Creating randomness Without Math.random - <AUTHOR> https://healeycodes.com/creating-randomness/ <comment><USER2> There are a few algorithms I think are simple enough to memorise yet seem universally useful enough to be bound to be good to know by heart at some point or other. LCG is one of them!

Something else that might be useful to know are methods to transform the uniform output of LCG into various other types of distribution shapes:

When U is uniform between 0 and 1 exclusive,

One can get an Exp(lambda) distributed variable with -log(U)/lambda

One can get a heavy-tailed Pareto(m,a) distributed variable with m/(1-u)^(1/a)

I'm still missing something easily memorable for bell-shaped distributions. The normal distribution would be nice because it's so easy to transform N(0,1) into a distribution with arbitrary parameters, but there's no simple way to compute the standard normal.

<comment><USER3> By way of the central limit theorem, summing a dozen uniformly distributed variables (and normalizing) will give a a reasonable approximation to a normal distribution.

[https://en.wikipedia.org/wiki/Central_limit_theorem](https://en.wikipedia.org/wiki/Central_limit_theorem)

<comment><USER2> Very clever. My first instinct was that that would be inefficient, but addition is super cheap and the uniform distribution converges rathe quickly to normal. I like it a lot!

Even if LCG itself would be considered expensive, for quick prototyping needs this should be sufficient.

</comment></comment></comment><comment><USER4> Great article, I love "because why not articles".

Checkout Perlin Noise, for when you need "smooth" and "natural" looking random numbers (making terrain, skies, waves, etc)

[https://www.youtube.com/watch?v=8ZEMLCnn8v0](https://www.youtube.com/watch?v=8ZEMLCnn8v0)

</comment><comment><USER5> Deterministic pseudorandomness is really useful for seeding dummy data, data that you'd like to be fairly random (though it doesn't need to be high-quality randomness, so LCG is fine) but consistent across runs/page loads.

</comment><comment><USER6> Good stack overflow answer about js implementation of pseudorandom number generator: [https://stackoverflow.com/a/47593316/1248177](https://stackoverflow.com/a/47593316/1248177)

</comment><comment><USER7> I just watched a really good video explaination of this the other day: [https://www.youtube.com/watch?v=4sYawx70iP4](https://www.youtube.com/watch?v=4sYawx70iP4)

</comment><comment><USER8> The real value is the reference to the API calls which inherently represent less predictable seed state. If you can't call out, then these are acheing to be used alongside some kind of introspection into the runtime.

</comment><comment><USER9> _"Each Math.random function created for distinct realms must produce a distinct sequence of values from successive calls."_

Nitpick: it would surprise me if any implementation implemented this requirement to the letter.

I think neither of the claims (FTA) "PRNGs are deterministic" and "A PRNG eventually repeats its sequence" are strictly required (for the first you can't seed Javascript's Math.Random, so there is no need to be able to regenerate a sequence; for the second, one could generate good pseudo random sequences that never repeat), but the implementations I'm aware of all have those properties, and use fixed-size state.

Given that, the number of PRNGs whose period is at most P is finite. So, one could exhaust that set by creating realms and random number sequences in each of them in a loop (a looooong loop)

The only ways to avoid generating a copy would be to gradually move to generators with more state or to crash.

<comment><USER10> > "Each Math.random function created for distinct realms must produce a > distinct sequence of values from successive calls."

If this were not true, it would have security implications.

Thought experiment: If there was a single state then a web page could pull a bunch of numbers, use that data to derive the seed AND the next number that will be pulled without pulling it.

Then the predictor page can STOP pulling numbers when they know the next number is an auspicious one. The predictor page has now successfully "rigged" the dice roll for another page that shares the same state.

<comment><USER9> I know that an am not disputing it. My claim is that most, if not all, implementations do not satisfy that requirement.

Also, that requirement isn't sufficient to prevent such attacks, by a long stretch.

An implementation that has only one sequence of random numbers r1, r2, r3, r4…, but drops a single item of the sequence for each subsequent realm (the second instance returns r2, r3, r4…, the third one r3, r4…, etc.) satisfies the requirement, and the individual sequences are as perfectly random as the original one), but still is vulnerable to attacks.

And it can be worse: an implementation that generates a unique r0 for each realm (could even be an easily predictable value) and returns r0, r1, r2, r3, r4…, with r1 and subsequent identical for all instances also satisfies the requirement.

</comment></comment></comment><comment> michael-ax [https://nullprogram.com/blog/2017/09/21/](https://nullprogram.com/blog/2017/09/21/)

</comment><comment><USER11> It would be great if JavaScript had also a built-in seedable random number generator.

<comment><USER12> It depends on the implementation, e.g. Node has crypto.getRandomBytes()¹.

If you mean the standard browser implementation, Crypto.getRandomValues()² may be what you're looking for. Note that the browser implementation of this is only a recommendation, so YMMV:

> To guarantee enough performance, implementations are not using a truly > random number generator, but they are using a pseudo-random number generator > seeded with a value with enough entropy. The pseudo-random number generator > algorithm (PRNG) may vary across user agents, but is suitable for > cryptographic purposes. Implementations are required to use a seed with > enough entropy, like a system-level entropy source.

> [...]

> There is no minimum degree of entropy mandated by the Web Cryptography > specification. User agents are instead urged to provide the best entropy > they can when generating random numbers, using a well-defined, efficient > pseudorandom number generator built into the user agent itself, but seeded > with values taken from an external source of pseudorandom numbers, such as a > platform-specific random number function, the Unix /dev/urandom device, or > other source of random or pseudorandom data.

¹ [https://nodejs.org/api/crypto.html#crypto_crypto_randombytes...](https://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback)

² [https://developer.mozilla.org/en- US/docs/Web/API/Crypto/getR...](https://developer.mozilla.org/en- US/docs/Web/API/Crypto/getRandomValues)

<comment><USER11> From what I can see at [https://developer.mozilla.org/en- US/docs/Web/API/Crypto/getR...](https://developer.mozilla.org/en- US/docs/Web/API/Crypto/getRandomValues) or [https://nodejs.org/api/crypto.html#crypto_crypto_randombytes...](https://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback)

... neither crypto.getRandomBytes() nor Crypto.getRandomValues() are SEEDABLE. There is no argument I could pass in that would produce the same random sequence for the same seed-value.

A reproducible random sequence would be useful in many situations I believe. I understand such a thing is not too difficult to program but it may be difficult to get verifiably good quality randomness out of your own implementation.</comment></comment></comment>


Zekai, a coffee-like programming language in 150 lines - <AUTHOR> https://github.com/lucazd/zekai <comment><USER2> This is a nice example of why you don't need a parser framework!</comment>


Oddball: Video Hacks: UFO Video Best "Fake" Yet - <AUTHOR> http://www.inquisitr.com/5943/ufos-filmed-in-turkey-real-evidence-or-biggest-scam-of-all-time/

<comment><USER2> It seems pretty unlikely to me that they would view an object over weeks and never even bother to pick up a still camera with a better zoom. Also, other people in the footage (like the fisherman) don't seem to be acting like anything's weird.

I had a hunch and looked up where this was supposedly taken -- a place called Yeni Kent, Turkey, I think. And there's a very oddly-shaped building called Ataturk Stadium, located on a hill, just across the bay. I don't know for sure but this might explain some of the footage.

<http://www.ataturkolimpiyatstadi.net/>

<http://flickr.com/photos/andyjap-lfc/1524723070/>

From some angles, there wouldn't be any other lights, so it would appear to float in darkness:

[http://www.flickr.com/photos/76712000@N00/17491854/in/set-40...](http://www.flickr.com/photos/76712000@N00/17491854/in/set-401939/)

</comment><comment><USER3> The quality of the tape is unremarkable. At no point in time was the camera focused on the craft so every frame is slightly blurry at best

2 hours of footage is a lot to fake although I did not see a moving craft once, only stationary objects. That substantially reduces the difficulty of producing this video.

</comment><comment><USER4> You'd think after seeing this thing day after day the video taper would want to pick up a tripod?

<comment><AUTHOR> This one is so interesting because of the amount of tape -- over 2 hours -- and the clarity of the footage.

If it's a fake, it must be faked in some way that it is easy to create frame- by-frame. That leaves out CGI, I think.

The color changes were strange as well.

</comment></comment><comment><USER5> _the center is claiming the footage isn't faked, and that it's the best evidence yet that we are not alone in the universe._

Ok, let's think "outside of the box" for a moment : we wouldn't expect a different behavior from time travelers as well. Maybe they're just humans ;-)

</comment><comment><USER6> I don't know what's more sad than this:

Wanting to see the video, or the fact that my iPhone still doesn't have flash. Cmon Jobs! What were you thinking!

</comment><comment><AUTHOR> I found this interesting both from the "How would you fake something like this?" standpoint and the "If not fake, what the heck is it?" standpoint.

Beats me if it's HN, but at least its non-political.

<comment><USER7> Assuming it's some kind of a man-made aircraft, is there any aerodynamic advantage to the saucer shape?

<comment><USER8> If you're a government conducting covert surveillance, and you use a plane or helicopter, and you are seen, the jig is up. If your craft is ufo shaped, no one will believe the witnesses.

<comment><AUTHOR> The phrase "stealth blimps" keeps getting kicked around from time to time. But then nothing ever comes of it.

We're overdue for whatever the next generation recon platform is.

<comment><USER9> I dunno what the next generation recon platform is, but I doubt it flies at night while lit up like a goddamn Christmas tree.

(Of course, aliens probably wouldn't do that either: they'd be a lot more subtle or a lot less subtle.)

<comment><AUTHOR> I can see a bunch of generals in a room now

"That's the last thing they'll expect! A giant flying Christmas Tree!"

Yes. IF (and it's a big IF) aliens are visiting us, they are probably so far beyond us we'd have no more inkling of them than an ant has of a person.</comment></comment></comment></comment></comment></comment>


Ask HN: What's the prerequisite to become an exploit developer? - <AUTHOR> I want to learn reverse engineering (RE) and exploit development.
There are great resources for both of them (like MBE http://security.cs.rpi.edu/courses/binexp-spring2015/ and RE https://github.com/fdivrp/awesome-reversing).
The only problem is that there is hardly any article which actual lays out a path for a complete beginner.
I want to understand what are the ACTUALLY NECESSARY topics required and in RIGHT ORDER to MINIMIZE the TIME WASTING and wandering in between topics so that the knowledge aqcuired is more practical in context of current vulnerabilities rather than being more theoretical.
Something like programming fundamentals>python>C>Assembly>Computer Organization>Windows Internals>Reversing>Fuzzing etc. (its only an example, please teach me the correct order)
Actually there's an article http://www.myne-us.com/2010/08/from-0x90-to-0x4c454554-journey-into.html but it is quite outdated.
Your opinions along with updated resource links and views on them will be greatly appreciated. Please, only focus only on topics that are actually necessary because RE and Exploit development are vast topics in themselve (for eg: Do I actually need to learn computer architecture or organization? AFAIK those circuits and architecture specific thing is more helpful for a electrical or electronics engineer rathen a RE. We need to learn the intricacies of a particular architecture like x86 or ARM but in my opinion those circuits won't help any RE in his daily reversing schedule, so please foucs on the only required part like one I know: OS fundamentals. <comment><AUTHOR> EDIT: Please also describe your best practices and things you learned from your mistakes.

</comment><comment><USER3> [Part 1 of 2]

I'm sorry this didn't get more responses, its a worthy question.

First, I've tackled this topic a few times: [https://www.reddit.com/r/AskNetsec/comments/5i73db/path_to_e...](https://www.reddit.com/r/AskNetsec/comments/5i73db/path_to_exploit_developer/db61ken/) is probably the most concise post of mine but I'll give a more complete (opinionated) guide below

> There are great resources for both of them (like MBE > [http://security.cs.rpi.edu/courses/binexp- > spring2015/](http://security.cs.rpi.edu/courses/binexp-spring2015/) and RE > [https://github.com/fdivrp/awesome- > reversing](https://github.com/fdivrp/awesome-reversing)).

I like the RPI course but without lectures it feels like there are too many gaps for it to be something I actually recommend to people

> Actually there's an article [http://www.myne- > us.com/2010/08/from-0x90-to-0x4c454554-journ...](http://www.myne- > us.com/2010/08/from-0x90-to-0x4c454554-journey-into.html) but it is quite > outdated.

Don't worry about content being dated, you will not find any good resources that cover right up to modern exploits what you will find are resources that can be used to train you up in the necessary foundations for you to understand modern exlpoits with a bit of your own leg work. The "From 0x90 to 0x4c454554" article actually looks like a very good collection of resources. Dates resources are still valuable as modern exploits are still doing the same thing (trying to get control of the IP register) its just now there are mitigations in place that require extra steps or to follow certain restrictions to be successful, but if you don't understand the foundation you can't learn the modern stuff.

> I want to understand what are the ACTUALLY NECESSARY topics required and in > RIGHT ORDER to MINIMIZE the TIME WASTING and wandering in between topics

The problem with that is that that time wasting and learning other topics that are not immediately useful are immensely beneficial on a whole. Honestly, a big part of exploit development is spending hours researching dead ends...seriously that's a big part of it. It requires a wide breadth of knowledge not just a bunch of tips and tricks specific to exploit development. In order to craft sophisticated exploits against a system you need to understand that system, how its built and how it works. This comes from that wandering research, it may not be immediately valuable but doing it often leads to building up a set of topics that you are deeply knowledgeable in. And, you you can draw from that knowledge in exploiting certain interactions later on. That wandering, beating your head against a wall, getting stuck not knowing what to do is part of exploit development. Trying to avoid it honestly doesn't sound like a good idea, you'll end up knowing a bunch of tricks but lacking the background to apply them creatively.

None the less, the first thing you need is some development background. If you want to break software start by learning how software is built.

So, I recommend starting by learning C. First C is the lingua franca of exploit development and reverse engineering. If you understand C you can break any high level software down into its 'C parts' and from that C you can determine what the machine code probably looks like. C is the perfect middle ground, thinking in machine code or assembly is too tedious and languages like Python or Java are too high level to capture whats going on at the CPU level. Software exploits ultimately are about controlling the IP register on the CPU that is why being able to understand the whole stack is important.

Start with C, but learn a higher level scripting language, something that is used for quick jobs, prototyping, etc. While C is nice it also requires a lot of lines to do some tasks that are very simple in higher level languages (string manipulation and network communication for example). So, its useful to know a scripting language to actually do quick jobs in. Python and Ruby are the two common choices right now, historically Perl was the most common choice. Now everyone I work with knows Python, but Ruby has its place too.

If you struggle to learn C, you might find it useful to start with a scripting language which are often said to be better for learning to program with. Maybe it is but I tend to side with Evan Miller who writes: [http://www.evanmiller.org/you-cant-dig- upwards.html](http://www.evanmiller.org/you-cant-dig-upwards.html) in that C is a better place to start even if the results are not as immediate. Still, if C isn't working for you start with the scripting language then learn C.

Further, once you know C and a scripting language, learn one of the modern work-horses, Java or C# (I lean towards Java). Most developers will know one or both of the languages and getting an understanding of Object Oriented Programming is useful to understanding how software is built. You find OOP design patterns in most software.

Once you know a native language (C, C++) an intermediate language (Java, C#, etc) and a scripting language (Python, Ruby, Perl, etc) you'll be able to work with the majority of code-bases out there even if you don't know the specific language in use you'll understand the core concepts that underline most languages. There are some other paradigms seen in less common languages like prolog (logic programming) or haskell (functional programming) that you won't understand but those three languages cover practically all modern software you'll encounter.

Recommended Books: you don't need to read all of these but its a selection you might find useful. Also, I am a fan of the Head First series which usually are not very thorough and some find the writing to be too casual and annoying so YMMV.

1\. Head First C, covers the basics of C in an easily digested format. Some I've recommended it to have found its section on pointers useful.

2\. The C Programming Language, the Bible of the C language, you'll pick up some bad habits from it, and its dated but its a concise overview of C.

3\. Violent Python, Its a bit steep of a learning curve but its teaching Python with a security focus so it fits in very well.

4\. Head First Programming - If you struggle with the basics of coding, it might be worth checking this book out.

5\. Dive Into Python - [http://www.diveintopython.net](http://www.diveintopython.net)

6\. Design Patterns: Elements of Reusable Object-Oriented Software - Once you understand the programming its time to learn the architecture of software, this is the classic book on the topic. 7\. Head First Design Patterns - if the last book was a bit too steep for you the Head First book might be a bit easier.

8\. Beej's Guide to Network Programming - You need to understand sockets, and socket programming, no exceptions and for C this is the best guide available.

While you're learning to code you should also be trying to get some experience working with Linux. Even if Windows is your daily driver (as it is mine) Linux is inescapable you'll rarely come across a network that doesn't use Linux anything (and similarly, you'll rarely come across a corporate network without some Windows servers too, so don't ignore Windows server). I don't have any book recommendations on this, just setup your own Linux box learn the different package managers and how to do what you need from the terminal.

I do recommend working through the following to get some general experience.

1\. [http://overthewire.org/wargames/leviathan/](http://overthewire.org/wargames/leviathan/) \- You'll learn about Linux with this one, and it doesn't require any programming ability so its a fair starting place.

2\. [http://overthewire.org/wargames/bandit/](http://overthewire.org/wargames/bandit/) \- Bandit is a easy server/wargame to start with, and it'll teach you a bit about Linux and require a bit of coding but there is nothing that requires technical exploit development knowledge. 3\. [https://exploit- exercises.com/nebula/](https://exploit-exercises.com/nebula/) \- Nebula is a little more difficult than Bandit but still non-technical and imo a little more fun.

Working through these give you some comfort working in a terminal and some experience getting the attacker's mindset and breaking things. You can do these while learning the stuff above.

You may also want to get some practice programming with challenges such as those at:

1\. ProjectEuler.net - These often require some mathematical insight but they're fun so I'm including it

2\. [https://leetcode.com](https://leetcode.com) \- This is used by some developers to practice before an interview, various levels so it'll work just for getting some experience with programming.

<comment><USER3> Now that you've got a foundation in software development we can move onto exploit-development. Well not quite first you need to bridge your knowledge from building software to breaking it. For this you need to start learning about how software works at a lower level, the CPU level. There is a good book: Computer Organization and Design. Its solid but its also a textbook and covers a lot more detail than you need (though still valuable to know). It covers MIPS and how the CPU works, you probably can skip stuff about the hardware and microcode though. MIPS is a simpler assembly language than intel's stuff so its a nice starting place though.

Intel is what you'll most often encounter though so you do need to learn x86 and x86_64.

OpenSecurityTraining.info provides a number of courses that are valuable for this bridge to breaking software.

1\. Life of Binaries - [http://opensecuritytraining.info/LifeOfBinaries.html](http://opensecuritytraining.info/LifeOfBinaries.html) \- This helps you go from understanding to software to understanding the system around the software and the context in which software runs. 2\. Introductory Intel x86 - [http://opensecuritytraining.info/IntroX86.html](http://opensecuritytraining.info/IntroX86.html) \- Really boring/dry class on x86 instructions but gives you the introduction you need.

3\. Introductory Intel x86-64 - [http://opensecuritytraining.info/Intr](http://opensecuritytraining.info/Intr) oX86-64.html - Just slides this time, good to review and get a sense of the differences between 32bit and 64bit intel assembly.

Once you've gotten the basics its finally time to move onto learning the actual exploit development skills.

1\. Introduction to Software Exploits - [http://opensecuritytraining.info/Exploits1.html](http://opensecuritytraining.info/Exploits1.html) \- In my opinion this is simply the best resource out there to learn the basics. It uses the book "The Shellcoder's Handbook" as its textbook and I completely recommend the book.

2\. Hacking: The Art of Exploitation - This is the most often recommended book, its great and has a much better introduction than the Shellcoder's Handbook but if you can make it through the course above without probably you can probably skip this book as the two resources covers more content but this book is one of the best introductions available. 3\. Corelan's Exploit Development Tutorial Series - [https://www.corelan.be/index.php/2009/07/19/exploit- writing-...](https://www.corelan.be/index.php/2009/07/19/exploit-writing- tutorial-part-1-stack-based-overflows/) \- It'll start in familiar territory but it'll get into some new stuff, overall a good series. 4\. Exploitation in the Windows Environment - [http://opensecuritytraining.info/Exploits2.html](http://opensecuritytraining.info/Exploits2.html) \- You'll find some overlap with Corelan's tutorial series and this course so you might want to take this course and reference the tutorials as you go.

5\. A Bug Hunter's Diary - Excellent book that covers some similar topics as the previous resources but spends a bit more time on actually finding vulnerabilities not just exploiting them and goes into more mitigations than the previous resources also, skip the stuff you already know. 6.

While learning all this exploit development stuff, there is another necessary skill to actually finding vulnerabilities: reverse engineering.

There are two books that I frequently recommend on the topic:

1\. Reversing: Secrets of Reverse Engineering - this is the most popular recommendation and its a great resource to work through.

2\. Practical Reverse Engineering - This is a new comer (2014) but I quite like it. It isn't as 'complete' as Reversing is but it covers a wider rage of topics that I find more useful.

3\. (Bonus) Malware Analyst's Cookbook - Malware Analysis is probably the most RE heavy field you can be in so this is a solid book on the topic. Just because of its name I didn't give it a fair chance when I was reviewing books to recommend but I did review it recently and do want to give it a plug and it has a lot of practical information and labs to work on.

By this point you should have a reasonably solid foundation and a good understanding of exploitation. You will not be up to writing the latest browser 0day but you'll have the foundation necessary to understand (and learn from) modern sophisticated exploits so you can find and development them yourself. There are no resources to fill in the final gap but to go out do your research on a system and apply what you've learned to find some way to break them and development that weakness into an exploit.

To get experience, there are a few resources I can recommend:

1\. Exploit-Exercises, I already mentioned Nebula, Protostar should be accessible to you once you've done the first Software Exploits course, and Fusion after the second one.

2\. Over the Wire, I've already mentioned a couple of their servers, check out the rest of them.

3\. Pwnable.kr - Challenges are at various levels use the harder ones to challenge yourself.

4\. Capture-The-Flag competitions - every year several CTFs are run, sign up and play in them. What is nice about CTFs is that they are bite-sized challenges, still difficult, still involving modern techniques (the ones worth the most points atleast) but not tedious and they don't require a big time investment to find a weakness in. The focus of the challenge is on the exploit development rather than on finding vulnerabilities. 5\. CVE lists - <USER2> software that interests you, find a known vulnerability and try to build your own exploit in it.

6\. Real world software, go and break something of interest to you, learn how it works, find a vuln and exploit it.

You may need to learn a new language, or research some new techniques to handle some mitigations, but you should have the foundation necessary to figure out what you don't know and how to learn what you need.

...and with all this content I never even touched on breaking web applications, so I must atleast give mention to "The Web-Application Hackers Handbook" cover that book, practice against any of the many vulnerable meant to be hacked web-apps out there (Damn Vulnerable Web App, OWASP Mutillidae 2, HackThisSite, HellboundHackers, Enigma-Group, HackThis.co.uk, etc, etc)

Good Luck!

<comment><AUTHOR> I'm extremely grateful and was not at all expecting such an explanation.

I wanna exlpain few things.

Let me rephrase what I meant by "minimize the time wasting". You see there are lot of great advice available online. You ask something on a subreddit or here and then people will share great resources. I love this and this kind of learning. My concern is that sometimes these resources and advice is given along the lines of "although its not completely necessary, it'll still be an experience in itself".

The problem here is that such kind of learning sometime waste too much of time and leave you with confusion. People daily ask so many questions on CompSci and you'll find books starting from complete basics of computer like Code [https://www.amazon.com/dp/0735611319](https://www.amazon.com/dp/0735611319), Nand2tetris course [http://www.nand2tetris.com](http://www.nand2tetris.com) etc to something very sophisticated like AI. I hope you can understand that if a person spends too much time on these kinda things given that he's got a job or he's student in university with a sweet CompSci curriculum (you know what I mean) then its a problem. Although the above mentioned resources are exceptional there are others too which teaches the same thing. Can a person read all of them one by one "just to satisfy his curiosity and thinking that it'll help him in future"?

RE is already an extremely sophisticated and vast field which requires computer mastery. I'm in college and it has made me hate things I loved. I'm extremely curious guy and can spend 10-20 hours in front of PC easily. I've ~6 years of experience with linux. Now I'm literally not in a state to read 2-3 400-800 page books on a single topic which I don't even know would be required in RE. There are some topics which are quite difficult but at least if we have an idea that it IS mandatory for RE then you can be sure and refer other resources. If you don't even know what's your syllabus how can one concentrate and master it let alone learning. RE requires you to study every minute details or computer system but wasting too much of time on those horrible digital logics and design is really not worth it.

So My purpose is to make it completely clear what I actually need to know so that I can focus on it instead of reading each and every topic in complete detail thinking that if I'll miss the direction of even a single electron in I/O I won't be able to do efficient reversing. I'm literally fed up of those architecture diagrams with arrows and cramming those definitions ROM, EEROM, EEPROM.............. again and again for tests and assignments.

I've few questions for you:

You mentioned Computer Organization and Design which I think is authored by Patterson and Hennessy which is used by almost all Universities. I'm just curious about its not so good looking amazon reviews. Also what's your opinion on Tanenbaum's books which you've mentioned in that reddit link.

Now let's summarize what I've understood (PLEASE help me correct if I'm wrong)

>>>> UNDERSTANDING the system you want to hack

> Learn the most used fundamental programmming languages. (the way we TALK > with computers) 1\. C (also C++ in some cases) 2\. Python or Ruby (given its > dominance in industry right now thanks to its productive nature, also being > used exploit writing) 3\. Java or C# (object oriented programming which > along with above languaged completes our programming fundamentals) 4\. > Assembly (obviously needed in RE) I think it need not be mentioned that we > need to have good grasp of Data Structures and Algorithms with above > languages (obviously not all)

> Understand each and every data flow and HOW a computer system work

Computer Organization and Design and Architecture

(OS fundamentals, memory management, virtual memory, paging, caching etc, Linux(macOS too) and Windows internals part I think comes here)

You restored my faith in humanity when you said I can skip the hardware and microcode part (please explain what specific topics, I swear I won't look at them again until I'm done with required topics.)

> Network Fundamentals and Programming Basics of http, TCP/IP and other > protocols.... Socket programming

>>>> THE HACKING PART

> Learning WHAT loopholes are there in this above process of data read write > Types of attacks (buffer overflows, heap overflows....)

> HOW those loopholes are exploited

>Reverse Engineering (Learning tools of trade: IDA, gdb.....) learning and practising reversing. Fuzzing

>Exploiting the bugs making exploits.

Please review and correct. Thanks again.

<comment><USER4> Shameless self-promotion. I have a YouTube channel where I basically try to offer a path for learning exploitation. I'm done covering all the basics, and we will soon move to more advanced stuff. I have videos on various different security topics, but here is the probably more relevant playlist: [https://www.youtube.com/playlist?list=PLhixgUqwRTjxglIswKp9m...](https://www.youtube.com/playlist?list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN)

<comment><AUTHOR> I know your channel very well. Its praised everywhere because of such good content. I will be happy if you go through my main concern in the details and read the above discussion. Thanks again for such a wonderful channel. I'll surely learn from it when I'll cover the prereqs to understand what you're saying in those videos.

<comment><USER4> > I want to understand what are the ACTUALLY NECESSARY topics required and in > RIGHT ORDER to MINIMIZE the TIME WASTING and wandering in between topics so > that the knowledge aqcuired is more practical in context of current > vulnerabilities rather than being more theoretical.

To be honest with you? I consider that sentence almost offensive. I hear you, but I think you have absolutely wrong expectations. You want to learn something that is not a profession like plumber where a really good expert can teach you everything you need to know with all the little tricks learned over the years. The field is sooo huge diverse and complicated that this won't work. And I think my playlist offers a rough outline that you can follow, but without going down rabbit holes left and right, and getting stuck many many times, you wont become good at it.

I understand the frustration that you don't want to "waste time" and that you are busy already. But everybody I know who is good in this field, including my own experience shows me, that nobody learns this stuff through a straight path. And everybody knows that most of the time will be spent chasing rabbits through a labyrinth and getting stuck.

Also there is no clear path. It's a complicated web you have to learn to traverse. For example like "Learn C" \- what the f __* does that even mean? To what extend? Hello World? Drivers? Or Operating System? "Learn assembler" \- which assembler? have you looked into the Intel Instruction spec once? I doubt any human knows every instruction. Also who said that intel is the way to go, why not ARM or AVR. All of these fields offer a lifetime of studying in itself.

The "art" in becoming good at security and RE is to get a broad knowledge of a lot of things and try to simultaneously go deeper 'n deeper in all of them. And if you are interested in a specific field, put more weight on those topics.

You know how long it takes to reverse engineer something? People stare on IDA for weeks or months at a time. You can't learn RE just by reading a book or a blog. You gotta start to just doing it, and hopefully find a few blogs and people to keep up the spirit.

<comment><AUTHOR> Why is it that K&R is referred as the greatest book on C but never recommended to a complete beginner but only seen as a reference book?

Why is it that several resources exist on buffer overflows yet we ask question on which one is better?

Why is it that you started your channel even though resources like Art of exploitation and Shellcode Handbook already exist?

Why is that there are people asking question like "computer science books you wish you had read earlier"?

Are the one who is questioning or answering is asking or telling a short-trick to become the super h4x0r?

Internet forums exist for a reason. It is always wise to take the advice of someone more experienced than you. I don't see any wrong in it.

The people who are on top are there because of a reason. The root of hacking lies in outsmarting a coder by exploiting the mistakes in his code. Now even a field like this has become a corporate profession.

But there's something that differentiates a hacker from rest of the people. I think learning from somebody else's mistakes is one of the smartest thing you can to do.</comment></comment></comment></comment></comment></comment></comment>


Work from home is dead, long live work from anywhere - <AUTHOR> https://techcrunch.com/2020/05/18/work-from-home-is-dead-long-live-work-from-anywhere/ <comment><USER2> I can work remotely since years, I often did.

I work for a company with a few offices, none is less than 500 miles aways from where I live.

I will likely never go back to those office.

But I could not picture myself working "on the road". I did it, it's stressful and leads to less productivity on my side.

Have you try an intense and involve pair programing session from a 'normal' coffee shop? It's frustrating. Noises, and lack of secondary monitors make it so.

Pretty often, I would have a week or two where I work from somewhere else, but I secure the place in advance , the network connection, and try to work it out with my co-workers if it's imply separate timezone. ( yay for daily stand up at 4AM ! )

I did work from a van from a few weeks. I was actually not working, mostly reacting. ( taking meeting, working on tickets as they are assigned to me... but never taking a deep breath and looking at how makes things better on the long run. )

Edit : my english is broken

<comment><USER3> The coffee shop only needs headphones, but I think there's demand there for a coffee shop that also has desks with monitors that you could hook into/rent. I'd love to be able to just rent desk space around town if it's cheap enough to pull me from home and has some perks that make it worth it, like a great internet connection or if it was more walkable to home vs work (I live in a city).

<comment><USER4> So, they just will become coworking spaces, with additional amenities (4K monitors, standing desks, advanced chairs) available at extra pay. Maybe you could even book them for a couple weeks, or months, to be yours.

Then imagine that your employer would offer you to compensate the coworking space's cost. And maybe the corporate Slack channel would start coordinating colleagues to go to the same cafe / coworking space to improve communication. Etc.

And all this stuff would do nothing to limit one's exposure to viruses and other pathogens; if anything, it would make the situation worse, by mixing people even more.

Work from _home_ (or its equivalent, like a long-term remote resort in a cheaper country) makes sense.

Work from a well-situated, well-stoked office makes sense.

Work form "anywhere" makes way, way less sense; one must be hard-pressed by circumstances to choose it.

<comment><USER5> > Work form "anywhere" makes way, way less sense; one must be hard-pressed by > circumstances to choose it.

I like your analytical approach and you are right: why go to a coworking space when there's not much difference to a real office anyway?

I think the answer for me lies in the _flexibility_ : In a coworking space I can come in or leave at whatever time I want. When I have an unproductive day I can go home at noon and when I feel like working on Saturday I will do so. Offices just have this peer pressure for Mo-Fr 9-6 that you can't evade and coworkers or your manager will raise their brows if you deviate from it. Even in coworking spaces I actually work a very regular schedule, but I just dislike not having the possibility to break out of it.

<comment><USER4> From where I sit, it looks slightly differently.

Nobody cares where you physically are, as long as you do your work and are available for communication. _But_ people do care very much whether you're available for questions / quick to react if something happens, and can produce something by an agreed-upon date.

That is, stopping my work at noon because I can't persuade myself to work would be frowned upon, whether I were in the office or WFH, unless I'd say that I'm not feeling well. (Which is probably a good way to frame it.)

Likely I'm just quite privileged by now; this is the norm around me now, and was the norm for maybe 10 years, but definitely won't be the norm 20 years ago, when I was not a senior enough engineer yet.

</comment></comment></comment></comment></comment><comment><USER6> _> from a hotel_

It always frustrated me that, prior to this whole shutdown, my workplace had a hard "no work from home" policy. But when I had to travel, they were perfectly fine with me working from my hotel room.

<comment><USER7> It was never about security or productivity of the team per se.

It was always to do with HR's concerns about the policy being used as workaround for taking unpaid leave - not saying it is right, just how it is. When you are travelling personally - you are already on leave HR don't care whether work happens or not ( your manager might). If it was official travel then in HR's mind you are not using the policy for as a paid leave so they don't care.

<comment><USER8> As if it should even matter! _(I 'm not saying you're wrong, just that the viewpoint you describe is ridiculous and archaic.)_

If a business can't measure its productivity absent the employees in the office, then it's not a real business. Now a business owner might think "Hey, I _paid_ for those hours, so if they aren't working every minute of every work hour, I'm losing money!" That might make sense in a "production heavy" environment, like factory labor, construction, fire fighting, etc., but there is a growing number of businesses that can operate asynchronously, and existing businesses should still consider shifting towards asynchronicity because, as much as it might seem more expensive on the surface, said businesses can already operate at lower base overhead, and even if an employee takes hours off their day to travel, run errands, etc., you're still usually paying them a base salary to get X work done by Y deadline. Being worried about an employee "not working" for part of the day because they work remotely is nonsensical for office type jobs where employees tend to work solitarily.

<comment><USER7> Like you say it shouldn't be hard in many industries .

However measuring outcomes is hard , developing good outcome metrics is such diversified workforces as knowledge economy is not easy and goodhart law make is not easy to solve

</comment></comment></comment></comment><comment><USER9> This article misses the fact that there are IP and HR legalities about where work is done. It's not that companies are simply being mean, their hands are often tied on these matters.

Changing countries, or working abroad, can affect numerous things including taxes, employee rights, medical benefits, and ip assignments. Even working from different states can have tax implications.

<comment><USER10> Remote-first companies seem to have an edge here since they can handle these situations as they come without a whole structure in the way that assumes everyone works in an office.

<comment><USER9> Even remote-first companies have limits on where they hire. Usually they hire in a given number of countries for example, but not all countries. Also, when you move countries in these companies you still need to get approval so that the legalities can be taken care of.

<comment><USER11> Depends on how employment is done. If the company accepts B2B-style contracting, it's quite common for the only issue to be "ok, what timezone you're going to be in?"

</comment></comment></comment></comment><comment><USER12> My long term dream has been to live overseas with my wife for a couple of years. Preferably continental europe for travel opportunities. But, she has to work at an english-speaking hospital that will accept her credentials.

Other options are sabbaticals, early retirement, whatever. Not many complicating factors other than a house (can rent that out), and our cats.

We generally take 1-2 international vacations per year, so my middle-term dream it to tack on work remote to that. Fly to a country, rent an AirBnB, work remote for a week or two, have my wife join me, then do another couple weeks there as a vacation. So I can double my time away without burning through my PTO in no time flat.

<comment><USER13> I've done this kind of thing. It's OK, but actually significantly less fun than you might imagine (if you are working). The problem is that you are working all day 5 days a week and then you are tired during the evening. Everything is new and so you don't have a rhythm going so it's a bit tiring. You get your weekends, but again, it flies by pretty quickly. It's also really tempting _not_ to travel on the weekends because you are tired and then you finish up your time and discover that you haven't done a quarter of the things you wanted to.

My biggest piece of advice is to "practice" first where you live. Empty your refrigerator and pantry. Work during the day and have the adventure of finding food by only going to ethnic supermarkets that you have never been to before. Go out to only restaurants that you've never been to before. Etc, etc.

On the weekends, travel -- even if only to the next town over. Don't use your car. Take a bus, train or whatever. Stay over night. Go hiking. Talk to the locals, etc, etc. Don't stay home.

If you get good at it and you can maintain your energy it will help you a lot when you travel and work. Before Covid, my wife and I would sometimes hop on a train on a Friday (we live in Japan). I would actually work on the train and then I would finish the day in a hotel. Then we would spend Saturday doing tourist things and come home on the Sunday. That worked pretty well for me. But there is _no_ rest!

Also, if you want to work while traveling somewhere (in a car if your wife is driving, on a bus, train, etc) I recommend taking the day off and trying it before you try to do it on a real work day. It's actually quite difficult and requires some setup to get everything working well (good internet connection, setup of a laptop so you can work in a tight space, bright windows shining on your screen, dealing with batteries, etc, etc).

Oddly, I'm super productive in some weird spaces: the shinkansen (bullet train), MacDonald's, highway bus, hotel room, car (when I'm charging it -- electric car), sitting outside in summer in the shade at a Shinto Shrine. But I am completely unproductive in others: airport, airplane (can't open the laptop fully!), car (when it is moving), the beach (too bright and there is sand everywhere).

<comment> em-bee not being able to work at a beach is a problem only because of lack of demand. it's absolutely solveable. it's possible to make screens that work on very bright environments, and splash proof casing helps with the sand.

when i was using an OLPC XO as my portable travel laptop, i was able to work at a beach just fine.

<comment><USER13> Yep. I'm personally waiting for the day when I can get an e-ink laptop. It would be amazing. I don't need color. Just grey scale and even 20 FPS would be fine. But that's not what the greater market demands, unfortunately.

</comment></comment></comment></comment><comment><USER14> Correct me if I'm wrong on this.

I'm under the impression that if I pay WeWork to be able to work at their tables and drink their coffee, that's tax-deductible and a business expense. But if I buy drinks at a coffee shop to work there, it isn't? [1]

This is something that doesn't make a lot of sense to me, as coffee shops are sort of a classic place for a freelancer to find space away from home to focus better.

[1] [https://www.sapling.com/40999/6-surprising-tax-deductions- fo...](https://www.sapling.com/40999/6-surprising-tax-deductions-for- freelancers)

<comment><USER13> What is allowable as a deduction for taxes is not really based on logic or fairness. We don't have King Solomon sitting there adjudicating what is the reasonable course of action. There are just coarse rules.

I'm in Japan, so my rules are likely different than yours. However, if I'm traveling for work, I can expense the cost of a place to work (including a cafe). In fact, my accountant demands it because if the government doesn't see some expenses when I travel, they start to get suspicious that I didn't travel at all. However, if I travel for my own benefit (even down to the corner coffee shop), then it is a personal expense. I can expense it if it is a _monthly_ cost (and hence a necessary business expense of providing a place to work), but not a one-off case (a personal expense because I'm bored of where I'm working). There _is_ (or was -- I haven't checked recently) a cafe in one of the neighbouring towns to me that rents tables by the month for exactly this reason. It's very affordable, because the tables are hot-swappable and they over-subscribe.

Before Covid-19 I used to go to me mother in law's for a week ever month or so. I used to work in the hot spring. It's quite cheap: about $10 for the whole day. They have tables and chairs and power and a cafe (terrible, though -- one of the only really bad restaurants I've ever found in Japan). Plus I get to soak in the hot spring a couple of times during the day to relax. I bought a month's worth of tickets in the hope that I could convince my accountant to consider it an expense, but he said it was a no go. Still, it's totally worth it (as long as you can manage working in a very chaotic and noisy environment -- I have no problem with that, personally).

<comment> em-bee so you need that coffee subscription

</comment></comment></comment><comment><USER15> WFA just needs a cute mascot.

[https://m.youtube.com/results?search_query=Kei+RV](https://m.youtube.com/results?search_query=Kei+RV)

Without a portable office, WFA is a tough sell.

With it, it`s common sense.

</comment><comment><USER16> "But what about the taxes and legal issues?"

There are a bunch of comments in here about that. And it's true, it's a huge pain in the ass. It's why I always prefer to hire people in states I'm already operating, to say nothing of people outside the US.

But I also see improvements every year. My payroll provider takes care of more of these issues each year, and there are other startups coming up that help you take care of these things as well.

There are companies out there that will deal with everything for you. You pick the person you want and then that company "hires" them and then rents them back out to you, taking a small piece of their salary for their HR services.

If work from everywhere becomes pervasive, I suspect two things will happen. One, a bunch of companies will spring up to streamline the process, and two, the big companies with lobbying powers will lobby for tax code and IP law changes to streamline the process.

<comment><USER17> >the big companies with lobbying powers will lobby for tax code and IP law changes to streamline the process.

There is literally no benefit to a given state, or country, to make it easier for jobs to leave their borders.

If we see a larger push by tech firms to let people work remotely, I personally believe we'll see government intervention in the name of the above. I also believe that, in the face of such a push, tech workers should seriously consider unionizing.

<comment><USER16> > There is literally no benefit to a given state, or country, to make it > easier for jobs to leave their borders.

Of course not. But there is benefit for making it easier for people to live within those borders and pay taxes within those borders while working for a foreign company.

What if the states stopped requiring businesses to file taxes on their employee's behalf?

What if the feds set up a system where I just report my employee's tax ID and how much they made to the Feds, and then the Feds share that with the states and each entity just sends a bill to the employee or to the business owner?

What if the feds pass some laws about autofiling of taxes. I just submit my employee's pay and benefits to a national register, maybe send some default amount of money, and everything else is taken care of for me, and they send me a refund if I overpay or send the employee a bill if I underpay?

There are lots of ways to streamline the system without losing tax revenue.

Most of them involve making the government responsible for collecting taxes instead of businesses.

</comment></comment></comment><comment><USER18> Pretty sure work from home always meant work from anywhere.

<comment><USER19> As an employer anywhere makes it real complicated. Many jurisdictions have a tax on wages earned while there, couple of big examples CA, NY and then even NYC on city income tax.

If you choose to work in NYC as an employer I'm obligated to collect and remit tax there. For individuals or on a one off basis this doesn't get tracked or audited much. If it became systematic it would.

This doesn't even contemplate the complexity if you choose to work from a different country. As an employer if I allow you to change your permanent address to France am I bound to manage your employment under French labor law? IANAL but I believe I am.

What if I knowingly allow you to work from a country where you keep your permanent address in the US and you are on a vacation visa instead of one where work is permitted. As a business am I obligated to report or am I running the risk of penalties from that country too?

Anywhere is really complicated.

<comment><USER20> w.r.t ". As an employer if I allow you to change your permanent address to France am I bound to manage your employment under French labor law?", IANAL either, but I know for a fact that this is the case. The tax man wants his cut, so the employer would have to establish a (subsidiary) company in France, and that becomes the local employer. There's absolutely no way you could be an employee (in the French labor law sense, which is very specific) of any foreign company while working in France (that would be "clandestine labor", see [https://fr.wikipedia.org/wiki/Travail_dissimul%C3%A9_en_Fran...](https://fr.wikipedia.org/wiki/Travail_dissimul%C3%A9_en_France)).

It's not specific to France, either. All countries need their tax base (well not just taxation, there's also retirement/joblessness/healthcare contributions, etc...).

</comment></comment></comment><comment><USER21> Working from home, and more importantly the increased likelihood of having a remote position in the future, has inspired me to eventually take on the life of a digital nomad.

I want to travel the United States seeing and living in as many places as possible. Unlike several people posting here I wouldn't mind working out of coffee shops or with just a laptop.

I see opportunity for adventure while I am still young. I don't mind the squalor of living out of my car and showering in gyms if it means I get to experience more from life.

What's the catch? I have no idea what this lifestyle would actually bring. If anyone knows what it is like please share your experiences.

<comment><USER22> _I have no idea what this lifestyle would actually bring. If anyone knows what it is like please share your experiences._

[https://www.amazon.com/Road-Jack- Kerouac/dp/0140283293](https://www.amazon.com/Road-Jack-Kerouac/dp/0140283293)

<comment><USER23> Or for a slightly more positive take on the South than that book

[https://www.amazon.com/Walk-Across-America-Peter- Jenkins/dp/...](https://www.amazon.com/Walk-Across-America-Peter- Jenkins/dp/006095955X)

</comment></comment></comment><comment><USER24> VR is approaching a threshold that I hope will make work-from-anywhere more practical for me. I've tried working on the road but never get near my home productivity. But if I could isolate by plopping on a headset that reproduces my home environment with umpteen floating screens it might work. I know just one dev that works inside of VR. With a bit more resolution and portability I'll probably join him.

<comment><USER25> I can't handle more than an hour at a time inside a VR headset before I start to go cross-eyed. I couldn't imagine trying to work that way.

</comment></comment><comment><USER26> Who writes this shit? No one expects you to work from the hospital waiting room while your mother is in an ICU.

</comment><comment><USER27> It seems the preference to work from home is pretty strong amongst software engineers. As a physician who was thrust into trying telemedicine, I couldn't stand it. I would never voluntarily opt to do telemedicine. Besides delivering much worse care, I love being "in the office" with the camaraderie of being physically at work.

<comment><USER28> If given private rooms, and not cubicles, i bet many programmers won't mind going into the office that much.

<comment><USER29> Why spend 8 office hrs + commute when I can spend half that working from home? That's an absurd amount of wasted hours that I can now reap.

</comment></comment></comment><comment><USER30> Did this when I was 19. Lived in my car and wrote code and got paid for it. That's how I ended up in SV from the east coast. Amazing trip!

</comment><comment><USER31> The last thing many managers want is a flourishing remote workforce because it highlights said managers' superfluousness.

</comment><comment><USER32> >My colleagues and I published a couple of different views on the future of "work from home" and remote work last Friday — a story that, if analytics is any sign, really struck a nerve with many of you.

This has become like Donald Trump or Tesla. Article after article that adds practically nothing on value because the headline drives clicks. This is just yet another "Now we can do _anything_ because I'm a tech journalist, not someone who has spent 10 seconds thinking about any of the implications of what I'm saying*.

<comment><USER33> I think this is a valid point.

Analytics cause a terrible feedback loop where authors just beat a topic to death with quick keyword-laden opinion articles for clicks. A topic that could use seriously exploration like "Work From Home" often just becomes some sort of meme to exploit.

</comment></comment><comment><USER34> Biggest challenge might be keeping track of locations to pay taxes accordingly

</comment><comment><USER35> Kinda sounds like the vision Adam Neumann had for WeWork.

<comment><USER6> Only, you know, without the need for WeWork.

</comment></comment><comment><USER36> What if the country has sanctions?</comment>


Convert Marvin Annotations to `My Clippings.txt` - <AUTHOR> https://github.com/cdpath/marvin_tools <comment><AUTHOR> This python script can convert annotation file exported from Marvin into Kindle's My Clippings. Perfect for people who reads on Marvin and Kindle at the same time.

<comment><USER2> Maybe the readme should have a description like this. Also, what is Marvin?

<comment><AUTHOR> Marvin is a powerful ePub reader on iOS. Regarding the readme, I respect the author's option ;)</comment></comment></comment>


The Doctors Who Bill You While You're Unconscious - <AUTHOR> https://www.theatlantic.com/health/archive/2020/02/surprise-bills-can-come-even-when-hospital-and-surgeon-network/606391 <comment><USER2> > A growing body of research suggests that this nightmare scenario is fairly > common for Americans.

This is just about every interaction with the medical system for me. It's not just surgery. At the moment the current one I'm dealing with is a case from UW medical center. They're billing my wife for special neurological testing that was denied by Cigna. I look at the Cigna policy and her diagnosis is covered for the testing. But they have a specific list of DX codes and the very generic one that UW supplied on their claim isn't in it. They need to use the ever so slightly more specific code relevant to my wife's condition. But trying to get them to understand this and resubmit it is like talking to a wall. Additionally being in network apparently they shouldn't bill for denied tests. But here they are billing. I hope we will be able to resolve it eventually but once again it's hours upon hours of effort from multiple people going into something that just shouldn't happen in any other system.

<comment><USER3> What are the consequences of simply refusing to pay the bill? I know your credit rating would suffer and you will get many calls from collectors but are there more serious consequences? At least in California? For example, can the insurance or hospital refuse to give you care or cancel your policy?

One of my friends did this after the insurance refused ambulance bills and while the experience was harrowing, just refusing to pay might just be how to deal with this.

<comment><USER4> www.commondreams.org/news/2020/02/11/outrageous-and-un-american-sanders-says- city-kansas-jailing-people-unpaid-medical

</comment></comment></comment><comment><USER5> So it's like when you bring your car to the workshop for a simple repair and when you come back they announce that they _had_ to do these 2 other things...

The next level in this is sneakily replacing fresh parts with older, second hand ones.</comment>


Beware Simple Stories - <AUTHOR> http://www.macdrifter.com/2015/05/beware-simple-stories.html <comment><USER4> I think everyone should know of the Murray Gell-Mann Amnesia effect. To quote from Michael Crichton:

> Media carries with it a credibility that is totally undeserved. You have all > experienced this, in what I call the Murray Gell-Mann Amnesia effect. (I > call it by this name because I once discussed it with Murray Gell-Mann, and > by dropping a famous name I imply greater importance to myself, and to the > effect, than it would otherwise have.) Briefly stated, the Gell-Mann Amnesia > effect works as follows. You open the newspaper to an article on some > subject you know well. In Murray's case, physics. In mine, show business. > You read the article and see the journalist has absolutely no understanding > of either the facts or the issues. Often, the article is so wrong it > actually presents the story backward-reversing cause and effect. I call > these the "wet streets cause rain" stories. Paper's full of them. In any > case, you read with exasperation or amusement the multiple errors in a > story-and then turn the page to national or international affairs, and read > with renewed interest as if the rest of the newspaper was somehow more > accurate about far-off Palestine than it was about the story you just read. > You turn the page, and forget what you know.

> That is the Gell-Mann Amnesia effect. I'd point out it does not operate in > other arenas of life. In ordinary life, if somebody consistently exaggerates > or lies to you, you soon discount everything they say. In court, there is > the legal doctrine of falsus in uno, falsus in omnibus, which means > untruthful in one part, untruthful in all. But when it comes to the media, > we believe against evidence that it is probably worth our time to read other > parts of the paper. When, in fact, it almost certainly isn't. The only > possible explanation for our behavior is amnesia.

Very intriguing when you think about it.

<comment><USER5> Rather ironic, considering that Michael Chrichton thought Global Warming wasn't a big deal[1]:

> At the end of the book, Crichton gives us an author's message. In it, he re- > iterates the main points of his thesis, that there are some who go too far > to drum up support (and I have some sympathy with this), and that because we > don't know everything, we actually know nothing (here, I beg to differ). He > also gives us his estimate, ~0.8 C for the global warming that will occur > over the next century and claims that, since models differ by 400% in their > estimates, his guess is as good as theirs. This is not true. (...)

> Finally, in an appendix, Crichton uses a rather curious train of logic to > compare global warming to the 19th Century eugenics movement. He argues, > that since eugenics was studied in prestigious universities and supported by > charitable foundations, and now, so is global warming, they must somehow be > related. Presumably, the author doesn't actually believe that foundation- > supported academic research ipso facto is evil and mis-guided, but that is > an impression that is left.

Kind of makes me wonder how much I can trust Crichton on anything. :)

[1] [http://www.realclimate.org/index.php/archives/2004/12/michae...](http://www.realclimate.org/index.php/archives/2004/12/michael- crichtons-state-of-confusion/)

<comment><USER6> I don't see how this criticism has anything to do with his point. But if you must, and if you would like anyone else to take your criticism seriously, I suggest citing Crichton's work and addressing it directly. Here's a lecture that touches on the subject:

[https://www.youtube.com/watch?v=MDCCvOv3qZY](https://www.youtube.com/watch?v=MDCCvOv3qZY)

[http://www.independent.org/events/transcript.asp?id=111](http://www.independent.org/events/transcript.asp?id=111)

It contains one of my favorite observations:

"...most people make the assumption of linearity in a world that is largely non-linear."

<comment><USER5> Well, the whole point of Crichton's thesis quoted by bdhe was (paraphrasing) "You can judge how much you can trust somebody, by first observing how much you can trust them on some topic you know about."

It's only fair that I get to apply his own point to himself. A fine novelist he may be, but climate expert he isn't.

<comment><USER7> He may be no expert, but his novels come from thorough amateur research, like Neal Stephenson.

</comment></comment></comment></comment></comment><comment><USER8> Funny thing is Gladwell admits he doesn't think coherency or consistency matter, he just wants to sell books:

"As I've written more books I've realised there are certain things that writers and critics prize, and readers don't. So we're obsessed with things like coherence, consistency, neatness of argument. Readers are indifferent to those things." \- Malcolm Gladwell

Edit: I stand by my interpretation. Gladwell's books aren't useful sources of knowledge, but they ARE a commercial gem. He takes a clear intuitive idea, and wraps enough text around it to fill a book. So high-concept that anyone can discuss his books at a cocktail party, even if they havent read it. Maximum virality. It does sell a lot of books.

<comment><USER9> That quote doesn't support your claim. "Writers and critics value X, readers don't" doesn't necessarily* imply "X doesn't sell books", and it definitely doesn't imply "and selling books is all I care about".

*Readers might not care about X, but they might care about what critics think of a book. This makes sense: as a reader, I'm probably not capable of critically evaluating the arguments in a book, so I have to rely on critics to find out whether or not the arguments are solid.

<comment><USER10> > I'm probably not capable of critically evaluating the arguments in a book

That, my friend, is a skill you can acquire and grow.

Since we're on the topic of popular science books, here's a reasonable read that can help you start improving:

[http://www.amazon.com/Art-Thinking-Clearly-Rolf- Dobelli/dp/0...](http://www.amazon.com/Art-Thinking-Clearly-Rolf- Dobelli/dp/0062219693/ref=sr_1_1?ie=UTF8&qid=1431444586&sr=8-1&keywords=thinking+clearly)

<comment><USER9> It was something of an exaggeration. I'm capable of doing many things that realistically, I'm not going to bother with.

But I don't think "clear thinking" is a solution to this problem. I can read a book and say "the facts as presented don't fit the narrative", which is what I did with paulsutter.

If I'm really dedicated, I can look up references. I can bypass the paywall, read a journal article, and see that the author has misrepresented the results.

But I can't read a book and say "wait, you're completely ignoring the effect that in-fighting in the Roman senate had on politics in Britain circa A.D. 50", because I don't know anything about that subject. I don't even know that it's relevant. Unknown unknowns.

I can't know everything, so I have to rely on other people.

</comment></comment></comment></comment><comment><USER11> This is very important.

Kahneman/Gladwell etc are selling attractive and novel conceptualisations and stories, not complete science.

A lot of what they are saying attracts attention and becomes more likely to be researched further. This is important and great and sometimes leads to disproofs such as the example here.

There is a bias here: the ideas presented in popular science books are more likely to be disproven, just because they are more likely to warrant further study. It's not that the ideas are necessarily more likely to be false - <USER2> is an important distinction and I think the article misses this point.

But, even when disproven, the popular science books still remain on the shelf and the wrong ideas from them still get repeated widely. On forums including HN.

The authors still want to sell their old books, even when they contain ideas now known to be wrong. And the stories they tell are still attractive, even if they are misleading a whole generation of people.

<comment><USER12> Please, please, pretty please don't lump in Kahneman with Gladwell. One is a Nobel laureate scientist, the other is a hack writer.

<comment><USER11> I agree totally with your point, but they do belong together in the context I wrote about.

Each of them have the goal of selling books.

</comment></comment></comment><comment><USER13> Whenever something becomes mainstream it's because it has been stripped of deeper context to appeal to the consuming masses. Pop Science will inevitably piss off scientists just like art critics will scoff at inexperienced amateurs or public commentary. Bite-sized feel good scientific content fashioned for larger audiences can come across more concrete than it should - you're right on that. If it comes at the expense of a more "scientifically minded" public, i'm fine with that. We're better off in the world of TED than we were before it.

<comment><USER14> Are we really? The social patterning is the religious revival meeting, and that's precisely the _wrong way_ to frame science if you want to give outsider a realistic impression of what it means and how it works.

Pop-sci has a terrible flattening effect. It gives the public the mistaken impression that their opinion is worth as much as a professional's, because it's not so hard really after you've read about it in a cheap paperback.

It's the mindset of "evolution of just a theory" and "climate change scientists are only in it for the money" and "my opinion of string theory is just as valid as that of a PhD working at the Perimeter Institute of Princeton - and what is a perimeter anyway?"

I'm not suggesting we should return to the happy era of pipe-smoking public science paternalism of the 40s and 50s.

But the alternative meme - that's it's all just a point of view - is just as destructive and stupid.

Gladwell, Godin, TED, and the rest are enablers of that mindset, whether or not they agree with it personally.

</comment></comment><comment><USER15> This sounds just like an article I read a few days ago:

[http://www.artofmanliness.com/2015/04/29/beware-the-too- comp...](http://www.artofmanliness.com/2015/04/29/beware-the-too-compelling- narrative/)

</comment><comment><USER16> The greatest enduring benefit of having studied and trained as a journalist is the experience gained as 'the gatekeeper' of information, and therefore the ability to interpret news more thoroughly. That, and the fact most news is depressing garbage as nutritional for your brain as sweetener is for your gut, is why I only skim the news these days.

Most journalists / writers are decent people aiming to communicate as much as they can, as clearly as they can, with overly tight time-frames and (less so online) limited news-holes.

They won't write "may be X" if they can write "is X" \- therefore, "may be" (and related modifiers like could, perhaps, up to, close to etc) mean "not definitely" and are usually safe to ignore.

They won't paraphrase someone if they have a direct quote just as specific - therefore, any general comments have been created to attempt to fit what someone said into the narrative angle of the piece. They may be inaccurate (and few things frustrate me more than the outragists of the world turning a newspaper story into somebody's direct quotes).

If the headline / lede seems outrageously unfair and Occams Razor suggests there must be more to the story, then there will usually be additional information in paragraph 5 that makes the story less outrageous and more normal. Genuinely shocking stories (whistle-blowing, massacres, genocide) don't need to lead with the outrage. Genuine stories also stick around for days with new information or different angles - therefore it's safe to conclude outrageous headlines are burying the mundane facts and can be ignored, until they show up many days in a row.

Obviously these are generalizations, they don't account for truly terrible writing like the _Daily Mail_ , gossip magazines, and current affairs television, and anyone who reads enough news with a critical eye probably comes to the same conclusions (ie, nothing special about me). What this awareness gives you of course is the ability to unwind a complex narrative out from a simple story.

So don't "Beware Simple Stories" \- rather, develop your own expertise in interpreting them.

</comment><comment><USER17> > We can measure the rate of learning. Google scholar counts the number of > times a paper is cited by other papers. I believe that well-informed > scholars who cite the original paper ought to cite the subsequent papers.

Possibly related, but Google and the very concept of PageRank was born out of Page and Brin's work on Backrub, which attempted to surface the importance/relevance of an academic paper based on which other papers cited it.

</comment><comment><USER18> TED sells tickets. Malcolm Gladwell sells books and appearances. They won't do that as well as they do now if they didn't embellish their stories with facts and points that the general masses relate to. On the bright side - <USER3> these people do to shift the attention of this generation from cars, hoes and money is a step closer to a somewhat brighter future for all of us.

<comment><USER19> At some level TED etc. are just providing what the market (us) wants.

Given a choice between thinking hard and an easy answer we tend to prefer the later until it no longer meets our needs or becomes clearly wrong.

</comment></comment><comment><USER20> I get the criticism because I imagine most of us work in a field other people do not understand the complexity of and would like to over simplify. However, I would rather they have a cursory understanding of what I do, what problems I am trying to solve and the challenges I face than have none. I feel the same about many areas. I think that environmental change is a problem, but I can do little to actually solve the problem other than attempt to understand it and influence policy with my votes or money. I am interested in various scientific fields, but hardly an expert, so I follow them at a surface level. It's not perfect, but I think it's better than nothing.

<comment><USER10> OP isn't arguing for "nothing". She is just giving fair warning.

<comment><USER20> Nor was I saying that "nothing" was the argument. I am simply pointing out that TED, science journalism and "storytelling" is generally a societal good, despite their flaws. Should we approach all things critically? Of course. I'm not a big Gladwell fan myself and I can't stomach Godin on a good day, but my view of the TED culture is much more positive for the reasons I outlined above.

</comment></comment></comment><comment><USER21> As the saying goes, all complex questions have simple, easy to understand wrong answers.

</comment><comment><USER22> Lots of good points that I definitely agree with.

> They are wrapped with a crudely drawn distribution curve on the cover and > published to a tourism market...

This reminds me of the lessons of Nassim Taleb (The Black Swan/Antifragile) who makes similar points about naive interpretations of statistics and their naive applications to most areas involving decision making.

I did really enjoy Blink though... I'm ashamed to say that I've barely started Thinking Fast and Slow (Kahneman's more scientific take on the same stuff) still.

</comment><comment><USER23> What the author seems to miss is that before he could describe decay pathways he had to learn what an isotope was. We shouldn't mistake the simplestory- tellers for tenured scholars - their job is not to render dissertation. It is to provide insight appropriate to the audience's level of understanding.

</comment><comment><USER24> Wow, that is some huge text. Computed font-size 31px.

</comment><comment><USER25> I would put a concise, simple point here summarizing the article, but...</comment>


Games involve constantly experiencing failure. So why are they fun? - <AUTHOR> http://www.oliverburkeman.com/blog/posts/games-involve-constantly-experiencing-failure-so-why-are-they-fun

<comment><USER2> For a game to be fun, it needs to give the player a sense that they are progressing ... getting a higher score, advancing to a higher level, seeing the next bit of the map, whatever. To play a game and score more than last time is success, even if your character ultimately fails by "dying". That reward is why we keep playing; if a game didn't give you the impression that you were getting further you'd feel like you're failing and soon give up. If you turned the score counter off in Tetris no one would play it for very long.</comment>


Satya Nadella pitched Excel to developers in a 1993 telecast - <AUTHOR> http://www.businessinsider.com/microsoft-ceo-satya-nadella-young-windows-nt-in-devcast-telethon-video-2017-9 <comment><AUTHOR> fast forward to: 1:45:27</comment>


Why so many programming languages? - <AUTHOR>

I started getting involved in coding ten or so years ago. I am self taught and, by necessity, became a jack of many trades (Bash, Awk, Javascript, PHP, Java, C, Assembly), but master of none.
I struggle to understand why so there's a flurry of languages seemingly designed to answer a specific need. Ten+ years ago, it was not the case (the purists will likely disagree).
C was well-suited for *nix, Basic for telco, ASM for micro-controller programming etc...Now, you have a need, wait a few months and you'll find a programming language.
Can someone please explain the reason why there is such an excess of programming languages? <comment><USER3> Almost every language fixes a certain problem in a way that the authors felt was better than any existing method.

In college I took part in an experimental Ada course - two semesters - <USER2> by arguably one of the first dozen or so experts in Ada. Ada was going to save the world - everything in the US Government was going to move to Ada, learn it or be a dinosaur. Ada had some very unique traits that made it very flexible. Dealing with financial figures/budgets? overload your math operators to handle currency. Dealing with extremely accurate numbers for missile tracking? overload your math operators to handle extremely precise numbers.

The problem was, after receiving this Ada training, replacing Cobol (which was the main intent), never took place. Now, the US Government allows programming groups to choose the 'right' language for the job. Ada is still used in some government and civillian tasks, but, it certainly didn't live up to the original hope. I believe portions of the Boeing 777 use Ada. It was still cheaper and easier to maintain Cobol code than to rewrite - and still is. I know two recruiters that occasionally mention their passing need for Cobol programmers - and it's been 25 years since Ada was going to replace Cobol.

PHP was originally developed to get away from Perl CGI and allow pages to be easily scripted and customized.

Every language has a particular strength or weakness and their own following. Not that you can't accomplish almost any task with any of them, it is selecting a language that might handle that task more efficiently.

Even for something like webapps, if you had 30 people in a room, I seriously doubt you would get any consensus on the best language for web scripting. Add on top of the language choice, frameworks, and you've got another religious war.

I don't think I have any projects that use a single language in deployment, even discounting bash from the equation. There are things that I find easier to accomplish in different languages.

</comment><comment><USER4> The reason why there are so many languages is that there's no committee deciding which languages are ok and which are not. And that's really, really awesome, because committees would stink at that.

Instead, we have the ability to choose among all these languages, or even to make our own. This is a good thing. Different languages approach things in novel ways, and learning new languages is a good way to broaden your skill as a developer. Learning new languages also gives you more tools in your toolbox, so you hopefully won't be stuck pounding in a screw with a hammer.

Some developers chose one language and stick with it, maybe for their whole career. This can be you, if you want that. But don't be surprised if your career becomes maintaining legacy apps, not that there's anything wrong with that.

<comment><AUTHOR> @dwc: sensible answer to a "problem" that made my head spin. Thanks for your insight. Much appreciated.

As far as "broadening your skill as a developer", it's another story. Maybe I should become self employed so I can finally master one trade and stop being the jack of so many.

</comment></comment><comment><USER5> This isn't particularly scientific, but the list of "2000s languages" on Wikipedia is relatively short:

[http://en.wikipedia.org/wiki/Timeline_of_programming_languag...](http://en.wikipedia.org/wiki/Timeline_of_programming_languages)

</comment><comment><USER6> There were quite a lot of languages even ten years ago.

There was shell, perl, python (albeit fairly young at that point), tcl, lisp, ada and so on and so forth.

The trend merely continued.

</comment><comment><AUTHOR> Why shouldn't there a one size-fits-all type language?

To the un-initiated (i.e me), this makes sense: one for mobile devices (java), one for the web (PHP?), one for UIs (javascript) and one for low-level work (c/asm).

How can someone who makes a living writing code be expected to keep up with the trend that @madhouse talks about?</comment>