The Greatest Good: What is the best charitable cause in the world? - <AUTHOR> http://www.theatlantic.com/business/archive/2015/06/what-is-the-greatest-good/395768?single_page=true <comment><USER3> Can't believe, no one has posted this yet.

[https://en.wikipedia.org/wiki/GiveWell](https://en.wikipedia.org/wiki/GiveWell)

"GiveWell is an American non-profit charity evaluator and effective altruism- focused organization.[5][6] Unlike any other charity evaluators, GiveWell focuses primarily on the cost-effectiveness of the organizations that it evaluates, rather than traditional metrics such as the percentage of the organization's budget that is spent on overhead.[6][7] GiveWell recommends several charities per year. In 2014, its top recommendations were the Against Malaria Foundation, GiveDirectly, the Schistosomiasis Control Initiative, and the Deworm the World Initiative."

<comment><USER4> I'm guessing no one posted it because there was a whole section in the original article on GiveWell.

<comment><USER5> Also [http://www.agorafund.org](http://www.agorafund.org) Allows you to give to basket of charities selected based on principles from effective altruism.

<comment><USER6> Just an FYI that the "administration fee is 5%. Additional PayPal processing fees may apply." [http://www.agorafund.org/terms-of- service/](http://www.agorafund.org/terms-of-service/)

</comment></comment></comment></comment><comment><USER7> Clearly the SENS Research Foundation, as a 501c3 charity that gives you the 80/20 win for a good expectation value for your dollars to do the most good in speeding up progress towards ending age-related disease. If you want to do better than the SRF at assigning dollars to speeding up progress towards ending age-related disease, you're going to have to spend some years reading research and making connections. (I wish more people would, actually, no such thing as too much help here).

Age-related disease kills ~100,000 people every day, and causes horrible day to day suffering for hundreds of millions of others. Nothing else comes even close as a single presently addressable cause of terrible things in the world, and lack of money is the greatest obstacle to progress towards meaningful treatments that address the root causes of aging and thus all age-related disease.

<comment><USER8> What indication is there that living longer would serve the greater good? People living longer = fewer births assuming stable population, and a greater percentage of life spent in older years. Even if you can make those older years healthy, you'll never be able to capture the uncomplicated wonder and joy of childhood and adolescence. You'd literally be trading a teenager's first crush for an 80-year old's third marriage. The aggregate joy of society will go down if SENS is successful.

<comment><USER9> I'm just going to have to guess that you aren't very old. I'm only 47, but I have to tell you that at least for me life just keeps getting better every year. I wouldn't trade this year for another year of my teens. I wouldn't trade this year for _10_ more years in my teens.

Gradually losing health is unfortunate. I have to watch what I eat and be careful with my lifestyle due to chronic illness. My vision has degraded pretty badly and I'm forced to use a really gigantic font when I'm programming (you don't want to know how much time I spend fiddling with my colours!). These things pale in comparison to simply knowing what makes me happy.

I've worked hard to learn to be happy. Again, at least for me, I don't think happiness is something that is given to you. It's something that you make yourself. I suppose some people have a talent for it, like everything else, but it's something that you can work on and get better at. Without trying to sound arrogant there is no way that a child can have the kind of happiness that I have every day, because they simply do not have the experience to do it. They have a tumble of conflicting emotions which they have no control over. You couldn't pay me to do that again.

<comment><USER8> I'm 31, with a toddler. I can't compare anything I do with the joy she gets out of the most mundane things. The first time she tasted chocolate? Blows me going to Alinea out of the water.

<comment><USER10> I'm not trying to disagree with you, I have a 7 month old son, but what about the joy you felt seeing her being born? I know that isn't a mundane thing and that you likely won't have it but a few more times but there are experiences that children can't have, that are, at least, as transcendent as a child's first taste of chocolate.

<comment><USER8> But that's precisely the thing. In a stable population, births per year are inversely proportional to life expectancy. So whatever joy seeing a child born brings to people, there will necessarily be less of that per year aggregated over the whole society. A society where everyone lives longer is necessarily one with a smaller proportion of joyful idealistic children and a higher percentage of cynical jaded older people.

</comment></comment></comment></comment></comment></comment><comment><USER11> This resonates with me. I remember reading of a Stanford graduate who was delivering meals to indigents in San Francisco and the Bay Area. I immediately thought: how selfish. To give up a possibly lucrative employment in finance, so she could personally experience charitable work, was a net loss to that organization. Why not work on Wall Street and donate 90% of her income instead?

This is a real choice. Joining the Peace Corp or helping rebuild levys after a flood is humbling, giving and selfish, all at once. Instead work at what you can do best; then donate so others can do the real work. This is practical selflessness.

<comment><USER12> Joe, this is Derek, the author of the piece linked above. I think you make a good point. When I first heard Will explain "earning to give," a part of me considered it off-putting and radical, but I've come to see it as an expansive view of doing good, because I think there are a lot of people who (a) wouldn't be good at charitable work or (b) would be good at charitable work but are better at - and enjoy! - other work. For these people, it's inspiring to think they can make a huge difference, too.

There is always the question: What happens if you discourage too many wonderful, smart people from working at charities? And here, Will's answer would be, I think, that if that starts happening, then we should reevaluate the advice. But for now, I think, the earning to give philosophy carries tremendous upside for getting more people to think of themselves as essential contributors to charitable causes, no matter where they work.

<comment><USER13> As a counterpoint, a friend of mine was knocked by when she volunteered for a local charity. "What qualifications do you have?"

The question sounds elitist, but the point was that charities often have metric shitloads of untrained helping hands. What they need, right now, is people that know how to manage, run finances, computer networking. Advanced skillsets.

I actually think the 'earning to give' mindset would really just end up as more consciential salve rather than a new way of thinking, much like people already do with minor donations. "Working on Wall St" _changes the way you think_. Case in point: another friend of mine was in a relationship with a hardcore Anarchist for 5 years, and came from a poorish middle-class background herself. She'd worked shitty working class jobs. She was pretty exposed to the plight of the poor and aware of poverty issues. Then she got a job in banking. A year later she got a raise of $10k, and she was negative about it, bitching about "the government taking half in tax" and it going to "useless welfare". Complaining that despite her tax load (seriously, got a raise, and all she could do was complain), she still had to help out her single-mother sister with money. Welfare was worthless, why should she have to pay so much tax? She got a bit of a shock when I said "So... what about all those other women like your sister who don't have a sister in banking?".

And here in our software bubble, I have a friend who earns 50% more than the national average household income (average, not median). He talks as if he's poor - and I see similar when I read conversations here on HN. It's awfully common for a software developer to see someone else doing the same thing and making a few dollars more, to then reclassify themselves as 'poor'.

The point is that where you work and who you associate with _change who you are_ and how you behave - and, ultimately, have a good chance of removing people from the pool of 'people who care' (like my banker friend above). I guess that it's not that she didn't _care_ , it's just that she no longer _saw_...

<comment><USER14> I think that's a really important concern. At 80,000 Hours when we encourage people to earn to give we ensure they're embedded in the effective altruism community, take things like the Giving What We Can Pledge and so on - mechanisms by which to ensure that our future selves don't fail to live up to our ideals.

It's also worth bearing in mind that the rate of people becoming disillusioned when they do direct work in charities also (anecdotally seems to me) to be very high. Reason is that it's often very hard, often you don't feel like you're having much of an impact. Whereas if you enjoy working in the lucrative career you're in, the 'sacrifice' of donating even 50% isn't really that great, so it's potentially easier to continue in that path. I'm genuinely really unsure which has the greater dropout rate: earning to give, or direct charity work. If I had to bet I'd say it was direct charity work.

</comment></comment></comment></comment><comment><USER15> Wow. This is a tough crowd. Its not enough to generously give your time and money to charity, you have to have an effective data driven approach to your giving or you suck. And if you can bill at $500 an hour, no helping out at the soup kitchen for you -- that an inefficient use of societies resources. Back to your cubicle, work some extra hours and give it to whatever causes our models say are best. Kind of a cold and sterile way to approach giving.

<comment><USER16> There's generally two things people want to accomplish out of charitable giving - making the world a better place, and the "warm fuzzies" of helping out.

The fact that getting the warm fuzzies isn't a particularly good way of making the world better doesn't mean that you can't get the fuzzies, too. It just means that there's a tradeoff involved, which means you want to make the best tradeoff you can between the two.

Go ahead and volunteer at the soup kitchen while you make $500, or even $5000 per hour. I particularly encourage it if you find it emotionally rewarding or motivating for the nitty-gritty work of making the world better.

</comment></comment><comment><USER14> Hey - I'm the guy described in the post - if anyone wants to ask me about anything to do with effective altruism, 80,000 Hours, Giving What We Can, GiveWell (which I didn't cofound but is part of the same charitable movement), or what Derek Thompson's household habits are, please do so! :)

<comment><USER17> Some of the charities mentioned are clearly advocating for policy change (lifting copyright and restructured tax schemes), and I think that generally all charities must decide how to relate to the current structure of the world because whatever the ill you are campaigning against preventive measure are most effective at preventing suffering. So one question is if you see any natural limit for when something goes from a charity to a political campaign and vice versa. For instance, imagine the bizarre scenario where a presidential candidate pledges a significant increase to foreign humanitarian aid by taking from the foreign military aid budget. Will make that candidacy a worthwhile charity (supposing the bizarro candidate has reasonable probability of winning)?

An unrelated question is: why do you think there are so few investment opportunities that are truly concerned with being ethical? The GiveWell founders seems like they could have made an investment fund dedicated to growing local companies in the poorer parts of the world. Direct cash transfers are among the best ways of helping the poor, but stable financing with modest return expectations seems like it could be pretty good too, with the benefit of slightly growing the capital available to help. Or you could imagine getting a significant amount of shares in Shell and turn up at shareholders meetings and make them repair their pipelines properly and such things.

<comment><USER14> Re: bizarro candidate? Yes, certainly. (as long as they're actually going to be much better for the world and your donation will make a difference). Lower probability of larger upside can easily beat guarantee of doing more modest amount of good.

There's a lot of talk about 'impact investing' and I see potential there, but at the moment the 'impact' side of things is generally very poorly understood so it's not fulfilling its potential in my view.

</comment></comment></comment><comment><USER18> Charity is about the donor as much as the recipient. Skip the pseudo- scientific horseshit and do something that matters to you.

Personally, I tutor a couple of kids in math every once in awhile, donate to a couple of religious organizations, a zoo, a local social services org, and a few museums. I find it fulfilling. One of my best friends is devoted to a particular state park -- he does trail cleanup something like 18 weekends a year.

Going down some philosophical rabbit hole where your life is essentially a dick measuring contest to figure out who is most selfless doesn't really do it for me.

Skip the measurement and do something real.

<comment><USER19> This is the worst kind of anti-intellectual nonsense. Do something real? What does that even mean? Are malaria nets not real to you?

Instead of waving off the serious efforts of a large group of people to figure out how to do the most good in the world as "dick measuring", I would encourage you to consider why you find the idea of comparing different forms of altruism so abhorrent that you refuse to even consider it as anything other than a source of cheap jibes.

Perhaps you consider the lives of people in your community to be more valuable than others. Perhaps you are less concerned with the good you do than how good it makes you feel. Perhaps you believe that charity is only meaningful if aligned with some higher power.

All of those would be meaningful arguments, but instead all you've given is an invective against thinking. Why? What good could that possibly do?

</comment></comment><comment><USER20> Providing women access to contraception and pregnancy termination services is what I personally identify as one of the best charitable causes.

Helping women prevent the birth of unwanted children who will, on average, lead worse lives than wanted children but who will still put additional strain on the world's environment seems a very clear case of a worthy cause to me.

An example charity in this area is Marie Stopes International [1].

[1] [http://www.mariestopes.org](http://www.mariestopes.org)

</comment><comment><USER21> My two cents... Open your startup in the third world, developing countries. Or, at least lead some people in those regions to grow their own problem solving skills with IT and engineering. Or, travel to those regions with your targeted donation savings and see the suffering of humans.

If charity means donating the money we think we no longer need, then we should go for any of the charity foundations mentioned in other comments. But the real charity would be to take our butts off our comfort zones, travel to the targeted countries, experience the real suffering of humans, and to find out how we can contribute with our top notch expertise in IT and engineering. Even discovering hidden prospects in those regions and nurturing them for local socio-economic development would be cool charitable work. Even, opening our startups and employing local people would contribute more significantly in those regions than millions of dollars in donations to those named charity foundations. It will not only improve our skill in practical problem solving, it will also enhance our spirituality.

<comment><USER14> I think that startups where the users are principally people in poor countries is a very promising area for socially minded people to work in.

Startups usually (but not always) generate value for their users in the form of consumer surplus. Because of diminishing marginal utility of money, $1 of consumer surplus in poor countries is worth 10x or more than $1 of consumer surplus in rich countries.

Some examples: Wave (YC alum) is making sending remittances cheaper (taking only 3% rather than 10% like Western Union). $0.4 trillion in remittances are sent every year. Segovia is making benefit payments in India more efficient, so that only 10% in lost in transactions rather than 50% as is currently the case. Both of these in my view have massive social value (and are run by people in the effective altruism community).

</comment></comment><comment><USER22> I use the free preview at www.guidestar.org. I then download the 1040's that are available. I go over the balance sheet. I look at the BOD. I scrutinize every page in that download. I try to guesstimate how much funding goes to the founders, and administration.

I then look at who's making the most money, including expenses, at the nonprofit. I have found too many people use nonprofits to support a comfortable lifestyle, and the cause comes second to their comfort. I have found, in too many cases, one person(many times--a husband, and wife) makes a lot of money, and the nonprofit doesn't seem to do much! This works for smaller nonprofits.

As to the larger nonprofits--many make me sick. That money could go to other causes. Off the top of my head these are the large nonprofits that need a through forensic review before donating to: (1) Goodwill (2) Cars for kids (when I reviewed this organization, they had one home in the Sierra foothills for, I believe--12 children, and most of their money was spent on advertising.) (3) St. Jude (correct me if I'm mistaken, but I heard they have enough money to survive for the next 100 years, and that's accounting for inflation, and growth?)

I love nonprofits. I just want to make sure that cause gets the money, or expertise. I'm tired of the scams.

</comment><comment><USER23> A point on "best."

There seems to be a lot of interest, some coming from the tech culture of evaluating charity and its efficiency. This is a good thing and could make a lot of difference. But for an individual that wants to give, you don't necessarily need it. You just need to find _a_ destination for your donation. Try to understand that single organisation.

I like the idea of simple things where the money = thing equation is understandable. For example, I have a distant cousin in the Philippines who builds "houses" for squatters with arrangements with land owners. It started after the storm. He lives locally and understands building. It's about £400 per hut. Most of the cost is labour. Materials are largely donated. The crew are locals that he knows. The recipients are living rough otherwise.

This may not scale to millions, but it works for individual donations. IE, you can find a charity that has the capacity to take your donation. Understand what they do and make an effective choice. It's a much easier problem to solve than the "how to make global donations more effective" problem and is really the problem at hand when _you_ make a choice.

Also..

 _Why was I doing it? Maybe the donation was the equivalent of an agnostic's prayer, on the off-chance the supernatural listens to altruism._

I like that. I'd apply an atheist version for myself. A prayer to human solidarity and fraternity, the things I hope for. I don't expect to make these things happen personally, but I can offer my prayer.

<comment><USER24> > You just need to find a destination for your donation.

The effective altruism counterpoint is that the same £400 is just about the amount necessary to save a life from malaria or schistosomiasis. Usually a child. The last number I saw was that ~$800 to one of GiveWell's top charities can be expected to save a life.

The "how to make global donations" problem is hard, but it's important, and we're fortunate that great work and research has been done. Let's use it to put our charitable donations to their best use!

<comment><USER23> The choices between putting a roof over a family in The Philippines and saving a child from malaria in Myanmar is an impossible one. Information can't solve it.

I have nothing against Give Well's approach. I think it is important. I'm just making the point that at a personal choice level, the "problem" is a lot more solvable. You only need to know about one charity, really.

<comment><USER24> It's possible that I don't understand your response, because I don't see why one only needs to know about one charity. On reflection, I don't think that it is an impossible problem either. It's making uncomfortable tradeoffs - <USER2> stopped me from considering this sort of question for a long time - but I've come to believe that these questions are too important to flinch away from.

One thought experiment to consider: suppose the homeless family themselves had to choose between a free wooden house or lifesaving medical care for their child. What would most families choose? What would you choose in their place? Is there a right answer?

</comment></comment></comment></comment><comment><USER25> While not directly related to the article's line of reasoning, an honourable mention goes to the Gates foundation - they're willing to take on some of the more "risky" high risk high reward projects that other charities that are accountable to the public can't risk.

<comment><USER26> My only question for the Gates Foundation is this: Didn't Mr. Gates make a vast amount of his incredible wealth using questionable and indeed: illegal business practices? There's the right place at the right time aspect of Mr. Gates' situation, but there's also bullish nature of it.

Can Mr. Gates now be seen on the moral high road, simply because of the way he's redistributing the wealth he attained (again: sometimes illegally) to those very less fortunate? Do we just say, "Shit Outta Luck" to his competitors?

I don't want these questions to be rhetorical, I'm actually very much interested in other people's opinions and point of view.

[https://en.wikipedia.org/wiki/Criticism_of_Microsoft](https://en.wikipedia.org/wiki/Criticism_of_Microsoft)

[https://en.wikipedia.org/wiki/Microsoft_litigation](https://en.wikipedia.org/wiki/Microsoft_litigation)

<comment><USER27> Irrelevant. We're talking about what he is doing while on top. There are more than enough examples of people on top that are doing nearly nothing to better the world.

<comment><USER28> Steve Jobs used to claim that best charity is doing business.

I (currently) think that best I can do is invest in myself, a.i. skip entertainment and study hard things.

</comment></comment></comment></comment><comment><USER29> For every dollar you earn, around 35% will be taken by the government and used for things most of which could be classified as "charitable". Just because you don't get a choice about taxation, doesn't mean that the choice to earn more money it isn't an effective form of altruism. And just because the government budget is huge, doesn't mean there isn't a 1-to-1 correspondence in the long run between how much the government taxes, and how much it can spend. (EDIT: and for actual charity, I go with Malaria. Dying sucks).

</comment><comment><USER30> The definition of charity seems to be giving money to those in need, but I prefer a less specific definition: Helping those in need. To do this, you can give money to 'charities', or you could perhaps try to help with systemic problems by attempting to effect wider change: If you're able to influence your country's government, isn't this more likely to have more effect, especially in the long run?

</comment><comment><USER31> one angle not addressed is there could be a social contract and relationship between the donor and the recipient.

This currently assumes a single transaction, but what if the recipient had a way to pay it back and/or pay it forward? If the donor had the opportunity to view the results of the donation, the satisfaction from it and the relationship obtained makes the sacrifice worth it.

If there was a system that helped to track it with the various privacy and other concerns, that would be so awesome!

</comment><comment><USER32> Charity is the opposity of justice. It preserves a state of things, a division among those who give and those who take. The best charitable cause is a world without it.

</comment><comment><USER33> My thoughts would be: 1) sponsor the private schooling of an orphan or disadvantaged child - if they get the grades you pay direct for the school and materials. (this system exists for most orphanages in most 2nd and 3rd world countries but you can start at home.)

2) International work camps for peace - fully volunteer organization and you get to see another country in a real way and do good work while doing so.

Both are 100% - 100% direct.

</comment><comment><USER34> Any service that your heart melts most for.

</comment><comment><USER35> It seems like simple education would be more effective than directly buying bed nets. How about subsidizing the cost for whole nations and educating with billboards?

<comment><USER36> A common fallacy is that the donors know best.

It would be wise to consult the works of William Easterly [1] e.g. The White Man's Burden [2]

[1] [https://en.wikipedia.org/wiki/William_Easterly](https://en.wikipedia.org/wiki/William_Easterly)

[2] [http://www.davidmays.org/BN/EasWhit.html](http://www.davidmays.org/BN/EasWhit.html)

</comment></comment><comment><USER37> Red Hook Initiative Center did a wifi mesh network.

[http://rhicenter.org/author/tony/](http://rhicenter.org/author/tony/)

I like this kind of ideas.

</comment><comment><USER38> The greatest good will be accomplished by developing synthetic labour (AI). This will generate so much profit that even a tiny taxation rate (0.001%) will allow everyone to live as billionaires do now and allow us to solve all other problems caused by (relative) poverty.

<comment><USER39> Right, because the human race has a really good track record of allowing the benefits of technological productivity increases to impact the poor in a positive way.

<comment><USER38> Have you ever wondered why we are all so much richer today (even the poor) than in the past? It is not because people decided the way to solve poverty was charity. It is only because we have replaced human labor with artificial labor.

More seriously once you have synthetic labor all the reasons for scarcity and exploitation of the poor end. Sure there will still be people who are on the bottom of society's pecking order, but their actual standard of living will be far beyond those of our richest today.

<comment><USER39> I think I get what you're saying, but even in Star Trek this doesn't work without a source of essentially-perpetual energy.

<comment><USER38> It is pretty lucky that we are only 93 million miles away from exactly that :)

I actually did the calculations back in the early 1990s of how many dollars you could generate by capturing all the solar output combined with synthetic labor. It is something on the order of 10^24 times the entire world GDP. When you have that level of resources then scarcity ceases to be a concern.

<comment><USER39> TBH I do agree that this is possible; I just think we have a long way to go as a civilization just in terms of basic human empathy and decency in addition to the technical challenges. And the technical challenges pale in the face of the sociological ones. I think that a lot of the oppression that happens in the world isn't driven by scarcity but by bigotry and prejudice.

<comment><USER38> I think it is a bit of a circle - our economic system requires bigotry and prejudice and these in turn help support our current economic system. Break the need for oppression of the poor and my hope is we stop oppressing.

<comment><USER39> I hope you're right! A lot of the assumptions surrounding scarcity are so deeply-ingrained into the way we think that it's difficult to speculate on what would happen otherwise.</comment></comment></comment></comment></comment></comment></comment></comment>


Making sense of a crazy year in open source - <AUTHOR> https://www.scalevp.com/blog/making-sense-of-a-crazy-year-in-open-source <comment><AUTHOR> Speaking about the new normal of 3-tier products, Elastic CEO Shay Banon summed it up, saying

"We now have three tiers: open source and free, free but under a proprietary license, and paid under a proprietary license."</comment>


The last thing America needs from Trump's infrastructure plan is more roads - <AUTHOR> http://www.slate.com/articles/business/metropolis/2017/04/the_last_thing_america_needs_from_trump_s_infrastructure_plan_is_more_roads.html <comment><USER2> Unpopular opinion: I live in rural USA. I sure would love a paved road. Living on a dirt road is an economic net negative for the community. My cars, mail trucks, etc. dont last as long, not to mention it has to be graded every time it rains hard. Some road improvement is absolutely worth it.

However, I must admit, most roads go in at a loss. And without reguard for future cost of maint. It seems like there is a lot of good to do here but only if managed well. We can only hope the brightest offer their suggestions and effort, even to an administration they may dislike.

<comment><AUTHOR> The depressing conclusion of people like Charles Marohn[1] is hard to get around: if the full cost of living outside of major urban centers were actually being born by the people who lived there, very few people could afford to live outside of major urban centers.

1: [https://www.strongtowns.org/journal/2017/1/9/the-real- reason...](https://www.strongtowns.org/journal/2017/1/9/the-real-reason-your- city-has-no-money)

</comment></comment><comment><USER3> I stopped reading at

"Not only should we not be building more roads, we shouldn't necessarily be repairing the ones we have."

I live in northwest Connecticut and I will not stand for this nonsense. Our roads are awful, and need to be repaired and. Unavoidable potholes, dangerous erosion, these are things that not only cause vehicular deaths but also severely decrease the lifetime of automobiles.

You can tell whoever wrote this article probably doesn't commute in their own car that they have to repair every 6 months because of shitty roads.</comment>


U.S. Engaged in Torture After 9/11, Review Concludes - <AUTHOR> http://www.nytimes.com/2013/04/16/world/us-practiced-torture-after-9-11-nonpartisan-review-concludes.html?pagewanted=all&_r=0

<comment><USER2> Can someone familiar with law (and international law) comment on this? How likely is it that high ranking officials will be held accountable for this?

<comment><USER3> I would say it's about as likely as it was before, sadly.

The Obama administration has seemingly made it a policy to decline to prosecute these types of offenses by the preceding administration. There's undoubtedly more that went into that decision than trying to piss off their own activist base but I don't see that any of the decision points would have changed for them.

As far as international law, the evidence hasn't really changed, it's always been risky for some of the Bush administration's neocons to travel abroad and risk arrest. I just don't see a country starting an international incident over this (but who knows?...)

<comment><USER2> Doesn't the UN have a duty to pursue the allegations and the evidence? What we're talking about here is war crimes is it not?

<comment><USER3> The commission came to its conclusion using publically accessible information, so if the UN has a duty now, it also had it before.

But even if the UN does investigate it, they would need to tread very carefully. Whatever else you might think about President Obama, he's not an idiot, and what /that/ means is that he cannot under any circumstances allow UN _anybody_ to arrest any Americans on U.S. soil unless he can get the Congress to buy off on that. Anything other than that would be political suicide. And needless to say, but Congress will be in no hurry to turn over anyone to be tried by some other tribunal. If it's really decided to be that bad they will want to prosecute in a U.S. court, but under almost no circumstance would they allow some other court to take a hack at it.

With that in mind it would be foolish for the UN to attempt an arrest only to be forcefully rebuffed as that would make them appear impotent. ("Never give an order you expect won't be carried out"). Mind, they might actually _be_ impotent, but it still is better for the UN that they don't appear so.

<comment><USER2> So, basically, people in positions of power can get away with almost anything. Even murder and torture. What the fuck is wrong with society?</comment></comment></comment></comment></comment>


Ask HN: Could I replace Django with Node.js? - <AUTHOR> I'm bidding on a two client projects right now. Both in the past I would have gone straight to building with Django. I'm obsessing over the idea of pivoting my go-to development stack from Django or PHP towards end-to-end Javascript, mostly because a lot of the best freelance engineers I work with are increasingly focused in this area. And I'm pretty skilled in Javascript myself. I increasingly feel the trend of web app development could go in this direction and the MVCs of yore will start to go the way of Perl or ASP.
But I need a serious sanity check. These projects aren't just little widgets, they have client-supplied requirements like user auth, specialized CMS, gated content, payments, user roles and permissions, user profiles and so on. The spec for one of them has upwards of 100 screens designed.
Would pivoting these types of obviously Django/Rails/PHP friendly projects to a MEAN stack be a mistake? Or am I planting a stake in the future? <comment><USER2> Since there are a lot of components involved, let's consider them separately instead of discussing the bundle as a whole. This also helps as M-E-A-N are very independent by design and can be used independently. In fact, we are currently using AngularJS at frontend and PHP at backend.

MongoDB: is a NoSQL database designed for handling huge amounts of non- relational data. In comparison, MySQL excels at handling relational data but does not scale as well. If you need a lot of joins (relationships, user roles, etc.) then MySQL will be better and if you can benefit from the ability to keep arbitrary columns in your database tables without the need for running ALTER commands or other database hacks (CMS fits very well as most CMSs hack MySQL a lt to get the fleibility they need) then MongoDB will suit better.

ExpressJS: is akin to Django. While I am not experienced with ExpressJS, it seems more oriented towards single-page apps. Django has some good support for templating which comes in very handy for traditional websites. Single page apps don't fetch a lot of HTML from backend anyway, so this capability is not of much use.

AngularJS: has no direct counterpart in LAMP stack with Django. Angular is a frontend framework used for building single page apps. In fact, if you are building a single page app, you would want to use a frontend framework like Angular or Ember even if you use Python/Django/MySQL at backend. As mentioned earlier, we have recently built a single page web app with Angular at frontend and LAMP(PHP) at backend.

Node.js: is actually (to some extent) a counterpart of apache server and not python or django. nodejs is a performance oriented server with asynchronism at its core. While it is definitely desirable for high workload applications, it does take some getting used to. For example, even though you I was quite comfortable with AJAX at frontend, writing database queries in an asynchronous mode felt quite unnatural at first.

Overall, depending on the kind of application to develop and the kind of time luxury to learn new things, you may want to adopt MEAN partially if not fully. If constraints permit, spending some time with M/E/A/N should be intellectually and professionally rewarding.

<comment><AUTHOR> Really appreciate the breakdown. Its actually surprising me how little I educated myself on some of the components.

From what I know ExpressJS is more of a microframework that can be used piecemeal. Closer to Flask or Sinatra maybe? Or am I way off here? Do you typically use an ORM for the DB or is the expectation to query MongoDB directly?

<comment><USER2> Thanks! MongoDB and NodeJS are fairly big projects and take some experience to fully appreciate. Even Angular vs Ember is not a trivial decision and its better to have some experience with both. I agree with czbond's suggestion of starting with smaller projects. It will also reduce _abandonware_ risk.

Again, I don't know much about Express though microframework seems to be the right term to me. Hopefully, other community members will shed some light on this. Regarding MongoDB, an ORM is technically not needed as mongo is not _relational_. In fact, mongo treates its records as first class JSON objects and therefore is very object-oriented natively.

<comment><AUTHOR> I appreciate your helping to knock some sense into me. I should know better than to go diving headlong into building large client projects in bleeding edge technology, heh

</comment></comment></comment></comment><comment><USER3> I have no experience in Django, but heavy experience with Rails. I've moved to Node for a variety of reasons - but my experience is the following: The level of re-usable code is growing quickly in the node eco-system, but it obviously hasn't matured to the levels of Django/Rails in robustness. Many "out of the box" items that are well tested in these frameworks still require more work or crafting your own home grown solutions. I believe the node approach is where the industry is going over the next 5 years. That said, I would personally do smaller projects in node (to build your skillset and familiarity), while doing larger projects in your speciality unless you have a plethora of time for the project. Then swap out the portfolio mix as you become more skilled in node.

<comment><AUTHOR> Thanks I really appreciate your incite. I may have other engineers with Node experience pick up the bulk of it so learning curve wouldn't be as big an issue. But I guess what you're trying to tell me is that I'm jumping the gun on Nodejs as Django/Rails replacement by a few years here..

I think my biggest fear is the size and fragmentation of the ecosystem. Every library out there seems to be a beta that could easily turn to abandonware in 6 mos. Is that a fair assessment?

</comment></comment><comment><USER4> I'd say the Django equivalent for Node.js is [http://keystonejs.com](http://keystonejs.com)

It's in very early stages, but it looks very promising and similar to Django.

</comment><comment><USER5> So, what is your final decision and intention?

<comment><AUTHOR> I did end up sticking with Django. Just seems like Node is still too bleeding edge for the client use cases I have right now</comment></comment>


Google employee fired over diversity row considers legal action - <AUTHOR> https://www.theguardian.com/technology/2017/aug/08/google-employee-fired-diversity-row-considers-legal-action-james-damore <comment><USER2> Reasonably well written article. I heard a similar news item on BBC's World Service. Is it something about Britain/Europe news which lends some perspective or is it a function of literal distance?

<comment><USER3> You're kidding right? It's full of mischaracterizations.

>suggesting women are less suited to certain roles in tech and leadership

Not true. Saying women are less suited is saying all women are less suited.

What he said is that when comparing the distribution curve of women to men, the average woman may be less suited than the average man.

That's different. It means that the top 10% of women may be far _better_ suited to leadership in tech than the bottom 85% of men.

>caused outrage when he circulated a manifesto at the weekend complaining about Google's "ideological echo chamber"

He wrote a memo. It was posted on an internal forum. He wasn't complaining, he was suggesting alternatives to discrimination. Why are they making it sound like he was distributing fliers all over campus?

</comment></comment><comment><USER4> Great, let him go to court and defend his thesis. Why don't all the sexist guys get together and form your own organization and let's see how you survive in this world?

</comment><comment><USER5> Question to everyone. 1: Do you think forced diversity is a good thing? Is it an attack on those with ability? 2: Is this a variant of the PC movement? Do you consider this an attack on free speech?

<comment><USER6> 1.) It's not so simple. There are social mechanisms at play that will lead to a segregated workforce if we do not combat them. In today's world it takes effort to maintain a diverse workforce. As as to whether its a good thing, I think that a) diversity of people means diversity of ideas and solutions, and b) diversity in workers helps combat some of the social mechanisms that would keep the workforce segregated. It is also of the uptmost importance to note that raising diversity in the workforce is orthogonal to compromising on the quality of workers.

2.) Yonatan Zunger's response to the manifesto has been highly shared, but I think his essay "Tolerance is not a moral precept" is an important framework when talking about this issue. The basic premise is that by adopting tolerance as a social norm, we are not agreeing to also tolerate intolerance. Companies like Google have set out the edict that all their workers should be treated with respect. By questioning the inate abilities of a large portion of the workforce, the manifesto's author is doing great damage to the attitude of tolerance that allows Google to operate. He isn't be prosecuted by the government, but he is necessarily being expunged from an enviromenent that he is incompatible with.</comment></comment>


Ask HN: Can H1-B holder open Stripe account and accepts payments? - <AUTHOR> Hey HN community! I'm very close to launching a SaaS project but not sure if my visa (h1-b) situation allows me to accept payments outside of my current job. If no, is there any alternatives I can use besides stripe to accept recurring payments? Thank you so much! <comment><USER2> You can't earn side income on h1-b visa. However, the job of enforcing that belongs to INS, not Stripe.

Stripe doesn't care. You can open Stripe account and accept payments, you just risk deportation if INS finds out.

Your other options:

* offer the SaaS for free until you get Green Card. It's still valuable to find out if your product will be used when the cost is $0 and you can build SEO/reputation. If you don't want to paint yourself into a corner you can build a "lite" version, that withholds some features. When you're ready, you can add those features and charge for a pro plan

* you can setup a business in your own country (or some non-US country that allows easy formation of businesses) and have payments (Stripe) directed to that business. I'm not sure how INS would interpret such work-around, but it's a moot point since the probability of INS finding out in this scenario is close to 0%

* like the above but have a trusted family member to open and manage the business. It's still a work-around but almost certainly INS-proof

</comment><comment><USER3> I don't think you can. As an H1b, the only allowed sources of active income are your H1b sponsors.</comment>


VC's Billion-Dollar Secrets - <AUTHOR> http://www.forbes.com/entrepreneurs/entretech/2007/06/01/google-amazon-ebay-ent-tech-cx_eb_0601everythingventured.html

<comment><USER2> the other good thing about 'viral' startups, is that you get instant feedback about whether something works; you don't have to hang around to see if people like it or will use it.

Max Levchin told me that he would never bother with a start-up that wasn't viral in some way for this same reason.

<comment><USER3> If your product is inherently viral, but isn't taking off, does that mean it's a bad idea? Or just that it hasn't tipped yet?

<comment><USER4> Probably means you're missing some critical usability feature, i.e. you're not solving the whole problem. Few ideas are all bad or all good, and things rarely tip all by themselves. But people don't use a product unless it solves their whole problem without making them hunt for missing pieces - that's really the difference between "project" and "product". If you're missing a piece, it'll never get off the ground.

The missing pieces are usually pretty subtle too - FaceBook took off largely because it was explicitly designed around existing physical social networks, like colleges. Many other people had done similar sites years earlier, but they always focused on building a social network out of thin ether, rather than leveraging offline social contacts.</comment></comment></comment>


Ask HN: Difficult Clients - <AUTHOR>

I don't do a ton of contract work, so I don't have much experience with difficult clients. I'm curious as to how everyone else deals with them.
In particular, I currently have a client I was doing some regular work for for around three months. It was all contract work, but I was working as an employee (no papers signed, just a verbal agreement).
Fast forward three months and I quit. I wrap up what I'm working on, send in a final invoice for the little work I was owed for ($400), and went our separate ways.
Fast forward another month. I had been told on four separate occasions "I'm sending your payment {as we speak|tonight|tomorrow|today}". He threatened to sue me five separate times for things that even a childs imagination would have difficulty coming up with. Every time I contact them it bounces between "I'm going to sue you" and "I'll send your payment right away". The threats of being sued are comical, but I've heard stories that he's not afraid to "make stuff up" if needed (while working there I witnessed first hand him faking documents for a mortgage).
$400 isn't a ton of money, and I'm pursuing it more out of principle than all else (he's done this to past contract workers and gotten away with it). At what point do you generally give up and write it off? <comment><USER2> Mike Monteiro gave a recent talk discussing how he handles client payments and in particular dealing with contracts. It's not only an entertaining talk but has some good information as well.

<http://vimeo.com/22053820>

As for me, In the past when dealing with smaller clients I always get some money up front (usually 50%) to "cover costs" along the way. In your case it's difficult to justify too much time chasing down $400 so you might be better off thinking about that as money spent on learning to be a contractor and quickly move on to the next job.

</comment><comment><USER3> At the point that it costs you more than sending a reminder email every week or so. For $400 just take the lesson and

a) Never work off contract again. Even in small projects that you wouldn't want to go to court over even in the worst case, sometimes they can help prevent the worst case. At worse they can give you a list of assumptions and clear up some misconceptions before you start (most of my simple contracts for small projects were just assumptions like "If you get me all content by DATE, I can have ABC Feature done by DATE2" etc

b) Always downpayment up front

c) Incremental releases and payment structure (I release this feature, I get this payment, etc., instead of lump sum 50% remainder at the end)

d) Trust your gut: I imagine you knew this guy was shitty going in (I almost always have, and in retrospect clients who didn't pay me I almost always had a bad gut feeling about and then convinced myself to do the work anyway).

e) Internalize the concept that time not wasted on shitty clients can be used more effectively to look for good ones.

Good luck!

<comment><USER4> I don't think it's realistic to always get down payment up front.

<comment><USER5> It depends on your history with the customer, the amount of money, and your risk tolerance. I always ask for a deposit unless the amount of money is completely trivial.

</comment></comment></comment><comment><USER4> I guess my initial question would be how many hours did you work for him? If it wasn't a lot of time, just accept that you aren't getting paid.

If you did put a lot time into it, then I would push more but make sure you understand why you are trying to get the $$. You won't convince him you were valuable or get a recommendation or reference (I have seen others think they can convert a bad client into a good one).

Finally, understand that bad collections are a fact of life. Everyone has it, and regardless of whether you have a contract or not, you are going to have to expect some amount of losers.</comment>


Dockless bikes: Are they bad for station-based bike-sharing systems? - <AUTHOR> https://www.curbed.com/2018/5/30/17390264/bike-sharing-dockless-bicycles-cities <comment><USER2> For some context on how bicycle sharing system was started/invented, it is from '70s Amsterdam. That incarnation was dockless and publicly owned. See Wikipedia "wittefietsenplan" (white bicycle plan, use translator) [1] or e.g. this UK song about it [2] by the band Tomorrow. This English Wikipedia article also contains some history about bicycle sharing system [3]

Recently it has finally been more broadly adopted (though also with a variant, the station-based bikes). One major advantage of station-based bikes is availability. You know beforehand where you can grab one (possibly using a mobile phone to see if they're available on the spot), and can plan accordingly. Dockless can compete with that availability via sheer volume though.

[1] [https://nl.wikipedia.org/wiki/Wittefietsenplan](https://nl.wikipedia.org/wiki/Wittefietsenplan)

[2] [https://en.wikipedia.org/wiki/My_White_Bicycle](https://en.wikipedia.org/wiki/My_White_Bicycle)

[3] [https://en.wikipedia.org/wiki/Bicycle- sharing_system](https://en.wikipedia.org/wiki/Bicycle-sharing_system)

<comment><USER3> Dockless bikes can be found as well via an app. I use mobike in Berlin. They have a map in their app that you can use in the unlikely case there aren't multiple bikes in visual range.

Berlin has a ridiculous amount of competing bike share companies. Multiple companies put many thousands of them on the street. Docking is not an option at that scale.

The article seems to imply some inherent advantage of the docked variety that I just don't see. Also despite success and excellent safety numbers the article is calling for regulations. Why?

From my point of view, dockless is clearly winning in Berlin. Getting people moving is a good thing. Ensuring every steet corner has plenty of bikes means grabbing one is a no brainer.

</comment></comment><comment><USER4> In Geneva, we have dockless bikes, but they are not everywhere. Why ?

The bikes need to connect to an antenna (bike point). The range is only few meters, so you can only dock them in designated spots. Quite clever I think.

<comment><USER5> Wouldn't those be essentially the same as docked bikes then? You have to bring it to one of the designated locations to drop it off, just like with docks.

<comment><USER4> Yes, but number of bikes is limited by space and not by dock places.

</comment></comment></comment><comment><USER6> Why would anyone use a station-based bike if a dockless is available?

<comment><USER7> The article says that dockless isnt cannibalizing docked during commute hours. This matches my experiences, downtown theres plenty of docks and dockless bikes, but around my house theres very few dockless bikes/scooters, but a very close dock. Not having to think about where I'm going to go hunting for a bike is nice, and time planning a little easier especially for work.

I imagine its also cheaper to run, which currently the annual ford bike pass in sf ends up being much cheaper than any of the alternatives - $12/month compared to a couple dollars per ride.

<comment><USER8> In frankfurt you can put back dockless bikes only to specific small areas, unless exceptionally you wanna pay premium. The bikes have a GPS after all, so why allow customers to scatter them ?

<comment><USER9> Because a huge part of the benefit is that the customers can use them for the last mile of their trip, wherever that goes.

<comment><USER8> You can with this system. You just pay extra so that someone can bring it back.

</comment></comment></comment></comment></comment><comment><USER10> >Dockless bikes: Are they bad for station-based bike-sharing systems? (curbed.com)

Yes. In Astana Ofo ran for just a year. After that, the company running station based rentals hired a battalion of tough guys to "deal with them"

<comment><USER11> In China, people regularly put chewing gum over the barcodes of dockless bikes, presumably the easiest way to prevent them being used.

</comment></comment><comment><USER12> Who cares? If dockless kills docked that's fine. What matters if whether they are good or bad for people.</comment>


Show HN: Animated Mistletoe and Kisses for iMessage Stickers - <AUTHOR> https://itunes.apple.com/us/app/animated-mistletoe-kisses/id1184653618?ls=1&mt=8 <comment><AUTHOR> To see quick preview of animation: [https://youtu.be/MLs1iGUQGaM](https://youtu.be/MLs1iGUQGaM) Merry Christmas Everybody. :)</comment>


Ask HN: How you test for different versions of IE on a mac? - <AUTHOR>

I haven't been able to determine a definitive / outstanding service that lets you test your site in several versions of IE on a mac (now that IE is discontinued)... how do people usually do this? <comment><USER2> The actual IE for Mac has died long ago and was barely related to IE for Windows anyway. If you mean current versions, try something like Saucelabs interactive sessions. They offer many different OS/browser combinations in VMs and even their free offering is plenty for light use. [https://www.saucelabs.com/](https://www.saucelabs.com/) for more...

In more limited form, Microsoft have their own freely downloadable VMs for certain versions of IE, though there are some tricky licensing issues, the VMs expire, and it's all quite cumbersome. [http://www.microsoft.com/downloads/en/details.aspx?FamilyId=...](http://www.microsoft.com/downloads/en/details.aspx?FamilyId=21EABB90-958F-4B64-B5F1-73D0A413C8EF)

For really basic tests, there's also the IE net renderer at [http://ipinfo.info/netrenderer/](http://ipinfo.info/netrenderer/)

</comment><comment><USER3> If you're looking for a service, Browser Stack ([http://www.browserstack.com/](http://www.browserstack.com/)) gets the job done.

Microsoft also offers free VMs for testing IE at modern.ie ([http://www.modern.ie/en-us/virtualization-tools](http://www.modern.ie/en- us/virtualization-tools)) for Virtualbox, Parallels, and VMWare. They have 9 or so images for testing IE, ranging from IE6 on Windows XP, to IE11 on Windows 8.1.

</comment><comment><USER4> We run [http://testingbot.com](http://testingbot.com) which provides just that: online browser testing. In your case, just go to our website, sign up for a free account and run any IE/Firefox/Chrome version straight from your mac. Please let me know what you think, we appreciate any feedback!</comment>


An absurd password recovery system by Adobe - <AUTHOR> http://coding.pressbin.com/107/Unhelpful-password-recovery-feature/

<comment><USER2> Google Apps does the same, for domains with many users.</comment>


Why Haven't Humanities Ph.D. Programs Collapsed? - <AUTHOR> http://www.theatlantic.com/business/archive/2013/09/why-havent-humanities-phd-programs-collapsed/279733/ <comment><USER2> University used to be a place to further one's intellect and expand one's mind. Now they are a sausage factory where one is barcoded and hopes to be sold for a pretty penny.

When the ancient Greeks created the foundations of modern mathematics and philosophy by drawing with a stick in the sand, they weren't looking to "totally pwn the quant market with this new algo brocrates!"

This article asks the wrong question. Ask instead, "Why does modern Western society place no value on learning that cannot be instantly monetized?"

</comment><comment><USER3> Because different people have different motivations.

People who are technically minded with a good grasp of logic and a desire to make and break things and who want a job study CS and get CS jobs (or just do CS and get CS jobs).

Those same people, with slightly better math and no inkling of the job market study physics. Some of them stay in physics - and some, like me, move into IT then security, and just keep moving, having a great life all the way through.

Those same people, with even better math and less make/break study math and some stay there and some become actuaries (what they intended all along) and some go into medicine (because math is one of the easiest science degrees to get, if you're good at math, no labs, so it's a pretty good pre-med).

Same group, less math, more make/break: Chemists.

And so and so on and so on.

I took physics. Because I loved it and because it was super tough. Job prospects? Whatever. Fell out of love, did a little philosophy and some CS, translated that into a 25 year IT Security career, last dozen as a consultant, work when I want, do some acting, have a psychology exam next week....

tl;dr? The author had it right in the first bullet: These people study what they love and the rest be damned. They are not thinking jobs and as long as analysts have only that material mindset they will never get it. They are thinking love. Some people survive on that love, some thrive on it, some crash into despair, and some of them move on. That's life.

</comment><comment><AUTHOR> I left this as a comment on _The Atlantic_ but think it relevant here too:

 _First, arts and humanities students aren 't necessarily the most career- minded or pragmatic individuals; they go to school to study what they love, then hope for the best._

This is an important point. I'm an ABD in English lit at the University of Arizona, and I noticed that most of my classmates, prior to enrolling, were either straight out of undergrad or another grad program, or had been working somewhat marginal jobs at bookstores, coffeeshops, and what not presumably for around $10 / hour. The U of A grad stipend pays about $20 / hour. That's still not a huge amount, given that it ranges from $14K – $ 17K or so, but supplemented with random work it's not insanely terrible.

My reading is that many humanities grad students view grad school as a lottery ticket.

I've written in more depth about "What you should know BEFORE you start grad school in English Literature: The economic, financial, and opportunity costs" ([https://jseliger.wordpress.com/2012/05/22/what-you-should- kn...](https://jseliger.wordpress.com/2012/05/22/what-you-should-know-before- you-start-grad-school-in-english-literature-the-economic-financial-and- opportunity-costs/)), but innumerable essays and posts like mind appear to have had little impact on the numbers.

<comment><USER4> Off topic, but how do you attend Arizona when you're in NYC? Is that a special program they have?

<comment><AUTHOR> Good point! I moved to NYC for love and am writing my diss here when I'm not wasting time on the Internet (like now), or doing real work-for-money work.</comment></comment></comment>


Thoughts on Machine Learning – Dealing with Skewed Classes - <AUTHOR> http://florianhartl.com/thoughts-on-machine-learning-dealing-with-skewed-classes.html <comment><USER2> This blog post presents good techniques, but misses the point.

The most important thing to do when designing a machine learning algorithm is to _choose your loss function_. The loss function quantifies how much your model sucks.

Ideally, your loss function should be the true loss, in real life. In a business, your true loss function is: -profit over the lifetime of the business. A lot of time it's difficult to measure the true loss, so your loss function should be a "surrogate" (approximation) of the true loss.

The author is poking around with techniques, without considering what he actually wants to optimize.

Brandon Ballinger said it well: [http://www.quora.com/What-are-the-keys-to- operationalizing-a...](http://www.quora.com/What-are-the-keys-to- operationalizing-a-machine-learning-ranking-system-from-an-organization- engineering-management-point-of-view/answer/Brandon-Ballinger)

"Make your success metric user happiness. Traditional accuracy measures like precision, square error, ROC, etc. don't capture what you really care about-- how users react to your model. For example, if you're running an ad system, your metrics should be revenue per pageview and click through rate. It's completely possible to have a model with a reduced error rate which lowers revenue, due to Simpson's paradox and a host of other reasons."

The author of this post hasn't really considered these questions, and gets all hand-wavey about precision and recall vs. confusion matrices. How do you know that any of these are what you _really_ care about?

So: What's the value of a false positive? What's the value of a false negative?

Here's where it gets interesting. For airport screening, one person might say that a false negative (terrorist slips through and kills 100 people) is 100M times worse than a false positive (I strip-search an innocent person). So this person has made a value judgment that the death of a random innocent person is 1 million times worse than humiliating an innocent person. The TSA, on the other hand, decides that a false negative is 100B times worse than a false positive, so they assign 1000 times as much value to catching terrorists vs. humiliating people as the other person.

Who's right? It's a value judgment, and machine learning can't answer that.

What I'm getting at here is that the choice of a loss function is ultimately an _aesthetic_ decision. Once we can optimize loss perfectly, what loss will we optimize?

<comment><USER3> I used to build fraud models where we had insane amounts of negative data and precious positive data. Our performance metric was well-reasoned; as you mention, we cared about the happiness of our customer, and baked all sorts of useful information into our evaluation metrics.

The problem is there is not always a cheap way to encode a complex evaluation metric into a loss function for many machine learning algorithms. In fact most of the really popular algorithms are popular because they work well mathematically - for example, generalized linear models are convex on a simple quadratic loss function, and neural networks have gradients when their loss functions are differentiable.

Also, I found optimizing for simple but sensible loss functions often gave pretty good performance. From a practical perspective, most of the gains of understanding the performance metrics we cared about came in the data preparation, evaluation and calibration stages of modeling, not model selection or training.

</comment></comment><comment><USER4> Another trick I've seen in biomedical data mining is synthesizing new samples from the under-represented class (using an algorithm like SMOTE).

</comment><comment><USER5> Another option could be to use an ensemble of exemplar svms [1], essentially training separate classifiers with a single target row set to 1 and all others to 0. This can be useful when trying to pick out examples that match a very specific pattern.

[1] <http://www.cs.cmu.edu/~tmalisie/projects/iccv11/>

</comment><comment><USER6> Good post on the exact problem I ran into when developing a machine learning algorithm to identify rule violations (basically fraud) based on self-reported descriptive text data. The few records that are "fraud" are precious from a training standpoint.

I found it helpful to start by over-representing the rare class and then slowly bring the balance back to the observed percentages.

The main reason for my over-representation of the rare class was that rare case was often not correctly identified (many false negatives) in the so- called "Gold Standard" training data. By over-representing the rare case, I was able to build a better training set while tuning your algorithm.

I'd be interested to hear if others flush out false positives in a similar/different manner (for the Skewed/Rare Class problems described by the article).

</comment><comment><USER7> One thing that may work well here is to train two models and ask which fits the data better (likelihood). Or, to leverage the full weight of the data in training submodels and then leverage that in the classifiers.

Fraud is particularly difficult though, because the entities are actively trying to thwart your attempts to detect them. Outlier detection is a must certainly. Collective entity resolution helps a lot too. It might even be worth seeing if you can use LDA to cluster the fraudsters together.

It's just not a domain suited to simple models or a singular approach.

</comment><comment><USER8> Precision and recall are a great way of looking at overall accuracy, but ROC curves and ROC AUC are highly recommended for model selection criteria on imbalnced datasets. For SVMs you can do a two dimensional grid search for C and Gamma looking for a maximum ROC.

I also use per class weights - by default SVM(libSVM, libLinear) cost parameter is the same for both classes. Penalize the classifier for false negatives more then for false positives(order of magnitude more).

</comment><comment><USER9> Totally new field for me, very interesting thoughts :)

</comment><comment><AUTHOR> hooande, thanks for the additional info. I'll definitely take a closer look at it.

</comment><comment><USER10> How about

\- make your classifier get to 100% accuracy (or close enough).

Also, do it automatically

\- use a unsupervised learning stage - then a simple a classifier (so you don't overfit). Repeat, growing the size of your unsupervised, followed by simple classifier, until you get 100%.

<comment><USER11> That approach is almost exactly that of Deep Learning / stacked Restricted Boltzmann Machines.

<comment><USER10> yeah, exactly</comment></comment></comment>


SocialURL Launches - Bebo, MySpace, YouTube and More in One Place - <AUTHOR> http://mashable.com/2007/03/05/socialurl/ <comment><AUTHOR> Here is another service meant to address the difficulties in managing your fragmented web identity. There hasn't been anything really great yet, so we'll have to see how SocialURL does.

With so many serve options cropping up at rapid rates, whoever truly solves the problem of getting your identity together has a hit on their hands.

I've mentioned OpenID in some discussions on here... now I'm talking about taking it a step further.</comment>


Hospitals Tell Doctors They'll Be Fired If They Speak Out About Lack of Gear - <AUTHOR> https://www.bloomberg.com/news/articles/2020-03-31/hospitals-tell-doctors-they-ll-be-fired-if-they-talk-to-press <comment><USER2> Shit, I'd be like fire me...

It's way too easy in this environment for people to act selfishly. I don't giving people excuse is the way to go.</comment>


Enviromental Scientist's Lecture about the Viable Strategies for Decarbonization - <AUTHOR> https://mediasite.engr.wisc.edu/Mediasite/Play/f77cfe80cdea45079cee72ac7e04469f1d <comment><USER2> [video]</comment>


Ask HN: What to do if i only manage to attract goldiggers? - <AUTHOR> I am a newly minted tech wealthy. I only manage to attract goldiggers. I am looking for serious advises from post tech noveu rich folks. <comment><USER2> Stop acting like a 'nouveau rich' \- that is like dead meat to gold digging flies... What kind of car do you drive etc ... Notice how the rich usually dress down in casually public places - shopping etc. Avoid live-in girls, amazing how soon them are common law wives after a while. Never allow a girl to change her address to yours because she moves so often. After 2 years she can point to her drivers licence etc as proof she lived with you for many years, and btw = half of what you have...

</comment><comment><USER3> Unless you're a celebrity, the only thing people know about you is what you tell them.

</comment><comment><USER4> I would guess that you're spending a lot of time, angst and money on your 'image': flash watch, flash clothes, flash car, flash house. That's just normal for the "newly minted .... wealthy."

People who are born to money never need to display it. They have the quiet confidence that it's there when they want to use it, and never need to 'prove something'.

So their clothes are very often not flash, and maybe even a good brand that was picked up cheap at a Goodwill Store.

They might drive a good but quite old car that isn't/wasn't 'top of range' like maybe a 5-year-old Mercedes C-class. Why have an extra-expensive sports car? The C-Class is good enough for local driving up to say 300 miles. Anything further and you travel by air and very probably in Business Class.

</comment><comment><USER5> Maybe try to meet people in non-professional contexts - I met my girlfriend via a language learning group, for example.

We were already friends before she knew what I did and certainly very good friends before she had any idea of my salary.

That said I'm not 'noveau-rich' just well-paid for my age and area.

</comment><comment><USER6> What aspects of your personality would be appealing to a partner even if you were broke? Cultivate those.</comment>


Encrypted EBS Boot Volumes - <AUTHOR> https://aws.amazon.com/blogs/aws/new-encrypted-ebs-boot-volumes/ <comment><USER2> Anybody know the performance cost of enabling encryption on boot volumes? Interested in enabling encryption on our database volumes.

</comment><comment><USER3> I think this could be big for environments that require it.

 _The stored data is encrypted, as is the data transfer path between the EBS volume and the EC2 instance. The data is decrypted on the instance on an as- needed basis, then stored only in memory._</comment>


75,000 Popcorn Time users will be getting a surprise in the mail this fall - <AUTHOR> http://thenextweb.com/insider/2015/08/25/75000-popcorn-time-users-will-be-getting-a-surprise-in-the-mail-this-fall/

<comment><USER2> TF article has a little more information and background: [https://torrentfreak.com/75000-popcorn-time-users-in- crossha...](https://torrentfreak.com/75000-popcorn-time-users-in-crosshairs- of-anti-piracy-group-150825/)</comment>


Ask HN: How do you notify your readers when you blog? - <AUTHOR> In the past I have allowed readers to provide their email address to receive new-post notifications, however I discontinued this as I don't want the responsibility of storing private user data. <comment><USER2> Tweet

</comment><comment><USER2> Rss

<comment><AUTHOR> I provide a feed but how many people actually use RSS these days? I personally use IFTTT to forward RSS feed updates to my inbox, but I don't use a traditional RSS reader.</comment></comment>


Zero-Day Vulnerability in Microsoft Windows Leaked on Twitter - <AUTHOR> https://twitter.com/SandboxEscaper/status/1034125195148255235 <comment><USER2> Here's the exploit description from the writeup .doc file that is included in the .rar file that's hosted on GitHub:

      The task scheduler service has an alpc endpoint, supporting the method "SchRpcSetSecurity".
      The prototype looks like this:

    	long _SchRpcSetSecurity(
    		[in][string] wchar_t* arg_1, //Task name
    		[in][string] wchar_t* arg_2, //Security Descriptor string
    		[in]long arg_3);

      Tasks created by the task scheduler will create a corresponding folder/file in c:\windows\system32\tasks.
      This function seems to be designed to write the DACL of tasks located there, and will do so while impersonating.

      However, for some reason it will also check if a .job file exists under c:\windows\tasks and try to set the DACL
      while not impersonating.

      Since a user, and even a user belonging to the guests group can create files in this folder, we can simply create
      a hardlink to another file (all we need is read access).
      Because of the hardlink, we can let the task scheduler write an arbitrary DACL
      (see second parameter of SchRpcSetSecurity) to a file of our choosing.

      So any file that we have read access over as a user and that system has the write DACL permission for,
      we can pivot into full control and overwrite it.

<comment><USER3> Please don't quote text with code blocks:

> _The task scheduler service has an alpc endpoint, supporting the method > "SchRpcSetSecurity". The prototype looks like this:_

        long _SchRpcSetSecurity(
            [in][string] wchar_t* arg_1, //Task name
            [in][string] wchar_t* arg_2, //Security Descriptor string
            [in]long arg_3);

> _Tasks created by the task scheduler will create a corresponding folder > /file in c:\windows\system32\tasks. This function seems to be designed to > write the DACL of tasks located there, and will do so while impersonating._

> _However, for some reason it will also check if a .job file exists under > c:\windows\tasks and try to set the DACL while not impersonating._

> _Since a user, and even a user belonging to the guests group can create > files in this folder, we can simply create a hardlink to another file (all > we need is read access). Because of the hardlink, we can let the task > scheduler write an arbitrary DACL (see second parameter of > SchRpcSetSecurity) to a file of our choosing._

> _So any file that we have read access over as a user and that system has the > write DACL permission for, we can pivot into full control and overwrite it._

<comment><USER4> Please don't repost other user's posts, because you have a formatting preference.

<comment><USER5> He didn't post the other user post again, but rather posted the original text from the writeup again.

</comment></comment></comment></comment><comment><USER6> Quote from blog post[1] dated 14th June:

        I really did not get anything for this bug, and I know I'm probably forfeiting an acknowledgement
        too right now. But I wasted alot of time on this bug, and nobody but me should be able to decide
        what to do with it. People who criticize this type of behavior I find frankly annoying.
        I used to be one of those self-righteous types, but I'm also pretty annoying, so perhaps there is a correlation.

        Besides, this bug is way to silly in its complexity to be of any use to anyone.
        I would not drop a full 0day exploit, which I can assure you,
        I have totally sitting on my hard drive (not referring to this bug :).

For the people wondering why she released the exploit instead of claiming bounty on it, in the blog post[1] dated 14th June, she said she would not drop a full 0day exploit. I guess that changed when she did not get credit for her last bug (cve-2018-8314) according to her another blog post[2] from Aug 17th.

[1] [https://sandboxescaper.blogspot.com/2018/06/using- filepicker...](https://sandboxescaper.blogspot.com/2018/06/using-filepickers- to-escape-sandboxes.html)

[2] [https://sandboxescaper.blogspot.com/2018/08/all-good- things-...](https://sandboxescaper.blogspot.com/2018/08/all-good-things-must- come-to-end.html)

<comment><USER7> Fixed:

> I really did not get anything for this bug, and I know I'm probably > forfeiting an acknowledgement too right now. But I wasted alot of time on > this bug, and nobody but me should be able to decide what to do with it. > People who criticize this type of behavior I find frankly annoying. I used > to be one of those self-righteous types, but I'm also pretty annoying, so > perhaps there is a correlation.

> Besides, this bug is way to silly in its complexity to be of any use to > anyone. I would not drop a full 0day exploit, which I can assure you, I have > totally sitting on my hard drive (not referring to this bug :).

</comment></comment><comment><USER8> "Here is the alpc bug as 0day: [https://github.com/SandboxEscaper/randomrepo/blob/master/PoC...](https://github.com/SandboxEscaper/randomrepo/blob/master/PoC- LPE.rar) … I don't fucking care about life anymore. Neither do I ever again want to submit to MSFT anyway. Fuck all of this shit."

So is this person upset because Microsoft wouldn't patch the bug? Or that they didn't want to pay for the information?

Comments seem to reference Apple pays 25k for this type of info.

Can anyone with background give some context here?

<comment><USER9> Earlier tweets from this account seem to indicate they believe MS intentionally sabotaged the process so that they could sell the bugs, including to oppressive governments:

[https://twitter.com/SandboxEscaper/status/103411618937352192...](https://twitter.com/SandboxEscaper/status/1034116189373521920)

[https://twitter.com/SandboxEscaper/status/103411292604562227...](https://twitter.com/SandboxEscaper/status/1034112926045622274)

 _EDIT_ as @dixie_land points out, it appears the author is open to selling indiscriminately.

<comment><USER10> _Please see[https://news.ycombinator.com/item?id=17860480](https://news.ycombinator.com/item?id=17860480) before downvoting._

From her website - [http://sandboxescaper.blogspot.com](http://sandboxescaper.blogspot.com):

> I'm also transgender. But my transition so far has been really difficult > (social isolation, lack of support.. etc), my voice is still really manly > and I don't really pass at all (which probably weirds people out.. so I > would rather say it upfront so I don't need to have anxiety about it, I have > alot of anxiety issues). I also have not been able to change my name yet, > legally its still "Thomas".

\- - -

w.r.t. the 0-day release: Well that's some seriously irresponsible stuff right there.

I think she has a tough time (she's transgender and doesn't have support from her peers). It's sad that she hasn't found a way to live a happy life although she clearly has serious skills. I hope she'll be fine.

It's just annoying that a lot of users are now at risk, I hope the patches will be installed ASAP.

<comment><USER11> Full disclosure is not "irresponsible", and plenty of researchers do it even in the absence of armchair psychoanalysis by the Internet.

<comment><USER10> Most of them follow specific timelines for those disclosures which are communicated with the affected vendor.

<comment><USER12> And also don't follow up a disclosure with an offer to sell exploits to the highest bidder.

Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)

<comment><USER13> If you sold to a country with standing sanctions, that could be an issue. 0-day's can also be considered munitions in some interpretations of law, though I am not a lawyer nor a weapons dealer.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> I'm always curious about the individuals discovering these zero day vulnerabilities.

What framework do they use to find it? Is it just educated trial and error until you hit something?

<comment><USER15> Fuzzers[1] as well as reverse engineering tools. For fuzzers there is both the publicly available ones like AFL [2] and custom/closed source ones. It seems to me every zero day author has their own fuzzers or fuzzing frameworks or at least a closed fork of an open source fuzzer. But to me finding the bug is less difficult then turning it into an exploit. Shoot you can still find bugs in modern software by bit flipping, as an example I wrote a fuzzer that opened up random PDF files and flipped some bits at random and then opened them with Preview. it did this about 40,000 times a day and after a couple days I would come back and my mac had kernel panicked. Now turning one of these PDF files that cause kernel panics into an exploit is going to require significantly more effort then writing and running a dumb fuzzer.

[1]: [https://en.wikipedia.org/wiki/Fuzzing](https://en.wikipedia.org/wiki/Fuzzing)

[2]: [https://en.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer)](https://en.wikipedia.org/wiki/American_fuzzy_lop_\(fuzzer\))

<comment><USER14> wow....that is pretty interesting. how do you write your own fuzzer, seems like that's where the edge comes from? How much more of an effort is it to write an exploit? Is it necessary to build a Proof of Concept or is simply disclosing the vulnerability enough?

If I buy ADA what software/API can I start tinkering with?

What you described seems like so much fun but scared of the writing exploit part. Now that seems really hard especially considering it needs to be fully undetectable for a long time until the buyer gets their return on investment.

Is there a course or resource I can use to begin this path?

I love love poking around with things to see how they work....basically the chase or the process is what I enjoy most and curious to know more.

How did you get into all of this?

<comment><USER15> > wow....that is pretty interesting. how do you write your own fuzzer, seems > like that's where the edge comes from? How much more of an effort is it to > write an exploit? Is it necessary to build a Proof of Concept or is simply > disclosing the vulnerability enough?

Dumb fuzzers can be written in anywhere from a day to a few weeks of work, smart fuzzers can take several years to write, also lots of fuzzers continually evolve over time because they have to. Its the Red queen effect[1], fuzzers keep finding bugs so they have to keep getting better to keep finding harder and harder to find bugs in a target codebase. So I would say an exploit is usually the harder task but some of the things smart fuzzers like SAGE[2] do would be incredibly hard to implement.

> If I buy ADA what software/API can I start tinkering with?

I'm not sure what ADA is. However for testable software I would go for programs that come installed on your operating system of choice. So in my case I was using MacOS at the time so I was targeting MacOS default applications.

> What you described seems like so much fun but scared of the writing exploit > part. Now that seems really hard especially considering it needs to be fully > undetectable for a long time until the buyer gets their return on > investment.

Fuzzer development and exploit development are pretty different tasks. Fuzzer development is basically normal software development, while exploit development at least with security mitigations turned on is an entirely different beast. For example in exploit development your going to need to know x86-64 assembly, as well as general memory layout, how a particular operating system implements ASLR[3] so you can bypass that. As well as bypassing DEP/NX[4] which is often done using ROP[5] and now recently newer techniques[6]. The fuzzer I was describing above was a dumb file mutation fuzzer which can be extremely simple. So first it was a file fuzzer, meaning it fuzzed programs that take files as inputs, stuff like video and music players or in my case pdf files. The mutation part means the fuzzer took existing valid files and added random mutations as opposed to generative fuzzers that build semi valid files from scratch. The dumb part means it didn't do cool stuff like AFL that use a genetic algorithm and probe system to better test code paths in a target program.

> Is there a course or resource I can use to begin this path?

Search fuzzers online until you've seen every/most pages, no joke thats basically what I did theres a few books but most of the info they have can be found online for free. Also make sure to try building a fuzzer or two, go simple at first. As well as using existing opensource fuzzers like AFL, Trinity and syzkaller.

> How did you get into all of this?

I forget how I got into fuzzing but I did try and start a fuzzing company a few years ago, but it turns out its way easier making money doing web development then selling fuzzing software or doing bug bounties for a living.

[1]: [https://en.wikipedia.org/wiki/Red_Queen_hypothesis](https://en.wikipedia.org/wiki/Red_Queen_hypothesis)

[2]: [https://patricegodefroid.github.io/public_psfiles/SAGE- in-1s...](https://patricegodefroid.github.io/public_psfiles/SAGE-in-1slide- for-PLDI2013.pdf)

[3]: [https://en.wikipedia.org/wiki/Address_space_layout_randomiza...](https://en.wikipedia.org/wiki/Address_space_layout_randomization)

[4]: [https://support.microsoft.com/en- us/help/875352/a-detailed-d...](https://support.microsoft.com/en- us/help/875352/a-detailed-description-of-the-data-execution-prevention-dep- feature-in)

[5]: [https://en.wikipedia.org/wiki/Return- oriented_programming](https://en.wikipedia.org/wiki/Return- oriented_programming)

[6]: [https://www.endgame.com/blog/technical-blog/rop-dying-and- yo...](https://www.endgame.com/blog/technical-blog/rop-dying-and-your-exploit- mitigations-are-life-support)

</comment></comment></comment></comment><comment><USER16> Ah, the old "trick a system process into overwriting a link destination" ploy. That used to be a popular exploit method on UNIX in the 1980s.

<comment><USER17> It still is a common vulnerability on *NIX

</comment></comment><comment><USER18> Yikes, that's a nasty one. Sad MSFT didn't want to pay bounty on this.

</comment><comment><USER19> Exactly how terrified should I be right now?

<comment><USER20> Not terribly terrified. At best it seem to be a Medium IL to SYSTEM. In other words a slightly better UAC bypass than most, but I don't think you can use it to escape from a browser sandbox for example.

<comment><USER21> People always seem to overlook this distinction... escalating admin privileges is typically one of the easier things for a hacker to do. Getting in is the harder part (ie, remote/browser exploits, etc).

<comment><USER22> (Hey dmix; hangs soon?)

I'm not really sure if that is true. Adobe exploits are pretty cheap and unless your target is in software you can usually get a click on a link one way or another.

Really, to me, the hard part is getting in without needing to have the user consciously do _anything_ since then you're in and nobody could even have noticed you doing something.

<comment><USER21> > Really, to me, the hard part is getting in without needing to have the user > consciously do anything

That's why I said remote/browser, everything else is noisy and therefore the 'easy' route. Usually this is sufficient for low tech nation states because they attack organizations not individuals, so all you need is a weak human link where noisey isn't a big deal. Then moving horizontally across the organization.

But more importantly OS are terribly insecure and privesc bugs are a dime a dozen. You don't need zero days to achieve that the vast majority of the time.

<comment><USER22> Yeah, sorry, a no-click / _remote_ exploit is hard. I agree with you there.

But a _browser_ exploit isn't. They're a dime a dozen. Also, I'm surprised that email is still a primary vector that's used to get people to click on links with their work computer. It seems like such a monitored method compared to, say, a LinkedIn contact.</comment></comment></comment></comment></comment></comment>


Apple baby Aza Raskin on the secrets of great User Interface - <AUTHOR> http://thenextweb.com/video/2011/05/10/apple-baby-aza-raskin-on-the-secrets-of-great-user-interface/ <comment><USER2> That was incredibly insightful. I really liked the comments about Warrior Scholars.</comment>


Twitter Bootstrap 2.0 Released - <AUTHOR> http://twitter.github.com/bootstrap/?20 <comment><USER2> duplicate: <http://news.ycombinator.com/item?id=3536291>

</comment><comment><USER3> According to their bug tracker the issue with Popover not accepting string constants as title/content has been solved. I'll be moving to 2.0 right away, or at least trying to shim that fix into my own project. Should take care of a bug I've been battling for the last few hours.

<comment><USER4> Had the same issue, was a super easy (one-line) fix in bootstrap-popover.js though.</comment></comment>


Ask HN: US based iphone developers (companies or individuals). Anyone? - <AUTHOR>

Do you know some US based iphone developers (companies or individuals)?
Looking to develop an application but don't want to start learning yet another programming language...
Thank you. <comment><USER2> What kind of application you want to develop? We are NY based company developing iPhone apps. We have currently 24 apps on the appstore. You can click on my nickname for more information.

</comment><comment><USER3> US based iphone developer = you'll be paying out of the ass for a simple app. Unless you are expecting your app to net you at least 6 figures, it's pretty much not worth it.

You should do a sponsorship instead. Throw up a figure, and let a developer who isn't an iphone developer do the job. The developer gets to learn a new language, while getting paid. And you don't end up spending a ton of money. Win/win for everyone</comment>


Ask HN: Best Anti-Virus/Security Set Up for Seniors? - <AUTHOR> What security setup do your recommend for seniors on windows based systems? Without having a fully managed setup is there some combination of security settings or programs that alleviates most potential problems seniors are likely to encounter using a typical windows computer. <comment><USER2> Microsoft Security Essentials. Free, auto-updating, and you forever avoid the extortionist dinning renewal scare tactics of the commercial products.

</comment><comment><USER3> My 2 cents; ironically I can speak from a bit of experience as this question is one I encounter daily. I am Co-Founder of a company which is owned and influenced by a "senior" for "seniors" this exact topic was the main source of our inspiration to start our company. The owner of the company we co-founded 6-7 years ago was our Mom Mrs. Burger – the sweetest, most caring, and moral woman! No joke… she has a big influence on our company culture and moral mission to help seniors, help themselves with antivirus security software and overall technical maintenance of devices. Over the years we built a very loyal customer base of mainly seniors and other age groups as well, it was a slow and but steady process but once we built a foundation of about 1,000 customers we realized that we had something special. I look back over the years and can honestly say that by simply doing the right thing, by having a genuine interest providing honest help to those who are willing to help themselves with regards to antivirus software's, cyber-security solutions and data protection processes or just general maintenance, the KEY I recommend for seniors using Windows based systems, without having a fully managed system or semi-managed system for support services would be as follows without giving away to much.

1.We made a conscious choice to invest our greatest asset our "time", up-front without expecting anything in return. We educate, empower and assist the senior on exactly what they need to know to be safe. Most importantly above all else you must have patience when dealing with seniors, I have found seniors pay attention very well if they find it important or critical, that's why it's best to start small and build action-by-action while guiding them step-by-step over time, do not overwhelm them trying to complete everything upfront. Mind your manners and be polite.

2\. We actually decided developed our own antivirus software. It was designed to be very easy to use, keeping it super simple to operate without support, the antivirus software provides complete security 365 days a year, In addition our software was designed to work well with legacy technology and older models of tech and the antivirus software will run/operate at the same time any other antivirus software is running allowing the user a redundancy or secondary solution to ensure nothing is missed. Also we find seniors really do NOT like using "the cloud".

3.After running cyber-security antivirus software which is FREE for 14-days so basically risk-free we begin the real practical application of our process. This the data protection portion of the cyber-security process, we have document processing tool that we show the senior how to use to complete either fraud alert or security freeze depending on each of the 3 major credit bureaus, depending on specific assessment questions we can determine what actions need to be taken to ensure a seniors identity is protected. It is super important to know the difference in the two types of alert that can be added.

4.Then taking the time again after providing complete report logs of the deep scans, defrags or system optimizations and carefully explaining the report log to the senior and after taking action to secure your credit reports and data with the 3 major credit bureaus, the next stage would be to secure your password for all sites suchs as FB,gmails, online banking ect ect, using systems and or tools such as LastPass which also comes with cool usb key from yubico key. You can easily google them.

In short I suppose that no one solution is the BEST ANTIVIRUS/Security Set-up for seniors as is the same with all other age groups or organizations. Cyber- security and Data protection doesn't just start and stop when you turn on and off your online devices. It starts with people who are willing to take action and personal responsibility for how they use internet, how they understand the hardware being used and the best ways to stay safe and secure with your data online. At the end of the day seniors who can delegate or collaborate simply want peace-of-mind.

Check us out [https://www.ms365security.com/](https://www.ms365security.com/) or [https://www.mainsource365.com/](https://www.mainsource365.com/)

<comment><USER4> Hey BeReADY, thanks for the awesome reply to this thread. I really appreciate your efforts to write a detailed and helpful response to the question. You guys are awesome and also your company. I must try to download your software and possibly make a blog out of it. Thanks.</comment></comment>


Show HN: Universal Login System for websites - <AUTHOR> http://ukey.one/demo/ <comment><USER2> And this is different/better than the google/facebook universal logins how?

<comment><AUTHOR> Thank you for your comment. Let me tell you a few pros:

\- You can integrate Google and Facebook directly, or integrate Ukey1 and get all in one.

\- Especially with Facebook, you need to follow API changes, but if you have Ukey1 - you don't need to care about it - we care. For example a week ago, one of my friends told me that Facebook changed something and since that time FB login doesn't work on his website - he still waits for his developers to fix it). Other example - pixabay.com - their FB login doesn't work at least for 6 months.

\- There are people who don't want to use social logins. If you don't want to loose those users, you need to implement email/password option as well. It means, you need to store passwords in your database and care about authentication. Ukey1 offers social logins (Google, Facebook, LinkedIn) as well as classic email/password option. It means, no barriers.

\- As a user, with Ukey1 you have absolutely full control over your personal data you share. It's not possible with Google or Facebook. And this is just a beginning.

\- As a user, you can merge all your social identities. Why? For example, very often I have a problem that after some time I can't remember what social account I previously used on different websites. And I am not alone.

\- And finally, are you familiar with new General Data Protection Regulation in EU? If you collect personal data about European citizens, you should. Ukey1 will solve all technical aspects for you, Facebook nor Google not.

</comment></comment><comment><USER3> No SSL. Ouch

<comment><AUTHOR> Thanks for your comment. There is no reason for HTTPS on our demo page because there are no secret transmissions there. Actually, this demo shows that our solution may be used on every kind of website even they don't use HTTPS. Of course, authentication itself and all API calls are via HTTPS.</comment></comment>


Compress your DSLR videos 4.5x (OS X bash script) - <AUTHOR> https://gist.github.com/redeemedfadi/d1cbbad63abe102c4db7

<comment><USER2> This is a nice script. If you write a blog post about what you do, why you wrote the script, and how it it works, I bet people on HN will want to read about it.</comment>