Teaching Programming To A Highly Motivated Beginner - <AUTHOR> http://cacm.acm.org/blogs/blog-cacm/156836-teaching-programming-to-a-highly-motivated-beginner/fulltext <comment><USER3> This may seem silly, but I found the most difficult part of learning RoR was getting my development environment set up. I tried several times since 2005 to get started, but failed due to a sticking point that for some reason I couldn't get past. It wasn't until a friend with a bunch of RoR experience walked me through the setup of the black box of different parts to run a web app that I actually got it. Comparatively, coding, refactoring, implementing best practices is much easier and enjoyable.

If you view programming as a craft, having mentors/coaches/peers definitely helps you improve much faster.

<comment><USER4> Totally agree with your last point.

To your first point, I really wish people would make virtual machine images with dev environments already set up on them.

<comment><USER5> > I really wish people would make virtual machine images with dev environments > already set up on them

I think this is actually often more of a problem in the long run, as it just pushes the learning of how RoR interfaces with the rest of the stack to later. If you're seeking to teach someone how logic, program control flow, and separation of concerns work (as the author did by abstracting the "grunge work" as he calls it), why not pick an environment a bit more bare-bones?

I see the merit in allowing someone to get something up and running rapidly, but I think they may miss important concepts when learning in an environment that favors convention over configuration.

<comment><USER6> Because the author explicitly wanted "not to waste his time on banal unrelated issues" except those directly related to the project at hand.

He's not missing important concepts but deferring important concepts to learn other important concepts that lead to progress today.

You end up paying back that deficit one step and one layer of abstraction at a time:

        Some of Brian's biggest forward mental leaps came when he took
        a step back away from the day-to-day project grind, learned new
        concepts in a course or from a book, and then thought about how to
        apply them to SwearBuy.

</comment></comment></comment></comment><comment><USER7> Taught myself to program over 6 years ago. I've learned low level and high level languages, algorithms, data structures, how to make websites and mobile applications, etc, etc. While I may have wished for an instructor at parts (specifically when my computer refused to run certain pieces of software, or when I accidentally wiped my entire hard drive while trying to install linux) in retrospect, I don't think I would choose to do it any other way.

Then again, I prefer learning from reading a book than from being taught. Everyone is different. It must be amazing to have someone guide you and check up on you once in a while though.

</comment><comment><USER8> I taught myself programming last year (starting with Python from Google's course) and am incredibly jealous of this. I'd have killed for someone to explain what on earth Object Oriented Programming was in the context of the project I was working on. It simply did not make sense to me for a very long time.

<comment><USER9> I'm curious; what was the first project you built on your own?

It's been so long since I started programming that I can't really remember mine. My wife is learning now and I sometimes worry that my gauge of what are good beginner projects is off.

<comment><USER8> For me it was a system for tracking errors in weather forecasts. I downloaded 400-odd forecasts from the NOAA twice a day and dropped them into a database.*

Figured out the following technologies on the fly: Python for the machine learning part, the backend and web scraping (after I finally gave up on SOAP), SQLite, HTML/CSS, PHP (after giving up on Django), Apache web server, FTP protocol (for backing up my stuff to my external drive). There are probably other things I tried and gave up on but forget.

I definitely went down a LOT of blind alleys and generally found out-of-the- box frameworks incomprehensible. The difference in the various communities was fascinating, too. For instance, try comparing forum answers to CSS or PHP questions against Python or, gasp, C. Holy cow.

*The result, if anyone cares, was that I figure they systematically overestimate High temps, underestimate low temps and overestimate POP.

EDIT: forgot javascript/jquery.

<comment><USER10> Did you set out with the goal to be a programmer when you started? I have a particular project I want to build, but I struggle with the build vs buy dilemma. It will probably take me 5x as long and be 10x worse than if found a good programmer.

But, I also want to learn because I know that I need to understand what is being built and if it's being built in the best way to accomplish the goal - getting the job done for the customer.

Is it realistic to focus on being a generalist with an understanding of various languages or do I just need to learn one language first like Python and go from there? I noticed the MIT Python videos are free also. Thanks

<comment><USER11> If you want to build something, I think that's an excellent reason to learn Python and dive in. You don't need to become a generalist before you can build something useful which you can learn from. As mentioned in the article, having concrete pain points in your coding ("Why doesn't this work?" or "how can I X?") will help you appreciate the problems that various techniques solve.

Studying other languages exposes you to issues that you might not experience on your own, but on the other hand it's hard to apply your understanding of them all quickly. Python is an excellent language to learn first.

Learn enough of one language to be dangerous, code the minimum that comes close to what you feel you need (or a toy version of it), and then you'll have a much better idea of what else you want to learn. Good luck!

<comment><USER10> Really appreciate your insight. It seems like there are some good online tutorials out there for Python also. Ok, Python will be my first victim. Thanks!

</comment></comment></comment></comment></comment></comment><comment><USER12> I went through a very similar process and I highly recommend it. I'm a web designer and I had a bit of experience with Javascript (just enough to be dangerous) but I really wanted to build an actual web application. I just couldn't seem to grasp OOP, but in hindsight it's because Javascript's OOP is so obfuscated.

I live in a small tourist town and I was surprised to find a local Ruby developer. We met up and I asked him to tutor me a couple of hours per week trying to build an actual Ruby on Rails application.

He set up the project structure and wrote a couple of tests, and I'd go back home and try to get those tests to green. Boy it was hard. I'd grind for days trying to get the last couple of tests to pass, so when we'd meet up for our weekly session he'd resolve them in just a couple of minutes and it made perfect sense. It was worth it just for those "ah ha!" moments.

Of course, the motivation isn't in learning the language/framework itself, it's in building something useful or meaningful to you.

In the end, with 2-3 hours of weekly mentoring, I was able to release the functional application in six months and learned tons in the process.

</comment><comment><USER9> I am in a similar situation to the author: I am an experienced programmer, and I am tutoring my wife, who left her job so she could devote all her time to learning to code. She's gone through all of the HTML, CSS, and JS CodeAcademy courses, and is now doing the Python course on Udacity.

While she hasn't needed a lot of help with those, she has also been working on extracurricular projects that I've helped put together for her. This is where I think the article was most revealing: I have been worried about helping too much, but now I can see why the opposite is true.

The author mentions that struggling with what you're learning is important. I agree. However, I think I have been letting my student struggle with the wrong things in the name of not "doing it all for her". I think it would be better to err on the side of providing every resource I can to define a straight path to a completed project. When she gets comfortable at a certain level, we can make the projects more complicated by involving more parts, rather than more frustrating by giving her less information.

<comment><USER13> I'm really enjoying the Coursera course on learning to program <https://www.coursera.org/course/interactivepython>. They have an interactive python implementation in javascript, so all the exercises are via browser - <USER2> configuration required at all. And the exercises are to build games.

Although I'm not building my own projects in the exercises, I am building something that I understand. This week's exercise was Pong and I'm looking forward to Asteroids in week 8.

Making something concrete really helps me understan the concepts.

<comment><USER9> Thanks for the tip! Would you mind posting a screenshot of Pong? I know that I loved being able to use graphics when I started, which is why I stuck to QBASIC as long as I did. Do they give you a library to use for drawing primitives (circles/squares/cthulhu), or is it all image-based?

</comment></comment></comment><comment><USER14> Cool post! I've seen a lot of beginners learn to code (I started a non-profit to help bring more women into software development) and while we're addressing the issue of code literacy, there's still a huge skills gap between those who "can code"/ have done some tutorials and those who are ready to flexibly architect software.

I'm hoping to make the process of going from newbie to experienced easier and more meaningful with CodeMontage (<http://bit.ly/CodeMontageLaunch>) - you get to work on real, open-source and social-mission projects, you get feedback and code reviews from experienced developers, and you build a portfolio of open source, quality code that you can reference later or use to get a job. It's also really nice for the experienced developers / experts in a language to be able to give code reviews on important projects - it's nice if you have a friend willing to pair on your side project, but definitely can wear on a relationship over time (and when all your friends are learning to code...).

</comment><comment><USER15> According to emails I still get for my (yet-to-be revised) Bastards Book of Ruby, this statement rings particularly true:

> _Since we finished our final tutoring session in March 2012, I didn't hear > from Brian for six months. He recently sent me an email mentioning that he > just wrote a Python script to help him model personal stock investments: > "I'm very proud of this script because it was the first thing I've done that > was both practical and purely for personal use. I was evaluating a stock > investment and wanted to simulate a bunch of scenarios. I started to model > the scenarios in a spreadsheet before I realized that a spreadsheet wouldn't > work, but python was perfect."_

Showing how programming is useful for "both practical and purely for personal use" seems to be the surest path for enticing non-professionals...with everything that we have to keep track of in our lives, purely academic pursuits can be tough to stick to.

</comment><comment><USER16> Essentially this is where I am - I've completed about 1/4 of codecademy's codeyear, and I'm digging into Arduino pretty well (hello self-driving trash can). Codecademy covered the basic concepts well, but I'd like to make sure there aren't any concepts I'm missing. If I'm doing something the hard way, I'd like someone with more experience to tell me.

I've already got a BA in business, and while repaying college loans, I really can't afford to pay for college classes to be able to meet with a professor. Besides, I'm not sure that college courses would teach me electronics and programming faster than I can teach myself. (College was a good experience, but I'm not trying to get another BA)

I'd almost like to start a service connecting interested learners with subject-matter mentors. In fact, some type of mentorship/tutoring program could be an integral part of a good hackerspace.

<comment><USER3> Not sure if this is a feasible where you live, but there are a lot of "code with other coders" meetups in SF and NYC. If you come with a programming sticking point, there are fresh eyes that can help you though it. I like codeacademy, but find its structure limiting; you can literally just go through courses parroting off information without learning best practices or antipatterns.

</comment></comment><comment><USER17> Any advice for the _slightly_ motivated beginner?

My wife has recently asked me to teach her some programming. I doubt she will be that highly motivated though. I am guessing her interest is just to explore this world and perhaps better understand the work I'm doing. I have never taught any beginners but this could be a fun experience for both of us. I am wondering what kind of assignments, projects or scenarios to go through, and what kind of a development environment to use.

I love python and think it's probably the best language to learn (and use), but I'm not sure how excited my wife will be from looking at a console? I was considering a little bit of javascript together with HTML/CSS, but most of the programming involved with interactive web pages I find a little boring... Any suggestions for some cool simple projects to walk through and learn programming with?

<comment><USER18> Students pick up on the enthusiasm of their teachers; motivation can be catching. Assume she's highly motivated and work from there. In general, I don't think that people who are "slightly" motivated learn much in any area.

A friend of mine who is highly motivated is having fantastic success with Zed's "Learn Python the Hard Way" (<http://learnpythonthehardway.org/>). I can't say I'm teaching him, though, I'm just in text and email contact if he hits a sticking point.

<comment><USER17> Thanks for the tip. That's true, of course. She might become highly motivated, but at this point there's nothing _burning_ to motivate her. She's not hoping to get a job as a developer, she's not particularly passionate about building a new app or a website. She's curious enough about it to try to explore. The same way she enjoys knitting occasionally. Does one have to be highly motivated to enjoy it?

</comment></comment></comment><comment><USER19> I'm currently mentoring someone using a method similar to this -- build steps of a project, be available for questions as they come up. We've covered basic OOP and are moving into more abstract concepts like FSMs. I'm curious about what happens next for someone who has learned to program decently well, but has no traditional formal education.

If going back to school is probably not an option for this guy due to other obligations (and finances) do you have any advice for the path from solid hobbyist into entry level professional?

<comment><USER20> I'm also interested in any advice that people have. I'm in the process of teaching myself programming and I try to take in as much guidance and advice as I can.

</comment></comment><comment><USER21> Sadly, new Python-based MIT courses are at least mediocre.

By mere rewriting the code from Scheme to (ugly) Python they lost all the elegance and convenience acquired by decades of evolution of the classic courses and two editions of SICP.)

Watching 6.00CS is boring, when you remember how this very code supposed to look in Scheme.

The old Berkeley's CS61A, which is based on the same great book, was also translated into Python.

For teaching in Python, at the very least, its standard idioms must be carefully selected and used, as it is in the original Python tutorial on the web.

</comment><comment><USER22> To those looking to start programming, but don't have a tutor nearby: pick up Steve Kochan's "Programming in C" and head on over to <http://cs50.net>. They have a Google Group set up where David Milan and his aides will answer your questions!

It's how I finally added some structure to my learning adventure.

<comment><USER23> I started that last week! I believe the new official site is www.edx.org

</comment></comment><comment><USER24> yes, how much for this kind of tutoring lessons?

<comment><USER25> I guess you are asking the wrong question here. Instead asking how much you should ask who will mentor me? It is more important to find a person who is ready to devote his/her time to mentor new programmers. I wish I would be as lucky as Brian. I am also looking for someone to mentor me. At times hundreds of choices confuses the new learner and all of a sudden the interest to learn fades. This is the best part of this article and so so very True - "There are dozens or sometimes hundreds of ways to accomplish the same task in computer programming; this multitude of choices can be paralyzing for beginners."

</comment></comment><comment><USER26> I'm curious as to see how much he charged for the lessons.</comment>


The Simplicity of Kallow - <AUTHOR> http://www.slideshare.net/celston/kallow-refresh-miami-presentation/ <comment><USER2> A presentation made at a local refresh meetup about Kallow a new way to buy electronics

</comment><comment><USER3> Marketing spam is marketing spam.

<comment><AUTHOR> so says the person with 5 karma points. it's a pretty insightful presentation, one which I have no financial or equity stake in.</comment></comment>


Cyberspace When You're Dead - <AUTHOR> https://www.nytimes.com/2011/01/09/magazine/09Immortality-t.html <comment><USER2> Please log in. No point with these walled sites.

<comment><AUTHOR> If you get: [https://myaccount.nytimes.com/auth/login?URI=http://www.nyti...](https://myaccount.nytimes.com/auth/login?URI=http://www.nytimes.com/2011/01/09/magazine/09Immortality-t.html&OQ=_rQ3D1)

Try removing the extra parts: [https://myaccount.nytimes.com/auth/login?URI=...&OQ=_rQ3...](https://myaccount.nytimes.com/auth/login?URI=...&OQ=_rQ3D1)</comment></comment>


Ask HN: Passively investing $50-200/mo into bitcoin as a Canadian? - <AUTHOR>

Where could I passively invest into Bitcoin as a Canadian. I'm OK with losing this sum of money after a few months, and seeing how fast Bitcoin is growing, I wouldn't mind making a few bucks. I was going to use LibertyBit but they shut down. <comment><USER2> Either [https://cavirtex.com/home](https://cavirtex.com/home) or [https://localbitcoins.com/](https://localbitcoins.com/)</comment>


How to do good talks at conferences - <AUTHOR> http://writing.makeshift.io/pieces/how-to-do-good-talks-at-conferences …

<comment><USER2> Broken link, and the correct link has already been submitted here:

[https://news.ycombinator.com/item?id=6583906](https://news.ycombinator.com/item?id=6583906)</comment>


Let's Start a Learning Revolution - <AUTHOR> http://vimeo.com/21600601

<comment><USER2> It's like Edward Tufte, Leni Riefenstahl—and, I dunno, Polyphonic Spree?—got together to brainwash you.

I've got to hand it to the video's production company, The Cultivated Word, for creating an triumphantly insipid piece of propaganda. Some advice, though: Try a slightly less obvious, bombastic approach; it might be less clear to your subjects, er audience, what you're trying to do.

The company's motto, from their web site: "We turn passive viewers into engaged audiences." What does that even mean?! Passivity and engagement are fairly orthogonal concepts—and what does "engagement" really mean? And the last time I checked, an audience is made up of viewers.

What they seem to be going for is the cultivation of sentiment based on emotional manipulation, which is nothing new, but I find the way they package it—as part of the solution rather than part of the problem—rather galling.

On another note, it very much reminds me of the end design work done in _Waiting for "Superman"_ , which itself made me feel a little like their director thought his audience a group of simpletons in deed of stick figure diagrams explaining the most basic concepts.

</comment><comment><USER3> Good idea, but seriously lacking in just about everything else.

No online classes? No search function or categories? No preview or course outline? ("You'll learn how to make a bag" doesn't cut it). No details about what makes their instructors qualified to teach? (Being successful doesn't make you a good teacher). Single classes with an average length of 90 minutes? What could anyone learn from that?

Nothing about their website convinces me that their classes are worth my time or money. I'm all in favor of making education more efficient, but this site just seems to be doing it all wrong.

</comment><comment><USER4> Awesome goals, that are even better considering how much the US is paying for education now - and planning to cut.</comment>


First US person dies from coronavirus in Washington state - <AUTHOR> https://www.foxnews.com/us/person-dies-from-coronavirus-in-washington-state-first-in-the-us-health-officials-say <comment><USER2> Not much information in this article, but given they only just reported new cases that makes me wonder if this person didn't come to a hospital until they were in severe condition - probably because they had no idea it was coronavirus and were thinking "it's the flu, it'll pass." If so it likely means many more cases in the community than we currently know about.</comment>


Swiss German is not context-free (unlike virtually all other languages) - <AUTHOR> http://www.eecs.harvard.edu/~shieber/Biblio/Papers/shieber85.pdf

<comment><USER2> I'm no linguist, but I think they effectively used the pumping lemma, just like the canonical "there's no finite bound on the distance between declaration and use of a variable" proof for Algol-flavored programming languages. Either confirmation or pointing out my mistake would be greatly appreciated.

<comment><AUTHOR> Yes, I think so.

I find that fascinating, because people usually assume that (a) natural language must be context-sensitive, because of ambiguities and all those misunderstandings in real world, where they forget that those aren't syntactic, but semantic or pragmatic issues, and (b) natural language must be _at least_ context-sensitive, probably more, because look at how restricting context-freeness is (e.g. when it comes to programming languages).</comment></comment>


Ask HN: How to Print Books? - <AUTHOR> I'm looking at all of the good books in the public domain, and would like to bring some of them to life. Nothing too fancy (don't need hardcovers, for example).
What sort of technology would one need to print their own books? Obviously paper(What kind?), a printer (What kind?), and some glue, perhaps.
If anyone has done this sort of thing before, I'd love your input. Thanks! <comment><USER2> If you don't need the "real book" look and want something practical and rather cheap: A laser printer and a wire binding machine with a cardboard cover.

Otherwise all those print-on-demand services may be what you're looking for. Alternatively, a local printer.

If you insist on "the real look" and want to do it yourself: Again a laser printer and binding the book by hand. There are tons of instructions and tutorials on the Internet, from quick and dirty to professional and artisan.

<comment><AUTHOR> Definitely going for the "real look". Thanks for the response, I appreciate it!</comment></comment>


Besides school, what should I be focusing on right now? (CIS Student, 2nd year) - <AUTHOR> I'm currently going for an AS in Computer Information Systems at my local community college and plan on transferring to either RPI or RIT (my community college has excellent articulation agreements) in 2015 to continue on for my BS. I'm currently looking into what is necessary for an internship over the summer of 2015 and am working on a few personal projects (two sites and a mobile game) as well as learning and getting solid grades in class.
What should be my focus? I'm looking for a general outline by those who have been in a similar position to mine (I imagine there are at least a few here on HN.) My main concern is getting to graduation and realizing that I've neglected a critical aspect that was necessary for all job seekers.
Thanks in advance! <comment><USER2> Internships and portfolio.

Setup a website that goes over projects you've done in school or personal projects. I got my last job because my portfolio website looked good and I had some past projects that 'showed' stuff on my resume. Most other people just had "I know c#". I had a project I could show off/describe.

<comment><USER3> Perfect answer.

A free GitHub site with some Open Source projects is also a nice inexpensive option for a portfolio.

But these days portfolios for programmers seems like a "must have." I'm surprised more colleges aren't helping students put them together.

<comment><AUTHOR> Thanks for the info, is there any particular tutorial/guide that you would recommend for me to really get a solid grip on Git and Version Control?

</comment></comment></comment><comment><USER4> Networking is important. I know many people whose first jobs were because of schoolmates. How to network is different for different schools; it can mean club involvement (eg, the local ACM or Linux chapter), or it can mean working on a local university research project which hires a lot of students.

<comment><AUTHOR> This was very helpful, thanks! There are not any research projects going on at my college that I know of, but there are one or two viable clubs at the CC and I'll take the initiative and look into joining them.

</comment></comment><comment><USER5> This might get a bit long - I am trying to get a lot of this sorted out myself but some thoughts

1\. University, certainly the good ones, have two goals - to grow the next generation of Professsors whose research will give multiple orders of magnitude payback to society, and to grow more rounded, more stable highly trained "future leaders". It's still a fairly reasonable approach, and I would strongly advise you to stick with the opportunity to grow and experience more as a young human than you will get almost any other time.

So, do work hard, but also sleep around, take time to travel cheaply in the long holidays, meet interesting people not because they might be useful in your future career, but because they are interesting. Sleep with some of them !

2\. Portfolios and networking - it's a bit blah! I would recommend that you do two things - experiment with different languages, build interpreters or compilers (start with a simple text markdown, build you own DSL) and just as importantly contribute to some open source projects - get your hands dirty with documentation, test frameworks, source code screw ups and bug triages.

If you want to impress me with your just out of college CV then proving you can work well with other professional developers, can put a decent commit together and not piss off my senior leads is useful, and demonstrating that you can look square at the trade offs with functional and OO, what makes life hard when building an interpreter and knowing how to go from AST _back to source code_

Well that will get you the interview at least

Below is a long email / blog-post-to-be that was in response to a similar question from a Greek graduate (and temporary taxi driver)

(Ok that's too long for HN submit form ... It will get rewritten and posted somewhere - but really - work hard, work with other people, work on gettin breadth of experience and why clever people have not yet settled on one language - and don't forget to meet interesting people and sleep with them (now my favourite phrase of the day)

<comment><AUTHOR> Thanks for taking your time to right out such a helpful and thorough comment. As far as point one goes, I'm definitely doing a few of those things and plan on travelling a bit too.

Number two is helpful, as I hadn't really thought about building any compilers or interpreters. Could you PM me the blog post if possible? I'm not sure if HN has this capability. If not, then I'll have my email in my profile. Thanks a ton!

<comment><USER5> Might take a day or two - want to publish it which means a rebuild of a laptop

</comment></comment></comment><comment><USER6> > My main concern is getting to graduation and realizing that I've neglected a > critical aspect that was necessary for all job seekers.

Search Indeed.com for demanding 'entry-level' positions requiring CIS backgrounds. Note the typical requirements/experience/qualifications that employers are looking for. Use that as your personal education & training road map.

Here's an example> [https://university- crowehorwath.icims.com/jobs/8577/consulta...](https://university- crowehorwath.icims.com/jobs/8577/consultant---university-entry-level--- consulting-information-security/job)

<comment><AUTHOR> Thanks for the link!</comment></comment>


Y Combinator's Paul Buchheit:The Surprising Learned from 200+ Startups (2016) - <AUTHOR> http://blog.capitalandgrowth.org/paul-buchheit/ <comment><USER2> I would be curious to hear about other examples where the idea seemed truly terrible, but then exceeded beyond their wildest dreams. I hear partners regularly citing this - and then they talk about AirBnB. Who are companies 2-10 who actually make this a pattern, or is this just bias because AirBnB was such a smashing success and it's a good anecdote?

</comment><comment><USER3> "I've discovered that most people are really good at finding obstacles. I don't fund these people."

Today a family member told me that I should quit working on my project because it looks like it's just not working out... I've only been working on it for like a month!

</comment><comment><USER4> Is it just me, or is the page hijacking normal page navigation keys like "PgDn" and "Space". Really, _really_ annoying that I don't seem to be able to navigate the way I usually would.

Major UX failure.

<comment><USER5> A part of me wishes all websites were like Berkshire Hathway [0]. No javascript. No jquery. No bullshit. Fast, legible, and unpretentious.

At the same time, we also love creative expression and individualism/branding.

Perhaps we've swung the pendulum towards the latter, which caused it to spin out of control in utter unpredictable chaos. Hijacking keyboard in a browser should NEVER be allowed. I don't care about any reason.

[0] [http://www.berkshirehathaway.com/](http://www.berkshirehathaway.com/)

<comment><USER6> Most of the actual content (the letters etc) on the Berkshire Hathaway site is in PDFs. Many are long documents with no navigation built in that are very awkward to read on mobile... As much as it's a nice example of a functioning barebones UI, it's not overall a great experience if it's main thing is serving PDFs. Unless I'm missing something, which I wouldn't mind learning, of course.

I agree with you about just leaving the damn keyboard alone though.

<comment><USER5> Perhaps BH is a bad example.

How about these:

[http://text.npr.org/](http://text.npr.org/)

[http://lite.cnn.io/en](http://lite.cnn.io/en)

[http://valentinpapon.com/](http://valentinpapon.com/)

More at the following link, but I warn you some of the websites go to a great extent in the favor of functionalism/brutalist expressions to the point where the damn thing is completely unusable. Cool though, very.

[http://brutalistwebsites.com/](http://brutalistwebsites.com/)

Also note the recurring themes:

      - Monospaced fonts
      - Full saturated blue #0000FF everywhere
      - unexpectedly large fonts
      - Retro 80's vibe (cursors, fonts, gifs, etc.)

:-) I find all of this very interesting.

<comment><USER7> For some reason, I can't scroll [http://valentinpapon.com/](http://valentinpapon.com/) on iOS.

<comment><USER6> Wow, I just though that was the end of the content but you are right!

</comment></comment></comment></comment></comment></comment><comment><USER8> It looks like someone was having some fun when they chose the photo of him smiling holding a (machine gun?).

<comment><USER9> Well to be fair, that's exactly how the rest of the world pictures Americans. Still seen as cowboys with guns.

<comment><USER10> Could you please not take HN threads on unsubstantive tangents at all, and especially not nationalistic flamebait ones?

</comment></comment></comment><comment><USER11> This post is pure fluff. Nothing surprising, nothing learned.

</comment><comment><USER12> > I also like people who get things done. If you've been working on your > startup for two years and have nothing to show, that's a pretty bad sign. > I've discovered that most people are really good at finding obstacles.

"Obstacles"? Okay:

I tried to install the Express (free but limited in the amount of data it would handle) version of Microsoft's SQL Server. After all the clicking for the install, which seemed to go well, the program would not run. Nor would it repair, uninstall, or reinstall. I had to reinstall the operating system on that bootable drive partition. Eventually I got SQL Server to install and run, wrote code for it, put data into it, etc.

> Just get started and deliver now. ... An extreme example of this is, I wrote > the first version of Gmail in a day!

Write code quickly?

Okay, I've done some of that: Back on OS/2, the e-mail program put one icon on my desktop for each e-mail message sent or received. It was also very slow for doing anything. Bummer.

But I'd long since learned and used Rexx (the elegant IBM scripting language by IBM's Mike Cowlishaw in England) and C and had used both for TCP/IP.

So, I got and read the basic IETF (Internet Engineering Task Force) RFC (Request for Comments) documents for e-mail and right away wrote my own Rexx code to receive e-mail. Less than a day. The next day I got a copy of a simple version of Sendmail and for sending e-mail had some Rexx code running in a few hours.

For the sending, I also implemented, again with Rexx, a simple feature for _nicknames_ for individual people and also for groups of people.

I liked it.

Since it was all command line driven, sending to a long mailing list was easy.

Soon I found that I really should be able to handle base 64 en/decoding so wrote some C code for that. Less than a day.

Worked fine for years.

The user interface was my then and still favorite text editor, KEdit, a PC version of IBM's XEdit.

But recently my motherboard got sick, and I have parts on the way for a nice, new computer. In the meanwhile, on my computer, dozens of times a day a Web browser at a site with a lot of JavaScript fails and a few times a day the operating system reboots. A few times a week I have to run the Windows CHKDSK on my boot partition. And the computer is so sick that Outlook won't install. Very sick computer: Problem seems to be on the motherboard between main memory and the processor.

So, I got my old Rexx-C based e-mail going again for sending. My computer is so sick I can't run the C compiler for my old C base 64 code so found some clever, nicely fast Rexx code for that and am using it. But now also need to decode "quoted-printable" so I wrote some code for that in Rexx in about an hour -- works great!

I don't have a copy of Sendmail, so for sending have started to use Gmail.

Sorry, Paul, I don't like Gmail! At this point, I'm so close to having my new computer up and running, I'm reluctant to write my own code from the simpler RFCs for sending e-mail so will stay with Gmail for sending.

I've written other code quickly:

(A) FedEx was about to die due to the BoD afraid of the challenges of being able to schedule the fleet when the growth got up to the plans. I was consulting and teaching computing and computer science at Georgetown University so got a time-sharing terminal to IBM's VM/CMS, and, in addition to the teaching, learned CMS and its editor and scripting language, designed and wrote some PL/I (which I was already good at), joined FedEx, all in eight weeks. Soon VP Roger Frock and I ran the code, pleased the founder F. Smith and the BoD, and saved the company.

(B) While in grad school, on a part-time job in applied math and computing, at one point the US Navy wanted an evaluation of the survivability of the US SSBN fleet under a special scenario of global nuclear war limited to sea. They wanted their results in two weeks.

I worked out some applied math, designed, wrote, and ran the software, and delivered in the two weeks, exactly. Some of the math was some Poisson process encounter rate work from the B. O. Koopman, _OEG-56 Search and Screening_ and some of the rest was on continuous time, discrete state space Markov processes subordinated to a Poisson process from

Erhan Çinlar, _Introduction to Stochastic Processes_ , ISBN 0-13-498089-1.

from which I'd recently had a course.

(C) For my startup, I wanted a good way to handle user session state. So, I wrote a session state server. Sure, Redis could have been used for that. What I wrote was so simple that it was less work than even reading the Redis documentation! So, I used de/serialization of class instances from/to a byte array sent/received via simple TCP/IP sockets and two instances of a Microsoft .NET collection class. The program is single threaded and uses the TCP/IP (first in, first out) FIFO input queue for synchronization. Works fine. That was about two days.

Hmm ... If I have 10 Web servers but just one session state server, then I won't need user _session affinity_ to the Web servers. But if I have 200 Web servers and one session state server for each 10 Web servers, then I will need user session state affinity to each of the 20 session state servers.

Hmm, what to do? Ah, to each user HTTP GET request, in my HTTP POST response am sending an encrypted GUID value and get GUID value back as the key in the session state server. So, ..., maybe I should bury in the GUID an ID of the relevant session state server. Then let each of the 200 Web servers go for each user to the session state server being used for the session for that user. Then for load leveling of the 20 session state servers, if usage data shows that that is worthwhile, then once a minute or so broadcast new assignments of session state servers to the Web servers?

(D) There was a sudden change in some banking laws, and a guy found a valuable optimization problem. He used simulated annealing, ran for days, and quit when tired maybe without a feasible solution or maybe with one but with no idea how close it was to optimality.

I got involved. The first problem was 0-1 integer linear programming with 40,000 constraints and 600,000 variables. I did some Lagrangian relaxation derivations, wrote some Fortran code, called the IBM Optimization Subroutine Library (OSL), and in less than an hour on a 90 MHz PC got a feasible solution guaranteed to be within 0.025% of optimality, all in two weeks.

But I can't always do things quickly:

To learn Microsoft's .NET, I started with

Jim Buyens, _Web Database Development, Step by Step: .NET Edition_ , ISBN 0-7356-1637-X.

which is beautifully done technical writing.

Then for the rest I went to Microsoft's MSDN and started finding, downloading, reading, abstracting, and indexing Web pages. It took a while, longer than an hour, week, or month, but I got about 5000 such from MSDN and about 1000 more from elsewhere.

That was about enough for my use of the .NET Framework, Visual Basic .NET (not the old Visual Basic 6.0 but close to equivalent to C# but with a different favor of _syntactic sugar_ ), ASP.NET for writing Web pages, and ADO.NET for communicating with SQL Server.

That was an "obstacle".

Sorry, Paul, such "obstacles" are just part of the work.

For my startup, all the work uniquely mine has been fast, fun, and easy. I saw the problem, thought of a very different, new solution with new data and some original applied math for getting the results for the users from the new data, and designed and wrote the code. The code is several programs communicating over TCP/IP with 24,000 statements in Visual Basic .NET in 100,000 lines of typing (lots of documentation with the code). It all runs as designed and appears ready for production. The code does not need refactoring, and there was no prototype code or "minimum viable product" code.

And, yes, the problem is one with no good solution but which essentially every user of the Internet in the world would like a solution on average a few times a week. So to a user, my solution is just a Web site. The monetization is via ads. So, sure, if people like my work, my little effort will be worth many times the $10 billion in the OP.

Summary

So, sometimes things are fast; and sometimes there are unavoidable obstacles.

<comment><USER13> Not sure if this is satire, but this sounds a lot like finding obstacles.

</comment></comment><comment><USER14> > "For example, Facebook had an offer from Yahoo for a billion dollars, which > everyone told Zuck to take. Fortunately, he said no. Had he said yes, it > would have been another failed Yahoo acquisition and Facebook would not have > nearly as much impact."

This is breathtakingly naive, idiotic or evil

Take your pick

It simply boggles the mind that he doesn't even _consider_ the possibility that Facebook not having "nearly as much impact" could be preferable to our current world.

<comment><USER15> I think he just means it's fortunate from Zuck/FB's perspective, not from the perspective of the rest of the world. The context is startup success.

<comment><USER14> Isn't "impact" generally about social change rather than monetary success?

For example, _" the Khan Academy has made a tremendous impact_".</comment></comment></comment>


Show HN: IT and software engineering jobs - <AUTHOR> https://www.staticjobs.com <comment><AUTHOR> IT and software engineering jobs in the US, Canada and the UK.

Our website is intentionally simple. Please, follow this link to learn more about us:

[https://www.staticjobs.com/about_us.php](https://www.staticjobs.com/about_us.php)

Don't shoot us for the staffing agencies, please. We're very well aware that nobody likes them. On the back-end we have everything to eliminate them from the search results. We cannot implement this functionality on the front-end yet for various reasons.

Job seekers, we are sympathetic with all of you and are committed to making your lives easier. For example, you won't see "great" stealth mode start-ups or established companies that are too "shy" to disclose their name. We require all job posters to publish their company name. Thus, no confidential or anonymous companies; you will know who you're sending your resume to.

As well, we realize that employers need to be educated. Eventually we're going to fix the problem with employers not posting pay rate, posting junk ads, programming assignments, tests and insane interviews and we may go as far as outlawing third-party agencies.

At this stage we're still in start-up mode and cannot be picky as far as job posters are concerned but our ultimate goals are above. Please, take a look at our site and apply for a job if you need one. And we would appreciate technical feedback again, especially how our site looks on tiny and huge screens.

UK and Canadian employers, we're giving free jobs to promote our business in your countries. Please, sign up and we'll give you as many free jobs as you want. There's nothing to lose. Worst case - you'll waste a bit of your time. Best case - you'll get a couple of resumes. We have traffic from these countries.</comment>


Ask HN: Would it make sense to have a website to keep track of your address? - <AUTHOR> I've moved 5 times in the last 7 years, and almost everywhere in the internet I have a wrong address.
Would it make sense to have a website which maps physical address to your login/password? It would still be anonymous, no names etc.
Then on other websites you would provide a token which would allow it to query your address from the main database.
So you only maintain in in one place, and every other website could be updating it if necessary when you log in.
I know the trick is that other websites must be willing to use it, but it seems like the way it should be done.
what do you think? <comment><USER2> This might be better done in a Password Manager. Whenever you register, make a record of the address you've used in your Password Manager, along with your password. Because I've also moved around quite a bit and have some older addresses under certain accounts, I make a note of this so that I can accurately say what my address is if I'm calling customer service, etc. Of course, I try to update all of my addresses, but sometimes I either forget to or cannot update my address.

</comment><comment><USER3> If you sign up for Credit Karma, they automatically do it for you ;)

When I purchased my house and signed with a mortgage company, they did ask me to list all of my addresses that I had ever lived at.. and asked me why I lived at so many places.

</comment><comment><USER4> I know the trick you are thinking, no one implement it for privacy reason.</comment>


Trello - A Big Update for the iOS App - <AUTHOR> http://blog.trello.com/ios-trello-2-4/

<comment><USER2> I use Trello everyday for work and personal. I recently downloaded the new app to my iPhone 4 running iOS 7 and certain boards crash the app when accessed. The only difference I can see is that the board that crashes uses labels.</comment>


Buffered Channels in Go: Tips and Tricks - <AUTHOR> https://www.rapidloop.com/blog/golang-channels-tips-tricks.html?h <comment><USER2> All of these tricks work with unbuffered channels as well. So it leaves the far more interesting question "When do you use buffered or unbuffered channels?" unanswered. Naturally, it depends a lot on the kind of system you want to build. Amking a channel buffered exposes the performance pitfall where a slow consumer is masked or hidden until it's supplier fills the buffer, and the real throughput is then exposed.

Edit: An interesting application of a buffered channel, for example, is when creating an object pool of finite size. Or, in conjunction with a timer, rate limiting a piece of code. I don't think I have ever considered a buffered channel in the typical producer/consumer setup.

<comment><USER3> Buffered channels are good for any use case where the different concurrent components operate on different cadences.

In degenerate cases that means that one of the cadences is inappropriately slow but in most cases it rounds out latency spikes and increases throughout.

For that matter I very rarely use zero size channels because if 2 things are on the same cadence why should I make them concurrent?

<comment><USER4> You have to be careful with that, though. Channels of size greater than one are _not_ async channels, which you do not say but are sort of implying. They will still block like size-0 channels if they fill up, for instance. The sort of workloads where they will meaningfully help your performance, and nothing else will, turns out to be smaller than most people's intuition will lead them to believe. It's a very precise combination of "usually I do nothing but sometimes I get 10 requests in under 10microseconds from on source and I've got enough CPU to handle them all simultaneously". Otherwise you're generally just as well of to use normal 0-sized channels and let the backpressure flow back to the receiver; in many "normal" workflows it won't even cost you latency because if you're CPU blocked anyhow you'll still be waiting on CPU, not channels.

Most people's intuitions about work distribution aren't very good either; if you break a process up into 5 pieces, your human brain will tend to estimate the five pieces as roughly the same size ("within an order of magnitude of each other"), when in the real computer world they will almost always be separated by multiple orders of magnitude in size. Evenly breaking up a task is usually quite hard and not something that happens accidentally. It doesn't help you all that much to use a 10-element channel if the producer is producing an element every 100 nanoseconds while the consumer is consuming one element per 10 milliseconds, both reasonable numbers, but separated by 5 orders of magnitude. The advantage of using a buffered channel is lost in the noise of the consumer, and it's not hard for it to be a net loss given the complexities buffered channels can involve if you accidentally code as if they are asynchronous rather than buffered-but-still-ultimately-synchronous. Zero- sized channels are more likely to exhibit any errors you made during development or QA rather than in production.

I don't think I've ever shipped a non-zero-sized channel in Go. Occasionally designs go through phases where they may have them, but they always come back out before I'm done. Even the "only allow X of a certain resource to be used" always seems to turn into "only spawn X goroutines that use that resource and feed them work off a channel that has no reason to be buffered".

<comment><USER3> Let me state explicitly, in either case you should be dealing with full channel cases.

I'd probably make a lot more use of empty channels if go had more sophisticated primitives around that. If I could say, publish to this channel until a timeout without all the overhead that is currently required.

As it stands (on my workloads), with unbuffered channels its hard to figure out if you have encountered a localized short term full channel or you've achieved some more degenerate case where you should be taking drastic load shedding action. Buffered channels make rough approximations of this very easy. Under normal operating modes this shouldn't be full. If it is sound the klaxon and begin load shedding.

And for most things that aren't pipelines, I simply don't think channels are very appropriate.

<comment><USER5> What?? Go channels don't have timeouts?

I had to read about this and I'm a little dumbfounded. Why wouldnt Go support timeouts for channels? The extra complexity seems huge especially if you wanted a timeout that was different than the library based hack -- for example if you wanted a timeout since last write.

I don't understand what the Go devs are protecting people from.

<comment><USER6> It's trivial to implement a channel read with timeout using select and time.After(). The first N google results for "golang channel timeout" show exactly that.

<comment><USER3> It's worth noting that eliminates the range option which means you need to handle all the edge cases around closed/nil channels by hand.

On the publish side in most production cases you don't want to use time.after as it leaks. So you'll use either a context or a timer.

All told it's a fair bit of boilerplate to get right everytime (which you can't _genericize_ ) which is why I tend to use buffered channels that are sized such that being full is a degenerate case.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Channels can be really useful but are massively oversold. Fortunately it has cooled off a bit in recent years but I still see heaps of go code that bends over backwards to use channels because "share memory by communicating blah blah blah", even in cases where using another synchronisation mechanism instead would radically simplify things.

</comment><comment><USER8> > If you do have pointers, or if the item iself [sic] is a pointer, it is up > to you to ensure that the pointed-to objects remain valid while it is in the > queue and being consumed.

Does this mean the producer have to keep pointer for the queued item around or it could get garbage collected? That seems.. unintuitive? Or is it just that working with the object could make the old pointer invalid?

<comment><USER3> The latter. The GC won't collect it while the pointer references it.

</comment></comment><comment><USER9> Interesting read. There are instances when you need unlimited capacity, and there is a proposal for it: [https://github.com/golang/go/issues/20352](https://github.com/golang/go/issues/20352) It doesn't look like it will make it as the maintainers are opposed to it.</comment>


Failure is part of learning - <AUTHOR> http://munyukim.wordpress.com/2012/05/26/failure-is-part-of-learning/

<comment><USER2> The "Fail early, fail fast" philosophy doesn't work unless you actually learn from failing.

<comment><AUTHOR> I agree , you have to learn from the failure for that philosphy to work

<comment><USER3> You also have to be in a culture/environment which appreciates and encourages learning from failure, rather than placing blame. See what we do at Etsy. <http://codeascraft.etsy.com/2012/05/22/blameless-postmortems>

<comment><AUTHOR> Thats quite an innovative way of handling problems</comment></comment></comment></comment>


Squad Wealth - <AUTHOR> https://otherinter.net/squad-wealth/ <comment><USER2> With the exception of streamers with a substantial regular audience, people taking active part in social justice events, and devs lucky enough to work on lively community projects, average people in my peer group have not started organically bonding into bands of Paleolithic hunter-gatherers of the information superhighway.

For example, I've watched a lot of roommate groups in shared houses fall apart as housemates pack up and go home to live with their parents.

This essay honestly feels like the author has transferred the style and cliches of mid-90s techno-utopianism into an essay promoting the benefits of neoprimitivist permaculture, buzzwords and all.

<comment><USER3> I'm starting to see something like this happen with devs that pursue many contract work (non community projects) and pool effort/work and split the spoils (its a group of two, one usually does db stufff, one usually does application stuff, but both can write/ship code. I might work with them in the future, working with one them now).

But overall, I'd agree, something like this is a non starter if each individual in a "squad" cant some how contribute meaningfully in part to its wealth.

Analogy might be to a specops squad to killing: might have a sniper, a couple of riflemen, a grenadier/demo, someone who can handle heavy weapons, and maybe a tactical communications/CAS person; all them can kill you in their own way and in a variety of environments, missing one reduces their ability in said environments.

</comment></comment><comment><USER4> With the amount of memes used throughout and constant informal langauge i'm not sure if this is a serious post or if i'm missing out on a joke. Not really sure if it was trying to put specific point across either

<comment><USER5> It's serious, though I agree it's a bit muddled in all the memes and references.

The core point as I understood it: the internet is quickly blurring the line between a company and a group of friends working together. Two of the limiting factors are our communication tools and financial/corporate structures.

My take: as this model become more prevalent, more alternatives to traditional employment and education routes open up allowing creators, researchers, and engineers to work on interesting problems without having to find one another through educational institutions and corporations.

<comment><USER6> Is there even a legal distinction in the US? Germany has a somewhat complicated and sometimes surprising law around all of that, but essentially you can form a "company" without any official acts. It's not necessarily a company to earn money, it's mostly about liability, e.g. who pays when it falls apart.

I couldn't quite make it through all the memes, because I found them too annoying, but I believe that, at least over here, the Squad would likely form a GbR ("Gesellschaft bürgerlichen Rechts"), which includes individual liability for everything done within that company. It's somewhat fuzzy what's part of the Squad's work, but essentially you could be on the hook for something your buddy does with your personal savings, without limit. It's probably better to formalize it and choose a limited liability company.

<comment><USER7> Sounds like a "partnership" where the liability for debts are shared between partners (as is income and equity).

Australia has 3 "corporate" trading structures and trusts for holding assets:

* Sole Trader

* Company

* Partnership

[https://www.business.gov.au/planning/business-structures- and...](https://www.business.gov.au/planning/business-structures-and- types/business-structures)

</comment></comment></comment></comment><comment><USER8> Anecdotal observation but from living in a kind of squad in my early 20s, two main problems ripped ours apart: 1) wealth distribution among unequal contribution and 2) romantic relationships and the changing dynamic they introduce.

When I think about groups that survive they seem to either have strong top- down power hierarchies (as in the cult or the corporation), or otherwise de- emphasize money and sex (as in the monastery).

<comment><USER9> > When I think about groups that survive they seem to either have strong top- > down power hierarchies (as in the cult or the corporation), or otherwise de- > emphasize money and sex (as in the monastery).

There's also the 'clan', essentially an extended family with strong financial and social ties, often treating wealth quasi-collectively. Varies by culture and era, but my clan (in the Mediterranean region) has been around in current form for about 100 years and is fairly resilient. Varying incomes and romantic relationships (among other things) cause problems here too, but the social structure has developed ways to manage them. There's a fairly elaborate culturally rooted system of gifts, obligations, unofficial hierarchies, etc. that keeps some of it working.

<comment><USER10> That's super interesting, can you expand? How is wealth treated quasi- collectively despite varying incomes? Is it shared between members? Or do members help with certain expenses like education, health, housing? I'm rather curious about this

</comment></comment></comment><comment><USER11> I have to hold myself back from "Oh brother"ing and scoffing myself to death with this, because I respect the fact that they're paying attention and their ideas aren't so mired in the past the way mine, basically, are.

</comment><comment><USER12> There's a 600 acre plot of relatively cheap land near me that I 2/3rds joking suggest me and friends should go in on together and start a hi tech commune. So far plenty of interest but no commitments. :(

<comment><USER13> What does something like that go for?

<comment><USER14> It can vary a lot depending on location, but here's a search on zillow to give you a sense of the market in California:

[https://bit.ly/3gEqOkw](https://bit.ly/3gEqOkw)

(bitly link, because the URL specifying the search filters is unreasonably long)

</comment></comment></comment><comment><USER15> This essay is both extremely poignant and nearly unintelligible, which is a vibe.

</comment><comment><USER16> I am careful with that word. I start with

[https://en.wikipedia.org/wiki/Squad](https://en.wikipedia.org/wiki/Squad)

and would expect it to mean "8-14 members" \-- if at all possible I would call a 20 person organization a Platoon comprised of 2 squads.

<comment><USER17> The article seems to agree with you:

> the ideal squad count is no more than 12.

<comment><USER18> Which is dumb, because that's around the size forums die forever due to lack of individual posters

<comment><AUTHOR> These squads are supposed to exist in a different format: as group chats where everyone knows everyone else.

</comment></comment></comment></comment><comment><USER19> I get the vibe. Squad, maybe not. But collective? Gang? Tribe? Yeah, that's been a thing for a while, but it really accelerated lately. It's easy to stumble upon the "permeable boundaries" Heather Marsh writes of online and create an organism that isn't a legal entity and isn't for life. And there's more of them all the time.

</comment><comment><USER20> I heard Michael Munfer on a podcast recently taking about higher education - that it is being dis-intermediated or broken down (cannot remember the right term)

And he suggested a new university that is likely to arise - where there is no campus but you are housed with (your squad) you get weekly tickets to the Proms or a new theatre etc etc. A whole rounded but decentralised education

I think not that squads are our future but the active conscious creation of them are

<comment><USER21> A word I've often heard for the "dis-intermediated or broken down" sentiment is "unbundled", by the way.

<comment><USER20> Thanks !!! That's what i meant :-)

PS Michael Munger not Munfer

</comment></comment></comment><comment><USER22> Small cliques of ~12 users is pretty much the long tail of Discord servers.

</comment><comment><USER23> I related pretty strongly to this. If you didn't, I highly recommend trying to form a tight-knit little group or two like this. It's really great.

<comment><USER24> Seconded. I notice a lot of comments scoffing at this and talking about group disintegration - have now been part of the same "group chat" / squad for 6-7 years and it was inchoate but there even before then. We do everything described in the essay. Reading it was eerie.

<comment><USER23> Ya, I felt the same way. Like they had been reading our channel or something. Good to know other people are doing the same thing.

</comment></comment></comment><comment><USER25> I thought I was gonna hate this but I ended up enjoying it a lot haha, thanks for sharing!

</comment><comment><USER26> Makes me think of the bash' from Too Like the Lightning

</comment><comment><USER27> Twenty-somethings often think that friends are more important than family, and friendship groups will last forever. They're not.

</comment><comment><USER28> This sounds like the kind of thing a couch surfer with no family or job would be really amped by.

<comment><USER29> It appeals way beyond that. Marginalized groups have known that concept since... well, forever. It's "chosen family" or "framily" (friend family) in the circles I'm familiar with.

The more technical term is "intentional communities". If you search for it, you'll find an extremely wide range of them. This particular "squad" thing has more of a tech bent, but it still falls within that concept.

The page also highlights one of the problems that squads face - it's a highly cohesive group with very closely aligned interests. That often makes their communication less interesting/understandable/relatable to outsiders.

(Which poses an interesting problem - the more uniform the group becomes, the more efficient in-group communication is. To the point where you cannot attract new members to the group, and it slowly withers away)

<comment><USER28> Those concepts don't give me the couch surfer "all you have to do is bottom-up the economy" but "you'll mostly be paid in memes" vibe.</comment></comment></comment>


Trying to Value Online Privacy - <AUTHOR> https://www.schneier.com/blog/archives/2014/01/trying_to_value.html

<comment><USER2> According to the abstract, a better title would be:

How much more would the average consumer be willing to pay for a given app, if it didn't collect any personal info or show ads?

In that context, their conclusion of "about $5" seems more reasonable, and encouraging.

</comment><comment><USER3> If anyone knows of additional research on the value of privacy please pass it along.

<comment><USER4> I am doing research on the value of information. From an economic perspective one could argue that the value of privacy can be inferred by the value of the lack thereof. I am not strictly of this opinion, but let's assume that works as a heuristic for argument's sake. Still the problem is that I am leaning towards the opinion that information has no intrinsic value and value comes from the processes that surround its use. Improvements in information processing capacity would therefore increase the value of privacy but we would also not be able to assert a value on our own privacy not knowing how the information that breaches it is used.

The truth is that privacy is much more complex to assess. In the context of our social existence we customarily sacrifice parts of our privacy to assert identity. On the other hand we do so in communication contexts. Communication has attributes that limit its scope (geographical, temporal etc.) It is very difficult to understand the impact of the acceptance of an overarching and limitless communication context, whether that is with a company or with a government.

If you are interested in the outputs of my research do not hesitate to pm me and I will keep you posted.

</comment></comment><comment><USER5> Sounds about right.</comment>


Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks - <AUTHOR> https://www.bleepingcomputer.com/news/security/sennheiser-headset-software-could-allow-man-in-the-middle-ssl-attacks/ <comment><USER2> Have any hardware companies _ever_ written good accompanying software? From all the custom-ui graphics card config nonsense to utilities that phone home of their own accord, to things like this which are laughably awful.

I feel glad I left for the mild shores of Linux in the early 00s.

<comment><USER3> Apple?

<comment><USER4> iTunes for Windows is hot garbage

<comment><USER5> They want you to buy a Mac. It's likely somewhat intentional.

<comment><USER6> iTunes for Mac is slightly less-hot garbage.

They need to refactor the monolithic app that does everything into smaller, more focused apps. My media player shouldn't also do document management for my phone.

</comment></comment></comment></comment></comment><comment><USER7> > the software was also installing a root certificate into the Trusted Root CA > Certificate store.

This kind of stuff shouldn't even be legal.

<comment><USER8> As a bit of a layman, is there even any legitimate reason at all (other than a user installing it in their own machine for reverse engineering purposes) for anyone to install a root certificate anymore?

I could understand it if it was a small company doing so at the time when certificates were expensive, but Sennheiser has plenty of money and certificates can be obtained for free nowadays.

<comment><USER9> I run some services for my private use. It's crazy that I need to have them certified by some third-party over-seas CA since I can't get my own devices to trust my own certificates.

We're not at that point yet, but running your own trust root is getting quite annoying. For example, Android constantly nags about "network might be monitored" when custom certificates are installed.

<comment><USER10> _Android constantly nags about "network might be monitored" when custom certificates are installed._

It won't if you add name constraints to your root certificate (because then it can't be used for blanket monitoring).

<comment><USER11> Does this actually work now? A name-constrained CA (or even its CSR) used to break things in absolutely hilarious ways.

</comment></comment></comment></comment></comment><comment><USER12> I'm a little lost on why the need a new root CA cert on a computer that already has a cert store.

Can't they safely communicate with whatever.sennheiser.com using the existing certs? Afaict, this isn't a stand-alone device trying to communicate, but your computer, running some app.

What am I missing?

Edit: okay, I see below that they are using a local web server, and (thanks to browser decisions about localhost) it requires https.

<comment><USER13> The really silly thing is that it's 2018 and the browser vendors _still_ refuse to implement name based constraints on certificate authorities. It should be perfectly reasonable for a local, single domain CA to be generated and installed with the application. Instead we treat every CA as worthy to handle every domain always.

<comment><USER11> I'm not sure that's a browser thing.

The X.509 spec specifies a field for that, which in OpenSSL would be called "subjectNameConstraints". The rules for the constraint can be found in RFC5280.[0] Mozilla have had an open development track for CA name constraints for quite some time, but the last edit to the page is from 2015.[1]

I tried to actually use this field couple of years ago, and none of the existing tools I tried had any support for it. OpenSSL would fail to parse a CSR config with this key. Same for Go's TLS library.

So of course I did what any enterprising hacker would do: I created a CSR manually with the correct OID in place. Trying to _sign_ that was nothing short of hilarious. Loading up the CSR into OpenSSL would trigger a BIO_read_* error. Trying the same with Go's TLS library triggered a panic!

I then realised that if you could somehow supply a certificate chain with a name-constrained CA in it, it would act as a highly reliable DoS against virtually all clients. (Probably against servers too, if you supplied a client-cert chain.)

Based on discussions since, I have been informed that Microsoft's TLS stack supports this - or at least should be technically capable of issuing CAs with the field in place. But because practically nothing else in the world has the support, and is in fact likely to crash when presented with one, even a gradual rollout is simply not possible.

Hence every single CA you see will be valid for *.

0: [https://tools.ietf.org/html/rfc5280](https://tools.ietf.org/html/rfc5280)

1: [https://wiki.mozilla.org/CA:NameConstraints](https://wiki.mozilla.org/CA:NameConstraints)

<comment><USER14> Another simple mitigation would be the ability for one certificate to be signed by several CAs.

We could combined with some DNS records that states the policy for validating the certificate (stating the number of CAs to validate a given certificate).

It could be a huge improvement on security, and eliminating CAs as single point failures for the whole internet, at least for critical pieces of it.

</comment></comment></comment></comment><comment><USER5> Why are they deploying their own certificate into the root store????

This is shocking behaviour. What's the difference between this and malicious software.

<comment><USER15> the problem is not that they add a root ca to the store. the problem is that they use the same Root CA on every computer in the world AND adding it into the Store AND having the Root CA PRIVATE KEY on ANY computer.

<comment><USER9> > the problem is not that they add a root ca to the store.

Yes there is. There is no valid reason for a glorified headphone driver to mess with what website your browser trusts.

<comment><USER16> There is a valid reason: to enable website-to-hardware communication (i.e, to provide a javascript-based api for websites to interface with that hardware).

Ideally browsers should implement well standardized, secure APIs for all devices in the world, but we are far from there. Until browser vendors implement the API you need, the only option is to employ this trick.

Of course, companies should NOT reuse the same certificate between installations though (just generate a certificate during the installation process and life is good again).

<comment><USER15> > Ideally browsers should implement well standardized, secure APIs for all > devices in the world, but we are far from there. Until browser vendors > implement the API you need, the only option is to employ this trick

well not only browsers, os's in general ;)

</comment></comment></comment></comment></comment><comment><USER17> From smart TVs to this. How awful.

Software is eating perfectly good peripherals and _totally_ ruining them.

</comment><comment><USER18> The comfort in this article is knowing for every boutique german headphone company that insists on becoming a CA, there are thousands of nameless chinese companies producing superior products at lower prices that do to some measure respect the users privacy in that they arent more than just a USB peripheral.

Sades and Xiberia for example make perfectly useful (if not a little bit cyberpunk) headsets that just operate as USB soundcards with no special CA requirement.

And if you're just in the mood to listen to some music without special software in this foul year of our lord 2018, Might i suggest a pair of Superlux 668B's? for ~$40 theyre easily better than anything Sennheiser produces that requires its own PKI.

<comment><USER19> I know this is really nitpicky, but is Sennheiser really a "boutique" company?

I was under the impression their maybe one of the biggest and most prominent headphone manufacturers in the world, especially when measured by R&D.

<comment><USER3> Exactly. The funny thing is the most of 'boutique' headphones companies are small Chinese vendors now, mostly unknown for the Western people outside of HeadFi forums.

</comment></comment></comment><comment><USER20> This seems like pure laziness. Did the developers really not have an understanding of basic PKI? Or did they realize late in the game that their local web socket was gonna require HTTPS and slap this on at the last minute?

<comment><USER3> Why should developers care if customers don't?

Do we know about a one B2C company who lost the business due the security breaches in their products?

</comment></comment><comment><USER21> Hmm, I recently picked up a pair of pxc 550s (crazy good black Friday deal), and I saw the thing about installing their android/iphone app to do NFC pairing, but I frankly have no idea why you would want that, or really much of anything else in the app. The reviews even mention that the eq controls don't even work for DRM'ed content.

OTOH, it seems if you pair the headphones with normal bluetooth its just using A2DP/SBC and the audio quality is _miserable_. Maybe its using a custom bluetooth profile/a2dp codec?

Basically, why exactly do they even need a full blown app?

(on a further side note, I've gotten to the point where I don't really even notice AC and computer fan noise so much so that while a couple of coworkers complained about it, it wasn't until I tried the PXC 550's at work that I realized our AC blowers are really _LOUD_. With the 550's the constant low frequency rumble is just gone. I guess my earplugs just wern't blocking that much low frequency.).

<comment><USER22> RMA for miserable sound ?

<comment><USER23> Bluetooth is absolute garbage for serious audio. Wired will always sound better, and a DAC + Amp driving the cans will always sound the best.

Sennheiser does make BT headphones with a dedicated tower that helps a bit, but nothing can replace a hard line.

<comment><USER24> > Sennheiser does make BT headphones with a dedicated tower that helps a bit, > but nothing can replace a hard line.

Their RS line of headphones don't actually use Bluetooth. Their older ones use the Kleer protocol, while the newer ones use a proprietary wireless protocol. Lossless audio in either case.

</comment></comment></comment></comment><comment><USER25> HN discussion and original report - [https://news.ycombinator.com/item?id=18550854](https://news.ycombinator.com/item?id=18550854)

</comment><comment><USER26> How does the process of getting the certificate installed work? Does the user manually accept the installation at any point? Or is part of the blame on Microsoft for allowing this?

<comment><USER27> You "just" need admin priv's to install one. there are "legit" reasons for using one atm (how else do you communicate with a localy running application from a site using SSL/TLS without using a browser extenstion? I honestly want to know as it would be handy for a project i'm working on).

For example Battle.net have a per machine generated CA that gets installed when you install BNet (which is why it recently started asking for admin privs to install / update instead of just asking for them when installing a game).

Its used for talking to BNet when following a battle.net link which can be used to prompt you to join BattleNet groups and other things. They used to use a cert signed by a public CA but that's is frowned upon (as the only way the client could really use it is if it knew the key for the cert which would lead to either a million localhost.bnet.tld (I don't remember the actual hostname so pulled one out of the air) certs or a shared cert with a million people who could access the private key if they went looking hard enough). They made a forum post about it when the issue about their own self signed CA started showing up everywhere [0].

I believe Spotify do something similar so things like open.spotify.com and other widgets can control the locally running spotify app.

MS themselves have a certtool in Visual Studio to create and add certs when dev'ing using the latest builds of ASP.NET Core 2 as the default for new projects is to use SSL (but iirc the cert tool VS uses does give you a prompt about it installing a cert).

[0] [https://us.battle.net/forums/en/bnet/topic/20760626838](https://us.battle.net/forums/en/bnet/topic/20760626838)

</comment></comment><comment><USER28> It would be strange if it wasn't allowed.

You are the man in the middle of a headset.

</comment><comment><USER29> All the technical mistakes aside, yet another illustration of why I refuse to use wireless peripherals. They're uniformly shoddy at best, dropping connections or having difficulty pairing often. The idea that headphones should need software strikes me as insane.

<comment><USER30> This is why Apple's AirPods have been so popular. They really work quite well, compared to any other wireless headphones I've used. Easier pairing and better connections.

<comment><USER31> Also, surprisingly durable. Around April I accidentally left them out of their charger and outside in the pocket of a foldable chair when I went out of town for 1 month. It rained on them multiple times. When I found them I was sure they would be broken.. I charged them up and I still use them daily. No issues.</comment></comment></comment>


Show HN: Quire for Android, in Google Flutter - <AUTHOR> https://quire.io/blog/p/Introducing-Quire-for-Android.html <comment><USER2> It's interesting to know a serious, business app built by Flutter which is still in alpha. Is it stable?

<comment><USER3> Last week we announced that we'll ship a beta in the next couple of months. Flutter is pretty stable - we're just working on scenario completeness in a few areas (performance, accessibility, a few more widgets).

For those who are interested, there's a great demo of building an app in Flutter here: [https://www.youtube.com/watch?v=iflV0D0d1zQ](https://www.youtube.com/watch?v=iflV0D0d1zQ)

(Disclaimer: I work on the Flutter team.)</comment></comment>


An Open Letter from Brian Krzanich, CEO of Intel, to Technology Industry Leaders - <AUTHOR> https://newsroom.intel.com/news-releases/security-first-pledge/ <comment><USER2> > Security-First Pledge

So, I take it Intel will be sharing lots of info about the Intel ME, as well as supported ways of disabling it? Or am I getting my hopes up?

<comment><USER3> I think you are reading this bit of PR far too optimistically.

For example, where in this statement does it say that Intel is actually going to change the way they design their chips to make them more secure? It doesn't. It only says that they will be more transparent about disclosing vulnerabilities, and presumably that means they will continue to disclose those security holes to the so-called "Tier 1" group, which excludes quite a few projects.

The most interesting thing to me was the subtle shift of responsibility onto vendors and consumers to make sure to patch their broken hardware promptly.

</comment></comment><comment><USER4> > In particular, we want to thank the Google Project Zero team for practicing > responsible disclosure, creating the opportunity for the industry to address > these new issues in a coordinated fashion.

I understand this a PR piece, and thus the use of the term "responsible disclosure". I believe the HN community disapproves of this terminology, and prefers usage of the term "coordinated disclosure".

The question that I had was whether Google's project zero team prefers one term over another? Or in general, if you're a security researcher and have involved in reporting vulnerabilities - can you take a stand and emphasize "coordinated disclosure" term in your own articles?

Edit: typos

<comment><USER5> Thanks for pointing out this little gem. I hope Google can be a little less responsible for independent company intel in the future.

<comment><USER6> Google didn't respect the embargo for the financial sake of Intel but for both it's own sake and the sake of all of it's users, as well as most computer users out there regardless if they use Google services or not.

Sure Intel put a PR spin on it, but any company would do that, but at least the patches were ready from the get go even tho the information started leaking a week prior to the official embargo date.

Would you rather having to wait 2-4 months without any mitigating solutions other than turning off your PC?

People are focusing too much on Meltdown, it's not the worse variant of Spectre, Variant 2 is much worse, and the possibility of future variants is even scarier.

I don't see anything wrong with companies spending 5-6 months on coordinating mitigation and fixes as well as building knowledge that can be used for future research and prevention of similar vulnerabilities.

<comment><USER7> You seem to be assuming no one else found and exploited the vulnerability in the meantime.

<comment><USER6> Say someone has found it before, it's likely better to have 1 nation state exploiting it for 3 more months longer than every script kiddy on the block.

These vulnerabilities affect nearly every CPU on the planet across all major CPU vendors, this isn't something your disclose immediately to teach someone a lesson or just to watch the world burn.

Do you think Google would want to leave their infrastructure vulnerable for months?

</comment></comment></comment></comment></comment><comment><USER8> I am curious how the BIOS/Firmware updates will be managed. Microsoft points to manufacturer. Manufacturer may 1) not be in the consumer personal computer market, or 2) even if the manufacturer is still in the business of selling computers may no longer be supporting specific devices. I'm specifically thinking of Toshiba, but there may be other examples out there.

Ideally there will be a way to safely update BIOS/firmware directly from Intel.

<comment><USER6> You don't need to wait for a BIOS update.

On Linux download the microcode and update it manually.

On Windows use the VMware Microcode installer and download the microcode from Intel and use that to update the Microcode on your machine.

On Windows you'll need to edit cpumcupdate.inf to remove the AMD microcode files if you don't want to download the microcode from both vendors since the VMware tool needs both to work properly.

Microcode update from Intel: [https://downloadcenter.intel.com/download/27431/Linux- Proces...](https://downloadcenter.intel.com/download/27431/Linux-Processor- Microcode-Data-File?v=t)

VMware Microcode Installer: [https://labs.vmware.com/flings/vmware-cpu- microcode-update-d...](https://labs.vmware.com/flings/vmware-cpu-microcode- update-driver)

<comment><USER9> I tried this and have the driver installed and the Get- SpeculationControlSettings Powershell module reports hardware support now. But I can't get windows to enable support, I've tried setting the registry keys in the referenced KB article [https://support.microsoft.com/help/4073119](https://support.microsoft.com/help/4073119)

I suspect that the driver loads to late, that windows has already done it's check to enable support before the driver loads the microcode update and I can't find anything about re-running the check or anyway to load the driver before that check.

Output from Get-SpeculationControlSettings Powershell module

        ---

        Speculation control settings for CVE-2017-5715 [branch target injection]

        Hardware support for branch target injection mitigation is present: True
        Windows OS support for branch target injection mitigation is present: True
        Windows OS support for branch target injection mitigation is enabled: False
        Windows OS support for branch target injection mitigation is disabled by system policy: False
        Windows OS support for branch target injection mitigation is disabled by absence of hardware support: False

        Speculation control settings for CVE-2017-5754 [rogue data cache load]

        Hardware requires kernel VA shadowing: True
        Windows OS support for kernel VA shadow is present: True
        Windows OS support for kernel VA shadow is enabled: True
        Windows OS support for PCID performance optimization is enabled: True [not required for security]

        Suggested actions

        * Follow the guidance for enabling Windows Client support for speculation control mitigations described in https://support.microsoft.com/help/4073119

        BTIHardwarePresent             : True
        BTIWindowsSupportPresent       : True
        BTIWindowsSupportEnabled       : False
        BTIDisabledBySystemPolicy      : False
        BTIDisabledByNoHardwareSupport : False
        KVAShadowRequired              : True
        KVAShadowWindowsSupportPresent : True
        KVAShadowWindowsSupportEnabled : True
        KVAShadowPcidEnabled           : True

<comment><USER6> That is strange what CPU/OS combo? this worked on my desktop and laptop, try rolling back the Jan 2018 update and then push it again with the new microcode there shouldn't be any difference the OS reads the microcode either from it's own partition or from the UEFI partition (BIOS) which ever is newer is used.

</comment></comment></comment></comment><comment><USER10> Didn't mention anything about how it would have been a good idea to sell all your stock 2 weeks ago.

</comment><comment><USER11> "There has been a disturbance in the kitchen..."

</comment><comment><USER12> The smug face you see there, friends, is that of a man with 39 million reasons not to care about this security-first pledge which someone else wrote.

<comment><USER13> Please don't post rage rants to HN, regardless of how you feel about someone or how their company did a thing you don't like. You may not owe better to the CEO of Intel, but you owe better to this community if you want to keep commenting here.

<comment><USER12> You are right, my apologies. I don't think deleting comments is allowed but I'll keep this in mind in the future

<comment><USER13> Appreciated!</comment></comment></comment></comment>


Google Engineer Builds Facebook Disconnect - <AUTHOR> http://techcrunch.com/2010/10/20/google-facebook-disconnec/ <comment><USER2> You know you're heading down a rocky road when third parties are creating your app's privacy functionality.

<comment><USER3> s/third parties/Google/

(I realise this isn't an official Google product)

</comment></comment><comment><USER4> You can use FacebookBlocker to accomplish the same thing with extensions for Firefox, Safari, and Chrome:

<http://webgraph.com/resources/facebookblocker/>

</comment><comment><USER5> A browser extension to block a single service?

Use a general "browser firewall" and add <http://*.connect.facebook.*/*> to the list of blocked urls...

<comment><USER6> The browser extension is useful, even more so for non-technical people: you click a button and it's installed.

<comment><USER7> How many non-technical people do you know that use Chrome as their primary browser?

I ask this because while I know plenty of tech savvy people that use Firefox, I'm in the minority on the Chrome/Chromium front amongst them, and I don't know a single non-technical person who uses Chrome.

<comment><USER8> I know quite a few non-technical person who use Chrome. I cannot guarantee that they know how to install an extension though. Most of the non-tech people uses internet primarily for FaceBook and they shouldn't be concerned when they see their FaceBook on say, CNN.com.

<comment><USER6> Installing this extension is as easy as clicking the big Install button on its page and then click Install when Chrome asks you whether you really want to install the extension.

<comment><USER8> You still need to go to Chrome extension website right? It's not that when you go to a website that has FB connect, the Chrome asks if you want to block it or not. That would be effective though.

<comment><USER9> FWIW, you do not need to go the Chrome extension website to install an extension. It can be hosted by a 3rd party via a simple link on any website.

<comment><USER8> Yes, I get your point, but if you take an example of CNN, they are not going to have a link to disable FB Connect.

<comment><USER6> Right. But they aren't going to have an explanation on how to block FB connect with your firewall, so it's not really a disadvantage of an extension.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Direct link to the Chrome extension: [https://chrome.google.com/extensions/detail/ejpepffjfmamnamb...](https://chrome.google.com/extensions/detail/ejpepffjfmamnambagiibghpglaidiec)

It is a bit odd to blame this on Google unless the guy created it at work. From the page: "the work here is entirely my own and in no way endorsed by Google."

edit: disclaimer is on the actual download page!

</comment><comment><USER11> Of course one should be 'worried' about privacy with his/her data on facebook, but i don't think one should care less with the information google has about a huge amount of people.

Just as a reminder: they know what you look for on the web (google itself), they know what you talk to your friends (gtalk), they know what you get via email (gmail), they know what videos you watch to (on youtube) and they now even have a browser which is being adopted by a lot of people pretty fast.

Maybe one does not use all those services but many people do, and depending on how you look at it, probably google has a lot of more 'private' information about one's life than facebook.

That, of course, doesn't mean 'FB disconnect' is a bad idea. It's just that i get 'scared' when someone who know a lot about you (google in this case) build something trying to look as they 'protect your privacy'... (i also keep in mind that google is not prone to providing data about users, but they have the ability to)

<comment><USER12> Why is it bad if google or facebook know a lot about people? Can you give me some examples?

<comment><USER13> Pooling all of that information into one place is begging for it to be abused. Would you still be asking the same question if it was s/Facebook/NSA/g or s/Google/FBI/g or even s/Google/KGB/g? Once all of this information is in place how hard do you think it will be for such organizations to get access to it? Just because the 'big bad guberment' isn't the one doing the collecting doesn't mean that the information cannot be abused internally, or externally to the company compiling it.

<comment><USER12> Usually these discussions sound like some people are worried that the corporations themselves will do something bad with the data (sell you more stuff you like ! _gasp_!).

Government misusing data is the only thing I could think of. But what's the evidence for that fear? If the organisations you mention wanted to go after people, can't they already do so?

With this kind of reasoning, the internet itself should qualify as a huge setback to privacy. The point is that the advantages far outweigh the disadvantages.

</comment></comment></comment></comment><comment><USER14> I'm hoping a Facebook engineer designs something similar for Google's privacy issues...

<comment><USER15> An Adwords blocker for Chrome?

An tool which automatically logs you into Facebook when presented with a choice of OpenIDs which includes Google's?

</comment></comment><comment><USER16> I do something similar with adblock filters. I don't use Facebook, so I have no privacy issue with connect, but it does improve load/render times by multiple seconds.

<comment><USER17> I too don't have a facebook account and the worst issue with Facebook connect is, its login box steals keyboard focus and completely annoys my browsing experience.

I hope he releases this as Firefox extension too.

<comment><USER18> FacebookBlocker <https://addons.mozilla.org/en-US/firefox/addon/212323/>

</comment></comment></comment><comment><USER19> What's interesting to me is that this is done in Chrome, which has given eg, Adblock some trouble since it does not really allow extensions to change the page content, only hide parts of it. Would be interested in a technical look at how it's managing to filter out the facebook bugs given that limitation -- or has Chrome been updated to give extensions more power?

<comment><USER20> knowing nothing else about chrome extension development:

Rapportive appears to modify page content in chrome

</comment></comment><comment><USER21> I do this system-wide on OSX via Glimmer Blocker (<http://glimmerblocker.org/>) using a modified version of the Facebook Like filter on their wiki (<http://glimmerblocker.org/wiki/Filters>). Has a nice bonus of speeding up page load as well.

</comment><comment><USER22> Can't this be blocked on a FB level already? I don't see those "FB Connect" boxes anymore. To be honest, I cannot even remember what setting I changed in FB, but it seems to work. (I also have disabled applications and not sure if this makes a difference but I use Adblock Plus as well.)

</comment><comment><USER23> This cannot be good for Google. If I was an exec at Google I would be very nervous about this. This is a good excuse and opportunity for people to start writing more ad blocking plugins. I am sure Google would not want that.

</comment><comment><USER8> It's a blessing for people like me who see the 'you are not authorized to visit this site and will be reported' kind of message on your office computer.

</comment><comment><USER24> another great extension for improving sanity and privacy on facebook is f.b purity. The app blocking functionality, helps protect your privacy from all those spammy quiz and game applications that appear in your newsfeed <http://www.fbpurity.com>

</comment><comment><USER25> Come on, we already have a perfectly good protocol for this, OpenID. It's unfortunate how big companies try to lock users in their own authentication services rather than educate them about OpenID (although I think the new JanRain widgets turn OpenID into a "Connect with X" service, which is great).

<comment><USER26> OpenID is not a perfectly good protocol. It is a total mess. Implementing it is an exercise in pulling teeth. Every major implementation was vulnerable to a timing attack until recently, which severely compromised the security of both sites which actually accept OpenID. The user experience is an abomination which requires users understand concepts which strike them like ancient Aramaic. Half of the spec, which you have to implement, is devoted to requirements put there for ideological reasons which no user is actually interested in (delegation). The core use case -- that any site on the website can ask for your holiest of holy credentials and you should just give them out -- appears to be the world's most widespread phishing attack, organized by sleeper agents planted on the spec committee whose dark masters tasked them with undermining everything we have ever taught users about password security.

<comment><USER19> Delegation is of great interest to anyone who runs their own web site but prefers to not run their own openid server.

(Won't touch the other trolling.)

</comment></comment></comment><comment><USER27> If you are that worried about Facebook privacy, just create a fake account and stuff it with fake data on your fake persona. This way, not only you will be expressing your disdain for Facebook's lack of privacy, you'll also be saying to Facebook: I don't like you but I use you ;-)

Or better yet, use OpenID.</comment>