Why I Actively Discourage Online Tooling like jwt.io and Online JSON Validators - <AUTHOR> https://www.jvt.me/posts/2020/09/01/against-online-tooling/ <comment><USER3> I agree with the author. Is it highly unlikely, sure, but it's important to create awareness of the risks associated. At the end of the day, you are sending potentially sensitive data to a third party.

Good security posture is all about building habits and I personally don't want myself or my team being comfortable with the idea of pasting code or JSON config files into a third party system.

If any of these online tools are sending your data to the server, don't use them. You don't know what happens with your data once you send it and accidents happen even if the service has your best interests in mind.

For the ones that are client side, such as JSON-to-go. You can save the client side code locally, set a bookmark, and use your local version instead.

<comment><USER4> I keep a copy of CyberChef [0] locally. Can do the majority of the data manipulation I need. Does JWT Decoding / Signing / Verification and JSON Validation / Pretty as well. You can experiment with insignificant data here [1].

[0] [https://github.com/gchq/CyberChef](https://github.com/gchq/CyberChef)

[1] [https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/)

<comment><USER5> Wow this looks really useful

</comment></comment></comment><comment><USER6> For those criticizing the author for 'fantasy' security problems, it seems relevant to emphasize that they work at a bank---their threat model is probably rather more vigorous than most.

<comment><USER7> > they work at a bank---their threat model is probably rather more vigorous > than most

Until one day when you work with ACH files and start having existential dread about the american payroll system.

<comment><USER8> Yes it's sometimes rediculus with what regulated businesses can get away with as long as it's either historical or had been certified to be secure at some point in time.

<comment><USER9> I don't think this is a good argument.

The ACH network is orders of magnitude more secure than credit cards. And ACH transfers have simple recourse, when errors or fraud occur.

</comment></comment></comment></comment><comment><USER10> I think the author is over dramatic. Like when he says this:

>I've been burned a number of times by folks putting a Non-Production JWT or an Open Banking Sandbox certificate into jwt.io.

He hasn't been "burned" by that at all. No security breach occured because of that. He does have somewhat of a point, but he goes off into fantasy land trying to justify it.

<comment><USER11> > these are sensitive in of themselves, as they have implementation details > for our services, and as mentioned, certain things could be used outside of > Capital One.

I imagine these JWTs will find their way into a frontend application in prod (because what else would they be for?), at which point any actual user of theirs could pull the token down and get access to these implementation details. The only thing sensitive about a JWT should be its ability to authenticate a user; encoding _actually sensitive_ data inside that token, such as anything you want kept secret, would be a huge mistake.

<comment><USER12> There are server side JWTs that are never exposed to the users.

<comment><USER13> I thought the entire point of signing a JWT was because you need to validate it because there is some endpoint that is untrusted and you have to treat the claims as potentially compromised.

<comment><USER14> Yes? And?

I may have a backend service that is both internally and externally exposed, necessitating all requests to it be signed. I may have a backend service that has load limits that need to be fairly adhered to, and to do that I allow users only so many requests per time period. Even without load limits, I may want to know who is calling me, and forcing services to first request a token on behalf of themselves makes it more likely that each service will uniquely identify itself.

Really, if you trust the callers of your API enough to allow unsigned JWTs, you probably should trust them enough to not require anything (because copy/paste mistakes alone mean the data isn't valid, intention aside). If you can think of a reason why not having any identity information at all is problematic, you should probably force a signed JWT. The extra effort is negligible, it reduces potential risk if the use of the service changes and it starts getting 'untrusted' users, and it helps reduce "oops" mistakes upfront.

</comment></comment></comment></comment></comment><comment><USER15> If you never use production data for anything other than production this stops being a problem. You can put all the dev and staging JWTs you want in to jwt.io at no risk if those things aren't available to the outside world.

<comment><USER16> Agreed. This pretty much applies with any data & tool. If the data is extra sensitive, make extra sure the tool you are using is secure. If your data is for dev purposes only, the tool doesn't have to be validated as thoroughly.

<comment><USER17> Wow really? Lateral movement is very real, your mindset is dangerous.

<comment><USER16> That is a good point to make. If the development data can lead to exfiltration of higher privacy data then I would define it as "more sensitive" and take that into consideration, this particularly applies to config information required for authentication. I understand your perspective however, it is important to take lateral movement into account.

</comment></comment></comment></comment><comment><USER18> For inspecting JWT tokens, I like the step command-line tool: [https://smallstep.com/cli/](https://smallstep.com/cli/)

      pbpaste | step crypto jwt inspect --insecure

It can be combined further with jq if you need to dig out a specific field. (pbpaste is a macOS cli command that prints the contents of the clipboard)

<comment><USER19> This is interesting! I've blogged about an OpenSSL-only version in [https://www.jvt.me/posts/2019/06/13/pretty-printing-jwt- open...](https://www.jvt.me/posts/2019/06/13/pretty-printing-jwt-openssl/) which optionally needs Python, so you can do it with basically 0 new dependencies, if that's what you want :)

</comment></comment><comment><USER20> For JWTs, I agree with this stance, since they are security credentials and therefore basically all of them are sensitive information.

I don't discourage online tooling in general. It's a risk/benefit trade-off--- No, you shouldn't paste sensitive information into websites run by other people in general, but for non-sensive information where you don't care if the online tool is logging it or not, go for it. There are significant advantages to not having to roll your own for every single thing you need to do.

Carried to its extreme conclusion, "Don't use online tooling" implies "Don't read jvt.me," because who knows what that website is doing while vending you blog posts? clearly, you should roll your own solution by maintaining your own private collection of knowledge that you never share with anyone else. ;)

<comment><USER21> >For JWTs, I agree with this stance, since they are security credentials and therefore basically all of them are sensitive information.

As long as it's prod env and your expiration time is somewhat reasonable, then I don't think it is sensitive at all unless you're storing an actual sensitive informations in them.

<comment><USER22> So you're just hoping that there isn't a bad guy on the other side trying to use the credentials in real time? Seems like a bad assumption to make, especially for a site that's specifically made for pasting in JWTs.

<comment><USER23> No. No one's hoping anything. It's more like a realization that even if there's a bad guy, they're only going to be able to pwn your dev environment, which has no valuable data in it, and can be replaced with a script.

</comment></comment></comment></comment><comment><USER24> But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?

<comment><USER25> i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search

<comment><USER26> So I'm not the only one.

It's even worse than that though, enter 'myintranetsite' and hit return, and you end up on a Google search page. Instead you have to enter '[http://myintranetsite'](http://myintranetsite')

<comment><USER27> Type myintranetsite/ instead, this is faster than [http://](http://) in front.

<comment><USER28> As you type, the name is still being sent to Google for search suggestions with every keystroke until the final "/".

If you prefix with "[http://"](http://"), no requests are made to Google (except "h", "ht", "htt", "http", and "http:")

<comment><USER29> > _If you prefix with "[http://"](http://"), no requests are made to Google > (except "h", "ht", "htt", "http", and "http:")_

This seems surprising to me. Can you back up this claim?

<comment><USER30> If you have search suggestions enabled then "http:" will be sent. Firefox disables them in Private Browsing mode for this reason.

\- [https://support.mozilla.org/en-US/kb/search-suggestions- fire...](https://support.mozilla.org/en-US/kb/search-suggestions-firefox)

<comment><USER26> > If you have search suggestions enabled then "http:" will be sent

What's the point of sending those characters?

<comment><USER31> Search Suggestions. You typed "h", maybe you want to search for "harpoons". "ht" might suggest "htaccess". "http" might be a search for "httpie". etc.

<comment><USER26> Yes, of course :-P

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> I agree with the premise though its easy to validate if these tools are sending data to a remote dest with the network activity developer tool in any of the major browsers.

<comment><USER33> Sure, but to be sure you'd have to validate it every time, because the site's content may have changed since your last visit. Do you?

<comment><USER34> No, you'd just have to validate it when you're inputting something particularly sensitive (and I really do usually look in the network console when I'm doing something like that)

<comment><USER35> Sounds like a lot more work than using a local solution.

<comment><USER34> Personally I don't feel that's true if you include the significantly increased amount of research necessary to even _find_ a decent local solution most of the time. Web apps are much more discoverable.

</comment></comment></comment></comment></comment><comment><USER36> More important than security issues, you are building a chain of dependencies that likely is undesirable. The service goes away, and you have to change your workflow -- less likely to happen with local software. Also less likely to happen with open source software than commercial software.

What if countries similarly tracked their dependencies on other countries and foreign companies, rather than just their budget? There are some trade-offs where you want to avoid dependency even if it is more costly. Recent scandals with constructs of selling water sources and public infrastructure to lease it back cheaper, comes to mind.

</comment><comment><USER37> I don't agree. I think online tools are great for quick-and-easy testing, and doesn't require any privacy issues. Mostly the benefit is ergonomics: I don't need to set up a bunch of stuff to do the thing I want, someone has done it because they had the exact same need.

The kind of thing I typically do with them:

\- Diff two files

\- Check brackets. JSON, jwt, that kind of thing

\- Run code snippets in a fiddle site

\- Regex

\- Unit converters, HEX/decimal calculators

\- Color pickers

In all cases, I'm using the tool before anything sensitive has been created. Why shouldn't I use a regex tool to figure out the exact string before I copy- paste it into my code? Or if I want to see if some particular little algorithm works, why not play around with it online, when an editor is already there and ready?

In any case, whatever I discover is part of a larger whole that was not set up in a way where this subproblem was going to be easy to test for, eg my particular use case may not make it easy to put a bunch of tests strings through regex.

<comment><USER38> I was boggling at how this could be tolerably efficient for someone, but I think I see it. My development workflow is terminal-centric, so copying out of the terminal to paste into a browser is extremely painful, whereas running 'diff', 'json_verify', etc. on local files or typing snippets into python/node/etc. from the shell is almost free. I suppose though if I were spending my day in VS Code or any kind of GUI IDE or similar, and if my workflow isn't optimized to pop open a unix shell with a keystroke for quick throwaway commands, it would be a lot easier just to C-a C-c alt-tab C-v from my GUI editor into a browser.

<comment><USER39> Pretty much. I use a mix of terminal and VS Code for development. Quite often I either don't have tools like json_verify, a hex/rgb code converter, jwt pretty printer, etc installed; or I can't remember what/how they're called. At which point its usually easier to slap it in a web search.

</comment></comment></comment><comment><USER40> Witnessing developers copy-paste code from their editor into textareas on webpages to do formatting/linting/etc induces the same kind of internal cringe-factor as when witnessing general computer users use the mouse for absolutely everything and knowing zero keyboard shortcuts.

Or to put it in contemporary terms:

Trigger Warning: Unoptimized Workflows

<comment><USER41> Cringe is one thing, but exposing data gets you walked out the front door. The two are worlds apart in terms of severity.

</comment></comment><comment><USER42> Completely unsurprised that this is coming from someone working at a bank. I saw a lot of the same working at another very large bank. Banks are extremely risk adverse in certain areas, such as using externally-hosted tooling. Certain areas of my employer, including where I worked, couldn't even use public cloud services. (And my area was additionally PCI, meaning that we also couldn't use our _internal_ cloud services...) It's to the point where they would rather risk the project or products success, over whatever their perceived risk using external hosting.

<comment><USER43> And yet I find that their security model is just backwards. They have myriads of rules like you can't email outside org and when people need to send something to others, they inadvertently find solutions which are less secure than email. My friend interned at a top bank as software developer and he got the response due to access requirement they can't give him any project.

</comment></comment><comment><USER44> [http://jsonprettyprint.net/](http://jsonprettyprint.net/) ranks high for "json pretty print" in Google and is an example where data hits their server.

<comment><USER45> Server-side-rending is sure not privat.

More on [http://jsonprettyprint.net/privacy](http://jsonprettyprint.net/privacy) \- well formated.

<comment><USER43> Pretty print privacy.

</comment></comment></comment><comment><USER46> I do enjoy this perspective from someone who says "I have no access to production data". Typically that is used as an excuse to not practice any security whatsoever, rather than as a side-note on a security heads-up!

I go back and forth on this all the time - easier access to production means faster development, but requires more discipline. Being able to reproduce production issues without production data takes a lot of engineering - <USER2> can be hard to justify when you're a tiny shop - when I was DevOps for 100 engineers it was certainly a much simpler time justification...

</comment><comment><USER47> Funny, I was just thinking about this the other day when I wanted to convert a bunch of JSON into YAML.

There were a number of online tools that did the conversion. The first thing I did was test them with dummy data to make sure it was fully client side and worked offline.

Can't be too safe if you're planning to run these tools on data that is protected by contract or NDA. Even if it's not, I still wouldn't want a third party site saving and potentially doing something with the data.

</comment><comment><USER48> I mean, as a dev for last 15 years, my rule of thumb is "don't trust the internet". Don't copy paste your code onto the internet, and don't copy paste internet's code into yours.

Also, another rule that helps, what's in production, stays in production. Don't copy paste things onto your machine, don't write things down in your notebook and don't even try sending it over the public internet.

</comment><comment><USER49> If you could sandbox part of the screen to say this thing is standalone and cannot perform any networking abilities and is cut off from everything else on the page that would be great.

The browser could recognise that tag and you get a safe space for people to copy/paste/interact with online web tools.

I'm pretty sure you can do this with WASM right now, but the browser doesn't inform the user that this is a safe space.

<comment><USER50> It's not exactly what you're describing and may be overkill, but you can definitely accomplish this with Qubes OS.

[https://www.qubes-os.org/intro/](https://www.qubes-os.org/intro/)

</comment></comment><comment><USER51> It sounded like the OP had some solid proof but eventually it boils down to "I'm suspicious".

It's a valid opinion just not an objective one

<comment><USER17> If there was proof it would be a different thread, but "don't paste credentials into websites you don't control" seems like great advice for life.

<comment><USER52> And if the app really is completely local to your browser like it says then make a copy and run it locally or on an internal web server for your whole team. Boom. No more "malicious updates" problem.

</comment></comment></comment><comment><USER53> While this article goes into the technical detail of how an attack from jwt.io to a developer might work, I think it most importantly leaves out what the potential threat actor in this threat model is, and what they hope to achieve. The actor would need to compromise jwt.io and use it to specifically target some developer (since the data is likely in localStorage).

This kind of attack is, I think very unlikely to happen because the costs vs potential rewards / risk are so poorly balanced. A jwt.io compromise is pretty hard, and you might get nothing from it!

That said, I agree with the idea that within the web security model, people should not be pasting security-critical data into sites! But I think this is more an issue of people having access to these security-critical keys than the sites themselves. After all, they could have downloaded a malicious binary, or their laptop could be stolen. People should not be put in a position where they have security critical keys on their clipboard.

</comment><comment><USER54> I agree with the author. I still think he makes some invalid points.

1\. "Although Non-Production, these are sensitive in of themselves, as they have implementation details for our services, and as mentioned, certain things could be used outside of Capital One."

Implementation details of your services shouldn't be a part of your security. Otherwise, you are relying on security by obscurity. I agree that you shouldn't necessarily share them publicly (if just for the sake of preventing people from relying on them as a public API), but declaring them as a security breach is far fetched (I'm assuming they are not actually relevant to your security).

2\. Many of the points that the author attributes to 3rd party services actually also apply to local tools, if they are downloaded by something like npm.

* it's not clear whether the code you are running is identical to the open source version of the code that you think you are running

* you have to trust a third party you have no relationship with

</comment><comment><USER55> I use these shell scripts for generating passwords. This uses bash.

      gen-pass(){
        gpg2 --armor --gen-random 1 15
      }
      gen-pass2(){
        openssl rand -base64 15
      }
      gen-pass3(){
        strings -n 1 < /dev/urandom | tr -d '[:space:]' | head -c15
        echo ""
      }

edit:formatting

</comment><comment><USER56> I've made internal tools for the exact thing, jwt inspection , which was a nice exercise and guarantees privacy. For things like JSON, using your editor/cli would be much faster. I'm not sure why a lot of developers don't add these integrations/learn the tools.

<comment><USER57> Because many users would rather not learn how to use 12 different cli commands. Many software dev can't even be bothered to learn how to copy/paste text content in the terminal or vim that spans longer than the screen.

A Web page makes things simpler, everyone has a browser. I built an internal web tool, replicated what the ones found on the Internet do, and developers in my organisation are using it daily.

</comment></comment><comment><USER58> I think that for identical reasons, browser extensions should be severely restricted on dev machines to a whitelist. I think it's crazy how so many developers install Chrome extensions managed by random anonymous people which often have broad permissions and which auto-update.

</comment><comment><USER59> I am constantly suspicious of all online tools. Every time I see someone paste a blob of customer data into an open browser tab to format the JSON I cringe; this is precisely the reason I spent a few hours to learn how to use `jq` efficiently.

</comment><comment> kalium-xyz Webapps like jwt.io run locally in your browser and you can monitor traffic, prevent further requests or even run them yourself to make sure of this. This post is misinformed at best.

<comment><USER25> did you validate that those sites do not batch data input over time and send them out, much later than your direct user input interactions?

<comment><USER60> Open in private window, set to offline in the console's network tab, do your thing, close the window. At least I'm not aware of a way the app could send or persist the data when you do that.

</comment></comment></comment><comment><USER61> Agree 100%. At my company, I've deployed the open source version of JSONLint.com internally to prevent any accidental exposure of internal or confidential data.

</comment><comment><USER62> It's always seemed to me that if someone at Google were to look at the terms entered into chrome from my company it would probably have a shocking amount of proprietary information - plans, costs, passwords etc. It's not exactly the same online tooling that the author is talking about, but anything going into your browser is probably going somewhere you can't truly trust.

</comment><comment><USER63> Some people at certain lines of work must use computers that cannot connect to the internet at all. This should not be a surprise to anyone.

</comment><comment><USER64> For me, it's more about workflow than anything. Its much faster to run some json through `jq` than it is to reach for my mouse, switch to my browser, open a tab and google for json validator, try to find a decent one, then try to copy and paste a huge file over.

If you spend all your time in the browser anyway, it might be different for you.

</comment><comment><USER65> This is an area where github pages shines. Unless my threat model includes github colluding with the website to steal secrets (it usually doesn't), I can check the source of a tool once and later be able to view only patches, with a guarantee that the source I see is what's actually running.

(I work at msft)

</comment><comment><USER66> This was a great read and I definitely agree with the author that you have to be careful about data that you post online. This is a reason why I've created Polypad ([https://mattebot.co/polypad](https://mattebot.co/polypad))

</comment><comment><USER67> If I made a list of the programs people should not be using online, some dinky data format validator would probably be among the last priorities on it, probably somewhere just above an online converter between l/100km and mpg, or an online egg timer. Pick your battles and all that.

</comment><comment><USER68> I am now motivated to set up local tooling that is as easy to use as online tooling. I've been nervous at times about pasting data, and usually triple- check first, but that itself takes time, and one day I might be in such a hurry I don't take it.

Better to establish good habits now.

<comment><USER68> Yesterday, I created a python script to reproduce jwt.io, so thanks for the motivation!

</comment></comment><comment><USER69> Even if JWT.io does everything on the up and up, if that site is compromised then every single user that pastes their token is as well. If I was a malicious actor, that's a site I would target first. We should use trusted local utilities to decode these tokens.

</comment><comment><USER70> Is there a good resource for finding terminal replacements for online tooling?

<comment><USER19> I'm happy to write blog posts for local alternatives to online tooling if you can share things you'd want

</comment></comment><comment><USER71> I use python -mjson.tool to validate JSON. And JQ to query it.

TLDR Don't use online services, you have no idea what they're doing with your data and if they run the open source version they say they do.

<comment><USER72> Or rather like with most online services, only feed them data you're comfortable with being shared to everyone.

</comment></comment><comment><USER19> Previous discussion: [https://news.ycombinator.com/item?id=24342063](https://news.ycombinator.com/item?id=24342063)

</comment><comment><USER73> Someone offline stack overflow for me before I paste half our source into it.

Agree with the author btw, just like the idea of taking it to a really far fetched conclusion.

</comment><comment><USER74> I use jwt.ms Validation is done in javascript and as it says "data never leaves the browser"

</comment><comment><USER75> 1 - Stop using JWTs would be a better first step, go to [https://paseto.io](https://paseto.io)

2 - Look at the network tab, see anything leaving your browser, websockets whatever ? if not, it's probably fine

</comment><comment><USER76> For VIM users:

%!python -m json.tool

</comment><comment><USER77> Tldr: security risk

</comment><comment><USER78> What's a good open source JSON viewer GUI (or TUI) with Linux support (with collapsing trees, searching, filtering, diff, etc)?

I had these exact same concerns last time I was trying to look for one. I found some online JSON tools and could use them for simple things. But I hated putting the JSON I was working on into some 3rd party website, even if it didn't contain anything sensitiveness.

I try to use jq whenever I can on the command line, but having good, local, visual tools (that aren't plugins to web browser or filled with electron cancer) would be nice.

<comment><USER35> Firefox has a pretty nice viewer that does searching, filtering and node collapsing

JQ will do the filtering / searching if you need anything advanced.

I've never searched for a json diff utility.

</comment></comment><comment><USER79> Considering that user agents are far more powerful than servers if you divide their power by the number of users, and considering that we have WASM now, one should wonder why these tools even need to run on a server.</comment>


What America looked like before the EPA, in photos - <AUTHOR> https://kottke.org/18/03/what-america-looked-like-before-the-epa-in-photos <comment><USER2> Hey all, we need to go meta for a sec and talk about why this article doesn't belong here, and how culturally this is a step in the wrong direction for HN.

First off, this is blogspam, the original Popular Science article is a bit better. There's a reason blogspam is discouraged by the guidelines.

More importantly, this is a particularly pernicious blogspam because the selected photos (atlas, burning boat, water glass) mostly illustrate problems that have comparables right now. It excludes the smog and coal burning illustrated in Popular Science that do a better job at illustrating both pollution and the EPA's achievements.

These problems make this article a poor fit for Hacker News. I think we should be all sad to see such an intellectually empty article ranked this highly.

<comment><USER3> Also on the meta front, I don't actually see any discussion of the pictures themselves. For example, I can't figure out what the problem with the Atlas Chemical Company is by inspection - that looks a lot like industrial levels of water vapour.

Only in the mine water example do I see what the issue is clearly. The discussion seems to have gone straight to related political issues and the broader environment. Interesting, but the article isn't being discussed.

<comment><USER4> Those stacks aren't popping out water vapour. Check the size of the stacks and the factory - there's no scrubbers or fractionation columns preprocessing the waste gasses.

Paper mills are very polluting enterprises - the water you're seeing is a thin sheet with a mostly laminar flow. It is opaque. This is not normal. The level of waste solutes in the raw ejecta is absurdly high, and is comprised of decomposed organic material & high oxygen content which leads to algal blooms, bleaches, heavy metals, chelating agents, etc.

I think the burning barge is pretty self explanatory.

<comment><USER5> _"I think the burning barge is pretty self explanatory."_

Is it? The photo doesn't tell whether that was something that happened regularly, and stuff like that happens today, too.

[https://www.fleetmon.com/maritime- news/?category=incidents](https://www.fleetmon.com/maritime- news/?category=incidents) taught me that the Maersk Honam (built in 2017; can hold over 15,000 TEU) caught fire on March 6 and was evacuated. Worse, that doesn't seem to be that exceptionally. [http://www.seatrade- maritime.com/news/europe/maersk-honam-jo...](http://www.seatrade- maritime.com/news/europe/maersk-honam-joins-a-growing-list-of-horrific- containership-fires.html) lists about one every year.

</comment></comment></comment></comment><comment><USER6> When I was younger, I honestly believed in the explanation that left to their own devices, free enterprise will work to protect the environment, as anything that hurts the market will hurt profits. What I didn't take into account was that this argument doesn't work for enterprises run by beings with limited lifespans. All except the most empathic humans will not incur any cost to avoid consequences that are beyond their lifespans (or, in some cases, beyond their immediate offsprings' lifespans). That is why I believe that Adam Smith's invisible hand will fail to help the environment...

<comment><USER7> On the contrary. Give property rights to everything and individuals and corporations will have every incentive to protect what they own, be it environmental resources or anything else.

<comment><USER8> Corporations have incentives to maximize short-term profits at the sacrifice of environmental resources and common decency (dump the chemical waste in the river and pay your employees the lowest possible wage).

This obviously means the company will quickly run out of resources and employees but depending on the severity of the deployed sacrifice, this can take decades, a time span that corporations have shown on several occasions to not care about.

<comment><USER7> My point was, make the river a private resource worth money to some organization or someone, and they will fight that corporation where it matters. Counter-balancing incentives work best, and we have already seen this kind of system work better than regulations.

<comment><USER8> As a public utility, the river is worth money to the government. If it goes to waste, less people will be able to use it to make money, which leads to less taxes.

Any agency brought up to protect the environment has per it's mission an incentive to protect the environment and doesn't suffer the problems of a corporation, namely limited funding. A government agency doesn't need to make profit to receive lots of funding if it's important enough.

</comment></comment></comment></comment></comment><comment><USER9> It's unfortunate that the EPA is under attack by conservatives who want limited government. If you start from first principles about what the min viable government should do, a big part of its charter would be to prevent major tragedies of the commons. And the environment is a textbook example of something that'd suffer the tragedy of the commons without government oversight.

I prefer a bigger government with a bigger social safety net with universal basic healthcare, etc. But I can understand conservative opposition to that; at least those don't produce tragedies of the commons. (They arguably do to a lesser extent: if people's basic needs are met, they're less likely to resort to crime to fulfill them. And a greater rate of crime is a tragedy for all; ask anyone who's paid a premium to live in a "safe" neighborhood.)

<comment><USER10> On the other hand, does the EPA really require 8 billion dollars per year when the protection laws have already been passed and improvements have already been made?

In a software project, you allocate $x per month during development, and only $(x/10) for maintenance after it has shipped. Is there a point where the EPA can say "mission accomplished" and downsize to maintenance/enforcement mode, or is this just a typical government organization that will happily consume as many tax dollars as it can get as long as it can?

<comment><USER11> Yes it does, due to the structure of the environmental laws.

In a libertarian system, you'd simply ban pollution (I.e. ban the externalizations of environmental costs), and then let the market and the courts hash things out. If a company was found dumping pollutants into the water, people would sue them, and the costs of all of that would get properly priced into the company's products.

But the environmental laws are all about the various ways in which companies _are allowed to pollute._ Companies can dump poison into rivers, so long as they conform the EPA limits. Those limits are, by design, not set any "correct" level (as above, the "correct" level is zero—forcing the externality to be fully internalized; from an economic efficiency point of view, all environmental externalities must be borne by parties to the transaction, either the company or its customers). Instead, the limits are of a "best effort" nature, and a "how to get there from here" nature. For example, the law requires air polluters to install "the best available control technology" on smoke stacks. What does that mean? Well, that requires continual review and revision.

The EPA doesn't exist to enforce laws that prevent pollution. It exists to _manage_ all the pollution that the law allows.

<comment><USER12> "Banning" pollution is not realistic. Any economy of this scale is going to produce pollution. And while some technologies like fossil fuels are worse then others, there is no pollution solution. So the best the EPA can do it manange the pollution we do create to mitigate the harms.

<comment><USER11> That's the point. In an idealized economic abstraction, banning pollution (more accurately, creating a cause of action for damages in connection with any level of pollution) would force the cost to be internalized. You can let phosphorous from your farm leach into the river, but any downstream property owners can sue you for reducing their property values by causing algal blooms. If the value created by your farm exceeds the externalized cost of pollution, you keep your farm, pay off the property owners, and pass the costs of that into people who buy your meat and vegetables. When the costs of pollution are priced into those products, the market will properly balance the benefits of farm products against the harms of farm pollution.

But that's wildly impractical. Hence the existence of the EPA, which is tasked with managing pollution, and using central planning to balance the benefits of productive activity against the harms of pollution.

</comment></comment></comment></comment></comment><comment><USER13> It's important to tell a balanced story. _Parts_ of America was like this. _Most_ of it was not.

Civil suits failed to curb industrial emissions in built-up areas, which then spilled over everywhere else. The EPA was a godsend.

I didn't understand the problem until the first time I visited L.A. Wow, what a mess. The air was so thick. It was disgusting.

It's amazing the progress we have made. But the EPA, like so many other agencies (I'm looking at you, TSA) is an agency without a limiting factor. You come up with a devil, you pass a bunch of rules, then you spend the next few years issuing press releases about how you're saving the world.

What's happened to American politics in many areas is that there are no feedback loops. When I look at the smog in LA back in the day and how the skies look now? That's a feedback loop. My government is doing something I want them to do. But when they talk about parts per billion versus parts per trillion? It's not evidently clear to me as a voter that we're not just continuing to expand our empire, just like the rest of the agencies.

I love what the EPA has done and I support them. But without some kind of limiting feedback loop my support really doesn't mean much. It's just a platitude. I don't support any agency that just runs off on their own taking more and more control over things for reasons I don't understand (or reasons I do understand but disagree with.)

So sure, EPA yay! So what the hell does that actually mean?

ADD: No matter what the group, big corporate governance groups, local town councils, Non-profit boards, or federal agencies, _political groups exist for political reasons_. We may laud their goals and love some of the things they've done, but when you are chartered because politics, and you get funding because politics, and people love or hate you because politics -- your primary concern is political. That's not a knock on anybody, that's just the logic of how these things work.

<comment><USER14> yes, how awful it would be if you ended up with _too much_ environmental protection

<comment><USER15> Environmental protection isn't free, but comes at an economic cost. Too much for the benefits and you will have a net loss.

</comment></comment></comment><comment><USER16> Americans love their freedom. Which is more important: the freedom of corporations to innovate in extracting natural resources, or the freedom of citizens to pursue happiness without being poisoned by drinking water?

The last photo on that page shows Mary Workman holding a glass of well water that the Hanna Coal Company rendered undrinkable. Something to remember for those who pine for the days of "great coal jobs" and that unrestricted American entrepreneurial spirit of the 1950s.

<comment><USER17> Not to take away from the broader point (I think the EPA and like organisations are very important), but would Workman not have recourse through other means (e.g. under nuisance)?

<comment><USER16> Recourse after the fact will move some amount of dollars from one bank account to another, but it won't restore destroyed environments and ruined health. Life is hard to replace, money isn't.

</comment></comment></comment><comment><USER18> The original quote by Alanis Obomsawin, an Abenaki from the Odanak reserve, was about Canada:

"Canada, the most affluent of countries, operates on a depletion economy which leaves destruction in its wake. Your people are driven by a terrible sense of deficiency. _When the last tree is cut, the last fish is caught, and the last river is polluted; when to breathe the air is sickening, you will realize, too late, that wealth is not in bank accounts and that you can't eat money._ "

</comment><comment><USER19> I lived then and these pictures are very shallow and only show a little of what things were like. They should show things like Fishkill, NY, and how we would dump trash out in the sea, how every area had an impromptu dump down by the river where old mattresses and wash machines ended up and took decades to clean up, where people thought it was OK to dump their auto oil directly onto the ground, massive exposed unlined dumps where auto and household chemicals would leak eventually into aquifers, companies dumping things like chrome plating, benzene enough it floated on drinking aquifer (see Love Canal, etc.), where a guy thought it OK to buy medical waste and bury hundreds of the barrels in his back yard "because it was _his_ land", or along Lake Erie where you could not even get near it from stink of dead Alewives(arguably man-made). The environment was worse than they portray in this pictorial.

<comment><USER20> I live in Van Nuys, CA, where the aerospace industry used to have manufacturing. Three blocks from me is the "great little bike path" that stretches the length of the valley. Guess what? That bike path is a paved over Superfund site. All of Van Nuys has toxic earth 6" to 10" down. I refuse to eat any fruit or vegetables grown in the area, while everyone around me thinks I'm being paranoid.

</comment></comment><comment><USER21> If you follow some links, you can find the whole collection (15000 images!):

Documentation project overview: [https://catalog.archives.gov/id/542493](https://catalog.archives.gov/id/542493)

Archive contents: [https://catalog.archives.gov/search?q=*:*&f.parentNaId=54249...](https://catalog.archives.gov/search?q=*:*&f.parentNaId=542493&f.level=item&sort=naIdSort%20asc)

Link to the original PopSci article: [https://www.popsci.com/america-before- epa-photos](https://www.popsci.com/america-before-epa-photos)

Traveling outside the US (been moving around for almost 5 years now) has opened my eyes to the value of some of the consumer/environmental/etc protection/safety agencies/laws in the US that I didn't appreciate before.

Some examples not necessarily related to the EPA:

\- Auto emissions regulations (or lack thereof)

\- Waste disposal (e.g. burning trash on the side of the road or dumping trash in public places)

\- Worksite safety (ever see a worker on a commercial build site wearing flip- flops two stories up on a rickety wood scaffold held together by twine, welding with no protective gear?)

\- Building codes, both for safety and accessibility

\- Marketing spam (depending on location, I'll get a handful of marketing sms a day - I have a newfound appreciation for CAN-SPAM[1])

You can argue that certain regulations go too far or maybe they don't go far enough, and those are important question to ask.

However, and this photo-documentary project underlines this, I've personally come to the conclusion that the importance of environmental regulations can't be understated. It affects the lives of literally everyone, in a "the air I breathe" and "the water I drink" and "the food I eat" and "the space I occupy" kind of way.

[1] [https://www.fcc.gov/general/can-spam](https://www.fcc.gov/general/can- spam)

<comment><USER22> Thanks for digging up the links, really awesome collection of photos.

</comment></comment><comment><USER23> The next battle is plastic. Consumers and corporations both love the convenience but we cannot go on producing endless steams of virtually unrecyclable, non biodegradable waste from a finite resource.

Difficulty mixed with opportunity.

</comment><comment><USER24> After EPA : [https://upload.wikimedia.org/wikipedia/commons/thumb/d/d5/An...](https://upload.wikimedia.org/wikipedia/commons/thumb/d/d5/Animas_River_spill_2015-08-06.JPG/1280px- Animas_River_spill_2015-08-06.JPG)

<comment><USER25> [https://en.wikipedia.org/wiki/2015_Gold_King_Mine_waste_wate...](https://en.wikipedia.org/wiki/2015_Gold_King_Mine_waste_water_spill)

The EPA didn't create this mess. They did screw up handling it, however. What happened was that the EPA accidentally released the waste products from an abandoned mine that had been accumulating in a reservoir for decades _all at once_. What do you think would have happened without any regulation at all? That shit would _already_ be everywhere.

<comment><USER26> Well, for one think it'd have been diluted over the course of decades rather than all being released at once. That would have been far better for the environment.

<comment><USER25> Well, no. The plan with capturing and concentrating the waste is to then treat said waste and dispose of it properly so that it doesn't enter the ecosystem _at all_. Dispersing it slowly over time is like slow death: it all accumulates eventually, since arsenic, lead, and other toxins don't just evaporate into nothingness.

</comment></comment></comment></comment><comment><USER27> The direction of causality presumed in the title is mixed up. The EPA did not materialize in a vacuum. It came about in a context of increased concern about pollution which had exceeded tolerable levels _AND_ the U.S. had grown to the point where the country as a whole was wealthy enough to care about such things. Because enough people wanted less pollution, the politicians did something.

What they did was not necessarily the "best" thing. The title of the post should have been "What America looked like before the enough Americans began caring for the environment, in photos".

PS: I grew up in a really polluted city.

</comment><comment><USER28> I've never really understood why conservatives are so reluctant to look after their environment, after all they get to live in it as well.

<comment><USER29> They aren't reluctant, but you have to speak their language. You may be eager to see a government agency placing limits on businesses, but that won't go over well at all.

A better approach is to speak in terms of paying for what you damage. The economy matters, and you have to break a few eggs to make an omelet... but you pay for anything you break.

So you end up charging a price, preferably to be paid to those who are affected, and the market responds by cutting pollution. It's almost like fine or cap-and-trade, but without the arbitrary limit that would cause offense. The result may even be better, since you won't always end up exactly at the limit.

Tainting and spoiling are usually bad to the conservative mindset, but watch out for property rights. You get to mess up your own stuff. If you bought it and you own it, you can ruin it. Arguing for restrictions that infringe on a person's property won't get you very far at all.

<comment><USER30> But what affects just one's own property vs affecting others? Can I dump toxic waste on my own land? What happens when 10 years later it starts leaching into the soil and poisoning nearby streams and farms? What about the animals who eat on my land and then run back into the forest where they get shot for someone else's dinner, and that someone else ends up consuming elevated levels of heavy metals? What about the person who buys the land from me? Do I have to disclose the presence of the waste to them?

<comment><USER31> > Can I dump toxic waste on my own land?

Sure, it's your land.

> What happens when 10 years later it starts leaching into the soil and > poisoning nearby streams and farms?

Those impacted landowners now have a tort claim against you, which they should pursue.

> What about the animals who eat on my land and then run back into the forest > where they get shot for someone else's dinner, and that someone else ends up > consuming elevated levels of heavy metals?

They now have a tort claim against you, which they should pursue.

> What about the person who buys the land from me? Do I have to disclose the > presence of the waste to them?

Yes, you should. If you don't, the purchaser now has a tort claim against you, which they should pursue.

\---

I know I'm being a bit trite with the above, but I mean no offense. The difference here is one of strategy, not base ideas. I (and other libertarians) believe that people who harm others through their action should be responsible for that harm. Proponents of the EPA believe that people should be limited by government regulation to a minimal level of harm.

I'll also grant that, prior to the EPA, the tort system in the US was ineffective at resolving these issues. I don't believe that was a problem with the process itself; it was (and remains) a problem with the courts.

<comment><USER19> We already tried this (ex. gasoline stations) and it doesn't work: there is no way someone who pollutes an entire aquifer with barrels of toxin can be made to financially or mechanically remediate it. It always falls upon the government to do so.

<comment><USER29> Requiring payment in advance solves most of that. The rest isn't solved by any current or proposed idea; some people will just be sneaky.

</comment></comment></comment></comment></comment></comment><comment><USER32> Living in Vietnam like my family does, I think about this frequently. Asian countries suffer from some of these same industrial problems that the West suffered from a generation ago. It isn't clear to me if these are problems that we've collectively just offshored to more developing nations, but there does seem to be a pattern as (Tiger in the modern case) economies industrialize and reach a certain hard-working xenith.

</comment><comment><USER30> That's without even showing the Cuyahoga river burning, the oil slicks and dead animals in Newtown Creek, or any superfund sites.

<comment><USER33> Yeah, I was really expecting either Cuyahoga or the infamous "Valley of the Drums" with leaking barrels of toxic waste

[http://bullittcountyhistory.org/bchistory/valleydrum.html](http://bullittcountyhistory.org/bchistory/valleydrum.html)

</comment></comment><comment><USER34> Please link to at least the popular science article which has more than three photos.

</comment><comment><USER35> I realize that HN generally skews left politically, but this is literally nothing more than a puff piece. There's nothing of value here.

<comment><USER36> Wait, what makes the EPA a left thing? It was proposed by Richard Nixon.

<comment><USER31> It has certainly been politicized, by both sides. The Democrats have used it as a tool to regulate industry to accomplish political aims, and the Republicans have used it as a symbolic scapegoat of the Democrats.

"The EPA" !== "environmental protection". It's a government agency, with all the baggage that goes along with it. One can be opposed to the very existence of the EPA while still being strongly supportive if its nominal mission.

</comment></comment></comment><comment><USER37> notice all the beautiful yellow flowers next to the horse. the good times before monsanto, bayer et al

</comment><comment><USER38> This is not because of EPA but because of humans who have more prosperity and start caring and having the political power to care about their environment.

The EPA is an expression of that and for a while when there were things that were objectively problematic in the USA it was a great organization.

Today I am not so sure as I think it's been too politicized.

There is an interesting debate about it here:

[https://www.intelligencesquaredus.org/debates/climate- change...](https://www.intelligencesquaredus.org/debates/climate-change-epa- has-gone-overboard)

</comment><comment><USER39> This is sort of a contentless post.

Certainly the EPA performs a valid role, however that is not to say that any attempts to constrain its increasing creep of scope and overreach of power is automatically _bad_.

Is it possible to find pictures from the late 60s showing pristine beautiful nature shots?

Is it possible to find pictures from late 60s showing clean and tidy small town streets?

Is it possible to find pictures from 2018 showing residents holding dirty water (ie. Flint, Michigan)?

Is it possible to find pictures from 2018 of dirty filthy slums?

Therefore, whats really the message? Let me guess....someone wants more money for their budget?

<comment><USER18> Are we on a sustainable path? Should the EPA get more money or less? Right now they are getting a 25% cut. The reduction in regulations will help big corporations, it may even create a few jobs, but it's not in the best interest of the general public, including future generations.

<comment><USER31> > Are we on a sustainable path? Should the EPA get more money or less? Right > now they are getting a 25% cut.

From my perspective, _everything_ in government should get less money. It's not so much a statement against the EPA as it is a statement that the federal government in particular is an order of magnitude too large and powerful.

> it's not in the best interest of the general public, including future > generations.

I get where you're coming from, and sympathize with your position - but you've not supported this statement. _How_ would cutting the EPA budget hurt us long- term? Can those effects be mitigated through other, less costly policies?</comment></comment></comment>


A couple GC algorithms in more detail - <AUTHOR> http://useless-factor.blogspot.com/2008/05/couple-gc-algorithms-in-more-detail.html

<comment><USER2> There's one question that's puzzled me for a long time: Why aren't there many (any) precise compacting GCs out there, at least in F/OSS software? Do these generally turn out to be a bad idea or something? The only one I've found so far is Mono's experimental GC.

<comment><USER3> It is really hard to write a generic precise GC (knows and follows object structure) that you can open source because every project that would want to use it has a different object structure. So pretty much every one has to be written from scratch. It is cheap and easy to throw in a conservative GC. It just isn't as good.

Squeak and the other smalltalks pretty much all have precise GCs. I'm not as familiar with the GC systems in the lisps, but I'd guess that they're all precise because the memory structures are so damn simple/clean. It is the scripting languages that start to fall down. Perl used reference counting for years, prolly still does; same with python. Ruby has a mark/sweep conservative. But hey, they work well enough. _shrug_

<comment><USER2> Hmm, I don't think it would be that hard to design a flexible yet efficient interface for specifying object and vtable layouts. Yes, it would create some restrictions on the clients of the GC, but I don't think they'd have to be particularly severe.</comment></comment></comment>


It's Okay to "Forget" What You Read - <AUTHOR> https://medium.com/the-polymath-project/its-okay-to-forget-what-you-read-f4ef1c34cc01 <comment><USER2> _> So read always from authors of proven worth [Seneca]_

Absolutely. The few authors that I love the best are streets ahead of the rest. Reading other authors is for me really just a search for the Next Big Thing. As time marches on, re-reading old favourites rises in value relative to reading new stuff, on average.

 _> Though our eyes may pass over all of the words and our hands may flip through all of the pages, what we read is never the entire book_

The idea that reading is encompassed by the eyes zig-zagging down the page like a raster scan is an example of the 'bucket theory' of the mind, as Karl Popper put it. This is where knowledge supposedly pours into the brain passively via the senses. Which is a fallacy.

 _> If I read for pure pleasure, what harm is there in forgetting?_

This is also the reason I've never seriously tried to _speed read_. Perhaps I'm mistaken about this, but why wolf down an expensive meal? There's nothing to be lost from optimising pleasure since it derives from the meaning i.e. from the true content.

 _> When we read, certain notable phrases, concepts and ideas [...] stand out more clearly from the others._

Oh yes. This is the _Searchlight Theory_ of the mind, where our attention is continually homing onto the most interesting or semantically useful bit of whatever we are doing.

<comment><USER3> It makes me think of Darwin's journals, where you can see him picking up on useful little tidbits from the stuff he's read and observed. His reading of Malthus was a major influence on his development of natural selection theory, but it's not like Origin of Species is a Malthusian tract. Exposure to other people's thoughts helps create our own thoughts.

There's a great many scientists and philosophers who were wrong about things but who provided the structure and patterns necessary for later thinkers. From Plato and Aristotle to Smith, Marx, Nietzsche, and Freud...

<comment><USER4> Interestingly, Wallace was also inspired by Malthus in his own co-discovery of evolution.

</comment></comment></comment><comment><USER5> For me the following quote from Paul Graham's essay has struck a chord: _For example, reading and experience are usually "compiled" at the time they happen, using the state of your brain at that time. The same book would get compiled differently at different points in your life._

It's changed how I read books. I used to feel that if I needed to re-read a book I did something wrong the first time – now I read a book again after some time just to get a different perspective of the book. It's the same thing that happens the second time you watch a movie: you notice details that you missed the first time around.

<comment><USER6> I also noticed this with books. My impression is that the same book can be called "great" by one person and "boring" or "uninteresting" by another, and it says really more about those people in relation to the book at that point in their lives, than about the book itself. It can show you what developmental stage these people are in.

For some, reading a simple book on emotions will be a game changer, while for others it will be stating the obvious and they won't even read more than a chapter or two, deciding that the book was too basic or even "bad".

I've developed a habit of buying and beginning a lot of books, but many I discard or set aside for the future. Few books seem "too basic" for me, with many I sense that their time is yet to come, or their utility at this point in my life is unclear.

BTW I have the same experience with movies; some of them have a great number of really interesting detail that I often miss the first time around.

</comment></comment><comment><USER7> This reminded of a nice little book by Pierre Bayard called _" How to Talk About Books You Haven't Read"_, which actually dedicates part of itself not to books which the reader hasn't actually read, but to those which he might have forgotten. Unfortunately, I've forgotten much of the rest of the book, so I really can't say much more about it.

Still recommend it, though.

<comment><USER8> Talking about a book you haven't read shouldn't be too difficult. Just ask a lot of questions and pursue the interesting answers. Convincingly passing yourself off as having read the book when you haven't, is probably more difficult, but would depend on how deep the discussion gets.

</comment></comment><comment><USER9> Eh, you still forget 90% of everything you ever read, or just plain learn, and that includes the models you get from reading books about the crusade.

If you want to retain anything in more than vague details, you need to intensively practice and study.

That is not to say you should practice and study everything in intense details. There's only so many hours to practice being a world class programmer and then something else.

It's fine to be an average driver, an average cook, average almost anything.

But if you want anymore than an average result, you're going to need to invest more than average effort.

<comment><USER10> If you're reading books for the details, you're doing it wrong.

Read books for ideas. You can always look at the book for reference when you forget the details.

I despair for the people who are taught that learning is about memorizing facts. Ideas are far more powerful than facts and a heck of a lot harder to lookup.

<comment><USER9> Learning is certainly about memorizing, whether that's facts or ideas or skills.

<comment><USER11> Learning is about changing the way we think and perceive. This is not best done through memorization.

Facts are important, however I would argue that the different conceptualizations of ideas and the relationships between them are far more important.

<comment><USER12> > _Learning is about changing the way we think and perceive. This is not best > done through memorization._

Unless it has left a permanent mark in our memory, there's no "changing in the way we think and perceive".

<comment><USER13> Very next sentence after the quoted material begins with "Facts ..."; i.e. the comment is about the memorization of facts specifically (perhaps the same thing we call "rote learning"), not about "memorization" being any kind of enduring state change in the memory.

</comment></comment></comment></comment></comment></comment><comment><USER14> I used to stress about this until I came across this quote:

"I cannot remember the books I've read any more than the meals I have eaten; even so, they have made me."—Ralph Waldo Emerson

Even if you don't have a photographic memory, reading changes our perspective in important ways.

<comment><USER15> This is both a blessing and a curse. I'm always afraid that I will read false or unreliable things, actually recognise it for what it is, but still have it linger in my brain enough that I will believe it in the future...

<comment><USER16> In fact a number of psychological studies have found that people will remember false information as true if you tell it to them and then immediately explain it is false. At least that's how I remember it. :)

<comment><USER17> I really hope that the other direction gives the desired result.

<comment><USER16> That seems doubtful.

</comment></comment></comment></comment></comment><comment><USER18> _"However, for the man who studies to gain insight, books and studies are merely rungs of the ladder on which he climbs to the summit of knowledge. As soon as a rung has raised him up one step, he leaves it behind. On the other hand, the many who study in order to fill their memory do not use the rungs of the ladder for climbing, but take them off and load themselves with them to take away, rejoicing at the increasing weight of the burden. They remain below forever, because they bear what should have bourne them."_

As comrade Schopenhauer put it ( [https://www.goodreads.com/quotes/301471-however-for-the- man-...](https://www.goodreads.com/quotes/301471-however-for-the-man-who- studies-to-gain-insight-books) )

Later, Wittgenstein echoed that item - [https://en.wikipedia.org/wiki/Wittgenstein%27s_ladder](https://en.wikipedia.org/wiki/Wittgenstein%27s_ladder)

<comment><USER19> Schopenhauer was not a socialist.

<comment><USER18> Picked up that habit from P.G.Wodehouse's comrade Psmith.

A harmless affectation. No real socialism involved.

</comment></comment></comment><comment><USER20> Books are like lovers. They change you, even if you don't recall the particulars.

<comment><USER21> I've quarrelled extensively with both.

</comment></comment><comment><USER22> I think it was interesting how it was talking about getting different things from the same book at different points in your life.

That's certainly how it went for me with the Silmarillion. I read it at 16 just after I had come off of reading Lord of the Rings and it was extremely boring. I read it again at 30 and I found it to be quite interesting. The book hadn't changed, but I had.

<comment><USER23> I've also found that to be true with movies. When I first watched Jaws 15 years ago, I thought it was boring and slow. I recently watched it again and loved every minute of it. The dialog, characters, and building tension was fantastic. I almost felt like I could smell the beach and the boats.

<comment><USER24> I have watched Apocalypto 3 times with a difference of 3-4 years. Each time I felt I was watching a completely different movie. Last time I watched it I saw it as a masterpiece in film art.

<comment><USER23> Yeah? I need to put it in my queue and give it another try.

</comment></comment></comment></comment><comment><USER25> Well that's a relief. They are talking about books, but I suppose it applies to all the time we 'waste' on HN and other news sites too.

<comment><USER26> that's one reason why I really like [https://archive.org/](https://archive.org/) and other similar projects

</comment></comment><comment><USER27> If you want to learn how to program, surely you would go asking the software engineering community how to do it? But rarely do we pay attention to how the people who're serious about reading and writing say you're actually supposed to read. I thought I knew how to read a book. But then I read the Well- Educated Mind and realized that I had went about it all wrong. English majors read books way differently than most people do. It is crucially important for retention and understanding of a book to actually write down thorough notes about it.

<comment><USER28> Thanks for the book recommendation. I'm going to check it out.

<comment><USER29> Just from looking at the description, it seems to cover the same territory as Mortimer Adler's _How to Read a Book_.

I'd read Adler's book first, but reading two different presentations of what might be the same idea is better than reading only one.

</comment></comment></comment><comment><USER16> I should hope so or I'd need to stop reading.

Incidentally, Sherlock Holmes never said "elementary, my dear Watson."

</comment><comment><USER30> Everywhere when there is a context about reading.. Ppl talk only about physical books, doesn't the same ideology apply for an article that you read online.. Be it HN articles? I even forget from what I read in HN.

<comment><USER31> It depends. When you read, you're approaching a well to drink the knowledge therein. When you're approaching a place that streams- HN, reddit, twitter- you're approaching a river.

You approach rivers and wells differently, and so you probably forget books and "flow"-based articles differently.

</comment></comment><comment><USER32> On re-reading books:

The first time I read Infinite Jest by David Foster Wallace I found myself unable to determine what was Important for much of the first few hundred pages. None of it made sense and I couldn't figure out what The Point of the book was. I kind of read the pages but didn't really take any of it in.

The second time I read it was a completely different experience: those first pages immediately made sense, and I derived a sense of pleasure in reading them that I didn't have the first time around.

<comment><USER27> Tangentially, I've had a similar experience when teaching myself some areas of pure mathematics via books. The first time around I had a hard time figuring out which theorems were significant and worth more attention than others. The second time around the most important ones were a lot more obvious.

</comment></comment><comment><USER33> That information reshapes your brain is something I think that most of the people on this site and reading my comment understand. Johnny 5 said it best - INPUT

</comment><comment><USER34> A lot of comments in this thread make it sound like if you're not going to perform rote memorization of what you read then it's not worth reading at all. Learning is more than memorization. To simply write-off all knowledge as just regurgitating facts is exactly what's wrong with the modern education system. Read for the sake of reading, explore new ideas and grow.

</comment><comment><USER35> Honestly, this makes sense to me too, but what scientific evidence is there of reading creating/affecting mental models for people? The article seemed like a lot of opinion, but not much evidence.

When I listen to audiobooks or read for personal development or business, I make an effort to apply things I've learned from the books to derive value.

</comment><comment><USER36> I noticed that if I read a book, I don't understand it immediately truly deeply. Some sort of analysis happens and then after few months or even years my mentality becomes different and I start to think in a different way. So it takes time to build a different mentality by reading books.

</comment><comment><USER37> Wasn't this story on here last week?

</comment><comment><USER38> I posted this 5 days ago, why does HN not pick it up as a duplicate?

[https://news.ycombinator.com/item?id=15111163](https://news.ycombinator.com/item?id=15111163)

<comment><USER39> Sorry yours didn't get any attention! It's mostly up to chance, so the software lets through resubmissions of earlier posts that are too old to save but didn't get any discussion.

<comment><USER38> Maybe the time stamp on the original post should just get updated in case of a re-submission of a previously unsuccessful post. The community deserves to get information quickly and there should be only one thread per post to avoid redundant arguments)

</comment></comment></comment><comment><USER40> Or maybe, just maybe, non-fiction books(not textbooks) are a terrible medium to learn anything, in light of what we know of how memory works ,and in light of various knowledge management technologies, which don't work terribly well with books ?

And books only exist because they are the lowest common denominator for someone to share an idea, and they are a good form of entertainment, similar to facebook posts ?</comment>


Humans Not Off the Hook for Megafauna Extinction - <AUTHOR> http://news.discovery.com/animals/did-humans-kill-the-megafauna-13092.htm <comment><AUTHOR> another article of theirs about an earlier study: [http://news.discovery.com/earth/weather-extreme- events/human...](http://news.discovery.com/earth/weather-extreme- events/humans-acquitted-of-mammoth-murder-130912.htm)</comment>


Out of Chaos, Order. Or So Google Says.  - <AUTHOR> http://www.nytimes.com/2007/05/11/technology/11google.html?ref=technology <comment><AUTHOR> Seems like Google is beginning to do what they said they wouldn't in their statement at their IPO, which is bend to the short-term demands of shareholders.</comment>


Customers connecting to our website having connectivity issues with carrier AT&T - <AUTHOR> <comment><AUTHOR> Hello,

We have a webservice where people can create their own web stores, we are hosted in Europe.

Issue is that many of our US customers can not browse their new created sites. Took us long time to figure out that the issue is with carrier AT&T.

Getting desperate here, have tried to contact AT&T many times without success.

My hosting company (OVH France) of course tells us the issue is not from their side (which is not) and I am running out of ideas, they have also tried to contact AT&T without success.

Only answer could get was this from their forum: [https://forums.att.com/t5/DSL-Routers-Home-Networks/DNS- Issu...](https://forums.att.com/t5/DSL-Routers-Home-Networks/DNS-Issues- connection-with-AT-amp-T/m-p/4278352)

Right now what we do is to bypass all the connection through cloudflare. This is not a long term solution since we use subdomains and there's a limitation, also those who use custom domains won't work.

Does anyone have a proper contact to AT&T? Does anyone had the same issue? Thanks for any help! ps: sorry grammar spaniard here

</comment><comment><AUTHOR> Any help please?</comment>