Sample cloud-native application with microservices - <AUTHOR> https://github.com/GoogleCloudPlatform/microservices-demo <comment><USER3> Completely ridiculous. I have been in the Kubernetes community for a couple years now, and there is a crazy amount of ridiculous unneeded micro- optimization for problems that nobody except the 1% of users got.

Istio mesh is a good example.

<comment><USER4> Why is everyone freaking out? This is a demo of the technology, its complexity is contrived to demonstrate various facets.

This kind of architecture is not unreasonable for larger companies with many teams, which is where the technology itself becomes useful as well. So in that context, this architecture is entirely reasonable.

<comment><USER5> There's a fine line between "this is possible" and "this is how it should be".

<comment><USER6> The line is fine, but this is already miles behind it.

</comment></comment></comment></comment><comment><USER7> How the heck did we get here as an industry. The complexity is ridiculous.

<comment><USER8> Not just complexity, but quantity of tools that do the same thing. Helm, Forge, Ksonnet, Operators, now this Skaffold (haven't heard of it before)... Sure, there are some differences, but still... I'm currently moving one app from GAE to GKE and saw recipes for using all of those to describe the infrastructure.

Quantity itself is not an issue - it's great to have options. Incompatibility, segmentation and uncertainity about the future are issues, though. E.g. ksonnet and Forge are dying. Some say Helm isn't particularly healthy, too - is it just speculations or would it die in next year or two, leaving all those charts repos a dead code for archeologists?

Maybe that's just me, but modern DevOps feels like JavaScript world from a few years ago. Things are born in abundance, promise lots, and die before they're even v1.0.

<comment><USER9> Pretty much all of these tools feel like the wrong abstraction level for app devs.

Have to imagine some k8s-controller/git server that enables git deployments to k8s with just a node size config is the optimal end state.

I've mentioned this before in related threads: app devs want heroku. They want a managed platform where they type "git push" and they have an application with all the fixings. Heroku got the UX right long ago, and the rest of the ecosystem is still playing catchup

<comment><USER8> Problem there is, this isn't easy and K8s doesn't do anything about that. You need a whole CI/CD pipeline to build Docker images first.

However, there is [https://gitkube.sh/](https://gitkube.sh/) that looks somewhat similar. Can't vouch for or against - haven't used it at all.

</comment></comment></comment></comment><comment><USER10> Could someone please point me in the direction of some solid documentation about deciding on when / how to split out microservices? So many of the cases I see them used are overkill and just make development and devops far more complicated for the scale of the application & amount of data/users being processed. I find myself usually comfortable with splitting out Auth (Cognito?), Payments (Stripe?), and not much else.

<comment><USER11> The way I've generally thought about it and have seen it done successfully in practice is to create a microservice for each component that scales independently. Auth and payments make sense because they scale independently. You may get authorization requests and financial transactions at a different rate than traffic to your application itself.

Similarly, if you run a website that does batch processing of images for example, the image processor application would be a microservice since that would scale independent of website load. It could be that you would need to process 100 or even 1000 images for each user, on average, and it doesn't make sense to scale your whole application when a bulk of the application processing is for image processing.

<comment><USER12> That might be good criteria. But it still depends on your application. Most web apps don't have hardly any overhead when under load. So it's essentially just as efficient to load the whole codebase as a monolith into each node as you scale up.

<comment><USER13> Correct, the hierarchical breakdown of services is orthogonal to the scaling unit of code. If every node in the cluster could execute every function, there is no need to split things out.

When deployment and coordination become an issue, that is when _deployment_ needs to get split up. But given our current RPC mechanisms, deployment and invocation are over-coupled so we have to consciously make these decisions when they could be made by the runtime.

</comment></comment></comment></comment><comment><USER14> I know this was probably well intentioned, but I can't shake the irony of how overly complex and over-engineered this is. If you're just starting out, please, please, please don't do this.

<comment><USER15> Man, this is a frustrating and shallow criticism. _Obviously_ this is over- engineered. It's a demonstration of how these patterns would fit together in an application that required them.

<comment><USER16> Agree it's not the best criticism, but there's at least some validity to it. I think the main issue is that this is an extremely heavyweight architecture that will incur a disproportionate level of administrative overhead - <USER2> would need an ample team of competent full-time devs to build and maintain this system properly. It's like an advertisement for a giant excavator where the excavator is featured crushing a soda can. It's an impressive piece of machinery, but the task being used to demonstrate it is comically mismatched with its true capabilities.

<comment><USER15> True, true. That's a fairer way to formulate it. But like, it's supposed to be an extremely heavyweight architecture. The benefits of microservices are arguably only apparent when you _have_ an ample team (or teams!) of competent full-time devs.

You're right they could have... beefed up the soda can, so to speak, but I don't blame the (presumably) DevRel folks who put this together for hand- waving it, "now imagine a mountain here".

<comment><USER16> > The benefits of microservices are arguably only apparent when you have an > ample team (or teams!) of competent full-time devs.

I would very much agree with that. Although I'm not against microservices, they are by no means a quick or efficient way to get things done. Hedging against future theoretical scaling concerns comes at a high cost - a cost that's very much worth it if true scale is achieved, but a high cost nonetheless.

</comment></comment></comment></comment></comment><comment> ISO-morphism Microsoft has a similar reference application [1].

There are comments arguing these architectures create a ridiculous amount of overhead for what would be a simple application traditionally, and others countering that the point is to show the underlying tech in the context of a "simple" problem. I think there's a large amount of truth for both sides.

It feels like there's a great paradigm shift on the horizon, and hopefully a good set of abstractions to build with. We're programming in machine-specific assembly languages, waiting for a high-level language to come along so we don't worry about things like calling conventions anymore.

[1] [https://github.com/dotnet- architecture/eShopOnContainers](https://github.com/dotnet- architecture/eShopOnContainers)

<comment><USER17> I don't have peers where I can bounce off my thoughts and get answers to solutions like these. I've been very curious about serverless microservices architectures and this repo has given me a pretty clear way of doing it while showcasing polyglot microservices and persistence. I get that it looks like it has a lot of overhead for what it tries to do but I can grok scaling this up for an enterprise application.

</comment></comment><comment><USER18> "Any intelligent fool can make things bigger and more complex... It takes a touch of genius - and a lot of courage to move in the opposite direction" \- Einstein

<comment><USER19> Everyone can randomly quite Einstein.

</comment></comment><comment><USER20> I really despise the phrase "cloud-native", but this is a cool project, because it shows how you can have a bunch of different platforms (python, go, node, etc) running together, and how you can set them up locally without having to worry about how to install them. Also there's no worry about someone publishing a package to npm that overwrites your documents, because everything runs in containers.

I'd love to say this is overcomplicated and to just use Docker Compose, but I don't think Docker Compose is the way to go.

The next thing I'd like to see is how to get this integrated with vscode or Atom to provide autocomplete without installing everything locally.

<comment><USER21> How about "cloud-amenable"?

</comment></comment><comment><USER22> It's unfortunate that each project has a `genproto.sh` and that there's no tool that autogenerates protocol libraries/modules for any consuming language. It's a real pain point of trying to get people to look at gRPC. I'd be amazing if there was a simple way to have:

       .proto(s) -> language code -> language binary/package

Completely automated and ready for an import into a project.

<comment><USER23> Bazel should be pretty good for that:

[https://bazel.build/](https://bazel.build/)

[https://docs.bazel.build/versions/master/be/protocol- buffer....](https://docs.bazel.build/versions/master/be/protocol- buffer.html#proto_library)

We use it at work to build a web app whose backend is written in Go and frontend in Typescript. All of the code gets built and placed in a Docker image using these rules:

[https://github.com/bazelbuild/rules_docker](https://github.com/bazelbuild/rules_docker)

<comment><USER24> Hi author here. We wanted to keep the demo app as simple as possible for readers. Adding Bazel would introduce another layer of complexity whereas most devs can read bash scripts that are a couple of lines.

</comment></comment></comment><comment><USER25> Tried grpc's in a production application where one microservice had to make over a million grpc connections to another microservice. We experienced ton of memory leaks and switched over to http/json which has been working well. Implementation was done in Scalla, Akka. Curious to know if others have had similar experiences or if there is another best practice with grpc's that we're missing.

<comment><USER26> The problem that gRPC solves for you is versioning your messages between your services.

As your json payloads evolve, you're going to encounter pain trying to keep your services in sync, whether it comes in the form of writing parsing code to crack open payloads and do conditional error checking based on the version (and expected fields), or whether it comes operationally in how you actually deploy updates to running services.

<comment><USER27> That's solved by protobuf, not grpc.

</comment></comment></comment><comment><USER28> I really appreciate projects like this.

It's helpful for casual observers to understand all the pieces of the stack. You can get an immediate feel if the approach is right for you and your team.

And it's helpful for engineers to have examples to reference copy when implementing the patterns themselves.

I've been working on project similar to this for go, gRPC and Envoy:

[https://github.com/nzoschke/gomesh](https://github.com/nzoschke/gomesh)

My project doesn't go into deployment or K8. If I needed to figure that out I'd look at the OP project.

I also have a project that demonstrates Go and Lambda:

[https://github.com/nzoschke/gofaas](https://github.com/nzoschke/gofaas)

If these help even a few engineers learn to be successful with the tools it's a win.

</comment><comment><USER29> Is this satire?

<comment><USER30> I honestly thought it was myself until I saw that it was an official GCP repo. Unbelievable...

Sending emails is a one-liner in Django. Am I a sucker for not building my own email sending service?!

Of course being a Google demo they have to include the obligatory ad server service, in Java no less. Nonsense like this is why I'm steering my kids away from considering software development as a career.

<comment><USER31> When a company and platform grows it's very common to build out an email sending service since you can only send so many emails per second.

An example of an email sending service is Sendgrid, who have built an entire company around this service.

<comment><USER30> I'm aware, I've used Postmark for years. My point is that building your own microservice to send emails is ridiculous overkill.

</comment></comment></comment></comment><comment><USER32> Let me try to break this down from first principles, since I'm not sure I agree with the largely negative sentiment ITT around how complex this looks:

Most software projects are long lasting, and have unpredictable and constantly changing requirements.

Agile is currently the best software development methodology under these constraints.

Effective Agile teams should not be larger than 10 people total, minus the PO and Scrum Master leaves 8 devs.

Its not possible to run a large scale, high traffic web application with only 8 devs.

Therefore, it makes sense to split large applications up into chunks small enough for a 10 person team to manage autonomously.

Since the application had to be split up, we now have to solve the communication issue. Now we need networking, DNS, TLS, have to consider latency and bandwidth, etc... We also have other issues if we're running at scale: redundancy, monitoring, separate environments for testing and production, having a local dev environment similar to the production environment. There is a huge list of things that are not important to for an early stage startup to think about, but are very important and very difficult for most large enterprises to get right if they want to consistently and reliably deliver good software.

Google is a large enterprise that operates large scale web services that has proven they know how to get this stuff right.

This repo is a reference architecture, from Google, on how to run micro services at scale using modern tools and methodologies. If you think this is over engineered I think you're just not the target audience, and something like Heroku is much better suited for your scale.

</comment><comment><USER33> Why both a ClusterIP and a LoadBalancer services to expose frontend 8080 as 80?

Also, no persistent data storage (no data to the store owner)? (I guess for easier example)

<comment><USER31> The ClusterIP and LoadBalancer are on separate network interfaces. The ClusterIP exposes the service on an internal interface whereas, the LoadBalancer exposes on a public interface.

[https://kubernetes.io/docs/concepts/services- networking/serv...](https://kubernetes.io/docs/concepts/services- networking/service/#publishing-services-service-types)

</comment></comment><comment><USER34> on thing that still i don't get with microservices is where to put the central control. Usually, services requires: authentication, authorization, execute, (errors), response.

Now, there should be a reverse-proxy that first call the authentication, if correct, calls authorization, if correct call the execution. But, how do people do that?

<comment><USER35> Istio (part of that demo) or Spire (SPIFFE) do that for you.

</comment></comment><comment><USER36> If this was just for demonstration, they could have done it with just a couple of microservices.

Why get the full web stack in the picture?

<comment><USER24> Hi, author of the demo here. We went with a complex app to show a realistic complex scenario. This way we get non-trivial trace graphs and metrics from monitoring tools.

</comment></comment><comment><USER37> Calm Down, Its showcase of what is possible, not what is ideal solution.

</comment><comment><USER38> They should change the name "Go" to "if err != nil"

<comment> why-el I don't understand why people don't like that. If you hate it so much, why not write a plugin for your text editor that collapses it? This will make read the Go code much faster, and only peek in if you are curious. The proposed `check` keyword will not remove the cognitive load this generates either.

The way I see it, I'd rather have it. Took maybe 30 seconds to write, eliminated a whole class of bugs, and if I don't like it, I will write that plugin to hide it.

<comment><USER39> What do you mean by "eliminated a whole class of bugs"?

<comment><USER40> I think he meant that it changed the nature of error handling, and thus changed the way developers think about bugs and the way we encounter them. Errors are returned from function calls, and callers are expected to check the value of that error. The error must be assigned into a variable (or intentionally ignored, which should never pass a code review), and then must be checked. This forces errors to be handled on the spot, or returned up the call stack intentionally, usually with some extra info/annotation. You don't get try/catch scenarios where an error is caught 10 calls above where it occurred.

Imagine writing Java, and wrapping every function call in a try/catch block, and inspecting the exception if one was caught, and then handling it or re- throwing it. That's kind of what we do in Go. There are no "unexpected errors" because it is clear where all errors originate and how they are to be handled.

Go2 will improve on this if err != nil syntax, possibly with some function- scoped error handler and a new language level handle/check concept. Check it out

[https://dev.to/deanveloper/go-2-draft-error- handling-3loo](https://dev.to/deanveloper/go-2-draft-error-handling-3loo) [https://github.com/golang/go/wiki/Go2ErrorHandlingFeedback](https://github.com/golang/go/wiki/Go2ErrorHandlingFeedback)

<comment><USER41> Catching all exceptions is what we used to do in Java - using checked exceptions. It turns out that in many cases the caller cannot do anything sensible with most exceptions, except to let them bubble up to a higher layer. Eventually you reach a point where something can be done - rolling back and retrying a whole transaction, for example.

Forcing every intermediate layer in the call stack to catch and rethrow that exception (check and propagate an error code) _sounds_ like a good thing for explicit error handling, but actually in practice introduces a lot of boilerplate code that just provides more opportunities for mistakes (like errors being silently swallowed, or logged multiple times creating confusing log files).

How many times in a code review do you see `if err != nil { return err }` and ask yourself if what it is doing is actually appropriate? Most people just mentally mask out that kind of boilerplate over time.</comment></comment></comment></comment></comment>


How Cybercriminals Can Abuse Chat Platform APIs as C&C Infrastructures [pdf] - <AUTHOR> https://documents.trendmicro.com/assets/wp/wp-how-cybercriminals-can-abuse-chat-platform-apis-as-cnc-infrastructures.pdf <comment><USER2> I have to admit, I've had a lot of fun in the past thinking of creative ways to control botnets. It's a fun thought exercise in developing in an area where everything is adversarial to your goal. And the fact that the amount of information you really need to transfer is so trivially small that you can get some really creative "solutions".

My favorite idea so far is to look for the existence of a specific username across several services for commands. Only the usernames are (in part) generated via a TOTP style rolling code. So to see if something should activate, it will look for the existence of a username of "imnotabot349556" on reddit, HN, and twitter. if it sees any of them, it can read a small command from any number of places on those sites that the user can post some kind of comment/profile/text.

This is super easy to control securely (could be done from anywhere, using any machine, over TOR or other networks), is hard to shut down (the rolling codes mean they would need to either have access to the "secret" and ban all future codes, or just ban "imnotabot*" which wouldn't be sustainable if multiple botnets started using this method, not to mention you could just switch to a hash of everything as the username), and is fairly fullproof (no reliance on any one network or channel). And with some forethought, an update mechanism can be built into it as well, so when someone gets close to your scheme, you could have all your bots update at a moment's notice to a new one.

At the end of the day, trying to stop a C&C server of a botnet is a futile exercise. Once the botnet is out there, there's no stopping it by shutting down a C&C server. There are just SO many ways to pass information, and when the information is on the size of hundreds of bytes in some cases, there's just no hope.

<comment><USER3> _> trying to stop a C&C server of a botnet is a futile exercise._

Laptop users who want broad Internet access (and will complain loudly if reddit/HN/Twitter is "down") aren't the same thing as the app server that only talks to a short whitelisted set of RFC1918 IPs, on specific ports only, and doesn't have Internet access - not even DNS. (WannaCry _demonstrated_ why not.)

Reddit and the like needs to accept they are hosting botnet C&C servers due to hosting loads of user-generated content (I'd do an invite-only subreddit with a tracking pixel in the CSS), but that doesn't make it pointless for the rest of us to do something where possible.

<comment><USER4> > (I'd do an invite-only subreddit with a tracking pixel in the CSS)

So that you could nuke it if a not-you IP accessed the subreddit? That's nice and could be very easily automated.

<comment><USER5> Except it doesn't work because reddit sanitizes their CSS and doesn't allow url() to external hosts. You need to upload the images you want to reference in the CSS to reddit.

</comment></comment></comment></comment><comment><USER5> 61 pages to conclude, yes you can indeed pass messages via chat APIs, shocking.

Also stupid if you actually do that since the chat API provider can simply cut you off and you don't have a C2 anymore and lost access to all the systems you infected.

<comment><USER6> I don't think it's "stupid" to C2 via chat API. It would be "stupid" to have no fallback mechanisms

<comment><USER7> Chat API's are good because the traffic to "facebook.com" probably won't be detected as malicious by most firewalls.

Your fallback should be a peer2peer network in DHT style, scanning the entire IP address space on a well known port to find nodes to connect to.

When a node is found, addresses of other nodes are requested, and a cache of a few thousand infected nodes kept to use as seeds for future connections.

Imagine you have 1 million infected machines, then most new nodes will find and connect to the network within 4000 packets sent across the network. For good measure, build in a list of a few thousand addresses into the malware as bootstrap nodes.

</comment></comment></comment><comment><USER8> Yes, this is something well known. Chat platforms have long since been used as botnet infrastructures. IRC is/was a big one for a long time because it's very lightweight and the protocol is well known (with a little know-how you can completely IRC over telnet). The only reason it's been ditched is because it's so heavily centralized -- loose the C&C server and you lose control, unless you have a way to push updates. That's why fast-flux DNS became popular.

In other news, water is wet, the sky is blue, etc. etc.

<comment><USER9> Agreed, but they created this paper because they actually found malware using Discord and Telegram. Apparently it can have alternative uses, such as being a direct interface to ransomware victims ("join this Slack channel to send me your bitcoin")

<comment><USER10> You know they're getting crafty when you can lend them your account for 72 hours to unlock your PC.

Legitimate History as a Service?

</comment></comment></comment><comment><USER11> Leave Britney alone! Or at least her Instagram account. [https://arstechnica.com/security/2017/06/russian-hackers- tur...](https://arstechnica.com/security/2017/06/russian-hackers-turn-to- britney-spears-for-help-concealing-espionage-malware/)

</comment><comment><USER12> They spent a year and a half on this fairly obvious thing only to conclude nothing new here and offer no useful advice beyond common best practices.

Are they going to waste the next year on how Twitter, Facebook, etc. can be used by criminals?

</comment><comment><USER13> I think a Tor hidden service would probably be a really good way to run C&C infrastructure. I'm surprised it doesn't get used more often. Or maybe it does?

<comment><USER14> I've always wanted to know what happened with the creator of this botnet. [https://blog.rapid7.com/2012/12/06/skynet-a-tor-powered- botn...](https://blog.rapid7.com/2012/12/06/skynet-a-tor-powered-botnet- straight-from-reddit/)

<comment><USER15> Arrested by the German police: [https://thehackernews.com/2013/12/alleged- skynet-botnet-crea...](https://thehackernews.com/2013/12/alleged-skynet- botnet-creator-arrested.html)</comment></comment></comment>


Hawaiian Airlines Bans Masks with Exhaust Valves and Vents - <AUTHOR> https://kokpitherald.com/hawaiian-airlines-masks-with-vents-and-valves/ <comment><USER2> Ugh. Continued fallout from terrible reporting on a non-scientific study that wasn't even looking at the issue in question.</comment>


What Does A Song That Costs $5 Sound Like? - <AUTHOR> http://www.npr.org/blogs/therecord/2013/09/11/219727031/what-does-a-song-that-costs-5-sound-like

<comment><USER2> It would be nice if someone could demonstrate that DSD sounds better than PCM in a double-blind experiment. Just as a sanity check, you could record the PCM from the DSD output to discover whether PCM is perceptually transparent. Advocates of DSD are often skeptical of double-blind experiments, which itself is a red flag.

<comment><USER3> > Advocates of DSD are often skeptical of double-blind experiments, which > itself is a red flag.

Exactly. There's a lot of wackos out there in the music biz though. People have religious beliefs about certain products/technologies/sounds without any solid reasoning behind it.

<comment><USER4> Whats wrong with that? We don't question tastes in art, why audio? I don't need logic or research or the agreement of others, I just know what sounds right to me, and that _is_ perfectly solidly reasonable. Ears are as weird and personal as eyes, as is our interpretation. You wont necessarily hear what I hear. On top of that, over time they change.

No need for words like wacko and religious. Unless of course you doing mind if I fire back with a few judgmental words of my own?

<comment><USER5> I think you have a different sort of 'taste' in mind than busterarm does.

It is a very reasonable thing to prefer record over CD. They have different sounds, people have different likes, easy, done.

But if someone tells you they prefer the look of HDMI when you use gold-plated wires, they're clearly deceiving themselves, because as a digital signal there is no difference whatsoever.

So the important question to ask is whether people _can_ hear the difference. I will accept that some people have better/different ears from others, but the best way to demonstrate that ability is a double-blind test.

Your standard is what 'sounds right'. Well, if you can _reliably_ tell me that X technology sounds better than Y technology, without labels on the two sets of headphones in front of you, then great, that's all I wanted. I don't need any kind of research showing that a format is objectively 'better'. I just want someone to show that it's objectively _different_ to human ears.

If someone says they have a preference, but doesn't actually prefer either one in a blinded test, then the labels 'wacko' and 'religious' fit.

<comment><USER3> Right. I'm trying to refer to the self-deception that people have when it comes to audio gear. A really common example is how many musicians and audiophiles end up buying power filters and claim they make the sound better. Often these people don't need the power filters and you can prove with documentation and test equipment that they a) don't need them and b) aren't doing anything to the sound. Are you playing out live in random clubs? Sure get a power filter (but that's not as important as a surge protector). Are you playing at home with modern wiring and not overloading your circuit? Don't waste your fucking money.

So many musicians end up developing biases about what certain equipment is supposed to sound like. There are a few videos floating around comparing guitar amp/cab modeling gear to the real thing. A lot friends of mine have trouble picking them apart or getting them right in a blind listening test. Frequently the model has some tweaks that make it sound better... or a better description would be to say that it sounds more like what the musician expects that gear to sound like. Some amp X was used on such and such album and has Y sound and the model sounds like that amp does on the album.

I'm frequently right in these blind tests and I end up telling people is that it's because I don't care about the gear and don't have any preconceived notions about what it should sound like. I just listen to the timbre and make my best guess.

</comment></comment></comment></comment></comment><comment><USER6> So DSD is just storing [the equivalent of] the digital pulse part of a class-D amplifier? That seems completely pointless...

My feeling is there's a one to one transform between the 1 bit world and the multi-bit world, which means that they're mathematically the same and any perceived differences are merely the result of poor A/B testing.

<comment><USER3> Pretty much spot on here.

</comment></comment><comment><USER7> It sounds a lot like someone making money. You play these over your $150,000 speakers with $10,000 speaker wire and you can pretty much hear the money hitting the table.

I heard this story on my way to work this morning and was just shaking my head. There are probably going to be a lot of people wanting to try out this newfangled $50 album, though.

</comment><comment><USER3> Whether DSD is even good or not is still something hotly debated. It's not at all suitable for editing. I'm really scratching my head why NPR reported a story that is so one-sided.

The fact-checking here is poor. They're presenting it as DSD vs MP3 when really it's DSD vs PCM.

</comment><comment><USER8> But no one's talking about FLAC/DSD for archiving and MP3 for casual listening... which should be the point.

The history of music (even if you don't like today's pop) should not be stored in 320 kilobit/s CBR.

</comment><comment><USER9> The very fact that 5.6MHz sampling rates are even a thing intended for human listening makes me doubt this lady's sanity.

<comment><USER10> It is intended for encoding, not for hearing.

Here: [http://en.wikipedia.org/wiki/Pulse- density_modulation](http://en.wikipedia.org/wiki/Pulse-density_modulation)

</comment></comment><comment><USER11> Here is a link to what must apparently be the new range of Sony hi-fi equipment the article talks about (but doesn't link to) in the first paragraph: [http://www.whathifi.com/news/sony-launches-high- resolution-a...](http://www.whathifi.com/news/sony-launches-high-resolution- audio-product-range-and-hi-res-downloads-site)

</comment><comment><USER12> Are people even able to audibly tell a difference? Like in an ABX test?

</comment><comment><USER13> Audiophile (the unhealthy obsession with audio) has made it on NPR</comment>


What Can Startups Learn from the Arab Spring? - <AUTHOR> http://digitly.wordpress.com/2012/06/28/what-can-startups-learn-from-the-arab-spring/

<comment><USER2> What can startups learn from Iran Contra? From Cuban Missile Crisis? from JFK assissination? From 9/11?

One thing: How to appropriate a media-title for your link-bait headline :-)

<comment><USER3> Stay tuned for "What the Holocaust can teach you about gardening".

<comment><USER2> How many thousand Syrians dead by now? I bet that's a lot like A/B testing a new favicon.

Fucking exploitive morons.

</comment></comment></comment><comment><USER4> Tasteless link bait much?

</comment><comment><USER5> Apparently he still believes the media narrative that the Arab Spring was a good thing.</comment>


Dr. Whitmore on Pandemics - <AUTHOR> https://medium.com/@stanfis111/dr-whitmore-on-pandemics-ecab951e5a45 <comment><USER2> Pretty good historical account of pandemics based on facts, but might wanna make it more apparent that this coming from a fictional novel.</comment>


Responding to government legal demands for customer data - <AUTHOR> http://blogs.technet.com/b/microsoft_on_the_issues/archive/2013/07/16/responding-to-government-legal-demands-for-customer-data.aspx <comment><USER2> I am surprised that Microsoft took as much flak for it as it did when pretty much every other online property including Google and Facebook has complied with these demand (as they are legally supposed to do).

Besides it is also interesting to note that providers such as Google and Facebook probably have a lot more interesting data that the government is likely interested in. It is more likely that data from the likes of Google and Facebook that can be used to track an individual or can be detrimental to them as compared to the data that Microsoft has.

<comment><USER3> Microsoft has gotten the worst of it so far because of NSA documents explicitly describing the relationship with Microsoft. Presumably similar documents exist for the other companies involved, but they haven't been leaked.</comment></comment>


The new Mac Heist holding page animation looks great, and no Flash - <AUTHOR> http://www.macheist.com/#

<comment><AUTHOR> They also appear to be using MooTools, which is interesting. I instinctively expected it to be jQuery.

</comment><comment><USER2> No Flash, but it still pegs one core, and turns on the fan. :(

</comment><comment><USER3> I asked someone to look at it on the iPhone. Works great.

</comment><comment><USER4> Wasn't this already submitted a couple hours ago?

<comment><AUTHOR> I tried searching through both the new submissions and through google, and couldn't find anything. I tried :(

</comment></comment><comment><USER5> impressive even without knowing it pushing the graphics development envelope.</comment>


Show HN: A simple offline-first app to track your reps in the gym - <AUTHOR> Developer here.  Thanks for checking out my app, Riker.  In case anyone is curious, the iOS app is native, written in Obj-C.  The Riker web app is written using React and Redux.  The REST API is written in Clojure and the backend is Postgres.
Although there is also a fully functional web version of Riker, the app is preferred since it supports offline mode, provides Watch App and integrates with Apple's Health app.
Will be happy to answer any questions.
App Store link: https://itunes.apple.com/us/app/riker/id1196920730?mt=8 Web link: https://www.rikerapp.com <comment><USER2> This is a good idea that I think touches on a pain point that everyone who goes to the gym experiences. I use the app Endomondo, which is fantastic for tracking walking or running outside but limited in terms of what gets recorded for any other type of exercise. Honestly I wish there was some kind of magnetized transmitter thingy that I could just stick on the barbell or kettle bell that would automatically sync reps to my phone with some kind of motion sensor gyrometer. Or smart dumbbells that my apple watch syncs with so it automatically records reps and weight.

In terms of "internet of things" solving a problem like that, viz. linking up all the stuff in the gym to my apple watch so that I can get fine grained stats about my workouts, would be flippin golden.

<comment><AUTHOR> Agreed - it would be really great to have automatic recording of reps like we have for steps, but as you pointed out, you would need "smart equipment" and "smart free weights," which are either very far off from happening, or won't happen, which is why I built Riker. Being able to record reps from the Apple Watch is the most friction-less for me so far.

<comment><USER2> Well here you go: [http://www.androidpolice.com/2017/04/24/google- fit-v1-64-for...](http://www.androidpolice.com/2017/04/24/google- fit-v1-64-for-wear-2-0-can-now-identify-strength-training-exercises-and- automatically-count-reps-apk-download/)

Given the battery issues of apple devices and the extremely limited nature of apple health, I have to say I am ever more interested in switching to the android ecosystem. Having a watch that makes fitness tracking effortless across a variety of activities without having to constantly tend to button pushing would be fantastic. Especially if said device didn't require an online course in battery management to last more than a year.</comment></comment></comment>


Nim language 0.14 released - <AUTHOR> http://nim-lang.org/news/2016_06_07_version_0_14_0_released.html <comment><USER2> Yay! We're one step closer to 1.0, which—I believe—will be a major milestone.

Nim is surely a very interesting language with some very real perspectives for production use.

</comment><comment><USER3> Nim and Rust are some of the most exciting new languages. Unfrotunately, both don't have an AWS SDK, and that prvents me from using either at work. :(

<comment><USER4> This might be what you're looking for: [https://github.com/aidansteele/aws_sdk.nim](https://github.com/aidansteele/aws_sdk.nim)

Of course, if that isn't suitable, one of the best ways to get started with Nim is to write such a library :)

<comment><USER3> Well, I could write one if I had the time or my employer approves it, and neither of these are realistic, unfortunately.

I think Amazon already has a bunch of JSON files in their boto library and some already use those to generate AWS SDK in multiple languages including the future Rust version (rusoto), but it takes time.

</comment></comment></comment><comment><USER5> CONGRATS! , Now we are talking.

YC Guys , FUND NIM! Nim is the game changer! If i am a millionaire , i wound fund a billion by selling my soul. It could kill Java , Golang and Swift in a single blow.</comment>


How do you find out what the usual salary is for the kind of work that you do? - <AUTHOR> People don't talk about their salaries because they seem to think it's impolite, and websites like Glassdoor are useless (for me) because it's impossible to figure out what job titles at different companies correspond to what I do. (I also work for a small company where no one has exactly the same job as me.)<p>How do you guys get around these problems and find out what level of salary you should be looking for? <comment><USER2> One strategy I've heard of: if you're getting recruiter spam, ask each of them, based on your resume, what kind of salary they could get you. Throw out any outliers or obvious liars, and take the average.

<comment><USER3> In my experience, recruiters offer more than the company is willing to offer. My final step in your plan would be to drop the values by 10 to 20 percent or so.

</comment></comment><comment><USER4> Someone posted a website to HN which let you see what h1 visa holders were earning at different companies. If you find similar companies you can look up what salaries their are for different job titles. Avoids the self selection bias of glass door.

<comment><USER5> Also, Foriegn Labor Certificaton Data Center[1] is used by DOL to determine the prevailing wage for an occupation.

[1] [http://flcdatacenter.com/OesWizardStart.aspx](http://flcdatacenter.com/OesWizardStart.aspx)

</comment></comment><comment><USER6> I can probably help. My wife does compensation for a living and has access to troves of data. More and more it is normalized wi little variance except for region based on cost of living. Years of experience plays a part too.

Also tact you can take is determine what your boss makes and perhaps work down from there.

<comment><USER7> Would you be willing to anonymously post some of the things from all that data that could help some of us out here?

</comment></comment><comment><USER8> Are there any organizations for your field you can reach out to?

Also, if there are staffing companies, sometimes they put out salary analysis research as content marketing tools that can be quite useful.</comment>


Flu vaccine paradox adds to public health debate - <AUTHOR> http://www.cbc.ca/news/health/flu-vaccine-paradox-adds-to-public-health-debate-1.2912790 <comment><USER2> > _" We have kind of hyped this vaccine so much for so long we are starting to > believe our own hype. Really, what we should be doing is looking for better > vaccines,"_

The PR on the flu-vaccine/campaigns and the efficacy of the vaccine itself have long been misaligned. Good to hear scientists and public health-officials start to acknowledge this. We'll see how long it takes to trickle down to the general public.

<comment><USER3> In particular as it was only 23% effective this year: [http://www.ajc.com/ap/ap/top-news/flu-vaccine-not-working- we...](http://www.ajc.com/ap/ap/top-news/flu-vaccine-not-working-well- only-23-percent-effec/njp3t/)

<comment><USER4> Is that bad? The ease of getting a vaccine needs to be enough such that it's not a burden to do so. Once that's achieved, 23% effective is actually quite a good benefit, given that those 23% also fail to infect others and improve our overall herd immunity.

<comment><USER5> Its bad compared to how effective the vaccine normally is, its good compared to no vaccine at all.

The idea that its one vaccine in the first place that is being "hyped" is wrong, _each year_ a new vaccine is created, and its done based on the strains of the flu that seem likely to be prominent. One of the reasons this year was worse than normal is that the strains that were prominent weren't what was predicted.

I don't think anyone would be against developing a _better_ vaccine, though I do think lots of people would be opposed against trading off efforts to assure that each years vaccine made under the current process gets well promoted to the public and distributed to achieve that. Those aren't the only possible uses of resources in our society, and there is no reason that efforts to develop are better flu vaccination system need to be traded off against efforts to assure the reach of the current system.

<comment><USER2> > _there is no reason that efforts to develop are better flu vaccination > system need to be traded off against efforts to assure the reach of the > current system_

I'm not sure that this is true. From a purely market-driven perspective, pharma is able to successfully move this product each year, without risk of liability, and without additional R&D. As long as there is a PR machine around this current product that continues to "reach" and drive customers, then what's the incentive to engage in expensive R&D needed to develop the next round?

<comment><USER5> Since its a public health problem, I would expect that, were it adopted as a priority, that the incentive would be in the public funds allocated to grants for vaccine R&D, and (for existing Big Pharma firms) to avoid being left without a chair when the current gravy train ends (apologies for the mixed metaphors) when better vaccines are deployed.

<comment><USER2> > _were it adopted as a priority,_

Agreed. _Once it becomes a priority_ with the subsequent funding/grants, I think that's when we'd see movement. Ironically, however, I wonder if the hype around the current program even slows adoption of new priorities.

Though, perhaps acknowledgments such as the type referenced by public health officials in this article portend the start of some movement.

> _left without a chair when the current gravy train ends when better vaccines > are deployed_

I wonder if their thinking is that this problem is easily fixed through acquisition if/when the time comes, especially in an industry as M & A-driven as pharma. Meanwhile, gravy-train.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Straining for an analogy? Am I the only one who hated this quote from the article?:

       "The idea basically is that your immune system
       is occupied elsewhere. It would be like getting
       the swirling ball of death on your Mac where your
       operating system is doing something else rather
       than opening the file."

</comment><comment><USER7> I am reminded of the conservative financial wisdom regarding insurance, which is "don't ever insure against things you can pay out of pocket".

Should we, perhaps, be questioning whether it makes sense to vaccinate against things we can overcome in a few days without harm ?

Of course I am speaking of otherwise healthy adults, and YMMV.

<comment><USER8> While it depends year to year, the flu averages out to about 10k deaths each year in the US and that's _with_ vaccination.

We're all pretty used to it so it doesn't seem like a big deal but it's actually very dangerous.

<comment><USER2> > _the flu averages out to about 10k deaths each year_

There's actually a lot of controversy around these numbers, with the CDC itself acknowledging that it's challenging to truly know for a number of reasons [1].

Here's a pretty remarkable quote from that page:

> _" most people who die from seasonal flu-related complications are not > tested for flu, or they seek medical care later in their illness when > seasonal influenza can no longer be detected from respiratory samples"_

So, it's really tough to know. As a result, some allege that the estimates are inflated as part of the campaign to ensure vaccination.

[1] [http://www.cdc.gov/flu/about/disease/us_flu- related_deaths.h...](http://www.cdc.gov/flu/about/disease/us_flu- related_deaths.htm)</comment></comment></comment>


Show HN: DevDash, highly configurable terminal dashboard for developers - <AUTHOR> https://github.com/Phantas0s/devdash <comment><AUTHOR> I released some months ago DevDash, a side project in Go to create terminal dashboards, in order to gather the data I need, as a developer, into the terminal. I was annoyed to switch between multiple tabs in my browser to see everything I wanted to see.

Since I have a blog and side projects, I developed DevDash to get data from Google Analytics, Google Search Console, Github and Travis.

The difference with other terminal dashboards out there is the configuration. You can push it pretty far, you can even use it to do custom call to the Google Analytics API and render the result in a widget.

Any feedback are welcome! If you want some new functionality for DevDash, don't hesitate to open a pull request to speak about it, or to simply let a comment here.</comment>


Ever wondered why your baby is crying? - <AUTHOR> We have good news!
Hablo is a mobile app that can help you  to understand why your baby is crying . Download Now and enjoy Parenting for FREE https://bit.ly/3cNd8SD <comment><USER2> "Add your babies' medical records on data centers of a private firm in Estonia": Maybe not.

"Get real time notifications when your baby is crying": Um I think you won't be able to ignore it even if you want to.

"decrypts babies'cries and informs parents of the reason behind the cry : Pain, Sleep, Discomfort or Hunger": Do you have benchmarks or citations for the training/test data used?

"Based on 35 research papers": No need to cite them I guess.

</comment><comment><USER3> Please don't use shortened URL here. [https://play.google.com/store/apps/details?id=com.hablocompa...](https://play.google.com/store/apps/details?id=com.hablocompany.hablo&fbclid=IwAR1A-CbOKkXZU_6eKpG1uTdzJgipPVHRb3StJt6NW0HiwWdgpDoG9bWIbkQ)

Some more technical description can get more traction here. What are you using? An expert system or deep learning? Is the method calibrated for different ages of the baby?

</comment><comment><USER4> [https://simpsons.fandom.com/wiki/The_Baby_Translator](https://simpsons.fandom.com/wiki/The_Baby_Translator)</comment>


App Undresses a Photo of Any Woman with a Single Click - <AUTHOR> https://www.vice.com/en_us/article/kzm59x/deepnude-app-creates-fake-nudes-of-any-woman <comment><USER2> If anything, I'm surprised that this wasn't created sooner.

Additionally, entire communities exist around shopping celebrities' heads onto naked bodies; this has been a thing approximately forever but no one really cared. Now that it's automated it's "absolutely terrifying"? Like the author said, anyone with a few hours of photoshop training can do the same, it's just faster now.

That being said, news articles like this will be key to generating enough fear to pass legislation about what we can and can't do with software. Not sure if that's a good thing.

<comment><USER3> This software is just a precursor to what could be possible in the future. You could conceivably tell the software a caption and it would generate a video for you. How can you control what software someone runs offline locally? You can't. I find it irrational to even think of such legislation.

Posting such generated content online is another matter though. It would probably already violate some preexisting laws.

<comment><USER4> > How can you control what software someone runs offline locally? You can't. I > find it irrational to even think of such legislation.

This is what DRM and Content ID are. They're not perfect, but plenty are trying, and it does stop most non-technical people.

<comment><USER3> I don't think you have thought it through. Those work using a blacklist only. First, you can't force people to run DRM on their system. Even if you could, the ML based generator will always generate some new and random that foils the DRM. You will basically need to force people to run an ML model on their system which serves as an intelligent dyanmic DRM, and thia dictatorial idea is acceptable nowhere.

</comment></comment></comment></comment><comment><USER5> I don't get the horror -- it's _not_ the woman's actual body. And even if it were, it's _just a body_ and maybe we shouldn't freak out about it. If we could somehow embrace "radical transparency" then it wouldn't make a difference if someone saw you naked, knew what gender's clothes you like to wear, what medical conditions you have, or anything else. If not that far, let's at least get rid of this puritanical nonsense where we can't see naked bodies, but it's fine to see extreme violence, etc. I agree that deep fakes will perhaps move us a step closer to not being shocked by images, and not believing anything we see or read online, which is probably good thing. Of course soon we'll all have to be naked save for gobs of SPF-1000 anyway...

<comment><USER6> I totally agree with this comment. "Ethics" needs disruption. We only have problems with nudity, because it is a tabu.

</comment></comment><comment><USER7> They sure have a lot of fake nude-but-censored photos in this article. I think one or two would have sufficed to show how the technology works.

<comment><USER8> I only saw two.

</comment></comment><comment><USER9> I see huge consequences as you pretty much frame any woman and there's nothing she can do about it. The problem is that perception matters. Many people who are not exposed to technology would not understand / believe that such app exists.

For example, if a person decides to grab a picture of a young teacher and post fake nudes, the teacher may be able to say that the pics are fake, but she might get fired anyway due to decisions made by the school board or PTA. This type of news might be picked up by the local news network and the story will be embellished out of proportions. Regardless of what she says and whether it's true, her reputation would already be tarnished. We've seen a lot of these happening with celebrities. It will be worse if it happens to normal people with no money to hire a PR company or go to court.

</comment><comment><USER10> > "This is absolutely terrifying," Katelyn Bowden, founder and CEO of revenge > porn activism organization Badass, told Motherboard. "Now anyone could find > themselves a victim of revenge porn, without ever having taken a nude photo. > This tech should not be available to the public."

Or maybe the opposite?

The transition to ubiquitous deep fakes will be very jarring to those who haven't been paying attention. In time, the shock value (and indeed interest) should fade into obscurity.

Pop stars upset about appearing in one of these deep fakes should be much more horrified about another possibility: eventually their talents will no longer be needed at all because it will be possible to produce content free of human placeholders and much more effective at generating money.

</comment><comment><USER11> A photo of "any woman"? I think not. All the examples are of female celebrities who are 90% naked in the original photo.

Taylor swift in a skin-tight see-through strapless dress? Kardashian in a bikini? I'll call this thing dangerous when it can work from headshots or images of people in winter clothing.

</comment><comment><USER12> What a great advertisement for the app. They were sure to identify the app and mention the cost.

Shocking, simply shocking.

</comment><comment><USER13> You think this is terrifying, wait until it works in realtime with an augmented reality app.

<comment><USER14> there's desensitization. try a nude beach for an example

<comment><USER13> Nude beaches imply consent - most places are not nude beaches.

</comment></comment></comment><comment><USER15> > DeepNude also dispenses with the idea that this technology can be used for > anything other than claiming ownership over women's bodies.

That's not true! We can also use it for undermining democracy, making everything look like a Van Gough painting, and...

> This algorithm is similar to [...] what self-driving cars use to "imagine" > road scenarios.

I understand the fear here, but I don't appreciate rage-bait sub-headlines that contradict the rest of the story. Obviously GANs can be used for many things.

Also, I'm sure there are a few bad actors who will use this for things like revenge porn (which is Not Good), but I suspect the driving demand behind this application is horny teenagers who think Daenerys from GoT is hot, rather than malicious people who want to "oppress women." Although to be fair, this is the effect the technology has, whether intended or not.

</comment><comment><USER16> "I was high when he pitched it!" [https://www.youtube.com/watch?v=FFNhP- dBK4E](https://www.youtube.com/watch?v=FFNhP-dBK4E)

</comment><comment><USER17> Two thoughts:

1\. Doesn't this make any genuine nude photo deniable?

2\. I wonder if this is the killer app for augmented reality.

<comment><USER18> > 1\. Doesn't this make any genuine nude photo deniable?

Deniable, sure, but what will denying it get you? If people wanted to rub it in your face, saying "it's not real" won't stop them. If your workplace is going to fire you because of it, denying it won't stop them from firing you.

<comment><USER19> I think it will eventually make the whole of nude photos a non-issue. You'll only still get fired and shamed for it while this tech is still underground - once it's widely known, "nudes" won't matter more than any other photoshopped image.

</comment></comment></comment><comment><USER20> > and only works on images of women.

Gamification shows up in some unlikely places

</comment><comment><USER14> Nice vice spam. What's horrifying about a person being nude again or seeing a nude person? I get the novelty but this is not " absolutely terrifying"

<comment><USER21> While I would agree in principle that there's nothing shameful about nudity, in most societies, this is simply not the case. Having images circulated of oneself in the nude would be shaming, and I imagine that having these images faked makes one feel a loss of control over one's image.

The fact that this was only made to effectively "unclothe" women is also disturbing (if unsurprising).

Not sure it qualifies as "spam".

<comment><USER14> > Not sure it qualifies as "spam".

the amount of fake nudes in the page. clearly yellow attention grabbing

</comment></comment></comment><comment><USER22> People only see the downsides but there could be some really cool uses for the technology in image repair, think old paintings, damaged photos, etc. So while yes, this tech starts as unwilling pornography, it could turn into something generally usefully to society.

<comment><USER6> Obviously, they took an existing technology, and applied it to a different goal.

<comment><USER22> Yes, obviously every other comment is about how terrible it is, however no one focuses on the tech that's available unless you're already in the field. Not sure what about my comment set people off, I almost expect it's bleedover from a different thread since there's no responses other than yours. The tech itself is pretty cool, using data sets to model similar body types. I remember seeing this when it first came out and was being used to swap President Obama's speech. I'd expect that this will be used to model missing children better, it might lead to computerized assistance in facial and body reconstruction. The tech is pretty interesting.</comment></comment></comment>


Ask HN: What's in your Microsoft.PowerShell_profile.ps1? - <AUTHOR> Hey HN! I'd ask around on HN to see what other goodies other devs have set up. DevTools, equivalents of Unix commands, $lang specific stuff or whatever else. <comment><AUTHOR> Here's my powershell profile [https://github.com/mikemaccana/powershell- dotfiles/blob/mast...](https://github.com/mikemaccana/powershell- dotfiles/blob/master/Microsoft.PowerShell_profile.ps1)

I came to posh from a Mac and use Linux for servers, so have a bunch of Unix aliases (pkill, df, grep, sudo etc) and run ConEmu / PSCX / PSReadLine and OpenSSH as part of my environment for history, ssh-agent, and other expected bits and pieces.</comment>


U.S. Internal Revenue Service uses Coinbase blockchain analytics software - <AUTHOR> https://www.theblockcrypto.com/linked/71890/irs-coinbase-blockchain-analytics <comment><AUTHOR> The deal is for one year and is valued at $124,950.00. I'm not sure if that's a good deal or not, but it seems... _reasonable_?

Original title was wordy and vague. It was:

U.S. Internal Revenue Service inks deal with Coinbase for blockchain analytics software</comment>


ECDSA smartphone key extraction using $2 magnetic probe - <AUTHOR> https://www.cs.tau.ac.il/~tromer/mobilesc/ <comment><USER2> Previous exciting works by the same research group (already discussed on HN):

\- Acoustic cryptanalysis : [https://www.cs.tau.ac.il/~tromer/acoustic/](https://www.cs.tau.ac.il/~tromer/acoustic/)

\- Get Your Hand Off My Laptop : [http://www.tau.ac.il/~tromer/handsoff/](http://www.tau.ac.il/~tromer/handsoff/)

I saw a live demo of the latter at the CHES 2014 conference in Busan, it was really impressive.

Now to be honest, I'm less impressed by this new one because I already saw a very similar attack on a smartphone using an EM probe (except maybe it was on the RSA cryptosystem). I'm not entirely sure but it may have been at the CRI demo stand at the CARTES convention in Paris in either 2012 or 2013.

<comment><USER3> CRI had a demo like that at RSA (the conference) around that time, so I think your recollection is right.

</comment></comment><comment><USER4> This is impressive, especially given how cheaply the attack can be realized. If you can get near the device you only need a coil and a sound card.

That being said:

> After observing the elliptic-curve double and add operations during a few > thousand signatures, the secret signing key can be completely reconstructed.

This is probably the biggest obstacle for pulling this off in reality. I have no idea what that means in minutes or hours you have to be near a phone doing encryption though.

<comment><USER5> A few thousand might be a lot of negotiations. Often the assymetric keys like EC or RSA are only used once to negotiate a smaller/faster key for aes.

</comment></comment><comment><USER6> "The attack requires measuring a few thousand ECDSA signatures" \- so not quite feasible by bumping into the target in a crowded subway.

<comment><USER7> And this is the kind of context i find often missing from security discussions.

It will still protect against anything short of a determined attacker with direct access to the hardware for an extended period.

Very little is secure against such a scenario, even less so if the attacker don't care about the defender knowing after the fact.

But all too often security research seems to consider anything that can be broken, even with the most complicated and time intensive of processes, as insecure.

<comment><USER8> Correct – the fact that there exists a possible way to extract these secrets is a chink in the armor. It's like how SHA1 started getting out of favor as soon as they started finding a couple of collisions.

Interesting that Apple already fixed this in iOS 9. Makes me wonder what kinds of crazy tests their security team must be doing, that they can mitigate such things.

<comment><USER9> These sorts of side channel vulnerabilities aren't some sort of new revelation-- the notion dates at least back to 2002 (per the authors' cited references). For example, one of the design goals of DJB's NaCl [1] is to mitigate side-channel vulnerabilities, specifically calling out data flow from secrets to load addresses (which has been used to break AES via a timing attack) and data flow from secrets to branch conditions (which is the sort of thing that's happening here-- where you can see secret-dependent patterns in the number and timing of operations in ECDSA computations) [2].

What's novel here is just how cheaply they're able to carry out these side- channel attacks.

[1] [https://nacl.cr.yp.to/](https://nacl.cr.yp.to/)

[2] [http://cr.yp.to/highspeed/coolnacl-20120725.pdf](http://cr.yp.to/highspeed/coolnacl-20120725.pdf) \-- see section 3, Core security features and their impact

</comment></comment></comment></comment><comment><USER10> Only koblitz curves (secp256k1) seem to be secure?

On a related note, the Bernstein team designed Ed25519 with side channels attacks in mind. [https://en.wikipedia.org/wiki/EdDSA#Features](https://en.wikipedia.org/wiki/EdDSA#Features)

<comment><USER11> It would have been nice if the paper had discussed Ed25519. Anyone else know what the status is relative to this (and other, similar) work?

<comment> floodyberry- The paper attacks implementations, not algorithms. As far as I know, all of the of the major Ed25519 implementations are side channel protected and safe (no branches on secret data, no array indexing with secret data)

</comment></comment></comment><comment><USER12> HN discussion of the paper: [https://news.ycombinator.com/item?id=11223266](https://news.ycombinator.com/item?id=11223266)

</comment><comment><USER13> Capturing the CPU instructions by a side-channel is indeed possible but the "real-life, working" use of the method described here is questionable for me. CPU in modern phones runs above 1GHz. USB sound card they're using provides max 192kHz which allows max 96kHz signal. 4 orders of magnitude less. There's also a lot of noise from different circuitry (GPU, display, wireless comm.) and laptop's noise as well which will obfuscate the signal.

<comment><USER14> It still strikes me as plausible. Sub-harmonics are a thing; it is entirely possible to leak data about what the CPU is or isn't doing down into the ultrasonic or audible bands.

As an example, one of my computers leaks a _ton_ of noise into the onboard audio that quickly becomes audible with a moderate amount of gain. So much so, that I've learned to recognize changes in the noise pattern from various activities (shuffling windows around the gui, launching a program, compiling a program, etc).

How practical a real-life, working use of the method described here will depend in no small part how much noise the device being attacked casts off. There's some pretty bad devices out there.

</comment></comment><comment><USER15> Would like to know where to get those $2 magnetic probes :o

<comment><USER16> Honestly, just strip coax away the outer sheath to expose the inner conductor. Make a loop with the exposed inner conductor and solder back onto the sheath. Increase the loop size or turns for lower frequencies.

<comment><USER17> Stripped probe is electric. Looped probe is magnetic. Stripped/looped probe is mixed probe. If you use coax - leave the shielding, just make sure to leave a gap. Just look at this picture [1] from this quite good article [2]. Depending on the design/equipment, you might need balancing/symmetrization.

Also directivity/sensitivity. While turn count will improve overall sensitivity, loop size will increase directivity. Keep in mind that both loop size and turn count affect probe filtering characteristics (it IS a filter), so I highly recommend experimenting with several designs. Have a look at my attempt at making magnetic probe from RG174 [3]. It is fat because of two layers of thermal shrink tube, which made it stiff enough for my experiments :)

It is hard to tell from a picture, but it should be that this probe uses two wires exactly for this purpose: one acts as a central conductor, other as a shield.

[1]: [http://www.compliance- club.com/archive/old_archive/030718b.j...](http://www.compliance- club.com/archive/old_archive/030718b.jpg) [2]: [http://www.compliance- club.com/archive/old_archive/030718.ht...](http://www.compliance- club.com/archive/old_archive/030718.htm) [3]: [http://imgur.com/hiRUJl6](http://imgur.com/hiRUJl6)

</comment></comment></comment><comment><USER18> One of my favorite articles on how someone extracted the private key from a Trezor wallet: [http://johoe.mooo.com/trezor-power- analysis/](http://johoe.mooo.com/trezor-power-analysis/)

</comment><comment><USER19> I'm surprised that security researchers use Lenovo - at least apart from researching/testing their devices.

<comment><USER20> I suppose they have enough qualification to wipe clean those machines and install linux or at least a clean copy of windows.

<comment><USER21> On the contrary. They are qualified enough to know that there's not much they can do, whether it is Lenovo, Apple or Dell.

</comment></comment></comment><comment><USER22> It's time for smartphone manufacturers to improve smartphone's EMI shielding and improve key entropy!

<comment><USER23> Well, wideband EMI can't be fully shielded if you intend your phone to be a... phone.

</comment></comment><comment><USER24> very interesting angle of attack. I wonder if you could use this avenue to get something off of a yubikey?

</comment><comment><USER25> Is this how the FBI are going to get into the iPhone maybe??

<comment><USER26> Not specifically. ECDSA is a signing algorithm. Unless there's some really fancy asymmetric authentication protocol between components within the phone, which perform curve operations, it's most unlikely. Of course, there's no saying a hardware side-channel isn't a possible attack vector.

<comment><USER25> There is a dedicated authentication coprocessor, to which the communications will be authenticated, so yes.

<comment><USER27> The thing you're talking about ("secure enclave") is not present in the phone the FBI are trying to attack.

Also, the Secure Enclave co-processor is on-die, so there will be no need to authenticate or encrypt communications with it.</comment></comment></comment></comment>


Ask HN: How do you search for jobs? - non-entity About 3 or 4 years into my career and I've decided to look for a new positions. Unfortunately, in the past few years I got really jaded and depressed and never bothered to enhance / modernize my skillset. I've been working with .NET the past couple years, but I haven't done much .NET core or worked with cloud technologies or a lot of other necessary stuff nowadays. Very recently, I've managed to regain my ambition and have been working on learning stuff that's much more interesting to me, but I'm far from skilled enough to get a job in that stuff. Looking on different boards, the jobs I'm actually qualified for look terribly boring or like they would be a negative experience altogether (I'm not trying to work somewhere with outdated tech for another few years)<p>I've heard the just mass applying to online positions on such (which Is what I normally do) is bad and that it doesn't often lead to a great job, but I have no ideas what else to do. I get recruiter spam, but always for A) really bad contracts or B) jobs that look good, but had the recruiter taken even a cursor look at my resume, they'd have been able to tell I'm not remotely qualified for the position. What other ways are options for finding new jobs? <comment><AUTHOR> Details may change every few years but overall, it boils down to two main approaches: 1) find a position through your professional network, as an estimated 80% of jobs come through such connections; 2) be discoverable for the other 20%.

Be active in both.

Present something at a local meeting/event. Often, it doesn't have to be fancy or overly polished. Some events on meetups.com have a few people present for 10 minutes each.

Which leads to #2, be discoverable: put those presentation materials on GitHub or GitLab.

Additionally, there are common interview questions (whiteboard and/or code challenge) such as URL shortener (e.g., TinyURL) or anagram solvers. These have come up a number of times in my interviews over the past few years, so I wrote the code and pinned these on my GitHub profile. (Same user id as here, if you're interested.)

I decided to go a step further and give each the full dev-ops treatment: Dockerfile, Makefile, etc.

But give them a solution, not a problem.

Avoid relying upon AWS/GCP/Azure proprietary offerings unless that's precisely what you're demonstrating, and make it work as-is: fetch all dependencies with version pinning (if possible-- else put versions in README), so then you know that it will build for them exactly as it did for you.</comment>


Blockchain Could Help Musicians Make Money Again - <AUTHOR> https://hbr.org/2017/06/blockchain-could-help-musicians-make-money-again <comment><USER2> This is Imogen Heap still pushing her failed Mycelia initiative. Total takings: $133.20. It literally got more press articles than paying customers.

Why Blockchain isn't a good fit for the music industry: [https://rocknerd.co.uk/2017/04/27/why-spotify-wants-some- blo...](https://rocknerd.co.uk/2017/04/27/why-spotify-wants-some-blockchain- how-music-industry-blockchain-dreams-work/)</comment>


What Does a Neural Network Actually Do? - <AUTHOR> http://moalquraishi.wordpress.com/2014/05/25/what-does-a-neural-network-actually-do/

<comment><USER2> Extensive discussion: [https://news.ycombinator.com/item?id=7797155](https://news.ycombinator.com/item?id=7797155)

Also submitted: [https://news.ycombinator.com/item?id=7796336](https://news.ycombinator.com/item?id=7796336)</comment>


If there is an online platform that - <AUTHOR> If there is an online platform that allows you to a) crowdsource all knowledge that supports or dismisses an insight/conclusion/hypothesis to see how many percent true it is, and b) weigh between two (or more) opposing opinions/theories of different experts/parties/camps of thought in relation to each other, would you use it? <comment><USER2> No.

If I want to watch people alternately call each other "deniers" and "alarmists" I'll just head over to Slashdot.</comment>


In Arbitration, a 'Privatization of the Justice System' - <AUTHOR> http://mobile.nytimes.com/2015/11/02/business/dealbook/in-arbitration-a-privatization-of-the-justice-system.html?hp&action=click&pgtype=Homepage&module=first-column-region&region=top-news&WT.nav=top-news&_r=1&referer=https://t.co/dCBa0wODBb?t=1&cn=ZmxleGlibGVfcmVjc18y&sig=0412b03d682114f12acb7519cc2a36701c44f4cc&al=1&iid=644b959be5494f2fb4c7ed16f404ec86&autoactions=1446991361&uid=321660521&nid=244+288 <comment><USER2> It's an issue that has more than one position.

For a long time I was a volunteer at a mediation center where maybe 70% of the cases we did were parenting plans for divorced or separated parents.

The scientific evidence is that mediation is much more effective, for parenting plans, than court both in terms of (i) people being happy with the results, and (ii) people following their plan and not winding up back in court.

The family court in the county has a close relationship with the mediation center and tries to send as many cases to it as it can because it is cheaper and faster, never mind getting the better outcomes that are mentioned above.

Now in the case of that center people can always go to court if they don't come to an agreement, but I would say that the NYTimes assessment of alternative dispute resolution is pessimistic and reflects the viewpoint of the lawyers who are 99% of democratic congressmen and nearly 50% of the republicans.

<comment><USER3> > Now in the case of that center people can always go to court if they don't > come to an agreement

This is the key. Most arbitration clauses in contracts, however, seek to prevent going to court. And, in addition, arbitrators side with companies what appears to be far to often.

If people are required to seek arbitration, but can still go to court afterward, I have no issue at all with arbitration.

<comment><USER4> "This is the key. Most arbitration clauses in contracts, however, seek to prevent going to court."

Most mediated settlement agreements have the same clause.

The goal is finality.

"And, in addition, arbitrators side with companies what appears to be far to often."

Based on _what_ data do you think it is far too often?

IE why is it bad that they side with companies often if the companies are right?

In my experience, most of what our justice system deals with are bullshit or worthless claims, and so if the private arbitrators agree with the companies, instead of the company settling, that's _good_ not _bad_.

I'd love to see some independent org do an independent review of the strength/merit of the claims of each arbitration case, and whether there is still bias "accounting for that"

I realize how difficult such a thing would be ;)

Without such a thing, at least, given what i've seen, i remain unconvinced that most complainers are is not just the whining of plaintiffs lawyers and people they sold a bill of goods to.

Because arbitration is cheaper, faster, and probably better for _everyone_.

(plus, you don't need _lawyers_ to represent you. In fact, i could start a company that handled thousands of arbitration claims for folks much more effectively than i could handle thousands of class action lawsuits. Because i don't need $500 an hour lawyers to manage the case, legally.

It happens that lawyers are really slow and haven't noticed this yet, but i expect arbitration will end up better long term for people once they do)

"If people are required to seek arbitration, but can still go to court afterward, I have no issue at all with arbitration. "

If they could, there would be no point in arbitration!

Someone is going to lose. If the next step is to go to a judge and have them re-decide the whole thing, why bother with the arbitration step?

<comment><USER3> > Based on what data do you think it is far too often?

Let's start with these:

[http://www.responsiblelending.org/credit-cards/research- anal...](http://www.responsiblelending.org/credit-cards/research- analysis/stacked_deck.pdf)

[http://www.nasaa.org/5698/state-securities-regulators-say- ne...](http://www.nasaa.org/5698/state-securities-regulators-say-new-study- clearly-shows-investors-view-securities-arbitration-as-biased-and-unfair/)

And from the second, let's grab this quote: "A striking 75 percent of customers who compared their arbitration process to their civil litigation process indicated that arbitration was "very unfair" or "somewhat unfair" compared to court."

Given that civil court absolutely sucks, that's quite telling.

<comment><USER5> That statistic doesn't tell you enough, because you don't know the rate of valid claims to invalid claims, and it's very possible that the "legal dispute with this particular company" filter exerts a powerful bias on that rate.

</comment></comment></comment></comment></comment><comment><USER6> > And unlike the outcomes in civil court, arbitrators' rulings are nearly > impossible to appeal.

> When plaintiffs have asked the courts to intervene, court records show, they > have almost always lost. Saying its hands were tied, one court in California > said it could not overturn arbitrators' decisions even if they caused > "substantial injustice."

This seems like a really serious problem. If arbitrations are, as they are claimed to be, generally better on the average (cheaper, faster, better compromises, etc), one could tolerate even "forced" arbitrations (by way of fine print that few people read). But the lack of avenues to appeal (if true) seems to me a fatal flaw.

Is this generally true of all arbitrations? Or is this only a few unusual cases?

<comment><USER4> Most arbitrations are binding. That means they can't appeal _the facts and the result_.

If the _arbitration process_ was unfair, they can appeal that. But if the process was fair, ....

<comment><USER7> For a definition of "fair" set by the arbitrator.

</comment></comment></comment><comment><USER7> Truly disgusting -- so unimaginably perverse injustice that I can't imagine a coherent lucid defense being presented that this should be legal, though if you have one please prove me wrong. If you want to protect rights, it's vital to not only have a statute against certain entities violating them (primarily government), but to ensure people cannot sign them away. If something is permitted, it will occur -- there will always be people desperate enough or uninformed enough to agree to anything that's permitted for them to agree to, and all of a sudden your rights only exist if you're wealthy enough to avoid being forced into a contract like this.

In our case it's become so ubiquitious that in job offers, not having binding arbitration is a perk -- companies sometimes choose to allow their employees the ability to exercise their rights in order to attract better talent. That's not good enough.

</comment><comment><USER8> People who think the "normal" legal system is "fair and honorable" have very clearly never dealt with it. It's many things but neither fair nor honorable are among them.

Arbitration can be good and can be bad. I'm not sure the best way to reduce the bad. It best not come at the expensive of Freedom of Contract.

<comment><USER9> "Freedom of contract" is a silly thing to uphold as an absolute principle. The reason to uphold contracts is for the general good of society, not just "because a contract is a contract", and companies being able to put mandatory arbitration clauses in contracts of adhesion to circumvent the standards of normal courts is not generally good for society.

</comment></comment><comment><USER10> Assertion: the rise of arbitration is caused by the rise in the expense and time-to-resolution of the government judicial system.

Thoughts?

<comment><USER11> Having one of the parties to the dispute being the primary and continuing source of income for the decision-maker does seem likely to improve those two measures of the process.

</comment></comment><comment><USER12> "For many people, when the choice is between giving up the right to go to court or the chance to get a job, it is not a choice at all."

Nice that we have luxury tech careers and can tell employers to fuck off. Remember to read your contracts before you sign them!

In general, I'm sure that voluntary mediation works well, but to take away a persons right to seek legal recourse is deeply wrong.

</comment><comment><USER13> To really make arbitration fair (or at least as fair public courts) you'd need so many regulations and oversights that you'd just end up with a parallel court system that would likely have the same problems that arbitration tries to solve in the first place (mainly time and expense).

</comment><comment><USER14> Related article: [https://scholar.princeton.edu/sites/default/files/mgilens/fi...](https://scholar.princeton.edu/sites/default/files/mgilens/files/gilens_and_page_2014_-testing_theories_of_american_politics.doc.pdf)

The United States is essentially an oligarchy. Why is this surprising? Are we stuck with the nationalistic sentiment that America is the Best TM and are blind to the issues that affect all of us?

<comment><USER15> How does the second part of what you said relate to the article?

</comment></comment><comment><USER16> In my view, "binding arbitration" is a very lopsided concept by which a large entity can use an intimidation tactic against a smaller entity or individual at, essentially, a lower cost than going through the US court system. This doesn't mean that the large entity is incapable or unwilling to spend capital in defense of a position, but it's akin to an "up front" legal investment to save money later. Why bother fighting in court, where an entity like the EFF or ACLU might be willing to provide financial means to support a fight in pursuit of justice, when there's an avenue to block such a process from even happening?

Thus, I've been happy to have my own "Personal Terms and Conditions" on file (somewhere around here, it was written several years ago) that intends to help tilt the scale back to even. What do I mean? I mean that as a condition of taking my money in Good Faith, whatever business entity I'm working with will have to abide by my own parameters of negotiation - as in, if I'm dealing with a large conglomerate, their means are significantly disproportionate to those that I have. So, as a rule of doing business with me, should there be a dispute, the corporate entity agrees to only use the same budget that I have available. It's highly subjective whether such things could be defensible in court, but it's just one way that I believe it's a US Citizen's right to declare when there's a fight, it's going to be as fair as it can be.

For example, a friend recently had a dispute with their major healthcare provider over a short vs. long-term prescription issue. The friend's Doctor wrote out a 90 day supply prescription for the incurable issue requiring maintenance medication. The insurance company refused to fulfill the 90 day supply, and said that they would only approve a 30 day supply. If you know about US health insurance programs, you'd know that a 90 day has a copay of $XX, and a 30 day has a copay of $YY. Thus, this person would have to pay nearly 2x in copay monies out of pocket simply because the insurance company didn't want to fund the actual, written prescription. Eventually the mail- order fulfillment service started calling up this friend, demanding $X,XXX in back co-pays. The friend pointed out that the fulfillment service had emptied out the Health Savings Account for several years, taking co-pays for each 30 day supply, which was unfair because the actual amount to be billed shouldn't exceed the 90 day cost. 5 phone calls later, and with the stubbornness of a ram, the friend finally got the company to give up on trying to extort him for money that wasn't owed. To this day, the insurance company refuses to fulfill the 90 day prescription, and he's simply waiting, fangs sharp, for if they try to come at him again.

How would the above situation work out in arbitration paid-for by the insurance company? They broke the binding agreement of fulfillment, then wanted to make it the responsibility of the party with the least means. That's injustice, and it's important for individuals to understand, or be willing to stand up and argue, when a large entity decides to "change the rules" to benefit themselves, it's fair game to change the rules right back and punch hard. I'm not presenting this kind of stuff as some kind of quick-fix or blanket approach for each and every person, life is more complex than that. However, the erosion of rights and personal liberty is another complex subject, one that I'm glad to study for its nuances and application in small and large battles.

<comment><USER17> Problem is, the much of the same can be said about lawsuits themselves. They also favor the larger party, especially when you factor in court costs.

I do wonder if it would be more fixable by requiring arbitrators to adhere to certain standards and register, then pick one at random for each arbitration request so that no one can stack the deck with their choice of arbiter.

</comment></comment><comment><USER18> "[Capitalism] has resolved personal worth into exchange value, and in place of the numberless and indefeasible chartered freedoms, has set up that single, unconscionable freedom — Free Trade. In one word, for exploitation, veiled by religious and political illusions, naked, shameless, direct, brutal exploitation." \- Karl Marx, The Communist Manifesto

This is quite the end game of capitalism, isn't it?

Individuals do not matter, capital does. Given that corporations have capital, they're the ones who matter. People, especially the disadvantaged ones who lack capital, are not important. Justice means the service of capital. If we agree to that, we'd see that this "new" system is not that unusual. If you have unfettered capitalism, you give up all other values to capital, including individual justice.

</comment><comment><USER19> I think this is a very one sided view of things (its NYTimes after all).

The purpose of arbitration is not to take away customer's right to seek justice. The purpose is to reduce costs of fighting a lawsuit in court which is far too expensive.

I do see the risk that arbitrators might favor the right of company more than the customer but such a company and arbitrator eventually lose credibility and market share.

Imagine we had to outlaw the whole arbitration process, what would happen that ? Courts will have more cases to address and both involved parties end up spending more money than usual which increases the cost of business for everyone.

I would rather opt in for arbitration and get my car for $500 less than see the arbitration process go away.

</comment><comment><USER20> It's great to know something like this exists. We should have arbitration like this here in Brazil too, instead of arbitrarion subjected to public courts.

<comment><USER21> I find this viewpoint surprising, given the problems with arbitration pointed out in the article.

What are your reasons for preferring arbitration? Are the courts in Brazil that corrupt? If so, how would arbitration be better?

<comment><USER20> They are very very slow, both in judging and in executing decisions, and at the same time consume a huge bunch of State money. They are probably corrupt as well.

</comment></comment></comment><comment><USER22> People should be encouraged to use the courts. It's a good thing that people use the court system to resolve their disputes. At least they're not dueling in the streets - or worse, leaving their disputes unresolved and suffering without any way to resolve them. Court systems are how modern societies resolve their disputes.

I think the US court system is - on average - fair to the parties involved. One example: The US doesn't award legal fees to the winner, because then everyone would immediately hire the most expensive lawyer to get a higher chance of winning. This would raise the stakes of any lawsuit, and make people far more scared to go to court. This means people might genuinely be suffering from some issue that they can't get resolved.

There's a legitimate issue where companies are afraid of losing millions on legal fees from one of their millions of customers that paid $20 for a cable and got shocked or hurt. Maybe the product was genuinely flawed or the company genuinely treated the customer poorly. Maybe the company is in the right but the customer feels slighted and wants their righteous indignation, or is just greedy for a payout.

For smaller claims, there is small-claims court which is supposed to handle this at much lower cost.

For larger claims: Well, the stakes are intrinsically higher, so maybe it makes sense for the legal system to be expensive.

But for mid-claims - claims too large for small claims court and too small to spend millions on a legal campaign - maybe there is room for improvement. And maybe that room involves arbitration companies. If two parties of equal power consent to using them to save money on a $100,000 contract, that seems okay to me.

But if a million dogs get shocked to death by defective dog collars, it seems wrong that people couldn't use the court system to get resolution. Maybe it's a bad example - but companies engaging in some trouble worth tens of millions of dollars _should_ end up in court. Society doing this is a good thing, even for the companies involved - although they might not feel like it at the time.

When you hear about some large corporation getting off the hook with what seems to be a slap-on-the-wrist million dollar fine, it's almost a good thing: it means you can use the court system to sue large companies to resolve disputes and get them to change their behavior without burdening everyone with a draconian court system.

I say arbitration should either always be appealable to a real court, or we should set up a new cheaper court system that reviews the evidence and makes a preliminary opinion but doesn't set precedent and can be appealed.

<comment><USER23> >There's a genuine issue where companies are afraid of losing millions on legal fees from one of their millions of customers that paid $20 for a cable and got shocked or hurt.

That's a feature not a bug. That paranoia has probably saved many tens of thousands of lives, maybe more.</comment></comment>


The case against CS master's degrees - <AUTHOR> https://ozwrites.com/masters/ <comment><USER2> Not everything has to be about work and employability. Some of us actually enjoy learning and exploring the more theoretical topics in CS.

<comment><USER3> Sounds like you should be doing PhD then?

At least in my university, MS students were usually paying full tuition, with the understanding that they'll take classes and leave for (presumably) high- paying job.

On the other hand, PhD students were usually paying no tuition at all -- instead, after getting their masters-equivalent, they were expected to do the research for a few years and therefore "pay back" by advancing the science.

(of course the fun fact was that one could drop out half-way from PhD program and get a MS degree.. but this did not happen very often)

<comment><USER2> Indeed, I've been considering getting a PhD. The situation in Sweden is quite different to yours however. To begin with, all university education is free, and we further get a student grant of ca. $300 USD / month and access to an almost free student loan for up to 6 years. PhD students all get a salary of ca. $3k USD / month. Also, here you don't get a PhD "instead" of a master's -- a master's is rather a prerequisite to getting a PhD, in practice if not formally. Generally, the path to a PhD in Sweden is: 3 years for bachelor's degree -> 2 years for master's -> 4 years for PhD.

</comment></comment></comment><comment><USER4> My CS masters completely changed my life. Would 100% recommend if you are open to learning a bunch of cool stuff.

<comment><USER5> * if you are open to paying tens of thousands of dollars for learning a bunch of cool stuff

<comment><USER4> Mine was £5000. UEA in the UK.

It has paid for itself many, many times over since then.

</comment></comment></comment><comment><USER6> The Georgia Tech OMSCS program is very good and affordable (10K or less). It's also the 7th ranked CS program in the world. And, you can and do interact with professors, not just TAs. I'm an OMSCS grad. I would do it again and strongly recommend it. I think programs like it are the future of higher education.

<comment> daniel-thompson OMSCS student here. I agree with the parent. However, the one downside of the program is that since the marginal cost of admitting an additional student is very low relative to the tuition amount, GT has an incentive to not be very selective about who they let in. From a democratization-of-educational- opportunities perspective, that's good: if you can hack it, then you can hack it, regardless of what formal qualifications you might be missing. But this program is the real deal courseware-wise, and that results in a lot of those under-prepared students taking classes that they just can't keep up in. Lots of those students end up washing out of the program... after paying GT a semester or two of tuition.

Example: in the Intro to OS course I'm about to finish, we started with 700+ students and are now down to about 340. The projects are typical schoolhouse stuff for systems programming: C programs that manage memory, use sockets, IPC constructs, pthreads, RPC libraries, etc. One of the guys on the class slack just posted that when testing & debugging the projects, he just printed stuff to stdout... for the whole semester... because he doesn't know - and didn't bother to learn - how to use a debugger.

<comment><USER7> >One of the guys on the class slack just posted that when testing & debugging the projects, he just printed stuff to stdout... for the whole semester... because he doesn't know - and didn't bother to learn - how to use a debugger.

Lol that's like the best way to debug C

<comment><USER8> yep, 10+ years in industry and that's how I usually debug (and I know how to use a debugger).

</comment></comment></comment></comment><comment><USER9> I really enjoyed Electrical & Computer Engineering, and took CS classes as electives. Felt the math and engineering courses grew my brain, and the CS courses were enough to get me into software. The CS majors I knew seemed to enjoy their choice less!

</comment><comment><USER10> It's sad that his page about self-studying CS [1] does not include any book specific to the Theory of Computation and Computational Complexity.

[1]: [https://teachyourselfcs.com/](https://teachyourselfcs.com/)

</comment><comment><USER11> I did a non-cs undergrad to cs grad path... It was hard. I wasn't admitted to the program without fulfilling almost all the core CS undergrad classes. This meant that between the prerequisites and the actual grad classes, I took over 120 credit hours of pure math and CS classes over the course of 5 years.

Obviously not every school has the same demands as others, and there are certainly a lot of degree farms that take foreign students money and funnel them though, but I'm not sure that the authors points ring very true... certainly not for everyone.

</comment><comment><USER12> And then there's my old manager who found a negative correlation between a programmer's ability and them holding a PhD in CS. FWIW, he had a MS in Software Engineering himself and he said that the correlation only seemed to hold for CS PhD's, not PhD's in other sciences. My department had a number of PhD's, but only one in CS and that one was hired a few years after that manager left.

Correlation isn't causation and all that, but it does bias you a certain way.

</comment><comment><USER13> What masters degree (or even undergraduate degree) is any of that not true of?

<comment><USER14> Yeah, past a certain point you realize how shallow degrees are, as they're merely an organization's approval that you studied something and demonstrated some level of aptitude of it.

Which is to say, you don't need a degree to study/learn things.

Though that approval is helpful in opening doors to employment when you're young, it again is not needed when your history of experience, abilities, and work can do the same later in your career...

</comment></comment><comment><USER15> I hate to be super-negative, but I'm not even sure a bachelors in CS is a good idea. Oh sure, you learn a few good things along the way, but then the professors start dragging you down their favorite theoretical paths. I'm all for philosophizing and navel gazing, but there's not much practical in things like lambda calculus, NP-completeness and some of the other topics. To make matters worse, these pursuits can confuse the brain. I know one fancy CS major who dismissed a problem as unsolveable because it was NP-complete. He missed the fact that the dimensions of the problem were such that a quick heuristic did perfectly fine.

The sad thing is that large parts of the curriculum aren't that valuable. Data structures used to be my favorite, but today it's not that important because we stick everything in hash tables or database tables. We rarely use LISTS!

The same goes for compilers. No one writes a compiler any more. Apple just repurposed LLVM when they made Swift. But all of the undergraduates have to pull their hair out making toy compilers and for what end?

Most of the CS curriculum is pretty extraneous. This is why many companies are deliberately hiring technically competent people from tech fields like physics or chemistry. They learn practical skills to analyze their data-- the kind of practical skills needed by corporations not theory heads.

<comment><USER16> In my experience, the biggest reason doing a bachelors in CS sucks is because it's a massive waste of time, leaving little to no time for side projects. Programming assignment questions tend to be vague and come with poorly scoped requirements. Usually the professor also forgets to tell you several essential details or has made several errors in the code. An average assignment can take upwards of 40 hours, with 10 or more of those hours spent because the professor was too lazy to check over their assignment for 30 minutes before handing it out. The saying that A students work for C students really makes sense in this context. A students never got the chance to work on what they wanted!

<comment><USER17> At U of Washington you get to choose your own senior project (so I've heard firsthand).

<comment><USER16> Thats actually pretty cool. I actually go to the other UW and watch jealously as startups are regularly birthed from capstone engineering projects.</comment></comment></comment></comment>


Create a better life - <AUTHOR> I've built an online application (idealweek.net) which helps people to better manage goals and time. Can you please let me know your thoughts on: - Is it usable? - Is it worth to pay 5$/month for my app? - Any other suggestions <comment><USER2> Screenshots! I was looking for some examples of use and screenshots, but I couldn't find any.

The idea looks very generic, so I think you must make very clear the specific advantage of your app to convince people to try it.

<comment><AUTHOR> Thanks. I will update the home page as your advice.

</comment></comment><comment><AUTHOR> [https://idealweek.net](https://idealweek.net)</comment>