Living with HTTPS - <AUTHOR> http://www.imperialviolet.org/2012/07/19/hope9talk.html <comment><USER2> This is pretty great. I guess he gave this talk at HOPE, but it's laser scoped to startups, down to the order in which he gives the advice:

* Enable HSTS

* Don't link to HTTP:// javascript resources from HTTPS pages

* Set the secure flag on cookies

Very few of the sites we test enable HSTS. But it's easy to do; it's just an extra header you set.

The only quibble I might have is the fatalism he has about mixed-security Javascript links. I'd go further than he does: when you source Javascript from a third party, you have leased your users security out to that third party. Don't like the way that sounds? Doesn't matter: it's a fact. Companies should radically scale back the number of third parties that they allow to "bug" their pages.

<comment><USER3> All of these are good recommendations.

Another technology to start preparing for is TACK. It allows you, the server owner, to control browser pinning of your certs while maintaining CA mobility. This gives you the control over your security that Google has over Gmail via Chrome cert pinning without having to issue a new browser build every time you change CAs.

One way to think of it is like a domain transfer lock but with cryptography. You control how you unlock your pin to allow mobility to a new CA by sticking a signed file on your SSL server.

<http://tack.io/>

[Disclosure: one of the authors of TACK is a former co-worker.]

<comment><USER4> I see Moxie is one of the authors on the draft. Is this an outgrowth/pivot of Convergence?

<comment><USER5> The way I see the relationship between Convergence and TACK is that Convergence is trying to provide trust agility for when we need to trust third parties, while TACK is trying to reduce the amount that we even need to trust a third party at all.

I think the first problem gets considerably easier to solve once the latter is in place, and there's a lot we could do with Convergence-like systems that would make them more deployable if TACK is adopted.

In the short term, however, TACK stands on its own, and we hope it's a fairly uncontroversial proposal that will be easy to integrate into the ecosystem.

</comment></comment></comment></comment><comment><USER6> > There's a second collarary to this: attackers can set your HTTPS cookies > too.

If your app uses session ID cookies, then another implication of this is that attackers can set a user's session ID to a value they know, wait for the user to log in, and then use the session ID to hijack the logged-in session. To prevent this make sure you regenerate session IDs when logging a user in. (This isn't the only reason to regenerate session IDs on log in but it's a very compelling one.)

<comment><USER2> This is called "Session Fixation". Most modern frameworks prevent it, which is a reason to use your framework's session functionality rather than re- inventing it.

Session fixation used to be a common problem. There were lots of J2EE applications which were not only fix-able, but which would allow an attacker to fix a session ID with a carefully crafted GET URL. It's much rarer now.

</comment></comment><comment><USER7> The author seems to gloss over the importance of browser built-in HSTS lists. If you're just relying on a response header to tell the browser to use HTTPS, aren't you still vulnerable? Isn't that the same fundamental problem with redirecting to HTTPS via Location headers?

In other words, a MITM could downgrade any HTTPS traffic and simply remove that STS header. The browser would be none the wiser.

<comment><USER2> No, that's not how STS works. Once the header is set, a MITM can't simply clear the header; the purpose of STS is to tell the browser to _remember_ that the site is HTTPS-only.

You are, obviously, vulnerable on first contact to a site, in that an attacker can prevent you from ever seeing the STS header. The point of STS is that attackers don't generally get to intercept your first contact with a site.

Adam Langley, by the way, is one of Google's Chrome SSL/TLS/HTTPS people.

<comment><USER7> I should clarify, I was referring to the first visit to the site. So yes, I can see how this greatly reduces the vulnerability, though it doesn't completely remove it.

As an example, a rogue Apple Store employee could insert him self as a MITM between the access point and the internet connection. Anyone testing out a new laptop in the store (or logging in to their bank from a just-activated iphone) would be vulnerable, without the attacker ever having touched any of those devices.

<comment><USER2> There are a lot of real security issues HSTS doesn't protect against. But for its miniscule cost, it does a very good job of protecting against one specific real threat.

</comment></comment></comment></comment><comment><USER8> Please for the love of god, if you're working at google and read this: Add a deeply set option to _FORCIBLY_ enable that button in all situations where it might appear. We sometimes have certificate issues with our proxy server at my workplace and it makes Chrome practically unusable when they happen.

I know what I'm doing. I'll reset the option when the underlying issue is resolved, and overall it's a great feature for the browser, but I need to have the ability to be responsible for myself.

<comment><USER2> It's very straightforward for a proxy to have its own CA=YES certificate and mint/sign certs for every HTTPS site the proxy sees on the fly. If you have a corporate proxy that is intercepting HTTPS traffic, that is what it should be doing.

Then, the proxy makes its certificate available to users, you download it, and add it to your CA certs via the UI that browsers provide for that; HTTPS magically appears to work again.

<comment><USER9> So the proxy server acts as a forced man in the middle? This has to be one of the most atrocious things I have ever experienced. Forcing a man in the middle is insane especially in a large company where there may well be a lack in competency.

HTTPS shouldn't magically appear to 'work' again, considering it is completely broken when a forced mitm is introduced.

<comment><USER2> Are you arguing with me, or with reality? I can't tell, because the system I described is how corporate proxies work pretty much everywhere.

If you want privacy against the administrators of your employer, don't use your employer's network to do things that need privacy.

<comment><USER9> I don't see how my comment may be interpreted as starting an argument. I was simply replying on your comment on HTTPS just 'work'ing once you ignore the man in the middle attack. It's not privacy from an employer that is the underlying issue. It is the practice itself which should be frowned upon. People didn't spend their time trying to come up with the ability to have secure communications from point A to point B just to have someone come in and break it.

The problem isn't necessarily what the employer sees, it's what the might employer keep around.

<comment><USER2> Enterprises are making a policy decision to take advantage of the Internet security model from the border of their network outward, but to take responsibility for IP security inside their network. That is a reasonable policy decision.

But even if reasonable people could disagree about that policy decision: the reality is that people operating large corporate networks require the ability to control SSL/TLS sessions; for instance, there are whole industry verticals where accessing a private email server not controlled by your employer is grounds for automatic termination, because regulations require them to track and archive email messages.

Finally, and I'm repeating myself: I am describing the reality of _most_ Fortune-500 enterprise networks. In most corporate networks, you cannot simply talk from your desktop out to the Internet; you are required to use a proxy. You're also almost certainly on an 10/8 IP address.

</comment></comment></comment></comment></comment></comment><comment><USER10> Moxie published a tool called SSLstrip <http://www.thoughtcrime.org/software/sslstrip/> here's a simple video demonstration <https://www.youtube.com/watch?v=PmtkJKHFX5Q>

<comment><USER11> Very interesting. Thanks!

</comment></comment><comment><USER12> For users, HTTPS Everywhere is a must: <https://www.eff.org/https-everywhere>

Also, by using DuckDuckGo [1] over HTTPS you get the same ruleset in HTTPS Everywhere [2] even if you don't have the extension installed.

[1] <https://duckduckgo.com/>

[2] [http://www.gabrielweinberg.com/blog/2010/09/duckduckgo- imple...](http://www.gabrielweinberg.com/blog/2010/09/duckduckgo-implements- https-everywhere.html)

<comment><USER13> The chrome extension at least seems to break a lot of sites. They're not kidding when they say it's alpha.

Pages include resources from https-everywhere'd domains and for whatever reason (mostly that the ssl versions of those resource urls aren't serving the same resources, or have broken certs) those resources fail to load. Within an hour of using it I'd seen it break 3 or 4 sites, so it got disabled.

You can manually disable it for individual sites, _if_ you recognize that it's the problem, but if some minor resource fails to load it might not be obvious.

<comment><USER14> The reason the extension 'breaks sites' is because an alarming number of sites are happy to serve unsecure content all over the place. See the refernece to New York Times in the original article for an example.

</comment></comment></comment><comment><USER15> Honest question, for those who have done it: what are the _downsides_ of allowing your whole site to be accessed via SSL?

Obviously, you need to be a bit more diligent about making asset urls protocol-relative (which can be a PITA across a large, dynamically generated site), but are there any other gotchas? Server load? Reduced cache-ability?

<comment><USER16> By protocol relative, are you referring to the // urls?

(<http://paulirish.com/2010/the-protocol-relative-url/>)

Because they wound't be so PITAish would they?

</comment></comment><comment><USER17> It mentions the free StartSSL certificates, as does their page. But what isn't clear is if the certificates are free to renew after a year (ie this is just a teaser).

I currently use a self signed cert and certificate patrol, but apps (in particular Thunderbird) are becoming increasingly hostile to that.

<comment><USER18> > what isn't clear is if the certificates are free to renew after a year

Yes, they are. StartSSL will even send you a reminder e-mail.

</comment></comment><comment><USER19> HTTPSEverywhere is a firefox/chrome browser plugin, that will ensure connections that can be HTTPS are. It also does a good job preventing ssl stripping.

<https://www.eff.org/https-everywhere/>

</comment><comment><USER20> This was by a wide margin my favorite talk at HOPE this year.

(and a great advertisement for using Chrome in secure settings where you need a web browser)

The irony of Google being one of the main http-only JS resources for a long time was kind of amusing, though.

<comment><USER21> What do you mean by "Google being one of the main http-only JS resources"?

<comment><USER20> Adsense.

Also I think GA was http only at some point.

<comment><USER21> Adsense can be an issue. At least it isn't a requirement for site functionality though.

GA has had https support as long as I can remember.

</comment></comment></comment></comment><comment><USER22> I'm wondering if there could be an equivalent DNS entry that might help signal a site should only be accessed via SSL? Then you could possibly protect against initial access as well as returning users.

<comment><USER23> We can't do a blocking DNS lookup other than for A/AAAA records. About 5% of Chrome users cannot resolve TXT records because the network is filtering the DNS requests. (i.e. we know that the network is up and we're asking about a DNS name that we known exists, but we get a timeout.)

<comment><USER24> In [1] you showed us how to authenticate via DNSSEC HTTPS in Chrome. If I understand correctly this involves a lookup of a TYPE257 record. Given that only 5% can resolve TXT records, do you know what % of Chrome users can then resolve TYPE257 records?

Digressing a bit further, wouldn't you say that even if HSTS is enabled _and_ registered in the all the browsers' built-in list, you still have the problem of unencrypted DNS lookups? (Maybe this kind of attack is orders of magnitude harder to implement. I honestly don't know.)

[1] <http://www.imperialviolet.org/2011/06/16/dnssecchrome.html>

<comment><USER2> No. The whole idea of HSTS is that you can never trust the DNS; you assume that's the most likely way an attacker is going to MITM her victims. HSTS tells the browser to remember that from that point on, all connections to SERVER.NAME have to happen under a TLS session with a valid cert.

<comment><USER24> Thanks for your answer! I'm more confused by the moment about DNSSEC et al: isn't the DNSSEC-based validation of HTTPS referred to above supposed to get rid of CAs in the future? That wouldn't make sense even with DNSSEC considering that the information is not encrypted? (Right?) I hope you don't take this as "hijacking", but I'd be most curious about what you and other security experts think about Paul Vixie's "Whither DNSCurve?" [1], which has amazingly not been submitted in HN. I just submitted it [2].

(If I could vote for your time investment, please kindly consider commenting on that article before replying to this comment.)

Thanks again!

[1] <http://www.isc.org/community/blog/201002/whither-dnscurve>

[2] <http://news.ycombinator.com/item?id=4268461>

<comment><USER2> There is a splinter group of people- who- want- DNSSEC who argue that DNSSEC will obviate the need for CAs. There reasoning, distilled, is that DNSSEC is itself a PKI, with the roots signing TLDs and TLDS signing domains and so on. Since the core architecture purpose of certificates is to "break the tie" between an attacker's public key and the real site's public key, and since DNSSEC zones could serve the same purpose, by housing a DNSSEC-signed public key, blammo, no more Verisign.

There are a bunch of problems with this idea. Most of the ones that spring to my mind are problems with DNSSEC in general: its brittleness, the reliability problems I think it's going to cause, the things it does that actually diminish the security of the DNS... but the big point relevant here is: DNSSEC replaces a market of CAs with a baked- into- the- Internet fiat authority. If DNSSEC had replaced SSL CA's in the mid '00s, Ghaddafi's Libya would have been Bit.ly's CA. This does not seem like a win to me.

I don't think that rent-seeking SSL CAs are as big a problem as many HN users seem to think they are. I think ultimately there's significant expense involved in operating a secure CA, and that relative to their purported value, CA certificates are reasonably priced.

The pressing problem with SSL/TLS is that CAs aren't trustworthy. They are rent-seeking, as expected, but also shoddily operated. The Internet has largely lost faith in the people operating CAs.

Moreover, a decade and a half of browser/CA relationships have left all the major browsers riddled with skeleton-key CA certs run by organization that nobody can really vouch for. As a result, large companies have purchased browser-trusted CA operations, and then used them to do incredibly dubious things. The companies that have been caught doing skanky stuff with their CA keys haven't even been kicked out of the browser CA stores.

As a result, we're left with a situation in which untrustworthy companies can potentially sign certificates for (and thus enable transparent MITM attacks against) critically important sites, like Google Mail. That's an untenable position.

I personally believe (and, yes, hope) that the future of Internet security looks much like today, except with things like Trevor Perrin and Moxie Marlinspike's TACK scheme, to allow security-sensitive sites to overrule bogus CAs, and to allow us to gradually decrease the architectural dependence we have on SSL CAs and start experimenting with more flexible alternatives.

I am not a fan of trying to take the same model that just failed us, but centralizing it and handing it over to the unaccountable groups of people who control the domain name system.

<comment><USER24> Wow. Thank you very much for educating us, Thomas. Your comments require grabbing some popcorn or equivalent. In particular when you engage in a constructive debate with someone of your caliber. One of my all-time favorite threads in HN (or elsewhere...) is <http://news.ycombinator.com/item?id=893659>. Thanks again.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> What I take out of this, beside things I knew of already (and most others as well) is:

* Chrome wants to FORCE you to buy an SSL certificate.

* The guy suggest getting one from StartSSL BUT those are crap for 2 reasons: you can only have ONE domain, else you have to pay. The TOS are horrible.

So, dear imperialviolet, if you want me to use certificates that your company trusts (and by extension, your users), get up with it and make Google provide free, unlimited SSL certificates.

Til then, no dice.

<comment><USER26> If you can't afford the $43/year for a Thawte starter cert, you have no business running a domain of your own. Seriously, less than $4 a month - that's going to be dwarfed by any sort of hosting you might be paying for.

And it's only one domain _per cert_ , so your entire argument is silly.

<comment><USER27> Dwarfed by hosting costs? There is tons of shared hosting options in the $50/year range which are quite usable for lots of purposes.

</comment></comment></comment><comment><USER28> SSL/TLS & Perfect Forward Secrecy - <http://hackerne.ws/item?id=4267767>

</comment><comment><USER29> Obligatory Django link: <https://github.com/carljm/django-secure>.

</comment><comment><USER30> Somewhat related question: It's fairly common for sites to have static files (images/css) served on a different (sub)domain. What are you supposed to do when the html content is being served on HTTPS? Should the static files be on HTTPS as well? If so, wouldn't it need a different certificate? Certificates are only valid for a single domain, after all.

<comment><USER31> You can get SSL certs that are valid for wild card subdomains, e.g. *.example.com

<comment><USER6> Wildcard certs tend to be very expensive. If you only need two domains it's probably more cost-effective to just buy two certs.

Edit: a downside of using separate certs is that you'll need to serve the respective sites from separate IP addresses, or rely on SNI [1] which isn't supported in older browsers. But if the use case is a separate domain for serving static files, that's probably hosted on a different server/IP address anyways, right?

[1] <http://en.wikipedia.org/wiki/Server_Name_Indication>

<comment><USER32> A certificate can also have a number of alternate names, which providers call a Unified certificate -- UCC. The nice thing about that is that you can add/remove names after you've bought the certificate without having to go through the process.

I haven't tried this in practice though, but this might be useful if you want to provide a bunch of client.yourdomain.com secure subdomains from the same IP address. Only downside is that the organization name will be the same.

<comment><USER33> This is also wildly more secure than a wildcard certificate, where if someone nicks your private key your entire domain is compromised, but with UCC only select hosts' security could be compromised. I believe it's also supported in more devices than SNI (since X.509v3)

</comment></comment></comment></comment></comment><comment><USER34> honest question: why can't banks when customers open a new account, give them a card with 1. the bank's ip addresses (in each region) and 2. their printed public key (ssl or ssh format). and why doesn't the bank ask for a public key from each customer? in-person key exchange.

no one even pays attention to the client side of ssl. how many of you use your own ssl certificates? you basically can't under the cert authorty scheme. it's a racket and no one is going to pay for these. and do the banks even care? they use tactics like cookies and follow-up emails to verify customers (hardware).

and why does the bank have to be able to switch their ip address without telling anyone? what if the same was true for phone numbers? people would be like wtf? load balancing? c'mon. too difficult ot type? thnk about the trade- offs in security, all for the sake of not looking at a number? ipv4 is no longer than an area code and phone number. just tell people where your servers are and let them choose the one that is nearest. which incidentally, contrary to conventional wisdom, is not _always_ the one that will be the most responsive in the ever-changing state of the network.

there's nothing more annoying than being subjected to using trial and error and you are not allowed to do any of the trial when the errors start coming. out of your control.

what happened to the concept of "important numbers"? are we to believe you only need to remember "google.com" or "yourbank.com"? that's a security problem waiting to happen.

second honest question: why does bank website need to embed links to third party reources and require that customers enable their browsers to access all these indiscriminantly (user doesn't get to choose) and to enable javascript?

is javascript needed for security of a connect or to accomplish a financial transaction? because that's all i need from the bank website.

i think we're past the point where customers need to be enticed to use the web to do things like banking and shopping. they're going to be forced to. so we can forgo the silly demonstrations and gratuitous use of javascript. save for "show HN".

what we need is simplicity, reliability and security.

</comment><comment><USER35> Does anyone have any recommendations for search terms I could use to put together a list of news stories / posts about known man-in-the-middle attacks that have occurred?

</comment><comment><USER36> If includeSubDomains is set for HSTS, does that mean that a cert for <https://foo.com/> is required instead of <https://www.foo.com/> in order to protect cookies set for foo.com and under?

It's not clear to me from what docs that I have been able to find.

</comment><comment><USER37> Google Cache mirror if anyone needs it: [http://webcache.googleusercontent.com/search?q=cache:http%3A...](http://webcache.googleusercontent.com/search?q=cache:http%3A//www.imperialviolet.org/2012/07/19/hope9talk.html)

</comment><comment><USER38> Any experience with CORS and https?

Does it work properly?

If i have www.mydomain.com with certificate A, and api.mydomain.com with a certificate B, can i make CORS call with javascript?

(i know that if you try it with self signed cert, it will just drop the request)

<comment><USER39> Yes this works. Just get all the headers correct.

</comment></comment><comment><USER40> I have a rails 3.2 site, and I hadn't thought about this much aside from setting force_ssl to true. Turns out that automatically enables HSTS and secure cookies - cool!

</comment><comment><USER41> For what is worth Libya owned a trusted CA (maybe still does), which means that MITM would happily work, because they can transfer all the certs to their own authority. I don't personally see how this is more secure than my self- signed certificate, which generates a warning that's these days very hard to avoid (even if I _do_ know that the cert is fine)

<comment><USER2> Stipulate that it's true that Libya owned a browser-trusted CA, and compare situations:

With signed certificates, Libya can MITM (unpinned) certificate-backed TLS sessions.

With signed certificates, random people cannot MITM (any) certificate-backed TLS sessions.

With self-signed certificates, Libya can MITM any TLS session.

With self-signed certificates, random people can MITM any TLS session.

I'm not seeing the argument you're making here.

</comment></comment><comment><USER42> I learned a lot about internet security here. Thanks a lot!</comment>


Ask HN: Building a Search Utility - <AUTHOR>

What are some resources that'd guide building a simple Web-based search utility?  Free online content, course materials, or source code are especially appreciated :-). <comment><USER2> Well, depending on the details of what you're doing, you may find it very straightforward to use Apache Solr[1]. It's basically a search engine in a box, other than getting the content indexed. It'll be up to you to figure out how to take whatever content it is that you're searching, and get it into the index.

If Solr is overkill for what you're doing, you can easily build a simple search engine using Lucene[2] directly (Solr builds on Lucene).

Nutch[3] might also be worth a look.

There's also a really good free book on Information Retrieval available[4].

[1]: <http://lucene.apache.org/solr/>

[2]: <http://lucene.apache.org>

[3]: <http://nutch.apache.org/>

[4]: [http://nlp.stanford.edu/IR-book/information-retrieval- book.h...](http://nlp.stanford.edu/IR-book/information-retrieval-book.html)</comment>


Sperm counts among western men have halved in last 40 years - <AUTHOR> https://www.theguardian.com/lifeandstyle/2017/jul/25/sperm-counts-among-western-men-have-halved-in-last-40-years-study <comment><USER2> > _Levine agreed that research into potential causes was needed. Numerous > possibilities have been mooted, with research suggesting links to body > weight, a lack of physical activity, smoking, and exposure of pregnant women > to chemicals found in myriad household products, known as endocrine > disruptors._

various prescription drugs?

</comment><comment><USER3> That last part.

Anything known to help your count or increase?</comment>


Convert your website into native Android and iOS mobile app - <AUTHOR> Hey what's up? It's your boy Youssef checking in right here, today I am back with another project, not a special one tho. It started by me having an unused domain name and like a boilerplate/template I just found buried on my GitHub, a client asked me few months ago to build a webview + sidebar app, very minimal but extremely cheap.
I said to myself if someone is interested in a solution like that there must be other people with the same goal, so here it is, a quick and reliable dashboard to help you create a mobile app in 5 min. The code is react native so definitely cross-platform. As always I ship my products asap, I don't bother with UI design, complex features and other stuff that take a lot of time until I get some traction.
So yeah that's that way I cooked up Murkstom http://murkstom.com/?utm_source=hackernews
Feel free to ask me anything and everything! <comment><USER2> You're talking about a web view, so it's not native?

Just because the web view is managed by React Native doesn't mean the app is native if the main functionality of the app is in a web view.

<comment><AUTHOR> The webview is by definition a native component, I mostly agree that we shouldn't call it a "native" app but I hope to find customers interested in adding more features than simply rendering the URL.</comment></comment>


The Woman Who Can't Recognize Her Face - <AUTHOR> http://www.newscientist.com/article/dn23482-mindscapes-the-woman-who-cant-recognise-her-face.html <comment><USER2> I had an interesting case of momentary face blindness once. It was unnerving. I was elbowing my way through a very busy bar area (it was early and I had just started drinking) and eventually there was a person in front of me who started going to the left just when I went left, and vice versa, as often happens when you walk in a crowded place. After a few left/right attempts I suddenly realized that the person was, in fact, myself, and that I had reached a mirror that covered the entire end of the room. (The bar's bouncer was standing behind me and had watched the whole thing and was laughing very hard.)

The thing is, since I did not _expect_ to see myself, I did not recognize myself. I believe that for one brief moment I truly saw myself as other people see me. We go through our lives being so psychologically connected to our outer selves, and being briefly disconnected feels very spooky.

</comment><comment><USER3> This reminds of a fascinating book, _The Man Who Mistook His Wife for a Hat_ by Oliver Sacks.

One of the most interesting stories is about a man who lost his ability to intuitively recognize things and needs to reason about their features to find out what they are.

      This is my shoe, no?
      No, it is not. That is your foot. There is your shoe.
      Ah! I thought that was my foot.

Whole excerpt here: [http://www.odysseyeditions.com/EBooks/Oliver-Sacks/The- Man-W...](http://www.odysseyeditions.com/EBooks/Oliver-Sacks/The-Man-Who- Mistook-His-Wife-for-a-Hat/Excerpt)

<comment><USER4> Currently reading Hallucinations. His coverage of such bizarre conditions as Akinetopsia (<http://en.wikipedia.org/wiki/Akinetopsia>) make his books great reads for the casually curious and really make it concrete how much of our reality is formed primarily in our heads.

</comment></comment><comment><USER5> I'm mildly face blind. Generally speaking it doesn't cause any problems - occasionally I spend the first 25 minutes of films wondering who is who and what's going on, and having missed the opening of The Departed I watched most of the film thinking Matt Damon and Mark Wahlberg were the same person.

However, there have also been some excruciatingly embarrassing situations where I've re-introduced myself (or ignored) people I actually know, although typically I've only met them a couple of times. Bizarrely, I'm worst with caucasian blonde women.

<comment><USER6> I think I am a bit face-blind too, and it seems to be mostly with women as well. I'm almost completely thrown off when a woman does a complete makeover. I find myself flustered by actresses quite often, having almost no idea if I should know who this person in the film is or not.

I can usually tell the difference between the various actresses in the same film, but across films I definitely have trouble.

But I have had trouble with some films that have multiple young brunette male actors (in their 20s to early 30s). There's been more than one movie where I didn't realize two different characters were two characters until it was almost over (or one of them died and the other kept on kicking). A second watching usually gets me sorted out.

I frequently weirded out by people who can look at a random candid photo of a famous person in a disguise and know who it is. The folks who work at TMZ blow me away.

</comment></comment><comment><USER7> There's this "mirror test" [1] where they put animals in front of a mirror. If they recognize themselves, they are considered to be aware of themselves.

This woman is either not aware of herself or her condition is a strong indicator that the mirror test might not be such a good idea at all. Definitely an interesting implication.

[1] <http://en.wikipedia.org/wiki/Mirror_test>

<comment><USER8> I've always considered The Mirror Test a deeply flawed experiment because it relies on a number of assumptions that are difficult (in my non-expert opinion at least) to guarantee.

For examples, babies are tested with a sticker, it's assumed that a baby's lack of motivation to remove the aforementioned sticker is proof that they baby is not yet self aware. Yet that's assuming that the child isn't just curious about his or her own appearance (as at that age they might not be familiar with their own image) so that the sticker is inconsequential to them.

</comment></comment><comment><USER9> You can test yourself here:

<http://www.faceblind.org/facetests/>

<comment><USER10> Honest question: These guys mention using the results for research. They must know they are skewing their results quite significantly by singling out anyone who is a) aware that the result of this test can be embarrasing b) not comfortable linking their name to such a test with?

I'd guess according to this test face blindness is far less common than previously assumed : )

<comment><USER9> As I understood it, they're basically searching for people with prosopagnosia for further research. They also mention somewhere that some people with prosopagnosia can do well in the test (I assume if those people have seen the famous faces enough it can work for light cases.)

</comment></comment></comment><comment><USER11> The headline is confusing. It should be "The Woman who can't recognize faces".

<comment><USER12> ...

How is that confusing? Not recognizing her own face is a special case.

<comment><USER13> I have to agree with the OP. The way the title is written, I took it to mean that she could recognize all faces except for her own.

</comment></comment></comment><comment><USER14> 2.5% of the population? Is that accurate? Seems too high.

<comment><USER15> "The researchers, led by Ken Nakayama and Richard Russell at Harvard and Bradley Duchaine at University College London, have found evidence that prosopagnosia, once thought to be exceedingly rare, may affect up to 2 percent of the population – suggesting that millions of people may be face-blind."

[http://news.harvard.edu/gazette/story/2006/06/face- blindness...](http://news.harvard.edu/gazette/story/2006/06/face-blindness- disorder-may-not-be-so-rare/)

"Recently, a hereditary sub-type of congenital prosopagnosia with a very high prevalence rate of 2.5% has been identified."

[http://onlinelibrary.wiley.com/doi/10.1348/174866407X231001/...](http://onlinelibrary.wiley.com/doi/10.1348/174866407X231001/abstract;jsessionid=0E1E3A1E3E97AFA7EED6DDAC3374885C.d03t02?systemMessage=Wiley+Online+Library+will+be+disrupted+on+11+May+from+10%3A00-12%3A00+BST+%2805%3A00-07%3A00+EDT%29+for+essential+maintenance)

</comment></comment><comment><USER16> I am not only mildly face blind, I sometimes just can't recall names. I had the face test and I just realized that I had forgotten the name of lead actor of Rocky (S. Stallone), Ex- President of USA, Saturday Night Live star, Taxi Driver's Lead actor and what not.

</comment><comment><USER17> I remember being in a very interactive week-long seminar where one of the 30 participants was a white guy with a beard. A few days into it I realized he was two guys. Just before the end of the week I realized he was (at least) three guys.

</comment><comment><USER18> There's a really good scifi short story about something called calliagnosia, by Ted Chiang. (Calliagnosia is a condition in which a person can not recognize beauty in a persons face. Not sure whether it was invented for the story or not.)

Here is a crappy PDF of it: <http://www.clarku.edu/welcome/placement/pdf/reading.pdf>

I'd suggest picking an anthology with the story up if it interests you. I read it in "Best of Scifi 2002" or something like that.

</comment><comment><USER19> This post creeps me out just a little bit, because I watched "Faces in the Crowd" last night (<http://www.imdb.com/title/tt1536410/>), and I have never even heard of face blindness before. Waking up and checking HN to see this post is slightly spooky. That is all. Oh, and I personally wouldn't recommend the movie.

</comment><comment><USER20> 60 Minutes did a two-part segment on this last year, if anyone is interested:

<http://www.cbsnews.com/video/watch/?id=7417242n>

<http://www.cbsnews.com/video/watch/?id=7417240n>

</comment><comment><USER21> Stories like these leave me dwelling on what the majority of the population may fail to notice due to hard-wiring. For example: a small percentage of people see a _wider_ range of color than average.

Does "situational blindness" or "system-level blindness" exist on a neurological level?

</comment><comment><USER22> It's an old lecture but if you want to understand some of the reasons why this is happening I can't recommend <http://www.bbc.co.uk/radio4/reith2003/lectures.shtml> enough.

</comment><comment><USER23> I wonder if it is possible to train people with such condition to successfully recognize faces.

I have some difficulties recognizing faces(not nearly as huge as describe in the article), and I think my ability improved during last couple of years.

<comment><USER24> I would imagine that to be the case.

Witness how many people report being unable to distinguish people from ethnicities that they're not used to interacting with.

<comment><USER25> Yup. Until I moved to the west coast all Indians looked like the same person to me.

</comment></comment></comment><comment><USER26> It's fascinating that that by accident/by design we, animals or humans, can recognize anything at all.

<comment><USER27> It's a survivor behavior. Recognize weak and strong elements in the group. Recognize safe places and easy to hunt animals.

Recognizing things is the essence of good decision making. And decision making is the essence of life.

So, yes, the odd for recognizing anything from a gigantic bunch of proteins, water, and subtle mix of heterogeneous chemicals, are very little. But, considering billions of year of billions of dices running, probability was high, don't you think ?

<comment><USER28> No, I don't think. Such order is not probable, given infinite time.

That all of this occured randomly, beginning with an explosion (involvng matter which should not have existed, by the way), is absurd.

People who argue against intelligent design may quibble with the details of a particular religion, but our attempts to scientifically describe creation are so woefully inadequate as to be no more actual science than is religion.

Randomness is one such "scientific" explanation. In fact, it is the religion of science, serving as the de facto answer for unknowns regarding creation and existence.

<comment><USER29> Have you ever seen genetic algorithms at work? Any doubts I had about evolution being a reasonable explanation for the complexity of life vanished when I saw how quickly systems could converge to viable solutions to problems by mixing characteristics from the most pat members of a population.

<comment><USER28> Yes, I did research on genetic algorithms with a professor in my college years. Wrote a few myself, played with fitness measurements, crossover methodologies, etc. I found them fascinating as well.

The theory of evolution can certainly describe some of what we see, however, it is woefully incomplete in its suggested role in creation theory. And while randomness clearly has a role in nature, it has become the default go-to for too many things which science cannot explain. Notice how the parent just casually tossed out randomness as the "obvious" explanation for such complex behavior, as if it was a foregone conclusion. It's anything but.

These are tremendously organized and complex systems (including the creation of the Universe itself), for which the prime driver is supposedly randomness. I just think it funny that people deride religious explanations as utter silliness, while so willingly believing that randomness is responsible for, effectively, everything we see. What is scientific about that? We even suspend basic laws of thermodynamics regarding matter creation to accomodate our random-centric explanations.

Better to just say, "we don't know".

<comment><USER30> I recommend [http://www.amazon.com/COMPLEXITY-EMERGING-SCIENCE-ORDER- CHAO...](http://www.amazon.com/COMPLEXITY-EMERGING-SCIENCE-ORDER- CHAOS/dp/0671872346/ref=sr_1_1?ie=UTF8&qid=1367771719&sr=8-1&keywords=complexity) which addresses this question in fascinating detail, and of course [http://www.amazon.com/Blind-Watchmaker-Evidence-Evolution- Un...](http://www.amazon.com/Blind-Watchmaker-Evidence-Evolution- Universe/dp/0393315703/ref=sr_1_1?s=books&ie=UTF8&qid=1367771784&sr=1-1&keywords=the+blind+watchmaker)

<comment><USER28> Thanks for the references. I am somewhat familiar with the second, and I look forward to diving deeper.</comment></comment></comment></comment></comment></comment></comment>


Show HN: Hosting my first developer event - <AUTHOR> http://indyhackday.com

<comment><USER2> I've run a few Hack days before so here are my first thoughts;

* your asking for my email address for a mailing list instead of letting me get a ticket (I see from the menu I can buy a ticket) but thats not obvious from the main splash above the film

* is this a traditional hack day its a little confusing (24 hours to work one something with prizes?

* if you've only launched this today you've left yourself a big task, < a month before the event, your going to have to push this a lot :)

good luck</comment>


Google confirms investment in Indonesian ride-hailing firm Go-Jek - <AUTHOR> http://www.nasdaq.com/article/google-confirms-investment-in-indonesian-ridehailing-firm-gojek-20180129-00055 <comment><USER2> I imagine it's just a coincidence that Steve Yegge recently left Google, joined Go-Jek competitor Grab, and posted a disparaging take on Google's slowing rate of innovation, but it's funny to imagine this as Google's revenge.</comment>


Ask HN: How to security scan your web application? - <AUTHOR>

Just wondering what tools you guys use to perform security checks on your applications?<p>I'm using skipfish for the security scan. What are you guys using? <comment><USER2> Not a tool, but a good read on this subject nonetheless:

<https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines>

</comment><comment><USER3> You could try brakeman if you're using rails.</comment>


Computer Programming Is a Trade; Let's Act Like It - <AUTHOR> http://online.wsj.com/articles/computer-programming-is-a-trade-lets-act-like-it-1407109947 <comment><USER2> WTF would you post an article that is behind a paywall?

<comment><AUTHOR> [http://lmgtfy.com/?q=Computer+Programming+Is+a+Trade%3B+Let%...](http://lmgtfy.com/?q=Computer+Programming+Is+a+Trade%3B+Let%27s+Act+Like+It+)</comment></comment>


Startup launches to match cancer patients with clinical trials - <AUTHOR> https://www.statnews.com/2018/09/06/with-big-name-backing-a-startup-launches-to-match-cancer-patients-with-clinical-trials/ <comment><AUTHOR> _[The startup] will charge cancer patients $3,000 upfront plus a $20 monthly fee — all out of pocket — for a service that analyzes their tumor sample and their medical record. Driver uses that information to recommend options for both approved treatments and clinical trials as well as facilitate referrals via an app that patients can access on their phones._

Soaking the desperate for statistically questionable, and morally indefensible, false hope.</comment>


Scalability vs. Performance: it isn't a battle - <AUTHOR> http://www.lethargy.org/~jesus/archives/91-Scalability-vs.-Performance-it-isnt-a-battle.html <comment><USER2> I don't think his point carries very far. Look, people are running large, successful web sites using PHP. What more proof do you need that performance is irrelevant?

<comment><AUTHOR> I don't think performance is irrelevant at all.

However, the "sweet spot" for acquisitions seems to be when your business reaches the 20-100 server range. LiveJournal, Wikipedia, Meebo, Flickr, etc. all seem to be around that size.

That's precisely the range where scalability _does_ matter and performance _doesn't_. You've outgrown the put-web-and-DB-on-separate-boxes-and-replicate approach, so you actually have to think about partitioning & shared-nothing. But 30 servers @ $200/month/server is only about $6000/month, the cost of a single employee. At this stage, it doesn't really make sense to sacrifice developer hours for operational costs.

If you get to be really big, it makes a whole lot more sense. 100,000 servers @ $200/month/server = $20M/month, more than the purchase price of a small smartup. At this point, it makes a lot of sense to put a team of a half-dozen or so programmers onto the problem of speeding up individual server performance. If you can double performance, you save $10M/month, which'll pay wages for close to 1000 programmers.

There's a reason why Google writes all their performance-critical stuff in C++.</comment></comment>


Exploiting Chrome V8: Krautflare - <AUTHOR> https://www.jaybosamiya.com/blog/2019/01/02/krautflare/ <comment><USER2> Really interesting bug in TurboFan's optimizer; getting Math.expm1 handling -0 incorrectly to removing bounds checks by dancing around multiple optimization passes was quite illuminating. Although, later in the exploit, it seems like using WebAssembly creates a RWX page? Why is Chrome doing this for WebAssembly when it stopped doing this for JavaScript, for obvious reasons?

<comment><USER3> V8 WebAssembly TLM Ben Titzer explained in a previous HN comment: [https://news.ycombinator.com/item?id=18812449](https://news.ycombinator.com/item?id=18812449)

</comment></comment><comment><USER3> Andrea Biondo did a writeup of the same CTF which I liked a lot. [https://abiondo.me/2019/01/02/exploiting-math- expm1-v8/](https://abiondo.me/2019/01/02/exploiting-math-expm1-v8/)

EDIT: Previous HN discussion on Andrea's writeup: [https://news.ycombinator.com/item?id=18808488](https://news.ycombinator.com/item?id=18808488)

</comment><comment><USER4> The left sidebar covers about a third of the content for me.

<comment><USER2> You can click on the hamburger menu to hide it.

<comment><USER5> Nope. Reader mode also doesn't work, which is rather uncommon.

<comment><USER2> What browser are you using? On mobile Safari, I don't see the sidebar, and in Safari on macOS I can hide the sidebar. Reader mode doesn't work on either.

<comment><USER6> Reader mode should be working now. Just tested on mobile Safari.

</comment></comment></comment></comment></comment><comment><USER7> Impressively, Shellphish solved this challenge in 3 hours. The CTF's interactive leaderboard is fun to play with: [https://archive.aachen.ccc.de/35c3ctf.ccc.ac/](https://archive.aachen.ccc.de/35c3ctf.ccc.ac/)

</comment><comment><USER8> Wow, I feel very dumb after reading this.

<comment><USER9> It shouldn't make you feel dumb - it should just make you aware of the incredible breadth and depth of human knowledge out there.

For every single field, there is so much to learn and know. People often underestimate how complex their sister-fields are. You know enough to be dangerous, but not enough to know how much you don't know.

</comment></comment><comment><USER6> Hi! Author here. Happy to answer any questions.

</comment><comment><USER10> Can anyone explain the bug and how it was exploited in simpler terms?

</comment><comment><USER11> And those Hacker News, Reddit and Twitter messages from Cloudflare employees about their VM-less workers's security will be gold in the future.</comment>


Formula E reveals second-generation car - <AUTHOR> https://www.motorsport.com/formula-e/news/formula-e-reveals-second-generation-car-1000535/?s=1 <comment><USER2> Note one of the most farcical parts of Formula E is changing for the 2018–19 season (when the new chassis is introduced): they're getting rid of the mid- race car change, and the batteries are required to last the full race distance.

<comment><USER3> What's farcical to me is that the cars are standardized and manufactured by one company. How is that supposed to be interesting and drive innovation?

<comment><USER2> The goal is powertrain innovation, without making teams divert their funds to developing new chassis and aero parts. The powertrain, beyond the battery, is free for manufacturers to compete on. Only the first season (2014–15) had completely identical cars.

<comment><USER4> Isn't battery where innovation is most needed?

<comment><USER2> Most of the concern with battery innovation is you can burn a lot of money very fast, as far as I'm aware, and I believe the manufacturers believe the powertrain to be more useful to invest in.

</comment></comment></comment></comment></comment><comment><USER5> I would really like to see a formula class that has no human pilots and no one on or near the field so the cars can go as fast as they possibly can, no limitation based on human reaction speed or human safety, no arbitrary rules around tire material or suction fans under the car etc etc.

<comment><USER6> I'd like to see that out of pure curiosity, but I would almost definitely struggle to get excited about it without the human element.

I think most wouldn't be that interested if there wasn't an actual driver (in the car, too, not some remote thing), even if it's ultimately faster.

<comment><USER7> > _I would almost definitely struggle to get excited about it without the > human element_

You'd have teams in "pits" monitoring their vehicles live. Those reactions will be raw and humanistic.

When the vehicle comes in for a "pit stop," the team--in addition to doing mechanical maintenance--could be allowed to tweak the code, _e.g._ based on strategic observations of other cars' behaviours. To keep it interesting, one could mandate--to make up for the electronics in the car--all "pit stop" labor be completely manual. (Any code changes could be taken onto the track on an unpowered drive.)

</comment></comment></comment><comment><USER8> EV's are amazing for drag racing (at least up to about 160mph) and hillclimb. Circuit racing has a long way to go before it is watchable IMO

[http://www.nedra.com](http://www.nedra.com)

Pikes Peak hillclimb [https://youtu.be/nMjsAMlXGBI](https://youtu.be/nMjsAMlXGBI)

</comment><comment><USER9> I'm interested in engineering for track marshall safety with these cars. Anyone come across any interesting articles? Certainly there were some difficulties with early F1 KERS batteries, must be far more difficult here with the energy required to power a car for an entire race.

Edit: thanks for info below.

<comment><USER10> I can't speak to f1 but in Le Mans and the wec they have had a variety of hybrid systems.

There are indicator lights on the outside of the cars that show the status of the hybrid system. They also have a emergency cutoff switch that is large enough for them to push with a fiberglass pole.

In some cases especially in practice if the car is badly damaged they will send one of the safety and intervention vehicles back to the pits and fetch a crew member from that car with tools to properly safe the hybrid system. I've also seen where the Marshalls will have the driver climb out of the car stand on the side pod and jump clear, then take 4 or 5 bunny hops away from the car.

<comment><USER11> Dumb question, why must a driver hop away from a damaged vehicle?

<comment><USER12> Theoretically, if there was a short to ground, a voltage potential could develop between the two legs if the driver took a step away from the car. By hopping and landing with feet together, both legs will always be at the same potential so no current should run through the legs even if the immediate area around the car is energized.

<comment><USER13> It looks absurd, but it's standard advice if a backhoe or crane hits a power line.

[https://youtu.be/Xvlk_73bSvc?t=2m31s](https://youtu.be/Xvlk_73bSvc?t=2m31s)

<comment><USER14> And why you should keep your feet together when there is a thunderstorm. An impact _near_ you can still kill you if your feet are apart.

</comment></comment></comment></comment></comment></comment><comment><USER15> Warning: Autoplaying ad with audio. (At least on my end.)

<comment><USER10> On my end at least it was a plug for something about the 24 hours of Le Mans which is far more interesting than formula e

<comment><USER16> Hopefully one day we can see a 24-Hours with all electric vehicles and no recharges. Theoretically possible today with nuclear power, but you know, not that.

</comment></comment></comment><comment><USER17> Do I read this right that FIA provides the card for every team? Why does this not work like F1 where every team brings their own car?

<comment><USER18> It's a standard chassis yes, but the powertrain is made by the teams. It's to force the manufacturers to concentrate their developments on the EV powertrain (cooling, inverter, motor etc) instead of aerodynamics and suspension.

The battery is also a spec part to force powertrain efficiency rather than cramming in more batteries, plus battery technology is expensive.

</comment></comment><comment><USER19> Are these super batteries also rechargable and have good longevity?

<comment><USER20> Almost nothing in autosport has good longevity.

</comment></comment><comment><USER21> So now Formula E has enough juice to last a full race with no car swap in the middle. There are also efforts to bring Formula E to city centres - and the people - but will anyone be watching?

I would like to see this electric car racing take a different direction - imagine if you could press a button on the dash and have your car emulate any of many open wheel single seater cars of the past.

Just getting started?

Try the 'Formula Challenge Japan' mode or maybe give an F2 car from the 1970's a spin.

If you get really brave then you could put it into one of those Red Bull F1 car modes.

You could have all the characteristics of each car ported over from a simulator/game but be out on the track.

As well as this open seater 'Formula E' with a difference there could also be a normal car with things like a roof and passenger seating, this could be electric and simulate any number of cars. Porsche GT3 RS?

Fine. There could be a fake manual gearbox, fake RPM redline and all of that exhaust noise nonsense also simulated.

Or maybe you would like to see what it is like to go round the track in a retro Ferrari 275 with a big V12 singing away.

Perhaps the next lap could be tried in Testarossa mode, with the Miami Vice Classic car simulated.

Or maybe you wondered what those Group B rally cars were really like, so you could just go into 'Lancia Delta Integrale mode' and not have the 'benefit' of a tank full of gasoline underneath one's seat.

Perhaps petrol could be faked too, a smell created that does not have the polycyclic aromatic hydrocarbons but gives the 'garage' impression.

As well as being greener, such simulator-cars would also be easier and cheaper to maintain than a fleet of ICE race cars. This would make track day racing more fun and accessible.

<comment><USER22> So you want an electric race car to feel like some other car? This really isn't possible at all. No matter what you do, a Testa won't handle like a Miata because you can't change weight on the fly. Really all that you could do is reduce the power of the car on the fly which doesn't give the same experience.

<comment><USER21> Yeah, you just put bricks in the bonnet or boot. Easy.

<comment><USER23> The miata is one of the lightest cars in the market. You cant add bricks to a Tesla and make it lighter.

And you can't change wheel base, weight distribution, ect, nilly willy.

<comment><USER24> He thinks "Miata = 50/50 balance" as if wheel size, suspension geometry, overall weight, are irrelevant.</comment></comment></comment></comment></comment>


The End of Power - <AUTHOR> http://reason.com/archives/2013/04/14/the-end-of-power <comment><USER2> When a small fraction of one percent controls well over 2/3 of the world's assets - explain how the "current power brokers/structure" is ending.

This article is nothing but pie in the sky fantasy.

<comment><USER3> Who cares who controls the majority of the world's assets when global standards of living are increasing, apparently quite drastically? It seems like living in the developed world puts you in a bubble relative to the world that is similar to the culture on Wall Street. It doesn't matter that everyone (still there after the recession) is stil getting paid an order or two of magnitude more than 99.5% of the country, many traders are still ridiculously competitive and hung up on the fact that there are people up the ladder making more than them while entirely taking their good fortune for granted.

The world is getting better for everyone and the point of the article is that the luxuries that come with increased wealth (internet, mobiles, greater political awareness, travel) make old power structures harder and harder to maintain, in almost every facet of society.

It's easy to get lost in the massive problems and doom and gloom facing everyone but if you step back and look at the forest, it's not all that gloomy.

<comment><USER4> Revolutions occur not during, but _after_ times of intense hardship. When the general population has enough time and resources to inform themselves of perceived imbalances in the power structure, and isn't expending all their efforts on survival, they have the opportunity to become politically active.

This is why smart dictators keep their populations in constant poverty and either war, or war-readiness.

</comment></comment></comment><comment><USER5> I think the author is correctly pointing out that the nature of power bases are shifting, but otherwise I think this article is mostly a bunch of wild stabs in the dark.

That said, these sorts of articles do resonate with an idea that's been growing in my head the past few years, that the dominant base & form of power is changing as technology has progressed, and the old power base is ramping up its efforts to fight this trend.

In that vein, a philosophy book that really hit home for me on the nature of power in today's IP-connected world was __Protocol__ - How Control Exists after Decentralization, by Alexander Galloway. Now, this sort of read may not be everyone's thing, and as with most philosophy books in the French tradition (think Deleuze & Guattari) , it often tries too hard.... but it's a provocative way of looking at how Internet protocol architecture and its resulting conflict patterns are starting to bleed into real world politics -- e.g. the control that others have over you by remaining connected vs. the power of being disconnected; "exploits" as the new dominant form of resistance against the power of protocols to control, etc. I'm not doing it justice here, but may be a good read if you're at all interested in postmodern philosophy (other than to laugh at, or justify the first two Matrix movies... which admittedly, is mostly what the discipline is good for).

</comment><comment><USER6> I disagree with the core premise. There's nothing fundamentally new about what's going on. Authority is not being undermined more than it was in the past. Technology may be speeding up the process, and enabling easier communication however.

The Christians effectively toppled (or consumed from within) the Roman empire, starting from an exceptionally small base.

Starting from a small group in each country, Communists took over Russia and China - the world's largest countries by land mass and population - and they did it exceptionally quickly considering.

Other examples: Simon Bolivar, Fidel Castro, the Founding Fathers, Khmer Rouge, Saddam Hussein, 1979 Iranian revolution, the Taliban. And those are just a few examples from the last couple hundred years. History is littered with a gazillion more, small and large, of varying ideologies. None of which needed smart phones or the Internet.

These types of things have always happened throughout history.

<comment><USER7> Good point. In fact, I would go further and say that there is a new mega power emerging to which all of these new and emerging "micropowers" are subjugated.

All of the "progress" we see in developing nations joins them to the global economy as both consumers and sources of cheap labor. Increasingly, the spoils of this globalization are accruing to a smaller and smaller subset of corporations and ultra-wealthy individuals.

When you look around at recent so-called disruption that potestors and modern "revolutionaries" enact, you realize that none have succeeded in displacing powers that are aligned with the global capitalist agenda. Indeed, those that do succeed have all served the interests of that agenda.

<comment><USER8> Agreed.

The libertarian fantasy that once we sufficiently undermine governments they will fall and a utopia of individual action free of tyranny will reign is just that - a fantasy. Governments are being weakened by the forces of corporate globalization and the winners aren't the masses. They're a tiny band of corporations and a small wealth elite that controls access to resources via control of those corporations. While overly oppressive government can indeed by a terrible problem, it is often overlooked that an elected government is the only means by which the masses can effectively contain the voracious appetites of giant corporations (which will often act in ways that aren't even in their own long term interests, destroying much of the economy on which they feed).

Free markets when well regulated by a government accountable to the people represent a happy medium, which served us well for an extended period in the 20th century. We seem to have lost that. Instead we're left with crony capitalism and government which acts on behalf of the highest bidder. The worst of both worlds. It is a lot harder to overthrow our corporate overlords in this world of weak governance than to overthrow an oppressive ideological political regime.

<comment><USER9> Well noted.

In addition to the "The libertarian fantasy that once we sufficiently undermine governments they will fall and a utopia of individual action free of tyranny", all processes that uphold all forms of government around the world are merely an illusion that reinforces the status quo globally.

But then again, things can change whether we want them to or not ;)

</comment></comment></comment></comment><comment><USER10> I find it interesting that many of the claims to progress cite percentage deltas, but presumably those statistics don't factor in population growth. Could it be, for instance, that just as many people are in extreme poverty as in the 70's, but that there are simply more well-off people now?

<comment><USER3> Going from six to seven billion people is a 16% growth whereas a lot of the statistics show much larger changes so even before factoring population the figures are probably still significant. There are nuances such as the exponential effects of the internet and mobile phones (a mobile phone or internet connection can have a massive impact on a remote community) and other unknown factors. If you dive into the academic literature I'm sure you can find some analysis of the figures.

I believe the extreme poverty goal used absolute numbers. Percentiles wouldn't make sense to begin with because extreme poverty is largely inherited and as you said could be dwarfed by population growth.

<comment><USER11> Is a person in "extreme poverty" with a cell phone?

<comment><USER3> Extreme poverty means living on less than $1.25 a day (not sure if it's per family or per person), not what technology you own. I'm sure that there is overlap and that is a testament to how pervasive technology has become. I'm sure mobile phones are playing a big role in raising people out of extreme poverty too.

</comment></comment></comment></comment><comment><USER12> I agree with the three "revolutions" described in the article. I really believe they are happening and actually believe we can expect them to continue happening.

Its just that the numbers are to good to be believed. I may be biased tho.

Anyway, I sure hope the article is 100% correct.

<comment><USER3> It's definitely way more nuanced than the author suggests. By developed world standards, poverty is not much better than extreme poverty (but fed is better than not), many of the stats regarding international commerce and investment came with unforseen social and political consequences, and much of the social progress in the middle east has resulted in the unaffected countries to become more paranoid and governments that are different, but not necessarily much better.

But this is an upward trend going for three decades now, let's hope it continues.</comment></comment>


Mathematics and the Imagination - <AUTHOR> https://en.wikipedia.org/wiki/Mathematics_and_the_Imagination <comment><AUTHOR> Here's a link to the book in PDF and plain text [https://archive.org/details/MathematicsAndTheImagination](https://archive.org/details/MathematicsAndTheImagination)</comment>


Why I built another Personal Finance App - <AUTHOR> https://medium.com/titmice/why-i-built-another-personal-finance-application-cd65de5904a5#.jr6mf4gi3 <comment><USER2> Choosing to go with a daily model is definitely a new spin on personal finance apps. I'm intrigued to see where this goes.</comment>


A New View for NYTimes Photos - <AUTHOR> http://open.blogs.nytimes.com/2015/03/27/a-new-view-for-nytimes-photos/

<comment><AUTHOR> Source: [https://github.com/NYTimes/NYTPhotoViewer](https://github.com/NYTimes/NYTPhotoViewer)</comment>


Fold - <AUTHOR> https://nextjournal.com/zampino/fold <comment><USER2> It's better to add the subtlitle to the submission: " _Fold: An explanation of the Composability of the Clojure Transducers_ "</comment>


CIA Coding Conventions for Python - <AUTHOR> https://wikileaks.org/ciav7p1/cms/page_26607631.html <comment><USER2> Looks to be 1:1 lifted from the Google style-guide

[https://google.github.io/styleguide/pyguide.html](https://google.github.io/styleguide/pyguide.html)

<comment><USER3> Not quite 1:1. Google's very first language rule, "Run pylint..." is missing. Interesting that a tool set for hacking does not focus on basic code review tools.

</comment></comment><comment><USER4> This is their git tips & tricks [https://wikileaks.org/ciav7p1/cms/page_1179773.html](https://wikileaks.org/ciav7p1/cms/page_1179773.html)

<comment><USER5> It's embarrassing to see that the CIA's Self-Signed Cert trick advocates "http.sslVerify false".</comment></comment>


Why are Slashdot's comments often impressive but Reddit's rarely so? - <AUTHOR>

<comment><USER2> I have exactly the opposite impression. Reddit's commenting highs are the highest on the Internet (higher by far than HN) and their lows are comparable to Slashdot.

(I'm here because the volatility on Reddit is too much for me).

</comment><comment><USER3> Slashdot is focused on a particular audience, unlike Reddit, thus suggesting that comments may be more targeted and useful than the typical "OP is a fag" idiocy.

On the other hand, checkout [http://www.reddit.com/r/depthhub](http://www.reddit.com/r/depthhub). That subreddit flags many of the deepest, most insightful comments on reddit and is a fascinating trove of information about all sorts of interesting subjects.

For example, here's a brilliant comment that compares and contracts Aldous Huxley's "Brave New World" and George Orwell's "1984" (both excellent books, I might add): [http://www.reddit.com/r/books/comments/1hhrpk/huxley_vs_orwe...](http://www.reddit.com/r/books/comments/1hhrpk/huxley_vs_orwell_in_100_words/caugn0o)

In a sense, Reddit can tend towards a Brave New World style of information by drowning us in so much information, much of which is false or inane, that we can lose sight of what's important, but as a source of entertainment, it's often terrific.

</comment><comment><USER4> I'm suprised the comments so far accept the premise. I've not read Slashdot regularly for a while, but when I pop in occasionally it stills seems the same mix of informed, humane, sanity and crazy, ill-informed, poorly directed rage that it's always been, i.e. mostly tilted towards the latter, even after filtering.

<comment><USER5> It depends on the subject imo. The comments on political articles are rarely good. But the comments on technical subjects can often be good. Compared to HN, Slashdotters are curmudgeonly about startups and consumer/web technology. But there are (I think) a larger number of commenters who come from an engineering background, not necessarily computer/software engineering. So for example, when Slashdot posts articles on nuclear power, or aircraft, or chemical engineering, the comments section will often have at least a handful of very good comments from people in the field.

<comment> B-Con I have the same impression. The commenters tend to be techncially-savy, but really bizarre on pretty much everything else.

</comment></comment></comment><comment><AUTHOR> Nobody here seemed to address the issue that I thought was the one most pertinent to HN.

The 'comment management system' in Slashdot makes the best comments 'bubble up to the top' because they obtain higher 'scores'.

Why is Reddit's 'comment management system' so much more primitive than Slashdot's?

</comment><comment><USER6> It is very simple: Reddit is a more general audience website, slashdot isn't. You should check out some of the better subreddits like /r/depthhub and /r/TrueReddit for better content and comments.

</comment><comment><USER7> Imagine the average person. Got that image in your head? If so, good. Now, by definition just under 50% of people are dumber that person or worse in some other vector such as civility in conversations.

Reddit is more inclusive of society than slashdot and is more likely to represent everyone along the bell curve.

</comment><comment><USER8> The topics at Slashdot attract smart, well-spoken people.

Lately, I've been hanging out on /. for that very reason. The topics and discussions are higher quality than HN IMO and the site is more configurable for the user.

<comment><USER9> huh. is that true? i should go back there. thanks.</comment></comment>


Shutting Down My Site - <AUTHOR> http://patdryburgh.com/blog/shutting-down-my-porno-site/

<comment><USER2> It always makes me a bit sad when any site is taken offline. I haven't even heard of Simple Desks before, but it still makes me sad that it is gone.

Destroying bits is so darn easy, that people do it too much. I don't delete emails (my spamfilter might delete, I don't). Once in a while it's nice to see what you were up to 5 years ago.

My personal homepage is still running. I haven't updated it in many many years, but it still there. Occasionally my friends and I check some photos from there that I posted almost 10 years ago. And I regret that I have deleted all previous version of my homepage.

And it was a sad day when GeoCities was taken offline.

Sure, if keeping your site up and running (even in read-only) costs too much, it's ok to shut it down. But please, try to save as much of the current Internet as you can so our children can see its history.

<comment><USER3> This reply got me thinking: does the nearly-zero incremental cost of a bit cause people to be more likely to turn into virtual hoarders? Anybody who didn't through physical mail away ever would be looked at funny, but I rarely delete an email, either.

Is there a psychological cost associated with virtual hoarding like there is with physical? Or is it truly not hoarding?

<comment><USER4> Coming from the opposite side, I wonder if there's an "anti-hoarding" disorder; feeling that most things (physical or virtual) in one's possession is a liability, a weight that would be better off discarded unless they are absolutely necessary. Almost everything I own adds to my psychological debt and I feel a weight being lifted off my shoulders whenever I can get rid of stuff, documents, files, emails or anything else attached to me.

<comment><USER5> I am like this. I am constantly looking to get rid of as much as I can and that includes digital things too.

I just moved a few months ago and everything I own fit in the back of a 87' Volvo wagon. And that includes my bed.

</comment></comment></comment></comment><comment><USER6> So you shut down a tumblr hosted site that didn't cost you anything to run except for time - and now all of us who had never heard of it before can't even see the content that used to exist. I'm glad you are doing something better with your time that you will find more fulfilling - but I think it's a shame you went this route.

<comment><USER7> Here is what you missed:

          __
         |  |

No, seriously... I enjoyed looking at those photos once, it was just like an architecture magazine. No big deal to shut it off, just don't consider it your life's work.

<comment><USER8> wayback machine has some samples from 2010. As swah says a bit like Blueprint magazine circa 1985. I liked the older desks that had some marks on them, had been _worked_ on. Does anyone _not_ use a Mac?

<comment><USER9> """Does anyone not use a Mac?"""

There's this guy in New Zealand.

</comment></comment></comment></comment><comment><USER10> You shut it down because nobody should give a fuck about it, yet you tell us what computer you used to develop your website? I don't get it!

Also, don't you feel a bit selfish for removing something that other people obvious find value in from the Internet?

<comment><USER11> Yeah this just feels like selfish ego-stroking bullshit.

</comment></comment><comment><USER12> apparent update:

"Back, and better than ever January 20th, 2012. Many thanks to Pat Dryburgh for his excellent work over the years. Unfortunately, he has chosen to end this venture. We think that is a great shame, and we've decided to bring it back, but in a different form. When we relaunch on January 20th, Simple Desks will return with a more substantial aim: to provide food for thought on the subjects of productivity, minimalism and design and technology (along with some occasionally unrelated musings). We hope you'll join us. In the mean time, we suggest you read Pat's excellent blog post (patdryburgh.com) on his decision. We hope to avoid some of the issues he raises with the new incarnation of Simple Desks."

<http://simpledesks.tumblr.com/>

<comment><USER13> and it will suck.

The idea of forcing change to revive something dead sucks, _organic_ change (or evolution as one might call) it is great but taking a tried and tested idea that had popularity and changing it forcefully never works.

Why don't they stick with what it was? :|

<comment><USER14> If we're taking the organic model, what it was died. It clearly wasn't profitable/rewarding enough for the old owner, perhaps if you don't change it that will be true for the new owner.

</comment></comment></comment><comment><USER15> I can relate to this so well. I've mentioned previously on this site that frankly I find much of the beauty and inspiration you can find on the web completely empty and meaningless. Technologists love to talk about the social impact the web is having and how it's going to change the world for the better (things which are undoubtedly true), but so much of it is so superficial that I can't help but think about what we're losing at the same time.

</comment><comment><USER16> So I appreciate that it's your site and you have the right to do whatever you want with it, but isn't it a tad arrogant to judge what other people may or may not get out of it? To call it "porno" is to make a big assumption of what people are using your site for. And even if most people _are_ just gawking at pretty pictures, isn't it a bit much for only _you_ to decide whether it's a net positive or negative on the world?

It reminds me of the whole "_why" thing. It's totally your right to stop hosting content, but it's also a bit rude.

</comment><comment><USER17> You can still see all the work via google images: [https://www.google.com/search?hl=en&safe=off&q=simpl...](https://www.google.com/search?hl=en&safe=off&q=simple+desks+on+tumblr&gs_sm=e&gs_upl=16979l20448l1l20522l13l9l2l2l2l0l182l985l2.6l11l0&bav=on.2,or.r_gc.r_pw.r_cp.,cf.osb&biw=1520&bih=683&um=1&ie=UTF-8&tbm=isch&source=og&sa=N&tab=wi&ei=_7YAT-e2JMqQiAL1h4WkDg)

</comment><comment><USER18> I'm glad you found something more fulfilling to do with your time, but that doesn't mean the Simple Desks idea was trivial, or on par with a porn site. I'm certain that many people can appreciate the ideal workspace setups of others, and yet it's not like something we would be fapping to. Honestly, I'm sad I didn't get a chance to really see the site before it got taken down.

</comment><comment><USER19> Link to the original site: <http://simpledesks.tumblr.com/>

It looks like someone has taken over. I'm glad, because it's a shame to shut something down that people enjoy, but you shouldn't feel _forced_ to work on a side project.

I wish you luck, and here's to hoping your future endeavors bring a bit more satisfaction.

</comment><comment><USER20> Well since it paid, why not sell it, or give it to someone who will run it. I check Freshome almost daily. You can say looking at other people's home is pointless specially expensive ones because most readers will never live in such a house. However some people may just find it joyful. Just check your logs and see the ten most frequent visitors, ask a couple of them to run it.

<comment><AUTHOR> This was an option I considered and discussed with a friend who is well known in the minimalism/productivity space.

To me, it's actually more of a moral issue: is keeping a site like Simple Desks online good, bad, or neutral to the world. I'm sure it's different for different people, but I just couldn't shake the feeling that in the end it was detrimental to people's time.

We have better things to do with our time, and much more beautiful works of art to get enjoyment from.

<comment><USER21> Of course you are welcome to do whatever you want. I find taking it to the moral extreme strange though.

That leaves you little in the way of daily activities besides pure charitable work. Does your short film make the world a better place? I doubt it.

It sounds like it comes down to what you enjoy, and that's great. The best motivation. Simple Desks though seems like the kind of site that some might get great joy out of.

<comment><AUTHOR> Hey Arnold,

Tried replying to you through email, but the email bounced back. Used the email on your Hacker News profile.

Cheers, Pat

<comment><USER21> odd. might have hit up against a spam filter. I added an alternate email to my profile if you want to try again.

</comment></comment></comment></comment></comment><comment><AUTHOR> Sorry, the title was censored.

<comment><USER22> That blog post really resonated with me. Thanks for writing it.

</comment></comment><comment><USER23> Oh well, I guess there's always <http://www.deskography.org/> for everyone else's desk-porn fix.

</comment><comment><USER24> What Do you mean here? "I kept it up because, baby, it paid."

You just put Google Adsense ads on the Tumblr page?

<comment><AUTHOR> No, the site was a member of Fusion Ads starting in January 2011. Before that, a company that made hardware for managing desk clutter sponsored the blog.

</comment></comment><comment><USER25> Too bad. I liked the Simpledesks site.

</comment><comment><USER26> Well, I have no idea who you are and what pages you are shutting down. Of course I wish you the best for your future. That being said:

"The real question is, who gives a fuck?"

<comment><USER27> I belong to a Facebook group for mountain biking in Ontario. People will propose rides on there, and of course the other folks who want to join in will use the comments to indicate that they're coming, discuss the timing, carpool, and so on.

And then there are always a few folks who chime in with "Sorry, can't make it" and "Sorry, not interested."

What we've discovered is that such messages do absolutely nothing to help the group with anything. Unless someone has already said they are interested, we discourage saying you're not interested. It simply adds noise to an otherwise productive discussion.

That's my anecdote in response to what appears to be a declaration that you are not interested in this post.

<comment><USER28> Going a bit off-topic, this happens on Facebook because when you decline an event it shows a text box asking to "say why you can't go". If Facebook would remove that textbox from the dialog, this would likely happen much less frequently.

</comment></comment></comment><comment><USER29> How much did it pay? If I may ask.

</comment><comment><USER30> why does this post exist?</comment>


Mistakes and Discoveries While Cultivating Ownership - <AUTHOR> https://www.youtube.com/watch?v=ddOGmao_cnA <comment><AUTHOR> transcript: [https://www.infoq.com/presentations/netflix-five-level- owner...](https://www.infoq.com/presentations/netflix-five-level-ownership/)</comment>


So you raised $15k or so from YC. What happened next? - <AUTHOR>

How did you get to Series A ? What significant milestones did you hit ? What did the timeline from YC to  Series A look like ? <comment><USER2> Here's what we did:

0) get some cash from yc 1) work on our product (6 months) 2) raise an angel round of several hundred k based on demos pre launch (4 months from start to finish) 3) launch our initial product 4) get buzz in media 5) 3 months after launch, raise series A

Based on the amounts new yc alums are raising now even pre-demo day, I think it's getting easier to compress the time between steps 0 and 5.

<comment><AUTHOR> Thanks. The follow up question is , how much traction did you get to close Angel round. How much did you have to ramp up to get to Series A.

About me : I am trying to figure out the scope and product-market fit for my idea and trying to decide how much money I need to save up and how much functionality needs to be ready before taking the plunge.

</comment></comment><comment><USER3> Trust the man in the pink shirt: <http://www.youtube.com/watch?v=m43t44WL8-w></comment>


Deconstructing: The Battle Music of Pokemon Red and Blue - <AUTHOR> http://jasonyu.me/pokemon-battle/ <comment><AUTHOR> Another discussion: [https://www.reddit.com/r/musictheory/comments/8sc2xg/i_wrote...](https://www.reddit.com/r/musictheory/comments/8sc2xg/i_wrote_an_analysis_of_the_4_battle_themes_from/)</comment>


Discuss my Idea: How about a more generic version of posterous? - <AUTHOR>

I've been thinking about this idea over the past few days. I've even already written code for it and have a functional prototype. But, everyone I tell the idea to doesn't seem to grasp the concept or just can't see why it would be useful. I was even told that I "could achieve more" by looking for new ideas, lol.
My idea is simple and came to me in a simple manner. The idea is this - a hosted database service (a la MongoHQ) with an easy and highly accessible CRUD interface via SMTP (a la Posterous).
The idea came to me while thinking about writing my own SMTP-based blog, like Posterous. I wanted to write my own blog that I was able to write to using any email client I had, instead of using some annoying WYSIWYG editor. I'd just use Markdown for formatting. But then a friend suggested, "why not generalize it for more than just blogs"? I'm not sure to what extent he meant, but I immediately envisioned something similar to Posterous but much much more generalized. Basically, a database that anyone could perform CRUD on using their email client.
Why email? Everyone has it. It's easily accessible. It doesn't take much explanation. There are email client implementations in pretty much every environment you can think of.
It obviously wouldn't be for heavy read/write traffic database applications, but more for casual users that don't fully understand the internal workings of how to use their own database. It could perhaps be used by myself to write my own Posterous-esque blogging platform. It could be used for email storage and backup. It could be use for file sharing, backing up files with associated meta data. A simple API could provide non-SMTP read access to your data - perhaps REST.
I feel like this idea excites me because of two reasons, A) it has a clear cut hosting-based business plan and B) I don't even know if I fully know how this is entirely useful or what the applications of it could be. I haven't gotten very good feedback on it, though. So, to exercise some of what I've read about lean startups and just throwing your ideas out there, I figure I'll see what you guys think about this?
Here is what I have running for it so far. It's just something I wrote in a single afternoon as kind of a proof of concept for myself. I wrote a simple SMTP server that does nothing but handling incoming emails and performs some simple, crude authentication on them. Authentication is done by signing up on the site, downloading the provided "db.auth" file. To submit data to the database, address an email to "firstname.lastname@example.com" and attach the "db.auth" file. The records will appear on the website. There is no other functionality in this demo.
http://collabreate.co:8080/records/
You have to include the /records/ otherwise it won't load anything. It's port 8080 because it's running on my home fios connection. The domain is just something I use to play with - it's not related to this particular idea.
So, what do you all think? :P <comment><USER2> I really like the idea of using email for, well, everything. And I prefer blogging by email (like posterous) and implemented it myself for App Engine (<https://gist.github.com/462907>).

As for this generic crud service. I think the problem is, just as you don't know how it could be useful, neither do others. A hosted db would be useful through an API, but communicating with email programmatically is probably a larger overhead compared to a standard GET or POST request.

<comment><AUTHOR> I can't put my finger on it, but for some reason I just can't stop brainstorming about this concept. I think it'd need to be marketed as a lower level service than Posterous. It wouldn't create a nice web page for you, it would just store the data and let you do whatever you want with it.

I guess you're right though. If somebody was going to code something and use a database, they'd probably just go with something a little more direct.

Edit: Also, in regards to overhead of GET versus an SMTP message. I think the payload for SMTP might be about the same or maybe even less than GET in size.

</comment></comment><comment><AUTHOR> Clickable: <http://collabreate.co:8080/records/>

Also, it's probably pretty easy to blow up right now. It should just ignore any other file attachments. If it's not working then it probably got blown up. I'll restart it when I notice. Also, you can technically send an email to <anything>@collabreate.co. :P</comment>


The Real Secret to Asian American Success Wasn't Education - <AUTHOR> https://www.washingtonpost.com/news/wonk/wp/2016/11/19/the-real-secret-to-asian-american-success-was-not-education/ <comment><USER2> This is some really dubious logic and it's terrible that this should be considered valid research.

To exclude the fact that some groups work harder, have completely different attitudes towards self preservation, who might have skills passed down from generation to generation, who might actually be more intelligent (contentious, I know, but it could be true).

It's ridiculous.

I grew up with a lot of Asian kids, and enough Black kids, and they were definitely different ethnic groups, in so many ways. It's crazy to think that 'only societies attitudes towards them' made the difference.

<comment><USER3> I really hate these comments which imply that black (african) people are intellectually inferior. If so, how do you explain the fact that African immigrants and their children have consistently been the most successful group in terms of educational and income achievement?

Just do a little research before insinuating that africans/blacks are less intelligent. Data says otherwise.

[0] [http://www.universityworldnews.com/article.php?story=2014101...](http://www.universityworldnews.com/article.php?story=2014101521150498) [1] [http://atlantablackstar.com/2012/10/06/obama-education- initi...](http://atlantablackstar.com/2012/10/06/obama-education-initiative- sparks-debate-on-black-immigrants-and-achievement/) [2] [http://articles.chicagotribune.com/2007-03-18/news/070318034...](http://articles.chicagotribune.com/2007-03-18/news/0703180344_1_black- immigrants-high-achieving-immigrants-biracial-couples)

<comment><USER3> Here is an even more extensive study on the academic achievements of African immigrants and their descendants in the U.S. and U.K. [0]

If anything, the research demonstrates that the Igbo from Nigeria are exceptionally successful - more high achieving than Chinese and Indians:

"Africans speaking Luganda and Krio did better than the Chinese students in 2011. The igbo were even more impressive given their much bigger numbers (and their consistently high performance over the years, gaining a 100 percent pass rate in 2009!). The superior Igbo achievement on GCSEs is not new and has been noted in studies that came before the recent media discovery of African performance. A 2007 report on "case study" model schools in Lambeth also included a rare disclosure of specified Igbo performance (recorded as Ibo in the table below) and it confirms that Igbos have been performing exceptionally well for a long time (5 + A*-C GCSEs); in fact, it is difficult to find a time when they ever performed below British whites."

[0] [http://www.unz.com/article/the-iq-gap-is-no-longer-a- black-a...](http://www.unz.com/article/the-iq-gap-is-no-longer-a-black-and- white-issue/)

<comment><USER2> What you are doing is proving that there is a strong difference in behaviour among ethnic groups and that racism doesn't really account for (assuming 'Black people' face the same degree of racism wherever they are from).

Your articles say nothing about the possibility of variance in intelligence among different groups.

<comment><USER3> I don't know. I have personally been told by good meaning friends that 'but you are different from African Americans' by other ethnic groups when I was in Engineering grad school.

Also on your point regarding variance in intelligence among ethnic groups, African Americans mainly came from west Africa, and according to the article I linked above, west African immigrants in the US and UK are the highest achievers, so genes don't seem to be the issue.

So, what is left, culture? If so, the culture of the African American people is molded by racism, both personal and institutional racism.

All I am asking of you really is to not lightly dismiss racism as a contributing, if not the main factor in the achievement gap. It would be easy for me to say that if I can go to school and do well, why can't they do it too? But even though I grew up in a poor, war torn African country, fortunately I was never told on a daily basis that I was inferior because I happened to be black. And I am enormously thankful for that.

</comment></comment></comment></comment></comment><comment><USER4> > But the greatest thing that ever happened to them wasn't that they studied > hard, or that they benefited from tiger moms or Confucian values. It's that > other Americans started treating them with a little more respect.

It seems strange to ignore the possibility that one led to the other.

<comment><USER5> Had the same idea while reading this post. It tries to prove that "all myths are rooted in truth", is wrong because asian american succeded, not because they worked better, but because they benefitted from better popularity.

My interpretation is : asian worked harder (as a group) it was noticed and it improved their reputation. Thanks to this, they got better wages.

</comment></comment><comment><USER6> _Instead, his research suggests that society simply became less racist toward Asians._

I think some more interesting questions are why that happened, and why the same didn't happen with blacks.

<comment><USER7> US law.

<comment><USER8> Law itself has very little power without change in social norm. Look into Foucault's modern philosophy of power.

</comment></comment></comment><comment><USER9> There certainly does appear to be a white supremacist fixation on black people. I was thinking the other day how odd it is that "white supremacists" (in America ) seem to spend a majority of their time talking about blacks when Asians are on average performing better in every metric. Life expectancy, earnings, education. I thought white supremacists would see Asian American success as a threat to their ideology (that whites are genetically superior and should be performing better than all races).

I only asked this question once on a YouTube race thread to self proclaimed white supremacists, and the response I got was that Asians don't commit crime or cause trouble so it's alright if they're performing better.

Which makes me believe a more accurate term for most white supremacists (in America at least) would be "anti-black".

<comment><USER10> Interesting response.

Really interesting given that white supremacists also tend to be anti-semitic, and most of the same tropes about Asians also apply to the Jewish community: Focus on education, low rates of crime, etc.

Maybe that's just a factor of how modern white supremacy came to be, though (i.e. Nazis).

</comment></comment><comment><USER11> So was it that

> Journalists were praising Asians for being hard workers who kept their heads > down, cherished education and didn't complain

? Or maybe it was just that

> Asians [were] being hard workers who kept their heads down, cherished > education and didn't complain.

I'll go further than another top-level comment and say that embracing the first sentence unironically is being _intentionally_ obtuse, given that one literally has to write the second sentence to get there.

But it's the unsurprising consequence of a worldview that "hard work never gets anyone anywhere". Note that you don't have to reject the idea of privilege entirely in order to acknowledge that hard work is also a path to success; and this article goes to show that hard work and success is also a path to privilege, not [just] the other way around.

</comment><comment><USER12> The Irish and Italians used to be considered non-white. I wonder if one day society will consider Asians as "white".

<comment><USER13> Disproportionately successful minorities such as East Asian and Indian immigrants are considered functionally white for propaganda purposes, as their success in modern institutions is significant evidence that these institutions are not discriminating based on anything other than ability.

</comment></comment><comment><USER14> I'd like to see a similar look at how and why attitudes changed towards Italian-americans, Irish-americans, and Jews. These groups were all discriminated against and considered undesirable by the majority for a long time, and now are mostly accepted.

I have suggested in jest before that what determines whether or not a minority will gain acceptance in the US is their food. Americans like Asian, Italian, and Jewish food, and Irish drinking culture, so ethnic restaurants from those groups became popular, and acceptance of the people behind the food followed. We like Mexican food, and Hispanics seem on track for mainstream acceptance.

Black food is too similar to general Southern food for the mainstream to see it as a separate cuisine, so acceptance has been harder for blacks.

</comment><comment><USER15> I suspect that the "them and us" mentality of our inner chimp is binary not n-ary so if society is really anti-black our minds cannot easily handle also being anti-"something else". So Asians simply became "honouray white" in order to make room for racism elsewhere.

It's something similar to the waves of immigrants hitting Londons docklands for generations - each wave suffers then moves outwards to the suburbs and the newest wave becomes the focus of ire.

Just a thought - depressingly maybe we always need a "them"

</comment><comment><USER16> It was their family unit.

</comment><comment><USER17> what a load of racist bullshit. So a $8,000 difference in wages in young men is proof that Asians got to where they are today because white people allowed them to?

so other people's respect will put money in my pocket? Damn why did I bother going to college?

</comment><comment><USER18> Whole lot of 'race realism' in this thread even for hacker news.</comment>


Why Nonstop Travel in Personal Pods Has yet to Take Off - <AUTHOR> http://www.npr.org/2015/09/24/440859459/why-nonstop-travel-in-personal-pods-has-yet-to-take-off <comment><AUTHOR> I just wanted to post this since it reminded me of the book "Aramis, or the Love of Technology" ([https://en.wikipedia.org/wiki/Aramis,_or_the_Love_of_Technol...](https://en.wikipedia.org/wiki/Aramis,_or_the_Love_of_Technology)) which I thought was an interesting story of large technology projects, how they take on a life of their own and why they sometimes fail.</comment>


Deadly Japanese earthquake study retracted over false data - <AUTHOR> https://www.nature.com/articles/d41586-019-01466-2 <comment><USER2> Reminds me of this other Nature paper which appeared to have many duplicated figures [0], caught by public review. The paper was later retracted [1]. Academic reviewers have a lot of responsibility and reviewers are often stretched thin. There are lots of open challenges when it comes to academic publishing, especially at top conferences/journals whose reputations add a lot of clout to the works they publish. At the other end of the spectrum, there are a plethora of low-standards conferences that publish what amounts to noise (which this MIT project amusingly calls out [2]).

One positive trend (in computer science, at least) is the increased push for reproducibility and artifact reviews [3] which raises the bar for publications.

[0]: [https://twitter.com/GaetanBurgio/status/1053948520535707648](https://twitter.com/GaetanBurgio/status/1053948520535707648)

[1]: [https://www.nature.com/articles/s41586-019-0967-z](https://www.nature.com/articles/s41586-019-0967-z)

[2]: [https://pdos.csail.mit.edu/archive/scigen/](https://pdos.csail.mit.edu/archive/scigen/)

[3]: [https://www.acm.org/publications/policies/artifact-review- ba...](https://www.acm.org/publications/policies/artifact-review-badging)

</comment><comment><USER3> Headline is ambiguous, but just FYI only the earthquake was deadly, not the study. (And yes studies can be deadly if they promote false/misleading information.)</comment>