Donald Trump Blocking Accounts on Twitter 'violates US Constitution' - <AUTHOR> http://www.independent.co.uk/news/world/americas/donald-trump-twitter-blocking-accounts-users-violates-us-constitution-columbia-university-knight-a7776486.html <comment><USER2> One thing to note here is that this isn't an out-of-the-blue abstract argument, but applies reasoning in recent cases addressing government officials use of social media outlets and the First Amendment. Obviously, Trump is higher profile than any of the officials in previous cases, but this is a potentially significant, developing area of law in the intersection of government and technology that reaches more than just Trump's Twitter account.

Original letter (with citations to legal precedent): [https://www.documentcloud.org/documents/3859469-White- House-...](https://www.documentcloud.org/documents/3859469-White-House- Twitter-Letter-FINAL.html)

Original Knight Institute release: [https://knightcolumbia.org/news/knight- institute-demands-pre...](https://knightcolumbia.org/news/knight-institute- demands-president-unblock-critics-twitter)

Additional legal analysis on the issue (written before and independently of the Knight Institute letter, but updated in light of it): [http://www.litigationandtrial.com/2017/06/articles/attorney/...](http://www.litigationandtrial.com/2017/06/articles/attorney/free- speech-and-trump-tweets/)

</comment><comment><USER3> I don't use twitter can anyone explain this? When the article says he blocked users, that just means he blocked them from writing on his page? Those people are still free to create their own tweets on their page, correct?

I don't see how that violates free speech. Using the article's "town hall" metaphor, if he asked to have someone removed from the town hall meeting aren't they still free to protest outside on the street corner? If someone is disturbing a town hall meeting (which is entirely subjective), they can be removed, which doesn't violate their free speech.

If he goes around & starts forcing Twitter to ban anyone who tweets negative comments on their own page that is violating free speech. I don't think the 2nd amendment guarantees my right to tag the president in social media posts, unless I'm not understanding.

<comment><USER2> > I don't use twitter can anyone explain this?

The _short_ version is that there are a line of existing federal First Amendment cases which are united by the principle that social media forums used by government officials in their official capacity are, in that context, "limited public forums", and that restrictions (particularly content- or viewpoint-based ones) on participation instituted by government officials (including the one controlling the relevant social media account) in that context are generally in contravention of the First Amendment.

I've linked sources which address both the original letter (which make its own legal argument with citations to relevant precedent) and a separate analysis addressing the same general issue (again, with references to relevant legal precedent) in another comment: [https://news.ycombinator.com/item?id=14509298](https://news.ycombinator.com/item?id=14509298)

</comment></comment><comment><AUTHOR> The way I see it, the implication of what they are claiming is that Twitter is a utility.

<comment><USER2> No, they are claiming that the @realDonaldTrump feed, specifically, is a limited public forum as that term has been established in First Amendment case law.

This has no bearing on Twitter's ability to control content, or non- government-officials using Twitter to block users, unlike what would be the case of this was about Twitter's status rather than a particular government official's feed's status.

</comment></comment><comment><USER4> bush league psych out shit. laughable man.</comment>


Ask HN: How did you migrate to the country you are living in now? - <AUTHOR> <comment><USER2> Gaborone, Botswana -> Johannesburg, South Africa.

The year is 2001. I'm fresh out of varsity with a computer science degree and I'm stuck doing copywriting work for an ad agency because there is no semblance of an IT industry in Botswana (still isn't)

I answer a software developer ad in a popular South African newspaper (for some odd reason we used to get them in Botswana too) but slyly leave out my current residential status.

I get an email requesting me to come for an interview in TWO DAYS.

I beg my folks for some cash, hop on a plane and attend the interview, which goes well. The guy interviewing me then says, well, when would you be able to start if we offered you the job. At this point I take a huge gulp and explain that I would have to wait until I get a work permit, which would require the company to submit a substantial amount of paperwork to the department of home affairs, along with processing fees etc etc.

It's only at this point that the interviewer looks flabbergasted that I had flown in from another country just to interview for an entry level position.

Anywho, for whatever strange reason (I suspect they were impressed with my commitment) they went along with it and I was only able to join them some 8 months later after all the paper work was processed.

The company shut down a year later.

<comment><USER3> Did you end up staying in South Africa or go somewhere else?

<comment><USER2> Ended up staying and have been ever since :-)

</comment></comment></comment><comment><USER4> Eritrea --> London,UK

I am still waiting my first experience on a plane. I haven't been on a plane yet. crossing the border to neighbouring country took me about five days on my own. few hours on the day but mostly on the night as you can imagine there are security on the border.crossing the sahara desert, the mediterranean sea and finally to UK. currently working as software developer.

<comment><AUTHOR> You should do an AMA on reddit.

</comment></comment><comment><USER5> I sold my business, started renting my furnished apartment, and took the airplane to Cambodia. Did volunteering work for the first few months, and now do small technical contract work -- around 10 hours of work a month pays for all the bills. I live in a small villa that comes with a gardener and security.

Aside from the lack of a real justice system and dealing with the government, it is actually a very welcome break. It makes you appreciate a lot of things in the "first world" that you might not see, and am looking forward to moving back to Europe in 2016!

</comment><comment><USER6> China: Applied for a job at a big name local company via the internet. Got paperwork and Z visa (if anyone's thinking about China, this is a must, as working illegally is taken much more seriously than in the past). The company provided dormitory style accommodation.

If you're thinking of China today (that was 10 years ago) and do technology, the easiest way would be to get a job with a well known Western company such as HP, IBM, etc big names as a regular Engineer or QA perhaps at a junior lead level (assuming not going in as more senior management, which in any case is usually internally picked). I'm absolutely sure anyone competent in a similar role with 3+ years' experience can get in AS LONG AS you can convince you'll be comfortable in a completely new culture and stay modest, and I've seen it done with experience that's not that relevant, simply because diversity and English skills are very much in need and appreciated _most_ of the time (a minority of managers can get defensive). Chinese language not needed in most international companies.

</comment><comment><USER7> Perth, Australia -> Berlin, Germany

I gave my boss at the time an ultimatum to transfer me to Europe or I'd resign after requesting a transfer for over a year. I bought a 1-way plane ticket to Berlin that same day and left 6 weeks later.

I initially got a 1 year working holiday visa but eventually changed over to a working visa 18 months later (I spent last 9 months of that time trying to apply for a working visa, but was repeatedly turned back due to insufficient paperwork and handed a 3-month extension to my original visa each time). Getting a tech job here is incredibly easy, so you're generally better off waiting until you arrive and have the chance to network with people.

I've been here 2.5 years now and it's a pretty great place, but I'm planning to move to France next year to co-found a company.

<comment><USER8> Hey! I lived the past 2 years in Perth and just got back to Brazil. I love that city...

But IT there kind of sucks, mostly mining companies.

</comment></comment><comment><USER9> Finished army service in Finland, the company I'd been working for opened an office in Singapore, jumped at the chance to become its first engineer and not see snow again for a while. Spent 8 years in Singapore and traveling around the region (Malaysia, Indonesia, Thailand, India, UAE, Saudi, Kuwait...), met my wife, founded a startup, which flopped but led to a job offer from Australia. We headed over on a work visa, applied for and received permanent residence 2 years and a bit later [1], and I became a citizen last year.

[1] [http://gyrovague.com/2012/08/10/notarizing-your- fingerprints...](http://gyrovague.com/2012/08/10/notarizing-your-fingerprints- for-fun-and-profit/)

</comment><comment><USER10> Poland -> USA

Came on a six-month tourist visa, got locked out of return trip due to an ill- timed declaration of martial law back home. Silver lining was automatically receiving US resident status.

<comment><USER11> Wow one is definitely out of your hands. Can you expand on the martial law circumstances?

Does something like that always automatically lead to resident status?

<comment><USER12> This must be referring to the 1981 declaration of martial law by Polish General Jaruzelski, following pressure from the Solidarity trade union and others. Due to Cold War politics, you can see the US might want to address this by allowing Poles stay in the US.

<comment><USER13> A similar thing happened with the Tiananmen Square protests in 1989.

[https://en.wikipedia.org/wiki/Chinese_Student_Protection_Act...](https://en.wikipedia.org/wiki/Chinese_Student_Protection_Act_of_1992)

In this case the automatic permanent resident status was created by a specific law; it wasn't a consequence of general legal principles.

The U.S. government does offer a relatively automatic asylum when people experience or fear certain kinds of persecution abroad, but the determination is supposed to be very individual and fact-intensive.

There was an exception to the detailed factual inquiry for Cubans: generally any Cuban who made it to the U.S. -- evading the U.S. Coast Guard, which was trying to prevent people from taking advantage of the policy -- would be given permanent resident status.

[https://en.wikipedia.org/wiki/Wet_feet,_dry_feet_policy](https://en.wikipedia.org/wiki/Wet_feet,_dry_feet_policy)

</comment></comment></comment></comment><comment><USER14> Ukraine(Donetsk) -> Poland

I opened a company and send all my invoices from the company's name. I lose money on all the taxes but its worth it. As long as I make enough money I can stay in the country and in the future apply for permanent residence and citizenship.

<comment><USER15> Cheers, don't see too many Ukrainians on HN.

</comment></comment><comment><USER16> France -> Canada, moved there when I was 15 years old with my parents and my sister. Did high school and college there. We applied for perm resisdency (equivalent of green card), got it in ~1 year (my dad was an investor so made it fairly easy).

Canada -> USA, went to SF for a coding bootcamp and got a job once done. Got my Canadian citizenship by then, so came in with a TN, then applied for H1B and now doing green card.

</comment><comment><USER17> Sint Maarten (Caribean island && country) -> Lisbon, Portugal

A your ago, crossing the Atlantic in about four weeks with a sailing boat. I actually had many problems cancelling my residency there because they could not believe I was leaving on a boat. The rules required a one way plane ticket. Its an island ! Good we left...

And because I have a EC passport I can just walk up to the local municipality and get residency.

</comment><comment><AUTHOR> Thank you everyone for the replies. Some of the comments in here are just... wow!

I asked this question, because I want to move to Canada, and seeing what some of you have gone through to get to migrate to another country, makes me realise how fortunate I am, and that I have no excuses if I don't migrate to the country I really want to be in.

Thanks everyone.

</comment><comment><USER18> France -> USA

Contracted for a US company in France, went to the US for the 2 weeks to train the American team on the project I was working on, stayed 2 more months because of the work needed, the American team ended up hiring me and payed for my green card.

</comment><comment><USER19> France -> USA

Took part in a coding competition on HackerRank, did well, applied for a job, did a few more interviews, flew to California :)

</comment><comment><USER20> Berlin, Germany: Took some savings from working back in the States, got here on a 90-day tourist visa, found an apartment and got my first working visa (without about 2 weeks to spare!, although you can extend a tourist visa here) as an English teacher. Later transitioned into a full-time development job.

Came here with my German girlfriend though, so I had a bit of help in terms of language, talking with bureaucracy, etc. But getting a visa (at least as an American!) was fairly straightforward and cheap, if occasionally slow and, well, bureaucratic.

Been here about 4 1/2 years now and love it.

</comment><comment><USER21> Liverpool, UK -> Toronto, Canada

Applied under the Federal Skilled Workers program once I passed the threshold of required points. I always wanted to live in Canada because of the better standard of living and wages.

It also cleared up my wife's visa status - we were at the mercy of the UK Home Office whether my wife could stay in the country. If I lost my job when we applied to renew her visa she would have had to leave. Canada cleared up all that uncertainty as we are now permanent residents here.

Canada has one of the most generous immigration programs in the world. Check it out.

</comment><comment><USER22> 1) Saved up freelancing money to live here while looking for a job for 6 months to 1 year

2) In the meantime work on getting Australian citizenship (at the time I was an Australian permanent resident, but Ukrainian by nationality), which would allow me to:

3) Apply for a working holiday visa to target country

4) During the above use flexibility of freelancing to spend a year at home learning to code and building up a game dev portfolio and blog

5) Start applying for work 1 week after arriving to target country

6) Apply for normal work and residency visa with employer's help after getting a job.

</comment><comment><USER23> Tokyo, Japan: Applied for an opening I spotted on Linkedin. Interviewed via skype over a few weeks. Got the job, got the standard engineer visa, and that was it.

<comment><USER24> Had you already passed JLPT?

<comment><USER23> I had zero Japanese. Rudimentary even now.

</comment></comment></comment><comment><USER25> Coventry/London, UK -> Malmo, Sweden

Girlfriend accepted a place in Lund university, so I applied for a job.

Since I'm a citizen of the EU, I have right of residence and in any other EU country; as such I don't need a VISA to live or work in another EU country.

The company I was hired by put me in one of their apartments while I found one of my own, so I moved. Later I got a social security number from the local tax agency (Sketterverket) and the rest is history:)

</comment><comment><USER26> Scotland -> USA (SF Bay Area).

I finished up a CS degree in Scotland and then applied for several engineer jobs in CA. I interviewed via Skype and got made a job offer (Groupon). Accepted offer and applied for the H1-B visa, and was extremely lucky that the visas didn't run out immediately that year (2011).

The visa process was very straightforward and the interview ultimately felt like a rubber stamping exercise (total anticlimax). It took about 5 months for the visa to become valid, though, so I spent that summer hanging around researching CA on Google maps and wikipedia. Packed up 5 suitcases and got on a plane from Glasgow -> Philadelphia -> SF, having never set foot in CA before.

Hired a car and drove around looking for apartments. Ultimately settled in San Mateo as I had figured out on Google maps it was about half way between Palo Alto (where I was working) and SF (where I anticipated I would want to spend quite a bit of time). Have been here ever since and no plans to move away.

Also made the mistake of shipping some items from Scotland which didn't arrive until 6 months after I did - would not recommend trying that.

</comment><comment><USER27> I rented my place on Airbnb, packed my bag, went to a country I was interested in, looked for a job there (luckily there was no need for a visa because I was in Africa/Middle East and you always find a way around there), found one in a few days (being a foreigner with skills help), and voilà. I didn't save any money, I just looked for a job :)

</comment><comment><USER28> By plane :), even if some people seem to think we did swim across(sadly not joking).

On a more serious note we didn't really plan on moving to another country but my wife was the lucky winner of one Diversity Visa(i added both of us to the program just for fun) and so we decided to move to the US and see how it is.

Moved from Romania to US and currently still in US after 9 years.

</comment><comment><USER29> Edinburgh, Scotland -> Helsinki, Finland.

Got on a plane. No real hardship involved. Although the process of shipping some of our possessions was stressful, both packing them, culling them, and arranging the actual transport.

Most of the process was easy, thanks to my Finnish wife who helped me with paperwork, but moving from the UK to Europe is pretty trivial.

</comment><comment><USER30> France -> USA. Like many qualified French guys in the bay area I got a degree from a top tier French school and did not want to work for finance, consulting or aerospace (or other giant companies).

I looked for an internship in the Bay, found one thanks to my school network, and worked as SQL developer for a year. The job was ok, but it gave me the opportunity to apply to universities in the Bay (they like candidates with startup experiences).

I now have a CS degree from the US which basically makes it much easier to get a US visa, well until yesterday:

[https://www.insidehighered.com/quicktakes/2015/08/17/judge-i...](https://www.insidehighered.com/quicktakes/2015/08/17/judge- invalidates-component-foreign-student-work-program).

</comment><comment><USER31> I migrated from Australia to Canada.

I came initially on a 1 year working holiday visa. Then got a 1 year work visa through an employer while I worked on my permanent resident application (spousal sponsorship).

PR was granted about 6 months after submission, and I got citizenship about 5 years later.

<comment><USER32> Don't spouse visas take over 12 months? I'm about the start the process of sponsoring my spouse and we are expecting it to take almost 2 years (we aren't living in Canada at the moment).

EDIT: well they do say "up to 16 months" at the Ottawa processing center. So I guess given the time you'd already spent in Canada 6 months isn't that wild.

<comment><USER33> I migrated from the USA to Canada last year on spousal sponsorship and the process end-to-end took ~7 months. I submitted the application while I still lived in the US and I was told that helps me as far as processing times. I'm sure a lot of factors come in to play, though.

</comment></comment></comment><comment><USER34> I migrated from Belgium to Hong Kong. It actually begun when I did my internship in China, after graduating I started looking for jobs in Hong Kong and one company offered me a working visa. 4 years later and I'm still there. (Although at another company)

</comment><comment><USER35> Cambodia to USA (southern california)

Parent flee the Vietnam fall out, grandfather from my father side died from friendly fire (USA), we supposely got a free ticket to USA if we can flee.

Parent ran from Vietnam, jump around, during Cambodia I was born, they went many places, thai/kham/lao and then Phillipines where my parent and I immigrated to the USA.

edit:

I posted on HN somewhere their stories fleeing. There were a few encounters where they could have died but got lucky. It's pretty neat and crazy. In general, America is a great country I'm glad, they worked hard and got my sister and I to college.

</comment><comment><USER36> India -> Texas, USA -> Ontario, Canada -> Seattle, USA -> TBD among Japan, Vancouver BC Canada, New Zealand, Australia

Came to US as grad student, stayed, worked, ran out of 6 yr H1B, moved to Canada, worked, started company (flopped), consulting moved back to US, worked, started company (ongoing), consulting.

I get itch to change countries/cities every 10 years or so. Also I want to collect residencies and citizenships. Now thinking of moving to another country most probably Japan, New Zealand, or Australia or settle down for good in Vancouver BC Canada.

</comment><comment><USER15> Kiev, Ukraine -> Connecticut, USA

Post-soviet Ukraine did not have very many prospects, just like much of the rest of Europe. My mom left when I was about 7 to start a better life for us in America. Took her about 7 years to make that a reality and see me again for the first time since. I am forever thankful to her for the sacrifice she made for both of us. I am now in my mid twenties, college educated and married, chasing the American dream.

</comment><comment><USER37> Indonesia -> USA

Got my first job in the USA fresh out of college, based on a recommendation from my high school programming friend that got his job here first. He got to finals of ACM programming competition in USA, and got hired almost on the spot.

Finally got my GC after 8 years of H1B & 3 more years of I-485. I think I'm quite lucky to be able to keep having jobs & maintained my H1B status during ups & downs of US economy.

</comment><comment><USER38> India -> US. Tried and tested route of M.S, H1-b -> wait in line for 7 years and get G.C. The only thing missing is "Profit".

<comment><USER39> Not anymore. H1B lottery is useless now.

</comment></comment><comment><USER40> Hungary -> Canada -> US -> Canada

While I love Canada, I really miss the Bay Area, where I lived the longest. But I made a mess of and failed to get my GC and now I won't ever get to live there no more. Been on a downward spiral lately.. but it's been great when it was going good. I was a software developer with minimal on the job training, btw, no degrees of any sort, sadly.

</comment><comment><USER41> Almost UK to Denmark.

The removal van comes tomorrow, my flight to Copenhagen is booked for Monday morning. I have a short term let organised.

<comment><USER25> Copenhagen airport is decent. I live across the bridge in Malmo, Sweden.

if it's not too personal, what's your plans for Denmark? :)

</comment></comment><comment><USER42> Netherlands -> USA

Came here with my first startup, got my green card quite easy and fast considering all the horror stories (got it 14 months after arriving) and I'm increasingly considering to apply for US citizenship in a few years, but that'll mean I'll lose my Dutch passport (NL does not allow dual citizenship). Tough choice.

<comment><USER43> Which green card did you get, if you don't mind me asking?

<comment><USER42> Just the regular I-485? I'm not sure if there's more than one green card.

<comment><USER43> There are different classifications, EB1, EB2, EB3, EB5, etc.. I'm wondering what you used as the founder of a startup (and who your lawyer was if it wasn't EB1 or EB5)

<comment><USER42> Ah, EB1.

</comment></comment></comment></comment></comment><comment><USER44> Edinburgh, Scotland -> Zurich, Switzerland Applied for software development contracts in Zurich. Flew over for an interview. Got the contract. Said I wanted 12 months. Got that too. Quit my permanent job. Took the plane. Still here nearly 5 years later.

</comment><comment><USER45> Catalonia -> London -> Tokyo.

Moved to London, met Japanese girlfriend, moved to Japan because we didn't love London that much, married, working for a a startup in Tokyo.

I wouldn't mind to go back sometime to South-West Europe, specially if we have kids.

</comment><comment><USER46> Brisbane, Australia -> Asunción, Paraguay

I finished uni in Austalia and moved here to Paraguay a few years ago for a sea change. My father's family are here so I was not absolutely lost. I loved learning a new culture and language.

</comment><comment><USER47> Beirut -> Dubai (Sponsored By Local Company 4 Years) -> Beijing (Applied for Big Name Western Multinational 6 Years) -> Vancouver (Immigrated Under Federal Skilled Workers Program) Kudos Canada

</comment><comment><USER48> Tenerife, Spain -> Amsterdam -> SF, California.

Founded a company and got selected for a startup accelerator in Amsterdam. Later, wife got a job in SF and we moved here.

</comment><comment><USER49> A recruiter contacted me on LinkedIn with a job offer. The interview went well and I got the position, so I quit my previous job and moved to the UK.

</comment><comment><USER50> Spain > Belgium Came to work for a Belgium co, now working for a USA co working on remote still form Belgium. 3 years of this already.

</comment><comment><USER51> Warsaw, Poland -> Berlin, Germany. Took a direct express train.

Boring, I know. Thanks to common borders.

<comment><USER52> What about the language? I get it that it's not a problem at all at work, but did you have to learn some German for a normal, day to day living? How long did it take you to learn enough to feel comfortable there?

<comment><USER51> Language is a considerable problem. You basically need it for the post office, your bank, your landlord, ISPs etc.

My 6 years of learning German (in public schools) didn't help much. I'm learning now everyday, for more than a year, and I still cannot understand my doctor and my neighbors.

As a fallback you just smile a lot and hope for the best.

</comment></comment></comment><comment><USER53> São Paulo, Brazil --> Chicago, IL, USA on a intra-company transferee visa (L1).

<comment><USER53> And, to expand on that, applying for my EB.

</comment></comment><comment><USER54> New Zealand -> London

So much better here. Unlimited Internet 1GB Fiber to the house!

<comment><USER55> hyperoptic?

<comment><USER25> they're the only company to do 1G unmetered I think. :D</comment></comment></comment>


Ask HN: Startup people, what are you reading? - <AUTHOR> I'm interested in learning what people working on startups (founders + employees) are reading.<p>What blogs do you read? Who do you follow on Twitter? Besides HN, what other communities do you belong? <comment><USER2> Communities? Well, I also participate at Lobste.rs, Barnacl.es, ai.stackexchange.com, datascience.stackexchange.com, electronics.stackexchange.com, stats.stackexchange.com, machinelearning.reddit.com, semanticweb.reddit.com, and artificial.reddit.com, among others.

Twitter? I follow a lot of people/brands/projects/etc. Feel free to go take a look:

[https://twitter.com/FogbeamLabs/following](https://twitter.com/FogbeamLabs/following)

Blogs? Probably easiest just to share my OPML file. [https://s3.amazonaws.com/fogbeam- public/digg_reader_subscrip...](https://s3.amazonaws.com/fogbeam- public/digg_reader_subscriptions.opml)</comment>


Carbon Black – A Global Market Overview - <AUTHOR> http://industry-experts.com/verticals/chemicals-and-materials/carbon-black-a-global-market-overview#.VpCaIMLwLgk.hackernews <comment><AUTHOR> This is good read if want to explore.

<comment><USER2> Is it _that_ much better than when you posted it earlier today?

[https://news.ycombinator.com/item?id=10863949](https://news.ycombinator.com/item?id=10863949)</comment></comment>


How Facebook Has Tunrned Each of Us into a Walled Garden - <AUTHOR> http://highscalability.com/blog/2016/12/5/the-tech-that-turns-each-of-us-into-a-walled-garden.html <comment><USER2> Minitrue on steroids. No hardcopy = no messy reconciliations with past statements. Atomized information = no messy reconciliations amongst ourselves.

>In a democracy, we're making choices that govern each other. So yes, we all have an obligation to understand each other.

Problem is, no one EVER attempted to understand the "other" with any empathy. Understanding was merely a tool to dominate.

</comment><comment><USER3> Why does everything have to be Republicans Vs Democrats?

<comment><USER4> duopolies work great to give a false sense of choice. it fits well into the age-old strategy to "divide and conquer".

there's also a quite scientific component of hegel's dialectic. quite interesting stuff if you dare looking behind the curtain.

[https://en.m.wikipedia.org/wiki/Duopoly](https://en.m.wikipedia.org/wiki/Duopoly)

[https://en.m.wikipedia.org/wiki/Georg_Wilhelm_Friedrich_Hege...](https://en.m.wikipedia.org/wiki/Georg_Wilhelm_Friedrich_Hegel)</comment></comment>


11k Citi employees fired. Help get them hired in tech. - <AUTHOR> http://retrain-citi.thinkful.com/

<comment><USER2> At the risk of sounding like a heartless bastard upholding tired old stereotypes, enterprise scale retail banking is probably the last place the majority of startups should consider a 'talent pool'. In places like Citi, change is something to be feared, silos are everywhere and 'lean' is probably unheard of (at least in IT circles).

Kudos for at least providing an opportunity for people to improve themselves though. And the sentiment of course.

<comment><USER3> I have kind of mixed feelings about this. I worked at Citi, and the average person there is actually pretty smart. They're just tied down by all the bureaucracy, which ends up killing their creativity and motivation.

This can turn into an advantage once you leave, though. Once you join a decent company you get _very_ motivated to do your best, because you never want to go back.

<comment><USER4> But would the 11k laid off be average employees, or the bottom 5%?

<comment><USER3> The smartest people will often end up performing terribly at bad companies. Being unable to act is not a huge deal for an average person, but it can be devastating and demotivating for someone who's used to getting shit done.

And honestly? I don't believe Citi management knows enough to know who their bottom 5% are.

<comment><USER5> You nailed it outright. I award an Indignation for your this post. I will also award one to Thinkful for this brilliant marketing move. So it's a Joint Indignation I award today: <http://www.youtube.com/watch?v=EtCiP8B2xpc#t=7s>

If 100 is the typical productivity of a smart person when she's making the technical calls, picking the tools, and writing a new system, most corporate environments expect software engineers to function at 5-10-- maybe 20-30 when they get to senior dev roles. The problem is that if you're used to 100+, that feels like being at 0. It's demoralizing when your productivity is a rounding error for environmental reasons that aren't your fault.

</comment></comment></comment></comment></comment><comment><USER6> Where's the indication that NYC tech talent was hit in any significant way? From the linked article:

 _About 35 percent of the fourth-quarter costs are tied to eliminating 6,200 jobs in consumer banking, with operations set to be sold or scaled back in Pakistan, Paraguay, Romania, Turkey and Uruguay, according to the statement. Branches will be reduced in five other nations, including 44 in the U.S._

<comment><USER7> It might be that no-one in NYC was fired. But I imagine that the people employed by Citi in the city (zing) are still a little nervous about their long-term prospects. When shareholders cheer people being fired, you have to wonder if you're next.

That said, it does make Thinkful's offer to "ex-Citi employees" a little less likely to be taken up.

<comment><USER6> I strongly doubt that anyone in Citi you'd want to hire for a startup is working under any kind of illusion that Citi is an employment project. If your unit isn't profitable (enough), it's shut. Of course the stock market likes that - or rather, dislikes the opposite.

<comment><USER8> I read the message as "Your industry sucks to work in now, doesn't it? Why not come to our website to study web programming online so you can come join the tech startup industry instead?"

<comment><USER6> That's a very charitable reading.

It's a PR play for the training outfit, and not a terribly good one, IMO.

<comment><USER8> The post is an advertisement to be sure. But they are being somewhat charitable themselves by giving their service away for free to ex-Citi employees.

<comment><USER9> Ah, but how many get the full service, and not just online course material? How do they scale their "one-on-one help" to 11k people?

Thinkful only get paid when a hiring manager employs somebody that they introduced. If I were to be an old curmudgeon, this is PR off the back of bad news, to try and scalp potential leads and resumes.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Citi was one of the best places I have ever worked.

Sure it was tightly controlled with various security precautions, change control and the other banking regulator requirements which made it impossible to be a hacker and to get things done quickly.

But as a workplace it left me with fond memories.

<comment><AUTHOR> Awesome. Were you recently laid off?

</comment></comment><comment><USER11> From my experience working at a large Investment Bank, the strong performers normally do keep up to date with new technology developments or have otherwise a strong base knowledge that allows them to pick up new things by themselves. The masses largely prefer to have a corporate job for as much pay as possible - this was the first workplace where I heard a number of people explicitly say they are only there for the money and in some cases actually want the redundancy packages.

In my view the good opportunity for other companies in these situations is that a number of stronger performers decide to leave by themselves when this happens, for multiple reasons - they are overworked because their teams are reduced, low morale, etc. These are the ones that are interesting to capture.

</comment><comment><USER12> But would they be good matches for tech jobs? On what basis are you reaching that conclusion?

<comment><AUTHOR> Excellent question.

Simply put: We follow where growing companies are looking for talent. That's our indicator.

Banks, hedge funds and other parts of the financial sector use a hell of a lot of fancy tech (they're the first "big data" after all), and there's a lot of expertise that's been locked up there for too long.

When I left finance (4.5 years, 4 years ago... hells yeah) I had all sorts of engineering skills, but knew nothing of the companies, how to evaluate employers, or what exact tools were most in demand or growing.

Helping people answer those questions more quickly than I could is our mission.

<comment><USER5> One thing I like about finance is that they are better than most corporations at respecting and evaluating intelligence. They don't reject the 140+ IQ set outright in the way that most corporate environments (even some startups) do. Financial companies may restrain and underemploy such people with bureaucratic nonsense, but they also pay for the pain.

The problem with the developer economy is that paid work has very low career efficiency. There's just a lot of glop work to go around, and most engineers don't have the political pull to get past it and on to the interesting stuff, which they're perceived as underqualified for because of their track record of crappy work (even if done well). Most engineers have about a 75% slack ratio in their careers, which prevents them from ever getting really good. But give a decently smart and motivated engineer 5 years of full autonomy and you'll have the guys and gals that people make Chuck Norris jokes about.

</comment></comment></comment><comment><USER13> On another (un?)related note, Citibank ran a 'Cyber Monday' in India where

        "it would provide discounts of up to 60 per cent"

[http://articles.economictimes.indiatimes.com/2012-12-02/news...](http://articles.economictimes.indiatimes.com/2012-12-02/news/35546881_1_citibank- plans-indian-market-ecommerce-players)

</comment><comment><USER14> _"MVC, Backbone, wireframing ... Django, Rails, Node, Hadoop ... Amazon Web Services & Heroku ... Git in a Nutshell Continuous deployment & TDD"_

They should teach more than just the latest (popular) concepts/languages like node, ruby, python. There seems to be little mention of important concepts such as data types, pointers, and OOP.

<comment><USER8> Nothing wrong with learning Javascript and Ruby or Python off the bat instead of starting with something like Java or C/C++. But you might want to start the course with stuff like programming language basics, database basics, and SQL if they're coming from non-programming positions.

It's also a little overkill to cover Django, Rails, AND Node.js in one course, isn't it?

I guess I'm not sure if the ad is targeted at Citigroup's software/IT people (who already know a lot of this stuff and are probably not the folks getting laid off) or the other (finance/accounting/admin/sales/customer service/operations) people (who probably need to start from the square-one basics of web programming).

<comment><AUTHOR> Fair question. We don't think you can learn from scratch any of these topics in three weeks, let alone all of them, to be employable at any of them. What we're talking about are people who are proficient in a given language or topic already, and who want to see a crash course, and get a taste, before deciding what to do next.

Our candidates are basically already very employable, but there's an extra risk we help employers avoid: that a new hire won't enjoy or become proficient in this new subject quickly (read: cheaply).

Thinkful is all about cost savings for employers, and candidates finding what they're really interested in.

Know java really, really well? Maybe you'll enjoy scala. But perhaps give it a trial run for a few weeks (along with some other cool stuff) before jumping in to a job for several years.

</comment></comment></comment><comment><USER15> Am I the only one that read that as "Dear Citi employees, sucks you got fired. You're probably bad at what you do; let us help."?

</comment><comment><USER5> This is brilliant marketing by Thinkful.</comment>


Show HN: ChatThrough.com -- Create your own random chatgroups - <AUTHOR> http://www.chatthrough.com

<comment><AUTHOR> Please leave any comments, tips, and advice that you may have. It will be very much appreciated. This is my first website launch and I want to know anything I can do to make the site better.</comment>


Hey Mashable and Wired… Firefox is not 10 - <AUTHOR> http://benjaminkerensa.com/2012/09/26/hey-mashable-and-wired-firefox-is-not-10 <comment><USER2> The claim is valid looks like Mozilla last celebrated the 7th last year... wow</comment>


The Perot Museum is Bursting With Science, Some of It Unsettling - <AUTHOR> http://www.nytimes.com/2012/12/01/arts/design/the-perot-museum-of-nature-and-science-in-dallas.html

<comment><USER2> Sounds like a good museum.

I read mostly to see what was unsettling. Perhaps an exhibit debunking evolution? No, it's this: "But it is almost bizarre to see a major exhibit about energy whose central focus is on fracking and its machinery, even if the process ultimately transforms American energy production".

Whether you hate fracking, love fracking, or like me just don't know enough to have an opinion, it seems like a great exhibit to visit. It really is transforming energy production in the US and it should be more widely understood.</comment>


Homeless Lawyer Secretly Lived in Public Defender's Office for 5 Months - <AUTHOR> http://abovethelaw.com/2015/05/homeless-lawyer-secretly-lives-in-public-defenders-office-for-5-months/

<comment><USER2> There was an attorney in santa cruz, california who specialized in pro bono work for the homeless, most commonly when they were prosecuted for camping within city limits. That law was passed in the 1950s to encourage tourists to rent hotel rooms rather than camp on the beach.

He was unable to pay his bar association, so some judge paid it for him.

The name of the judge was never disclosed publicly. I'm not real clear how we know that it was a judge. I expect that had the judge claimed credit publicly, he would have been obligated to recuse himself when this attorney appeared before him.

</comment><comment><USER2> Go read a legal textbook - as opposed to legislation or a contract.

They're really quite easy to understand in contrast to computer science or physics texts. I read them for fun.

Judicial opinions are commonly easy to read, especially supreme court opinions.

My point is that maybe it's not so hard to pass the bar.

<comment><USER3> It's really not. People used to pass the bar without ever going to a law school.

The entire profession has been captured by educational institutions. It's a posterchild for what tech should not allow itself to become.

<comment><USER4> It is still possible, here and there to "read law" to qualify oneself to take the bar examination. It is definitely rare these days.

<comment><USER2> Caryl Chessman - The Birdman - passed the bar after reading the law in Alcatraz.

I've met some attorneys that I don't regard as being very bright. I don't think that's ever been the case for anyone I've ever met with a graduate physics degree.</comment></comment></comment></comment>


Show HN - A tweetmeme of its own for every city - <AUTHOR> http://frrole.com

<comment><USER2> 20 cities is hardly "every city". I tried 'frrole.com/mycity', expecting a page to be generated on the fly, but no such luck. Should be possible though, and then you could legitimately state that you offer results for every city.

It would also be a nice touch to use geolocation to automagically generate a city (or region) page. Right now, it presented me with the page for Mumbai, while I'm in Europe. Out of the available options on the site, London is closest to me.

<comment><USER3> Agree, should have said "Building a tweetmeme of its own for every city". This is the first release, we are taking the no. of cities to 50+ with the next release in 6-8 weeks.

The focus till now has been on building algorithms that are kickass enough to filter junk out and keep only useful stuff in. Still WIP I know, but what do you think about that. Take <http://frrole.com/san+francisco> for example.

<comment><USER4> The suggestion is that the user should be able to enter any city, not just use the preset ones.

<comment><USER3> Thanks, that is how it is intended to be in the longer term. But going to hit Twitter's rate limits very soon and access to full firehose is way too costly for a bootstrapped startup.

Hope to scale to 50+ cities by ourselves, validate traction with users from those 50 cities and then look at really big scaling, if it is getting some love:)

</comment></comment></comment></comment><comment><USER5> There is a value in providing a "social news paper for a city" but that's not what OP is doing now. "Swarm" intelligence is superior to an individual. Filtering news articles by number of re-tweets sets higher threshold for signal-to-noise ratio, however, 140 characters hardly constitute a "news article". Below, my suggestion for a data mining web application that is focused on delivering a news paper customized for a city with high signal-to- noise ratio news articles.

Input: X = country, Y = city, tweets from twitter

For each X scan last N million tweets that have a link to a web-site, output M most linked domains (Facebook.com, techcrunch.com, cnn.com, wsj.com, etc) - this gives you a base for news feeds customized for every country

For each Y in X, scan last n thousand tweets that have a link to a web-page, output m most linked web-pages that are hosted on M domains for Y country - this gives you the "social news paper for Y city in X country"

Parameters M and N prevent spamming and shape long term trends. Parameters n and m give you short term trends, which in essence are the "swarm" intelligence about which articles are worth reading for a given city in a given country. The value here is a time saver of what is worth reading to keep up with your community.

Note to self: could be a data mining web app

<comment><USER3> I agree some and disagree some. Regarding M and N, I don't think they can control spam any more than m and n, given that M and N are going to be super- sets of root domains of m MULTIPLIEDBY Y{1 to j} and no of tweets of n MULTIPLIEDBY Y{1 to j} respectively, where j is the no of Y in each X.

Where I totally agree is the "Swarm" intelligence is superior to an individual philosophy. The same thing is dictating our thought process as well. Here: <http://frrole.com/about-us>

Where I again think differently is the 140 chars vs. the linked article line of thought. Grant that maybe we should call this "social headlines for your city" instead of "social newspaper..." ( 140 chars make for perfectly good headlines) but I believe that the information overload today is increasing drastically, attention span therefore (and otherwise) is decreasing significantly; so much so that more content, specially textual, is not the answer. Less content in fact is the answer, but chosen intelligently enough so that it does not leave things out.

Where I definitely agree with gayakwad is that these are fantastic inputs, the kind of inputs one definitely expects on HN. See from your profile that your areas of interest too are those that we are working on (Frrole is a lot, LOT more than no of retweets btw), maybe we should talk offline?

</comment></comment><comment><USER6> This is interesting, but looking at the NYC one, your "Xpert Tweeters" really distort the idea of "local".

I'm seeing tons of national news from the WSJ, the NBA, and a score of other media outlets that are based in New York but not covering New York (aside from incidentals, e.g., that Wall Street is a street in Manhattan).

Also, as you expand, it might be worth while to drill down NYC by borough. Having a Brooklyn, Manhattan, Queens, and even Hoboken NJ page would probably be worthwhile both for your users, and for you.

<comment><USER3> Yup, have heard that one a couple of times already, we are going to take care of that one VERY soon. Plan to aggregate tweets at country/global level too going forward, so have to do it in a way that we remove them from the city but not lose them totally.

Check out some of the deals, events etc, though. Good "democratized" info (I hope:)), including things that would never make it through standard aggregators.

</comment></comment><comment><USER7> looks great.. way to go.. ranking tweets based on re-tweets is the best way to filter out twitter noise.. a suggestion would be to keep it local to begin with.. india specific.. else it'll again somewhat become noise at international level..

I created something on same lines but much much smaller (and minimal) : www.lessvu.com

primarily to track certain active communities in india.. (presently works for journalists only)

<comment><USER3> thanks. Retweets is just one rule. Pretty much like google uses back links as an indicator, but has 200-300 other rules, we use retweets as an indicator but have 100+ rules probably. or around. These rules are spread across metadata analysis (language based, response type, location based filtering etc), statistical analysis(no of retweets, recency based scoring etc) and linguistic/textual analysis (syntactical construction, use of spammy words, characters etc)

</comment></comment><comment><USER8> Please expand to multiple cities, more content and Mobile. As it is first version, Still looking good.

Best wish

</comment><comment><USER9> Looks awesome !, really interesting data in my city Bangalore Are you ppl looking only at no of Retweets ?

<comment><AUTHOR> Good to know that you liked it, Certainly we consider tweet count but that's not the only thing, we have put lots of logic for analyzing tweet's nature (textual/NLP), relevance (by city and category) and most importantly we have worked on cutting noise.

</comment></comment><comment><USER10> Vancouver before Montreal? Does not make any sense :-)

<comment><USER3> Montreal is up in the next release.</comment></comment>


Who's Collecting Kids' Personal Data? Lots of People - <AUTHOR> https://openstandard.mozilla.org/whos-collecting-kids-personal-data-lots-of-people/

<comment><USER2> They failed to give a example of how this harmed children, or is unique to the internet. The biggest harm they mention is getting an unsolicited email for a private high school. I remember in high school getting unsolicited postal mail from collages. The other harm was a neighbor made a youtube account and posted videos with her parents knowing. It sounds more like the parent's were harmed instead of the child, presumably she wanted to make a YouTube account and post videos otherwise she would not have done it.

I just don't really understand what we are trying to protect and what the big deal is. (Seriously if someone does understand I would really like to know.)

<comment><USER3> > They failed to give a example of how this harmed children ... I just don't > really understand what we are trying to protect and what the big deal is.

A few thoughts about this argument, which many people bring up:

1) Many people value their privacy; it might not be universal (though I think everyone does to some degree) but it's widespread and has been enshrined in law and custom across many (I suspect all) cultures.

2) Information is power. I don't have to explain why on HN (I hope). People who control information about you have power over you, to varying degree. Information also has value and should not be taken without consent (which is financial harm, arguably).

3) Some argue that if loss of privacy results in no physical or financial harm then it results in no harm. If you think through this argument, clearly there are other universally recognized kinds of harm. For example, the following might result in no physical or financial harm: Sexual assault, kidnapping, home invasion, theft (if the assets are returned soon), if I caused your spouse to divorce you or family to disown you, installation of malware on your computer, etc.

I think the question of the harm in an invasion of privacy is an interesting and valuable philosophical one to consider, but I feel it's a bit disingenuous to propose seriously that privacy has no value.

</comment></comment><comment><USER4> Why is it that things which are problems, in general, only seem to get focused on when you get "Think of the chiiiildren."?

While it's nice that people are doing things for children, these same privacy issues exist for adults.

<comment><USER5> Because we are humans, and care about our children? I don't have kids, but I suppose we will both understand this when we have one.

Children are an excellent argument. Many revolutions started because students were beaten by the police (or sent to war), and it made their parents angry. Children are other people in the world we care about the most, and only by caring about other people a just society can exist. So take it as a road to privacy regulations.

I wish engineers understood this better, and wouldn't shy from doing the same. The argument "think about the children" is often invoked by conservatives in support of authoritarian policies, but there is no reason why it can't be an argument for democratic and liberal positions.

</comment></comment><comment><USER6> including mozilla via google analytics and google cookies!</comment>


What sort of people become white nationalists? - <AUTHOR> https://www.economist.com/democracy-in-america/2018/08/13/what-sort-of-people-become-white-nationalists <comment><USER2> Can anyone explain to me how the article connected:

 _being white was "very" or "extremely important" to their identity_ _expressed strong feelings of white solidarity_ _believed whites suffered a meaningful amount of discrimination_

with _people likelier to harbour angry racial resentments_?

There is no explanation found, we're just accept this as fact and throw out further conclusions from this basis.

On another note, I can see why The Economist wants you to become a paying subscriber.

How else will they have the resources to put together these important pieces that will surely make the world a better place and keep people informed about these essential issues in society. A prime example of what they stand against according to their motto: "... timid ignorance obstructing our progress."</comment>


Show HN: WebGL Insight, a Debugging Toolkit for Chrome - <AUTHOR> https://github.com/3Dparallax/insight/ <comment><USER2> This AddOn really gives you a nice, high level overview of what's going on and where to optimize. I may just add that for lower level debugging WebGL Inspector[1] is also tremendously helpful.

Also, cool to see my game[2] as an example for the bad overdraw situation :)

[1] [https://chrome.google.com/webstore/detail/webgl- inspector/og...](https://chrome.google.com/webstore/detail/webgl- inspector/ogkcjmbhnfmlnielkjhedpcjomeaghda) [2] [http://phoboslab.org/xibalba/](http://phoboslab.org/xibalba/)

</comment><comment><USER3> This looks excellent. Congratulations to you, Aaron, Adrian, and Dian for making such a handy tool.

Though the "programs" view seems to just combine all of the shaders found on the page. It includes "potential" programs which were never linked.

<comment><AUTHOR> Lots of thanks from each of us! We hope you get a lot of use out of it :D

</comment></comment><comment><USER4> I will definitely try this. Does resource viewer support cube textures?

<comment><AUTHOR> Thank you! Please let us know how it goes.

We currently don't do any special handling for cube textures, but that was one of the features we have planned next.

</comment></comment><comment><USER5> Doesn't seem to work on Google Maps. :/

<comment><AUTHOR> Looking into what's going on in Google Maps now! It works in the Google Earth view, but only after moving the view a bit.

Thank you for pointing that out!</comment></comment>


The Golden Age of Rich People Not Paying Their Taxes - <AUTHOR> http://theatlantic.com/politics/archive/2018/12/rich-people-are-getting-away-not-paying-their-taxes/577798/ <comment><USER2> > By that time, the Republican narrative had taken hold: The IRS had to be > "held accountable" for wasting millions on lavish conferences and > persecuting conservative nonprofits for their political beliefs.

That is very dismissive of some very salient complaints about how groups were targeted. Read the Wikipedia article. This isn't moonbat pizzagate nonsense. Among keywords targeted were "open source software", "medical marijuana", and "Israel".

A Democratic senator said:

> U.S. Senator Claire McCaskill (D-MO) said, "We should not only fire the head > of the IRS, which has occurred, but we've got to go down the line and find > every single person who had anything to do with this and make sure that they > are removed from the IRS and the word goes out that this is unacceptable."

[https://en.m.wikipedia.org/wiki/IRS_targeting_controversy](https://en.m.wikipedia.org/wiki/IRS_targeting_controversy)

<comment><USER3> Definitely not great behavior. The idea this was purely an anti-conservative thing when OSS advocacy is on this list is where my eyes glaze over though. Just on its face there is a lot of evidence in the other direction

>Ryun has stated he believes that Greenhouse Solutions benefited from its name (although the quick approval might also be due to the fact that Greenhouse Solutions was already operating as a nonprofit and was already on-file with the IRS.)

Like "conservative claims bias (but here is the real explanation)." Might as well place "claims to be innocent " in the profile of every person in Shawshank

The insistence of people bringing up this thing as a conservative thing only when there were liberal groups also being targeted (There could have been a proper bipartisan effort against this!) is mind-boggling.

<comment><USER2> I don't care to rehash the argument, but targeting nonprofits based on their names is at best arbitrary and uneven. Maybe it was accidental that conservative groups felt targeted. But given that non-profits aren't in the business of lawsuits, it's a due process concern when the IRS is arbitrary.

Some sort of heuristic based on random sampling or less political profiling (location, governing structure, association with known tax evaders) makes more sense.

<comment><USER3> Yep, I had never really dug too much into this (partly because I would hear about it from people I know to act in bad faith), but I agree on the arbitrariness being a due process concern.

I do feel like "random sampling" would make a lot more sense here. Other profiling feels like it might end up in the same spot though. Really the ideal thing is to improve the processes/rules and give enough resources to where they don't feel the need to have to pull fringe-political-shaped needles out of haystacks in the hopes that those needles happen to also be non-compliant shaped.

Incentives are all weird here, and we end up in these messes. And some people take advantage of that to create a narrative that makes it _even harder_ to solve the real problem (imagine asking for more resources for compliance after this "IRS is being used for politics" stuff)

</comment></comment></comment></comment><comment><USER4> > "No business would fail to fund a unit that, on average, brought in $7 for > every dollar spent. Shareholders would rebel and bring lawsuits, or at least > oust the management or board of directors," Olson wrote in her preface to > the report. "Yet this is precisely what we are doing with the IRS > budget."[0]

Sounds like the IRS should be the most funded government agency.

[0] [https://www.irs.gov/newsroom/national-taxpayer-advocate- deli...](https://www.irs.gov/newsroom/national-taxpayer-advocate-delivers- annual-report-to-congress-focuses-on-tax-reform-irs-funding-and-identity- theft)

<comment><USER5> Yeah, especially because tax avoidance is an insanely difficult problem to fight once it gets big enough. I mean it's impossible to prosecute at once even 10% of the country for not paying taxes.

Imagine the US going through a Greece episode, which was caused in big part by tax avoidance. To this day it's perfectly fine in Greece to ask for a ~20% "cash discount" in almost any shop, which of course means simply not paying the VAT tax (similar to the US sales tax).

Edit: let me self-correct - this does not seem to be an actual problem in the US - with this plot: [https://en.m.wikipedia.org/wiki/Tax_evasion#Government_respo...](https://en.m.wikipedia.org/wiki/Tax_evasion#Government_response)

<comment><USER6> The US has a very high tax compliance rate because most of our income is reported through 3rd parties (w2, 1099, etc.). For income that is not reported through a 3rd party, we have low compliance rates as well. For income subject to little or no information reporting, the misreported income is 63% of total according to the IRS. [https://www.irs.gov/pub/irs- soi/p1415.pdf](https://www.irs.gov/pub/irs-soi/p1415.pdf)

<comment><USER7> >> because most of our income is reported through 3rd parties

For most _people_ and most of _their_ income. I seriously doubt it true that most income, as in >50% of all income earned by all US entities, is so reported. Corporate income is massive. Corporations, the wealthy, private contractors ... their income is not automatically reported. Note too that "income" includes all income, not just net profits subject to tax.

<comment> barry-cotter Indeed. It is trivially easy to get people to conspire to evade taxes for the benefit of other people for similar payment to that they could get working for clean companies when they could pay massive fines or go to prison for doing so. Equally it is simple to find these people when any one of them could go to the government and inform them of your illegal actions when first informed or as a whistleblower after years doing so.

The difference between the US and Mexico in terms of corruption is not that the people in the US are pure of heart, it's that coordinating corrupt and illegal activities is next to impossible when law enforcement are clean.

<comment><USER8> > when law enforcement are clean

What are some differences between law enforcement in the US and Mexico?

<comment> barry-cotter Fundamentally, that the FBI is run by people who don't take bribes and who promote people who find corruption in state or local law enforcement or other government offices. In Mexico there are states where the chief of police is owned by the narcos, in the US, a single department being corrupt from top to bottom is probably the biggest scandal since WWII.

[https://en.m.wikipedia.org/wiki/Rampart_scandal](https://en.m.wikipedia.org/wiki/Rampart_scandal)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I take pride in paying my taxes. It reminds me that our society has a cost, and we all contribute towards it.

I'd be interested to know how others feel. And how we could inspire more people to feel pride in contributing rather than make such efforts to avoid contributing.

<comment><USER10> I'm against taxes for the simple fact they're non-voluntary. I don't think there's anything wrong with people that that are willing to pay them, but I don't think forcefully [meaning, eventually you will be arrested by someone with a gun] taking another person's money is justifiable by any society.

<comment><USER11> This is reasonable. I'd prefer that rather than forcibly collecting taxes, non-payers could simply be, peacefully, stripped of citizenship and exiled.

<comment><USER12> Yep, it is totally "non violent" to throw people into the sea, where they can be "non violently drowned to death".

The ocean is the only place not claimed by a nation. That's the point. You cannot buy land, and have it declared yours, not subject to the authority of a nation.

If you support violence, that's fine. Go ahead and say so, and make that arguement. Lots of people support the government's monopoly on violence. It is not a particularly controversial opinion to have.

But don't pretend like exiling people from land that they own is "non violent". Just be honest with yourself and say "yes. I support the government's monopoly on violence". It's not hard, nor controversial.

<comment><USER13> > If you support violence, that's fine. Go ahead and say so, and make that > arguement. Lots of people support the government's monopoly on violence. It > is not a particularly controversial opinion to have.

If someone is squatting in your house, benefiting from money you spend on it, you are justified in evicting them.

> The ocean is the only place not claimed by a nation. That's the point. You > cannot buy land, and have it declared yours, not subject to the authority of > a nation.

This has been true since basically the dawn of human civilization. Just in those times, you were subject to the authority of invaders.

> But don't pretend like exiling people from land that they own is "non > violent". Just be honest with yourself and say "yes. I support the > government's monopoly on violence". It's not hard, nor controversial.

Owning land is a concept that only exists inside of a system of government with a mechanism to enforce property rights. If they decide they don't want to be subject to the rules of society, they don't get to have their cake and eat it too.

<comment><USER12> > kaibee 1 hour ago | parent | on: The Golden Age of Rich People Not Paying > Their Tax...

> If you support violence, that's fine. Go ahead and say so, and make that > arguement. Lots of people support the government's monopoly on violence. It > is not a particularly controversial opinion to have. If someone is squatting > in your house, benefiting from money you spend on it, you are justified in > evicting them

This argument is only valid if you believe that the 200 countries in the world own every single inch of land in the world.

> . Just in those times, you were subject to the authority of invaders.

Yes, and this would be described as violence.

And that's fine. If you believe in the authority of the monopoly on violence of governments, all you have to do is say so! That's it!

This is merely a descriptive claim I am making. That the act of owning every plot of land in the world, and preventing other people from owning it, and then kicking people off of 100% of the land, is violence.

If there was an ever expanding mirror world, where people could up and leave too, then this would not be violence.

Or in other words, owning 100% of something is violence, but owning 0.00001 % of something is not.

And all you have to do is say that you support the uncontroversial opinion of the government monopoly on violence, and we are good to go. Easy!

</comment></comment></comment></comment></comment></comment><comment><USER14> An IRS budget of $14B means each person in the USA is paying $43 per year to fund the agency (including children). At the Federal minimum wage, after taxes, that's about a full working day to pay it off. If you have a non- working spouse and one child, three working days.

So it seems like a lot to me.

Here's an idea, why don't we simplify our Byzantine tax filing processes so that the whole thing doesn't cost so much. I know, I know, all that sweet H&R Block tax lobbyist money is addictive, but it would be better for the country if congress would put down the pipe.

<comment><USER15> A US military budget of $660,000,000,000 means each person the USA is paying $2030 to fund the military (including children). At the Federal minimum wage, after taxes, that's 47 full working days to pay it off.

So that seems like a lot more to me.

<comment><USER16> Luckily, we can focus on more than one thing at a time. We can oppose foreign interventionist wars and reform the tax code at the same time.

</comment></comment></comment><comment><USER17> The political support for underfunding the IRS comes from the complexity of the US tax code combined with the extraordinary powers of the IRS. It leaves the average taxpayer with the feeling that could be audited and even jailed at any time for non-compliance with some obscure rule.

I am an Australian and I fear the IRS more than the ATO, not because I owe the IRS anything (I am not a US taxpayer), but because I have US customers. There is probably some obscure form or reporting requirement I have missed or filled in incorrectly that could make me the target of some arbitrary action by the IRS. You can see why foreign financial institutions just won't have anything to do with US taxpayers.

</comment><comment><USER18> All very sad. It is time to bring the wealthiest back to heel. Companies and individuals cannot be above the law or the states which sustain their lives and businesses will crumble. Time to take back control.

<comment><USER19> It is impossible to revert. Rich people own the world and unless they are willing to sacrifice their wealth/power, there is no other solution other than revolt/war.

<comment><USER20> Or you can organize and vote. This is still a democracy.

<comment><USER21> This (the USA, at least) is a constitutional republic. You have representation and you have constitutional rights. In a democracy, a plurality of the people can vote to do whatever they want to you. In a constitutional republic, a supermajority has to change the nature of your rights in order to violate them.

It's an important distinction.

<comment><USER22> The USA is a symmetric federalist constitutional republican representative democracy. This is a form of democracy.

"Democracy" is a family of types of government, of which the absolute democracy many imagine in one form. A representative democracy is another.

</comment></comment></comment></comment></comment><comment><USER23> Maybe if we had simpler tax code instead of byzantine monstrosity that happens now, when even professionals can't be sure if particular payment is right, and there's no hope regular citizen can figure it out - we'd not need as much funding to the IRS as we need now. But that would mean giving up the power to control people's decisions by messing with taxation - one of the most powerful levers of control Federal Government can have over the private citizen (Obamacare individual mandate has been deemed a "tax", because that'd make it within Fed's constitutional powers) and one of the most powerful levers to control the economy. Having simple tax code removes that power, and that's why it would not become simple.

</comment><comment><USER24> > letting the poor commit too much fraud

> Cutting the IRS's budget didn't make sense to him. It was one of the few > areas of government that had a positive return on investment

> Since the IRS-reform bill in 1998, the agency is prohibited from evaluating > agents based on how much money they bring in. Instead, they are evaluated on > how efficiently they open and close audits

I find these pretty interesting. It does feel a little fishy, given the IRS can actually be a revenue generating center for the government. Which would be very different if it was costing more then it brought in.

</comment><comment><USER25> From the same source, for some context:

"Proof the IRS Didn't Target Just Conservatives", from early on in the scandal

[https://www.theatlantic.com/politics/archive/2013/06/proof-t...](https://www.theatlantic.com/politics/archive/2013/06/proof- the-irs-didnt-target-just-conservatives/276536/)

After the evidence was overwhelming and denial was impossible:

"New Documents Show the IRS Targeted 'Progressive' and 'Tea Party' Groups for Extra Scrutiny"

[https://www.theatlantic.com/politics/archive/2014/04/new- doc...](https://www.theatlantic.com/politics/archive/2014/04/new-documents- show-the-irs-targeted-progressive-and-tea-party-groups-for-extra- scrutiny/361125/)

</comment><comment><USER26> Seems to me, though I'm not American, that many Americans take issue with the arduous process of paying tax in America. I suggest you take a look at Estonia's tax collection system and it's efficiency as a potential model.

</comment><comment><USER27> i guess there should be more enforcement but im not a big fan of an organization that presidents have used again their enemies. Also beauracies tend to grow over time and the amount of tax they need (both sides unfortunately). I would bet california breaks 10% sales tax this decade

</comment><comment><USER28> There has to be some clever way to privatize this.

<comment><USER29> Privatized prisons have worked out so well - I agree it's probably a good idea here as as well. /s

<comment><USER30> We just didn't do it cleverly enough, you silly socialist!

</comment></comment></comment><comment><USER31> The IRS administers and enforces the income tax laws beyond the parameters of the laws passed by Congress and signed by the President as well as beyond the parameters laid down by the U.S. Supreme Court. Moreover, the IRS's own internal procedures, manuals and literature itself indicate the IRS knowingly deceives the American public about the scope of its true income tax authority.

In addition, consider this: [https://www.numbersusa.com/news/irs-12-million- illegal-alien...](https://www.numbersusa.com/news/irs-12-million-illegal- aliens-committed-identity-theft-fy-2017)

</comment><comment><USER32> Classic "Republican" playbook: instead of killing a govt agency/service directly, slowly de-fund it over years until it's crippled, then use said crippled state as "you see, the state just can't provide healthcare/telecom/infrastructure efficiently, it must be privatized" justification, then deliver the remainders on a silver platter for the ultra rich to siphon the profits off.

<comment><USER33> Not clear what their plan is in this case though. You can't exactly privatize gov tax collection at least not in a way that wouldn't result in billions of dollars for fraud and even more lost revenue.

<comment><USER34> If they cared about losing money to fraud we wouldn't be in this situation to begin with.

</comment></comment></comment><comment><USER10> The IRS has a $12,000,000,000 to spend, and we're worried about a few millionaires not paying their taxes? I'm much more concerned about the first part, how on earth did we give that astronomical amount of funding to that agency and what in the heck are they doing with $12b that couldn't be done with $12m?

<comment><USER35> For easier math, let's assume that 330m Americans file 120m tax returns. So all in, collection, processing, auditing, technology, customer support (which is excellent btw), management, compliance, etc would be ~$0.10 per return? Even at ~$100 that seems pretty well run. Scale costs.

<comment><USER36> The number is extreme... but it's worth noting that Facebook and Google both manage more users, often with more complex information, including people intentionally trying to break and trick their systems - at very low cost.

(I'm not sure if Google/FB spend 0.10 per user, but it sure ain't anywhere near $100).

I think with a sensibly simplified tax code, and FAANG-level technical innovation, IRS costs could enter that range.</comment></comment></comment>


Student hacks high school software and finds "SQL injections galore" - <AUTHOR> https://secalerts.co/article/student-hacks-school-software-and-finds-sql-injections-galore/5cf2e72f <comment><USER2> Some friends and I hacked Blackboard last year. We exploited it by smuggling null bytes (0x00) via. their WebDAV protocol.

This made it possible to hijack other accounts, including our professors'. So we hacked our own grades and then reported it. Luckily we didn't suffer the same fate as Demirkapi.

Blog post here: [https://bustbyte.no/blog/how-we-hacked-blackboard-and- change...](https://bustbyte.no/blog/how-we-hacked-blackboard-and-changed-our- grades)

<comment><USER3> I remember finding XSS and XSRF bugs in one of their things like 9 years ago. I'm not surprised it still sucks.

I posted it on the full disclosure mailing list, and IIRC they ignored it as far as I could tell. This was back in 2010.

(And before I get flak for not notifying them before disclosing it, I was a teenager and I wouldn't do it that way now)

<comment><USER4> I reported a vulnerability in blackboard when I was in college (around the same time period as you).

I don't recall any sort of disclosure mailing list, and the only contact link I found seemingly went through my college's IT department. Whether my university had applied some customization, or whether it was just me being a young college student, I'm not sure.

Anyways, a few days after I had reported the vulnerability, I was summoned to a meeting where I found myself sitting at a table opposite my academic advisor, as well as the Department Chair of the CS department, where they began to speak to me about "academic integrity".

I'm glad the story mostly ends there, as during this meeting I realized what had _actually_ happened; someone in the IT department had misinterpreted my report as some sort of hacking threat, and they had "tracked me down on the university network", which makes no sense because I had reported the vulnerability via email directly from my .edu address.

While I wasn't exactly well-liked among the professors in the CS department, the department chair at least recognized that it was a big misunderstanding, that I wasn't doing anything nefarious, and had been acting in good faith.

After that meeting, I had approximately zero interest in disclosing vulnerabilities of any sort, for fear of being on the hook if/when they were ever exploited.

<comment><USER5> > I don't recall any sort of disclosure mailing list,

fyi, your parent post referred to [1] here. Glad nothing too bad came of your disclosure.

[1] [https://seclists.org/fulldisclosure/](https://seclists.org/fulldisclosure/)

</comment></comment></comment></comment><comment><USER6> I'm confident that if you poked around the software of the vast majority of organizations in this world, you'd find "SQL injections galore". There is just limitless amounts of old code that no one has the resources to address. Should the information on students be well protected? Of course. Have you ever seen the software running your local dentist, doctor, insurance office? It's just impossible to spend money and fix things that already work.

<comment><USER7> We have about 200,000 lines of code that look like this:

        250:             Let strsql = "Update TbfFileManagementSystem Set FileName = replace(FileName,'" & Me![PONumber].OldValue & "','" & Me![PONumber] & "')" & _
        " Where FileID = '" & strFileID & "';"
        260:             mdb.Execute (strsql)

<comment><USER8> Insert a line of code before that statement which validates that the variable is an integer and you're sorted. As an added bonus, check that it's in range.

<comment><USER9> Please don't. Use placeholders and the DB's prepared statements API _everywhere_. Manual escaping and validation is a recipe for disaster.

<comment><USER8> Absolutely - that is the desired end state.

In some languages migrating to the prepared statement API can be a considerable amount of work and that takes a lot of time.

If the code is mainly made up of queries with an integer ID then you can make the code safe using guards with a fraction of the effort meaning that your software is stable faster. Then you can take your time rewriting your data access layer to use the safe-by-design APIs.

I should have made that clear in my original post :)

BTW at some point you might need to get into escaping / validation to support operations not supported by the safe APIs. If/when you encounter this it's a massive red flag. Your system design should reflect that. It should be treated like radioactive waste: be paranoid.

</comment></comment></comment></comment></comment><comment><USER10> Me and my friends had a lot of fun hacking into our school IT systems in high school. We took security as a challenge, not as a warning.

At various points, we had a shared file server for sharing movies and music for the whole school, bypassed the proxy (which also gave us a vastly improved connection speed), had Unreal Tournament 99 on the computers (this was ~2010, but it was one of the only games that would play well), we figured out how to send messages to all computers (using Novell Zenworks or something), and eventually a few of us just had full root access to the entire system. We also had lots of fun with fork bombs, setting peoples desktops to porn (we weren't meant to be able to change our desktop but there were workarounds), and the occasional broadcast storm.

If only we had known about bitcoin at the time, we'd have become rich running a mining network on the school computers.

Luckily, our school had a very relaxed attitude to our shenanigans. We generally avoided doing anything actively harmful and we also got a few free passes by helping the IT staff when they had problems (they were useless at their job).

<comment><USER11> When I was in junior high, circa mid 90s, I hade full control of my school's network. Was Novell Netware based, DOS only. Menu was meant to restrict what apps we could run to only those in the menu. Found an "exploit" in WordPerfect in that you could launch WP, hit a function key to launch a limited command prompt, but on exiting WP, it would crash, returning to a full command prompt. Being basically DOS 6.x, there was no further permissions at that point. I was friendly with the IT admin, so I always let him know when I stumbled into something (I also had about a half dozen admin accounts hidden). I had the ability to chamge grades, impersonate teachers and send messages as a teacher, but never abused my acceas. I did get suspended for a week after a network crash (likely caused by a failed disk) that I had nothing to do with.

My parents asked me point blank if I'd done and if I knew how to do it, or which I honestly replied no to both. That was when I got my first C++ book. My parents were like "if you got suspended for something you didnt do, you're sure as fuck going to learn how to do it."

<comment><USER12> Heh, this sounds like my high school experience.

Many teachers left the default password on their accounts. Was messing in the interface that I didn't understand very much and sent a broadcast message to the entire network. One by one they started beeping and displaying a blank message notification across all the computer labs in the school. Luckily I had some opsec at that age and didn't do it on the workstation I was assigned to. Logged out and quickly went back to my seat in the confusion that quickly spread in our class.

Wasn't till 2 years later that I got in trouble and got kicked off the computers for a month. For having a shareware game on the network. The network admin said something to the effect of "We are pretty certain you have done a lot of things far worse than this, but we can't pin any of them to you, so this is what you get punished for", and well, he was right.

<comment><USER11> Yeah, I didnt start cracking passwords until I was in college - I didnt need to. When in junior high, the IT admin would kick off a tape back up of the network, and stay logged in. Id wait until later, like 6pm-7pm and dial into his computer (his computer had a connected modem that accepted inbound connections with no username/password), do my thing, then restart the backup before I was for the night, so he wouldn't notice in the morning. Never did anythinf destructive, but I did have about 6 bogus accounts with full admin access. Kept those accounts to myself, lest they grt discovered. They never did... He left around my freshman year of high school. Didn't trust his replacement, so kept my lips shut about the access I had. Graduated with nearly all of my accounts with admin access intact.

In college, had to crack some passwords. Turns out all of the lab computers, the admin password of all NT lab Pcs was a 5 character building abbreviation + room number of where campus IT was based... I was expecting the crack to run overnight on my then 500 Mhz P3. The password was cracked before I could stand up to go to dinner. Last cracked passwords on my old XP laptop, that I couldn't remember the password to. Hard part is getting the unencrypted password file (since I think Win2k, Windows encrypts the SAM file on disk and exclusively locks the file while the OS is running), but if you can run something with system authority, you can inject a dll and extract the decrypted file. You still have to brute force the NTLM hashes after that, but on modern hardware, takes just a few mins. Back in the NT 4 days, at least the way our comouters were configured, nonadmins had write permissions to everything under c:\Windows. Easy way to get system? Replace the default screen saver with a copy of cmd.exe, then log out and wait for the logon screen saver to fire. Back in the day, screen savers ran as system. They dont any longer.

On the NT 4 boxes, I was able to script everything. Pop in a bootable floppy with the script and an NTFS driver, reboot, wait for the script to complete, having copied the SAM file, then reboot again and back to normal. Walk back to my dorm room, crack at will.

</comment></comment></comment></comment><comment><USER13> I had a similar experience being 13, but luckily for me it only involved my own highschool website and data. I found a blind sql injection and got access to the credentials of any user. I wasn't a particularly mature 13 y/o so I started messing around.

My highschool reported the incidents and I got caught in a few weeks. I almost went to trial, my hard drive with my StarCraftII campaign almost finished was confiscated (I haven't seen it again since that moment) and it was overall an instructing episode. It didn't go any further because my parents had good relations with the highschool's direction and they withdrawed the report as soon as they knew it was me.

In the following years I kept in contact with the webmaster and I remember feeling very encouraged to report any other flaw I could find to him. I found a few more things over the years, but most importantly learned a lot.

Every time I read news like this I remember how grateful I felt when my highschool not only forgave me but also helped me keep learning. I believe it can make a difference, and even more so when dealing with younger kids.

<comment><USER14> Yeah, it's cliche but for kids, the quote they "were so preoccupied with whether or not they could, they didn't stop to think if they should" really applies. You're smart enough to hack the system but not smart enough to know that it's a really bad idea.

</comment></comment><comment><USER15> >Demirkapi passed on his findings to his school's IT department. However, it ended up being viewed by every school in his district and he was suspended from school for two days.

<comment><USER16> Lesson learned.

Keep vulnerabilities to your self.

<comment><USER17> Meh, anyone who knows anything would look very positively on a kid who had the curiosity and ability to do that and suffered ridiculous consequences. The suspension is a badge of honor, a great story, and generally a life long benefit.

When I was in high school a few of us grabbed passwords from unencrypted wifi/network protocols (maybe it was POP3 logins, I don't remember) and "reported" it with some harmless website defacing, telling the admin (who was a cool guy). Nothing happened and I don't think anyone ever even noticed.

<comment><USER18> Funny,

I was nearly expelled from my high school for finding and immediately reporting a vulnerability, without having actually exploited it. Also my story is far too common. Most of the people in charge don't know anything!

Many of us in the industry who have been around the block a few times support either selling your exploits or open disclosure. We have our reasons.

<comment><USER19> I had a friend that noticed some really nasty vulns in his college's software (passwords in plaintext in the page, and the reset question and answer). I coached him how to very carefully report them and he had some help from family. But given that the uni takes federal funding he could have easily landed a federal felony for just reporting, and all he did was do view source on the page.

</comment></comment></comment></comment></comment><comment><USER20> I live in the town where this happened. A lot of us parents already hated the software involved. On the other hand, it's not clear that alternatives would fare any better. In my experience, software specific to non-technical orgs like schools or doctors' offices is uniformly terrible not just in terms of security but all over. I wouldn't be at all surprised if competitors' software was even worse. Such is the state of the world.

<comment><USER21> Makes one wonder if there's a market opportunity

<comment><USER20> There are many. Unfortunately both the domain-knowledge requirement and switching costs are very high. It's hard for a newcomer to break in, and once they have there's little incentive to keep updating the product. The result is a succession of companies and products that were probably fine for the time when they were introduced, but quickly seem dated as the rest of the industry evolves.

The other alternative is open source. Lower the initial cost of entry, amortize the cost of maintaining and enhancing core components, and let vendors compete on the basis of what they can offer on top of that. Unfortunately, this approach yields much lower margins than what "vertical" software vendors are used to, so they'll fight any such thing tooth and nail. That gets us into the domain of trusts, cartels, and regulatory capture. The business factors preclude technical solutions, and users pay the price. :(

<comment><USER22> Keeping up annually with federal and individual state education reporting regulations is a severe PitA. The Texas Board of Ed itself is a monster of a bureaucracy compared to some other states.

</comment></comment></comment></comment><comment><USER23> Blackboard. Ha ha ha. Blackboard.

When I was in school, there was a vulnerability where you could reach courses that you didn't belong to, simply by changing the id in the URL. A couple of students got punished (banned from school computers for months) for exploiting this (to leave a message on said courses). As of a year later, the vulnerability was still not fixed (although the messaging infrastructure was disabled).

<comment><USER24> Heh. When I was in school (maybe dating myself here), there was a blanket prohibition on accessing "DOS Screens" because the total morons that ran the school's IT department couldn't lock it down and someone sent a bunch of popup messages to the entire campus using _net send_.

<comment><USER25> A friend of mine got hassled in the high school computer lab for being in cpanel for his personal website. Apparently it looked scary.

Security on the old Macs was hilarious though - the student user accounts had a limited set of applications they were allowed to launch, but it was only enforced via Finder checking when you double clicked it.

There were so many other ways to launch things. Custom buttons in AppleWorks toolbars, AppleScript, dragging it into Safari and then opening it from the downloads manager, and setting the creator code to match any application you had permission for were convenient options.

Don't have access to run Script Editor? That's ok, type applescript: into Safari's URL bar and it'll pop right up.

</comment></comment></comment><comment><USER26> That correlation is very frustrating -- people should take this more seriously, but those who discover things are punished... should be pretty obvious why security is way it is, right?

</comment><comment> gjsman-1000 True story: I inadvertently hacked the Smart TVs at my college once. They are typically always showing announcements, and they let student clubs post messages with the approval of Student Life.

Well, after a software update, nobody noticed that the permissions system for the TV was disabled. So I come along, a few weeks/months/? later and make an ad for Math Club, and it went live immediately. No Student Life approval.

Of course, this isn't a glamorous bug. Briefly thought, "Man, if I was a bad guy, I'd totally post some really _shocking_ material." I wasn't a bad guy though, told Student Life, and they fixed it.

EDIT: There is a shared account detailed in the Club manual on how to create a TV ad (for context).

</comment><comment><USER27> An article with more details is here:

[https://www.vice.com/en_us/article/59nzjz/teen-security- rese...](https://www.vice.com/en_us/article/59nzjz/teen-security-researcher- bill-demirkapi-suspended-for-exposing-vulnerabilities)

This article has more details about the reasons Demirkapi was suspended. Apparently he first tried to contact Follett (the software maker) directly, but they ignored him. He then tried to use the software itself to send a message Follett, but the message was instead broadcast to a large number of parents, teachers, and administrators across the district. This does seem pretty irresponsible, and Demirkapi said he understood the reason for his suspension.

Thus, this doesn't seem like the usual "person reports vulnerability and is punished for it" story.

Of course the ultimate responsibility lies with the software makers who have these vulnerabilities in their software and who don't respond when someone reports them.

</comment><comment><USER28> I'm genuinely surprised this didn't result in his expulsion, knowing how these kinds of stories usually go down.

<comment><USER29> I think your "usually" is heavily biased by media stories, which of course report only the exceptional, otherwise it wouldn't be news.

I've reported vulns in school before and got an unexpected bug bounty. I also abused vulns to put games on a school server when I was younger and that time I got a firm talking to. I also know someone and their friend who were around 18 at the time and stole a teacher's password (don't remember how, but nothing clever) and changed some grades of theirs. They were indeed suspended.

</comment></comment><comment><USER30> This was the case when I was in school too. (Gesh, it's been that long already?!).

I bet most schools are in a similar situation. Lack of a proper budget, cheaply made software sold by shady vendors, IT staff that isn't properly trained, etc.

</comment><comment><USER31> This kid seems a lot more responsible than I was when I was in high school.

Taking about manipulating the URL parameters... yeah, I used that trick to apply discount codes way back in the day. The web form wouldn't accept them, but if you bolted them on to the URL after that step in the checkout process, they'd blindly get applied to your cart anyway. Found one for like 95% off a CD, and used it on a laptop at BestBuy. 15 year-old me thought he was really smart, but mostly he was just a vandal and a thief.

Best line:

> "Don't fall for marketing. Just because (vendors) say they take care of data > doesn't mean they do."

</comment><comment><USER32> A good friend of mine got suspended for a semester after he found a pretty trivial flaw in his university's password reset form that would ultimately allow him to reset the password of anyone who had an account on the school's network including faculty and administrators. IT discovered him, locked him out of the network before he was able to report it, and threatened to take legal action. From what I've heard, they never fully fixed it. He went to a technology university mind you.

<comment><USER33> I found a blind SQL injection in my university course management system. Probably could have dropped the entire campus course list... but I didn't try. Found it at ~2-3AM, and so figured I'd bother IT in the morning. Woke up to a locked account and a message from the dean of students to pay him a visit.

I got off with some stupid fine and my online access being locked for 30 days. Was pretty annoying though, because they counted the 30 days only during when school was in semester. I happened to be doing this the final day of the semester... so that 30 days ended up being a lot longer.

</comment></comment><comment><USER34> I found the same thing in high school. Except that I didn't tell anyone, and it was fixed after a few months. I guess someone was looking at request logs after all.

</comment><comment><USER35> As a current high school student I know that my school's software has similar weaknesses. I talked to our IT "department" (we only have one active person that I know of) and he said the district does not really have anywhere to bring up the issue.

</comment><comment><USER36> My school (biggest school in Germany in the time) had VNC Server running on all PCs, so the teachers could check what there students where doing. Surely enough they used the same password on every single PC in the whole school. Fun times.

</comment><comment><USER37> For a 17 year old, that is brilliant. But he has to look after himself because obesity problems create bigger problems. You can not spend so much time in front of a computer. Take a walk. Do some sports. You can be a good hacker too. Peace man. [https://www.wired.com/story/teen-hacker-school-software- blac...](https://www.wired.com/story/teen-hacker-school-software-blackboard- follett/)

</comment><comment><USER38> This was the case for blackboard in 2006. I see they haven't improved at all.

</comment><comment><USER39> Bobby Tables, please report! [https://xkcd.com/327/](https://xkcd.com/327/)</comment>


Feedback for a startup - <AUTHOR>

I am looking for some feedback and general comments about a startup I am working for called SoundFit. We create custom fit ear adapters that increase comfort, and won't fall out accidentally. They passively reduce outside noise by up to 30dB, allowing wearers to hear the signal clearly at lower volumes and with higher dynamic range, while protecting their hearing. Here are links to our website, Facebook page, twitter page and angel list profile. https://soundfit.me/legal.php https://www.facebook.com/soundfit http://twitter.com/thesoundfit http://angel.co/soundfit-1 Any information would be greatly appreciated! <comment><USER2> I like that the idea is easy to understand, but there is not enough information available on the site to answer many of the questions going through my mind as I think "Do I want to pay $100 for this?" By saying "can reduce ambient noise by up to 30db" that's just not selling the product enough.

I'm thinking to myself: will this muffle my headphones? what does an apple/bose/etc headset with your silicone attachment look like? Are some of these universal (can an apple one be used for another earpiece as well?) Will it look fashionable? Noticeable? People already have in-ear headphones (though they may fall out), but how does this method compare in quality?

There are just many of these questions that you need to address before you can expect people to throw a Benjamin at you. More pictures of "exactly what this will look like" would be helpful.

I'm not sure if you've considered a return policy. I understand this is quite a custom job, but having a good return policy may definitely ease people's payment tensions as well. Hard to decide.

Best of luck.

</comment><comment><USER3> Earphones falling out of my ears is definitely a problem, but this is a high tech (probably one of the best) solution for a simple problem. It is a hard sell if my ear phones cost less than the adapter. As far as your website is concerned, try showing some more pictures of these custom fits vs the regular ones. As I understand the home "kits" help you get the impression of my ears and using that you will build my custom fits. Shouldn't the home "fit" by free or included in my adapter's price? Just my thoughts and feedback. I would buy one of these if they were more affordable. :)

</comment><comment><AUTHOR> Thanks everyone for the comments! They are very very helpful. Also, just to clarify the homepage for the website is as follows. <https://soundfit.me/> sorry if there was any confusion about that.</comment>