Bit.ly exploit to brand your short url - <AUTHOR>

I don't know if someone has observed this, but if I append any random sub domain name, to a shortened url from bit.ly, it still takes me to the correct url.
For example, I picked up this from techrunch's tweet http://bit.ly/12V9c1. I could also create a link called http://mayanks.bit.ly/12V9c1 and it would still take me to techcrunch's site. So I get to brand my own short url.
Is this an undocumented feature or something is wrong here? <comment><USER2> It's likely just a DNS wildcard setting that resolves everything to the same server.

Not an uncommon practice, and helps ensure that things like the random typo of ww.site.com by a user still gets them to where they were expecting to go.

So my guess is that it's not an undocumented feature but more of a clever hack that exploits something that was done for an entirely different, but closely related, purpose.

<comment><AUTHOR> I have seen links like <http://om.bit.ly/xyz> on twitter. In a recent bit.ly's blog I've seen announcement about cbs.bit.ly. So I don't think it is just a plain DNS wildcard. This must have been an intended feature but looks like its not completely intended.

For example in case of cbs.bit.ly only links shortened by cbs should be valid. But try it out any bit.ly shortened link works with cbs. subdomain as well.

<comment><USER2> It looks like they are doing DNS wildcarding and basic round-robin DNS-based load balancing.

My guess would be that for particular subdomains (om, cbs, etc.) they may be offering some stats on clicks, referrers, etc., so that those users can better track that sort of stuff.

But, the easiest way to manage this DNS-wise is to use wildcards. The side effect is that any subdomain becomes valid, but that's usually no issue.

\</comment></comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>

brks-macbook-pro:Downloads brk$ ping om.bit.ly

PING om.bit.ly (22.214.171.124): 56 data bytes 64 bytes from 18.104.22.168: icmp_seq=0 ttl=57 time=69.395 ms 64 bytes from 22.214.171.124: icmp_seq=1 ttl=57 time=69.584 ms ^C

\--- om.bit.ly ping statistics --- 2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 69.395/69.489/69.584/0.095 ms

brks-macbook-pro:Downloads brk$ ping cbs.bit.ly

PING cbs.bit.ly (184.108.40.206): 56 data bytes 64 bytes from 188.8.131.52: icmp_seq=0 ttl=57 time=69.898 ms 64 bytes from 188.8.131.52: icmp_seq=1 ttl=57 time=69.625 ms 64 bytes from 184.108.40.206: icmp_seq=2 ttl=57 time=69.815 ms ^C

\--- cbs.bit.ly ping statistics --- 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max/stddev = 69.625/69.779/69.898/0.114 ms

brks-macbook-pro:Downloads brk$ ping foo.bit.ly

PING foo.bit.ly (22.214.171.124): 56 data bytes 64 bytes from 22.214.171.124: icmp_seq=0 ttl=57 time=70.048 ms 64 bytes from 184.108.40.206: icmp_seq=1 ttl=57 time=69.509 ms 64 bytes from 22.214.171.124: icmp_seq=2 ttl=57 time=70.003 ms ^C

\--- foo.bit.ly ping statistics ---

3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max/stddev = 69.509/69.853/70.048/0.244 ms

brks-macbook-pro:Downloads brk$ ping brk.bit.ly

PING brk.bit.ly (126.96.36.199): 56 data bytes 64 bytes from 184.108.40.206: icmp_seq=0 ttl=57 time=69.191 ms 64 bytes from 22.214.171.124: icmp_seq=1 ttl=57 time=69.489 ms 64 bytes from 220.127.116.11: icmp_seq=2 ttl=57 time=72.154 ms ^C

\--- brk.bit.ly ping statistics ---

3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max/stddev = 69.191/70.278/72.154/1.332 ms

brks-macbook-pro:Downloads brk$ ping 123.bit.ly

PING 123.bit.ly (184.108.40.206): 56 data bytes 64 bytes from 188.8.131.52: icmp_seq=0 ttl=57 time=69.376 ms 64 bytes from 220.127.116.11: icmp_seq=1 ttl=57 time=70.049 ms 64 bytes from 18.104.22.168: icmp_seq=2 ttl=57 time=75.750 ms ^C

\--- 123.bit.ly ping statistics ---

3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max/stddev = 69.376/71.725/75.750/2.859 ms

brks-macbook-pro:Downloads brk$ ping 456.bit.ly

PING 456.bit.ly (18.104.22.168): 56 data bytes 64 bytes from 220.127.116.11: icmp_seq=0 ttl=57 time=69.185 ms 64 bytes from 220.127.116.11: icmp_seq=1 ttl=57 time=69.917 ms 64 bytes from 18.104.22.168: icmp_seq=2 ttl=57 time=69.663 ms ^C

\--- 456.bit.ly ping statistics ---

3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max/stddev = 69.185/69.588/69.917/0.303 ms brks-macbook-pro:Downloads brk$

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>

Also, sub-sub-domains work:

brks-macbook-pro:Downloads brk$ ping ntr.brk.bit.ly

PING ntr.brk.bit.ly (126.96.36.199): 56 data bytes 64 bytes from 18.104.22.168: icmp_seq=0 ttl=57 time=70.208 ms 64 bytes from 220.127.116.11: icmp_seq=1 ttl=57 time=68.510 ms

<http://ntr.brk.bit.ly/xyz>

<comment><AUTHOR> Thanks for the quick lookup. I did some dig on some sub-domains as well. Indeed looks like they have a wild card for sub-domain mapping.

I wonder then what is the extra advantage/feature that om and cbs are getting. Anyone can brand their bit.ly shortened url with or without bit.ly's consent

</comment></comment><comment><USER3> Didn't see it mentioned already, but <username>.bit.ly redirects to bit.ly/user/recent/<username>. So "pplante.bit.ly" redirects to "bit.ly/user/recent/pplante" which contains the list of my recent shortenings.

This must be an undocumented feature to allow user accounts to brand their links if desired, since it redirects to the account's recent list. I am curious if many twitter clients would properly recognize "<user>.bit.ly/xyz" as a shortened url and try to expand it via the API, my guess is a few out there might see this as a long url and try shortening it again. What a unforeseen mess that would cause.

<comment><AUTHOR> twitterfox that I use as my twitter client does not recognize "<user>.bit.ly/xyz".

If it is an undocumented feature, it is susceptible to link hijacking. I can take a url shortened by you (pplante) and brand it as my own mayank.bit.ly/xyz. That will not be cool...

</comment></comment><comment> onreact-com Is it a bug or a feature?

<comment><USER4> URL shorteners in general or this specific observation?

<comment> onreact-com The specific one of course ;-)</comment></comment></comment>


White House said to be in talks with Intel, TSMC to build more US chip factories - <AUTHOR> https://www.engadget.com/white-house-intel-tsmc-us-factory-talks-165608078.html <comment><USER2> Oof, that's worrying. The semiconductor foundries in Taiwan are as much a national security concern as the oil from Saudi Arabia.

<comment><USER3> You don't think Nuclear weapons and a president named Trump is a security concern for the rest of the world?

You're here worrying about semiconductor foundries? Why? Your phone already has enough processing power to guide a nuclear bomb into the white house. It's already a concern and it's already too late. Taiwan and the rest of the world has computing technology well past a "security concern."

Of course anyone who's not white and American if they have any form of computing technology that's better than the America makes it a security risk. Are you actually afraid or are you so arrogant that you believe that only America should have the latest and greatest technologies?

Makes sense because only a country with a wise and mature president like trump and citizens genius enough to vote for him are privileged enough to have "technology."

I'm tired of these racist bigoted opinions from blind white people who don't understand of the world. Grow up. Stop being racist.

That's EOD here.</comment></comment>


Ask HN: How do you recover from a bad day? - <AUTHOR>

When you have had a bad day, what do you normally do to take your mind off/switch-context just to feel better/not-shitty...<p>Does anyone have any routines like some games, books or some other activity (apart from exercise as it's normally already 8ish in night when you realize the day is gone, and it was quite horrible, and you don't have much energy or motivation left to go to gym or a run...) <comment><USER2> counter strike

walk my dogs

watch some conference videos on youtube ( [https://www.youtube.com/user/Confreaks](https://www.youtube.com/user/Confreaks) ) or random stuff on [http://reddit.tv](http://reddit.tv)

IMO it is about clearing my head so I can evaluate what happened, mistakes made, improvements, and get ready to rock the new day.

</comment><comment><USER3> Girlfriend :)</comment>


Full-Stack Redux Tutorial - <AUTHOR> http://teropa.info/blog/2015/09/10/full-stack-redux-tutorial.html <comment><USER2> This is much better than a boilerplate project. Problem with starting from a boilerplate is that you don't know how everything got to that point.

<comment><USER3> I wrote a react-starter app a few months ago for my friends I was trying to convert to react, and so I could streamline making smaller prototypes.

As a teaching tool it was ok, but people kept getting tripped up by the webpack / build tool phase of the app. It's different than the way most people start apps with angular or backbone.

I also dislike boilerplates, I hate making a project with someone else's legacy code baked in.

I thought it would be nice to have a dependency wrap around the webpack / babel api for me, so I made [https://github.com/eanplatter/enclave](https://github.com/eanplatter/enclave). So far it's helped my noob friends get introduced to React without having to think about webpack, but also doesn't add boilerplate code to the app.

Sorry for the shameless plug, just thought it might be relevant :D

</comment></comment><comment><USER4> This was one of the first tutorials that got me into React. Very comprehensive, but I never did understand the necessity for using actions and stores on the server.

</comment><comment><USER5> What tool is used to create the diagrams here? Is it GraphViz or something else? Looks very nice</comment>


This Is How People Make Money Out of Thin Air Thanks to the Internet - <AUTHOR> https://quartsoft.com/blog/201706/make-money-internet <comment><USER2> Yea, I don't think novelty is quite the exploitable niche though. The uncertainty regarding whether or not something might become some sort of fad is way larger than whether or not some app with a clear use and target demographic might become at least ramen profitable, if not successful.

Plus, there's no clear inference from successful novelty goods or services to what other possible novelty stuff. Someone might make a better text editor than the ones currently out there. But can anyone improve on the Pet Rock?

It's a quite hard problem.</comment>


Why Isn't Gatsby in the Public Domain? - <AUTHOR> https://www.eff.org/deeplinks/2013/05/why-isnt-gatsby-public-domain <comment><USER3> A similar HN post, which may be of interest: "What Could Have Entered the Public Domain on January 1, 2012?" <https://news.ycombinator.com/item?id=4802849>

I find this overextension of copyright laws maddeningly frustrating. My previous comment (unfortunately) still stands:

Also still under copyright:

"I Have a Dream" until 2038[1]. This is particularly frustrating because the copyright holders include the estate of the person who _delivered_ the speech, but not the estate of the two other people who _wrote_ it (and likely most of it) - not to mention the fact that, by any web-era definition, it was a public performance and also a 'general publication'.

"Happy Birthday" (certainly in the EU until 2016, and potentially in the US too until 2030, though this is disputed[2]).

There is also one movie - whose name escapes me now - which entered the public domain and was then put _back_ under copyright protection subsequently.

In the case of "I Have a Dream", think of the societal cost of raising two generations of students without a complete copy of the speech in their textbooks (as is generally the case).

Alternatively, think of how a 2012 version of "I Have a Dream" would happen today. If hundreds of cell phone recordings of the speech were distributed halfway around the world within mere minutes after the speech, of what relevance would copyright protection be?

[1][http://en.wikipedia.org/wiki/I_Have_a_Dream#Copyright_disput...](http://en.wikipedia.org/wiki/I_Have_a_Dream#Copyright_disput..).

[2] <http://en.wikipedia.org/wiki/Happy_Birthday_to_You>

<comment><USER4> The shorter the copyright, the less incentive there is to create something timeless and lasting (if copyright terms provide incentive to invest in creative work). If spoils are only provided for life+70 years, then an artist may have little incentive to create something that could be enjoyed for a period longer than that.

<comment><USER5> Do people just downvote sarcasm or are people just not recognizing it? Thought this was hilarious.

<comment><USER6> When first reading, I didn't see it as sarcasm, just as an unsubstantiated claim. Rereading it, I'm still not so sure...

</comment></comment></comment></comment><comment><USER7> The original US copyright act protected works for 14 years and was renewable for an additional 14 if the author was alive. I think that's reasonable.

<https://en.wikipedia.org/wiki/Copyright_Act_of_1790>

<comment><USER8> US patents last 20 years with design patents lasting 14 years. Whilst copyright and patents aren't directly comparable (design patents come close) it's hard to see how the size of this disparity makes any sense.

Engineers keep creating their entire lives, if they can help it. Why incentivise artists to capitalise endlessly on their 'one big break'? :/

Edit: or indeed by endlessly charging licensing fees for their particular idea, which is inexplicably considered to be tremendously more timeless than a similar concept in engineering. :/

<comment><USER9> IMO, the length of utility patents should be guarded way more jealously than the length of copyright.

Unlike copyright, a patent gives you a true monopoly over its subject - <USER2> can prevent other people from using an idea even if they came up with it independently. At their worst, patents can stifle further developments in a field. Copyright, even with a ridiculously long term, at least has the property that you can't use it to stop other people doing things independently, so it can't block whole fields in the same way. So the length disparity isn't necessarily unjustifiable.

</comment></comment></comment><comment><USER10> Well, I am reading Gatsby again right now free on my Kindle in view of seeing the film next week. It's available on <http://gutenberg.net.au/ebooks02/0200041.txt>.

Is this illegal for me to bring my Kindle to the U.S.?

The same book search on <http://www.gutenberg.org/ebooks/search/?query=gatsby> shows nothing.

<comment><USER11> Yes, _The Great Gatsby_ entered the public domain January 1, 2011, in countries such as the United Kingdom and Australia that observe copyright for the author's lifetime plus 70 years. F. Scott Fitzgerald died in 1940. But in the United States, under the Copyright Term Extension Act of 1988, _The Great Gatsby_ seems to be protected until 95 years after its first publication, which was in 1925. That may mean January 1, 2021. Project Gutenberg is well aware of the copyright terms in the countries where it operates.

I am not a lawyer. It seems to me that copyright has nothing to do with your possession of a work that you obtained legally. It involves publication, duplication, public performance, and so on.

A bit more about _The Great Gatsby_ and copyright is here: [http://www.guardian.co.uk/books/2011/jan/09/robert-mccrum- co...](http://www.guardian.co.uk/books/2011/jan/09/robert-mccrum-copyright- law-kindle)

About copyright terms in various countries: [http://en.wikipedia.org/wiki/List_of_countries%27_copyright_...](http://en.wikipedia.org/wiki/List_of_countries%27_copyright_length)

(While we're discussing copyright for classic books, some might be interested to learn about the copyright for _Peter Pan_.)

<comment><USER12> I wouldn't put it past the copyright cartels in the US to find some way to bend copyright law to go after people bringing copies of books into the US, even just for personal use, that were obtained in a manner that would be considered illegal in the US. On the other hand, in this particular case, I don't see how the "offender" would ever even get on the cartels' radar for the act of bringing a Kindle (in personal luggage) loaded with books under copyright in the US and in the public domain elsewhere across international borders.

</comment></comment></comment><comment><USER13> Kind of funny that people are talking about Fitzgerald and the rights to make money off of "Gatsby". He obviously intended to make a living off of the book but it didnt sell well. He was paid less than $2,000 for the book and sold the movie rights for $16,666...which is roughly $200K in today's money.

[http://www.marketplace.org/topics/life/money-behind-great- ga...](http://www.marketplace.org/topics/life/money-behind-great-gatsby- fitzgerald-adaptations)

Too bad the book never got the recognition it deserved in his lifetime.

<comment><USER14> Authors in Fitzgerald's time made their money off of short stories. He was apparently making $4,000 per story.

<http://www.people.vcu.edu/~bmangum/fitzstories.html>

I've also heard that all the 19th century novels were so long because originally they were serialized, and the author was basically paid per chapter.

<comment><USER15> >>I've also heard that all the 19th century novels were so long because originally they were serialized, and the author was basically paid per chapter.

That's exactly how A Tale of Two Cities was written.

<comment><USER16> That's how Dickens wrote most of his novels, actually.

</comment></comment></comment></comment><comment><USER17> Just like everything else in this country, because: profit.

Why does the health care system suck? because: profit.

Why do our politicians suck? because: profit.

Why do we go into war without a care? because: profit.

Why is corn syrup subsidized but not salad? because: profit.

Yay 'murica.

<comment><USER18> Some governments just want to watch the world burn.

<comment><USER19> Then the members of those governments should be indicted on a long list of felony charges against the rights of human beings on this planet. The general people suffer because all the money addicts need their fix, and so they pay our politicians to change the laws to accommodate their needs. They don't care about us and they never will as long as they control the printing presses.

</comment></comment></comment><comment><USER20> Amusingly, I wanted to read Gatsby on a plane trip, so at the airport I Googled for it and downloaded the PDF from some Australian university's site. Then I read the whole thing. Later someone mentioned that it was still copyrighted and I argued that obviously not, it was freely available. But apparently not in the USA :-/

<comment><USER21> There are many things that you can download for free off the Internet. That doesn't mean that they aren't protected by copyright.

<comment><USER20> It seemed like a reasonable assumption that a 90-year-old book was in the public domain.

<comment><USER22> Australia has an author's death plus fifty years copyright expiration for books where the author died in or before 1954. Unfortunately, I think we're "catching up" to the US with our copyright laws.

There's <http://gutenberg.net.au/> (no formal relationship with Project Gutenberg) which makes works available that are public domain in Australia (but not the US), and this has The Great Gatsby.

</comment></comment></comment></comment><comment><USER23> The (at least here in Germany) well known book "Mein Kampf" by Hitler loses it's copyright in 2016. The state of Bavaria uses copyright law (German: Urheberrecht) to disallow any distribution of the book. There is an ongoing discussion how the Government can prohibit future distribution of the book, now that it goes into public domain. (<http://en.wikipedia.org/wiki/Mein_Kampf>)

<comment><USER24> It's curious to me that the government (local government in this case, it appears) would want to censor that book. The whole idea of freedom is that people should be free to make up their own mind, and being able to study what Hitler wrote is important to a study of history.

My parents have a copy of Mein Kampf on their bookshelf; not because they're Nazis but because it tells us a lot about what happened.

<comment><USER25> I had (have?) a copy as one of many textbooks for a Holocaust class. Its pretty crazy to read because quite a few things from the 30s and 40s turned out just like planned in the book. Deja Vu feelings all thru. Which led to in class discussions about which modern book, if any, seems equally likely to predict the future. Some peak oil classics were discussed, Camp of the Saints was discussed, a couple others. The unabomber ramblings and quite a few others got discredited. Lots of in class discussion about why the events of WWII seemed inevitable, why was the only response to his very public plans was eventually the D-Day invasion and is that right or wrong way to do it and how so. Its a great book for encouraging in class discussion and hopefully once its finally liberated more history classes and liberal arts synthesis classes will use it as a resource.

This is the academic tragedy of copyright. We have better educational materials for the Civil War than WWII because memoirs and such are free from the civil war.

</comment></comment></comment><comment><USER26> I find it odd that we protect one segment of creatives and not another. Artists get these insane protections yet if you invent something it's up to 24 years and only if you want to spend the time and money getting the protection. What an insane racket.

<comment><USER27> Patents and copyright are _completely_ different. Copyright protects a specific work - you could write a book that has exactly the same plot and characters as _The Great Gatsby_ , and as long as you use different sentences and names, it would not be copyright infringement (just look at the cookie- cutter ripoffs of _Shades of Grey_ \- and for each one that's published, the editor rejected 30 more).

If you have a patent on some mechanism, _nobody else is allowed to use that mechanism_ without your approval, and minor variations are not sufficient to bypass that.

<comment><USER28> Your broader point is a good one, but my understanding (though IANAL) is that while copyright does protect the expression of an idea rather than the idea itself, exactly where to draw the line is a bit of a fuzzy area (see "substantial similarity"[1]). It's not just a work exactly as it was expressed - a written work might infringe even with different names and wording. One test that has been proposed is if "the ordinary observer, unless he set out to detect the disparities, would be disposed to overlook them, and regard [the] aesthetic appeal [of the two works] as the same". On the other hand scenes that are required by the genre generally aren't protected even if they're copied pretty closely (according to scène à faire doctrine[2]).

[1]<http://en.wikipedia.org/wiki/Substantial_similarity>

[2]<http://en.wikipedia.org/wiki/Sc%C3%A8nes_%C3%A0_faire>

<comment><USER9> We should be careful about conflating principle and evidence. That looks like an evidential test to help a court decide whether copying had taken place. If you turn up with what looks like a tweaked copy of Harry Potter claiming you wrote it yourself, no-one's going to believe you -- but if you did somehow manage to prove it on the balance of probabilities (e.g. you've lived your whole life in a sealed metal box and can prove you've never read Harry Potter or something), then you're fine, you've rebutted the evidential presumption.

</comment></comment></comment></comment><comment><USER29> This is an interesting take on the correlation/causation between the impending expirations of the Mickey Mouse copyright and the subsequent extensions of the copyright duration over the past century:

<http://www.techdirt.com/articles/20090811/0123105835.shtml>

</comment><comment><USER30> The only ethical action is to ignore copyright. Publish under CC0/public- domain. Share with your family, with your friends, with everyone. Download to your hearts content.

There is no copyright.

<comment><USER31> > There is no copyright. Well its definitely not hard to find pretty much > anything even somewhat popular for download on the internet somewhere > despite no small effort to prevent it.

</comment></comment><comment><USER32> The article mentions the TPP is on the horizon, which recently got a new trade representative/negotiator in the US.

Here is an email campaign to nag him towards good stewardship, for those interested: <http://www.openmedia.org/froman?utm_campaign=Froman>

The EFF also has a summary of the changeover: <https://news.ycombinator.com/item?id=5647596>

</comment><comment><USER33> If there isn't copyright protection on this work, no one will want to write another book again!

<comment><USER34> Huh? Who is saying no protection is needed? What we are saying is that the protection is far too long.

<comment><USER30> And no restrictions on non-commercial use. Don't forget that.

</comment></comment></comment><comment><USER35> If you're in Australia or Canada, you can find Gatsby links for your kindle or ipad at [http://go-to-hellman.blogspot.com/2013/05/its-legal-to- downl...](http://go-to-hellman.blogspot.com/2013/05/its-legal-to-download- great-gatsby.html)

If you're in the US or Europe, I'd advise you not to find those links.

</comment><comment><USER36> But if Gatsby is not in the public domain, who owns it? If Fitzgerald has no living heirs, who owns the property rights? These would normally transfer to the state of his heirs' residence at the time of their death like any other abandoned property. In the U.S. at least, intellectual property owned (as opposed to licensed) by states is in the public domain. So wouldn't Gatsby be in the public domain by this method, regardless of copyright? In other words, copyright is a property right, but when there is no one left to exercise that right, the property escheats to the state and thereby becomes property of all.

<comment><USER37> He had a daughter who went on to have 4 kids: <https://en.wikipedia.org/wiki/Frances_Scott_Fitzgerald> So presumably they get the money.

</comment></comment><comment><USER38> I argued in a previous thread that there is nothing morally wrong with pirating older works like The Great Gatsby. Unfortunately, that doesn't help with higher-budget derivative works, but it's a start.

</comment><comment><USER39> Because otherwise, Fitzgerald wouldn't have or have had any incentive to invest in creative work?

<comment><USER40> _"What's that? You mean in 2013 people will be able to read my book for free? Well fuck it, I'll just go have another drink instead."_

(Actually to be fair, I don't think "instead" is quite the right word there.)

<comment><USER41> Don't joke. Disney honestly think like that. When home video was introduced they couldn't get their heads round the fact that they wouldn't know how many people would be sitting round the tv watching a movie, and thus Disney wouldn't be able to charge all of these people. Some of them would be watching for free!

Disney have introduced things like single watch video tape (need to be sent back somewhere to be rewound); limited life DVD (special materials, sent in sealed envelope, as soon as it's opened it starts to oxidise); and they still have pretty horrible unskippable trailers and warnings and etc.

<comment><USER42> >limited life DVD

I remember well the original DIVX at Circuit City:

<http://en.wikipedia.org/wiki/DIVX>

I honestly think that failure was a huge reason why Circuit City failed. They built up so much ill will from a technically literate audience.

<comment><USER41> Wow. I was talking about (<http://en.wikipedia.org/wiki/Flexplay>) so there's a few different systems around.

> _Flexplay is a trademark for a DVD-compatible optical video disc format with > a time-limited (usually 48-hour) playback time. They are often described as > "self-destructing" although the disc merely turns black and does not > physically disintegrate. The same technology was used by Disney's Buena > Vista Home Entertainment under the name ez-D._

</comment></comment></comment></comment></comment><comment><USER43> You guys ever read 'Melancholy Elephants' by Spider Robinson?

<http://www.spiderrobinson.com/melancholyelephants.html>

</comment><comment><USER44> The public didn't write it, Mr. Fitzgerald did. Therefore, both he and his heirs are entitled to reap the profits of that work. I have zero problems with literature holding copyright for as long as someone is willing to manage that copyright.

</comment><comment><USER45> So the company who owns the rights to it can make a nice chunk of change off new book purchases (especially the purchases made by the buzz from the movie).

</comment><comment><USER46> I think its in the public domain in other countries (i.e. australia)...silly that you could get it for free down there and schlep it back here.

</comment><comment><USER47> Meyer Wolfsheim would never hear of it. :-)

</comment><comment><USER48> Article doesn't answer question posed in title.

</comment><comment><USER49> It's a fashion to bash copyright laws but lot of people forget that without economic instrument called copyrights it would be almost impossible to produce/consume works that bears high risk/investment.

If you had a house, you don't expect it to become part of public domain after 100 years. You neither expect wooden table you made in weekend or jewelry you designed to be automatically in public domain after X years. Infect you would probably argue that government has no right to confiscate your property and it should rather be inherited by whomever you desire forever after your death. Why music/books/software that _you_ create should be any different?

<comment><USER50> > It's a fashion to bash copyright laws but lot of people forget that without > economic instrument called copyrights it would be almost impossible to > produce/consume works that bears high risk/investment.

What are you talking about? No one has a problem with limited term copyright like you are talking about. We have a problem with infinite term copyright.

How does _retroactively_ extending copyright length provide any of the benefits you are claiming?

> Why music/books/software that you create should be any different?

They aren't any different. You are allowed to bequeath music, books, software (sometimes) to people. Haven't you ever given a CD away?

If you are trying to refer to intellectual property, then you are talking about a made-up right. The only reason we even grant this made-up right is because there is a quid pro quo. If there is no cultural/societal benefit to enforcing this made-up right, then why shouldn't we unmake it?

<comment><USER51> _No one has a problem with limited term copyright_

Well, some of us do. But it's certainly not the majority, even here.

<comment><USER52> Even the Pirate Party (at least the UK one) only wants to reduce copyright length, not abolish it.

<comment><USER51> Well, if I was to advocate among the general public for a policy change, I'd advocate for something more palatable as well. You shouldn't assume those are necessarily the end goals of the party members. It might just be a compromise.

</comment></comment></comment></comment></comment><comment><USER53> Big false dichotomy. That director most likely could have made Romeo and Julet even if they'd had to pay a licence fee, just like how he's now managed to make a film adaptation of Gatsby, which will likely also be a box office success and enrich the culture of film.

This really just boils down to some people being mad that they can't make money off derivative works because other people are making money off the original work. Boo hoo.

</comment><comment><USER54> If you create something, _it belongs to you._

I guess somebody didn't learn this lesson in kindergarten, and still wants to whine and complain in an effort to effectively nationalize what is rightfully private property.

<comment><USER55> Why should MY tax dollars be used to enforce YOUR copyright?

If you want to protect it, go hire your own police and build your own courts; stop using mine.

<comment><USER54> I pay taxes, too.

In an ideal society, I wouldn't be opposed to those seeking copyright enforcement paying the costs, although the costs would presumably eventually be passed on to the infringers. We will never see such a society in our lifetimes, though, so it's a somewhat moot point.</comment></comment></comment>


Gmail Has 350 MM Active Users - <AUTHOR> http://thenextweb.com/google/2012/01/19/gmail-closes-in-on-hotmail-with-350-mm-active-users/ <comment><USER2> Survey:

-What are your favorite gmail features?

-What do you wish it had?

I access gmail at least 20x/day and I still stumble upon new features. Just learned about "OIB" yesterday.

<comment><USER3> I'm actually amazed at all the things that Gmail _doesn't_ do after all these years:

\- It doesn't let me search for untagged messages.

\- It doesn't let me search or auto-tag by contact.

\- It doesn't let me view messages in a fully-threaded, rather than flat- threaded format.

\- It doesn't let me read my mail in a two-pane format, where headers are in on pane and the body of a message is in the other.

\- There's a lot of functionality for which there is no keyboard shortcut. E.g., displaying inline images.

\- The built-in GUI editor often doesn't do the right thing. I.e., it _routinely_ just does weird stuff.

I guess, overall I'd say that Gmail is the worst web-based email client -- _except_ for all the others.

<comment><USER4> >> \- It doesn't let me search for untagged messages.

Yes it does (I think I must be misunderstanding what you mean by untagged)

>> \- It doesn't let me search or auto-tag by contact.

Yes it does (you can search for a contact, and you can setup a filter to auto tag)

>> \- It doesn't let me view messages in a fully-threaded, rather than flat- threaded format.

Why would you want this? Gmail's threading system has been widely copied and I've always thought of it as obviously superior.

>> \- It doesn't let me read my mail in a two-pane format, where headers are in on pane and the body of a message is in the other.

Fair (though there is a google labs feature which lets you view message bodies without leaving your inbox by double clicking).

>> \- There's a lot of functionality for which there is no keyboard shortcut. E.g., displaying inline images.

Do you really think there should be a shortcut for something like that? This example is especially worrying because it's a security feature.

>> \- The built-in GUI editor often doesn't do the right thing. I.e., it routinely just does weird stuff.

I have no idea what you mean by this, but I'll assume you mean the rich text editor, and I haven't really experienced "weird stuff."

<comment><USER5> _Yes it does (I think I must be misunderstanding what you mean by untagged)_

Show only messages without any tag? Seems pretty clear to me.

 _Do you really think there should be a shortcut for something like that? This example is especially worrying because it's a security feature._

How is a keyboard shortcut any more worrying than a link? It doesn't have to be a single key, it can be a combination.

Personally, this is what drives me crazy with Gmail. I can almost, but not quite, use it without a mouse. It works for most stuff, and then you get stuck.

I moved to Thunderbird (+muttator) just because of that.

<comment><USER6> >Show only messages without any tag?

Can you search "-tag1 -tag2 ..." ? I only have 10 tags, so if I really needed to do this, it's fairly acceptable. Not sure if you have a gazillion or something.

<comment><USER3> That's the canonical answer to this conundrum, but I have lots of tags, so this solution is not acceptable to me.

</comment></comment></comment></comment></comment></comment><comment><USER7> What does "MM" stand for? Million Monthly? I see this term everywhere, but cannot find a definition.

<comment><USER8> It's million, derived from M, Roman numeral for one thousand, one thousand one thousands is one million.

<comment><USER9> I can't find any source for this, but it seems more likely MM is an abbreviation of "mille mille."

MM in Roman numerals would just be 2000. 1 million would be written as M with a bar over it. [1]

[1] <http://en.wikipedia.org/wiki/Roman_numerals#Large_numbers>

</comment></comment></comment><comment><USER10> Users or accounts? I've personally made at least 5 or 6 gmail accounts and I bet there are plenty of people that have made more than that.

GMail is a great service.

<comment><USER11> The headline says "active users" -- by which they might mean, users who have actively logged into the site in the last 30 days.

<comment><USER10> but if I log in to 5 different email accounts I'm still just one user.

</comment></comment></comment><comment><USER12> GMail really got 90 million new users since October? Why? Seems like an especially random time.

<comment><USER13> Probably lifted by their push of Google+ to sit down and create an account. If you already had a Hotmail or Yahoo account, you may not have had a reason to create a Google account of any kind.

</comment></comment><comment><USER14> Logged into 4 accounts right now.</comment>


How Are Humans Unique? - <AUTHOR> http://www.nytimes.com/2008/05/25/magazine/25wwln-essay-t.html?partner=rssuserland&emc=rss&pagewanted=all

<comment><USER2> To suggest that the only major difference betweeen humans and chimps is social seems kind of stupid to me. The human brain is obviously more advanced and capabile of more complex resoning beyond that of simple social interactions.

<comment><USER3> I think a better way to state it is that the major differences you're picturing between humans and chimps might actually be social in origin.

<comment><USER2> I'm sure that is the basis of this guy's argument, but the biggest differences are the physical ones in the brain. Did those physical changes occur due to social pressures? I don't know and neither does the author. It is a weak argument.

<comment><USER3> What differences are there in the brain besides physical ones? And the point is not that the changes happened because of social pressures, but because more complicated forms of social interaction aided our ability to work in groups to survive.

For example, I don't think it's a major stretch to imagine that rudimentary mathematics might've arisen so that we could communicate to each other hunting distances, necessary food rations, etc...

By the way, I think your point is valid, and I'm not sure why you're being downmodded. It seems that downmod here is becoming more like the reddit disagreement downmod than indicating whether the content of the post is valid, as it should be.

</comment></comment></comment></comment><comment><USER4> Humans share more DNA with Ayn Rand than apes do.

<comment><USER5> And yet, most would rather share more with apes than Ayn Rand.</comment></comment>


The findings of medical research are disseminated too slowly - <AUTHOR> http://www.economist.com/news/science-and-technology/21719438-about-change-findings-medical-research-are-disseminated-too <comment><USER2> No no no no....

Don't give them more money! Journals already have far too much power. They already publish research in a way that serves their own financial needs. They are too slow. They make you do all the writing, editing, formatting and figure design for free, then they charge people to read your publicly funded research. They make you put your data in an excel spreadsheet or a PDF. They fail miserably at peer review. At my institution, editors of nature journals are going around and giving seminars on how to publish in their journal - journal editors giving SEMINARS to ACTUAL SCIENTISTS. Absurdity.

All of this will sink journals. They just don't know it yet. Their strategy seems to be to become more like news outlets, publishing opinion pieces on how to fix scientific publishing, yet never actually changing what they do. The only reason it survives is because more than anybody, scientists learn to put up with all sorts of shit.

<comment><USER3> > They make you do all the writing, editing, formatting and figure design for > free

Shouldn't research scientists be the ones who write? I mean, who else knows the intimate details about your experiments that need to be communicated to posterity? And, do they really make you do the formatting? My understanding is you basically just give them an easily readable pdf version of your paper... in standard double spaced 12 font arial, and when it gets accepted they are the ones who choose the pretty fonts (probably with Indesign) and revise your figures so they don't look crappy.

That said, I'll say one nice thing about the system (partly in the spirit of contrarianism, as hardly anyone has good things to say about top journals:)). If you really want to be published in a top journal, there are two routes: 1) make something really ground-breaking... and then you can even submit a crappily-formatted paper with ugly figures and you'll still get accepted -- and they'll make good figures _for_ you! 2) have something decently good... make good figures, make sure you follow formatting guidelines to a tee and make everything as easy as possible for the editors, and then hope for the best. I think this situation is not too bad.

<comment><USER2> Obviously you write your own paper. The point is the journals profit from your work, yet they expect you to do everything for free. Then they charge your university's library a fortune so you can access your own paper. If someone wants to reuse a figure from your paper, which you made yourself, and represents data from publicly funded research on patients that donated their time and body for the betterment of society, the journal wants to charge $500.

I've realised that scientists will put up with almost anything. You have to be that way, otherwise you won't last. But when Elsevier makes billions of dollars in profit, and the person that reviews the papers for them lives in a box subsisting on instant noodles with no job security, you have to ask some questions. We don't actually need Elsevier. If they disappeared tomorrow science would march on largely unperturbed. Elsevier needs the scientists, and bless them, they have found a way to put us to work for free and sell us the product at the same time.

</comment></comment></comment><comment><USER4> While I appreciate the trend towards open-access and wider dissemination, I don't think that the _slowness_ of dissemination is one of the bigger problems in medicine.

Given that the subject deals with trying to "fix" complex, organic systems, it's worth taking time to get things right before designing interventions. It is important to realize that a flood of rapid communication often makes it harder to settle on the underlying truth (as clearly evidenced by the recent atmosphere) by rendering the search process unstable.

As some other articles (on the HN front page) have recently argued, the rush to faster publication is one of the biggest causes of research debt. And I think that is a much more important problem to solve. So, by all means let's have open-access and also more distilled dissemination. But optimizing for speed (eg: race to publish) often gets in the way of correctness.

<comment><USER5> Right now we have research that is slow to publish, but publishing is careful, and once published we treat is as a kind of truth. You can call it a "Brittanica" approach.

Alternative is not just a faster publishing, but more feedback, and better discussion around the subject. You could call it a "Wikipedia" approach.

In the "Wikipedia" approach, you don't rely on the publisher's prestige, nor citations, as a meter of trustworthiness. Before accepting the results you review it's discussions and critique.

A similar switch happened with traditional news publishing. Years ago you had to rely on the fact that an article was published in Economist, and vetted by their good editors. Nowadays, there is a lot of independent content, and there are communities (like HN, or Reddit's AskScience), and non-profits (fact checkers, or Snopes) that point out the potential issues.

<comment><USER6> I don't think using the decentralization of news as a comparison is a good one. I agree that there are great things about new media outlets, but on the balance we are arguably worse off -- news is more polarized and political than ever. There's more great analysis and commentary online, but there's also more analysis and commentary in general.

</comment></comment></comment><comment><USER7> Loved the end of the article:

Having survived three and a half centuries, scientific journals will no doubt be around for a long time yet. With luck, though, they will return to being science's servants, rather than its ringmasters.

</comment><comment><USER8> The majority of journals I know provide an open-access option: you pay a few thousand dollars publication fee such that everyone else in the world can read the electronic version for free. PNAS has this option. Nature, I believe, make an article free in several months/a year if you opt to open access. A few funding bodies, such as Wellcome Trust, have requested to publish in the open access model for several years (these funding bodies pay for the publication fee as long as you can get your paper accepted). I am not sure what the Gates foundation is doing differently here.

<comment><USER9> Note that, to a lab just starting out "A few thousand dollars" is a non- trivial expenditure.

<comment><USER8> Yeah. Understand that. But journals are not charity. Someone has to pay for publication and distribution. It is either readers, authors or funding providers. Or you could get rid of the costly midman/publishers, but I am not sure an academic world with preprint servers only would be a better one.

<comment><USER10> Some countries/universities have reserved pots of money for OA fees, sadly it isn't common.

I have myself published a few papers with PhD students that should have been OA but we used the PhD students' allocated funds to send that student to a relevant conference, that's a better prospect for their career.

</comment></comment></comment></comment><comment><USER11> Article is about free access to bio/med research. Some thoughts:

Would love to see rate of adoption of new standards of evidence based medical care as a function of institutional access to top journals or simply Uptodate (the tool people actually use nowadays). Access to curated guidelines may be more clinically important than primary lit.

One reason prestigious journals are great is you get the imprimatur of success for further funding/promotion without needing to wait for citations and scientific consequence. Perhaps an opensource analytics team will over time convert the community to other metrics like reads, shares, and other h-factoresque metrics (granted all are contrived and gamable to some degree), perhaps tied to some funding consequences. Cough, ResearchGate, cough.

Regarding thread title: The small number of good medical findings are disseminated far too slowly; the large number of irreproducible, contradictory, poorly supported, and statistically misinterpreted findings are disseminated far too quickly. Couldn't resist.

</comment><comment><USER12> For those not in the field, it's worth noting that a good deal of research is disseminated prior to publishing (or while "in press"/waiting to be published) via conferences or word of mouth.

<comment><USER13> The reach should be quit limited or not? Imo it's kind of the point to make it accessible to everyone.

</comment></comment><comment><USER14> Most research work is fraudulent, how does disseminating it faster address quality concerns?

</comment><comment><USER7> It says that the fact that physicists share more their work than biological sciences, because the first ones are more computer savvy. The conspiracy theorist in me thinks that biological science papers are more forged due to Big Pharma profit motivations. Physicists have more difficult to manipulate their data.</comment>


BentoML: A platform for serving and deploying machine learning models - <AUTHOR> https://github.com/bentoml/BentoML <comment><USER2> Thanks for sharing the project Kevlar1818.

BentoML author here - we are building BentoML to empower Data Scientists to ship prediction services instead of delivering "models" to dev teams. We proposed a workflow that made it easy for data scientists to create and test prediction services and then deploy them to cloud platforms such as AWS Lambda, SageMaker or Docker/Kubernetes.

Happy to answer more questions, cheers!

</comment><comment><USER3> Interesting project, I've heard a lot of good things about GraphPipe for Model Serving with support for multiple languages (Go, Python, Java) [https://github.com/oracle/graphpipe](https://github.com/oracle/graphpipe)

<comment><USER2> Graphpipe solves a very unique problem when building ML model serving system, although BentoML is trying to solve a very different problem. We think it would be interesting to support GraphPipe's flatbuffer format in BentoML's REST API model server down the line if people are interested in that.

</comment></comment><comment><AUTHOR> The project's documentation gives a better overview of its capabilities:

[https://bentoml.readthedocs.io/en/latest/quickstart.html](https://bentoml.readthedocs.io/en/latest/quickstart.html)

<comment><USER2> Our quick start guide notebook on Google Colab is also a great place to get started!

[https://colab.research.google.com/github/bentoml/BentoML/blo...](https://colab.research.google.com/github/bentoml/BentoML/blob/master/guides/quick- start/bentoml-quick-start-guide.ipynb)</comment></comment>


Show HN: SendOtterLove.com – Send someone loving otter puns - <AUTHOR> https://www.sendotterlove.com/ <comment><AUTHOR> OP here, uhh, AMA?

Preemptive answers:

1\. Yes, this was _heavily_ inspired by Goat Attack ([https://goatattack.com/](https://goatattack.com/)).

2\. Python, Django, Twilio, Stripe, and Heroku.

3\. Partner in crime: aubricus.</comment>


Show HN: IRedis: CLI for Redis with AutoCompletion and Syntax Highlighting - <AUTHOR> https://github.com/laixintao/iredis/ <comment><USER2> This is really great! The tui is very intuitive and the auto-complete a great addition.

It even highlights keys and values differently: [https://i.imgur.com/mrOMBUi.png](https://i.imgur.com/mrOMBUi.png)

It also handles redis server weirdness as well by faithfully relaying error messages.

I haven't explored the tool too deeply but would it be possible to get keys from redis itself to assist with auto-complete?

<comment><AUTHOR> Hi dpbriggs!

I think it is a good idea to auto fetching the keys (among ohter things like set's members, etc). I wrote some ideas here, it was on the plan!

[https://github.com/laixintao/iredis/issues/255](https://github.com/laixintao/iredis/issues/255)

</comment></comment><comment><USER3> I installed it with the only hope it would recognize Redis URIs like redis://name:password@host:port/db, unlike redis-cli, which requires me to type each part of the URI separated in different flags I never remember.

Turns out it doesn't, but maybe someone will hear me in the future!

<comment><AUTHOR> Hi fiatjaf,

This feature has been implemented and released on v1.2, please give it a try!

Also, you can store dsn alias on config, check it out: [https://github.com/laixintao/iredis#using- dsn](https://github.com/laixintao/iredis#using-dsn)

<comment><USER3> Great, iredis --url will save my life, thank you!

</comment></comment></comment><comment><USER4> I just took a peek in the code to make sure it didn't use the "keys" command. I see you give a warning for a list of dangerous commands. Good thinking!

<comment><AUTHOR> Yes currently iredis won't send any command secretly, behave like redis-cli. The completion is based on history.

</comment></comment><comment><USER5> That looks great! I guess it can support other DB from its base.

<comment><AUTHOR> Yes, have look at the project page: iredis.io/

You may also like [https://www.dbcli.com/](https://www.dbcli.com/) (actually iredis is joining dbcli)</comment></comment>


Is BGP Safe Yet? - <AUTHOR> https://isbgpsafeyet.com/ <comment><USER3> A professor at my University mentioned that when he was a student, the professors at that time claimed that the security of BGP is a solved problem and nobody is going to talk about it in ~2 years. This was +20 years ago. He has spent a lot of his research on an alternative for BGP called SCION[1], as the adaption of BGPSec is not very straight forward and rather an ugly fix. I think it is pretty interesting that the problems of BGP are not discussed more widely and often.

[1] [https://www.scion-architecture.net/](https://www.scion-architecture.net/)

<comment><USER4> I worked for a big European network vendor and ended up on a project trying to sort out the utter mess that is legacy SS7.

SS7 networks are basically wide open, with no auth and anyone can get an SS7 hub for cheap and start sending nefarious commands to peoples handsets. They can forward or record calls and read SMS. They can track you or they could just be a jerk and keep rebooting your phone. Worse still it can be used to intercept 2FA codes over SMS, which is the approach a lot of banks are taking for personal account security. intelligence agencies are without a doubt using it for intercepting and tracking.

The Telcos are lost with how to address the issues combined with cost considerations, so most are taking the approach of hoping it stays out of the news and waiting for it to eventually be deprecated from the network.

<comment><USER5> I hope in the long the telco world will adopt the internet approach of treating the network as untrusted.

</comment></comment></comment><comment><USER6> It would be interesting to read more about the _problems_ with RPKI. The set of organizations that need to implement RPKI to make it effective is pretty small, and yet it's been a long slog to get it even to this point. It's not like network engineers at Google, Comcast, and Verizon are unfamiliar with it. What's going wrong?

<comment><USER7> RPKI doesn't sign hops in the path for a BGP update. That means to hijack a prefix, all you need to do is to take a legitimate route and re-advertise it with your AS as the second hop in the path.

This isn't as damaging as being able to advertise a smaller prefix because it won't send _all_ traffic to you. It will just send from routers where your path is shorter than the original.

To actually prevent hijacking via path shortening attacks like this, you need a full BGPSEC implementation [https://en.wikipedia.org/wiki/BGPsec](https://en.wikipedia.org/wiki/BGPsec) which is a much higher barrier than RPKI because the crypto operations jump 1 or 2 orders of magnitude (signing every re-advertised route rather than just originated routes).

So RPKI gets the cert infra in place, but it doesn't really fully solve the problem.

<comment><USER8> But, with RPKI getting the cert infra in place, would that not then make it relatively easier to take that 2nd step, than when not even RPKI was in place?

<comment><USER9> The problem is the number of updates / changes that happen all the time in BGP, and having each router cryptographically validate each one / sign every update it sends.... it doesn't scale well.

The BGPSEC theory is there but not sure if we can make a workable system.

[https://www.potaroo.net/ispcol/2011-07/bgpsec.pdf](https://www.potaroo.net/ispcol/2011-07/bgpsec.pdf)

<comment><USER10> Current routers can't handle it, but ... it's not like routes changes _that_ much that we're talking about an intolerable amount of RSA operations. We're really talking about fewer operations per day per router than some web frontends do in a second.

<comment><USER6> That doesn't sound right? In 2018 there were, according to Geoff Huston, days with 700,000 updates per day. That sounds high for handshakes/second.

<comment><USER10> OK, OK, my bad; a single large multicore NGINX box can only do about 100k full TLS handshakes per second with 2048 RSA. So it'd be several seconds.

On the other hand, verify is cheaper. My crappy laptop will do ~320k RSA-2048 verifications per second...

<comment><USER11> [https://www.nginx.com/wp-content/uploads/2014/07/NGINX- SSL-P...](https://www.nginx.com/wp-content/uploads/2014/07/NGINX-SSL-P..).

350 per core per second... you are way off at 100k/s.

If there is such a thing I'd really like to see setup to get it running / try it out myself as well.

do note there are ways to cache ssl data so connections are resumed / avoid handshake again for same user

<comment><USER10> [https://www.nginx.com/blog/testing-performance-nginx- ingress...](https://www.nginx.com/blog/testing-performance-nginx-ingress- controller-kubernetes/)

60k/second across 24 cores, admittedly on very fast hardware (though not using all the cores that hardware has). Pretty much the same number on 16 cores.

In general, telling someone they're "way off" about performance and citing 6 year old benchmarks isn't a winning plan.

In any case, it's immaterial to what we're discussing. My slow laptop could verify all the signatures for a busy day of updates in a couple seconds, and it's clearly -possible- to put a big fraction of this horsepower in a router.

<comment><USER11> Thanks for the reference, new benchmark looks nice.

Apologize for the 'way off', its reach-able.

And agree its immaterial to signature checks, but since it was brought up...

Either way, there is probably something holding routers back from reaching that, would be fun to speculate.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Hrm...

I have been a huge fan of Hurricane Electric (he.net) for over ten years and have done a lot of evangelizing ... rsync.net uses he.net pops all over the world (except for Zurich, where we use init7...).

They have been very progressive, clueful and efficient in all of our dealings with them.

So I am surprised to see them marked unsafe. I have emailed my point of contact there and asked for some explanation - perhaps I can update this comment in a bit ...

<comment><USER13> A startup company that several of my friends worked at many years ago had boxes that continuously monitored routing around that would and would flag and delay BGP updates that caused a significant topological change. They could be added manually immediately, or would be implemented with a delay after they had enough data that the route was legitimate.

My ISP had one of these boxes and was quite proud of it. It worked really well against BGP idiocy. It might not have worked against a concerted attack, but it did stop several of the "Ooops. All the routes are belong to us." problems that seem to be the "normal" BGP "attacks".

I am surprised that these big players don't already have something that does something similar.

<comment><USER14> Of course they do have such equipment, which makes you wonder how sophisticated the attacks are and now flimsy the security is. It's obvious that this equipment exists. How else would the equipment in the same or likely next room over [0] know the state of packets that need further routing adjustments?

Maybe the relevant parties didn't get the message because the call was coming from inside the building. [1]

[0] [https://en.wikipedia.org/wiki/Room_641A](https://en.wikipedia.org/wiki/Room_641A)

[1] [https://tvtropes.org/pmwiki/pmwiki.php/Main/TheCallsAreComin...](https://tvtropes.org/pmwiki/pmwiki.php/Main/TheCallsAreComingFromInsideTheHouse)

<comment><USER9> I'm not so sure.

The internet community (I.e. routing guys/Nanog/ietf etc) is fairly open. I've not heard much of such approaches being used. It is a very interesting idea.... I guess you gotta weight delaying inserting an update with potentially blackholing a destination until you do.

<comment><USER14> For an quick dragnet to get an IP in a sea of noise, it would work. In any case, you just have someone else do it, accidentally of course. The more accidental and and wide reaching and quickly reverted the outage is, the more plausibly deniable it is.

I agree that this approach isn't really suitable for much else because it's much too overt and likely to notify the target. Modern engagements use BGP hijacks as a critical tool with a lot of capabilities but also extreme visibility and publicity. So it's not good for most jobs as other better suited tools for those jobs already exist. [0] [1]

[0] [https://en.wikipedia.org/wiki/Operation_Onymous](https://en.wikipedia.org/wiki/Operation_Onymous)

[1] [https://arstechnica.com/tech-policy/2015/11/fbi-the- allegati...](https://arstechnica.com/tech-policy/2015/11/fbi-the-allegation- that-we-paid-cmu-1m-to-hack-into-tor-is-inaccurate/)

</comment></comment></comment></comment></comment><comment><USER15> OpenBSD just released a portable version of their privsep rpki-client(8)* this week!

[https://www.rpki-client.org/](https://www.rpki-client.org/)

rpki-client 6.6p1 was released Apr 13, 2020: [https://www.rpki- client.org/txt/rpki-client-6.6p1.txt](https://www.rpki-client.org/txt/rpki- client-6.6p1.txt)

* [https://man.openbsd.org/rpki-client](https://man.openbsd.org/rpki-client)

Looks like there may be problems with the mirror sites, a generated tarball is on the official portable github, but it may be worth waiting for an official announcement as github can re-roll these (it's not an uploaded release asset): [https://github.com/rpki-client/rpki-client- portable/releases](https://github.com/rpki-client/rpki-client- portable/releases)

<comment><USER16> please check back in a few days, we are almost there.

you can also work with [https://github.com/rpki-client/rpki-client- portable](https://github.com/rpki-client/rpki-client-portable) currently runs on a bunch of systems! coming to packages in the popular formats close to you soon!

<comment><USER15> Thanks for the update!

</comment></comment></comment><comment><AUTHOR> More details on the problem of BGP hijacking and how the IsBGPSafeYet.com test was implemented: [https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing- sec...](https://blog.cloudflare.com/is-bgp-safe-yet-rpki-routing-security- initiative/)

<comment><AUTHOR> Also Wired story: [https://www.wired.com/story/cloudflare-bgp-routing-safe- yet/](https://www.wired.com/story/cloudflare-bgp-routing-safe-yet/)

</comment></comment><comment><USER17> the most promising replacement is the SCION[1] project. See section "Authentication and PKI"[2]. It's already used by SwissCom and another CH based ISP. It can do path selection, geo-fencing, and traffic shaping. Really cool DDoS mitigation[3] as well. It has been previously discussed on HN[4].

[1] [https://www.scion-architecture.net/](https://www.scion-architecture.net/)

[2] [https://www.scion- architecture.net/pages/publications/](https://www.scion- architecture.net/pages/publications/)

[3] [https://news.ycombinator.com/item?id=21546214](https://news.ycombinator.com/item?id=21546214)

[4] [https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=SCION%20project&sort=byPopularity&type=all)

<comment><USER18> I'm not sure thats truly "promising" in any sense :)

</comment></comment><comment><USER19> Interesting response to this by UK ISP Andrews & Arnold: [https://www.aa.net.uk/etc/news/bgp-and- rpki/](https://www.aa.net.uk/etc/news/bgp-and-rpki/)

<comment><USER9> I love the way they basically say they are gonna do their own assessment and won't roll in behind the consensus on RPKI. Like the trend-setting industry leaders they are.

They deserve to be called out for this. It's not hard to implement RPKI. Only valid excuse is if your routers don't support it.

Signing ROAs is trivially easy in the RIPE region. Why haven't they done so before the pandemic???

Wasting time with this response instead isn't maybe the best use of their time.

</comment></comment><comment><USER20> For those who don't have their own Autonomous System, but want to play with RPKI validation, you can join DN42 [1] and validate routes there.

Netravnen kindly provides a route export compatible with GoRTR and Routinator [2], which has been working nicely for me.

[1] [https://dn42.us](https://dn42.us)

[2] [https://github.com/netravnen/dn42-roa- export](https://github.com/netravnen/dn42-roa-export)

<comment><USER21> This is really frickin cool thanks for sharing it.

</comment></comment><comment><USER22> This is actually a very very powerful idea.

The trick is to get something VPs / "Decision Makers" can use to make decisions that's easy for them to digest especially if they are not technically sophisticated. This meets that criteria.

They should add microsoft azure to this list.

This could absolutely become an RFP requirement / preference point for a lot of compliance focused / not only tech focused buyers (govt / large agencies and companies)

A huge thumbs up!

</comment><comment><USER23> Wow the diagrams are really well done here. Really well-made and presented.

<comment><USER24> Yes, they look really great and responsive, too. I'd actually like to know how they were done... Are they just basically coded by hand or is there a visual tool you can use to design interactive graphical stuff like this in what I guess is HTML5/CSS/maybe JavaScript, similar to (dare I mention the word) Flash in the olden days? (Sorry, haven't done any web development in decades, obviously :-)).

<comment><USER25> Yup, they were coded by hand!

Here was the initial commit which added the first diagram (originally there was only one):

[https://git.io/JfJ4K](https://git.io/JfJ4K)

<comment><USER16> a really cool way to explain RPKI, thanks for sharing!

</comment></comment></comment></comment><comment><USER26> It seems to me that trust is not a global thing. If A trusts B then that does not mean that C would also trust B. Does the protocol capture that principle?

<comment><USER27> No it doesn't.

I remember the first time i setup a rack of servers in a cage in a datacenter for a company i founded. We bought a block of IPs in bulk and then we bought an interconnect from a provider within the datacenter. To get those IPs pointing to our server we had our severs announce ownership over BGP. It's that easy.

Usually BGP messages are filtered out by routers. Otherwise home users would announce ownership of the Google addresses and have all those messages come to them for example. But if you have access to an interconnect in a datacenter you can state you own whatever IP addresses you want. There's really nothing at all stopping it right now.

<comment><USER28> Many upstream transit providers have route filters in place. They won't accept any route, like they did in the 90's. Some still do, of course.

Also, normally you have your _router_ announce routes over BGP, not your _servers_.

</comment></comment></comment><comment><USER9> While RPKI is great, saying BGP will be "secure" once it's deployed is not true.

It'll be more secure, sure. But RPKI only addresses origin validation, not path validation. It won't stop me announcing your space spuriously provided it has your AS as the origin. Path-validation a la BGPSEC would be needed to stop that. But that's an extremely difficult problem to solve given the amount of churn in the global routing table. The amount of crypto validation routers would need to do is prohibitive. And Moore's law doesn't help because as CPU power goes up so do the key sizes we need to use.

Either way people should implement RPKI, or at least sign ROAs for their space. It's easy to do and makes a bit improvement.

</comment><comment><USER29> I would argue that for BGP to be safe, all ~68,000 autonomous systems will need to embrace RPKI, not just a handful of ISPs/telcos/CDNs. Akamai is announcing ~2,300 prefixes, shouldn't they use RPKI?

<comment><AUTHOR> Yes, though it's a bit like if every airline implemented an accurate COVID-19 health check. You'd still have local problems, but the infection would keep from spreading worldwide. In the case of BGP, if the major transit providers properly filter routes, hijacks do much less damage to the broad network.

<comment><USER30> How are you verifying compliance? It looks like to pass the test all I need to do is implement filtering on my interconnects with Cloudflare (or just drop 18.104.22.168/24 entirely).

To your example, airlines could screen passengers flying out of Eastdakota Regional Airport but nowhere else.

<comment><AUTHOR> We can always change up the bad IP range announced.

But, more generally, I think the network engineers at ISPs want to implement RPKI. It's the managers who haven't prioritized. Hopefully this helps escalate it as a priority.

<comment><USER18> Very few people want to implement RPKI, those that are doing it either are really hot for it or are being forced to do it.

</comment></comment></comment></comment></comment><comment><USER31> [http://isThisYourPaperOnSingleServingSites.com/](http://isThisYourPaperOnSingleServingSites.com/)

<comment><USER14> Thank you for this link.

I really appreciate this kind of meta-commentary on the recent trend of single purpose sites. It would be easy to dismiss them, but they're as much a part of the web as any other content a browser can render. It's a sign of a mature platform when you have trends and norms while also admitting outliers and oddities.

</comment></comment><comment><USER32> I have no comment re: the actual campaign but I find the site wonderfully clean.

<comment><USER33> going on a tangent here... I looked at the stylesheet ([https://isbgpsafeyet.com/index.css?v=24](https://isbgpsafeyet.com/index.css?v=24)) and saw things like `border-top-color: currentColor;` and other variables used in plain CSS that I didn't even know you could do.

<comment><USER25> (Designer here) YES! `currentColor` is amazingly useful and supported everywhere [https://caniuse.com/#feat=currentcolor](https://caniuse.com/#feat=currentcolor)

</comment></comment></comment><comment><USER34> Love this effort. [EDIT: Removed poorly thought out idea]

<comment><USER35> I would discourage this approach. Internet spam-generating campaigns aren't really an effective way of creating change, and the poor employee required to read the emails at that contact address is probably not responsible for the decisions holding up implementation.

Which is to say: Please don't advocate for behaviors that harass line employees at corps you don't like.

<comment><AUTHOR> Agree. Mentioning them on Twitter is one thing. Harassing NOCs already stressed during this time of unprecedented Internet usage is another.

<comment><USER34> Point taken. Please excuse the over exuberance during uncertain times.

</comment></comment></comment></comment><comment><USER36> What is the barrier of entry for an individual or company to obtain a public ASN and theoretically announce a nefarious route?

Would it come down to an irresponsible ISP blindly trusting the bad router?

It does seem important for not putting this burden on each ISP, just trying to understand the scope of all this.

<comment><USER37> Getting a public ASN is relatively trivial. If you're curious, you can read more about it here: [https://www.arin.net/resources/guide/request/](https://www.arin.net/resources/guide/request/)

As for whats stopping the announcement of bad routes? Mostly just the ISPs, the big transit providers, and the IX's.

The problem isn't the small users. You, as a nefarious individual, are unlikely to be able to cause much real damage. In datacenters where you don't bring your own dedicated transit (expensive), you have to tell them your ASN and IP information so it gets whitelisted.

The problem is large players. If China Telecom wants to claim Google's IPs... well the entire world's transit providers may not acknowledge that - <USER2> enough will to cause a real problem. More examples: [https://en.wikipedia.org/wiki/BGP_hijacking#Public_incidents](https://en.wikipedia.org/wiki/BGP_hijacking#Public_incidents)

<comment><USER36> Thank you for the detailed reply, exactly what I was looking for and very interesting!

</comment></comment></comment><comment><USER38> Another RPKI tool: [https://rtrlib.rpki.net/](https://rtrlib.rpki.net/) allows to fetch RPKI data from a cache server. using the rtrclient, which is part of the package, you can export ROAs to any format.

</comment><comment><USER39> I was playing around with this, and it seems the entire section "What's a BGP hijack?" totally disappears on smaller screens. Is this intended? Seems like a pretty important section!

</comment><comment><USER40> Does this solution apply to private networks? I learned first hand how dangerous it can be when I brought down our datacenter with an accidental BGP announcement.

<comment><USER41> You can do this. I know a few large well know networks which have suffered from internal BGP hijacks within their data centers from different business units stepping on each other. You can either try to implement via strict route policies or try to do RPKI.

</comment></comment><comment><USER42> I remember doing an IP range scan with nmap from an EC2 instance in the early days, and finding a bunch of exposed BGP routers. I wonder how vulnerable they were.

<comment><USER18> TLDR; Not very unless they were general purpose operating systems vs network operating systems.

</comment></comment><comment><USER43> It's interesting to note that the Bitcoin ecosystem depends on BGP being secure

</comment><comment><USER44> Semi-tangential, but an interesting alternative to RPKI that uses blockchain: [https://ieeexplore.ieee.org/abstract/document/8751229](https://ieeexplore.ieee.org/abstract/document/8751229)</comment>


Ask HN: Do You Invest? - <AUTHOR> I work as a devops engineer and I've recently reached the point where I have money to do more than just pay my student debt off. Do you invest? If so how did you get started? Any book suggestions? <comment><USER2> [https://www.reddit.com/r/personalfinance/](https://www.reddit.com/r/personalfinance/) have compiled a huge wiki (top navigation) for all life situations.

If you're not in the US note the country specific subreddits in the right hand box on [https://www.reddit.com/r/personalfinance/wiki/investing](https://www.reddit.com/r/personalfinance/wiki/investing)

The recent "Ask HN: What are the best strategies for a new grad engineer to build wealth?" [https://news.ycombinator.com/item?id=22274207](https://news.ycombinator.com/item?id=22274207) might be relevant to your situation (it talks about Silicon Valley salaries, not everbody has those).

</comment><comment><USER3> If you're in the U.S., your first investment should be to contribute to your 401(k) plan, if your company offers one. Especially if you get a company match from your employer.</comment>


Building An App? TapFame Has A Developer For That - <AUTHOR> http://techcrunch.com/2012/08/21/building-an-app-tapfame-has-a-developer-for-that/ <comment><USER2> Unfortunately, the story is not so cool, the website and especially the template used to generate portfolios is an OBVIOUS gross ripoff of App Cubby website.

Evidences ? Sure : <https://twitter.com/drbarnard/statuses/238032311961137152> <https://twitter.com/drbarnard/statuses/238033908988538880> <https://twitter.com/drbarnard/statuses/238034285905473536> <https://twitter.com/drbarnard/statuses/238037462688075776>

</comment><comment><USER3> Did you just rip off appcubby's website? <http://appcubby.com>

</comment><comment><USER4> We took a lot of feedback from our original show HN post and rebuilt the service. No more Facebook Connect requirement!

It's come a long way - more feedback would be great.

<comment><USER5> awesome!</comment></comment>


The Downside of Working in Finance - <AUTHOR> https://openfolio.com/insights/124/the-downside-of-working-in-finance/ <comment><AUTHOR> I found this interesting: "People in Finance are on average less invested (i.e. hold a higher % in cash) than the other groups"

</comment><comment><USER2> Excellent example of First World Problems.</comment>


Prenup Is a Four-Letter Word - <AUTHOR> https://www.nytimes.com/2017/10/13/style/modern-love-prenup-is-a-four-letter-word.html <comment><USER2> What's the point of this? It sounds like the insecurities of someone who's made terrible financial decisions her entire life and trying to somehow blame this discomfort on her fiance.

</comment><comment><USER3> For the life of me, I will never understand why simply marrying someone legally entitles them to half your stuff that you've spent your whole life earning and saving. It's almost as if that law is __designed __to motivate women to divorce their husbands and "cash in" as soon as the times get tough!

It's no surprise that almost 70% of all divorces are initiated by the woman in the relationship, even when the man might be desperately trying to keep the relationship alive.

</comment><comment><USER4> If one partner in a relationship has solid assets or more money saved than the other, I think a prenup is esssential. We never know what the future will bring, and emotions will cause people to be irrational. At least that's why I have a prenup. That said, this whole relationship seems tenuous from the start. Six years, with a kid, plus counseling, it sounds like a lopsided relationship that was rocky from the start.

</comment><comment><USER5> Why have multiple lawyers fighting eachother instead of having one who's just payed to get an agreement between the 2 people? This could have been handled much easier.</comment>


5 Reasons why you should learn Swift  - <AUTHOR> http://www.hackswift.co/blog/2014/6/7/why-should-you-learn-swift

<comment><USER2> Thanks for posting this, vedil</comment>


Ask YC: good service/api to send emails? - <AUTHOR>

For a community site, I'm sending lots of emails, but the more I send (all opt-in), the more end up in spam filters. Is there an affordable (so I can send 100s or 1000s of emails a day for a reasonable cost) service with a simple API that lets me send email? I want to use one so that they can worry about contacting ISPs about not being spam etc... <comment><AUTHOR> I'm currently sending a few 100 a day, expect to send 1000s of emails a day. Again, this is all opted in, but a lot of them still get lost in spamfilters, that's the main problem.

</comment><comment><USER2> at his startup school talk, dhs mentioned:

<http://www.campaignmonitor.com/>

not sure if it's considered affordable.

</comment><comment><USER3> man 8 sendmail

ps. and yes, you will get into spam lists no matter what you send, and you will have to cope with it as everyone else does.

</comment><comment><AUTHOR> So there's no service that solves this? Damn..</comment>


Show HN: Find Movies Similar to Ones You Love - <AUTHOR> http://imse.co <comment><USER2> Is pretty good actually. I tested it for Dunkirk and Valerian, gave nice results.</comment>


Do You Really Have to Go to College? - <AUTHOR> http://thechoice.blogs.nytimes.com/2013/03/07/do-you-really-have-to-go-to-college/?src=recg

<comment><USER2> I met the love of my life and the mother of my child in college.

The problem with these articles and the types of comments on sites such as HN is that people neglect the fact that college is an experience, and a highly subjective one at that. Too often do technocrats forget that college isn't simply an investment, but for many, it is also a consumption good, and THAT IS OK.

Sure, college isn't necessarily going to make you the best programmer in the world. But, if one looks past the facade of a pure investment brought upon by our economy and media, there lies a rich experience in diversity and the exposure to the liberty of choice (at least in America).

<comment><USER3> You can easily be exposed to diversity and choice without going hundreds of thousands of dollars into debt.

<comment><USER4> The best I've heard is "At least you will be able to think critically." Was that really left out of the previous 12 years' curriculum?

<comment><USER5> Unfortunately, in the US, with so many public schools striving to meet benchmark scores on standardized tests that require little critical thinking. . .the answer is yes, that's increasingly left out of the previous 12 years' curriculum.

<comment><USER3> This is largely FUD in well-to-do districts. Having gone through the public school system after NCLB was passed in a district consisting primarily of upper middle class students, I rarely heard NCLB or the related standardized tests mentioned. And when I did, it was in the form of a derogatory remark from the teachers.

Of course, things may be very different for people from other socioeconomic backgrounds.

</comment></comment></comment></comment></comment><comment><USER6> A quote from "Coders at Work" - one that I read every time I feel scared or not "good enough".

Seibel: And you very briefly went to CMU after you finished high school.

Zawinski: Yeah. What happened was, I hated high school. It was the worst time of my life. And when I was about to graduate I asked Fahlman if he'd hire me full-time and he said, "No, but I've got these friends who've got a startup; go talk to them." Which was Expert Technologies—ETI. I guess he was on their board. They were making this expert system to automatically paginate the yellow pages. They were using Lisp and I knew a couple of the people already who had been in Fahlman's group. They hired me and that was all going fine, and then about a year later I panicked: Oh my god, I completely lucked into both of these jobs; this is never going to happen again. Once I no longer work here I'm going to be flipping burgers if I don't have a college degree, so what I ought to do is go get one of those.

The plan was that I'd be working part-time at ETI and then I'd be going to school part time. That turned into working full-time and going to school full- time and that lasted, I think, six weeks. Maybe it was nine weeks. I know it lasted long enough that I'd missed the add/drop period, so I didn't get any of my money back. But not long enough that I actually got any grades. So it's questionable whether I actually went. It was just awful. When you're in high school, everyone tells you, "There's a lot of repetitive bullshit and standardized tests; it'll all be better once you're in college." And then you get to your first year of college and they're like, "Oh, no—it gets better when you're in grad school." So it's just same shit, different day—I couldn't take it. Getting up at eight in the morning, memorizing things. They wouldn't let me opt out of this class called Introduction to Facilities where they teach you how to use a mouse. I was like, "I've been working at this university for a year and a half—I know how to use a mouse." No way out of it—"It's policy." All kinds of stuff like that. I couldn't take it. So I dropped out. And I'm glad I did.

Then I worked at ETI for four years or so until the company started evaporating. We were using TI Explorer Lisp machines at ETI so I spent a lot of my time, besides actually working on the expert system, just sort of messing around with user-interface stuff and learning how those machines worked from the bottom up. I loved them—I loved digging around in the operating system and just figuring out how it all fit together. I'd written a bunch of code and there was some newsgroup where I posted that I was looking for a job and, oh, by the way, here's a bunch of code. Peter Norvig saw it and scheduled an interview. My girlfriend at the time had moved out here to go to UC Berkeley, so I followed her out.

</comment><comment><USER7> I understand and possible agree with the general idea, but I feel that this article takes it way overboard. If you want to talk about coding use statistics relevant to coders, not general statistics.

> Furthermore, some recent college graduates are not faring too well in the > job market.

This is not true in my experience for coders. Go to silicon valley and therell be many startups vying to get your attention.

> If you'd like to learn how to code, you don't need a $150,000 piece of paper > to tell you that you can.

That isnt what the paper signifies. It signifies that you have reached at least a certain level of education in the field. More importantly, it signifies this to other people who dont know you at all. Even pg wants to know what school you went to on the yc application. (you might argue that people who drop out still get in, yes, but if they had had that credential, their likelyhood would probably have increased, otherwise, why would yc ask?)

<comment><USER8> yeah, that piece of paper is kinda like the HS Diploma that those 80% of graduates who can't read received (NY article earlier in the week). The college degree is just as useless. How many people remember everything, or even a large portion of what they read in college? Or still remember all of the lectures? Even going to college and getting a degree is no guarantee that the person will be capable of doing the job.

<comment><USER7> What is the probability that a person without a diploma can read? You see, its a credential that means something to people who do not know the person. Even if the difference between the probability a person can read given a diploma and one without is shrinking, it still has value. Furthermore, I remember a lot of what I learned in college. What I dont fully remember, I still remember the basic concept. This aids me in a general understanding of what is possible, knowledge of possible solutions, and furthermore, if I actually need to know more detail about it it would be very fast to learn what I had forgotten (like a cache miss).

</comment></comment></comment><comment><USER9> Stop with this no college crap.

Here's the facts: if you have no work experience and no college education, you're not even going to get a phone interview with any software company. You're just not. None of the companies I've worked for (from tiny startups to 1000+ person software companies) would look twice at your resume. They wouldn't even get so far as printing it out so they could throw it away.

You are not Mark Zuckerberg. You are not Bill Gates. Don't try to pretend you are. If you're incredibly lucky, you'll get a job as an unpaid intern at a medical device company writing Delphi for their internal systems. You may be able to work your way up from there... but it'll suck.

College was FUN. I learned a lot there. I wouldn't skip it for the world. Hell, for much of my 20's I wished I could go back to college to do it some more.

I went to a private, expensive technical school, and graduated with, yes, $30,000 in debt. If you're as smart as you think you are, you can get grants and scholarships to reduce the cost of college. And then you can pay it off a few hundred dollars a month like everyone else does... and you'll laugh, because a few hundred dollars a month isn't that bad when you're getting paid $70k+

I promise you, you'll learn a lot in college. You'll have fun. Don't listen to all the statistics about not being able to get a job or pay off loans... those are general statistics for all graduates that include all the philosophy and English and history of music majors.

You'll be graduating with SKILLS and KNOWLEDGE that can be directly applied to the JOB that you get because you are QUALIFIED, and because software companies troll job fairs at technical colleges looking for bright stars like you that will work their butts off for half the price of the old neckbeards with kids that want to go home at 5pm.

GO TO COLLEGE. IT'S AWESOME.

<comment><USER10> Working within the system is always the easiest approach, but it produces very predictable results. Some people don't get the same affirmation from following the expected path.

There are very strong arguments for and against college. The right choice depends on the temperament of the person. Unfortunately that person is rarely equipped with all of the information/maturity to make a good choice for themselves. This is a failing of parents and schools, who themselves generally don't know any better.

But the crux of the argument is that the default choice is very very often the (or a) bad one. It's an important conversation to have.

Edit: your "here's the facts" line is overemphasized, and demonstrably incorrect.

</comment></comment><comment><USER11> I'm from India and I personally feel that India is not yet ready to accept non college graduates. No one acknowledges a non college graduate here. College in India is pretty much mandatory. In such an environment even though college education doesn't make a very big practical difference, it is important for one to go to college to achieve some kind of a footing for future ventures, either a job or a start up. Although this trend is slowly changing with students starting up at the college level and below. Wherever the students feel that the college material they are provided with is not sufficient enough they are looking out for online courses and other material from the internet.

<comment><USER12> Well, India has a real cultural issue with regard to education. There's just something odd about the idea that a child or young teenager that does not get the very top grades in sort of a "scary" educational system being basically a loser at life. There seems to be very little room for people to either reinvent themselves at, even, 16, let alone in their 20s.

</comment></comment><comment><USER13> That's especially true for Russia. The quality of russian university education is extremely low. Youngsters go to uni in order to avoid mandatory enlistment. Indeed, russian army is hell, composed of criminals. So, in some countries (like, Russia) you really HAVE TO go to uni.

<comment><USER14> > russian army is hell, composed of criminals

I wouldn't generalize like that. Russia is a big place. There are all sorts of things happening, and it heavily depends on where you serve. My friend is in Russian army right now, he has access to internet and posts on facebook occasionally. He's doing pretty good and the people surrounding him are all right.

<comment><USER15> _Kremlin Rising_ , slightly dated now (2005), has a very good chapter on this, and I expect there are other more detailed works on the topic. For many enlistees, it seems the Russian Army (I don't know how this is in other branches) is a terrible place with a culture of physical and sexual abuse, not unlike a good chunk of the US prison system.

</comment></comment></comment><comment><USER16> I think this really only applies to coding and other skill-type jobs. This wouldn't work for finance, law, and other lucrative fields -- yet.

I'd like to see some case studies on someone who walks into Wall Street without a degree. That'd be interesting.

<comment><USER17> In some states it is still possible to sit for the bar without attending law school. But who would hire you, when there's a glut of credentialed attorneys with no job?

<comment><USER18> You pose a reasonable question - and I would agree that the ordinary path of getting hired into a well paid first year associate job at a law firm would probably be off the table.

But I also suspect a lot of people would hire you. The US has a glut of lawyers, no doubt, but also a huge number of people who can't afford lawyers (and are pretty screwed without them). If you were willing to work for $50 an hour or less, I suspect you'd be booked up pretty quickly.

Another thing to keep in mind - I'm actually skeptical that law school is the only good path to become a lawyer. Keep in mind how talented people from non- CS fields can become at programming. A lot of people with degrees in math and physics, or no degree for that matter, who study intensely can become truly exceptional programmers.

Some people learn much faster than others, and some people are extremely good and disciplined at self-study. Abraham Lincoln is probably the most famous lawyer who never went to college or law school. Keep in mind, you still have to pass the bar, and there are often apprenticeship requirements or other educational requirements for the non-law school route. And (like the math or physics major who becomes a programmer), many of these non-law school lawyers might very well have impressive academic credentials in other fields.

</comment></comment></comment><comment><USER19> Also, if you have any interest in relocating to other countries, a degree is in most cases a requirement.

<comment><USER20> This. Especially if you're a citizen of a country other than the US and hope to have the career mobility to work in one of the American hotbeds. It will severely limit your career for a very long time if you don't, especially if your work history is difficult to prove.

<comment><USER21> Utter rubbish, in my experience: I've done it with no degree, and ~7 years out of the western workforce.

The US was OK but I much prefer Asia and Europe (for quality of life, languages, art, history and conversation).

</comment></comment></comment><comment><USER22> _The connection economy we live in today has had drastic effects on the incentives and economics of education — yet it seems that colleges haven't really taken notice._

Obviously, Colleges didn't take notice because enrollment is still high and people still bet on their degrees.

What I think colleges should do, is not reduce their tuition, but improve their brand. It's not the degree that matters, it's the college that you graduated from. If the quality of graduates of a certain college drops significantly, this will affect the whole college graduates credibility.

If you are looking for a JOB (at a company), go and get a DEGREE. That's it. The typical path. There is no creativity in this path. If you are looking to become an ENTREPRENEUR and start businesses and stuff, I'd say give college a shot (maybe a year or two) and then drop (if you don't like it).

There are many other ways to network beside college. But I'd say, give it a shot.

</comment><comment><USER23> What is with all of the anti-college articles that the New York Times publishes? Almost every time I see one come up it's inevitably a NYT article.

<comment><USER17> No doubt the scions of many middle and upper-middle class NYT readers are having a hard time seeing the ROI on their liberal arts educations. It's sad how many people I know who finished college, moved back home, and ended up with the same waitressing job they had in high school. And misery loves company.

</comment></comment><comment><USER24> I was disappointed with the article, because the title led be to believe, that there is some college that will teach Go in their classes.

<comment><USER25> Many colleges in the upper level electives will let you use whatever language you want, but if the prof doesn't know it don't expect help. I was using Scala in my game programming class instead of Java like everyone else (since the projects were targeting the JVM, I couldn't assume any other environment be present, and I had done plenty of C/C++ elsewhere and wanted to try something new). I got an A, and the prof only once read my code and said "I really need to read some documentation on Scala!"

<comment><USER12> Students, and others in this industry in general, tend to make such a big deal about using the latest hyped languages. I think too much so. It's "impressive," I guess. Having a foundation in computer science means you understand that most of the concepts in these "new" languages have been well worn since the 60s, just packaged in new ways, incremental improvements. There's also something to be said, in my view, for Turing completeness. This is not anything about your story, just a related tangent.

<comment><USER26> I love the serious response to a comment posed as a joke due to the poor capitalization of the original title. So much so that I feel on the fence about even pointing it out.

<comment><USER12> Well, nerds can find interesting discussions in almost anything. :)

<comment><USER25> Sometimes I see :) and think it is the mast of a sailboat. Discuss!

</comment></comment></comment></comment></comment></comment><comment><USER12> We sure never see this topic on HN. :) Of course you don't have to go. And of course, getting stuck working in the restaurant business until you're 40 because you started working their because it was quick money out of high school and easier than going to college is always an option too.

Now, lest anyone get the wrong idea I do not mean to imply that one path leads to the other. But also, please let's not pretend that Gates and Zuckerberg are "typical" college dropouts either. Maybe, the restaurant kids are more common than Gates type people, eh?

\-- Anyway, seriously, if you are a recent HS grad and choose not to go to college and instead decide to give Devbootcamp $12,200 for an RoR course ... I'm sure they have a nice product ... But I will also like to contact you regarding the small matter of a bridge I would like to sell.

<comment><USER27> You can learn quite a bit from just the Internet, a bit of ambition, and a willingness to say "I don't know, but I will figure it out." Sure, there are foundational concepts that you will miss, but I haven't noticed their absence yet. Besides, if I'm missing some kind of CS knowledge I will buy the book, ask the web, and take the heat. I'm sure college is great, but is it necessary in this field, at this time? My personal experience says no. I'm not the best dev, and I have some things to learn, but so do the guys with papers.

<comment><USER26> Agreed. As an interviewer, I'm constantly disappointed with the skills of CS grads. Many years in industry show me that if there is anything to be learned about programming in college, it in a field other than CS.

Now, that's not strictly true, but the fact that we've accepted more non-CS grads, or non-grads than CS grads I think says something about the state of our CS education.</comment></comment></comment>