Ask HN: What small habit(s) I can do daily to help me get into pentesting? - <AUTHOR> I'm a back end dev looking to make the jump into security with the main focus being pentesting.
My goal is to pass the OSCP by this time next year.
Aside from hitting the lab and go through the course, what small habit(s) can I do daily to help me with the jump?
Long time lurker first time posting so please excuse me for anything I might overlooked. <comment><USER2> If you want to start looking at application layer pentesting I would review the owasp top 10 and then see how you can apply it to your current projects. I'm constantly using this list and other tricks on any sensitive site that my data resides to hone my skills and make sure there isn't any dumb security flaws that will leak my information. The sad thing is that you'll find cracks in the armor of almost any web service that you use.

I think the most basic test you can practice is just changing the URL if you see a number in it. If you change the number should you see the information that is at the new number? Yes reveals a lot about the website and it's security measures and will let you keep poking further.

Last thing I'll say is, as you practice and learn do not be malicious, even if you could delete an entire set of data because of bad permissions, don't do it. Most, like 90% of companies are relatively appreciative of being told about an exploit. There are some that are not however :(

Practice makes perfect, if you can get marginally better at security them you will write better code and better applications so go for it!

</comment><comment><USER3> segment what you want to learn, then make a good plan. If you do that, then you can spend little amounts of time to go far.

There's some different stages to pentest. (roughly, people have different philosophies / levels of knowlege on this. this is mine...)

\- decide scope (what are you testing? ususally consists of ip ranges, or some software package, or w/e the agreement or target might be) \- enumerate (what is it really you are testing? - enumerate and find all the details about what's inside the scope you decided) \- exploit (if you found something in enumeration phase, try and exploit it) \- post-exploit (if you're on the box. try to escalate priveleges, lateral movement, look for credentials and other juicy stuff - re-using enumeration tools on the new host is common to try and use it as a stepping stone) \- report (write very detailed a report on which you would be able to replicate all of the exposed flaws. a good practice to confirm you know what you did truely.)

These stages have various tools and techniques related to them which you could split by stage and start to learn.

Deciding scope, thats for yourself at the moment, as there's no client demands yet, perhaps in the near future, lets hope for you :).

Enumeration: there's lots of tools to enumerate depending on what you are looking at. So the scope will help you to decide which tools are useful. Tools can include but certainly not limited to: nmap, nc, dirbuster, sqlmap, wpscan, and much much much much more depending on what you're looking at.

exploit: this is a touch cookie, it involves often looking for specific exploits for versions of software and then editing them manually to suit your needs. metasploit is a big help in this within the pentest community, but having learnt basic assembly, C, python etc. is very useful here to be able to modify existing PoC exploits for your own target.

post-exploit: again this is very depending on what you really find, but i would definitely recommend for linux and windows to look at privelege escalation techniques, not relying on tools to do it for you. This is one of the most useful skills i think, as a lot of exploits will land you in a low privelege shell.

report: this is dull as hell as you can imagine, everyone hates it, but in the end it's a test of your knowledge to be able to tell exactly and specifically what, how and why you exploited a certain target, and what it gained you as an adversary. Since you are learning ,i would recommend this step atleast to the point where you regurgitate to yourself on-paper for a friend to read / try what you did. that way you can confirm that you understood what you did, and have some second opinion from a friend who will reproduce your results (or not). very valuable to do, even though it's dull!

To test and try these kinds of things there's tons of 'metasploitable' VMs etc. to learn with. You can set up a few on a lab network (some vms on your laptop!) and try to exploit, then move from one to the other via SSH tunnels etc. And on that topic, learn SSH deeply... learn all about all ways of tunneling and port forwarding it can do. it's magic... but can be confusing as hell when you start out. :)

know this is hardly a concrete tip, but perhaps it will give you some ideas for things YOU are interested in, as being interested will help most of all to learn :)

<comment><AUTHOR> wow thank you for this! Honestly I've always looked at it as a whole and as a result every time I want to dive in it scares and overwhelms me.

I'll try to plan my learning by breaking the process into different stages.</comment></comment>


Stop Giving it Away For Free and Start Creating Brand Value - <AUTHOR> http://www.readwriteweb.com/start/2011/05/stop-giving-it-away-for-free-and-start-creating-brand-value.php

<comment><USER3> Interesting points. As far as I can tell, offering promotions has three possible benefits:

1\. Introducing people to your product that might not have otherwise tried it, or might have forgotten about it. Some of these people may become loyal customers in the future paying full price.

2\. Price discrimination: those with lower price sensitivity won't bother with the coupon and will pay full price, while those with higher price sensitivity will still be your customers. This only makes sense if you are making money even at the reduced price.

3\. Creating a customer perception that they are getting a better value.

None of these things really works if everyone has ultra-easy access to coupons all of the time.

<comment><USER4> Price discrimination is an excellent point. I guess the trick is to enable price discrimination without lowering the value of your brand, so the coupons or whatever would have to be sufficiently annoying to use so not everyone would use them.

</comment></comment><comment><AUTHOR> The article leads me to think that if creative and alternative online/mobile/geo/gamification/social promotions aimed that uses means other than coupons and discounts could be created, that consumer brands would love you (and pay you).

For example, perhaps "happenings" of some sort, tie-ins to grass-roots events. Or perhaps your standard purchase contest but for groups. Or maybe "social loyalty points" (as opposed to individual loyalty programs).

</comment><comment><USER5> Here is a great way to create brand value in the digital world, that generates both financial and non-financial value: give away your mass-produced stuff as free and/or open source and/or libre, and charge for custom work or advanced support or vanity branding.

This model tends not to work for entertainment products that people, in their heart of hearts, realize they do not really need in their lives. Hmm.

Good for you, and good for the world. Do well by doing good.

</comment><comment><USER6> > If I can get millions of people to pay $5.99 for Kellogg's Corn Flakes > versus $2.99 for generic corn flakes, that's a strong brand.

Is the product actually better? If not, that sounds like a dysfunctional market. Brand seems adjacent to deception. Is that what we want more of?

<comment><USER7> A brand is not deception, it's having people trust what you say. Anyone can say that their software is easy to use, but most people won't believe you. Apple, Google, 37signals, etc have brands that people _trust_ and people believe that their message will match reality. I trust Dropbox to work, but no other sync product has built a brand strong enough that I would even bother looking at them.

Said another way, brands are an ecosystem of response to a company's product and marketing. Despite kajillions of dollars spent on advertising, a lot of Microsoft's brand is BSOD, Vista, Clippy and constant restarts. Despite objective safety numbers and no evidence of failure, people trusted Toyota less, billions of dollars less, when the brake/accelerator "story" was happening last year.

A brand is what people expect to get. The $2.99 corn flakes, even if they are as good as Kellogg's, are dragged down by every other crappy generic cereal a customer has ever eaten.

</comment></comment><comment><USER8> Brand takes a long time and lots of money to build. Think Apple, Coke, or McDonald. Free or discounted products are short term marketing mechanism to build awareness of the products and companies. It is one way to build the brand.

</comment><comment><USER9> Some valid points in here, for sure.

 _Look at Groupon's month-over-month decreasing revenue for evidence._

Is there actual evidence of this? Groupon is private, so how would we know? (Real question, not rhetorical.)

<comment><USER10> I don't think the business idea behind Groupon is growing less popular - <USER2> likely, they're suffering from the effects of so many people copying them. Every local newspaper site I read now has a '50% off deal coupons' feature.

<comment><USER11> On a sidenote, I'm getting exhausted from 'deals.'

LivingSocial, GroupOn, Yelp Deals/Coupons, Facebook Deals, Slickdeals...</comment></comment></comment>


When Employees Use Software That IT Hasn't Approved - <AUTHOR> https://hbr.org/2019/06/when-employees-are-using-software-that-it-hasnt-approved <comment><USER2> I see this a lot in consulting. When a new CIO (or CEO or other C level) arrives, they want to make their mark with a digital transformation intiative. This usually just means that the new C level employee is coming into a medium to large business and would like to add a bullet point to their resume and get that new shiny object everyone is talking about. Tableau, Salesforce, Data lakes, blockchain, ERP, Identity Management and "cloud" projects are often the result. It seems to also stem from the new C level employee having a close relationship with a sales rep/partner/C level employee at the vendor. Left a project a couple years ago that had Hadoop interfaces from every system. The user count of all this data? exactly 0.

One somewhat disturbing trend I've seen at some of the largest corporations- cut/outsource IT support staff to near egregiously low levels to "save money". At the same time kick off 7-9 figure ERP/consulting projects that at best provide fractional value to the organization.

Of course there are counterpoints to this. One of Houston's major pipeline operators pulled off a digital transformation and actually ended up with well designed, highly integrated and easily maintained systems. It took about 5-7 years and had a few reboots, but it eventually landed. That brings me to my final point. These projects often have a timeline that is divorced from reality. Whatever time frame you think a major IT project will take. Double it. twice, then add 50% and you are close. It also seems that C level folks are hesitant to hire boutique/small shops that have industry experience and years of experience in favor of big consulting. Nobody every gets fired for hiring Accenture/Deloitte/PwC. What usually happens in the non trivial niches is that these big shops sleeve the boutiques through them to get things done...

<comment><USER3> We've got a Salesforce implementation going at the nonprofit where I work. While there was some debate about which big CRM we'd buy, the need to consolidate was blindingly obvious.

Why? Because our organization has been quite forward thinking about allowing managers and executives to source the technology they think they to succeed. As this article advocates for, IT was largely consultative rather than dictatorial, and a lot of business units were able to pick what they wanted.

But what this has left us with is dozens of places where customer data was being stored, some of them now past their end of life. No central visibility into customer experience. People getting multiple copies of the same email from different departments using different email platforms. Poor deliverability. Subscriptions on random credit cards that suddenly turn off because the person left and no one knows how to get into the admin account and update the card.

We hired a boutique shop to do the Salesforce implementation; we're not scared of doing that. Unfortunately this time it did not pay off... their performance fell off, to the point that they couldn't even reply to emails on time. As sometimes happens with small firms, they grew too fast and exceeded their ability to operate. We can't wait for them to figure it out... so here we go with a big dog firm. Let's see how that goes.

Maybe I'm lucky in who I work with, but I find the "add a bullet point to the resume" take to be maybe a bit too cynical. Tableau, Salesforce, data lakes, ERP, identity management, and "cloud" infrastructure each seem like useful tools if implemented smartly. (Note that I took out blockchain...)

<comment><USER4> Your problem statement does make it sound like you need a CRM, but I do wonder why is has to be a big CRM with a big consultancy, and why IT aren't delivering it?

Who's going to run the thing afterwards? Will the bigdogs deliver something that you can maintain, or is that generally against their own interests?

Finally, who's gonna secure all this customer data? Are they taking that on as part of their remit? They rarely do.

<comment><USER5> I expect the significant discounts offered to NFPs has some bearing on this decision.

Having been involved in IT management of NFPs, the low price is a significant draw, and the total lack of internal skills is rarely able to counter this.

If you don't have some sort of architecture function, technical risk management, application management, and data management these projects simply won't deliver value.

<comment><USER4> Fair enough. Do they usually complete on the cheap, or do they turn the screws after delivery?

</comment></comment></comment></comment></comment><comment><USER6> This is exactly extremely common. In my company there is this constant battle about the devs having admin rights on their machines. We need admin rights to do our job. We have had dozens of meetings explaining the situation but IT can't come up with a solution so the devs go around security because they have no alternative if they want to finish their work . Same with Dropbox. They block it but we have suppliers who use Dropbox. So the result is that people download confidential files from Dropbox on their home computers or phones and transfer them to their work machines.

In my view security shouldn't be isolated at corporate headquarters but they should be close to the end users so they see what users need to do and help them to balance security with getting things done. They can't just block stuff without providing alternatives or they will either hurt the business or they will be circumvented.

<comment><USER7> I think most of the reasons for admin rights are no longer valid. Its easy to change user environment variables and lots of applications can be installed as a user. Why would you need admin rights?

Dropbox/googledrive is a huge security hole that is definitely blocked at most companies I work at.

<comment><USER6> This is about Windows desktop development. I need admin rights to install sql server, I need them to customize my machine so it's similar to our target environment. I need to change user permissions all the time yo see how things behave under different conditions . There is a ton more I could walk you through and have done multiple times. Comments like yours come repeatedly from people who don't know about the work we do. I have offered them to demonstrate doing our job without admin rights but so far nobody has even tried. They just keep sending the same email about not needing admin rights which has repeatedly been showed to not work.

<comment><USER8> Being punchy about it you've never moved on from thinking you need admin rights on your machine. Chocolatey for Business' self-service installer, SCCM jobs, and a variety of other tools exist to enable you to get _specific_ things that require elevation executed. If you're changing things to test various configurations wouldn't it be handy to have those scripted, get them peer reviewed / linted and you've got yourself the start of a process to get that script executed on demand.

This stuff isn't that hard - but those of us doing it see the mad things that people do when they're given blanket, even time bound, admin access. They're the ones dealing with the support calls when then every SQL Server installation has been done differently with no details of what specifically was done. IaC works.

<comment><USER9> Then I hit another 'no-admin' roadblock, that requires a day or weeks of hostile IT bureaucracy and the IT department has just wasted another +$3000 of employee time. This behavior might drive them to quit, leading to a premature +$30k recruiting and on ramping cost to replace them.

Now iterate that over 1000s of other instances and you see the financial reason why devs need admin.

</comment></comment></comment></comment></comment><comment><USER10> Let's ignore the SaaS security issues for a second. When IT says "No" it's not like the area asking is going to go away and not try to solve their problem. Organizations are going to find ways to solve their issues and IT can either help from the beginning or help clean up the mess later. I try to take the stance of offering the right solution and a lot of the times a now solution at the same time. There is no saying "No" in the long term, either help them now or get stuck with the shadow solution the magic macro guy cobbled together that became a critical business function.

<comment><USER11> I have seen IT being unaware of and unwilling to meet requirements of highly specialized technical teams, such as network engineering. You cannot have a TELNET client because the use of TELNET is prohibited by corporate policy, test TCP connections another way. You don't need vim when you have vi. You can't have admin rights but we don't support drivers for RS232 dongle so nope. Sometimes it's quite a challenge to get some work done.

<comment><USER12> Use netcat.

Telnet is pretty hard to procure since it's not included by default since Windows 7.

<comment><USER13> It ships with Linux...

</comment></comment></comment></comment><comment> drevil-v2 I still shudder thinking about my time working as a developer on corporate IT locked down IBM leased laptops. Every time I did npm install I needed to request admin access to Windows which took 2-3 hours to action by IBM team sitting on the other side of the world in India.

One day a grey beard took pity on me and installed a Linux VM where I was admin, copied the security certs from the Windows host and I could access all corporate resources at my leisure. Never logged a single IT Helpdesk ticket after that.

<comment><USER14> Yup, back then my way around corporate locked down Windows machines was to only get permission to install VMware Workstation or Virtualbox.

Then fullscreen Ubuntu in a VM from then on. Slower but no restrictions. Even better when Workstation supported multiple screens.

<comment><USER15> Honestly on my work machines, though we have root, the difference in FS performance tilts in favour of VMs/containers due to the slow endpoint protection affecting native FS access, and for a lot of tasks we do that outweighs any virtualisation overhead.

</comment></comment></comment><comment><USER16> Our IT security department was incentivized to deny everything from new tools to new internal applications.

We had an outside firm making security decisions and if there were any security issues it would end up being on them. So as long as they did not allow us to release any products and or install any software they could not be held responsible.

I made friends with a lower level contractor who told me off the record to use my judgement on what to install to get the job done, because the security department would never approve anything new unless directly instructed to by the CEO.

Fast forward three months, there was a major security flaw on our website (also built with outsourced labor) which allowed anyone to access private data without a login.

A few of us had reported to the security department that the code running the website was so poorly written that the odds of being insecure were close to 100 percent. We suggested upgrading the website and rewriting the code, and management was on board with this but security department refused to allow us to use any new frameworks since they were not approved. Of course in a matter of a few months the site was hacked and millions were spent as a result.

I quit this job after we were unable to release several products after a year even though we jumped through every hoop we needed to. That department killed all innovation.

<comment><USER17> I think it really depends on the company. If you're something like a nontechnical non-profit, sure, turn that decision making over to IT. In that case IT is performing a vital, skilled function.

But in most software shops, the workers are probably more qualified than the IT department to be making decisions about what applications to use, and what kind of security they need. IT is just there to make things run and fix them when they break. They don't really need to offer guidance.

</comment></comment><comment><USER18> Joining Google was an eye-opener for me on this. Was the first time I encountered an IT department (TechStop) that didn't act like a police force and instead had your back, helping you get where you needed to be. Was always the first thing I would show guests on a tour of the campus.

<comment><USER19> But you're probably a developer?

TechStop is/was great. But Windows users had locked down workstations where IT whitelisted binaries. I assume the approval process sucked about as much as normal.

Many Google employees use desktop Linux which is basically unheard of outside the tech world. That by itself simplifies things quite a bit. Not many people writing viruses posing as screensavers for Google's in house Linux strain. Anyone who cracks that is probably an APT attacker and those require different approaches.

</comment></comment><comment><USER20> Its the user who downloaded a program they "needed" which had malware which sent out a lot of spam email because this was a user that did announcements which basically got an e-mail server listed on blacklists that creates these IT policies.

You want to treat people like responsible adults, but they aren't the ones who have to deal with the fallout. Developers know the score for the most part, so full privileges are expected with the caveat, if it all goes bad, we are wiping the machine[1], not doing a recovery.

IT dreads the moment we are called to account for something some user decided they needed to do.

1) most developers understand backup tools and code control - those that don't, well...... with great power comes great responsibility

<comment><USER21> Yep, a company I worked at hired a tech writer that downloaded some cracked version of software that included ransomware on their first day of work because they said they didn't want to wait for the company to get them a legitimate copy.

<comment><USER22> Well, that used to be common practice... in the '90s.

Thank $deity for the rise of opensource.

<comment><USER20> OpenSource still isn't a force in that particular area. Its Microsoft or Adobe there.

<comment><USER22> Yeah, what I meant is that, these days, the culture is such that one assumes there will be an OSS tool somewhere, before one even considers a sketchy binary. Maybe the OSS option will be inferior, but it's almost guaranteed that it will get some stuff done and not nuke your machine. That's a significant improvement (of course we know that having a github repo is no guarantee and blablabla, but it correlates well enough for most purposes).

</comment></comment></comment></comment></comment><comment><USER23> _" Soon enough the CIO sniffed out the project and called her in to a disciplinary council."_

Somebody has apparently lost touch with who the customer for IT is.

<comment><USER24> To be honest, I find it odd when you treat it as if everyone else that you work with is a customer. I don't believe in this philosophy. The business is my customer. The business is what IT is trying to protect. If you have individuals that are not following policies, they would be disciplined like HR would discipline for not following policies. It's all in place to protect the business and what's best for the business. Sure you'd like admin rights to your own machine, that will help you individually, but will it help the business as a whole if we get hit with cryptowall again?

<comment><USER25> I find most "IT security policies" that hamper developers to be mostly security theatre. No matter how many policies they put in place, since they aren't developers, one junior developer can write:

      var sql = "select * from Customer where firstname = '" + firstname + "'";

And thwart all of your security "best practices."

I was the lead dev at a medium size non tech company, and the hoops I had to go through to get anything done dealing with the "security team" was ridiculous and of course I didn't have access to production to troubleshoot for awhile.

I had ultimate control of all the code that did go through the process. If I were to do something stupid or purposefully malicious, while I didn't have access to the environment - my code did.

As far as someone mistakingly installing a "crypto wall", if a user can download a program that doesn't require admin access, that program has access to the user's files. The system can be restored much easier than the user's data.

<comment><USER26> _I find most "IT security policies" that hamper developers to be mostly security theatre. No matter how many policies they put in place, since they aren't developers, one junior developer can write..._

IT policies at large corporations aren't implemented for developers (only). They're implemented for everybody. For every developer, there is a salesperson, admin, manager, or HRBP who will do things they might not fully understand to be "bad".

I came into the industry in the late-90s and still remember the chaos that the ILOVEYOU and Anna Kournikova style viruses caused in corporate offices. Non- technical users didn't know that Windows hid file extensions by default. They didn't think that opening a picture could start a shitstorm the brought the corporate network to its knees. Fun times.

<comment><USER25> Yes. I remember ILOVEYOU too. It also confirms my point.

\- It spread by reading the person's contact information which doesn't require administrator access.

\- It also corrupted the user's files and didn't require administrator access for that either.

</comment></comment></comment></comment></comment><comment><USER27> Security training focuses way to much on email phishing and not enough on this kind of stuff. Actually getting your work done, managing your own computer. Of course people can't be trusted if they havem't been trained. How to handle USB drives. What and from where you can download and run programs. What actually IS a program and what isn't. Many of us learned this the hard way by playing lots of cracked games in the 90s. But not everyone did that.

Try explaining to a non-technical person how how a desktop background image isn't a program so it's basically safe to grab from anywhere, while a screen saver is _definitely_ a program and usually unsafe to get from most places, and a word document is _some times_ a program that might eat your computer. Training could involve things like "which of these 5 webbpages would you consider it safe to download and run executable from"?

Having too cumbersome rules around security just means it's ignored or circumvented, increasing risks.

<comment><USER28> It's tough, I give security awareness trainings myself and I completely agree with what you're saying. However, that's a lot of information to give to a group of new employees that can span any department and technical understanding.

I actually was talking today with a customer during a logical assessment about if I talked about downloading malware in the training. I dedicate an entire section to downloading documents, but I don't really give people the information you're talking about. I tell them how to avoid ever having to download anything, and if they _must_ do it, how to try and do it properly. All of this is ended with the process on how to report incidents because eventually something bad will happen.

As a company you kind of expect this to be solved at a number of layers. Endpoint management should hopefully help resolve this issue. Restricting web access where it makes sense can help. Sec Awareness Training helps keep people aware. Etc, etc, etc. You hope your controls are what save you from incidents, because there is no way you can effectively train your entire company on security topics to a degree that they can make good, security conscious decisions. That said, many of these SAT's are really just checking compliance requirements, because thats the real need. I put my own training together starting with what I know needs to be covered for compliance (pii handling, passwords, acceptable use policy, common threats, security incident response reporting, etc). Anything else that makes it in is purely because I have extra time and I know it to be important.

<comment><USER27> Concrete example happened just this morning: I needed some documentation that exists on archive.is, but has been taken down from the original site. I navigate to the cached content on archive is, and archive.is is DNS blocked when going through my VPN by Cisco Umbrella because apparently it's an "anonymizer" service.

So I change my DNS settings to use an 18.104.22.168 dns first, and my company dns second. Now I can access both archive.is and sites on the company network. Excellent. But in doing this I circumvented all the DNS filtering, not just for this site. The reasonable thing would have been a warning like a https- style warning "Are you sure you want to continue to this site"? Or a way of whitelisting, perhaps temporarily, a single address. Instead my options were to ask an administrator or disable the whole security feature entirely. (Or connect/disconnect the VPN temporarily every time I needed something blacklisted, but that didn't feel like a good solution).

</comment></comment></comment><comment><USER29> This brings back a memory. The only time I was fired "for cause". Summer after my freshman year at college, I was temping and got an assignment doing real estate purchase comps with a company in the East Bay. At the time, there were laser printers, but often printing sucked up CPU time and let's just say multitasking was still not a widespread thing.

I found myself tired of sitting around. I found a TSR / print spooler that would use RAM and offload the process of printing. This allowed me to keep working. My productivity (as a temp) was higher than many others including the person I was "reporting to" at the company.

They found the print spooler, labeled it "unapproved software", and I was walked out the door.

The funny thing is, a friend at the time (and I didn't realize it) was higher up in the management. He reached out to me on a multi-line BBS that was popular in the area and offered me a full time job a few days later. I was in school and obviously declined.

Working the rest of the summer for a Chemical Engineer in Martinez/Benecia ended up being incredibly more interesting. So it was a net win.

</comment><comment><USER30> This thread hits home. I switched jobs a few years ago because the IT policies on workstations were being ratcheted down to make my job as a developer difficult to impossible.

Now, the company I work for, ostensibly a _software_ company, got its ISO certifications, which meant policies and procedures that make developing hard or impossible again.

How does a software business _successfully_ implement stringent access controls while still allowing for efficient software development? I'd like to see/hear what works.

<comment><USER31> I'm heading down this path right now. How do I obtain my certs while also allowing enough freedom for the dev teams to operate.

We have to deal with the fallout when they screw something up, there has to be a happy medium somewhere.

<comment><USER12> What's the issue specifically?

Developers don't need admin rights for much of anything in this decade. No need to bother with that.

Common software has to be made available in self-service, so developers can install development tools like notepad++ or visual studio.

Deployment is usually the challenge because you have to store binaries somewhere, copy it to some random servers and finally execute it, each step causing numerous security headaches, so there has to be some approved tooling to handle that.

<comment><USER32> You can't get past "docker run" without admin rights. No, the challenge is access to production data without auditing.

</comment></comment></comment></comment><comment><USER33> IT is a service to the rest of the company. If you don't approach it with a servant's heart, people will go find their own solutions without you and you'll be part of the cleanup crew.

</comment><comment><USER34> I just witnessed a very similar situation, on a smaller scale, but there are many of these in my company, and they add up.

Boss: "We need access to the database of our primary application that you wrote for us so that we can pull the data into this new tool to track progress."

IT: "No. Not only can we not give you access to YOUR data in YOUR application that we wrote on YOUR dime, we will not allow you to have this new application written by someone who isn't in our group. If you wanted something like this, why didn't you just ask us? We would have written this for you."

Boss: "We had a meeting about this over a year and a half ago, and you told me that you didn't even have the time to discuss it further."

IT: "... Well, we're still not going to let you do this."

IT is effectively holding the rest of the company hostage, and the corporate technical debt is becoming epic. So skunkworks solutions will continue to be developed.

</comment><comment><USER35> Its the same dilemma companies face with their legal team. The "safest" thing to is nothing at all so sometimes the overabundance of caution hamstrings business growth.

That's what the CEO is there to figure out.

</comment><comment><USER36> The ideal IT team is one that proactively learns the needs of others in the business and works with them to solve problems. It's no wonder that so many companies end up with shadow IT when so many IT teams are just people who tell you "no" whenever you ask for something. Doing it right is harder in the near- term, but much easier in the long-term as you're not putting out so many fires or going to "disciplinary council" meetings.

</comment><comment><USER37> It sounds like the author recommends embracing the Agile philosophy of letting your teams choose their tools, then working with IT/Sec to make sure implementation is sound. I like that philosophy.

<comment><USER38> Great until you have five teams, each having chosen a different tool, and now you're wondering why the IT support costs are out of control.

Still possible to support but requires a different model e.g. one where IT delivers a new, unconfigured workstation to your new team member and it's up to them to build it. If it breaks, their loss of productivity is their problem and not ITs.

Authority for something (e.g. software selection) must go in conjunction for responsibly for consequences arising. Those things must always move in lockstep to avoid perverse outcomes.

<comment><USER39> Our IT does not support development environments. Just network, backups, printing, client certs. Dev tools support is all essentially peer to peer and ad hoc, with escalation to the internal owner of the tool (another engineer) sometimes possible. If you mess up in an unrecoverable way, IT will give you a loaner to work on while they reimage your machine. It works fine.

</comment></comment></comment><comment><USER40> As a born and bread corporate (mostly banks) corporate IT guy, I used to frown upon this behavior. Then I got one of my bigger career breaks because the finance team went behind IT, bought a software and installed it in a machine which kept under their desk. They further hired people from an IT service company to configure the machine.

The configuration was so bad that it exposed the company's network to whole wide world. Google contacted the company and after searching high and low IT security managed to track the pc down and take it away. Finance team promised to hire someone with skillset required to run the software in a closed environment. And that's how I ended up getting my job.

<comment><USER41> Really interesting story, especially if you put it in the context of being corporate world and a finance team, both of which aren't the type to rock the boat.

It says a lot about the struggles of enabling change in structures with strong silos that (what are probably among the most risk averse type of) people would go to such lengths.

</comment></comment><comment><USER42> This is my current situation. Being a SWE, IT and security are always putting out fires with networks or upper echelon cybersecurity violation complaints (mostly people downloading software without authorization). They have very little time, almost none for investigating new software, and all software must be installed by them. End of the day, nothing gets done on our work computers. I once waited two months for them to say no for a piece of solution we as the team approved. It's absolutely frustrating.

</comment><comment><USER43> I've been amused by VMWare being on the strictly-enforced official software list, and the VM being considered data. Nothing in the VM counts as software! It's not even being sneaky. Official policy is that the VM is data.

</comment><comment><USER44> > The CIO admitted that he had been approached and explained that he had > informed the VP that IT already had a project with SAP to deliver what the > VP needed. "Yes, but that won't be ready for me to use for three years, and > I need something today," retorted the VP. The CIO was silent. Then the CEO > asked the VP, "I've known you for ten years. You don't seem like someone who > would do something to harm the company. Why did you do this?" The VP hit > right back: "Since I started this digital customer acquisition program, > we've increased revenue $1M per month. Before we were losing revenue. If you > want, I can shut it down right now. What do you want me to do?"

Maybe not for this particular project, but another interpretation of that is "who cares about security if we're making money" which is a very dangerous argument as well.

<comment><USER45> When a person says "we need this infrastructure project" and a project is commissioned, acknowledging the need, it is in my experience that unfortunately that person's job function is rarely placed on hold until the appropriate infrastructure has been made available.

"Who cares about your pie-in-the-sky infrastructure project, my boss continues to measure our real performance with basic accounting, and is expecting to be able to report on growth each quarter, which I can't help without tools" seems to be a bit closer to the argument posed here, IMHO.

<comment><USER44> Of course that's the real question with the actual story in the actual article -- could they have implemented their security on the temporary infrastructure, or "good-enough" security, if the CIO knew about it?

In that story, is the blame on the VP for going ahead instead of getting dialogue started between CEO, VP and CIO? Is it on the CIO for just saying "no" instead of recognizing the need and the value? Is it on the CEO for failing to empower the VP and CIO to get that conversation started themselves?

And then, it's all well and good to worry about the bottom line first, until you're sitting in Equifax's shoes right.

<comment><USER45> I've been the one in the story who hears "no" enough times myself that I know which side I'm naturally going to fall on. But I've never been the one that did an Equifax, and now has to explain themselves to the board, so there's also that.

I've seen it said well in another comment on this post, I feel like could be said about more than a handful of orgs:

> The problem is, I write up a proposal identifying the risks associated with > the exemption, along with minimum and recommended compensating controls. > This then gets discussed among IT Management, where it is usually decided > it's too much overhead, and to just deny the request or if the user can > scream loud enough, allow it outright and get some director to sign > something. The third oft-used response is ignore the problem and hope the > user finds their own work around so we can get back to the 13 projects we're > somehow expected to complete this quarter.

> ignore the problem and hope the user finds their own work around

> _ignore the problem and hope the user finds their own work around_

If this is even remotely the story of what happened, you can't really be surprised when the user went off and did their own thing. If they came to you with a specific priority business problem and an expectation of your support to solve it with a sense of necessary due urgency, and your answer is returned in the format of a 5 year plan... I don't think you can really act surprised in fairness when they end-around you and solve the problem somehow else, anyway.

If it means standing on a mountain of chairs for them to do so then I guess there'd have to be shared culpability. So how do we make sure that it never looks attractive to build that mountain of chairs?

I wish I knew more about the "digital customer acquisition program." The story makes it sound like this "VP for a declining line of business" honestly was not going to make it another 3.5 years without some help.

I struggle with this myself, when it seems like we could go ahead and solve a problem for like $80/mo, but instead we're going to study the problem and spend $20-40k out of peoples' salaries on coming up with a recommendation for an even more expensive project that can only be justified as necessary in order to avoid this other, cheaper tool we could have used.

There's obviously some mismatch when on one hand there's a major project with a vendor like SAP in the picture, but on the other hand there are basic needs that aren't being met, to the point where someone is going to set up "shadow- IT" on a personal credit card just to keep the basic business of the company moving in the right direction.

</comment></comment></comment></comment><comment><USER46> How many years since _The Phoenix Project_ and this conversation has barely moved an inch?

CIO probably wins this battle and gets the VP fired, but will be mystified when they're reporting to the CFO or a Chief Digital Officer when it happens 3 more times by the end of the year.

<comment><USER47> >How many years since The Phoenix Project and this conversation has barely moved an inch?

People are still fighting the lessons in The Mythical Man Month; it's gonna be a while.

</comment></comment><comment><USER48> Something that's crossed my mind is John Gall's observation that complex systems operate in failure mode 100% of the time. I understand "failure mode" to mean that built-in guards have been bypassed in order to enable the system to do _anything at all_. Germane to this thread, the "guards" are IT approvals.

I suspect that if a business is complex enough to have IT policy, that policy is always being bypassed in some way, at any given time. Somebody is using unofficial software, or using official software in an unofficial way.

</comment><comment><USER49> To me it reads like this - VP didn't care about the consequences of utilizing their solution and didn't care about IT; they simply wanted their stuff done, without acknowedgling prioratization of tasks.

The proper way this could have been resolved is by VP utilizing people's skills they've hired. Does this solution look good and will accomplish the task that was prioritized? Excellent! Pass it to IT to evaluate. If the task has specification - excellent, have somebody in IT look for a product that ticks all the boxes and let's choose it together.

</comment><comment><USER50> Does your IT team use key loggers or other employee monitoring software at your company? I hear some big trillion dollar companies do this. Is that true?

</comment><comment><USER51> I work in an IT organization & I see (in the sense of witness) both sides of this. We are over-tasked and under-resourced and new projects/ideas/initiatives that come in the door go into a backlog of requests. So I see business/end users signing up on their own for SAAS solutions to solve their problems.

<comment><USER52> Right, the CIO is also being held to a lower standard than a P&L. The CIO could have planed out an interim solution to meet the business needs quicker.

If the tables were turned, say the CIO needed to deliver a service and didn't have a big enough budget, then what?

</comment></comment><comment><USER53> > If you don't think this is happening in your organization, think again

That story probably never happened anyway. But the essence of the article is very true. I never have been in a corp where IT enforces 100% conformity anyway (apart from medical industry).

Sure, there are actual successful attacks, but that is mostly not the fault of unsanctioned programs.

But there are systems where people should not just start to use any system, because information gets lost on the way. That would include CRM and ERP in my opinion. That a company can exist without a CRM is questionable to begin with and solutions are plentiful. If they did not have anything like that...

If the story were true, it would not be the fault of Chief Input/Output.

<comment><USER54> I've been in corporate IT where this happened. All company apps were built internally. None were able to run on anything past Windows XP. On top of my regular help desk, asset management, software project, and lease refresh program I was also somehow supposed to make the software work with Windows 7 as they had let the developers go. This is the same company that refused my sane security requirements and ignored just about everything until too late. I hear they have since outsourced IT and networking and it's failing dramatically, but they are saving money right?

</comment></comment><comment><USER55> Well, that cleared that up then! Gosh I had no idea that the solution would be so simple.

It does shock me that the people who've had their whole infrastructure compromised and held to ransom by viruses and the people who've been held over a barrel by suppliers or had vast amounts of money burned by being locked into a dozen vendor contracts for the same service are so silly and hysterical about it when the solution is as simple as "identify when you need to be best in class and stay small everywhere else".

</comment><comment><USER56> Hehe, if you think this is nuts, come to pharma. We can't do jack shit with our machines. If you so much as change the time on your machine, that is a 'data integrity breach', and if your actions are determined to be malicious it can result in a firing.

<comment> GuB-42 To be honest, changing the time on a machine is a very serious concern. Accurate timekeeping is crucial in security, that's how you connect events together.

<comment><USER56> Well, all the rigid policies like no dropbox or no FTP or no whatever, also arise from serious concerns. I just wanted to point out another seemingly innocuous one. Most of our equipment is not internet connected, and we need to manually change the time for daylight savings or other corrections. We have a company policy and procedure to do that periodically so that our audit trails are accurate. Sometimes folks get busy and the shop floor guys take matters into their own hands.

</comment></comment></comment><comment><USER57> I just wish I had a decent computer at work that didn't have 3rd party antivirus that would just slow the software to a crawl.

</comment><comment><USER58> Isn't IT something from the past? I would expect people knowing how to use a computer and what they need to do their job.

<comment><USER59> As a lowly help desk technician perusing this thread, you couldn't be any further from the truth. The software devs never open tickets, everyone else does and its for the most banal problems

<comment><USER60> I've opened plenty of tickets as a developer, mostly the tickets are IT's garbage software or horrible network setups preventing me from doing my work.

</comment></comment></comment><comment><USER61> There's a difference between using software that IT has approved and shipping customer data outside of the company.

</comment><comment><USER62> how about trust your staff.

<comment><USER63> Maybe, "empower your staff as they each prove competence", instead?

</comment></comment><comment><USER64> In our company people just started using free slack en mass, boycotting the horrible IT approved Skype for business. When it was discovered that thousands of employees were using slack, the CTO had to step in and tell IT to fuck off, and started paying for the full version.

</comment><comment><USER65> > The CIO admitted that he had been approached and explained that he had > informed the VP that IT already had a project with SAP to deliver what the > VP needed. "Yes, but that won't be ready for me to use for three years, and > I need something today," retorted the VP. The CIO was silent. Then the CEO > asked the VP, "I've known you for ten years. You don't seem like someone who > would do something to harm the company. Why did you do this?" The VP hit > right back: "Since I started this digital customer acquisition program, > we've increased revenue $1M per month. Before we were losing revenue. If you > want, I can shut it down right now. What do you want me to do?"

Shut it down right now and ask the VP to tender their resignation. Any company doing a 3-year SAP implementation is a very large company. That $1M in additional revenue pales in comparison to the risk introduced by sharing company or personal customer data with a vendor who has not passed the required security auditing. Data is no longer a thing to be thrown around in search of additional revenue and "but I made money" or "I had to because IT is slow" is not a post hoc rationalization for the behavior.

Regardless of the merits of large enterprises acting this way, this is a VP who clearly cannot function within the enhanced risk-controlled environment of one and should find a position with a smaller company where they have more freedom to pursue personal initiatives at the VP-level. Those companies exist. Go find one.

<comment><USER66> >>Any company doing a 3-year SAP implementation is a very large company.

Not at all. I have a client with ~100 employees who are past year 2 of their Salesforce implementation because the director of technology keeps changing priorities and project requirements.

<comment><USER65> That's fair, but just using the time-frames in the article, 6 months had passed before the VP got caught and still had 3 years left on the implementation. I think a director of technology who take 3.5+ years to do a CRM implementation at a 100-person company... isn't doing a very good job. :-)</comment></comment></comment>


Ask HN: How to export GReader Starred items and GBookmarks to Evernote? - <AUTHOR>

This is going to sound like I'm selling Evernote, but I'm not. It's just that Evernote supports data portability more than the competition.
I'm going to be transferring all my Chrome Bookmarks and previous Google Starred items to Evernote.
How?
With these programs:
https://github.com/kerchen/export_gr2evernote
https://github.com/spiermar/bookmarks2evernote
Why?
I have 3 premium months for free so I want everything all in one place so then I can sort, delete, and reorganize these bookmarks.
The problem is none of these github pages come with instructions. I'm running Arch Linux and nothing happens when I type the command x >> x.py.
If you're the author of these pages, don't assume people will magically know how to use these programs!
DAE how to use these?
Can you please tell me how because I really want to get this done. <comment><USER2> On windows, I just do..

python evernote2enex.py -m 10

Not sure if Linux is different, but you might try and leave off the part where you specify the output file?

<comment><AUTHOR> Got this now:

File "export2enex.py", line 45 print str(err) ^ SyntaxError: invalid syntax

Reading: [https://wiki.archlinux.org/index.php/Python#Dealing_with_ver...](https://wiki.archlinux.org/index.php/Python#Dealing_with_version_problem_in_build_scripts)

This obviously is assuming the default python is python 2.The developer forgot to add the extra instructions for Arch Linux...THANKS!

</comment></comment><comment><USER2> Did you get your starred.json file from Google takeout, yet?

<comment><AUTHOR> Thanks for replying. Yes, and I have the html file from GBookmarks, Python 2.6.8 and 3.3.1 too.

</comment></comment><comment><USER2> Using the export2enex.py file?

<comment><AUTHOR> Correct, so that I can upload it in the windows desktop app using wine that's already set up and ready to go. Previously using export2enex, it would create the file but with nothing inside of it.</comment></comment>


Polybit makes mistake. Owns up. - <AUTHOR> Update: I rage posted this as I thought it was widely inappropriate and tone deaf to the community they are counting. As always to sides to every coin and I appreciate the response from Keith.
/Update
Hey Amir,
I noticed that you're a stargazer on the apex/apex repo, which made me think you'd be interested in the serverless space, so I thought I'd reach out.!
I'm Keith Horwood - I'm the lead author of the API framework, Nodal, and I created stdlib, which aims to make building serverless microservices as easy as possible - without ever having to worry about scale.
You can build your own services or integrate with existing ones from our thousands of users. Here's an example of a markdown service we use to generate documentation on our website: http://stdlib.com/services/stdlib/markdown
Here's another one from someone in our community to find the name of a city based in the USA based on GPS coordinates: http://stdlib.com/services/thisdavej/gps
Anyway - I'd really appreciate it if you tried out our Developer Preview for a project of your own: http://stdlib.com/
Or you can check it out on GitHub here: https://github.com/poly/stdlib
I'm confident that you'll find it as the fastest, easiest way to build and manage microservices.
Let me know if you have any questions!
Best, Keith --
Keith Horwood Founder and CEO, Polybit
polybit.com <comment><USER2> Hey. Keith here.

So first of all, I want to apologize. This is a _huge_ mistake on my part, and I take personal responsibility. I have been cold e-mailing people directly literally for months (getting people to test out your project is hard work!) and we've been very lucky to have found super positive community members and feedback.

That is not the case here, however. We've been growing massively since we presented at AWS re:Invent. As a solo founder, I've been torn between hiring / building product / talking to investors and I took a "shortcut" \--- we hired some growth consultants to do some cold outreach for us. There was a mix up, e-mails were sent out with wrong names (etc.) at a larger scale than I'm comfortable with and I was just notified about it as of this post.

I'm really sorry to you and anybody that was affected by this mix up. I'm thankful you brought this to my attention. As per cold outreach, I will focus on owning the process myself as much as I can on the personal scale I'm accustomed to. If you have any suggestions as to how we can improve stdlib to increase exposure _without_ cold outreach, I'm more than happy to listen.

If anybody reading this was affected by this e-mail, feel free to e-mail me directly - keith at polybit dot com. Please remind me in the future and I'm happy to discuss giving you some free platform usage once we're out of Developer Preview.

Thanks again for bringing this up --- and truly sorry for any inconvenience.

</comment><comment><USER3> Is the only thing that was widely inappropriate and tone deaf to the community the fact that it was a email to golang folks about a nodejs project or the fact that it was just spam or something else that I'm not picking up on?

<comment><USER4> I forgive him but this is what I received if you're curious (about 15 emails across 2 accounts within a couple of days):

On Mon, Jul 25, 2016 at 8:19 PM, Keith Horwood <k____@p______.com> wrote: one last attempt... let me know if you'd like those extra credits and if I can help in any way.

thanks again, so much, for joining and I hope you get a lot of mileage out of our software and services!

\- Keith

On 2016-07-23 00:19:59 UTC, Keith Horwood <k____@p______.com> wrote: guess I caught you at a bad time, would love to talk more if you do get the chance! it's just a few questions and it means a lot to us. :)

\- Keith

On 2016-07-20 00:19:59 UTC, Keith Horwood <k____@p______.com> wrote: hey! didn't hear back from you, would still love to know all about you and hook you up with some more credits.

Aside from the free credits, feel free to reach out to me any time --- this is my personal e-mail. :)

Cheers, \- Keith

On 2016-07-17 00:19:59 UTC, Keith Horwood <k____@p______.com> wrote: Hey,

Thanks so much for signing up for Polybit and checking it out, and happy Saturday!

I'm Keith Horwood, author of Nodal ([https://github.com/keithwhor/nodal](https://github.com/keithwhor/nodal)) and founder of Polybit. The response we've seen to Polybit so far has been nothing short of amazing, and you're part of that. Thank you. No, really, it's been a lot of hard work to get to where we are today and your support makes everything worthwhile.

We're trying to learn as much as possible about our users and community --- it's important we can support everyone --- so I'd like to offer you some free platform credits. Would just like to know a couple things, a short e-mail response will go a long way. :)

1\. Did you know about Nodal before checking out Polybit? 2\. Do you plan on using Polybit for personal purposes, work projects, or both? 3\. Where do you work? 4\. Is there anything you'd like to know about us?

Let me know and I'm happy to add 1,000 credits to your account. By the way - if you sign up for our community Slack with the slack command on polybit.com, you'll get an additional 500 credits.

Cheers, \- Keith

<comment><USER2> For the record --- this was a series of emails I sent out after users registered for the original version of the platform we launched in July.

It was feedback from users here that led us toward stdlib [1] and where we're at now. Probably the most valuable email responses I think I've ever received. I hope you understand at some level that I have to batch email or I simply don't have enough hours in the day to talk to everyone - and I do want everyone's feedback. :) I think I've personally responded to absolutely everyone who's given a response - negative or positive - hundreds, at least. I wouldn't be here without the help and support of others so I want to listen to everyone as best I can.

[1] [https://stdlib.com](https://stdlib.com)</comment></comment></comment>


The Roots of Lisp (2002) [pdf] - <AUTHOR> http://slackwise.net/files/docs/The%20Roots%20of%20Lisp.pdf

<comment><USER2> I've on more than one occasion used Lisp's "everything is data" idea to build little domain-specific languages in JSON. One of the easiest places to start is with representing HTML this way; you can e.g. start to write the Python or JS code:

        ["table", ["tbody", ["tr", ["td class=first", 1], ["td", 2]]]]

instead of:

1	2

A really early attempt at this is: [https://github.com/drostie/d.o/blob/master/build.js](https://github.com/drostie/d.o/blob/master/build.js) but I haven't maintained it in a while.

If you're interested in language design, there appears to be a "little gap" which means a lot between a Lisp data structure and an XML data structure: In XML's view, every list's first element is a string; in Lisp's, it can be anything. This little gap actually corresponds to one of the interesting habits which has disappeared since compilers took over our assembly-writing: it used to be the case that programmers would sometimes _compute an instruction code_ for the next instruction; similarly in Lisps you sometimes (but not too often; it's confusing!) compute a function for your next operation.

If that confuses you because you're not good with Lisp, it's equivalent in Python or JS is:

         (f(x, y, z))(a, b, c)

so that you figure out which function to call and then immediately call it on some parameters. It's not necessarily a difference in expressiveness, as the XML-style just can add an atom 'call' which expresses the above as:

        call(f(x y z) a b c)

but it does seem to correspond to some deeply different philosophy for the system.

<comment><USER3> Your JSON snippet is reminiscent of SXML, a format for describing XML/HTML as s-expressions. The difference being that, using quasiquote and unquote, Lisps are full-fledged templating languages.

Here's a simple template written in Scheme:

      (define stuff '("foo" "bar" "baz"))

      `(ul (@ (class "foo"))
           ,@(map (lambda (thing)
                    `(li ,thing))
                  stuff))

Output:

      (ul (@ (class "foo")) (li "foo") (li "bar") (li "baz"))

Fun stuff!

</comment></comment><comment><USER4> Not to sound smart ass but I got that in 1996 when I was fortunate enough to have a course on Scheme by D. Ribbens here at Liege University in Belgium. He showed us how to build that very interpreter and how powerful it was (he used to say : forget about algorithms or OOP, here's the truly powerful stuff :-) ). Since then I contemplate the slow evolution of languages, leaning to functional programming (although Scheme is not FP, that's for sure).

That said, what could be taught to a young student today that would provide the same kind of enlightenment I had with those few pages of list(p) ?

<comment><USER5> Funny I also got some enlightenment in the same year but with Caml Light and Prolog with a little Smaltalk on the side (VisualWorks). At Nova University in Lisbon.

And that was just the beginning as my university had a few lectures that made use of them, since a few of the major teachers were quite into FP and LP communities.

Then I had to traverse the desert of mainstream languages, until being finally allowed to use such concepts on the programming languages I work with.

</comment></comment><comment><USER6> The paper concludes that a "remarkably elegant model of computation" can be made using just 7 primitive operators, which allows for defining a self- interpreter.

In fact, 0 primitive operators suffice, as the ability to denote functions (Section 2) gives us the Turing complete lambda calculus.

A self-interpreter for a version of lambda calculus denoted in binary fits in under 26 bytes, as shown on [http://www.cwi.nl/~tromp/cl/cl.html](http://www.cwi.nl/~tromp/cl/cl.html)

</comment><comment><USER7> I used ps2pdf[1] to make a cleaner/better version from the original PostScript[2] file from Paul Graham's site[3]:

[http://slackwise.net/files/docs/The%20Roots%20of%20Lisp.pdf](http://slackwise.net/files/docs/The%20Roots%20of%20Lisp.pdf)

The tracking/kerning is still off, but not as much. It's definitely easier to read than the one linked in this post. Anyone know a better utility, or is the source PostScript just poorly typeset?

 _Edit:_ I've just applied pkfix[4] to the file as mainland recommended[5], and it looks wonderful! I've replaced the file on my server, so you can Ctrl-F5 it to see the wonderful crisp text.

[1]: [http://ghostscript.com/doc/current/Ps2pdf.htm](http://ghostscript.com/doc/current/Ps2pdf.htm) [2]: [http://lib.store.yahoo.net/lib/paulgraham/jmc.ps](http://lib.store.yahoo.net/lib/paulgraham/jmc.ps) [3]: [http://www.paulgraham.com/rootsoflisp.html](http://www.paulgraham.com/rootsoflisp.html) [4]: [http://ctan.mackichan.com/support/pkfix/pkfix.pl](http://ctan.mackichan.com/support/pkfix/pkfix.pl) [5]: [https://news.ycombinator.com/item?id=8350995](https://news.ycombinator.com/item?id=8350995)

<comment><USER8> Using pkfix before ps2pdf will improve the final output---it replaces bitmap fonts with Type 1 fonts.

<comment><USER7> That is _amazing_. I've gone and used pkfix and updated the file. It looks perfect now. Thanks!

</comment></comment></comment><comment><USER9> Why are the letters like that? I feel like I'm reading a ransom letter.</comment>


Ask HN: What would you pay to discover & support startups? - <AUTHOR>

A lot of us are building startups. A lot of us are interested in new products as they hit the market. Would you pay $$$ to be part of a startup community focused on discovering new startup products? If so, how much would you pay? Would it change your mind if the revenues went directly to startups being discovered? Would you pay for anything surrounding this concept? See betacandy.com for reference.value. <comment><USER2> No, I wouldn't pay. There are several sites designed for this out there that don't charge anything already. That said, majority of the sites I come across while great are not generally services I would normally use or consider a must have. Paying to have access to the latest and greatest startup seem to be more valuable to press if that even matters, which I presume isn't since most startups want attention and would gladly get any press they can receive.</comment>


Fuck Work: Our Jobs Are Still Killing Us - <AUTHOR> http://www.vice.com/en_uk/read/your-shitty-job-is-still-killing-you

<comment><USER2> Try not having a job for a year, see what kills you then.</comment>


Significant sex differences in Covid-19 immune response - <AUTHOR> https://news.yale.edu/2020/08/26/sex-differences-covid-19-immune-responses-affect-patient-outcomes? <comment><USER2> Here is the actual paper. Drives me nuts when university PR departments can't be bothered to link to the source literature:

[https://www.nature.com/articles/s41586-020-2700-3](https://www.nature.com/articles/s41586-020-2700-3)

<comment><USER3> Seems like they factored in the obvious stuff, i.e. men having poorer health outcomes in general, so I wonder if this has something to do with reproduction? By that I mean women's immune systems reacting more strongly to protect a (possible) baby?

<comment><USER4> Men's immune systems weaken with increased testosterone - speculation is that this allows them to have less immune response so they can keep hunting and fighting.

<comment><USER5> How does an immune response impact physical capability?

<comment><USER6> Most of "feeling sick" isn't the actual bacteria/virus causing problems, it's your immune system doing things like raising your internal temperature to fight off the virus or generating boatloads of phlegm to do whatever that does.

</comment></comment></comment></comment></comment><comment><USER7> Read it but it left me curious how it may affect intersex people like XXY and found a better article [0]. So tldr, apparently number of X chromosomes affects cytokine production. "The lower secretion of inflammatory cytokines in women may protect them from an uncontrolled and potentially life-threatening immune response in cases of severe aggression such as sepsis, trauma or extensive burns throughout life."

[0]: [https://www.frontiersin.org/articles/10.3389/fimmu.2019.0105...](https://www.frontiersin.org/articles/10.3389/fimmu.2019.01052/full)

<comment><USER8> It seems much more likely that the direct controller is sex hormone levels, not chromosomes. Though chromosomes may affect what levels of sex hormones your body produces naturally, hormones are what actually control dimorphism in the immune system[0]

[0]: [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4251360/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4251360/)

<comment><USER9> There's some research showing that estrogen/androgen receptor signalling plays a part in sex-differential disease severity in SARS-CoV-1 and SARS-CoV-2. Incidentally, i love how some suggested pharmacotherapeutic agents include, like, nonsteroidal antiandrogens, GnRHa's, straight-up estradiol, and, of all things, spironolactone.

[https://cancerdiscovery.aacrjournals.org/content/10/6/779](https://cancerdiscovery.aacrjournals.org/content/10/6/779)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5450662/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5450662/)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7233687/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7233687/)

[https://journals.physiology.org/doi/full/10.1152/ajplung.001...](https://journals.physiology.org/doi/full/10.1152/ajplung.00153.2020)

[https://www.medrxiv.org/content/10.1101/2020.08.21.20179671v...](https://www.medrxiv.org/content/10.1101/2020.08.21.20179671v1)

[https://www.jimmunol.org/content/jimmunol/198/10/4046.full.p...](https://www.jimmunol.org/content/jimmunol/198/10/4046.full.pdf)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7191632/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7191632/)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7363620/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7363620/)

[https://link.springer.com/article/10.1007/s11906-020-01073-x](https://link.springer.com/article/10.1007/s11906-020-01073-x)

<comment><USER8> Haha yeah Spironolactone is certainly a weird one. I don't quite understand how it suppresses testosterone myself, all I know is it made me and everyone I know who takes it crave all the salt in the world and have to pee 2x as much. (Taking it to suppress testosterone of course, I don't know anyone actually taking it to reduce their covid risk)

</comment></comment></comment></comment><comment><USER10> Recent and related: [https://news.ycombinator.com/item?id=24304191](https://news.ycombinator.com/item?id=24304191)

</comment><comment><USER11> There's a lot of literature about sex hormones and immune response.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6119719/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6119719/)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4701921/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4701921/)

And then extremely anecdotally: the only people I personally know who have gotten sick† in my ~25–35-year-old social circle have been guys who are, as they say, "on the bike". Geared up, if you know what I mean.

 _†and they've all recovered well; they had about a week of pretty nasty flu- like symptoms, but then bounced back with bed rest_

<comment><USER12> I'm actually not sure what you mean by "on the bike." Is that a slang?

<comment><USER11> Anabolic-androgenic steroids.

<comment><USER13> Presumably this is an on-the-nose reference to the widespread use of dopants in cycling. In completely unrelated terms, the Tour de France started this saturday :)

<comment><USER11> I don't really know the etymology. I have just always seen steroids called "gear", and then figured "on the bike" derived from that.

But also how dare you suggest that the highest levels of competitive sport, where the margin of victory is razor-slim, and you only have a few years of peak performance, are infested with drugs? How crass. How immoral. I miss the simpler days of my youth, when Hulk Hogan told us we just had to take our vitamins.

<comment><USER14> Ah, minor linguistic differences. In Ireland, 'gear' means heroin.

<comment><USER15> Gear is generally used for IV drug paraphernalia worldwide, and yes heroin users use that term as well.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> I see the "but I thought sex was a construct" folks are showing up at the bottom of the thread. I suspect the gender radicals would be quite happy with this study if they just replaced male and female with AMAB and AFAB[1].

I actually think followup studies on gender minorities could be really interesting here - do people taking testosterone get sick like AMAB people who aren't taking hormones? Do AMAB people taking estrogen have better outcomes?

[1] Assigned male at birth and assigned female at birth, respectively.

<comment><USER17> Gender is a social construct. Sex is a matter of biology. Those aren't the same thing.

<comment><USER18> You're playing with semantics.

<comment><USER19> semantics are important, they're how we communicate meaning</comment></comment></comment></comment>


How Rich Chinese Use Visa Fixers to Move to the U.S - <AUTHOR> https://www.bloomberg.com/news/features/2017-09-14/how-rich-chinese-use-visa-fixers-to-move-to-the-u-s <comment><USER2> Pretty sure EB-5 is available for residents of many countries, not just China. Its use is completely legal.

Also the US is hardly alone in handing out visas and residency to rich folks. Money is just another "desireable attribute" that countries look for in heir immigrants, on top of the more common traits like education, professional experience, etc.

</comment><comment><USER3> Nothing sells copy like another fearful article about rich Chinese "taking over" the USA. Americans only have to blame themselves for this one (although I don't think it's such a big deal) because they are trying to profit through some loophole. Isn't that the American way?

<comment><USER4> This is a common story in many countries, a fear of the rich immigrants/expats "taking over" while simultaneously finding ways of profiting off of their money. I've seen similar situations in many Asian countries with much more overt racism. No reason to be hard on America here.

<comment><USER5> I've tried arguing that the rich Chinese people buying condos in Toronto and leaving them vacant isn't a problem in itself.

There are things we can do: increase property taxes and encourage new development. Canada is a huge country and anyone paying property taxes while not living there is clearly a net profit. I agree. I see tons of racist comments out of Canada as well singling out the Chinese.

</comment></comment></comment><comment><USER6> I guess the problem with rich chinese is that even tech people turn into a lower class when they compare. That and they buy every building they can contributing to the housing crisis.

</comment><comment><USER7> tldr; You have money? Won't be burden on the welfare system? Will pay more in taxes than you receive? Your not welcome -- this article.</comment>


Tell HN: Just launched Users Like Me - <AUTHOR>

Hello everyone, I've spent the last couple of weeks developing Users Like Me.
In short, Users Like Me is a web app using the Gowalla API that shows you users who frequent the same spots you do.
I developed the app for myself because I wanted a way to find people in my area who also used Gowalla. It turned out to be more useful to find others who have the same interests as I did.
The URL is http://userslike.me, enjoy! <comment><USER2> Clickable link

<http://userslike.me>

</comment><comment><USER3> What font is the line 'users like me' set in?

<comment><AUTHOR> Lobster, <http://www.fontsquirrel.com/fonts/Lobster></comment></comment>


Feature request: Only allow upvotes from users with enough karma - <AUTHOR> On Stackexchange users only get the right to upvote if they have earned enough rep. That way users can't create fake accounts to upvote their posts and increase their rep. On this site though, some upvotes don't increase your rep. Instead, this site uses heuristics to decide whether an upvote is "fake" or not. The problem with that is it's strange when half your upvotes don't add to your reputation.<p>Why shouldn't this site copy Stack Exchange? <comment><USER3> How about a halfway solution: new/low-karma users can upvote comments but not submissions.

That way new users can still contribute positively to discussions they appreciate, but can't manipulate the front page.

<comment><USER4> The threshold could be very low for gaining upvote privilege. But yes, I like this idea better. As a long time reader but someone who doesn't comment much, I don't like the idea of being further restricted on what users like me can't do. I upvote things I find interesting even if I don't comment often.

</comment></comment><comment><USER5> > The problem with that is it's strange when half your upvotes don't add to > your reputation.

Well, first, I don't like calling total karma reputation. Established users on HN definitely are likely to have a reputation as well as a karma aggregate, but the two aren't closely related.

Second, I don't see the problem. It's only an issue if karma total is a metric you are trying to manage, but that's not a behavior I think HN wants to do more to encourage.

</comment><comment><USER6> I wonder if anyone has come up with or tried a system that has up /down vote as being factually inaccurate, and a separate one for I downvote cuz I don't like this, although I cant't say it's factually wrong. Things like that.

It seems that different people use these things for different reasons - <USER2> they may not be wrong, but the affects on the stories / comments could be to the same even if it was not the intention of the voter.

I've kicked around ideas about differing voting options for social sites, and have some options that include emojis and such, just to add context to the vote.

Certainly good civil discourse can be better if people can admit they don't like something, or want it to change, even if the facts of a certain piece are accurate.

OF course having an "downvote not as innacurate, but missing other facts such as blah blah blah.. or downvote as appearing to purposefully cherry pick some facts and leaving out other well known facts in an effort to scew the views of others".. these kinds of votes would add to other people's understanding of conversations perhaps..

Sites could have other views the lead threads for more info on hover / long press.. with options for "more facts people have suggested are left out" \- stuff like that..

and of course change your viewing of threads based upon your circle, or tribe.. and show the view if followed opposite tribe.. things like that.

I for one would like to see these things happen all around the web - just no idea how to code it, and how the ux could be done. Fancy total re-arrange ajax maybe?

Of course people could self select their "tribe" democrats vs republicans for example.. but machines could also create their own "tribes" based upon ips or other info known about groups of users...

tap to see how group of google employees all pushed up or down tap to see how ips from gov addy have pushed up doen..

stuff like that.

I think I have been voted up and down for things, and don't know why - so no way to learn or debate it, but of course this is HN and not some international televised and rated broadcast or whatever, and apparently there are methods for people to view things that are voted down or whatever if they wish.

Coming from the sony dash app and tablet version mainly, I still don't understand how this thing works all the way it seems.</comment>


Silicon Valley reality show venture, Ignite, interviewed on TechCrunch - <AUTHOR> http://techcrunch.com/2012/09/27/ignite-wellness-hermione-ben-way-silicon-valley-bravo/

<comment><AUTHOR> Ignite is the venture that the Bravo reality show will be following in their series, which premieres tomorrow.</comment>


Firefox users, get ready for ads in your browser - <AUTHOR> http://www.cnet.com/news/mozilla-officially-kicks-off-ads-in-firefox/

<comment><USER2> I don't see any issue with this, apart from the Clickbait title. As it stands at the moment at first install they would be blank, so they may as well put ads in them until you have surfed around enough to show something useful there.

</comment><comment><USER3> This is such a dishonest and misleading title. There are ads on the new tab screen before you navigate to a page and only until you have enough history to have that displayed. That is the only place you would ever sea browser provided ad.

On top of that you can turn if off. This is borderline libel

</comment><comment><USER4> Mozilla, please listen...let us pay for Firefox. Sure someone can freely donate to the foundation, but giving an option for users to pay would bring it more money from people that don't even know that Mozilla is a non-profit.

Make it optional. When users disable the ads, ask them to donate with a link. Something like that. Many of us love Firefox and Mozilla for fighting for freedom and we want to see it well supported. But those of us who see it are not enough to fund it alone.

<comment><USER5> Here's an idea: if Mozilla had first-class support for Active Directory Group Policy, my company would almost _certainly_ pay for modest support licenses.

As it stands, Chrome for Business and IE have better support.

</comment></comment><comment><USER6> I hate that Mozilla is doing this.

But I concede that they are in a strategically weak position.

Google has no competition in the search space, so they don't _need_ Firefox's traffic.

Microsoft _wants_ Firefox's traffic, but most Firefox users would (rightly or wrongly) consider a default search engine change to be a downgrade.

It's also possible that both Google and Microsoft might decide that, strategically, the web browser landscape would be preferable to them with one less major player, each hopeful that their entry would take up the majority of the gap. So they might non-collusively collude to starve Mozilla.

Where else can Mozilla make hundreds of millions of dollars per year in revenue by throwing a switch? They are at the whim of corporations whose interests are not well-aligned with their mission.

So, reluctantly, I get it.

Still, the likelihood that Mozilla can turn itself into a major advertising medium seems so remote to me. Sure, they hired the ad biz dude, and no doubt he has minions to sell sell SELL!, but replacing Google revenue is a big hill to climb.

Mozilla has an expansive mission. No one else is trying to do what they do. I believe that they deserve our support more than anyone else. They may have expanded well beyond the point of supportability, however.

If they lose Google, and Microsoft wants them to starve, even with this adrev move, their revenue would almost certainly drop to 20-30% (at most) of the current $300MM. That's a lot of people and a lot of projects that will be cancelled. It would be a new crisis of the web, honestly.

If this advertising move alienates any portion of their userbase, Mozilla's importance to Google declines even more quickly than their potential independent ad revenue.

So I'm biting this bullet, hard. I believe in Mozilla, and I recognize an existential threat to their mission, which is even more obviously important today than 18 months ago. Hindsight suggests some helpful defensive moves, but we are here, now.

I understand the "ok then, switching to xx browser" reactions, and even sympathize with the "whatevs, as long as I can turn it off" crowd.

But we need to give Mozilla the option of a soft landing. Maybe they need to rein in their projects and staff expenditures and focus on a few super important things. But letting them starve would be catastrophic.

The Google contract was supposed to expire this month. Do we think Google is now evil enough to try to game their advantage, in the guise of shifting corporate priorities? I sure hope not.

</comment><comment><USER7> It is unclear to me how those ads will help Firefox. Some people will be disgruntled by this move and stop using Firefox.(Ironically, those will be the people who are most likely to donate money) Those that keep using Firefox probably have the intention to visit an address when they open up a new tab. Why would they stop for a while before typing in the address to look at those ads?

</comment><comment><USER8> If Citrix remote desktop worked properly in Chrome I wouldn't ever use Firefox. This post reminded me to give Chrome another try...</comment>


Japan's technology champions: Invisible but indispensable - <AUTHOR> http://www.economist.com/displayStory.cfm?story_id=14793432

<comment><USER2> great read - I lived in Tokyo for 2 years, and as a westerner this attitude resonated with me by the time I left... Upon my return things i hadn't noticed before leaving now become noticeable - I was accustomed to a wide range of knowledge at a very shallow depth, instead of a small range knowledge at a deep depth - this article (to me) communicates the different approaches between the Japanese and us. Good read, thank you for that...</comment>


How to Recognize the Real Senior Developer? - <AUTHOR> https://blog.aurity.co/how-to-recognize-the-real-senior-developer-d7e107ce6ddc <comment><USER2> I am disappointed in the amount of blog spam posts that are nothing but ads for a company or service. Some times the actual post content is interesting, but the ending is almost always buy our stuff. Usually though it is poorly written to get the page views.

</comment><comment><USER3> I don't think people who consider Harry Potter to be a pinnacle of fine writing should be in the business of telling Juniors from Seniors.

Also, for marketing spam, which this is, it isn't written even to Rowling's standards.</comment>


A minimal js stopwatch+timer - <AUTHOR> http://www.ianjorgensen.com/timer I could not find a simple timer that would count up and down i.e. stopwatch+timer so i quickly put this together. Let me know what you think :) <comment><USER2> This a nice simple implementation, really like it, the only thing I would ask is that at the 10 second point or something, the screen turns red during the countdown as a little warning

<comment><AUTHOR> Good idea! i just made that change :)

</comment></comment><comment><USER3> I think you can mod it to be an Egg Timer, some people still find it useful, paid version is selling for USD $5.

<comment><AUTHOR> what do you mean by an Egg Timer?

<comment><USER3> A Web version - <http://e.ggtimer.com/> A Windows XP version - <http://www.sardinesoftware.com/eggtimerplus.php>

<comment><AUTHOR> It kind of does an what e.ggtimer.com does but only for minutes (just type in the minutes and hit enter). I could add some visual indicator of the percentage time left. You can also link to a time like this <http://www.ianjorgensen.com/timer#10> or <http://www.ianjorgensen.com/timer#0> to count up.

I like <http://www.sardinesoftware.com/>, he sels the most simple apps 5 bucks a piece! Its not a bad idea.</comment></comment></comment></comment>


Towards a Universal VM - <AUTHOR> http://www.infoq.com/presentations/Towards-a-Universal-VM

<comment><USER2> Seems there's at least some direction the new java owners want to head at.</comment>


Can Cinder, the World's Most Precise Griddle, Replace Sous-Vide? - <AUTHOR> http://www.seriouseats.com/2015/10/worlds-most-precise-griddle-replace-sous-vide.html <comment><USER2> Sous-vide is amazing but I can't believe how expensive they typically are.

Because I couldn't believe it, I built my own for $45 using weird things from amazon. It didn't even take any electrical work or programming and can be setup in about a minute:

Cheap fish tank pump: [http://www.amazon.com/gp/product/B00EWENKXO](http://www.amazon.com/gp/product/B00EWENKXO)

Cheap hot plate: [http://www.amazon.com/gp/product/B005T0SN0K](http://www.amazon.com/gp/product/B005T0SN0K)

And the star of the show, a temperature modulator with a standard plug: [http://www.amazon.com/gp/product/B00V4TJR00](http://www.amazon.com/gp/product/B00V4TJR00)

Put a pot of water on the hot plate, insert fish tank pump, plug hot plate into the Willhi. Put your meat into a regular ziplock bag, leaving it open, dip it into the water. The pressure of the water will cause the air to leave the bag, creating a vacuum (you can find many demonstrations of this technique on youtube). Clip the bag to the side of the pot using some clothes pins. Bam! DYI sous vide.

Generally it maintains the temperature within +/\- 1 degree Fahrenheit, which is good enough for a rare steak. I had this incredibly dangerous coffee heating element at first, which could keep the temperature within 0.1 degree, but decided it was too dangerous to be worth it: [http://www.amazon.com/gp/product/B00V4TJR00](http://www.amazon.com/gp/product/B00V4TJR00)

I then use a $25 Iwatani torch to char the surface: [http://www.amazon.com/gp/product/B00BBJC1CY](http://www.amazon.com/gp/product/B00BBJC1CY)

As opposed to most butane cooking torches, this one seems to produce a large hot flame about 20 centimeters long and the diameter of a quarter.

Not to take away from this griddle or anything, but I'm pretty psyched about my sous vide machine and it was too easy to make just to not tell everyone that will listen.

<comment><USER3> so simple diy setup..

some questions:

first two links:

       And the star of the show, a temperature modulator with a standard plug: http://..

and

         but decided it was too dangerous to be worth it: http://..

were the same: [http://www.amazon.com/gp/product/B00V4TJR00](http://www.amazon.com/gp/product/B00V4TJR00) ; was this intentional?

second, does that little water pump handle the heat?

lastly, did you just bend up the heating element and place it directly in the water?

<comment><USER4> I assume he's using the hotplate as-is with a large pan of water on top and the thermostat controlling power to the hotplate and the temperature probe in the water.

If Steve could continue to be a Cool Guy (sorry!) and confirm that would be wonderful because I've just been to Amazon to try and create a similar set-up.

Another implementation question: does the pump need a pipe connected to it, or is it sufficient as-is?

For those in the UK, here's what I ordered: Pump - [http://www.amazon.co.uk/gp/product/B00BVK966C](http://www.amazon.co.uk/gp/product/B00BVK966C) Thermostat - [http://www.amazon.co.uk/gp/product/B00BVYCZ84](http://www.amazon.co.uk/gp/product/B00BVYCZ84) Hot plate - [http://www.amazon.co.uk/gp/product/B00A4DE35G](http://www.amazon.co.uk/gp/product/B00A4DE35G)

Yes, it is all frighteningly cheap and I'm not going to leave it running unattended!

<comment><USER2> Yes that's it, the hot plate is being used as a normal hot plate, but its power is being controlled by the thermocouple.

The pump is used as is, fully submersed in the water with no tubes. All it does is agitate the water to make the heating more evenly dispersed.

Your setup looks good, I was going to buy a similar control unit to yours until I found the Willhi version that just used regular outlets. The thing with this box is you have to do a little bit of wiring work to set it up. Turned out to be cheaper for me to buy the already assembled outlet version than the components for it.

I think you can already find tutorials online about people connecting this non-outlet style of thermocouple to a slow cooker to make a sous vide. That was my original plan until I sleuthed out this cheaper design. So check those tutorials out.

The best thing about sous vide is that you can "set it and forget it", you should thoroughly leave it unattended because it's so amazingly convenient.

</comment></comment></comment></comment><comment><USER5> J Kenji's articles on Serous Eats are phenomenal. It's what got me started sous vide cooking, as well thinking about cooking in a whole new way.

I highly recommend anyone who hasn't read any of his stuff to do so, regardless of whether you like to cook or not.

<comment><USER6> Can you please link to some "highlights"? Some must-reads from seriouseats? I like Kenji too, but I only started following him just recently.

<comment><USER7> [http://www.seriouseats.com/2015/08/the-food-lab-complete- gui...](http://www.seriouseats.com/2015/08/the-food-lab-complete-guide-to- sous-vide-burger.html)

[http://www.seriouseats.com/recipes/2010/02/the-best- buffalo-...](http://www.seriouseats.com/recipes/2010/02/the-best-buffalo- wings-oven-fried-wings-recipe.html)

This one made the news when it came out, because it's totally fun and great:

[http://aht.seriouseats.com/archives/2010/05/the-burger- lab-h...](http://aht.seriouseats.com/archives/2010/05/the-burger-lab-how-to- make-perfect-mcdonalds-style-french-fries.html)

</comment></comment></comment><comment><USER8> Answer from article: No

<comment><USER9> See: [https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

</comment></comment><comment><USER10> _" Entering the fray next year is the Cinder, a countertop cooking device that promises to deliver sous-vide-level precision without the bags and the water bath."_

I've been critical before on technology solving home as opposed to commercial cooking, this statement alone using a technical approach to avoid waste of water and removal of plastic from cooking is fantastic.

 _" Sous-vide cooking excels at tenderizing typically tough cuts while maintaining juiciness through prolonged, often multi-day cooks that break down connective tissue while also conveniently storing released juices in its bag."_

Why is a sous-vide better than a pressure cooker here?

<comment><USER7> Sous-vide is better for some dishes because the temperature is controlled, and generally low. If you want a rare steak, the temperature should be 120 F ([http://www.seriouseats.com/2015/06/food-lab-complete- guide-t...](http://www.seriouseats.com/2015/06/food-lab-complete-guide-to- sous-vide-steak.html)). A pressure cooker, because it relies on steam, will always cook above 212 F. That's awesome for a lot of dishes (chili! [http://www.foodnetwork.com/recipes/alton-brown/pressure- cook...](http://www.foodnetwork.com/recipes/alton-brown/pressure-cooker-chili- recipe.html)), but for many meat preparations it's overcooking.

One dish that I have directly compared sous-vide against more traditional techniques is pork shoulder. My "traditional" technique is oven-cooking, a process that takes 6 hours at 325 F. In sous-vide, the shoulder takes longer, more like 24-72 hours, but the temperature is lower, 135 F ([http://sousvidely.com/sous-vide-pulled-pork/](http://sousvidely.com/sous- vide-pulled-pork/)). Also, it's in a bag. The sous-vide version is better in many ways -- it's got more juice and color and tastes fresher -- and it's way easier because I don't have to turn and baste it every 2 hours.

But yeah, I don't love the consumables of sous-vide. I reuse bags and water whenever I can.

<comment><USER10> thanks @rdw, that is a great explanation.

</comment></comment></comment><comment><USER11> The test sounded promising vs sous vide.

I demand a Pepsi challenge.

I just can't believe this thing would end up as juicy being exposed to the air like that.

<comment><USER12> That is a good idea, I'll look into doing that!

</comment></comment><comment><USER13> In an article all about how precision cooking is changing the world:

> That said, precision isn't really needed when searing, just high heat.

<comment><USER14> Searing is just one step in the process.

I have a pricey high tech anova sous-vide circulator which is great for getting steaks to the perfect done-ness, then I use a decidedly low-tech $15 lodge cast iron pan to get that perfect finish.

Right tool for the job, etc etc.

<comment><USER6> You could use a blow torch for searing-- hell lot less hassle, and so much quicker.

<comment><USER7> Not enough new tech involved! Consider getting a Searzall to solve that problem: [http://www.bookeranddax.com/searzall/](http://www.bookeranddax.com/searzall/)

<comment><USER5> I have a blowtorch and a bought a Searzall for it. While it's a really cool device, I've found I prefer blowtorching my steaks normally as it provides a higher temperature.

I feel the Searzall works better for things like melting cheese, lightly toasting bread, or otherwise browning things without too much heat.

<comment><USER6> How does the blowtorch work for things like melting cheese, toasting bread, etc.? Or is that just not feasible?

edit: wait a minute, it seems that Searzall is basically just an addon _to_ a normal blowtorch. So if you just take off the "Searzall" addon, you are left with a normal blowtorch. (Or am I misunderstanding something here? Please confirm!)

<comment><USER5> Yeah, exactly, the Searzall attaches to a blowtorch. It reduces the heat and spreads it out over a larger space.

For steaks, I prefer to get oil very hot in a cast iron, then put the steak in the cast iron, while torching each side for 30-45 seconds. (Also got that off a Kenji article.)</comment></comment></comment></comment></comment></comment></comment>