like tries, Bloom filters, etc. are useful sometimes but 90% of the time it's a very small handful of techniques you're using.</comment>


Products funded by Juicero's VCs - <AUTHOR> https://bullshit.ist/products-funded-by-juiceros-vcs-956c43dfeb0a <comment><USER2> Satire. It wasn't obvious to me at the first sight.</comment>


Let the other 95% of Great Programmers in (2014) - <AUTHOR> http://paulgraham.com/95.html <comment><USER2> If my whole way of making money dependent on awesome bridge builders and I could only find those bridge builders in Europe, do you think I would want the government to allow those people into the country - or at least somehow give me access to them? When reading anything that has to do with immigration, keep this in mind: "follow the money".

</comment><comment><USER3> "if the qualities that make someone a great programmer are evenly distributed, 95% of great programmers are born outside the US"

When over 1B people have inadequate access to water, it is impossible for me to believe great programmers are evenly distributed. The core point of this article appears intellectually dishonest.

<comment><USER4> What about 70%? The core point still stands.</comment></comment>


MemProcFS: The Memory Process File System - <AUTHOR> https://github.com/ufrisk/MemProcFS <comment><USER2> I really don't understand forensic professionals' fascination with using Windows; it always seems like a square peg in a round hole.

<comment><USER3> It's nearly always the target system, so they have to be familiar with it.

<comment><USER2> As an embedded engineer, I have to be familiar with my target systems, but that doesn't make them good candidates for being host systems too.

</comment></comment></comment><comment><USER4> ~~So if I understand correctly, this lets you create a RAMdisk to use from within your own programs?~~

Nope, I don't understand correctly. It's too early for me.

<comment><USER5> It looks like it takes a memory dump of "physical memory" and it mounts it like a FS for you to inspect as you wish. You can just navigate through folders to find the objects you're looking for.

Interesting...

<comment><USER2> I don't think it's a dump, I think it's live, but I could be wrong.</comment></comment></comment>


Still hatin' on Git: now with added Actual Reasons - <AUTHOR> https://reprog.wordpress.com/2010/05/12/still-hatin-on-git-now-with-added-actual-reasons/ <comment><USER2> I'll save you a click: the author doesn't read the message "git status" gives during a conflicted merge ("run git add"), blames Git.</comment>


Sane Vim Plugin Management with Vundle - <AUTHOR> http://www.charlietanksley.net/philtex/sane-vim-plugin-management/

<comment><USER2> Not arguing with his main points, but updating submodules for pathogen is easier than he says.

To update submodules do (in the "main dir" of the git repo):

       git submodule foreach git pull

<comment><USER3> That assumes that all the plugins are installed via Git, right?

<comment><USER2> It updates only those plugins that are installed as git submodules yes. Most recent bundles have git repos, but if they don't

        https://github.com/vim-scripts

mirrors all plugins hosted on vim.org as clonable repos.

<comment><USER4> did not know about this... this is official awesome

</comment></comment></comment></comment><comment><USER5> I truly prefer to use git-subtree with pathogen.

1\. add a repo:

        $ git remote add remote-vim-surround https://github.com/tpope/vim-surround.git

2\. git-subtree:

        $ git subtree add --prefix=vim/bundle/vim-surround remote-vim-surround master

3\. occasional updates:

        $ git subtree pull --prefix=vim/bundle/vim-surround remote-vim-surround master

The advantage of this method is that I can keep my config directory in git, pull it onto a new machine, and not have to update any submodules. It's just all there.

</comment><comment><USER3> Interesting. I just recently started using Pathogen, and it is a _great_ improvement, but I do agree that updating plugins is still a chore.

How well does Vundle work in Windows? And how does it organize the plugins?

<comment><USER6> The plugin author discusses that here: <https://github.com/gmarik/vundle/wiki/Vundle-for-Windows>.

</comment></comment><comment><USER7> Updating your plugins (when using pathogen) is super-easy if they're stored in git somewhere.

        Dir.glob("#{ENV['HOME']}/.vimbundles/*").each do |d|
          next unless File.directory?(d)
          puts "updating #{d}"
          `cd #{d}; git pull --rebase; cd -`
        end

in ruby, would be easy enough in bash/zsh/python/perl/ as well.

see also: [https://github.com/hashrocket/dotmatrix/blob/master/bin/vimb...](https://github.com/hashrocket/dotmatrix/blob/master/bin/vimbundles.sh)

</comment><comment><USER8> It baffles me how underdeveloped the git-submodule command is. I've never enjoyed that aspect of Vim bundle management, and this looks like a refreshing alternative.

Is submodule-based package management gone for good? I'm going to wait and see.

One thing is clear: the author understands the current Vim ecosystem and knows exactly what pain points still exist. He doesn't diminish how great Pathogen is but has come up with a way to make package management seamless, and for that reason, I'm going to give this a try.

</comment><comment><USER9> I'm using pathogen with 'braid' to manage git based bundles.

For example to add the rails plugin I can do:

        braid add git://github.com/tpope/vim-rails.git bundle/vim-rails

then I can do `braid update bundle/vim-rails` to update just that or `braid update` to update all

</comment><comment><USER10> I've been using (and loving) vim-update-bundles for about 5 months now. I'm not sure how the two compare in terms of features, but the core functionality is the same.

<https://github.com/bronson/vim-update-bundles>

</comment><comment><USER11> I switched to using Vundle this morning (before seeing the article). It is an excellent way to manage VIM plugins.

</comment><comment><USER12> _...There is a growing consensus about Vim users that Pathogen is the best way to manage scripts. The idea behind pathogen is a fantastic one (to be honest, all of Tim Pope's scripts are well-thought out and executed; pathogen being no exception)..._

You can get past the "Javascript required" message by disabling CSS (e.g. Web Developer Toolbar extension).</comment>


Federal Rules of Evidence - <AUTHOR> http://www.rulesofevidence.org <comment><USER2> Why is this here? I'm not one of those people who complain about off-topic posts, I'm just genuinely perplexed as to what people find interesting about this.

<comment><USER3> How about this: [http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1469676](http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1469676) (a Bayesian interpretation of federal rule of evidence 401). More generally, the FRE and the FRCP are really amenable to the sort of system analysis that comes naturally to engineers.

[Warning: severe geekery ahead]

E.g. consider 28 U.S.C. 1446, which governs when a case filed in state court can be removed to federal court by the defendant. Not all cases are removable --the case can be heard in federal court only if federal jurisdiction exists. However, cases are removed immediately upon filing a notice of removal--if the plaintiff contests federal jurisdiction, she has to file a motion to remand in the federal court.

Why do it this way instead of having filing a motion to remove in the state court and waiting for a decision on whether the case is removable? Because it decreases the latency of the whole procedure to let things get going in federal court and figuring out after the fact whether removal was proper. Usually, removal will have been proper and no remand will be necessary. This sort of pattern should be familiar to any engineer--this is exactly what a CPU does when it predicts a taken branch, starting execution of the branch target before resolving the branch condition. It decreases the latency of the branch, and because mispredicts are rare, the CPU rarely has to flush the speculatively-executed instructions.

<comment><USER4> Wonderful metaphor.

I'm given pause by the possibility that, in the case of the federal court, the work done in the 'predicted' branch might prejudice the outcome of the branch selection in a way that's either not possible or easily preventable in the CPU case.

</comment></comment></comment><comment><USER5> It's great to see more legal materials online, but this is not well done. It does not contain dates that would allow you to determine if it is up to date, and it does not contain committee notes that help interpret the rules. See law.cornell.edu[1] for an example of a great way to make law accessible.

[1] Ex: [http://www.law.cornell.edu/rules/fre](http://www.law.cornell.edu/rules/fre)

<comment><USER6> The Cornell version seems so much better that 'dang should swap the links.

</comment></comment><comment><AUTHOR> I liked it just because it's mobile friendly. The cornell site is not. And as mentioned in other comments, cornell is super spammy now.</comment>


Cryptosphere - Encrypted P2P web application platform - <AUTHOR> https://github.com/cryptosphere/cryptosphere

<comment><USER2> I might be the square here, but for something as serious as an encrypted P2P platform that is meant to evoke trust and privacy and security, the silliness of that README is an odd match.

And I don't think that's a trivial thing, as this is meant to be a foundational product used to build secure systems, and the marketing of the product (the GitHub README) contributes to how people will see it, whether they decide to use it, and is ultimately is a part of the landscape of the development of secure, encrypted systems.

<comment><USER3> I think they're trying to say that they're at a stage that they don't want to evoke trust, they want to evoke scrutiny and perhaps play testing.

<comment><USER2> Ah, that makes sense. I'd prefer a big red box that says "Not for production use" and a clean README to be more direct, but I suppose this works.

<comment><USER4> [http://i.imgur.com/4dZq0ZI.png](http://i.imgur.com/4dZq0ZI.png)

Like that?

</comment></comment></comment></comment><comment><USER5> Their internal cryptocurrency for P2P is not far fetched. In fact, something similar has been deployed by scientists and used on small scale since 2007: [http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=666351...](http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=6663517)

Disclaimer: dev of this system

</comment><comment><USER6> There are simple and compelling reasons penned by the creator[0]. I ain't an expert in security, although the key idea of a local backend with P2P activities makes intuitive sense to secure data from eavesdropping.

Ideas from a related project[1] like de-centralization, self-management of small servers (as opposed to server farms) distributed around the globe could be leveraged in cryptosphere? Diagram explaining interactions in Elijah[2]

[0] [http://tonyarcieri.com/the-cloud-isnt-dead-it-just-needs- to-...](http://tonyarcieri.com/the-cloud-isnt-dead-it-just-needs-to-evolve)

[1] [http://elijah.cs.cmu.edu/](http://elijah.cs.cmu.edu/)

[2] [https://github.com/cmusatyalab/elijah- cloudlet/blob/master/d...](https://github.com/cmusatyalab/elijah- cloudlet/blob/master/doc/papers/satya-ieeepvc-cloudlets-2009.pdf)

</comment><comment><USER7> I think that having an internal cryptocurrency, like bitcoin would improve the system. For example it would allow me to mine some coins by sharing my 2Tb HDD for 2 months and then have a place to backup my 100Gb of data for one or two years without worrying that my node will be down and my backed up data will be deleted from the network. What do you think?

<comment><USER8> It seems to be a deliberate choice they made. See this page of their wiki: [https://github.com/cryptosphere/cryptosphere/wiki/Philosophy](https://github.com/cryptosphere/cryptosphere/wiki/Philosophy).

<comment><USER9> Hmmm.. I don't understand much of what that says. It seems that the bartering system basically means, between participants: I will store some of your data and you will store some of my data. And I will provide bandwidth for your data and vice versa. Both nodes agree to this deal. That way, nodes establish long- term relationships exchanging storage and bandwidth. Is that correct?

But, is there a way to buy/sell storage or bandwidth, without bartering? Could there be an economic incentive to run large-scale nodes providing service for buying customers?

</comment></comment></comment><comment><USER10> Sounds like an interesting idea. I don't think it is able to execute code in a p2p fashion so it's probably better to call it a web publication/storage platform

</comment><comment><USER11> Has any thought been paid to network attacks like black holes, white holes, gray holes? Attempted network partitioning with sleeper agents? Etc.

<comment><USER12> Check the code, search through the wiki and then you can create an issue. Claiming something without even knowing the facts is really convenient, isn't it?</comment></comment>


Robinhood Stored Passwords in Plaintext - <AUTHOR> Just received this email from Robinhood (https://robinhood.com/):
"When you set a password for your Robinhood account, we use an industry-standard process that prevents anyone at our company from reading it. On Monday night, we discovered that some user credentials were stored in a readable format within our internal systems. We wanted to let you know that your Robinhood password may have been included.
We resolved this issue, and after thorough review, found no evidence that this information was accessed by anyone outside of our response team. Out of an abundance of caution, we still recommend that you change your Robinhood password.
We take matters like this seriously. Earning and maintaining your trust is our top priority, and we're committed to protecting your information. Let us know if you have any questions–we're here to help.
Sincerely,
The Robinhood Team"
If you've used Robinhood in the past, it's a good idea to check your emails! <comment><USER2> This doesn't mean they were stored in a database. "a readable format within our internal systems" could be log files if they didn't scrub passwords when logging requests.

<comment><USER3> I'm not an authentication system programmer, so this may be a silly question, but why do clients still send passwords to a server? Doesn't it make more sense to hash the username and password together with some sort of nonce/salt that's sent to the server for validation?

<comment><USER4> If you hash the password on the client, then the hash essentially becomes the new password and you haven't solved anything. What you're looking for is a password authenticated key agreement in which one party authenticates to another without an eavesdropper learning any secret [1]. For whatever reason, no major websites use PAKEs today.

[1] [https://blog.cryptographyengineering.com/2018/10/19/lets- tal...](https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about- pake/)

<comment><USER5> But you have. It means even if you refuse your passwords elsewhere, only the website that was compromised is compromised.

<comment><USER6> You can (and should) store the salt server-side. Moving the hashing to the client does not solve anything.

</comment></comment></comment></comment></comment><comment><USER7> This is yet another reminder: Do Not Reuse Passwords. There's good password management even for mobile operating systems these days. I'm using Bitwarden on iOS, and it integrates well both with native apps and webpages.

Also, use two factor authentication, of course. If you are going the U2F route, I highly recommend having a permanent key for each computer and a bluetooth+NFC key for on-the-go. It's a worthwhile investment.

My biggest problem today is that it is tedious to generate and save new passwords on mobile, which is increasingly where I do so... but security always comes with some costs, I suppose.

<comment><USER8> I haven't looked into password managers for a while. What do you do if you need to login on a random machine?

<comment><USER9> Don't. You shouldn't be putting your passwords into a random machine, it may be compromised.

20 years ago when I was in high school a friend of mine bought a hardware key logger. It went inline between the keyboard and computer. He would leave it on library computers to get the firewall password and to mess with other students. You never know when a machine is compromised.

<comment><USER10> > Don't. You shouldn't be putting your passwords into a random machine, it may > be compromised.

Sure, you _shouldn 't_, but sometimes you have no other choice. The simplest case that comes to mind are the tourists who need to print boarding passes using the self-service computers in their hotel (or, even worse, at some printing shop down the street).

I would definitely change my password afterwards, though.

<comment><USER11> Just upload stuff you might need from an unsafe area from a private gitlab repo. Encrypt it if you like. Change the gitlab password when you're back (or just delete the account if you're paranoid).

</comment></comment></comment></comment></comment><comment><USER12> Similar things have happened to Facebook _and_ Google recently, the two companies that people keep repeating have the best security teams in the world. As long as humans are involved in programming - something that will likely be the case for the foreseeable future - these things will happen. But props to them for owning up about it and promptly mailing users pro-actively.

<comment><USER13> Genuine question: how would the non-involvement of humans make such issues unlikely? Doesn't the machine learning process involve trying (which, in the case of programming, would probably mean deploying to some users) what is quite certainly a combination of successful and unsuccessful things, to see what sticks?

<comment><USER12> I would assume, perhaps in error, that when such a system is created that it could be fed enough rules about what not to do that such oversights would not happen. The typical error is 'programmer debugging something will serialize a struct to a log file without realizing that there are critical fields in the struct'.

</comment></comment></comment><comment><USER14> Not surprised, considering their security practices... see [https://news.ycombinator.com/item?id=15679099](https://news.ycombinator.com/item?id=15679099)

</comment><comment><USER15> If you ever run a service, make sure you're not storing nginx logs with the contents of POST requests. A few years later you'll realize you "stored passwords in plaintext"

I assume this is what happened here, but maybe Robinhood will elaborate at some point.

</comment><comment><USER16> Isnt it so convenient that they announce this after they close their funding round.

<comment><USER17> My thoughts exactly. How the hell do financial applications not take security more seriously? I just don´t understand. It isn´t that hard to make security a top priority. It isn´t even that expensive in comparison to the price they pay for issues like these, yet it seems that time after time, fast growth and dumping shares onto new VCs or public market investors takes priority over all else...

<comment><USER18> > How the hell do financial applications not take security more seriously?

This is what taking security more seriously looks like.

The lazy company doesn't even bother to look for problems like this, never finds them, and then an attacker eventually gains access to the plaintext passwords and compromises their customers.

The shortsighted company finds the problem and fixes it silently, even though they should really notify users to change their passwords to mitigate the possibility that the plaintext passwords were already compromised.

The company that takes security more seriously does own up to it despite the PR hit.

<comment><USER19> Yeah, at least they notified customers. I found a similar issue issue at a financial services company (money lending) where I previously worked as a junior dev. A dev accidentally added a log statement to debug something that made it to production. To make matters worse, the logs were also sent off to 3rd party log aggregator that we used and all devs had access to.

The company refused to do anything. No emails sent, not even a forced password reset. The dev who made the mistake responded with "This is not a real concern. I am disappointed we spent so much time working on this." I brought it up with the CTO who essentially did nothing. Then I brought it up with CEO who came to our standup where the responsible dev than said something along the lines of "we don't serve any heads of state, so it doesn't really matter." CEO did nothing. I emailed the general counsel who told me no one else brought it up with him.

I think I gave notice 2 weeks later. The general counsel apparently left within a year (not sure if related).

</comment></comment></comment></comment><comment><USER20> The fact that they prompt you for your literal bank password when funding your account says everything you need to know about how they look at security.

<comment><USER21> That's true of nearly every app I've used that links to your bank account (mint and venmo off the top of my head). Super archaic and obtuse and I solely blame the banks for not building a better method.

<comment><USER20> ACH transfers do NOT require you to give your password to anyone, and they have been around forever.

Never give your bank password to anyone other than your bank.

<comment><USER22> But ACH transfers require you to give the information needed to print out checks against your bank account (routing number and account number).

</comment></comment></comment></comment><comment><USER23> The title is so misleading....

</comment><comment><USER24> Man, I would spend time masking sensitive data in a shop with no traffic, but someone like Robinhood or Facebook can get away with it. They don't sweat the small stuff, do they?

</comment><comment><USER25> > "we ... recommend that you change your Robinhood password"

This should really be a forced reset. Not finding evidence that it was accessed isn't proof that it wasn't.

</comment><comment><USER26> So they probably have a request logger that logs request headers, and they accidently were logging credentials from those headers is probably what happened. This has hit basically every large web service at some point. Crazy this never came up in an earlier internal security audit, but not surprising it occurred in the first place.

<comment><USER27> Filtering those parameters should be a fundamental practice.

</comment></comment><comment><USER28> I got an email this morning that my hulu had been logged into... my hulu and my robinhood did in fact share a password. I have no evidence that these are connected, but better safe than sorry. (And I do use 1password now, I just didn't back when I used robinhood and hulu).

<comment><USER29> Have you checked HaveIBeenPwned? for your email? If you shared a password between Hulu and Robinhood in your pre-lastpass days, you probably used it on yet another site that was hacked.

<comment><USER30> The problem is that it says I've been pwned, but it's completely unhelpful because it doesn't say which service(s) it was. I use different passwords for most sites (randomly generated via password manager), though a few unimportant ones share a common password.

I use Bitwarden, which has a way of checking password dumps, but only for individual passwords. I have over a hundred entries, so checking that frequently is quite time consuming.

I've decided to just switch my email on as many sites as possible using a few aliases to make put them into buckets, but there has to be an easier way...

<comment><USER31> > _The problem is that it says I 've been pwned, but it's completely unhelpful > because it doesn't say which service(s) it was_

This is the most frustrating thing about hibp. I have hundreds of passwords on hundreds of services. "we found your email in a dump" doesn't help me if I don't know which server you found it for.

</comment></comment></comment></comment><comment><USER32> "found no evidence that this information was accessed by anyone outside of our response team. Out of an abundance of caution, we still recommend that you change your Robinhood password."

That is complete bullshiting pr spin and I'm greatly concerned about my account.

Gee wiz I wonder if anyone on the response team could have done something. Or a dev with nefarious purposes like guy that rigged the lottery multiple times.

</comment><comment><USER33> Probably server logs / http request handler console log

</comment><comment><USER34> "take matters like this seriously", not really.

</comment><comment><USER35> I think it was some kind of logs. Probably request logs.

</comment><comment><USER36> It's hard to believe a financial services company would store passwords in plain text out of stupidity. Could this be a legal strategy to avoid responsibility in some scenario?

</comment><comment><USER37> thanks for the heads up. I got the same email earlier.

</comment><comment><USER38> Plaintext bank account credentials. Wow.

</comment><comment><USER39> Looks like storing in text is now a trend will do this in rest of my projects.

</comment><comment><USER40> I smell weapons grade bullshit.

>On Monday night, we discovered

Because one casually does security audits on a Monday night and then releases a "nothing has come to our attention" statement?

The one is proactive (on a monday night?) the other speaks of a response to an external actor. Which is it?

The mere fact that a release like this happened suggests some sort of legal/SEC/accounting requirement was triggered. i.e. Something happened.

<comment><USER41> I think it's plausible. As other commenters have noted, the leak was most likely in application logs. So on Monday night, SRE gets paged about random issue, pulls up the logs and starts debugging, ends up stumbling across a user's password.</comment></comment>


Ask HN: How can someone be 26% of a nationality on Ancestry.com? - <AUTHOR> How can one have a fraction of a nationality where the denominator is not a power of 2? e.g. 1/2, 1/4, 1/8, 1/16 <comment><USER2> 1/128 + 1/4 = 0.2578125 = 26% approximately

</comment><comment><USER3> you'd need 33 of 128 ancestors which is the level of the parents of your great grand parents' great grand parents</comment>


Covid-19 vs. Temperature (Not Real Science) - <AUTHOR> I was curious to see if I could find any correlation between the Coronavirus and the temperature. In this post, I explain why and how I did it. DISCLAIMER: This is very unscientific and I just hacked a script together as fast I could on a boring night in quarantine.<p>https://blog.cude.io/covid-19-temperature/ <comment><AUTHOR> Check it out here: [https://blog.cude.io/covid-19-temperature/](https://blog.cude.io/covid-19-temperature/)

</comment><comment><USER2> It would be nice to add the slope of the linear fit and the error. I guess it is something like -0.002+-0.005 or -0.002+-0.006, and it too close to the noise level to be meaningful.</comment>


MTV Cribs Is Coming Back as a Snapchat Series - <AUTHOR> http://variety.com/2016/digital/news/mtv-cribs-snapchat-1201758169/ <comment><USER2> This is really interesting. I'm old but I've recently downloaded snapchat and started messing around with it. It's a totally different kind of communication than I've ever experienced. I totally "got it" once I used it.

Very cool to see major content creators utilize the platform to create new kinds of media experiences.</comment>


F*** Facebook: Decentralize social sharing with listservs - <AUTHOR> http://sharescribe.co/

<comment><USER2> Eh, how about not.</comment>


Organizing your Email into Folders is a Waste of Time - <AUTHOR> http://blog.gaborcselle.com/2011/05/organizing-your-email-into-folders-is.html <comment><USER2> Not having my emails in folders would make it impossible to skim an email "conversation" prior to picking up after 3 months. It would be impossible to archive a project and send it to people.

Foldering has its uses. Search has its uses. I do both.

What is this current fad for telling me how I _must_ do things. I'm an individual, and I have strengths and weaknesses. My strengths don't match yours - don't make me work the way you think I ought.

And _get off my lawn!_

</comment><comment><USER3> I've got filters set up to organize in Outlook by Category, and manually flag items based on priority. I've found that cross-referencing For Follow Up flags by Category is the best way to keep emails from falling through the cracks. For everything else, there's Xobni.

I only use folders for stuff like serve emails.

For my personal mail, I'm generally happy with my options in Gmail.</comment>


What programming language should I learn? - <AUTHOR>

I know it depends upon what my goals are, but I'm a novice programmer who is simply learning HTML/CSS through CodeAcademy. I plan to move on to Ruby on Rails next so I can be proficient in web development.<p>Does anyone have recommendations for languages that are important to learn for web development? I'm thinking of an ecommerce platform currently. Also, is codeacademy something y'all would recommend, or is there something else I should take a look at? <comment><USER2> I personally don't have experience with Ruby on Rails, but it is almost universally regarded as an excellent option for web development.

If you want something more versatile (for non-web programming), I would suggest python.

If you go with python, Django is the most popular web framework. However, I find Flask much easier to get started with.

Both are excellent languages. It is tempting to spend a lot of time researching the options in the hopes of picking the "best" language. In my experience, it's better just to pick one and get down to work.

<comment><USER3> Agree. I've jumped into web development recently and was really amazed with python, Flask as a framework and Heroku as a hosting platform.

</comment></comment><comment><USER4> Rails is a good choice for your server-side code and will stay in fashion for a good while I suspect.

Don't forget that you're also going to want to know javascript for your front- end development.

I suspect node.js is going to come on strong over the next few years, but in most discussions I've been having recently, everybody I've spoken to still feels it's a bit to early to jump on that bandwagon. But if you want to get ahead of the curve, node might be the ticket.

</comment><comment><USER5> At the risk of being downvoted for suggesting PHP, I'm still going to suggest it. You're not going to be cool for learning it but now that PHP has namespaces, a built in server, composer, great frameworks and CMS like symfony2 and flow3, and ecommerce platforms like magento and OXID, there's really no limit to what you can do on the server with it. Also, it doesn't hurt your marketability that the vast majority of all webdev jobs require you know it.

<comment><USER6> I'd second PHP (plus a framework, perhaps). I suggest PHP mostly to avoid friction. If I had to start w/ setting up rails, I would probably have given up before finishing the installation.

</comment></comment><comment><USER7> Javascript or similar compile to JS languages. It has very good performance thanks to google V8, you can use it on the client side, the server side and it's a dynamic language so it's easier. It's also similar to C and Java. A strength if you want to code algorithms or learn C later.</comment>


Ask HN: What skills should I learn for backend freelancing? - <AUTHOR>

I've worked as a backend developer for two years, and I'd like to try freelancing. I'm moving soon (Philly), and I'm wondering where I might spend my time most profitably in the ~3 months before that happens. My current plan is to look for contract work with web dev agencies with a design / branding focus but perhaps limited backend expertise.
If you were hiring me, what would you look for? Are there particular topics, CS or otherwise, I should study? Is it reasonable to start freelancing so early in my career (should I be looking for a full time job?)
Any advice is very much appreciated! <comment><USER2> I think backend freelancing is harder than front end which needs some graphics design skills and HTML/css/javascript implementation. Most of the in-house systems are outsourced to contract/consultant companies instead of using freelancing due to the amount of work and time constraint.

With two years of experience, I guess it's too early unless you have intensive experience with many backend systems. Different companies may require different tool set and server stack. So it's hard to cover everything.

I've got a list of questions asked in my Kickstarter project: "How to build a website like an engineer", which may partially qualify you as a competent engineer in the job market. If you think you are over qualified to cover all the topics I provided, maybe it's a good to go. [http://kck.st/SY4CXv](http://kck.st/SY4CXv)

</comment><comment><USER3> all of them</comment>


What If Conan Said, 'Bye, NBC. Hello, Internet'? - <AUTHOR> http://bits.blogs.nytimes.com/2010/01/18/what-if-conan-said-goodbye-nbc-hello-internet/?hp

<comment><USER2> Then he'd make a tiny fraction of his current income. Isn't that why the NYT wants to go back to charging readers? I'm surprised they don't suggest he'd do the show over Twitter.

<comment><USER3> Think about most of his show, either skits written but a crew of writers, or advertising the latest blockbuster movie with some big star. He might be able to run a monologue online by himself, but I doubt he'd have the cash flow to support a prop/writing staff, or be widely viewed enough to bring on a-list celebs during their PR runs.

</comment></comment><comment><USER4> I don't think it would work. Conan is a funny guy but almost all his comedy is based on mainstream popular culture punchline. On the Internet you're dealing with an audience who has largely turned away from the mainstream spoon fed world to search out their own interests. He would have to drastically revamp his routine because, chances are, most of that mainstream spoon fed audience is going to watch whatever is on broadcast TV at 11:35. This nicely explains the success of people like Jay Leno and David Letterman who haven't delivered a new joke in the last decade that didn't involve simply updating names/places/event to fit their classic routine of pop culture humor. It's not quite the same as the silent film era stars who couldn't make it in talkies but I don't think it's entirely different either. It's just a different skill set and a big transition to make for someone who's been doing basically the same exact show every night for 15 years.

<comment><USER5> A lot of what makes comedy work in the first place is cultural capital. Shows like The Simpsons et al. make use of shared cultural experiences to be funny. I'd expect that I would miss most jokes for a long while if I went to another country, even if I spoke the language. I don't think that using cultural references diminishes Conan's humor at all.

However, if making a big transition in writing is necessary to make things work on the web, I can't imagine anyone being better suited than Conan and his team.

</comment></comment><comment><USER6> _So here's my advice to Mr. O'Brien: After he leaves NBC and spends a few months healing his wounds and pulling the troops back together, he should come back and make the Internet his time slot. He doesn't need to abandon television — there are still millions of viewers who sit around the living room and tune in at a specific time — but he could take the battle in the direction the audience is clearly migrating: online._

Isn't that exactly what most shows (Tonight Show included) do right now? Broadcast at a specific time to millions of people while offering up clips and other content online (and in many cases, the entire show, the following day)?

For example: Last week, knowing that Conan was going to draw a larger crowd than usual, Letterman uploaded clips of his monologue to their CBS branded YouTube channel before the show aired.

</comment><comment><USER7> I don't think anything so radical is required. Fox will pick up Conan and give him a show. Fox seems to have a talent for monetizing the "small but devoted audience" shows (e.g. Family Guy, Futurama, just about every Joss Whedon show ever...).

<comment><USER8> And Arrested Development. That show being cancelled made me hate Americans.

<comment><USER9> I never understood the American fascination with spending an entire decade of one's life playing the same character and saying the same jokes. After two seasons it's time to move on and do something different with your life.

<comment><USER8> Probably has something to do with getting paid more money the longer you do it and loving the people you work with.

</comment></comment></comment></comment><comment><USER10> I think comedy shows like the late-night shows and SNL are in the same situation as CDs were last decade - it's no longer enough to have one or two jokes (singles) carry the whole show (CD), because we can now acquire those individually.

If Conan went online, he could focus on doing 5-10 funny things a week, cut his budget massively, and have a total of 40-60 minutes of content each week, but have it be good stuff. Because he wouldn't be bubbled into a timeslot, he wouldn't have to "fill" with less-funny stuff.

</comment><comment><USER11> Casual fans, such as myself, would very rarely bother to look it up and watch it online, but catching a half hour or so after the news might happen a few times a week.

</comment><comment><USER12> Tom Green did this after MTV cancelled his show.

<comment><USER13> Tom Green's show is interesting and innovative, and his celebrity interviews are better than any you'll find on a TV talk show. Largely because the celebrities let their guard down in the low-rent facilities.

Conan has a couple big personal obstacles to going online. First, he'd have to lay off a lot of his staff, because an online talk show doesn't require and can't support nearly as many crew members as The Tonight Show.

Second, he'd be taking a big pay cut. If the show did well he might still have a shot at seven figures, but any TV talk show he does would probably pay him at least $15-20 million.

Third, he'd have fewer viewers, which could be a blow to both his ego and his cultural importance (that's not to suggest that either is currently out of whack).

The upside is that Conan is probably one of the best-positioned people in the world to do something like this, and he has the means and support to try it out as an experiment for a few months. At this point in his career, though, he may not be looking to make such a big change.

</comment></comment><comment><USER14> I think the author makes the fundamental mistake of assuming his experiences are normative. Just because he watches television online doesn't mean the majority of people do. It's certainly trending that way, but for now broadband penetration isn't to the point in the US to supplant broadcast TV.</comment>


Real Launches Official FB Scrabble...Outside N America only. - <AUTHOR> http://www.news.com/8301-13577_3-9912587-36.html?tag=newsmap <comment><AUTHOR> Real won the rights to produce Scrabble from Mattel, who owns the game outside North America. In yet another case of digital making physical legalities meaningless. Let's see how long this geographic shoe-horning holds, as Hasbro owns the NA rights with EA covering electronic distro. My hunch is neither will let this one go...</comment>